Series comparison

-[Qemu-devel] [PULL 00/12] target-arm queue
+[PULL 00/36] target-arm queue
-target-arm queue: mostly aspeed changes from Cédric.
+Hi; here's another arm pullreq; by volume most of this is
 refactoring from me, but there are also some bugfixes and
 other bits and pieces here.
 thanks
 -- PMM
-The following changes since commit 85182c96de61f0b600bbe834d5a23e713162e892:
+The following changes since commit ed734377ab3f3f3cc15d7aa301a87ab6370f2eed:
-  Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20190912a' into staging (2019-09-13 14:37:48 +0100)
+  Merge tag 'linux-user-fix-gupnp-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2025-01-24 14:43:07 -0500)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190913
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250128-1
-for you to fetch changes up to 27a296fce9821e3608d537756cffa6e43a46df3b:
+for you to fetch changes up to 664280abddcb3cacc9c6204706bb739fcc1316f7:
-  qemu-ga: Convert invocation documentation to rST (2019-09-13 16:05:01 +0100)
+  hw/usb/canokey: Fix buffer overflow for OUT packet (2025-01-28 18:40:19 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * aspeed: add a GPIO controller to the SoC
+ * hw/arm: Remove various uses of first_cpu global
- * aspeed: Various refactorings
+ * hw/char/imx_serial: Fix reset value of UFCR register
- * aspeed: Improve DMA controller modelling
+ * hw/char/imx_serial: Update all state before restarting ageing timer
- * atomic_template: fix indentation in GEN_ATOMIC_HELPER
+ * hw/pci-host/designware: Expose MSI IRQ
- * qemu-ga: Convert invocation documentation to rST
+ * hw/arm/stellaris: refactoring, cleanup
  * hw/arm/stellaris: map both I2C controllers
  * tests/functional: Add a test for the arm microbit machine
  * target/arm: arm_reset_sve_state() should set FPSR, not FPCR
  * target/arm: refactorings preparatory to FEAT_AFP implementation
  * fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
  * fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
  * hw/usb/canokey: Fix buffer overflow for OUT packet
 ----------------------------------------------------------------
-Christian Svensson (1):
+Bernhard Beschow (3):
-      aspeed/smc: Calculate checksum on normal DMA
+      hw/char/imx_serial: Fix reset value of UFCR register
       hw/char/imx_serial: Update all state before restarting ageing timer
       hw/pci-host/designware: Expose MSI IRQ
-Cédric Le Goater (7):
+Hongren Zheng (1):
-      aspeed: Remove unused SoC definitions
+      hw/usb/canokey: Fix buffer overflow for OUT packet
       aspeed: Use consistent typenames
       aspeed/smc: Add support for DMAs
       aspeed/smc: Add DMA calibration settings
       aspeed/smc: Inject errors in DMA checksum
       aspeed/scu: Introduce per-SoC SCU types
       aspeed/scu: Introduce a aspeed_scu_get_apb_freq() routine
-Emilio G. Cota (1):
+Peter Maydell (22):
-      atomic_template: fix indentation in GEN_ATOMIC_HELPER
+      target/arm: arm_reset_sve_state() should set FPSR, not FPCR
       target/arm: Use FPSR_ constants in vfp_exceptbits_from_host()
       target/arm: Use uint32_t in vfp_exceptbits_from_host()
       target/arm: Define new fp_status_a32 and fp_status_a64
       target/arm: Use vfp.fp_status_a64 in A64-only helper functions
       target/arm: Use fp_status_a64 or fp_status_a32 in is_ebf()
       target/arm: Use fp_status_a32 in vjvct helper
       target/arm: Use fp_status_a32 in vfp_cmp helpers
       target/arm: Use FPST_A32 in A32 decoder
       target/arm: Use FPST_A64 in A64 decoder
       target/arm: Remove now-unused vfp.fp_status and FPST_FPCR
       target/arm: Define new fp_status_f16_a32 and fp_status_f16_a64
       target/arm: Use fp_status_f16_a32 in AArch32-only helpers
       target/arm: Use fp_status_f16_a64 in AArch64-only helpers
       target/arm: Use FPST_A32_F16 in A32 decoder
       target/arm: Use FPST_A64_F16 in A64 decoder
       target/arm: Remove now-unused vfp.fp_status_f16 and FPST_FPCR_F16
       fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
       fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
       fpu: Fix a comment in softfloat-types.h
       target/arm: Remove redundant advsimd float16 helpers
       target/arm: Use FPST_A64_F16 for halfprec-to-other conversions
-Peter Maydell (1):
+Philippe Mathieu-Daudé (9):
-      qemu-ga: Convert invocation documentation to rST
+      hw/arm/nrf51: Rename ARMv7MState 'cpu' -> 'armv7m'
       hw/arm/stellaris: Add 'armv7m' local variable
       hw/arm/v7m: Remove use of &first_cpu in machine_init()
       hw/arm/stellaris: Link each board schematic
       hw/arm/stellaris: Constify read-only arrays
       hw/arm/stellaris: Remove incorrect unimplemented i2c-0 at 0x40002000
       hw/arm/stellaris: Replace magic numbers by definitions
       hw/arm/stellaris: Use DEVCAP macro to access DeviceCapability registers
       hw/arm/stellaris: Map both I2C controllers
-Rashmica Gupta (2):
+Thomas Huth (1):
-      hw/gpio: Add basic Aspeed GPIO model for AST2400 and AST2500
+      tests/functional: Add a test for the arm microbit machine
       aspeed: add a GPIO controller to the SoC
- Makefile                      |  24 +-
+ MAINTAINERS                           |   1 +
- hw/gpio/Makefile.objs         |   1 +
+ hw/usb/canokey.h                      |   4 --
- accel/tcg/atomic_template.h   |   2 +-
+ include/fpu/softfloat-types.h         |  10 +--
- include/hw/arm/aspeed_soc.h   |   4 +-
+ include/hw/arm/fsl-imx6.h             |   4 +-
- include/hw/gpio/aspeed_gpio.h | 100 +++++
+ include/hw/arm/fsl-imx7.h             |   4 +-
- include/hw/misc/aspeed_scu.h  |  21 +-
+ include/hw/arm/nrf51_soc.h            |   2 +-
- include/hw/ssi/aspeed_smc.h   |   7 +
+ include/hw/char/imx_serial.h          |   2 +-
- hw/arm/aspeed.c               |   2 +
+ include/hw/pci-host/designware.h      |   1 +
- hw/arm/aspeed_soc.c           |  63 ++-
+ target/arm/cpu.h                      |  12 ++--
- hw/gpio/aspeed_gpio.c         | 884 ++++++++++++++++++++++++++++++++++++++++++
+ target/arm/tcg/helper-a64.h           |   8 ---
- hw/misc/aspeed_scu.c          | 102 ++---
+ target/arm/tcg/translate.h            |  32 ++++++---
- hw/ssi/aspeed_smc.c           | 335 +++++++++++++++-
+ fpu/softfloat.c                       |   6 +-
- hw/timer/aspeed_timer.c       |   3 +-
+ hw/arm/b-l475e-iot01a.c               |   2 +-
- MAINTAINERS                   |   2 +-
+ hw/arm/fsl-imx6.c                     |  13 +++-
- docs/conf.py                  |  18 +-
+ hw/arm/fsl-imx7.c                     |  13 +++-
- docs/interop/conf.py          |   7 +
+ hw/arm/microbit.c                     |   2 +-
- docs/interop/index.rst        |   1 +
+ hw/arm/mps2-tz.c                      |   2 +-
- docs/interop/qemu-ga.rst      | 133 +++++++
+ hw/arm/mps2.c                         |   2 +-
- qemu-doc.texi                 |   5 -
+ hw/arm/msf2-som.c                     |   2 +-
- qemu-ga.texi                  | 137 -------
+ hw/arm/musca.c                        |   2 +-
-files changed, 1585 insertions(+), 266 deletions(-)
+ hw/arm/netduino2.c                    |   2 +-
- create mode 100644 include/hw/gpio/aspeed_gpio.h
+ hw/arm/netduinoplus2.c                |   2 +-
- create mode 100644 hw/gpio/aspeed_gpio.c
+ hw/arm/nrf51_soc.c                    |  18 ++---
- create mode 100644 docs/interop/qemu-ga.rst
+ hw/arm/olimex-stm32-h405.c            |   2 +-
- delete mode 100644 qemu-ga.texi
+ hw/arm/stellaris.c                    | 118 +++++++++++++++++++-----------
  hw/arm/stm32vldiscovery.c             |   2 +-
  hw/char/imx_serial.c                  |   7 +-
  hw/pci-host/designware.c              |   7 +-
  hw/usb/canokey.c                      |   6 +-
  target/arm/cpu.c                      |   6 +-
  target/arm/helper.c                   |   2 +-
  target/arm/tcg/helper-a64.c           |   9 ---
  target/arm/tcg/sme_helper.c           |   6 +-
  target/arm/tcg/sve_helper.c           |   6 +-
  target/arm/tcg/translate-a64.c        | 103 ++++++++++++++-------------
  target/arm/tcg/translate-sme.c        |   4 +-
  target/arm/tcg/translate-sve.c        | 130 +++++++++++++++++-----------------
  target/arm/tcg/translate-vfp.c        |  78 ++++++++++----------
  target/arm/tcg/vec_helper.c           |  22 +++---
  target/arm/vfp_helper.c               |  73 +++++++++++--------
  target/i386/tcg/fpu_helper.c          |   8 +--
  target/m68k/fpu_helper.c              |   2 +-
  target/mips/tcg/msa_helper.c          |   4 +-
  target/rx/op_helper.c                 |   4 +-
  target/tricore/fpu_helper.c           |   6 +-
  fpu/softfloat-parts.c.inc             |   4 +-
  hw/arm/Kconfig                        |   2 +
  tests/functional/meson.build          |   1 +
  tests/functional/test_arm_microbit.py |  31 ++++++++
 files changed, 452 insertions(+), 337 deletions(-)
  create mode 100755 tests/functional/test_arm_microbit.py

-[Qemu-devel] [PULL 06/12] aspeed/smc: Add DMA calibration settings
+[PULL 01/36] hw/arm/nrf51: Rename ARMv7MState 'cpu' -> 'armv7m'
-From: Cédric Le Goater <clg@kaod.org>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-When doing calibration, the SPI clock rate in the CE0 Control Register
+The ARMv7MState object is not simply a CPU, it also
-and the read delay cycles in the Read Timing Compensation Register are
+contains the NVIC, SysTick timer, and various MemoryRegions.
 set using bit[11:4] of the DMA Control Register.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Rename the field as 'armv7m', like other Cortex-M boards.
-Acked-by: Joel Stanley <joel@jms.id.au>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20190904070506.1052-7-clg@kaod.org
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20250112225614.33723-2-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/ssi/aspeed_smc.c | 64 ++++++++++++++++++++++++++++++++++++++++++++-
+ include/hw/arm/nrf51_soc.h |  2 +-
-file changed, 63 insertions(+), 1 deletion(-)
+ hw/arm/nrf51_soc.c         | 18 +++++++++---------
 files changed, 10 insertions(+), 10 deletions(-)
-diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
+diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/aspeed_smc.c
+--- a/include/hw/arm/nrf51_soc.h
-+++ b/hw/ssi/aspeed_smc.c
++++ b/include/hw/arm/nrf51_soc.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct NRF51State {
- #define   CTRL_CMD_MASK            0xff
+     SysBusDevice parent_obj;
- #define   CTRL_DUMMY_HIGH_SHIFT    14
- #define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
+     /*< public >*/
-+#define CE_CTRL_CLOCK_FREQ_SHIFT   8
+-    ARMv7MState cpu;
-+#define CE_CTRL_CLOCK_FREQ_MASK    0xf
++    ARMv7MState armv7m;
-+#define CE_CTRL_CLOCK_FREQ(div)                                         \
-+    (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT)
+     NRF51UARTState uart;
- #define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
+     NRF51RNGState rng;
- #define   CTRL_CE_STOP_ACTIVE      (1 << 2)
+diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
- #define   CTRL_CMD_MODE_MASK       0x3
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@
+--- a/hw/arm/nrf51_soc.c
- #define   DMA_CTRL_DELAY_SHIFT  8
++++ b/hw/arm/nrf51_soc.c
- #define   DMA_CTRL_FREQ_MASK    0xf
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
  #define   DMA_CTRL_FREQ_SHIFT   4
 -#define   DMA_CTRL_MODE         (1 << 3)
 +#define   DMA_CTRL_CALIB        (1 << 3)
  #define   DMA_CTRL_CKSUM        (1 << 2)
  #define   DMA_CTRL_WRITE        (1 << 1)
  #define   DMA_CTRL_ENABLE       (1 << 0)
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
      }
- }
+     /* This clock doesn't need migration because it is fixed-frequency */
+     clock_set_hz(s->sysclk, HCLK_FRQ);
-+static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask)
+-    qdev_connect_clock_in(DEVICE(&s->cpu), "cpuclk", s->sysclk);
-+{
++    qdev_connect_clock_in(DEVICE(&s->armv7m), "cpuclk", s->sysclk);
-+    /* HCLK/1 .. HCLK/16 */
+     /*
-+    const uint8_t hclk_divisors[] = {
+      * This SoC has no systick device, so don't connect refclk.
-+        15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0
+      * TODO: model the lack of systick (currently the armv7m object
-+    };
+      * will always provide one).
-+    int i;
+      */
-+
-+    for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) {
+-    object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container),
-+        if (hclk_mask == hclk_divisors[i]) {
++    object_property_set_link(OBJECT(&s->armv7m), "memory", OBJECT(&s->container),
-+            return i + 1;
+                              &error_abort);
-+        }
+-    if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) {
-+    }
++    if (!sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), errp)) {
 +
 +    qemu_log_mask(LOG_GUEST_ERROR, "invalid HCLK mask %x", hclk_mask);
 +    return 0;
 +}
 +
 +/*
 + * When doing calibration, the SPI clock rate in the CE0 Control
 + * Register and the read delay cycles in the Read Timing Compensation
 + * Register are set using bit[11:4] of the DMA Control Register.
 + */
 +static void aspeed_smc_dma_calibration(AspeedSMCState *s)
 +{
 +    uint8_t delay =
 +        (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
 +    uint8_t hclk_mask =
 +        (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
 +    uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask);
 +    uint32_t hclk_shift = (hclk_div - 1) << 2;
 +    uint8_t cs;
 +
 +    /*
 +     * The Read Timing Compensation Register values apply to all CS on
 +     * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays
 +     */
 +    if (hclk_div && hclk_div < 6) {
 +        s->regs[s->r_timings] &= ~(0xf << hclk_shift);
 +        s->regs[s->r_timings] |= delay << hclk_shift;
 +    }
 +
 +    /*
 +     * TODO: compute the CS from the DMA address and the segment
 +     * registers. This is not really a problem for now because the
 +     * Timing Register values apply to all CS and software uses CS0 to
 +     * do calibration.
 +     */
 +    cs = 0;
 +    s->regs[s->r_ctrl0 + cs] &=
 +        ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT);
 +    s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
 +}
 +
  /*
   * Accumulate the result of the reads to provide a checksum that will
   * be used to validate the read timing settings.
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_checksum(AspeedSMCState *s)
          return;
      }
-+    if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) {
+@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
-+        aspeed_smc_dma_calibration(s);
+     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart), 0);
-+    }
+     memory_region_add_subregion_overlap(&s->container, NRF51_UART_BASE, mr, 0);
-+
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart), 0,
-     while (s->regs[R_DMA_LEN]) {
+-                       qdev_get_gpio_in(DEVICE(&s->cpu),
-         data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
++                       qdev_get_gpio_in(DEVICE(&s->armv7m),
-                                     MEMTXATTRS_UNSPECIFIED, &result);
+                        BASE_TO_IRQ(NRF51_UART_BASE)));
      /* RNG */
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
      mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0);
      memory_region_add_subregion_overlap(&s->container, NRF51_RNG_BASE, mr, 0);
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->rng), 0,
 -                       qdev_get_gpio_in(DEVICE(&s->cpu),
 +                       qdev_get_gpio_in(DEVICE(&s->armv7m),
                         BASE_TO_IRQ(NRF51_RNG_BASE)));
      /* UICR, FICR, NVMC, FLASH */
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
          sysbus_mmio_map(SYS_BUS_DEVICE(&s->timer[i]), 0, base_addr);
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer[i]), 0,
 -                           qdev_get_gpio_in(DEVICE(&s->cpu),
 +                           qdev_get_gpio_in(DEVICE(&s->armv7m),
                                              BASE_TO_IRQ(base_addr)));
      }
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_init(Object *obj)
      memory_region_init(&s->container, obj, "nrf51-container", UINT64_MAX);
 -    object_initialize_child(OBJECT(s), "armv6m", &s->cpu, TYPE_ARMV7M);
 -    qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
 +    object_initialize_child(OBJECT(s), "armv6m", &s->armv7m, TYPE_ARMV7M);
 +    qdev_prop_set_string(DEVICE(&s->armv7m), "cpu-type",
                           ARM_CPU_TYPE_NAME("cortex-m0"));
 -    qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
 +    qdev_prop_set_uint32(DEVICE(&s->armv7m), "num-irq", 32);
      object_initialize_child(obj, "uart", &s->uart, TYPE_NRF51_UART);
      object_property_add_alias(obj, "serial0", OBJECT(&s->uart), "chardev");
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 11/12] atomic_template: fix indentation in GEN_ATOMIC_HELPER
+[PULL 02/36] hw/arm/stellaris: Add 'armv7m' local variable
-From: "Emilio G. Cota" <cota@braap.org>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+While the TYPE_ARMV7M object forward its NVIC interrupt lines,
-Signed-off-by: Emilio G. Cota <cota@braap.org>
+it is somehow misleading to name it 'nvic'. Add the 'armv7m'
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+local variable for clarity, but also keep the 'nvic' variable
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+behaving like before when used for wiring IRQ lines.
 Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20250112225614.33723-3-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- accel/tcg/atomic_template.h | 2 +-
+ hw/arm/stellaris.c | 21 +++++++++++----------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 11 insertions(+), 10 deletions(-)
-diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/atomic_template.h
+--- a/hw/arm/stellaris.c
-+++ b/accel/tcg/atomic_template.h
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
+      */
- #define GEN_ATOMIC_HELPER(X)                                        \
- ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
+     Object *soc_container;
--                 ABI_TYPE val EXTRA_ARGS)                           \
+-    DeviceState *gpio_dev[7], *nvic;
-+                        ABI_TYPE val EXTRA_ARGS)                    \
++    DeviceState *gpio_dev[7], *armv7m, *nvic;
- {                                                                   \
+     qemu_irq gpio_in[7][8];
-     ATOMIC_MMU_DECLS;                                               \
+     qemu_irq gpio_out[7][8];
-     DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
+     qemu_irq adc;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      qdev_prop_set_uint32(ssys_dev, "dc4", board->dc4);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(ssys_dev), &error_fatal);
 -    nvic = qdev_new(TYPE_ARMV7M);
 -    object_property_add_child(soc_container, "v7m", OBJECT(nvic));
 -    qdev_prop_set_uint32(nvic, "num-irq", NUM_IRQ_LINES);
 -    qdev_prop_set_uint8(nvic, "num-prio-bits", NUM_PRIO_BITS);
 -    qdev_prop_set_string(nvic, "cpu-type", ms->cpu_type);
 -    qdev_prop_set_bit(nvic, "enable-bitband", true);
 -    qdev_connect_clock_in(nvic, "cpuclk",
 +    armv7m = qdev_new(TYPE_ARMV7M);
 +    object_property_add_child(soc_container, "v7m", OBJECT(armv7m));
 +    qdev_prop_set_uint32(armv7m, "num-irq", NUM_IRQ_LINES);
 +    qdev_prop_set_uint8(armv7m, "num-prio-bits", NUM_PRIO_BITS);
 +    qdev_prop_set_string(armv7m, "cpu-type", ms->cpu_type);
 +    qdev_prop_set_bit(armv7m, "enable-bitband", true);
 +    qdev_connect_clock_in(armv7m, "cpuclk",
                            qdev_get_clock_out(ssys_dev, "SYSCLK"));
      /* This SoC does not connect the systick reference clock */
 -    object_property_set_link(OBJECT(nvic), "memory",
 +    object_property_set_link(OBJECT(armv7m), "memory",
                               OBJECT(get_system_memory()), &error_abort);
      /* This will exit with an error if the user passed us a bad cpu_type */
 -    sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
 +    sysbus_realize_and_unref(SYS_BUS_DEVICE(armv7m), &error_fatal);
 +    nvic = armv7m;
      /* Now we can wire up the IRQ and MMIO of the system registers */
      sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 09/12] aspeed/scu: Introduce per-SoC SCU types
+[PULL 03/36] hw/arm/v7m: Remove use of &first_cpu in machine_init()
-From: Cédric Le Goater <clg@kaod.org>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-and use a class AspeedSCUClass to define each SoC characteristics.
+When instanciating the machine model, the machine_init()
 implementations usually create the CPUs, so have access
 to its first CPU. Use that rather then the &first_cpu
 global.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20190904070506.1052-10-clg@kaod.org
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Samuel Tardieu <sam@rfc1149.net>
 Message-id: 20250112225614.33723-4-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/aspeed_scu.h | 15 +++++++
+ hw/arm/b-l475e-iot01a.c    | 2 +-
- hw/arm/aspeed_soc.c          |  3 +-
+ hw/arm/microbit.c          | 2 +-
- hw/misc/aspeed_scu.c         | 83 ++++++++++++++++++++----------------
+ hw/arm/mps2-tz.c           | 2 +-
-files changed, 64 insertions(+), 37 deletions(-)
+ hw/arm/mps2.c              | 2 +-
  hw/arm/msf2-som.c          | 2 +-
  hw/arm/musca.c             | 2 +-
  hw/arm/netduino2.c         | 2 +-
  hw/arm/netduinoplus2.c     | 2 +-
  hw/arm/olimex-stm32-h405.c | 2 +-
  hw/arm/stellaris.c         | 2 +-
  hw/arm/stm32vldiscovery.c  | 2 +-
 files changed, 11 insertions(+), 11 deletions(-)
-diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
+diff --git a/hw/arm/b-l475e-iot01a.c b/hw/arm/b-l475e-iot01a.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/aspeed_scu.h
+--- a/hw/arm/b-l475e-iot01a.c
-+++ b/include/hw/misc/aspeed_scu.h
++++ b/hw/arm/b-l475e-iot01a.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void bl475e_init(MachineState *machine)
+     sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
- #define TYPE_ASPEED_SCU "aspeed.scu"
- #define ASPEED_SCU(obj) OBJECT_CHECK(AspeedSCUState, (obj), TYPE_ASPEED_SCU)
+     sc = STM32L4X5_SOC_GET_CLASS(&s->soc);
-+#define TYPE_ASPEED_2400_SCU TYPE_ASPEED_SCU "-ast2400"
+-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0,
-+#define TYPE_ASPEED_2500_SCU TYPE_ASPEED_SCU "-ast2500"
++    armv7m_load_kernel(s->soc.armv7m.cpu, machine->kernel_filename, 0,
+                        sc->flash_size);
- #define ASPEED_SCU_NR_REGS (0x1A8 >> 2)
+     if (object_class_by_name(TYPE_DM163)) {
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
+diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
  extern bool is_supported_silicon_rev(uint32_t silicon_rev);
 +#define ASPEED_SCU_CLASS(klass) \
 +     OBJECT_CLASS_CHECK(AspeedSCUClass, (klass), TYPE_ASPEED_SCU)
 +#define ASPEED_SCU_GET_CLASS(obj) \
 +     OBJECT_GET_CLASS(AspeedSCUClass, (obj), TYPE_ASPEED_SCU)
 +
 +typedef struct  AspeedSCUClass {
 +    SysBusDeviceClass parent_class;
 +
 +    const uint32_t *resets;
 +    uint32_t (*calc_hpll)(AspeedSCUState *s);
 +    uint32_t apb_divider;
 +}  AspeedSCUClass;
 +
  #define ASPEED_SCU_PROT_KEY      0x1688A8A8
  /*
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
+--- a/hw/arm/microbit.c
-+++ b/hw/arm/aspeed_soc.c
++++ b/hw/arm/microbit.c
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void microbit_init(MachineState *machine)
-                                 &error_abort, NULL);
+     memory_region_add_subregion_overlap(&s->nrf51.container, NRF51_TWI_BASE,
                                          mr, -1);
 -    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
 +    armv7m_load_kernel(s->nrf51.armv7m.cpu, machine->kernel_filename,
 , s->nrf51.flash_size);
  }
 diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                                      mms->remap_irq);
      }
-+    snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
+-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
-     sysbus_init_child_obj(obj, "scu", OBJECT(&s->scu), sizeof(s->scu),
++    armv7m_load_kernel(mms->iotkit.armv7m[0].cpu, machine->kernel_filename,
--                          TYPE_ASPEED_SCU);
+, boot_ram_size(mms));
-+                          typename);
+ }
-     qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev",
-                          sc->info->silicon_rev);
+diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
      object_property_add_alias(obj, "hw-strap1", OBJECT(&s->scu),
 diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/aspeed_scu.c
+--- a/hw/arm/mps2.c
-+++ b/hw/misc/aspeed_scu.c
++++ b/hw/arm/mps2.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_get_random(void)
+@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
+                  qdev_get_gpio_in(armv7m,
- static void aspeed_scu_set_apb_freq(AspeedSCUState *s)
+                                   mmc->fpga_type == FPGA_AN511 ? 47 : 13));
- {
--    uint32_t apb_divider;
+-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
--
++    armv7m_load_kernel(mms->armv7m.cpu, machine->kernel_filename,
--    switch (s->silicon_rev) {
+, 0x400000);
 -    case AST2400_A0_SILICON_REV:
 -    case AST2400_A1_SILICON_REV:
 -        apb_divider = 2;
 -        break;
 -    case AST2500_A0_SILICON_REV:
 -    case AST2500_A1_SILICON_REV:
 -        apb_divider = 4;
 -        break;
 -    default:
 -        g_assert_not_reached();
 -    }
 +    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(s);
      s->apb_freq = s->hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
 -        / apb_divider;
 +        / asc->apb_divider;
  }
- static uint64_t aspeed_scu_read(void *opaque, hwaddr offset, unsigned size)
+diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
-@@ -XXX,XX +XXX,XX @@ static const uint32_t hpll_ast2400_freqs[][4] = {
+index XXXXXXX..XXXXXXX 100644
-     { 400, 375, 350, 425 }, /* 25MHz */
+--- a/hw/arm/msf2-som.c
- };
++++ b/hw/arm/msf2-som.c
+@@ -XXX,XX +XXX,XX @@ static void emcraft_sf2_s2s010_init(MachineState *machine)
--static uint32_t aspeed_scu_calc_hpll_ast2400(AspeedSCUState *s)
+     cs_line = qdev_get_gpio_in_named(spi_flash, SSI_GPIO_CS, 0);
-+static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
+     sysbus_connect_irq(SYS_BUS_DEVICE(&soc->spi[0]), 1, cs_line);
- {
-     uint32_t hpll_reg = s->regs[HPLL_PARAM];
+-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
-     uint8_t freq_select;
++    armv7m_load_kernel(soc->armv7m.cpu, machine->kernel_filename,
-@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_calc_hpll_ast2400(AspeedSCUState *s)
+, soc->envm_size);
      return hpll_ast2400_freqs[clk_25m_in][freq_select] * 1000000;
  }
--static uint32_t aspeed_scu_calc_hpll_ast2500(AspeedSCUState *s)
+diff --git a/hw/arm/musca.c b/hw/arm/musca.c
-+static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
+index XXXXXXX..XXXXXXX 100644
- {
+--- a/hw/arm/musca.c
-     uint32_t hpll_reg   = s->regs[HPLL_PARAM];
++++ b/hw/arm/musca.c
-     uint32_t multiplier = 1;
+@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
-@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_calc_hpll_ast2500(AspeedSCUState *s)
+                                                      "cfg_sec_resp", 0));
- static void aspeed_scu_reset(DeviceState *dev)
+     }
- {
-     AspeedSCUState *s = ASPEED_SCU(dev);
+-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
--    const uint32_t *reset;
++    armv7m_load_kernel(mms->sse.armv7m[0].cpu, machine->kernel_filename,
--    uint32_t (*calc_hpll)(AspeedSCUState *s);
+, 0x2000000);
 +    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
 -    switch (s->silicon_rev) {
 -    case AST2400_A0_SILICON_REV:
 -    case AST2400_A1_SILICON_REV:
 -        reset = ast2400_a0_resets;
 -        calc_hpll = aspeed_scu_calc_hpll_ast2400;
 -        break;
 -    case AST2500_A0_SILICON_REV:
 -    case AST2500_A1_SILICON_REV:
 -        reset = ast2500_a1_resets;
 -        calc_hpll = aspeed_scu_calc_hpll_ast2500;
 -        break;
 -    default:
 -        g_assert_not_reached();
 -    }
 -
 -    memcpy(s->regs, reset, sizeof(s->regs));
 +    memcpy(s->regs, asc->resets, sizeof(s->regs));
      s->regs[SILICON_REV] = s->silicon_rev;
      s->regs[HW_STRAP1] = s->hw_strap1;
      s->regs[HW_STRAP2] = s->hw_strap2;
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_reset(DeviceState *dev)
       * All registers are set. Now compute the frequencies of the main clocks
       */
      s->clkin = aspeed_scu_get_clkin(s);
 -    s->hpll = calc_hpll(s);
 +    s->hpll = asc->calc_hpll(s);
      aspeed_scu_set_apb_freq(s);
  }
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_scu_info = {
+diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
-     .parent = TYPE_SYS_BUS_DEVICE,
+index XXXXXXX..XXXXXXX 100644
-     .instance_size = sizeof(AspeedSCUState),
+--- a/hw/arm/netduino2.c
-     .class_init = aspeed_scu_class_init,
++++ b/hw/arm/netduino2.c
-+    .class_size    = sizeof(AspeedSCUClass),
+@@ -XXX,XX +XXX,XX @@ static void netduino2_init(MachineState *machine)
-+    .abstract      = true,
+     qdev_connect_clock_in(dev, "sysclk", sysclk);
-+};
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-+
-+static void aspeed_2400_scu_class_init(ObjectClass *klass, void *data)
+-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
-+{
++    armv7m_load_kernel(STM32F205_SOC(dev)->armv7m.cpu, machine->kernel_filename,
-+    DeviceClass *dc = DEVICE_CLASS(klass);
+, FLASH_SIZE);
 +    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
 +
 +    dc->desc = "ASPEED 2400 System Control Unit";
 +    asc->resets = ast2400_a0_resets;
 +    asc->calc_hpll = aspeed_2400_scu_calc_hpll;
 +    asc->apb_divider = 2;
 +}
 +
 +static const TypeInfo aspeed_2400_scu_info = {
 +    .name = TYPE_ASPEED_2400_SCU,
 +    .parent = TYPE_ASPEED_SCU,
 +    .instance_size = sizeof(AspeedSCUState),
 +    .class_init = aspeed_2400_scu_class_init,
 +};
 +
 +static void aspeed_2500_scu_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
 +
 +    dc->desc = "ASPEED 2500 System Control Unit";
 +    asc->resets = ast2500_a1_resets;
 +    asc->calc_hpll = aspeed_2500_scu_calc_hpll;
 +    asc->apb_divider = 4;
 +}
 +
 +static const TypeInfo aspeed_2500_scu_info = {
 +    .name = TYPE_ASPEED_2500_SCU,
 +    .parent = TYPE_ASPEED_SCU,
 +    .instance_size = sizeof(AspeedSCUState),
 +    .class_init = aspeed_2500_scu_class_init,
  };
  static void aspeed_scu_register_types(void)
  {
      type_register_static(&aspeed_scu_info);
 +    type_register_static(&aspeed_2400_scu_info);
 +    type_register_static(&aspeed_2500_scu_info);
  }
- type_init(aspeed_scu_register_types);
+diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/netduinoplus2.c
 +++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@ static void netduinoplus2_init(MachineState *machine)
      qdev_connect_clock_in(dev, "sysclk", sysclk);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    armv7m_load_kernel(ARM_CPU(first_cpu),
 +    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                         machine->kernel_filename,
 , FLASH_SIZE);
  }
 diff --git a/hw/arm/olimex-stm32-h405.c b/hw/arm/olimex-stm32-h405.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/olimex-stm32-h405.c
 +++ b/hw/arm/olimex-stm32-h405.c
@@ -XXX,XX +XXX,XX @@ static void olimex_stm32_h405_init(MachineState *machine)
      qdev_connect_clock_in(dev, "sysclk", sysclk);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    armv7m_load_kernel(ARM_CPU(first_cpu),
 +    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                         machine->kernel_filename,
 , FLASH_SIZE);
  }
 diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stellaris.c
 +++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      create_unimplemented_device("hibernation", 0x400fc000, 0x1000);
      create_unimplemented_device("flash-control", 0x400fd000, 0x1000);
 -    armv7m_load_kernel(ARM_CPU(first_cpu), ms->kernel_filename, 0, flash_size);
 +    armv7m_load_kernel(ARMV7M(armv7m)->cpu, ms->kernel_filename, 0, flash_size);
  }
  /* FIXME: Figure out how to generate these from stellaris_boards.  */
 diff --git a/hw/arm/stm32vldiscovery.c b/hw/arm/stm32vldiscovery.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32vldiscovery.c
 +++ b/hw/arm/stm32vldiscovery.c
@@ -XXX,XX +XXX,XX @@ static void stm32vldiscovery_init(MachineState *machine)
      qdev_connect_clock_in(dev, "sysclk", sysclk);
      sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 -    armv7m_load_kernel(ARM_CPU(first_cpu),
 +    armv7m_load_kernel(STM32F100_SOC(dev)->armv7m.cpu,
                         machine->kernel_filename,
 , FLASH_SIZE);
  }
 --
-.20.1
+.34.1

-New patch
+[PULL 04/36] hw/char/imx_serial: Fix reset value of UFCR register
+From: Bernhard Beschow <shentey@gmail.com>
+The value of the UCFR register is respected when echoing characters to the
+terminal, but its reset value is reserved. Fix the reset value to the one
+documented in the datasheet.
+While at it move the related attribute out of the section of unimplemented
+registers since its value is actually respected.
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/char/imx_serial.h | 2 +-
+ hw/char/imx_serial.c         | 1 +
+files changed, 2 insertions(+), 1 deletion(-)
+diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/char/imx_serial.h
++++ b/include/hw/char/imx_serial.h
+@@ -XXX,XX +XXX,XX @@ struct IMXSerialState {
+     uint32_t ucr1;
+     uint32_t ucr2;
+     uint32_t uts1;
++    uint32_t ufcr;
+     /*
+      * The registers below are implemented just so that the
+      * guest OS sees what it has written
+      */
+     uint32_t onems;
+-    uint32_t ufcr;
+     uint32_t ubmr;
+     uint32_t ubrc;
+     uint32_t ucr3;
+diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/char/imx_serial.c
++++ b/hw/char/imx_serial.c
+@@ -XXX,XX +XXX,XX @@ static void imx_serial_reset(IMXSerialState *s)
+     s->ucr3 = 0x700;
+     s->ubmr = 0;
+     s->ubrc = 4;
++    s->ufcr = BIT(11) | BIT(0);
+     fifo32_reset(&s->rx_fifo);
+     timer_del(&s->ageing_timer);
+--
+.34.1

-New patch
+[PULL 05/36] hw/char/imx_serial: Update all state before restarting ageing timer
+From: Bernhard Beschow <shentey@gmail.com>
+Fixes characters to be "echoed" after each keystroke rather than after every
+other since imx_serial_rx_fifo_ageing_timer_restart() would see ~UTS1_RXEMPTY
+only after every other keystroke.
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/char/imx_serial.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/char/imx_serial.c
++++ b/hw/char/imx_serial.c
+@@ -XXX,XX +XXX,XX @@ static void imx_put_data(void *opaque, uint32_t value)
+     if (fifo32_num_used(&s->rx_fifo) >= rxtl) {
+         s->usr1 |= USR1_RRDY;
+     }
+-
+-    imx_serial_rx_fifo_ageing_timer_restart(s);
+-
+     s->usr2 |= USR2_RDR;
+     s->uts1 &= ~UTS1_RXEMPTY;
+     if (value & URXD_BRK) {
+         s->usr2 |= USR2_BRCD;
+     }
++
++    imx_serial_rx_fifo_ageing_timer_restart(s);
++
+     imx_update(s);
+ }
+--
+.34.1

-New patch
+[PULL 06/36] hw/pci-host/designware: Expose MSI IRQ
+From: Bernhard Beschow <shentey@gmail.com>
+Fixes INTD and MSI interrupts poking the same IRQ line without keeping track of
+each other's IRQ level. Furthermore, SoCs such as the i.MX 8M Plus don't share
+the MSI IRQ with the INTx lines, so expose it as a dedicated pin.
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/fsl-imx6.h        |  4 +++-
+ include/hw/arm/fsl-imx7.h        |  4 +++-
+ include/hw/pci-host/designware.h |  1 +
+ hw/arm/fsl-imx6.c                | 13 ++++++++++++-
+ hw/arm/fsl-imx7.c                | 13 ++++++++++++-
+ hw/pci-host/designware.c         |  7 +++----
+ hw/arm/Kconfig                   |  2 ++
+files changed, 36 insertions(+), 8 deletions(-)
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx6.h
++++ b/include/hw/arm/fsl-imx6.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/usb/chipidea.h"
+ #include "hw/usb/imx-usb-phy.h"
+ #include "hw/pci-host/designware.h"
++#include "hw/or-irq.h"
+ #include "exec/memory.h"
+ #include "cpu.h"
+ #include "qom/object.h"
+@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
+     ChipideaState      usb[FSL_IMX6_NUM_USBS];
+     IMXFECState        eth;
+     DesignwarePCIEHost pcie;
++    OrIRQState         pcie4_msi_irq;
+     MemoryRegion       rom;
+     MemoryRegion       caam;
+     MemoryRegion       ocram;
+@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
+ #define FSL_IMX6_PCIE1_IRQ 120
+ #define FSL_IMX6_PCIE2_IRQ 121
+ #define FSL_IMX6_PCIE3_IRQ 122
+-#define FSL_IMX6_PCIE4_IRQ 123
++#define FSL_IMX6_PCIE4_MSI_IRQ 123
+ #define FSL_IMX6_DCIC1_IRQ 124
+ #define FSL_IMX6_DCIC2_IRQ 125
+ #define FSL_IMX6_MLB150_HIGH_IRQ 126
+diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/fsl-imx7.h
++++ b/include/hw/arm/fsl-imx7.h
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/net/imx_fec.h"
+ #include "hw/pci-host/designware.h"
+ #include "hw/usb/chipidea.h"
++#include "hw/or-irq.h"
+ #include "cpu.h"
+ #include "qom/object.h"
+ #include "qemu/units.h"
+@@ -XXX,XX +XXX,XX @@ struct FslIMX7State {
+     IMX7GPRState       gpr;
+     ChipideaState      usb[FSL_IMX7_NUM_USBS];
+     DesignwarePCIEHost pcie;
++    OrIRQState         pcie4_msi_irq;
+     MemoryRegion       rom;
+     MemoryRegion       caam;
+     MemoryRegion       ocram;
+@@ -XXX,XX +XXX,XX @@ enum FslIMX7IRQs {
+     FSL_IMX7_PCI_INTA_IRQ = 125,
+     FSL_IMX7_PCI_INTB_IRQ = 124,
+     FSL_IMX7_PCI_INTC_IRQ = 123,
+-    FSL_IMX7_PCI_INTD_IRQ = 122,
++    FSL_IMX7_PCI_INTD_MSI_IRQ = 122,
+     FSL_IMX7_UART7_IRQ    = 126,
+diff --git a/include/hw/pci-host/designware.h b/include/hw/pci-host/designware.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/pci-host/designware.h
++++ b/include/hw/pci-host/designware.h
+@@ -XXX,XX +XXX,XX @@ struct DesignwarePCIEHost {
+         MemoryRegion io;
+         qemu_irq     irqs[4];
++        qemu_irq     msi;
+     } pci;
+     MemoryRegion mmio;
+diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/fsl-imx6.c
++++ b/hw/arm/fsl-imx6.c
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
+     object_initialize_child(obj, "eth", &s->eth, TYPE_IMX_ENET);
+     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
++    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
++                            TYPE_OR_IRQ);
+ }
+ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
+     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX6_PCIe_REG_ADDR);
++    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
++                            &error_abort);
++    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
++
++    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_MSI_IRQ);
++    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
++
+     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE1_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE2_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE3_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
+-    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_IRQ);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
++    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
+     /*
+      * PCIe PHY
+diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/fsl-imx7.c
++++ b/hw/arm/fsl-imx7.c
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_init(Object *obj)
+      * PCIE
+      */
+     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
++    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
++                            TYPE_OR_IRQ);
+     /*
+      * USBs
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
+     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
+     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX7_PCIE_REG_ADDR);
++    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
++                            &error_abort);
++    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
++
++    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_MSI_IRQ);
++    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
++
+     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTA_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTB_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
+     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTC_IRQ);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
+-    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_IRQ);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
+     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
++    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
++    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
+     /*
+      * USBs
+diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/pci-host/designware.c
++++ b/hw/pci-host/designware.c
+@@ -XXX,XX +XXX,XX @@
+ #define DESIGNWARE_PCIE_ATU_DEVFN(x)               (((x) >> 16) & 0xff)
+ #define DESIGNWARE_PCIE_ATU_UPPER_TARGET           0x91C
+-#define DESIGNWARE_PCIE_IRQ_MSI                    3
+-
+ static DesignwarePCIEHost *
+ designware_pcie_root_to_host(DesignwarePCIERoot *root)
+ {
+@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_msi_write(void *opaque, hwaddr addr,
+     root->msi.intr[0].status |= BIT(val) & root->msi.intr[0].enable;
+     if (root->msi.intr[0].status & ~root->msi.intr[0].mask) {
+-        qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 1);
++        qemu_set_irq(host->pci.msi, 1);
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_config_write(PCIDevice *d, uint32_t address,
+     case DESIGNWARE_PCIE_MSI_INTR0_STATUS:
+         root->msi.intr[0].status ^= val;
+         if (!root->msi.intr[0].status) {
+-            qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 0);
++            qemu_set_irq(host->pci.msi, 0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static void designware_pcie_host_realize(DeviceState *dev, Error **errp)
+     for (i = 0; i < ARRAY_SIZE(s->pci.irqs); i++) {
+         sysbus_init_irq(sbd, &s->pci.irqs[i]);
+     }
++    sysbus_init_irq(sbd, &s->pci.msi);
+     memory_region_init_io(&s->mmio,
+                           OBJECT(s),
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/Kconfig
++++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
+     select PL310  # cache controller
+     select PCI_EXPRESS_DESIGNWARE
+     select SDHCI
++    select OR_IRQ
+ config ASPEED_SOC
+     bool
+@@ -XXX,XX +XXX,XX @@ config FSL_IMX7
+     select WDT_IMX2
+     select PCI_EXPRESS_DESIGNWARE
+     select SDHCI
++    select OR_IRQ
+     select UNIMP
+ config ARM_SMMUV3
+--
+.34.1

-[Qemu-devel] [PULL 07/12] aspeed/smc: Inject errors in DMA checksum
+[PULL 07/36] hw/arm/stellaris: Link each board schematic
-From: Cédric Le Goater <clg@kaod.org>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Emulate read errors in the DMA Checksum Register for high frequencies
+Board schematic is useful to corroborate GPIOs/IRQs wiring.
 and optimistic settings of the Read Timing Compensation Register. This
 will help in tuning the SPI timing calibration algorithm. Errors are
 only injected when the property "inject_failure" is set to true as
 suggested by Philippe.
-The values below are those to expect from the first flash device of
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-the FMC controller of a palmetto-bmc machine.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-2-philmd@linaro.org
-Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
+[PMM: Use https:// URLs]
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Joel Stanley <joel@jms.id.au>
 Message-id: 20190904070506.1052-8-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/ssi/aspeed_smc.h |  1 +
+ hw/arm/stellaris.c | 8 ++++++++
- hw/ssi/aspeed_smc.c         | 36 ++++++++++++++++++++++++++++++++++++
+file changed, 8 insertions(+)
 files changed, 37 insertions(+)
-diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/ssi/aspeed_smc.h
+--- a/hw/arm/stellaris.c
-+++ b/include/hw/ssi/aspeed_smc.h
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCState {
+@@ -XXX,XX +XXX,XX @@ static void lm3s6965evb_init(MachineState *machine)
+     stellaris_init(machine, &stellaris_boards[1]);
      uint32_t num_cs;
      qemu_irq *cs_lines;
 +    bool inject_failure;
      SSIBus *spi;
 diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/aspeed_smc.c
 +++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_calibration(AspeedSMCState *s)
      s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
  }
 +/*
-+ * Emulate read errors in the DMA Checksum Register for high
++ * Stellaris LM3S811 Evaluation Board Schematics:
-+ * frequencies and optimistic settings of the Read Timing Compensation
++ * https://www.ti.com/lit/ug/symlink/spmu030.pdf
 + * Register. This will help in tuning the SPI timing calibration
 + * algorithm.
 + */
-+static bool aspeed_smc_inject_read_failure(AspeedSMCState *s)
+ static void lm3s811evb_class_init(ObjectClass *oc, void *data)
-+{
+ {
-+    uint8_t delay =
+     MachineClass *mc = MACHINE_CLASS(oc);
-+        (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
+@@ -XXX,XX +XXX,XX @@ static const TypeInfo lm3s811evb_type = {
-+    uint8_t hclk_mask =
+     .class_init = lm3s811evb_class_init,
-+        (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
+ };
-+
-+    /*
++/*
-+     * Typical values of a palmetto-bmc machine.
++ * Stellaris: LM3S6965 Evaluation Board Schematics:
-+     */
++ * https://www.ti.com/lit/ug/symlink/spmu029.pdf
-+    switch (aspeed_smc_hclk_divisor(hclk_mask)) {
++ */
-+    case 4 ... 16:
+ static void lm3s6965evb_class_init(ObjectClass *oc, void *data)
-+        return false;
+ {
-+    case 3: /* at least one HCLK cycle delay */
+     MachineClass *mc = MACHINE_CLASS(oc);
 +        return (delay & 0x7) < 1;
 +    case 2: /* at least two HCLK cycle delay */
 +        return (delay & 0x7) < 2;
 +    case 1: /* (> 100MHz) is above the max freq of the controller */
 +        return true;
 +    default:
 +        g_assert_not_reached();
 +    }
 +}
 +
  /*
   * Accumulate the result of the reads to provide a checksum that will
   * be used to validate the read timing settings.
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_checksum(AspeedSMCState *s)
          s->regs[R_DMA_FLASH_ADDR] += 4;
          s->regs[R_DMA_LEN] -= 4;
      }
 +
 +    if (s->inject_failure && aspeed_smc_inject_read_failure(s)) {
 +        s->regs[R_DMA_CHECKSUM] = 0xbadc0de;
 +    }
 +
  }
  static void aspeed_smc_dma_rw(AspeedSMCState *s)
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_smc = {
  static Property aspeed_smc_properties[] = {
      DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
 +    DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false),
      DEFINE_PROP_UINT64("sdram-base", AspeedSMCState, sdram_base, 0),
      DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
                       TYPE_MEMORY_REGION, MemoryRegion *),
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 02/12] aspeed: add a GPIO controller to the SoC
+[PULL 08/36] hw/arm/stellaris: Constify read-only arrays
-From: Rashmica Gupta <rashmica.g@gmail.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Message-id: 20250110160204.74997-3-philmd@linaro.org
 Message-id: 20190904070506.1052-3-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed_soc.h |  3 +++
+ hw/arm/stellaris.c | 6 +++---
- hw/arm/aspeed_soc.c         | 17 +++++++++++++++++
+file changed, 3 insertions(+), 3 deletions(-)
 files changed, 20 insertions(+)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/hw/arm/stellaris.c
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void ssys_update(ssys_state *s)
- #include "hw/watchdog/wdt_aspeed.h"
+   qemu_set_irq(s->irq, (s->int_status & s->int_mask) != 0);
  #include "hw/net/ftgmac100.h"
  #include "target/arm/cpu.h"
 +#include "hw/gpio/aspeed_gpio.h"
  #define ASPEED_SPIS_NUM  2
  #define ASPEED_WDTS_NUM  3
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
      AspeedSDMCState sdmc;
      AspeedWDTState wdt[ASPEED_WDTS_NUM];
      FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
 +    AspeedGPIOState gpio;
  } AspeedSoCState;
  #define TYPE_ASPEED_SOC "aspeed-soc"
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
      int spis_num;
      const char *fmc_typename;
      const char **spi_typename;
 +    const char *gpio_typename;
      int wdts_num;
      const int *irqmap;
      const hwaddr *memmap;
 diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed_soc.c
 +++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spis_num     = 1,
          .fmc_typename = "aspeed.smc.fmc",
          .spi_typename = aspeed_soc_ast2400_typenames,
 +        .gpio_typename = "aspeed.gpio-ast2400",
          .wdts_num     = 2,
          .irqmap       = aspeed_soc_ast2400_irqmap,
          .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spis_num     = 1,
          .fmc_typename = "aspeed.smc.fmc",
          .spi_typename = aspeed_soc_ast2400_typenames,
 +        .gpio_typename = "aspeed.gpio-ast2400",
          .wdts_num     = 2,
          .irqmap       = aspeed_soc_ast2400_irqmap,
          .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spis_num     = 1,
          .fmc_typename = "aspeed.smc.fmc",
          .spi_typename = aspeed_soc_ast2400_typenames,
 +        .gpio_typename = "aspeed.gpio-ast2400",
          .wdts_num     = 2,
          .irqmap       = aspeed_soc_ast2400_irqmap,
          .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .spis_num     = 2,
          .fmc_typename = "aspeed.smc.ast2500-fmc",
          .spi_typename = aspeed_soc_ast2500_typenames,
 +        .gpio_typename = "aspeed.gpio-ast2500",
          .wdts_num     = 3,
          .irqmap       = aspeed_soc_ast2500_irqmap,
          .memmap       = aspeed_soc_ast2500_memmap,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
                            TYPE_ASPEED_XDMA);
 +
 +    sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
 +                          sc->info->gpio_typename);
  }
- static void aspeed_soc_realize(DeviceState *dev, Error **errp)
+-static uint32_t pllcfg_sandstorm[16] = {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
++static const uint32_t pllcfg_sandstorm[16] = {
-                     sc->info->memmap[ASPEED_XDMA]);
+x31c0, /* 1 Mhz */
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
+x1ae0, /* 1.8432 Mhz */
-                        aspeed_soc_get_irq(s, ASPEED_XDMA));
+x18c0, /* 2 Mhz */
-+
+@@ -XXX,XX +XXX,XX @@ static uint32_t pllcfg_sandstorm[16] = {
-+    /* GPIO */
+x585b /* 8.192 Mhz */
-+    object_property_set_bool(OBJECT(&s->gpio), true, "realized", &err);
+ };
-+    if (err) {
-+        error_propagate(errp, err);
+-static uint32_t pllcfg_fury[16] = {
-+        return;
++static const uint32_t pllcfg_fury[16] = {
-+    }
+x3200, /* 1 Mhz */
-+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->info->memmap[ASPEED_GPIO]);
+x1b20, /* 1.8432 Mhz */
-+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
+x1900, /* 2 Mhz */
-+                       aspeed_soc_get_irq(s, ASPEED_GPIO));
+@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj)
  }
- static Property aspeed_soc_properties[] = {
-     DEFINE_PROP_UINT32("num-cpus", AspeedSoCState, num_cpus, 0),
+ /* Board init.  */
 -static stellaris_board_info stellaris_boards[] = {
 +static const stellaris_board_info stellaris_boards[] = {
    { "LM3S811EVB",
 ,
 x0032000e,
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 01/12] hw/gpio: Add basic Aspeed GPIO model for AST2400 and AST2500
+[PULL 09/36] hw/arm/stellaris: Remove incorrect unimplemented i2c-0 at 0x40002000
-From: Rashmica Gupta <rashmica.g@gmail.com>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-GPIO pins are arranged in groups of 8 pins labeled A,B,..,Y,Z,AA,AB,AC.
+There is nothing mapped at 0x40002000.
 (Note that the ast2400 controller only goes up to group AB).
 A set has four groups (except set AC which only has one) and is
 referred to by the groups it is composed of (eg ABCD,EFGH,...,YZAAAB).
 Each set is accessed and controlled by a bank of 14 registers.
-These registers operate on a per pin level where each bit in the register
+I2C#0 is already mapped at 0x40021000.
 corresponds to a pin, except for the command source registers. The command
 source registers operate on a per group level where bits 24, 16, 8 and 0
 correspond to each group in the set.
- eg. registers for set ABCD:
+Remove the invalid mapping added in commits aecfbbc97a2 & 394c8bbfb7a.
  |D7...D0|C7...C0|B7...B0|A7...A0| <- GPIOs
  |31...24|23...16|15....8|7.....0| <- bit position
-Note that there are a couple of groups that only have 4 pins.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-There are two ways that this model deviates from the behaviour of the
+Message-id: 20250110160204.74997-4-philmd@linaro.org
 actual controller:
 (1) The only control source driving the GPIO pins in the model is the ARM
 model (as there currently aren't models for the LPC or Coprocessor).
 (2) None of the registers in the model are reset tolerant (needs
 integration with the watchdog).
 Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
 Tested-by: Andrew Jeffery <andrew@aj.id.au>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20190904070506.1052-2-clg@kaod.org
 [clg: fixed missing header files
       made use of HWADDR_PRIx to fix compilation on windows ]
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/gpio/Makefile.objs         |   1 +
+ hw/arm/stellaris.c | 2 --
- include/hw/gpio/aspeed_gpio.h | 100 ++++
+file changed, 2 deletions(-)
  hw/gpio/aspeed_gpio.c         | 884 ++++++++++++++++++++++++++++++++++
 files changed, 985 insertions(+)
  create mode 100644 include/hw/gpio/aspeed_gpio.h
  create mode 100644 hw/gpio/aspeed_gpio.c
-diff --git a/hw/gpio/Makefile.objs b/hw/gpio/Makefile.objs
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/gpio/Makefile.objs
+--- a/hw/arm/stellaris.c
-+++ b/hw/gpio/Makefile.objs
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_OMAP) += omap_gpio.o
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
- obj-$(CONFIG_IMX) += imx_gpio.o
+      * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf
- obj-$(CONFIG_RASPI) += bcm2835_gpio.o
+      *
- obj-$(CONFIG_NRF51_SOC) += nrf51_gpio.o
+      * 40000000 wdtimer
-+obj-$(CONFIG_ASPEED_SOC) += aspeed_gpio.o
+-     * 40002000 i2c (unimplemented)
-diff --git a/include/hw/gpio/aspeed_gpio.h b/include/hw/gpio/aspeed_gpio.h
+      * 40004000 GPIO
-new file mode 100644
+      * 40005000 GPIO
-index XXXXXXX..XXXXXXX
+      * 40006000 GPIO
---- /dev/null
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+++ b/include/hw/gpio/aspeed_gpio.h
+     /* Add dummy regions for the devices we don't implement yet,
-@@ -XXX,XX +XXX,XX @@
+      * so guest accesses don't cause unlogged crashes.
-+/*
+      */
-+ *  ASPEED GPIO Controller
+-    create_unimplemented_device("i2c-0", 0x40002000, 0x1000);
-+ *
+     create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
-+ *  Copyright (C) 2017-2018 IBM Corp.
+     create_unimplemented_device("PWM", 0x40028000, 0x1000);
-+ *
+     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
 + * This code is licensed under the GPL version 2 or later.  See
 + * the COPYING file in the top-level directory.
 + */
 +
 +#ifndef ASPEED_GPIO_H
 +#define ASPEED_GPIO_H
 +
 +#include "hw/sysbus.h"
 +
 +#define TYPE_ASPEED_GPIO "aspeed.gpio"
 +#define ASPEED_GPIO(obj) OBJECT_CHECK(AspeedGPIOState, (obj), TYPE_ASPEED_GPIO)
 +#define ASPEED_GPIO_CLASS(klass) \
 +     OBJECT_CLASS_CHECK(AspeedGPIOClass, (klass), TYPE_ASPEED_GPIO)
 +#define ASPEED_GPIO_GET_CLASS(obj) \
 +     OBJECT_GET_CLASS(AspeedGPIOClass, (obj), TYPE_ASPEED_GPIO)
 +
 +#define ASPEED_GPIO_MAX_NR_SETS 8
 +#define ASPEED_REGS_PER_BANK 14
 +#define ASPEED_GPIO_MAX_NR_REGS (ASPEED_REGS_PER_BANK * ASPEED_GPIO_MAX_NR_SETS)
 +#define ASPEED_GPIO_NR_PINS 228
 +#define ASPEED_GROUPS_PER_SET 4
 +#define ASPEED_GPIO_NR_DEBOUNCE_REGS 3
 +#define ASPEED_CHARS_PER_GROUP_LABEL 4
 +
 +typedef struct GPIOSets GPIOSets;
 +
 +typedef struct GPIOSetProperties {
 +    uint32_t input;
 +    uint32_t output;
 +    char group_label[ASPEED_GROUPS_PER_SET][ASPEED_CHARS_PER_GROUP_LABEL];
 +} GPIOSetProperties;
 +
 +enum GPIORegType {
 +    gpio_not_a_reg,
 +    gpio_reg_data_value,
 +    gpio_reg_direction,
 +    gpio_reg_int_enable,
 +    gpio_reg_int_sens_0,
 +    gpio_reg_int_sens_1,
 +    gpio_reg_int_sens_2,
 +    gpio_reg_int_status,
 +    gpio_reg_reset_tolerant,
 +    gpio_reg_debounce_1,
 +    gpio_reg_debounce_2,
 +    gpio_reg_cmd_source_0,
 +    gpio_reg_cmd_source_1,
 +    gpio_reg_data_read,
 +    gpio_reg_input_mask,
 +};
 +
 +typedef struct AspeedGPIOReg {
 +    uint16_t set_idx;
 +    enum GPIORegType type;
 + } AspeedGPIOReg;
 +
 +typedef struct  AspeedGPIOClass {
 +    SysBusDevice parent_obj;
 +    const GPIOSetProperties *props;
 +    uint32_t nr_gpio_pins;
 +    uint32_t nr_gpio_sets;
 +    uint32_t gap;
 +    const AspeedGPIOReg *reg_table;
 +}  AspeedGPIOClass;
 +
 +typedef struct AspeedGPIOState {
 +    /* <private> */
 +    SysBusDevice parent;
 +
 +    /*< public >*/
 +    MemoryRegion iomem;
 +    int pending;
 +    qemu_irq irq;
 +    qemu_irq gpios[ASPEED_GPIO_NR_PINS];
 +
 +/* Parallel GPIO Registers */
 +    uint32_t debounce_regs[ASPEED_GPIO_NR_DEBOUNCE_REGS];
 +    struct GPIOSets {
 +        uint32_t data_value; /* Reflects pin values */
 +        uint32_t data_read; /* Contains last value written to data value */
 +        uint32_t direction;
 +        uint32_t int_enable;
 +        uint32_t int_sens_0;
 +        uint32_t int_sens_1;
 +        uint32_t int_sens_2;
 +        uint32_t int_status;
 +        uint32_t reset_tol;
 +        uint32_t cmd_source_0;
 +        uint32_t cmd_source_1;
 +        uint32_t debounce_1;
 +        uint32_t debounce_2;
 +        uint32_t input_mask;
 +    } sets[ASPEED_GPIO_MAX_NR_SETS];
 +} AspeedGPIOState;
 +
 +#endif /* _ASPEED_GPIO_H_ */
 diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + *  ASPEED GPIO Controller
 + *
 + *  Copyright (C) 2017-2019 IBM Corp.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include <assert.h>
 +
 +#include "qemu/osdep.h"
 +#include "qemu/host-utils.h"
 +#include "qemu/log.h"
 +#include "hw/gpio/aspeed_gpio.h"
 +#include "include/hw/misc/aspeed_scu.h"
 +#include "qapi/error.h"
 +#include "qapi/visitor.h"
 +#include "hw/irq.h"
 +#include "migration/vmstate.h"
 +
 +#define GPIOS_PER_REG 32
 +#define GPIOS_PER_SET GPIOS_PER_REG
 +#define GPIO_PIN_GAP_SIZE 4
 +#define GPIOS_PER_GROUP 8
 +#define GPIO_GROUP_SHIFT 3
 +
 +/* GPIO Source Types */
 +#define ASPEED_CMD_SRC_MASK         0x01010101
 +#define ASPEED_SOURCE_ARM           0
 +#define ASPEED_SOURCE_LPC           1
 +#define ASPEED_SOURCE_COPROCESSOR   2
 +#define ASPEED_SOURCE_RESERVED      3
 +
 +/* GPIO Interrupt Triggers */
 +/*
 + *  For each set of gpios there are three sensitivity registers that control
 + *  the interrupt trigger mode.
 + *
 + *  | 2 | 1 | 0 | trigger mode
 + *  -----------------------------
 + *  | 0 | 0 | 0 | falling-edge
 + *  | 0 | 0 | 1 | rising-edge
 + *  | 0 | 1 | 0 | level-low
 + *  | 0 | 1 | 1 | level-high
 + *  | 1 | X | X | dual-edge
 + */
 +#define ASPEED_FALLING_EDGE 0
 +#define ASPEED_RISING_EDGE  1
 +#define ASPEED_LEVEL_LOW    2
 +#define ASPEED_LEVEL_HIGH   3
 +#define ASPEED_DUAL_EDGE    4
 +
 +/* GPIO Register Address Offsets */
 +#define GPIO_ABCD_DATA_VALUE       (0x000 >> 2)
 +#define GPIO_ABCD_DIRECTION        (0x004 >> 2)
 +#define GPIO_ABCD_INT_ENABLE       (0x008 >> 2)
 +#define GPIO_ABCD_INT_SENS_0       (0x00C >> 2)
 +#define GPIO_ABCD_INT_SENS_1       (0x010 >> 2)
 +#define GPIO_ABCD_INT_SENS_2       (0x014 >> 2)
 +#define GPIO_ABCD_INT_STATUS       (0x018 >> 2)
 +#define GPIO_ABCD_RESET_TOLERANT   (0x01C >> 2)
 +#define GPIO_EFGH_DATA_VALUE       (0x020 >> 2)
 +#define GPIO_EFGH_DIRECTION        (0x024 >> 2)
 +#define GPIO_EFGH_INT_ENABLE       (0x028 >> 2)
 +#define GPIO_EFGH_INT_SENS_0       (0x02C >> 2)
 +#define GPIO_EFGH_INT_SENS_1       (0x030 >> 2)
 +#define GPIO_EFGH_INT_SENS_2       (0x034 >> 2)
 +#define GPIO_EFGH_INT_STATUS       (0x038 >> 2)
 +#define GPIO_EFGH_RESET_TOLERANT   (0x03C >> 2)
 +#define GPIO_ABCD_DEBOUNCE_1       (0x040 >> 2)
 +#define GPIO_ABCD_DEBOUNCE_2       (0x044 >> 2)
 +#define GPIO_EFGH_DEBOUNCE_1       (0x048 >> 2)
 +#define GPIO_EFGH_DEBOUNCE_2       (0x04C >> 2)
 +#define GPIO_DEBOUNCE_TIME_1       (0x050 >> 2)
 +#define GPIO_DEBOUNCE_TIME_2       (0x054 >> 2)
 +#define GPIO_DEBOUNCE_TIME_3       (0x058 >> 2)
 +#define GPIO_ABCD_COMMAND_SRC_0    (0x060 >> 2)
 +#define GPIO_ABCD_COMMAND_SRC_1    (0x064 >> 2)
 +#define GPIO_EFGH_COMMAND_SRC_0    (0x068 >> 2)
 +#define GPIO_EFGH_COMMAND_SRC_1    (0x06C >> 2)
 +#define GPIO_IJKL_DATA_VALUE       (0x070 >> 2)
 +#define GPIO_IJKL_DIRECTION        (0x074 >> 2)
 +#define GPIO_MNOP_DATA_VALUE       (0x078 >> 2)
 +#define GPIO_MNOP_DIRECTION        (0x07C >> 2)
 +#define GPIO_QRST_DATA_VALUE       (0x080 >> 2)
 +#define GPIO_QRST_DIRECTION        (0x084 >> 2)
 +#define GPIO_UVWX_DATA_VALUE       (0x088 >> 2)
 +#define GPIO_UVWX_DIRECTION        (0x08C >> 2)
 +#define GPIO_IJKL_COMMAND_SRC_0    (0x090 >> 2)
 +#define GPIO_IJKL_COMMAND_SRC_1    (0x094 >> 2)
 +#define GPIO_IJKL_INT_ENABLE       (0x098 >> 2)
 +#define GPIO_IJKL_INT_SENS_0       (0x09C >> 2)
 +#define GPIO_IJKL_INT_SENS_1       (0x0A0 >> 2)
 +#define GPIO_IJKL_INT_SENS_2       (0x0A4 >> 2)
 +#define GPIO_IJKL_INT_STATUS       (0x0A8 >> 2)
 +#define GPIO_IJKL_RESET_TOLERANT   (0x0AC >> 2)
 +#define GPIO_IJKL_DEBOUNCE_1       (0x0B0 >> 2)
 +#define GPIO_IJKL_DEBOUNCE_2       (0x0B4 >> 2)
 +#define GPIO_IJKL_INPUT_MASK       (0x0B8 >> 2)
 +#define GPIO_ABCD_DATA_READ        (0x0C0 >> 2)
 +#define GPIO_EFGH_DATA_READ        (0x0C4 >> 2)
 +#define GPIO_IJKL_DATA_READ        (0x0C8 >> 2)
 +#define GPIO_MNOP_DATA_READ        (0x0CC >> 2)
 +#define GPIO_QRST_DATA_READ        (0x0D0 >> 2)
 +#define GPIO_UVWX_DATA_READ        (0x0D4 >> 2)
 +#define GPIO_YZAAAB_DATA_READ      (0x0D8 >> 2)
 +#define GPIO_AC_DATA_READ          (0x0DC >> 2)
 +#define GPIO_MNOP_COMMAND_SRC_0    (0x0E0 >> 2)
 +#define GPIO_MNOP_COMMAND_SRC_1    (0x0E4 >> 2)
 +#define GPIO_MNOP_INT_ENABLE       (0x0E8 >> 2)
 +#define GPIO_MNOP_INT_SENS_0       (0x0EC >> 2)
 +#define GPIO_MNOP_INT_SENS_1       (0x0F0 >> 2)
 +#define GPIO_MNOP_INT_SENS_2       (0x0F4 >> 2)
 +#define GPIO_MNOP_INT_STATUS       (0x0F8 >> 2)
 +#define GPIO_MNOP_RESET_TOLERANT   (0x0FC >> 2)
 +#define GPIO_MNOP_DEBOUNCE_1       (0x100 >> 2)
 +#define GPIO_MNOP_DEBOUNCE_2       (0x104 >> 2)
 +#define GPIO_MNOP_INPUT_MASK       (0x108 >> 2)
 +#define GPIO_QRST_COMMAND_SRC_0    (0x110 >> 2)
 +#define GPIO_QRST_COMMAND_SRC_1    (0x114 >> 2)
 +#define GPIO_QRST_INT_ENABLE       (0x118 >> 2)
 +#define GPIO_QRST_INT_SENS_0       (0x11C >> 2)
 +#define GPIO_QRST_INT_SENS_1       (0x120 >> 2)
 +#define GPIO_QRST_INT_SENS_2       (0x124 >> 2)
 +#define GPIO_QRST_INT_STATUS       (0x128 >> 2)
 +#define GPIO_QRST_RESET_TOLERANT   (0x12C >> 2)
 +#define GPIO_QRST_DEBOUNCE_1       (0x130 >> 2)
 +#define GPIO_QRST_DEBOUNCE_2       (0x134 >> 2)
 +#define GPIO_QRST_INPUT_MASK       (0x138 >> 2)
 +#define GPIO_UVWX_COMMAND_SRC_0    (0x140 >> 2)
 +#define GPIO_UVWX_COMMAND_SRC_1    (0x144 >> 2)
 +#define GPIO_UVWX_INT_ENABLE       (0x148 >> 2)
 +#define GPIO_UVWX_INT_SENS_0       (0x14C >> 2)
 +#define GPIO_UVWX_INT_SENS_1       (0x150 >> 2)
 +#define GPIO_UVWX_INT_SENS_2       (0x154 >> 2)
 +#define GPIO_UVWX_INT_STATUS       (0x158 >> 2)
 +#define GPIO_UVWX_RESET_TOLERANT   (0x15C >> 2)
 +#define GPIO_UVWX_DEBOUNCE_1       (0x160 >> 2)
 +#define GPIO_UVWX_DEBOUNCE_2       (0x164 >> 2)
 +#define GPIO_UVWX_INPUT_MASK       (0x168 >> 2)
 +#define GPIO_YZAAAB_COMMAND_SRC_0  (0x170 >> 2)
 +#define GPIO_YZAAAB_COMMAND_SRC_1  (0x174 >> 2)
 +#define GPIO_YZAAAB_INT_ENABLE     (0x178 >> 2)
 +#define GPIO_YZAAAB_INT_SENS_0     (0x17C >> 2)
 +#define GPIO_YZAAAB_INT_SENS_1     (0x180 >> 2)
 +#define GPIO_YZAAAB_INT_SENS_2     (0x184 >> 2)
 +#define GPIO_YZAAAB_INT_STATUS     (0x188 >> 2)
 +#define GPIO_YZAAAB_RESET_TOLERANT (0x18C >> 2)
 +#define GPIO_YZAAAB_DEBOUNCE_1     (0x190 >> 2)
 +#define GPIO_YZAAAB_DEBOUNCE_2     (0x194 >> 2)
 +#define GPIO_YZAAAB_INPUT_MASK     (0x198 >> 2)
 +#define GPIO_AC_COMMAND_SRC_0      (0x1A0 >> 2)
 +#define GPIO_AC_COMMAND_SRC_1      (0x1A4 >> 2)
 +#define GPIO_AC_INT_ENABLE         (0x1A8 >> 2)
 +#define GPIO_AC_INT_SENS_0         (0x1AC >> 2)
 +#define GPIO_AC_INT_SENS_1         (0x1B0 >> 2)
 +#define GPIO_AC_INT_SENS_2         (0x1B4 >> 2)
 +#define GPIO_AC_INT_STATUS         (0x1B8 >> 2)
 +#define GPIO_AC_RESET_TOLERANT     (0x1BC >> 2)
 +#define GPIO_AC_DEBOUNCE_1         (0x1C0 >> 2)
 +#define GPIO_AC_DEBOUNCE_2         (0x1C4 >> 2)
 +#define GPIO_AC_INPUT_MASK         (0x1C8 >> 2)
 +#define GPIO_ABCD_INPUT_MASK       (0x1D0 >> 2)
 +#define GPIO_EFGH_INPUT_MASK       (0x1D4 >> 2)
 +#define GPIO_YZAAAB_DATA_VALUE     (0x1E0 >> 2)
 +#define GPIO_YZAAAB_DIRECTION      (0x1E4 >> 2)
 +#define GPIO_AC_DATA_VALUE         (0x1E8 >> 2)
 +#define GPIO_AC_DIRECTION          (0x1EC >> 2)
 +#define GPIO_3_6V_MEM_SIZE         0x1F0
 +#define GPIO_3_6V_REG_ARRAY_SIZE   (GPIO_3_6V_MEM_SIZE >> 2)
 +
 +static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
 +{
 +    uint32_t falling_edge = 0, rising_edge = 0;
 +    uint32_t int_trigger = extract32(regs->int_sens_0, gpio, 1)
 +                           | extract32(regs->int_sens_1, gpio, 1) << 1
 +                           | extract32(regs->int_sens_2, gpio, 1) << 2;
 +    uint32_t gpio_curr_high = extract32(regs->data_value, gpio, 1);
 +    uint32_t gpio_int_enabled = extract32(regs->int_enable, gpio, 1);
 +
 +    if (!gpio_int_enabled) {
 +        return 0;
 +    }
 +
 +    /* Detect edges */
 +    if (gpio_curr_high && !gpio_prev_high) {
 +        rising_edge = 1;
 +    } else if (!gpio_curr_high && gpio_prev_high) {
 +        falling_edge = 1;
 +    }
 +
 +    if (((int_trigger == ASPEED_FALLING_EDGE)  && falling_edge)  ||
 +        ((int_trigger == ASPEED_RISING_EDGE)  && rising_edge)    ||
 +        ((int_trigger == ASPEED_LEVEL_LOW)  && !gpio_curr_high)  ||
 +        ((int_trigger == ASPEED_LEVEL_HIGH)  && gpio_curr_high)  ||
 +        ((int_trigger >= ASPEED_DUAL_EDGE)  && (rising_edge || falling_edge)))
 +    {
 +        regs->int_status = deposit32(regs->int_status, gpio, 1, 1);
 +        return 1;
 +    }
 +    return 0;
 +}
 +
 +#define nested_struct_index(ta, pa, m, tb, pb) \
 +        (pb - ((tb *)(((char *)pa) + offsetof(ta, m))))
 +
 +static ptrdiff_t aspeed_gpio_set_idx(AspeedGPIOState *s, GPIOSets *regs)
 +{
 +    return nested_struct_index(AspeedGPIOState, s, sets, GPIOSets, regs);
 +}
 +
 +static void aspeed_gpio_update(AspeedGPIOState *s, GPIOSets *regs,
 +                               uint32_t value)
 +{
 +    uint32_t input_mask = regs->input_mask;
 +    uint32_t direction = regs->direction;
 +    uint32_t old = regs->data_value;
 +    uint32_t new = value;
 +    uint32_t diff;
 +    int gpio;
 +
 +    diff = old ^ new;
 +    if (diff) {
 +        for (gpio = 0; gpio < GPIOS_PER_REG; gpio++) {
 +            uint32_t mask = 1 << gpio;
 +
 +            /* If the gpio needs to be updated... */
 +            if (!(diff & mask)) {
 +                continue;
 +            }
 +
 +            /* ...and we're output or not input-masked... */
 +            if (!(direction & mask) && (input_mask & mask)) {
 +                continue;
 +            }
 +
 +            /* ...then update the state. */
 +            if (mask & new) {
 +                regs->data_value |= mask;
 +            } else {
 +                regs->data_value &= ~mask;
 +            }
 +
 +            /* If the gpio is set to output... */
 +            if (direction & mask) {
 +                /* ...trigger the line-state IRQ */
 +                ptrdiff_t set = aspeed_gpio_set_idx(s, regs);
 +                size_t offset = set * GPIOS_PER_SET + gpio;
 +                qemu_set_irq(s->gpios[offset], !!(new & mask));
 +            } else {
 +                /* ...otherwise if we meet the line's current IRQ policy... */
 +                if (aspeed_evaluate_irq(regs, old & mask, gpio)) {
 +                    /* ...trigger the VIC IRQ */
 +                    s->pending++;
 +                }
 +            }
 +        }
 +    }
 +    qemu_set_irq(s->irq, !!(s->pending));
 +}
 +
 +static uint32_t aspeed_adjust_pin(AspeedGPIOState *s, uint32_t pin)
 +{
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    /*
 +     * The 2500 has a 4 pin gap in group AB and the 2400 has a 4 pin
 +     * gap in group Y (and only four pins in AB but this is the last group so
 +     * it doesn't matter).
 +     */
 +    if (agc->gap && pin >= agc->gap) {
 +        pin += GPIO_PIN_GAP_SIZE;
 +    }
 +
 +    return pin;
 +}
 +
 +static bool aspeed_gpio_get_pin_level(AspeedGPIOState *s, uint32_t set_idx,
 +                                      uint32_t pin)
 +{
 +    uint32_t reg_val;
 +    uint32_t pin_mask = 1 << pin;
 +
 +    reg_val = s->sets[set_idx].data_value;
 +
 +    return !!(reg_val & pin_mask);
 +}
 +
 +static void aspeed_gpio_set_pin_level(AspeedGPIOState *s, uint32_t set_idx,
 +                                      uint32_t pin, bool level)
 +{
 +    uint32_t value = s->sets[set_idx].data_value;
 +    uint32_t pin_mask = 1 << pin;
 +
 +    if (level) {
 +        value |= pin_mask;
 +    } else {
 +        value &= !pin_mask;
 +    }
 +
 +    aspeed_gpio_update(s, &s->sets[set_idx], value);
 +}
 +
 +/*
 + *  | src_1 | src_2 |  source     |
 + *  |-----------------------------|
 + *  |   0   |   0   |  ARM        |
 + *  |   0   |   1   |  LPC        |
 + *  |   1   |   0   |  Coprocessor|
 + *  |   1   |   1   |  Reserved   |
 + *
 + *  Once the source of a set is programmed, corresponding bits in the
 + *  data_value, direction, interrupt [enable, sens[0-2]], reset_tol and
 + *  debounce registers can only be written by the source.
 + *
 + *  Source is ARM by default
 + *  only bits 24, 16, 8, and 0 can be set
 + *
 + *  we don't currently have a model for the LPC or Coprocessor
 + */
 +static uint32_t update_value_control_source(GPIOSets *regs, uint32_t old_value,
 +                                            uint32_t value)
 +{
 +    int i;
 +    int cmd_source;
 +
 +    /* assume the source is always ARM for now */
 +    int source = ASPEED_SOURCE_ARM;
 +
 +    uint32_t new_value = 0;
 +
 +    /* for each group in set */
 +    for (i = 0; i < GPIOS_PER_REG; i += GPIOS_PER_GROUP) {
 +        cmd_source = extract32(regs->cmd_source_0, i, 1)
 +                | (extract32(regs->cmd_source_1, i, 1) << 1);
 +
 +        if (source == cmd_source) {
 +            new_value |= (0xff << i) & value;
 +        } else {
 +            new_value |= (0xff << i) & old_value;
 +        }
 +    }
 +    return new_value;
 +}
 +
 +static const AspeedGPIOReg aspeed_3_6v_gpios[GPIO_3_6V_REG_ARRAY_SIZE] = {
 +    /* Set ABCD */
 +    [GPIO_ABCD_DATA_VALUE] =     { 0, gpio_reg_data_value },
 +    [GPIO_ABCD_DIRECTION] =      { 0, gpio_reg_direction },
 +    [GPIO_ABCD_INT_ENABLE] =     { 0, gpio_reg_int_enable },
 +    [GPIO_ABCD_INT_SENS_0] =     { 0, gpio_reg_int_sens_0 },
 +    [GPIO_ABCD_INT_SENS_1] =     { 0, gpio_reg_int_sens_1 },
 +    [GPIO_ABCD_INT_SENS_2] =     { 0, gpio_reg_int_sens_2 },
 +    [GPIO_ABCD_INT_STATUS] =     { 0, gpio_reg_int_status },
 +    [GPIO_ABCD_RESET_TOLERANT] = { 0, gpio_reg_reset_tolerant },
 +    [GPIO_ABCD_DEBOUNCE_1] =     { 0, gpio_reg_debounce_1 },
 +    [GPIO_ABCD_DEBOUNCE_2] =     { 0, gpio_reg_debounce_2 },
 +    [GPIO_ABCD_COMMAND_SRC_0] =  { 0, gpio_reg_cmd_source_0 },
 +    [GPIO_ABCD_COMMAND_SRC_1] =  { 0, gpio_reg_cmd_source_1 },
 +    [GPIO_ABCD_DATA_READ] =      { 0, gpio_reg_data_read },
 +    [GPIO_ABCD_INPUT_MASK] =     { 0, gpio_reg_input_mask },
 +    /* Set EFGH */
 +    [GPIO_EFGH_DATA_VALUE] =     { 1, gpio_reg_data_value },
 +    [GPIO_EFGH_DIRECTION] =      { 1, gpio_reg_direction },
 +    [GPIO_EFGH_INT_ENABLE] =     { 1, gpio_reg_int_enable },
 +    [GPIO_EFGH_INT_SENS_0] =     { 1, gpio_reg_int_sens_0 },
 +    [GPIO_EFGH_INT_SENS_1] =     { 1, gpio_reg_int_sens_1 },
 +    [GPIO_EFGH_INT_SENS_2] =     { 1, gpio_reg_int_sens_2 },
 +    [GPIO_EFGH_INT_STATUS] =     { 1, gpio_reg_int_status },
 +    [GPIO_EFGH_RESET_TOLERANT] = { 1, gpio_reg_reset_tolerant },
 +    [GPIO_EFGH_DEBOUNCE_1] =     { 1, gpio_reg_debounce_1 },
 +    [GPIO_EFGH_DEBOUNCE_2] =     { 1, gpio_reg_debounce_2 },
 +    [GPIO_EFGH_COMMAND_SRC_0] =  { 1, gpio_reg_cmd_source_0 },
 +    [GPIO_EFGH_COMMAND_SRC_1] =  { 1, gpio_reg_cmd_source_1 },
 +    [GPIO_EFGH_DATA_READ] =      { 1, gpio_reg_data_read },
 +    [GPIO_EFGH_INPUT_MASK] =     { 1, gpio_reg_input_mask },
 +    /* Set IJKL */
 +    [GPIO_IJKL_DATA_VALUE] =     { 2, gpio_reg_data_value },
 +    [GPIO_IJKL_DIRECTION] =      { 2, gpio_reg_direction },
 +    [GPIO_IJKL_INT_ENABLE] =     { 2, gpio_reg_int_enable },
 +    [GPIO_IJKL_INT_SENS_0] =     { 2, gpio_reg_int_sens_0 },
 +    [GPIO_IJKL_INT_SENS_1] =     { 2, gpio_reg_int_sens_1 },
 +    [GPIO_IJKL_INT_SENS_2] =     { 2, gpio_reg_int_sens_2 },
 +    [GPIO_IJKL_INT_STATUS] =     { 2, gpio_reg_int_status },
 +    [GPIO_IJKL_RESET_TOLERANT] = { 2, gpio_reg_reset_tolerant },
 +    [GPIO_IJKL_DEBOUNCE_1] =     { 2, gpio_reg_debounce_1 },
 +    [GPIO_IJKL_DEBOUNCE_2] =     { 2, gpio_reg_debounce_2 },
 +    [GPIO_IJKL_COMMAND_SRC_0] =  { 2, gpio_reg_cmd_source_0 },
 +    [GPIO_IJKL_COMMAND_SRC_1] =  { 2, gpio_reg_cmd_source_1 },
 +    [GPIO_IJKL_DATA_READ] =      { 2, gpio_reg_data_read },
 +    [GPIO_IJKL_INPUT_MASK] =     { 2, gpio_reg_input_mask },
 +    /* Set MNOP */
 +    [GPIO_MNOP_DATA_VALUE] =     { 3, gpio_reg_data_value },
 +    [GPIO_MNOP_DIRECTION] =      { 3, gpio_reg_direction },
 +    [GPIO_MNOP_INT_ENABLE] =     { 3, gpio_reg_int_enable },
 +    [GPIO_MNOP_INT_SENS_0] =     { 3, gpio_reg_int_sens_0 },
 +    [GPIO_MNOP_INT_SENS_1] =     { 3, gpio_reg_int_sens_1 },
 +    [GPIO_MNOP_INT_SENS_2] =     { 3, gpio_reg_int_sens_2 },
 +    [GPIO_MNOP_INT_STATUS] =     { 3, gpio_reg_int_status },
 +    [GPIO_MNOP_RESET_TOLERANT] = { 3, gpio_reg_reset_tolerant },
 +    [GPIO_MNOP_DEBOUNCE_1] =     { 3, gpio_reg_debounce_1 },
 +    [GPIO_MNOP_DEBOUNCE_2] =     { 3, gpio_reg_debounce_2 },
 +    [GPIO_MNOP_COMMAND_SRC_0] =  { 3, gpio_reg_cmd_source_0 },
 +    [GPIO_MNOP_COMMAND_SRC_1] =  { 3, gpio_reg_cmd_source_1 },
 +    [GPIO_MNOP_DATA_READ] =      { 3, gpio_reg_data_read },
 +    [GPIO_MNOP_INPUT_MASK] =     { 3, gpio_reg_input_mask },
 +    /* Set QRST */
 +    [GPIO_QRST_DATA_VALUE] =     { 4, gpio_reg_data_value },
 +    [GPIO_QRST_DIRECTION] =      { 4, gpio_reg_direction },
 +    [GPIO_QRST_INT_ENABLE] =     { 4, gpio_reg_int_enable },
 +    [GPIO_QRST_INT_SENS_0] =     { 4, gpio_reg_int_sens_0 },
 +    [GPIO_QRST_INT_SENS_1] =     { 4, gpio_reg_int_sens_1 },
 +    [GPIO_QRST_INT_SENS_2] =     { 4, gpio_reg_int_sens_2 },
 +    [GPIO_QRST_INT_STATUS] =     { 4, gpio_reg_int_status },
 +    [GPIO_QRST_RESET_TOLERANT] = { 4, gpio_reg_reset_tolerant },
 +    [GPIO_QRST_DEBOUNCE_1] =     { 4, gpio_reg_debounce_1 },
 +    [GPIO_QRST_DEBOUNCE_2] =     { 4, gpio_reg_debounce_2 },
 +    [GPIO_QRST_COMMAND_SRC_0] =  { 4, gpio_reg_cmd_source_0 },
 +    [GPIO_QRST_COMMAND_SRC_1] =  { 4, gpio_reg_cmd_source_1 },
 +    [GPIO_QRST_DATA_READ] =      { 4, gpio_reg_data_read },
 +    [GPIO_QRST_INPUT_MASK] =     { 4, gpio_reg_input_mask },
 +    /* Set UVWX */
 +    [GPIO_UVWX_DATA_VALUE] =     { 5, gpio_reg_data_value },
 +    [GPIO_UVWX_DIRECTION] =      { 5, gpio_reg_direction },
 +    [GPIO_UVWX_INT_ENABLE] =     { 5, gpio_reg_int_enable },
 +    [GPIO_UVWX_INT_SENS_0] =     { 5, gpio_reg_int_sens_0 },
 +    [GPIO_UVWX_INT_SENS_1] =     { 5, gpio_reg_int_sens_1 },
 +    [GPIO_UVWX_INT_SENS_2] =     { 5, gpio_reg_int_sens_2 },
 +    [GPIO_UVWX_INT_STATUS] =     { 5, gpio_reg_int_status },
 +    [GPIO_UVWX_RESET_TOLERANT] = { 5, gpio_reg_reset_tolerant },
 +    [GPIO_UVWX_DEBOUNCE_1] =     { 5, gpio_reg_debounce_1 },
 +    [GPIO_UVWX_DEBOUNCE_2] =     { 5, gpio_reg_debounce_2 },
 +    [GPIO_UVWX_COMMAND_SRC_0] =  { 5, gpio_reg_cmd_source_0 },
 +    [GPIO_UVWX_COMMAND_SRC_1] =  { 5, gpio_reg_cmd_source_1 },
 +    [GPIO_UVWX_DATA_READ] =      { 5, gpio_reg_data_read },
 +    [GPIO_UVWX_INPUT_MASK] =     { 5, gpio_reg_input_mask },
 +    /* Set YZAAAB */
 +    [GPIO_YZAAAB_DATA_VALUE] =     { 6, gpio_reg_data_value },
 +    [GPIO_YZAAAB_DIRECTION] =      { 6, gpio_reg_direction },
 +    [GPIO_YZAAAB_INT_ENABLE] =     { 6, gpio_reg_int_enable },
 +    [GPIO_YZAAAB_INT_SENS_0] =     { 6, gpio_reg_int_sens_0 },
 +    [GPIO_YZAAAB_INT_SENS_1] =     { 6, gpio_reg_int_sens_1 },
 +    [GPIO_YZAAAB_INT_SENS_2] =     { 6, gpio_reg_int_sens_2 },
 +    [GPIO_YZAAAB_INT_STATUS] =     { 6, gpio_reg_int_status },
 +    [GPIO_YZAAAB_RESET_TOLERANT] = { 6, gpio_reg_reset_tolerant },
 +    [GPIO_YZAAAB_DEBOUNCE_1] =     { 6, gpio_reg_debounce_1 },
 +    [GPIO_YZAAAB_DEBOUNCE_2] =     { 6, gpio_reg_debounce_2 },
 +    [GPIO_YZAAAB_COMMAND_SRC_0] =  { 6, gpio_reg_cmd_source_0 },
 +    [GPIO_YZAAAB_COMMAND_SRC_1] =  { 6, gpio_reg_cmd_source_1 },
 +    [GPIO_YZAAAB_DATA_READ] =      { 6, gpio_reg_data_read },
 +    [GPIO_YZAAAB_INPUT_MASK] =     { 6, gpio_reg_input_mask },
 +    /* Set AC  (ast2500 only) */
 +    [GPIO_AC_DATA_VALUE] =         { 7, gpio_reg_data_value },
 +    [GPIO_AC_DIRECTION] =          { 7, gpio_reg_direction },
 +    [GPIO_AC_INT_ENABLE] =         { 7, gpio_reg_int_enable },
 +    [GPIO_AC_INT_SENS_0] =         { 7, gpio_reg_int_sens_0 },
 +    [GPIO_AC_INT_SENS_1] =         { 7, gpio_reg_int_sens_1 },
 +    [GPIO_AC_INT_SENS_2] =         { 7, gpio_reg_int_sens_2 },
 +    [GPIO_AC_INT_STATUS] =         { 7, gpio_reg_int_status },
 +    [GPIO_AC_RESET_TOLERANT] =     { 7, gpio_reg_reset_tolerant },
 +    [GPIO_AC_DEBOUNCE_1] =         { 7, gpio_reg_debounce_1 },
 +    [GPIO_AC_DEBOUNCE_2] =         { 7, gpio_reg_debounce_2 },
 +    [GPIO_AC_COMMAND_SRC_0] =      { 7, gpio_reg_cmd_source_0 },
 +    [GPIO_AC_COMMAND_SRC_1] =      { 7, gpio_reg_cmd_source_1 },
 +    [GPIO_AC_DATA_READ] =          { 7, gpio_reg_data_read },
 +    [GPIO_AC_INPUT_MASK] =         { 7, gpio_reg_input_mask },
 +};
 +
 +static uint64_t aspeed_gpio_read(void *opaque, hwaddr offset, uint32_t size)
 +{
 +    AspeedGPIOState *s = ASPEED_GPIO(opaque);
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    uint64_t idx = -1;
 +    const AspeedGPIOReg *reg;
 +    GPIOSets *set;
 +
 +    idx = offset >> 2;
 +    if (idx >= GPIO_DEBOUNCE_TIME_1 && idx <= GPIO_DEBOUNCE_TIME_3) {
 +        idx -= GPIO_DEBOUNCE_TIME_1;
 +        return (uint64_t) s->debounce_regs[idx];
 +    }
 +
 +    reg = &agc->reg_table[idx];
 +    if (reg->set_idx >= agc->nr_gpio_sets) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: no getter for offset 0x%"
 +                      HWADDR_PRIx"\n", __func__, offset);
 +        return 0;
 +    }
 +
 +    set = &s->sets[reg->set_idx];
 +    switch (reg->type) {
 +    case gpio_reg_data_value:
 +        return set->data_value;
 +    case gpio_reg_direction:
 +        return set->direction;
 +    case gpio_reg_int_enable:
 +        return set->int_enable;
 +    case gpio_reg_int_sens_0:
 +        return set->int_sens_0;
 +    case gpio_reg_int_sens_1:
 +        return set->int_sens_1;
 +    case gpio_reg_int_sens_2:
 +        return set->int_sens_2;
 +    case gpio_reg_int_status:
 +        return set->int_status;
 +    case gpio_reg_reset_tolerant:
 +        return set->reset_tol;
 +    case gpio_reg_debounce_1:
 +        return set->debounce_1;
 +    case gpio_reg_debounce_2:
 +        return set->debounce_2;
 +    case gpio_reg_cmd_source_0:
 +        return set->cmd_source_0;
 +    case gpio_reg_cmd_source_1:
 +        return set->cmd_source_1;
 +    case gpio_reg_data_read:
 +        return set->data_read;
 +    case gpio_reg_input_mask:
 +        return set->input_mask;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: no getter for offset 0x%"
 +                      HWADDR_PRIx"\n", __func__, offset);
 +        return 0;
 +    };
 +}
 +
 +static void aspeed_gpio_write(void *opaque, hwaddr offset, uint64_t data,
 +                              uint32_t size)
 +{
 +    AspeedGPIOState *s = ASPEED_GPIO(opaque);
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    const GPIOSetProperties *props;
 +    uint64_t idx = -1;
 +    const AspeedGPIOReg *reg;
 +    GPIOSets *set;
 +    uint32_t cleared;
 +
 +    idx = offset >> 2;
 +    if (idx >= GPIO_DEBOUNCE_TIME_1 && idx <= GPIO_DEBOUNCE_TIME_3) {
 +        idx -= GPIO_DEBOUNCE_TIME_1;
 +        s->debounce_regs[idx] = (uint32_t) data;
 +        return;
 +    }
 +
 +    reg = &agc->reg_table[idx];
 +    if (reg->set_idx >= agc->nr_gpio_sets) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: no setter for offset 0x%"
 +                      HWADDR_PRIx"\n", __func__, offset);
 +        return;
 +    }
 +
 +    set = &s->sets[reg->set_idx];
 +    props = &agc->props[reg->set_idx];
 +
 +    switch (reg->type) {
 +    case gpio_reg_data_value:
 +        data &= props->output;
 +        data = update_value_control_source(set, set->data_value, data);
 +        set->data_read = data;
 +        aspeed_gpio_update(s, set, data);
 +        return;
 +    case gpio_reg_direction:
 +        /*
 +         *   where data is the value attempted to be written to the pin:
 +         *    pin type      | input mask | output mask | expected value
 +         *    ------------------------------------------------------------
 +         *   bidirectional  |   1       |   1        |  data
 +         *   input only     |   1       |   0        |   0
 +         *   output only    |   0       |   1        |   1
 +         *   no pin / gap   |   0       |   0        |   0
 +         *
 +         *  which is captured by:
 +         *  data = ( data | ~input) & output;
 +         */
 +        data = (data | ~props->input) & props->output;
 +        set->direction = update_value_control_source(set, set->direction, data);
 +        break;
 +    case gpio_reg_int_enable:
 +        set->int_enable = update_value_control_source(set, set->int_enable,
 +                                                      data);
 +        break;
 +    case gpio_reg_int_sens_0:
 +        set->int_sens_0 = update_value_control_source(set, set->int_sens_0,
 +                                                      data);
 +        break;
 +    case gpio_reg_int_sens_1:
 +        set->int_sens_1 = update_value_control_source(set, set->int_sens_1,
 +                                                      data);
 +        break;
 +    case gpio_reg_int_sens_2:
 +        set->int_sens_2 = update_value_control_source(set, set->int_sens_2,
 +                                                      data);
 +        break;
 +    case gpio_reg_int_status:
 +        cleared = ctpop32(data & set->int_status);
 +        if (s->pending && cleared) {
 +            assert(s->pending >= cleared);
 +            s->pending -= cleared;
 +        }
 +        set->int_status &= ~data;
 +        break;
 +    case gpio_reg_reset_tolerant:
 +        set->reset_tol = update_value_control_source(set, set->reset_tol,
 +                                                     data);
 +        return;
 +    case gpio_reg_debounce_1:
 +        set->debounce_1 = update_value_control_source(set, set->debounce_1,
 +                                                      data);
 +        return;
 +    case gpio_reg_debounce_2:
 +        set->debounce_2 = update_value_control_source(set, set->debounce_2,
 +                                                      data);
 +        return;
 +    case gpio_reg_cmd_source_0:
 +        set->cmd_source_0 = data & ASPEED_CMD_SRC_MASK;
 +        return;
 +    case gpio_reg_cmd_source_1:
 +        set->cmd_source_1 = data & ASPEED_CMD_SRC_MASK;
 +        return;
 +    case gpio_reg_data_read:
 +        /* Read only register */
 +        return;
 +    case gpio_reg_input_mask:
 +        /*
 +         * feeds into interrupt generation
 +         * 0: read from data value reg will be updated
 +         * 1: read from data value reg will not be updated
 +         */
 +         set->input_mask = data & props->input;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: no setter for offset 0x%"
 +                      HWADDR_PRIx"\n", __func__, offset);
 +        return;
 +    }
 +    aspeed_gpio_update(s, set, set->data_value);
 +    return;
 +}
 +
 +static int get_set_idx(AspeedGPIOState *s, const char *group, int *group_idx)
 +{
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    int set_idx, g_idx = *group_idx;
 +
 +    for (set_idx = 0; set_idx < agc->nr_gpio_sets; set_idx++) {
 +        const GPIOSetProperties *set_props = &agc->props[set_idx];
 +        for (g_idx = 0; g_idx < ASPEED_GROUPS_PER_SET; g_idx++) {
 +            if (!strncmp(group, set_props->group_label[g_idx], strlen(group))) {
 +                *group_idx = g_idx;
 +                return set_idx;
 +            }
 +        }
 +    }
 +    return -1;
 +}
 +
 +static void aspeed_gpio_get_pin(Object *obj, Visitor *v, const char *name,
 +                                void *opaque, Error **errp)
 +{
 +    int pin = 0xfff;
 +    bool level = true;
 +    char group[3];
 +    AspeedGPIOState *s = ASPEED_GPIO(obj);
 +    int set_idx, group_idx = 0;
 +
 +    if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
 +        error_setg(errp, "%s: error reading %s", __func__, name);
 +        return;
 +    }
 +    set_idx = get_set_idx(s, group, &group_idx);
 +    if (set_idx == -1) {
 +        error_setg(errp, "%s: invalid group %s", __func__, group);
 +        return;
 +    }
 +    pin =  pin + group_idx * GPIOS_PER_GROUP;
 +    level = aspeed_gpio_get_pin_level(s, set_idx, pin);
 +    visit_type_bool(v, name, &level, errp);
 +}
 +
 +static void aspeed_gpio_set_pin(Object *obj, Visitor *v, const char *name,
 +                               void *opaque, Error **errp)
 +{
 +    Error *local_err = NULL;
 +    bool level;
 +    int pin = 0xfff;
 +    char group[3];
 +    AspeedGPIOState *s = ASPEED_GPIO(obj);
 +    int set_idx, group_idx = 0;
 +
 +    visit_type_bool(v, name, &level, &local_err);
 +    if (local_err) {
 +        error_propagate(errp, local_err);
 +        return;
 +    }
 +    if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
 +        error_setg(errp, "%s: error reading %s", __func__, name);
 +        return;
 +    }
 +    set_idx = get_set_idx(s, group, &group_idx);
 +    if (set_idx == -1) {
 +        error_setg(errp, "%s: invalid group %s", __func__, group);
 +        return;
 +    }
 +    pin =  pin + group_idx * GPIOS_PER_GROUP;
 +    aspeed_gpio_set_pin_level(s, set_idx, pin, level);
 +}
 +
 +/****************** Setup functions ******************/
 +static const GPIOSetProperties ast2400_set_props[] = {
 +    [0] = {0xffffffff,  0xffffffff,  {"A", "B", "C", "D"} },
 +    [1] = {0xffffffff,  0xffffffff,  {"E", "F", "G", "H"} },
 +    [2] = {0xffffffff,  0xffffffff,  {"I", "J", "K", "L"} },
 +    [3] = {0xffffffff,  0xffffffff,  {"M", "N", "O", "P"} },
 +    [4] = {0xffffffff,  0xffffffff,  {"Q", "R", "S", "T"} },
 +    [5] = {0xffffffff,  0x0000ffff,  {"U", "V", "W", "X"} },
 +    [6] = {0x0000000f,  0x0fffff0f,  {"Y", "Z", "AA", "AB"} },
 +};
 +
 +static const GPIOSetProperties ast2500_set_props[] = {
 +    [0] = {0xffffffff,  0xffffffff,  {"A", "B", "C", "D"} },
 +    [1] = {0xffffffff,  0xffffffff,  {"E", "F", "G", "H"} },
 +    [2] = {0xffffffff,  0xffffffff,  {"I", "J", "K", "L"} },
 +    [3] = {0xffffffff,  0xffffffff,  {"M", "N", "O", "P"} },
 +    [4] = {0xffffffff,  0xffffffff,  {"Q", "R", "S", "T"} },
 +    [5] = {0xffffffff,  0x0000ffff,  {"U", "V", "W", "X"} },
 +    [6] = {0xffffff0f,  0x0fffff0f,  {"Y", "Z", "AA", "AB"} },
 +    [7] = {0x000000ff,  0x000000ff,  {"AC"} },
 +};
 +
 +static const MemoryRegionOps aspeed_gpio_ops = {
 +    .read       = aspeed_gpio_read,
 +    .write      = aspeed_gpio_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid.min_access_size = 4,
 +    .valid.max_access_size = 4,
 +};
 +
 +static void aspeed_gpio_reset(DeviceState *dev)
 +{
 +    AspeedGPIOState *s = ASPEED_GPIO(dev);
 +
 +    /* TODO: respect the reset tolerance registers */
 +    memset(s->sets, 0, sizeof(s->sets));
 +}
 +
 +static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
 +{
 +    AspeedGPIOState *s = ASPEED_GPIO(dev);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    int pin;
 +
 +    /* Interrupt parent line */
 +    sysbus_init_irq(sbd, &s->irq);
 +
 +    /* Individual GPIOs */
 +    for (pin = 0; pin < agc->nr_gpio_pins; pin++) {
 +        sysbus_init_irq(sbd, &s->gpios[pin]);
 +    }
 +
 +    memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
 +            TYPE_ASPEED_GPIO, GPIO_3_6V_MEM_SIZE);
 +
 +    sysbus_init_mmio(sbd, &s->iomem);
 +}
 +
 +static void aspeed_gpio_init(Object *obj)
 +{
 +    AspeedGPIOState *s = ASPEED_GPIO(obj);
 +    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
 +    int pin;
 +
 +    for (pin = 0; pin < agc->nr_gpio_pins; pin++) {
 +        char *name;
 +        int set_idx = pin / GPIOS_PER_SET;
 +        int pin_idx = aspeed_adjust_pin(s, pin) - (set_idx * GPIOS_PER_SET);
 +        int group_idx = pin_idx >> GPIO_GROUP_SHIFT;
 +        const GPIOSetProperties *props = &agc->props[set_idx];
 +
 +        name = g_strdup_printf("gpio%s%d", props->group_label[group_idx],
 +                               pin_idx % GPIOS_PER_GROUP);
 +        object_property_add(obj, name, "bool", aspeed_gpio_get_pin,
 +                            aspeed_gpio_set_pin, NULL, NULL, NULL);
 +    }
 +}
 +
 +static const VMStateDescription vmstate_gpio_regs = {
 +    .name = TYPE_ASPEED_GPIO"/regs",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(data_value,   GPIOSets),
 +        VMSTATE_UINT32(data_read,    GPIOSets),
 +        VMSTATE_UINT32(direction,    GPIOSets),
 +        VMSTATE_UINT32(int_enable,   GPIOSets),
 +        VMSTATE_UINT32(int_sens_0,   GPIOSets),
 +        VMSTATE_UINT32(int_sens_1,   GPIOSets),
 +        VMSTATE_UINT32(int_sens_2,   GPIOSets),
 +        VMSTATE_UINT32(int_status,   GPIOSets),
 +        VMSTATE_UINT32(reset_tol,    GPIOSets),
 +        VMSTATE_UINT32(cmd_source_0, GPIOSets),
 +        VMSTATE_UINT32(cmd_source_1, GPIOSets),
 +        VMSTATE_UINT32(debounce_1,   GPIOSets),
 +        VMSTATE_UINT32(debounce_2,   GPIOSets),
 +        VMSTATE_UINT32(input_mask,   GPIOSets),
 +        VMSTATE_END_OF_LIST(),
 +    }
 +};
 +
 +static const VMStateDescription vmstate_aspeed_gpio = {
 +    .name = TYPE_ASPEED_GPIO,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_STRUCT_ARRAY(sets, AspeedGPIOState, ASPEED_GPIO_MAX_NR_SETS,
 +                             1, vmstate_gpio_regs, GPIOSets),
 +        VMSTATE_UINT32_ARRAY(debounce_regs, AspeedGPIOState,
 +                             ASPEED_GPIO_NR_DEBOUNCE_REGS),
 +        VMSTATE_END_OF_LIST(),
 +   }
 +};
 +
 +static void aspeed_gpio_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->realize = aspeed_gpio_realize;
 +    dc->reset = aspeed_gpio_reset;
 +    dc->desc = "Aspeed GPIO Controller";
 +    dc->vmsd = &vmstate_aspeed_gpio;
 +}
 +
 +static void aspeed_gpio_ast2400_class_init(ObjectClass *klass, void *data)
 +{
 +    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 +
 +    agc->props = ast2400_set_props;
 +    agc->nr_gpio_pins = 216;
 +    agc->nr_gpio_sets = 7;
 +    agc->gap = 196;
 +    agc->reg_table = aspeed_3_6v_gpios;
 +}
 +
 +static void aspeed_gpio_2500_class_init(ObjectClass *klass, void *data)
 +{
 +    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
 +
 +    agc->props = ast2500_set_props;
 +    agc->nr_gpio_pins = 228;
 +    agc->nr_gpio_sets = 8;
 +    agc->gap = 220;
 +    agc->reg_table = aspeed_3_6v_gpios;
 +}
 +
 +static const TypeInfo aspeed_gpio_info = {
 +    .name           = TYPE_ASPEED_GPIO,
 +    .parent         = TYPE_SYS_BUS_DEVICE,
 +    .instance_size  = sizeof(AspeedGPIOState),
 +    .class_size     = sizeof(AspeedGPIOClass),
 +    .class_init     = aspeed_gpio_class_init,
 +    .abstract       = true,
 +};
 +
 +static const TypeInfo aspeed_gpio_ast2400_info = {
 +    .name           = TYPE_ASPEED_GPIO "-ast2400",
 +    .parent         = TYPE_ASPEED_GPIO,
 +    .class_init     = aspeed_gpio_ast2400_class_init,
 +    .instance_init  = aspeed_gpio_init,
 +};
 +
 +static const TypeInfo aspeed_gpio_ast2500_info = {
 +    .name           = TYPE_ASPEED_GPIO "-ast2500",
 +    .parent         = TYPE_ASPEED_GPIO,
 +    .class_init     = aspeed_gpio_2500_class_init,
 +    .instance_init  = aspeed_gpio_init,
 +};
 +
 +static void aspeed_gpio_register_types(void)
 +{
 +    type_register_static(&aspeed_gpio_info);
 +    type_register_static(&aspeed_gpio_ast2400_info);
 +    type_register_static(&aspeed_gpio_ast2500_info);
 +}
 +
 +type_init(aspeed_gpio_register_types);
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 05/12] aspeed/smc: Add support for DMAs
+[PULL 10/36] hw/arm/stellaris: Replace magic numbers by definitions
-From: Cédric Le Goater <clg@kaod.org>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-The FMC controller on the Aspeed SoCs support DMA to access the flash
+Add definitions for the number of controllers.
 modules. It can operate in a normal mode, to copy to or from the flash
 module mapping window, or in a checksum calculation mode, to evaluate
 the best clock settings for reads.
-The model introduces two custom address spaces for DMAs: one for the
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 AHB window of the FMC flash devices and one for the DRAM. The latter
 is populated using a "dram" link set from the machine with the RAM
 container region.
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Acked-by: Joel Stanley <joel@jms.id.au>
 Message-id: 20190904070506.1052-6-clg@kaod.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-5-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/ssi/aspeed_smc.h |   6 +
+ hw/arm/stellaris.c | 25 +++++++++++++++----------
- hw/arm/aspeed.c             |   2 +
+file changed, 15 insertions(+), 10 deletions(-)
  hw/arm/aspeed_soc.c         |   2 +
  hw/ssi/aspeed_smc.c         | 222 +++++++++++++++++++++++++++++++++++-
 files changed, 226 insertions(+), 6 deletions(-)
-diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/ssi/aspeed_smc.h
+--- a/hw/arm/stellaris.c
-+++ b/include/hw/ssi/aspeed_smc.h
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCController {
+@@ -XXX,XX +XXX,XX @@
-     hwaddr flash_window_base;
+ #define NUM_IRQ_LINES 64
-     uint32_t flash_window_size;
+ #define NUM_PRIO_BITS 3
-     bool has_dma;
-+    hwaddr dma_flash_mask;
++#define NUM_GPIO    7
-+    hwaddr dma_dram_mask;
++#define NUM_UART    4
-     uint32_t nregs;
++#define NUM_GPTM    4
- } AspeedSMCController;
++#define NUM_I2C     2
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCState {
      /* for DMA support */
      uint64_t sdram_base;
 +    AddressSpace flash_as;
 +    MemoryRegion *dram_mr;
 +    AddressSpace dram_as;
 +
-     AspeedSMCFlash *flashes;
+ typedef const struct {
+     const char *name;
-     uint8_t snoop_index;
+     uint32_t did0;
-diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
+@@ -XXX,XX +XXX,XX @@ static const stellaris_board_info stellaris_boards[] = {
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed.c
+ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+++ b/hw/arm/aspeed.c
+ {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
+-    static const int uart_irq[] = {5, 6, 33, 34};
-                             &error_abort);
+-    static const int timer_irq[] = {19, 21, 23, 35};
-     object_property_set_int(OBJECT(&bmc->soc), machine->smp.cpus, "num-cpus",
+-    static const uint32_t gpio_addr[7] =
-                             &error_abort);
++    static const int uart_irq[NUM_UART] = {5, 6, 33, 34};
-+    object_property_set_link(OBJECT(&bmc->soc), OBJECT(&bmc->ram_container),
++    static const int timer_irq[NUM_GPTM] = {19, 21, 23, 35};
-+                             "dram", &error_abort);
++    static const uint32_t gpio_addr[NUM_GPIO] =
-     if (machine->kernel_filename) {
+       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
-         /*
+x40024000, 0x40025000, 0x40026000};
-          * When booting with a -kernel command line there is no u-boot
+-    static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
++    static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
+     /* Memory map of SoC devices, from
-+++ b/hw/arm/aspeed_soc.c
+      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-                           typename);
+      */
-     object_property_add_alias(obj, "num-cs", OBJECT(&s->fmc), "num-cs",
-                               &error_abort);
+     Object *soc_container;
-+    object_property_add_alias(obj, "dram", OBJECT(&s->fmc), "dram",
+-    DeviceState *gpio_dev[7], *armv7m, *nvic;
-+                              &error_abort);
+-    qemu_irq gpio_in[7][8];
+-    qemu_irq gpio_out[7][8];
-     for (i = 0; i < sc->info->spis_num; i++) {
++    DeviceState *gpio_dev[NUM_GPIO], *armv7m, *nvic;
-         snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
++    qemu_irq gpio_in[NUM_GPIO][8];
-diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
++    qemu_irq gpio_out[NUM_GPIO][8];
-index XXXXXXX..XXXXXXX 100644
+     qemu_irq adc;
---- a/hw/ssi/aspeed_smc.c
+     int sram_size;
-+++ b/hw/ssi/aspeed_smc.c
+     int flash_size;
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
- #include "qemu/log.h"
+     } else {
- #include "qemu/module.h"
+         adc = NULL;
  #include "qemu/error-report.h"
 +#include "qapi/error.h"
 +#include "exec/address-spaces.h"
  #include "hw/irq.h"
  #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@
  #define   DMA_CTRL_FREQ_SHIFT   4
  #define   DMA_CTRL_MODE         (1 << 3)
  #define   DMA_CTRL_CKSUM        (1 << 2)
 -#define   DMA_CTRL_DIR          (1 << 1)
 -#define   DMA_CTRL_EN           (1 << 0)
 +#define   DMA_CTRL_WRITE        (1 << 1)
 +#define   DMA_CTRL_ENABLE       (1 << 0)
  /* DMA Flash Side Address */
  #define R_DMA_FLASH_ADDR  (0x84 / 4)
@@ -XXX,XX +XXX,XX @@
  #define ASPEED_SOC_SPI_FLASH_BASE   0x30000000
  #define ASPEED_SOC_SPI2_FLASH_BASE  0x38000000
 +/*
 + * DMA DRAM addresses should be 4 bytes aligned and the valid address
 + * range is 0x40000000 - 0x5FFFFFFF (AST2400)
 + *          0x80000000 - 0xBFFFFFFF (AST2500)
 + *
 + * DMA flash addresses should be 4 bytes aligned and the valid address
 + * range is 0x20000000 - 0x2FFFFFFF.
 + *
 + * DMA length is from 4 bytes to 32MB
 + *   0: 4 bytes
 + *   0x7FFFFF: 32M bytes
 + */
 +#define DMA_DRAM_ADDR(s, val)   ((s)->sdram_base | \
 +                                 ((val) & (s)->ctrl->dma_dram_mask))
 +#define DMA_FLASH_ADDR(s, val)  ((s)->ctrl->flash_window_base | \
 +                                ((val) & (s)->ctrl->dma_flash_mask))
 +#define DMA_LENGTH(val)         ((val) & 0x01FFFFFC)
 +
  /* Flash opcodes. */
  #define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
          .flash_window_size = 0x10000000,
          .has_dma           = true,
 +        .dma_flash_mask    = 0x0FFFFFFC,
 +        .dma_dram_mask     = 0x1FFFFFFC,
          .nregs             = ASPEED_SMC_R_MAX,
      }, {
          .name              = "aspeed.spi1-ast2400",
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
          .flash_window_size = 0x10000000,
          .has_dma           = true,
 +        .dma_flash_mask    = 0x0FFFFFFC,
 +        .dma_dram_mask     = 0x3FFFFFFC,
          .nregs             = ASPEED_SMC_R_MAX,
      }, {
          .name              = "aspeed.spi1-ast2500",
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reset(DeviceState *d)
      memset(s->regs, 0, sizeof s->regs);
 -    /* Pretend DMA is done (u-boot initialization) */
 -    s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS;
 -
      /* Unselect all slaves */
      for (i = 0; i < s->num_cs; ++i) {
          s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
          addr == s->r_ce_ctrl ||
          addr == R_INTR_CTRL ||
          addr == R_DUMMY_DATA ||
 +        (s->ctrl->has_dma && addr == R_DMA_CTRL) ||
 +        (s->ctrl->has_dma && addr == R_DMA_FLASH_ADDR) ||
 +        (s->ctrl->has_dma && addr == R_DMA_DRAM_ADDR) ||
 +        (s->ctrl->has_dma && addr == R_DMA_LEN) ||
 +        (s->ctrl->has_dma && addr == R_DMA_CHECKSUM) ||
          (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) ||
          (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->ctrl->max_slaves)) {
          return s->regs[addr];
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
      }
- }
+-    for (i = 0; i < 4; i++) {
++    for (i = 0; i < NUM_GPTM; i++) {
-+/*
+         if (board->dc2 & (0x10000 << i)) {
-+ * Accumulate the result of the reads to provide a checksum that will
+             SysBusDevice *sbd;
-+ * be used to validate the read timing settings.
-+ */
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+static void aspeed_smc_dma_checksum(AspeedSMCState *s)
+     }
-+{
-+    MemTxResult result;
-+    uint32_t data;
+-    for (i = 0; i < 7; i++) {
-+
++    for (i = 0; i < NUM_GPIO; i++) {
-+    if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
+         if (board->dc4 & (1 << i)) {
-+        qemu_log_mask(LOG_GUEST_ERROR,
+             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
-+                      "%s: invalid direction for DMA checksum\n",  __func__);
+                                                qdev_get_gpio_in(nvic,
-+        return;
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
 +    }
 +
 +    while (s->regs[R_DMA_LEN]) {
 +        data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
 +                                    MEMTXATTRS_UNSPECIFIED, &result);
 +        if (result != MEMTX_OK) {
 +            qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash read failed @%08x\n",
 +                          __func__, s->regs[R_DMA_FLASH_ADDR]);
 +            return;
 +        }
 +
 +        /*
 +         * When the DMA is on-going, the DMA registers are updated
 +         * with the current working addresses and length.
 +         */
 +        s->regs[R_DMA_CHECKSUM] += data;
 +        s->regs[R_DMA_FLASH_ADDR] += 4;
 +        s->regs[R_DMA_LEN] -= 4;
 +    }
 +}
 +
 +static void aspeed_smc_dma_rw(AspeedSMCState *s)
 +{
 +    MemTxResult result;
 +    uint32_t data;
 +
 +    while (s->regs[R_DMA_LEN]) {
 +        if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
 +            data = address_space_ldl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
 +                                        MEMTXATTRS_UNSPECIFIED, &result);
 +            if (result != MEMTX_OK) {
 +                qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n",
 +                              __func__, s->regs[R_DMA_DRAM_ADDR]);
 +                return;
 +            }
 +
 +            address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
 +                                 data, MEMTXATTRS_UNSPECIFIED, &result);
 +            if (result != MEMTX_OK) {
 +                qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash write failed @%08x\n",
 +                              __func__, s->regs[R_DMA_FLASH_ADDR]);
 +                return;
 +            }
 +        } else {
 +            data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
 +                                        MEMTXATTRS_UNSPECIFIED, &result);
 +            if (result != MEMTX_OK) {
 +                qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash read failed @%08x\n",
 +                              __func__, s->regs[R_DMA_FLASH_ADDR]);
 +                return;
 +            }
 +
 +            address_space_stl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
 +                                 data, MEMTXATTRS_UNSPECIFIED, &result);
 +            if (result != MEMTX_OK) {
 +                qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n",
 +                              __func__, s->regs[R_DMA_DRAM_ADDR]);
 +                return;
 +            }
 +        }
 +
 +        /*
 +         * When the DMA is on-going, the DMA registers are updated
 +         * with the current working addresses and length.
 +         */
 +        s->regs[R_DMA_FLASH_ADDR] += 4;
 +        s->regs[R_DMA_DRAM_ADDR] += 4;
 +        s->regs[R_DMA_LEN] -= 4;
 +    }
 +}
 +
 +static void aspeed_smc_dma_stop(AspeedSMCState *s)
 +{
 +    /*
 +     * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the
 +     * engine is idle
 +     */
 +    s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS;
 +    s->regs[R_DMA_CHECKSUM] = 0;
 +
 +    /*
 +     * Lower the DMA irq in any case. The IRQ control register could
 +     * have been cleared before disabling the DMA.
 +     */
 +    qemu_irq_lower(s->irq);
 +}
 +
 +/*
 + * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA
 + * can start even if the result of the previous was not collected.
 + */
 +static bool aspeed_smc_dma_in_progress(AspeedSMCState *s)
 +{
 +    return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE &&
 +        !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS);
 +}
 +
 +static void aspeed_smc_dma_done(AspeedSMCState *s)
 +{
 +    s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS;
 +    if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) {
 +        qemu_irq_raise(s->irq);
 +    }
 +}
 +
 +static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint64_t dma_ctrl)
 +{
 +    if (!(dma_ctrl & DMA_CTRL_ENABLE)) {
 +        s->regs[R_DMA_CTRL] = dma_ctrl;
 +
 +        aspeed_smc_dma_stop(s);
 +        return;
 +    }
 +
 +    if (aspeed_smc_dma_in_progress(s)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA in progress\n",  __func__);
 +        return;
 +    }
 +
 +    s->regs[R_DMA_CTRL] = dma_ctrl;
 +
 +    if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) {
 +        aspeed_smc_dma_checksum(s);
 +    } else {
 +        aspeed_smc_dma_rw(s);
 +    }
 +
 +    aspeed_smc_dma_done(s);
 +}
 +
  static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
                               unsigned int size)
  {
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
          }
-     } else if (addr == R_DUMMY_DATA) {
-         s->regs[addr] = value & 0xff;
-+    } else if (addr == R_INTR_CTRL) {
-+        s->regs[addr] = value;
-+    } else if (s->ctrl->has_dma && addr == R_DMA_CTRL) {
-+        aspeed_smc_dma_ctrl(s, value);
-+    } else if (s->ctrl->has_dma && addr == R_DMA_DRAM_ADDR) {
-+        s->regs[addr] = DMA_DRAM_ADDR(s, value);
-+    } else if (s->ctrl->has_dma && addr == R_DMA_FLASH_ADDR) {
-+        s->regs[addr] = DMA_FLASH_ADDR(s, value);
-+    } else if (s->ctrl->has_dma && addr == R_DMA_LEN) {
-+        s->regs[addr] = DMA_LENGTH(value);
-     } else {
-         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
-                       __func__, addr);
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_smc_ops = {
-     .valid.unaligned = true,
- };
-+
-+/*
-+ * Initialize the custom address spaces for DMAs
-+ */
-+static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp)
-+{
-+    char *name;
-+
-+    if (!s->dram_mr) {
-+        error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set");
-+        return;
-+    }
-+
-+    name = g_strdup_printf("%s-dma-flash", s->ctrl->name);
-+    address_space_init(&s->flash_as, &s->mmio_flash, name);
-+    g_free(name);
-+
-+    name = g_strdup_printf("%s-dma-dram", s->ctrl->name);
-+    address_space_init(&s->dram_as, s->dram_mr, name);
-+    g_free(name);
-+}
-+
- static void aspeed_smc_realize(DeviceState *dev, Error **errp)
- {
-     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
-@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
-         s->num_cs = s->ctrl->max_slaves;
      }
-+    /* DMA irq. Keep it first for the initialization in the SoC */
+-    for (i = 0; i < 4; i++) {
-+    sysbus_init_irq(sbd, &s->irq);
++    for (i = 0; i < NUM_UART; i++) {
-+
+         if (board->dc2 & (1 << i)) {
-     s->spi = ssi_create_bus(dev, "spi");
+             SysBusDevice *sbd;
      /* Setup cs_lines for slaves */
 -    sysbus_init_irq(sbd, &s->irq);
      s->cs_lines = g_new0(qemu_irq, s->num_cs);
      ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
          memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
          offset += fl->size;
      }
 +
 +    /* DMA support */
 +    if (s->ctrl->has_dma) {
 +        aspeed_smc_dma_setup(s, errp);
 +    }
  }
  static const VMStateDescription vmstate_aspeed_smc = {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_smc = {
  static Property aspeed_smc_properties[] = {
      DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
      DEFINE_PROP_UINT64("sdram-base", AspeedSMCState, sdram_base, 0),
 +    DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
 +                     TYPE_MEMORY_REGION, MemoryRegion *),
      DEFINE_PROP_END_OF_LIST(),
  };
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 10/12] aspeed/scu: Introduce a aspeed_scu_get_apb_freq() routine
+[PULL 11/36] hw/arm/stellaris: Use DEVCAP macro to access DeviceCapability registers
-From: Cédric Le Goater <clg@kaod.org>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-The APB frequency can be calculated directly when needed from the
+Add definitions (DCx_periph) for the DeviceCapability bits,
-HPLL_PARAM and CLK_SEL register values. This removes useless state in
+replace direct bitmask checks with the DEV_CAP() macro,
-the model.
+which use the extract/deposit API.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20190904070506.1052-11-clg@kaod.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-6-philmd@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/aspeed_scu.h |  8 +++-----
+ hw/arm/stellaris.c | 37 +++++++++++++++++++++++++++++--------
- hw/misc/aspeed_scu.c         | 25 +++++++++----------------
+file changed, 29 insertions(+), 8 deletions(-)
  hw/timer/aspeed_timer.c      |  3 ++-
 files changed, 14 insertions(+), 22 deletions(-)
-diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/aspeed_scu.h
+--- a/hw/arm/stellaris.c
-+++ b/include/hw/misc/aspeed_scu.h
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
+@@ -XXX,XX +XXX,XX @@
-     uint32_t hw_strap1;
+  */
-     uint32_t hw_strap2;
-     uint32_t hw_prot_key;
+ #include "qemu/osdep.h"
--
++#include "qemu/bitops.h"
--    uint32_t clkin;
+ #include "qapi/error.h"
--    uint32_t hpll;
+ #include "hw/core/split-irq.h"
--    uint32_t apb_freq;
+ #include "hw/sysbus.h"
- } AspeedSCUState;
+@@ -XXX,XX +XXX,XX @@
+ #define NUM_GPTM    4
- #define AST2400_A0_SILICON_REV   0x02000303U
+ #define NUM_I2C     2
-@@ -XXX,XX +XXX,XX @@ typedef struct  AspeedSCUClass {
-     SysBusDeviceClass parent_class;
++/*
++ * See Stellaris Data Sheet chapter 5.2.5 "System Control",
-     const uint32_t *resets;
++ * Register 13 .. 17: Device Capabilities 0 .. 4 (DC0 .. DC4).
--    uint32_t (*calc_hpll)(AspeedSCUState *s);
++ */
-+    uint32_t (*calc_hpll)(AspeedSCUState *s, uint32_t hpll_reg);
++#define DC1_WDT          3
-     uint32_t apb_divider;
++#define DC1_HIB          6
- }  AspeedSCUClass;
++#define DC1_MPU          7
++#define DC1_ADC          16
- #define ASPEED_SCU_PROT_KEY      0x1688A8A8
++#define DC1_PWM          20
++#define DC2_UART(n)     (n)
-+uint32_t aspeed_scu_get_apb_freq(AspeedSCUState *s);
++#define DC2_SSI          4
 +#define DC2_QEI(n)      (8 + n)
 +#define DC2_I2C(n)      (12 + 2 * n)
 +#define DC2_GPTM(n)     (16 + n)
 +#define DC2_COMP(n)     (24 + n)
 +#define DC4_GPIO(n)     (n)
 +#define DC4_EMAC         28
 +
- /*
++#define DEV_CAP(_dc, _cap) extract32(board->dc##_dc, DC##_dc##_##_cap, 1)
-  * Extracted from Aspeed SDK v00.03.21. Fixes and extra definitions
++
-  * were added.
+ typedef const struct {
-diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
+     const char *name;
-index XXXXXXX..XXXXXXX 100644
+     uint32_t did0;
---- a/hw/misc/aspeed_scu.c
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+++ b/hw/misc/aspeed_scu.c
+     sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
-@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_get_random(void)
+     sysbus_connect_irq(SYS_BUS_DEVICE(ssys_dev), 0, qdev_get_gpio_in(nvic, 28));
-     return num;
- }
+-    if (board->dc1 & (1 << 16)) {
++    if (DEV_CAP(1, ADC)) {
--static void aspeed_scu_set_apb_freq(AspeedSCUState *s)
+         dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
-+uint32_t aspeed_scu_get_apb_freq(AspeedSCUState *s)
+                                     qdev_get_gpio_in(nvic, 14),
- {
+                                     qdev_get_gpio_in(nvic, 15),
-     AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(s);
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+    uint32_t hpll = asc->calc_hpll(s, s->regs[HPLL_PARAM]);
+         adc = NULL;
+     }
--    s->apb_freq = s->hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
+     for (i = 0; i < NUM_GPTM; i++) {
-+    return hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
+-        if (board->dc2 & (0x10000 << i)) {
-         / asc->apb_divider;
++        if (DEV_CAP(2, GPTM(i))) {
- }
+             SysBusDevice *sbd;
-@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
+             dev = qdev_new(TYPE_STELLARIS_GPTM);
-         return;
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      case CLK_SEL:
          s->regs[reg] = data;
 -        aspeed_scu_set_apb_freq(s);
          break;
      case HW_STRAP1:
          if (ASPEED_IS_AST2500(s->regs[SILICON_REV])) {
@@ -XXX,XX +XXX,XX @@ static const uint32_t hpll_ast2400_freqs[][4] = {
      { 400, 375, 350, 425 }, /* 25MHz */
  };
 -static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
 +static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s, uint32_t hpll_reg)
  {
 -    uint32_t hpll_reg = s->regs[HPLL_PARAM];
      uint8_t freq_select;
      bool clk_25m_in;
 +    uint32_t clkin = aspeed_scu_get_clkin(s);
      if (hpll_reg & SCU_AST2400_H_PLL_OFF) {
          return 0;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
              multiplier = (2 - od) * ((n + 2) / (d + 1));
          }
--        return s->clkin * multiplier;
-+        return clkin * multiplier;
      }
-     /* HW strapping */
+-    if (board->dc1 & (1 << 3)) { /* watchdog present */
-@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
++    if (DEV_CAP(1, WDT)) {
-     return hpll_ast2400_freqs[clk_25m_in][freq_select] * 1000000;
+         dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
- }
+         object_property_add_child(soc_container, "wdg", OBJECT(dev));
+         qdev_connect_clock_in(dev, "WDOGCLK",
--static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s, uint32_t hpll_reg)
- {
--    uint32_t hpll_reg   = s->regs[HPLL_PARAM];
+     for (i = 0; i < NUM_GPIO; i++) {
-     uint32_t multiplier = 1;
+-        if (board->dc4 & (1 << i)) {
-+    uint32_t clkin = aspeed_scu_get_clkin(s);
++        if (DEV_CAP(4, GPIO(i))) {
+             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
-     if (hpll_reg & SCU_H_PLL_OFF) {
+                                                qdev_get_gpio_in(nvic,
-         return 0;
+                                                                 gpio_irq[i]));
-@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-         multiplier = ((m + 1) / (n + 1)) / (p + 1);
+         }
      }
--    return s->clkin * multiplier;
+-    if (board->dc2 & (1 << 12)) {
-+    return clkin * multiplier;
++    if (DEV_CAP(2, I2C(0))) {
- }
+         dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
+                                    qdev_get_gpio_in(nvic, 8));
- static void aspeed_scu_reset(DeviceState *dev)
+         i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
-@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-     s->regs[HW_STRAP1] = s->hw_strap1;
+     }
-     s->regs[HW_STRAP2] = s->hw_strap2;
-     s->regs[PROT_KEY] = s->hw_prot_key;
+     for (i = 0; i < NUM_UART; i++) {
--
+-        if (board->dc2 & (1 << i)) {
--    /*
++        if (DEV_CAP(2, UART(i))) {
--     * All registers are set. Now compute the frequencies of the main clocks
+             SysBusDevice *sbd;
--     */
--    s->clkin = aspeed_scu_get_clkin(s);
+             dev = qdev_new("pl011_luminary");
--    s->hpll = asc->calc_hpll(s);
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
--    aspeed_scu_set_apb_freq(s);
+             sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(nvic, uart_irq[i]));
- }
+         }
+     }
- static uint32_t aspeed_silicon_revs[] = {
+-    if (board->dc2 & (1 << 4)) {
-diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
++    if (DEV_CAP(2, SSI)) {
-index XXXXXXX..XXXXXXX 100644
+         dev = sysbus_create_simple("pl022", 0x40008000,
---- a/hw/timer/aspeed_timer.c
+                                    qdev_get_gpio_in(nvic, 7));
-+++ b/hw/timer/aspeed_timer.c
+         if (board->peripherals & BP_OLED_SSI) {
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t calculate_rate(struct AspeedTimer *t)
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
- {
+             qemu_irq_raise(gpio_out[GPIO_D][0]);
-     AspeedTimerCtrlState *s = timer_to_ctrl(t);
+         }
+     }
--    return timer_external_clock(t) ? TIMER_CLOCK_EXT_HZ : s->scu->apb_freq;
+-    if (board->dc4 & (1 << 28)) {
-+    return timer_external_clock(t) ? TIMER_CLOCK_EXT_HZ :
++    if (DEV_CAP(4, EMAC)) {
-+        aspeed_scu_get_apb_freq(s->scu);
+         DeviceState *enet;
- }
+         enet = qdev_new("stellaris_enet");
  static inline uint32_t calculate_ticks(struct AspeedTimer *t, uint64_t now_ns)
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 04/12] aspeed: Use consistent typenames
+[PULL 12/36] hw/arm/stellaris: Map both I2C controllers
-From: Cédric Le Goater <clg@kaod.org>
+From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Improve the naming of the different controller models to ease their
+There are 2 I2C controllers, map them both, removing
-generation when initializing the SoC. The rename of the SMC types is
+the unimplemented one. Keep the OLED controller on the
-breaking migration compatibility.
+first I2C bus.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20190904070506.1052-5-clg@kaod.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250110160204.74997-7-philmd@linaro.org
+[PMM: tweak to appease maybe-use-uninitialized warning]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/aspeed_soc.h |  3 ---
+ hw/arm/stellaris.c | 21 +++++++++++++--------
- hw/arm/aspeed_soc.c         | 25 ++++++++++++-------------
+file changed, 13 insertions(+), 8 deletions(-)
  hw/ssi/aspeed_smc.c         | 12 ++++++------
 files changed, 18 insertions(+), 22 deletions(-)
-diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
+diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/aspeed_soc.h
+--- a/hw/arm/stellaris.c
-+++ b/include/hw/arm/aspeed_soc.h
++++ b/hw/arm/stellaris.c
-@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-     uint32_t silicon_rev;
+       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
-     uint64_t sram_size;
+x40024000, 0x40025000, 0x40026000};
-     int spis_num;
+     static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
--    const char *fmc_typename;
++    static const uint32_t i2c_addr[NUM_I2C] = {0x40020000, 0x40021000};
--    const char **spi_typename;
++    static const int i2c_irq[NUM_I2C] = {8, 37};
--    const char *gpio_typename;
-     int wdts_num;
+     /* Memory map of SoC devices, from
-     const int *irqmap;
+      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
-     const hwaddr *memmap;
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
+     qemu_irq adc;
-index XXXXXXX..XXXXXXX 100644
+     int sram_size;
---- a/hw/arm/aspeed_soc.c
+     int flash_size;
-+++ b/hw/arm/aspeed_soc.c
+-    I2CBus *i2c;
-@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2400_irqmap[] = {
++    DeviceState *i2c_dev[NUM_I2C] = { };
+     DeviceState *dev;
- #define aspeed_soc_ast2500_irqmap aspeed_soc_ast2400_irqmap
+     DeviceState *ssys_dev;
 -static const char *aspeed_soc_ast2400_typenames[] = { "aspeed.smc.spi" };
 -static const char *aspeed_soc_ast2500_typenames[] = {
 -    "aspeed.smc.ast2500-spi1", "aspeed.smc.ast2500-spi2" };
 -
  static const AspeedSoCInfo aspeed_socs[] = {
      {
          .name         = "ast2400-a1",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .silicon_rev  = AST2400_A1_SILICON_REV,
          .sram_size    = 0x8000,
          .spis_num     = 1,
 -        .fmc_typename = "aspeed.smc.fmc",
 -        .spi_typename = aspeed_soc_ast2400_typenames,
 -        .gpio_typename = "aspeed.gpio-ast2400",
          .wdts_num     = 2,
          .irqmap       = aspeed_soc_ast2400_irqmap,
          .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
          .silicon_rev  = AST2500_A1_SILICON_REV,
          .sram_size    = 0x9000,
          .spis_num     = 2,
 -        .fmc_typename = "aspeed.smc.ast2500-fmc",
 -        .spi_typename = aspeed_soc_ast2500_typenames,
 -        .gpio_typename = "aspeed.gpio-ast2500",
          .wdts_num     = 3,
          .irqmap       = aspeed_soc_ast2500_irqmap,
          .memmap       = aspeed_soc_ast2500_memmap,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      AspeedSoCState *s = ASPEED_SOC(obj);
      AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
      int i;
-+    char socname[8];
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-+    char typename[64];
+         }
      }
 -    if (DEV_CAP(2, I2C(0))) {
 -        dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
 -                                   qdev_get_gpio_in(nvic, 8));
 -        i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
 -        if (board->peripherals & BP_OLED_I2C) {
 -            i2c_slave_create_simple(i2c, "ssd0303", 0x3d);
 +    for (i = 0; i < NUM_I2C; i++) {
 +        if (DEV_CAP(2, I2C(i))) {
 +            i2c_dev[i] = sysbus_create_simple(TYPE_STELLARIS_I2C, i2c_addr[i],
 +                                              qdev_get_gpio_in(nvic,
 +                                                               i2c_irq[i]));
          }
      }
 +    if (board->peripherals & BP_OLED_I2C) {
 +        I2CBus *bus = (I2CBus *)qdev_get_child_bus(i2c_dev[0], "i2c");
 +
-+    if (sscanf(sc->info->name, "%7s", socname) != 1) {
++        i2c_slave_create_simple(bus, "ssd0303", 0x3d);
 +        g_assert_not_reached();
 +    }
-     for (i = 0; i < sc->info->num_cpus; i++) {
+     for (i = 0; i < NUM_UART; i++) {
-         object_initialize_child(obj, "cpu[*]", OBJECT(&s->cpu[i]),
+         if (DEV_CAP(2, UART(i))) {
-@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
-     sysbus_init_child_obj(obj, "i2c", OBJECT(&s->i2c), sizeof(s->i2c),
+     /* Add dummy regions for the devices we don't implement yet,
-                           TYPE_ASPEED_I2C);
+      * so guest accesses don't cause unlogged crashes.
+      */
-+    snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
+-    create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
-     sysbus_init_child_obj(obj, "fmc", OBJECT(&s->fmc), sizeof(s->fmc),
+     create_unimplemented_device("PWM", 0x40028000, 0x1000);
--                          sc->info->fmc_typename);
+     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
-+                          typename);
+     create_unimplemented_device("QEI-1", 0x4002d000, 0x1000);
      object_property_add_alias(obj, "num-cs", OBJECT(&s->fmc), "num-cs",
                                &error_abort);
      for (i = 0; i < sc->info->spis_num; i++) {
 +        snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
          sysbus_init_child_obj(obj, "spi[*]", OBJECT(&s->spi[i]),
 -                              sizeof(s->spi[i]), sc->info->spi_typename[i]);
 +                              sizeof(s->spi[i]), typename);
      }
      sysbus_init_child_obj(obj, "sdmc", OBJECT(&s->sdmc), sizeof(s->sdmc),
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
                            TYPE_ASPEED_XDMA);
 +    snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
      sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
 -                          sc->info->gpio_typename);
 +                          typename);
  }
  static void aspeed_soc_realize(DeviceState *dev, Error **errp)
 diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/aspeed_smc.c
 +++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSegments aspeed_segments_ast2500_spi2[] = {
  static const AspeedSMCController controllers[] = {
      {
 -        .name              = "aspeed.smc.smc",
 +        .name              = "aspeed.smc-ast2400",
          .r_conf            = R_CONF,
          .r_ce_ctrl         = R_CE_CTRL,
          .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .has_dma           = false,
          .nregs             = ASPEED_SMC_R_SMC_MAX,
      }, {
 -        .name              = "aspeed.smc.fmc",
 +        .name              = "aspeed.fmc-ast2400",
          .r_conf            = R_CONF,
          .r_ce_ctrl         = R_CE_CTRL,
          .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .has_dma           = true,
          .nregs             = ASPEED_SMC_R_MAX,
      }, {
 -        .name              = "aspeed.smc.spi",
 +        .name              = "aspeed.spi1-ast2400",
          .r_conf            = R_SPI_CONF,
          .r_ce_ctrl         = 0xff,
          .r_ctrl0           = R_SPI_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .has_dma           = false,
          .nregs             = ASPEED_SMC_R_SPI_MAX,
      }, {
 -        .name              = "aspeed.smc.ast2500-fmc",
 +        .name              = "aspeed.fmc-ast2500",
          .r_conf            = R_CONF,
          .r_ce_ctrl         = R_CE_CTRL,
          .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .has_dma           = true,
          .nregs             = ASPEED_SMC_R_MAX,
      }, {
 -        .name              = "aspeed.smc.ast2500-spi1",
 +        .name              = "aspeed.spi1-ast2500",
          .r_conf            = R_CONF,
          .r_ce_ctrl         = R_CE_CTRL,
          .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .has_dma           = false,
          .nregs             = ASPEED_SMC_R_MAX,
      }, {
 -        .name              = "aspeed.smc.ast2500-spi2",
 +        .name              = "aspeed.spi2-ast2500",
          .r_conf            = R_CONF,
          .r_ce_ctrl         = R_CE_CTRL,
          .r_ctrl0           = R_CTRL0,
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 12/12] qemu-ga: Convert invocation documentation to rST
+[PULL 13/36] tests/functional: Add a test for the arm microbit machine
-The qemu-ga documentation is currently in qemu-ga.texi in
+From: Thomas Huth <thuth@redhat.com>
 Texinfo format, which we present to the user as:
  * a qemu-ga manpage
  * a section of the main qemu-doc HTML documentation
-Convert the documentation to rST format, and present it to
+We don't have any functional tests for this machine yet, thus let's
-the user as:
+add a test with a MicroPython binary that is available online
- * a qemu-ga manpage
+(thanks to Joel Stanley for providing it, see:
- * part of the interop/ Sphinx manual
+ https://www.mail-archive.com/qemu-devel@nongnu.org/msg606064.html ).
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20250124101709.1591761-1-thuth@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
-Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
-Message-id: 20190905131040.8350-1-peter.maydell@linaro.org
 ---
- Makefile                 |  24 ++++---
+ MAINTAINERS                           |  1 +
- MAINTAINERS              |   2 +-
+ tests/functional/meson.build          |  1 +
- docs/conf.py             |  18 ++---
+ tests/functional/test_arm_microbit.py | 31 +++++++++++++++++++++++++++
- docs/interop/conf.py     |   7 ++
+files changed, 33 insertions(+)
- docs/interop/index.rst   |   1 +
+ create mode 100755 tests/functional/test_arm_microbit.py
  docs/interop/qemu-ga.rst | 133 +++++++++++++++++++++++++++++++++++++
  qemu-doc.texi            |   5 --
  qemu-ga.texi             | 137 ---------------------------------------
 files changed, 166 insertions(+), 161 deletions(-)
  create mode 100644 docs/interop/qemu-ga.rst
  delete mode 100644 qemu-ga.texi
-diff --git a/Makefile b/Makefile
-index XXXXXXX..XXXXXXX 100644
---- a/Makefile
-+++ b/Makefile
-@@ -XXX,XX +XXX,XX @@ endif
- endif
- ifdef BUILD_DOCS
--DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 qemu-ga.8
-+DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 docs/interop/qemu-ga.8
- DOCS+=docs/interop/qemu-qmp-ref.html docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7
- DOCS+=docs/interop/qemu-ga-ref.html docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7
- DOCS+=docs/qemu-block-drivers.7
-@@ -XXX,XX +XXX,XX @@ DESCS=
- endif
- # Note that we manually filter-out the non-Sphinx documentation which
--# is currently built into the docs/interop directory in the build tree.
-+# is currently built into the docs/interop directory in the build tree,
-+# and also any sphinx-built manpages.
- define install-manual =
- for d in $$(cd $(MANUAL_BUILDDIR) && find $1 -type d); do $(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)/$$d"; done
--for f in $$(cd $(MANUAL_BUILDDIR) && find $1 -type f -a '!' '(' -name 'qemu-*-qapi.*' -o -name 'qemu-*-ref.*' ')' ); do $(INSTALL_DATA) "$(MANUAL_BUILDDIR)/$$f" "$(DESTDIR)$(qemu_docdir)/$$f"; done
-+for f in $$(cd $(MANUAL_BUILDDIR) && find $1 -type f -a '!' '(' -name '*.[0-9]' -o -name 'qemu-*-qapi.*' -o -name 'qemu-*-ref.*' ')' ); do $(INSTALL_DATA) "$(MANUAL_BUILDDIR)/$$f" "$(DESTDIR)$(qemu_docdir)/$$f"; done
- endef
- # Note that we deliberately do not install the "devel" manual: it is
-@@ -XXX,XX +XXX,XX @@ ifdef CONFIG_TRACE_SYSTEMTAP
-     $(INSTALL_DATA) scripts/qemu-trace-stap.1 "$(DESTDIR)$(mandir)/man1"
- endif
- ifneq (,$(findstring qemu-ga,$(TOOLS)))
--    $(INSTALL_DATA) qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
-+    $(INSTALL_DATA) docs/interop/qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
-     $(INSTALL_DATA) docs/interop/qemu-ga-ref.html "$(DESTDIR)$(qemu_docdir)"
-     $(INSTALL_DATA) docs/interop/qemu-ga-ref.txt "$(DESTDIR)$(qemu_docdir)"
-     $(INSTALL_DATA) docs/interop/qemu-ga-ref.7 "$(DESTDIR)$(mandir)/man7"
-@@ -XXX,XX +XXX,XX @@ docs/version.texi: $(SRC_PATH)/VERSION config-host.mak
- sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html $(MANUAL_BUILDDIR)/interop/index.html $(MANUAL_BUILDDIR)/specs/index.html
- # Canned command to build a single manual
--build-manual = $(call quiet-command,sphinx-build $(if $(V),,-q) -W -n -b html -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
-+# Arguments: $1 = manual name, $2 = Sphinx builder ('html' or 'man')
-+build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" sphinx-build $(if $(V),,-q) -W -n -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
- # We assume all RST files in the manual's directory are used in it
- manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst) $(SRC_PATH)/docs/$1/conf.py $(SRC_PATH)/docs/conf.py
- $(MANUAL_BUILDDIR)/devel/index.html: $(call manual-deps,devel)
--    $(call build-manual,devel)
-+    $(call build-manual,devel,html)
- $(MANUAL_BUILDDIR)/interop/index.html: $(call manual-deps,interop)
--    $(call build-manual,interop)
-+    $(call build-manual,interop,html)
- $(MANUAL_BUILDDIR)/specs/index.html: $(call manual-deps,specs)
--    $(call build-manual,specs)
-+    $(call build-manual,specs,html)
-+
-+$(MANUAL_BUILDDIR)/interop/qemu-ga.8: $(call manual-deps,interop)
-+    $(call build-manual,interop,man)
- qemu-options.texi: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool
-     $(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")
-@@ -XXX,XX +XXX,XX @@ qemu.1: qemu-option-trace.texi
- qemu-img.1: qemu-img.texi qemu-option-trace.texi qemu-img-cmds.texi
- fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
- qemu-nbd.8: qemu-nbd.texi qemu-option-trace.texi
--qemu-ga.8: qemu-ga.texi
- docs/qemu-block-drivers.7: docs/qemu-block-drivers.texi
- docs/qemu-cpu-models.7: docs/qemu-cpu-models.texi
- scripts/qemu-trace-stap.1: scripts/qemu-trace-stap.texi
-@@ -XXX,XX +XXX,XX @@ txt: qemu-doc.txt docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
- qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
-     qemu-img.texi qemu-nbd.texi qemu-options.texi \
-     qemu-tech.texi qemu-option-trace.texi \
--    qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
-+    qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi \
-     qemu-monitor-info.texi docs/qemu-block-drivers.texi \
-     docs/qemu-cpu-models.texi docs/security.texi
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ QEMU Guest Agent
+@@ -XXX,XX +XXX,XX @@ F: hw/*/microbit*.c
- M: Michael Roth <mdroth@linux.vnet.ibm.com>
+ F: include/hw/*/nrf51*.h
- S: Maintained
+ F: include/hw/*/microbit*.h
- F: qga/
+ F: tests/qtest/microbit-test.c
--F: qemu-ga.texi
++F: tests/functional/test_arm_microbit.py
-+F: docs/interop/qemu-ga.rst
+ F: docs/system/arm/nrf.rst
- F: scripts/qemu-guest-agent/
- F: tests/test-qga.c
+ ARM PL011 Rust device
- F: docs/interop/qemu-ga-ref.texi
+diff --git a/tests/functional/meson.build b/tests/functional/meson.build
 diff --git a/docs/conf.py b/docs/conf.py
 index XXXXXXX..XXXXXXX 100644
---- a/docs/conf.py
+--- a/tests/functional/meson.build
-+++ b/docs/conf.py
++++ b/tests/functional/meson.build
-@@ -XXX,XX +XXX,XX @@ todo_include_todos = False
+@@ -XXX,XX +XXX,XX @@ tests_arm_system_thorough = [
- # with "option::" in the document being processed. Turn that off.
+   'arm_cubieboard',
- suppress_warnings = ["ref.option"]
+   'arm_emcraft_sf2',
+   'arm_integratorcp',
-+# The rst_epilog fragment is effectively included in every rST file.
++  'arm_microbit',
-+# We use it to define substitutions based on build config that
+   'arm_orangepi',
-+# can then be used in the documentation. The fallback if the
+   'arm_quanta_gsj',
-+# environment variable is not set is for the benefit of readthedocs
+   'arm_raspi2',
-+# style document building; our Makefile always sets the variable.
+diff --git a/tests/functional/test_arm_microbit.py b/tests/functional/test_arm_microbit.py
-+confdir = os.getenv('CONFDIR', "/etc/qemu")
+new file mode 100755
 +rst_epilog = ".. |CONFDIR| replace:: ``" + confdir + "``\n"
 +
  # -- Options for HTML output ----------------------------------------------
  # The theme to use for HTML and HTML Help pages.  See the documentation for
@@ -XXX,XX +XXX,XX @@ latex_documents = [
  # -- Options for manual page output ---------------------------------------
 -
 -# One entry per manual page. List of tuples
 -# (source start file, name, description, authors, manual section).
 -man_pages = [
 -    (master_doc, 'qemu', u'QEMU Documentation',
 -     [author], 1)
 -]
 -
 +# Individual manual/conf.py can override this to create man pages
 +man_pages = []
  # -- Options for Texinfo output -------------------------------------------
 diff --git a/docs/interop/conf.py b/docs/interop/conf.py
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/interop/conf.py
 +++ b/docs/interop/conf.py
@@ -XXX,XX +XXX,XX @@ exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
  # This slightly misuses the 'description', but is the best way to get
  # the manual title to appear in the sidebar.
  html_theme_options['description'] = u'System Emulation Management and Interoperability Guide'
 +
 +# One entry per manual page. List of tuples
 +# (source start file, name, description, authors, manual section).
 +man_pages = [
 +    ('qemu-ga', 'qemu-ga', u'QEMU Guest Agent',
 +     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8)
 +]
 diff --git a/docs/interop/index.rst b/docs/interop/index.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/interop/index.rst
 +++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
     bitmaps
     live-block-operations
     pr-helper
 +   qemu-ga
     vhost-user
     vhost-user-gpu
 diff --git a/docs/interop/qemu-ga.rst b/docs/interop/qemu-ga.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/docs/interop/qemu-ga.rst
++++ b/tests/functional/test_arm_microbit.py
 @@ -XXX,XX +XXX,XX @@
-+QEMU Guest Agent
++#!/usr/bin/env python3
-+================
++#
 +# SPDX-License-Identifier: GPL-2.0-or-later
 +#
 +# Copyright 2025, The QEMU Project Developers.
 +#
 +# A functional test that runs MicroPython on the arm microbit machine.
 +
-+Synopsis
++from qemu_test import QemuSystemTest, Asset, exec_command_and_wait_for_pattern
-+--------
++from qemu_test import wait_for_console_pattern
 +
 +**qemu-ga** [*OPTIONS*]
 +
 +Description
 +-----------
 +
 +The QEMU Guest Agent is a daemon intended to be run within virtual
 +machines. It allows the hypervisor host to perform various operations
 +in the guest, such as:
 +
 +- get information from the guest
 +- set the guest's system time
 +- read/write a file
 +- sync and freeze the filesystems
 +- suspend the guest
 +- reconfigure guest local processors
 +- set user's password
 +- ...
 +
 +qemu-ga will read a system configuration file on startup (located at
 +|CONFDIR|\ ``/qemu-ga.conf`` by default), then parse remaining
 +configuration options on the command line. For the same key, the last
 +option wins, but the lists accumulate (see below for configuration
 +file format).
 +
 +Options
 +-------
 +
 +.. program:: qemu-ga
 +
 +.. option:: -m, --method=METHOD
 +
 +  Transport method: one of ``unix-listen``, ``virtio-serial``, or
 +  ``isa-serial`` (``virtio-serial`` is the default).
 +
 +.. option:: -p, --path=PATH
 +
 +  Device/socket path (the default for virtio-serial is
 +  ``/dev/virtio-ports/org.qemu.guest_agent.0``,
 +  the default for isa-serial is ``/dev/ttyS0``)
 +
 +.. option:: -l, --logfile=PATH
 +
 +  Set log file path (default is stderr).
 +
 +.. option:: -f, --pidfile=PATH
 +
 +  Specify pid file (default is ``/var/run/qemu-ga.pid``).
 +
 +.. option:: -F, --fsfreeze-hook=PATH
 +
 +  Enable fsfreeze hook. Accepts an optional argument that specifies
 +  script to run on freeze/thaw. Script will be called with
 +  'freeze'/'thaw' arguments accordingly (default is
 +  |CONFDIR|\ ``/fsfreeze-hook``). If using -F with an argument, do
 +  not follow -F with a space (for example:
 +  ``-F/var/run/fsfreezehook.sh``).
 +
 +.. option:: -t, --statedir=PATH
 +
 +  Specify the directory to store state information (absolute paths only,
 +  default is ``/var/run``).
 +
 +.. option:: -v, --verbose
 +
 +  Log extra debugging information.
 +
 +.. option:: -V, --version
 +
 +  Print version information and exit.
 +
 +.. option:: -d, --daemon
 +
 +  Daemonize after startup (detach from terminal).
 +
 +.. option:: -b, --blacklist=LIST
 +
 +  Comma-separated list of RPCs to disable (no spaces, ``?`` to list
 +  available RPCs).
 +
 +.. option:: -D, --dump-conf
 +
 +  Dump the configuration in a format compatible with ``qemu-ga.conf``
 +  and exit.
 +
 +.. option:: -h, --help
 +
 +  Display this help and exit.
 +
 +Files
 +-----
 +
 +
-+The syntax of the ``qemu-ga.conf`` configuration file follows the
++class MicrobitMachine(QemuSystemTest):
 +Desktop Entry Specification, here is a quick summary: it consists of
 +groups of key-value pairs, interspersed with comments.
 +
-+::
++    ASSET_MICRO = Asset('https://ozlabs.org/~joel/microbit-micropython.hex',
 +        '021641f93dfb11767d4978dbb3ca7f475d1b13c69e7f4aec3382f212636bffd6')
 +
-+    # qemu-ga configuration sample
++    def test_arm_microbit(self):
-+    [general]
++        self.set_machine('microbit')
 +    daemonize = 0
 +    pidfile = /var/run/qemu-ga.pid
 +    verbose = 0
 +    method = virtio-serial
 +    path = /dev/virtio-ports/org.qemu.guest_agent.0
 +    statedir = /var/run
 +
-+The list of keys follows the command line options:
++        micropython = self.ASSET_MICRO.fetch()
 +        self.vm.set_console()
 +        self.vm.add_args('-device', f'loader,file={micropython}')
 +        self.vm.launch()
 +        wait_for_console_pattern(self, 'Type "help()" for more information.')
 +        exec_command_and_wait_for_pattern(self, 'import machine as mch', '>>>')
 +        exec_command_and_wait_for_pattern(self, 'mch.reset()', 'MicroPython')
 +        wait_for_console_pattern(self, '>>>')
 +
-+=============  ===========
++if __name__ == '__main__':
-+Key             Key type
++    QemuSystemTest.main()
 +=============  ===========
 +daemon         boolean
 +method         string
 +path           string
 +logfile        string
 +pidfile        string
 +fsfreeze-hook  string
 +statedir       string
 +verbose        boolean
 +blacklist      string list
 +=============  ===========
 +
 +See also
 +--------
 +
 +:manpage:`qemu(1)`
 diff --git a/qemu-doc.texi b/qemu-doc.texi
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-doc.texi
 +++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@ so should only be used with trusted guest OS.
  @c man end
 -@node QEMU Guest Agent
 -@chapter QEMU Guest Agent invocation
 -
 -@include qemu-ga.texi
 -
  @node QEMU User space emulator
  @chapter QEMU User space emulator
 diff --git a/qemu-ga.texi b/qemu-ga.texi
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/qemu-ga.texi
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -@example
 -@c man begin SYNOPSIS
 -@command{qemu-ga} [@var{OPTIONS}]
 -@c man end
 -@end example
 -
 -@c man begin DESCRIPTION
 -
 -The QEMU Guest Agent is a daemon intended to be run within virtual
 -machines. It allows the hypervisor host to perform various operations
 -in the guest, such as:
 -
 -@itemize
 -@item
 -get information from the guest
 -@item
 -set the guest's system time
 -@item
 -read/write a file
 -@item
 -sync and freeze the filesystems
 -@item
 -suspend the guest
 -@item
 -reconfigure guest local processors
 -@item
 -set user's password
 -@item
 -...
 -@end itemize
 -
 -qemu-ga will read a system configuration file on startup (located at
 -@file{@value{CONFDIR}/qemu-ga.conf} by default), then parse remaining
 -configuration options on the command line. For the same key, the last
 -option wins, but the lists accumulate (see below for configuration
 -file format).
 -
 -@c man end
 -
 -@c man begin OPTIONS
 -@table @option
 -@item -m, --method=@var{method}
 -  Transport method: one of @samp{unix-listen}, @samp{virtio-serial}, or
 -  @samp{isa-serial} (@samp{virtio-serial} is the default).
 -
 -@item -p, --path=@var{path}
 -  Device/socket path (the default for virtio-serial is
 -  @samp{/dev/virtio-ports/org.qemu.guest_agent.0},
 -  the default for isa-serial is @samp{/dev/ttyS0})
 -
 -@item -l, --logfile=@var{path}
 -  Set log file path (default is stderr).
 -
 -@item -f, --pidfile=@var{path}
 -  Specify pid file (default is @samp{/var/run/qemu-ga.pid}).
 -
 -@item -F, --fsfreeze-hook=@var{path}
 -  Enable fsfreeze hook. Accepts an optional argument that specifies
 -  script to run on freeze/thaw. Script will be called with
 -  'freeze'/'thaw' arguments accordingly (default is
 -  @samp{@value{CONFDIR}/fsfreeze-hook}). If using -F with an argument, do
 -  not follow -F with a space (for example:
 -  @samp{-F/var/run/fsfreezehook.sh}).
 -
 -@item -t, --statedir=@var{path}
 -  Specify the directory to store state information (absolute paths only,
 -  default is @samp{/var/run}).
 -
 -@item -v, --verbose
 -  Log extra debugging information.
 -
 -@item -V, --version
 -  Print version information and exit.
 -
 -@item -d, --daemon
 -  Daemonize after startup (detach from terminal).
 -
 -@item -b, --blacklist=@var{list}
 -  Comma-separated list of RPCs to disable (no spaces, @samp{?} to list
 -  available RPCs).
 -
 -@item -D, --dump-conf
 -  Dump the configuration in a format compatible with @file{qemu-ga.conf}
 -  and exit.
 -
 -@item -h, --help
 -  Display this help and exit.
 -@end table
 -
 -@c man end
 -
 -@c man begin FILES
 -
 -The syntax of the @file{qemu-ga.conf} configuration file follows the
 -Desktop Entry Specification, here is a quick summary: it consists of
 -groups of key-value pairs, interspersed with comments.
 -
 -@example
 -# qemu-ga configuration sample
 -[general]
 -daemonize = 0
 -pidfile = /var/run/qemu-ga.pid
 -verbose = 0
 -method = virtio-serial
 -path = /dev/virtio-ports/org.qemu.guest_agent.0
 -statedir = /var/run
 -@end example
 -
 -The list of keys follows the command line options:
 -@table @option
 -@item daemon= boolean
 -@item method= string
 -@item path= string
 -@item logfile= string
 -@item pidfile= string
 -@item fsfreeze-hook= string
 -@item statedir= string
 -@item verbose= boolean
 -@item blacklist= string list
 -@end table
 -
 -@c man end
 -
 -@ignore
 -
 -@setfilename qemu-ga
 -@settitle QEMU Guest Agent
 -
 -@c man begin AUTHOR
 -Michael Roth <mdroth@linux.vnet.ibm.com>
 -@c man end
 -
 -@c man begin SEEALSO
 -qemu(1)
 -@c man end
 -
 -@end ignore
 --
-.20.1
+.34.1

-New patch
+[PULL 14/36] target/arm: arm_reset_sve_state() should set FPSR, not FPCR
+The pseudocode ResetSVEState() does:
+    FPSR = ZeroExtend(0x0800009f<31:0>, 64);
+but QEMU's arm_reset_sve_state() called vfp_set_fpcr() by accident.
+Before the advent of FEAT_AFP, this was only setting a collection of
+RES0 bits, which vfp_set_fpsr() would then ignore, so the only effect
+was that we didn't actually set the FPSR the way we are supposed to
+do.  Once FEAT_AFP is implemented, setting the bottom bits of FPSR
+will change the floating point behaviour.
+Call vfp_set_fpsr(), as we ought to.
+(Note for stable backports: commit 7f2a01e7368f9 moved this function
+from sme_helper.c to helper.c, but it had the same bug before the
+move too.)
+Cc: qemu-stable@nongnu.org
+Fixes: f84734b87461 ("target/arm: Implement SMSTART, SMSTOP")
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-4-peter.maydell@linaro.org
+---
+ target/arm/helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static void arm_reset_sve_state(CPUARMState *env)
+     memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
+     /* Recall that FFR is stored as pregs[16]. */
+     memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
+-    vfp_set_fpcr(env, 0x0800009f);
++    vfp_set_fpsr(env, 0x0800009f);
+ }
+ void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask)
+--
+.34.1

-New patch
+[PULL 15/36] target/arm: Use FPSR_ constants in vfp_exceptbits_from_host()
+Use the FPSR_ named constants in vfp_exceptbits_from_host(),
+rather than hardcoded magic numbers.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-5-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 12 ++++++------
+file changed, 6 insertions(+), 6 deletions(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline int vfp_exceptbits_from_host(int host_bits)
+     int target_bits = 0;
+     if (host_bits & float_flag_invalid) {
+-        target_bits |= 1;
++        target_bits |= FPSR_IOC;
+     }
+     if (host_bits & float_flag_divbyzero) {
+-        target_bits |= 2;
++        target_bits |= FPSR_DZC;
+     }
+     if (host_bits & float_flag_overflow) {
+-        target_bits |= 4;
++        target_bits |= FPSR_OFC;
+     }
+     if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
+-        target_bits |= 8;
++        target_bits |= FPSR_UFC;
+     }
+     if (host_bits & float_flag_inexact) {
+-        target_bits |= 0x10;
++        target_bits |= FPSR_IXC;
+     }
+     if (host_bits & float_flag_input_denormal) {
+-        target_bits |= 0x80;
++        target_bits |= FPSR_IDC;
+     }
+     return target_bits;
+ }
+--
+.34.1

-New patch
+[PULL 16/36] target/arm: Use uint32_t in vfp_exceptbits_from_host()
+In vfp_exceptbits_from_host(), we accumulate the FPSR flags in
+an "int", and our return type is also "int". However, the only
+callsite returns the same information as a uint32_t, and
+more generally we handle FPSR values in the code as uint32_t,
+not int. Bring this function in to line with that convention.
+There is no behaviour change because none of the FPSR bits
+we set in this function are bit 31. The input argument to
+the function remains 'int' because that is the return type
+of the softfloat get_float_exception_flags().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-6-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@
+ #ifdef CONFIG_TCG
+ /* Convert host exception flags to vfp form.  */
+-static inline int vfp_exceptbits_from_host(int host_bits)
++static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+ {
+-    int target_bits = 0;
++    uint32_t target_bits = 0;
+     if (host_bits & float_flag_invalid) {
+         target_bits |= FPSR_IOC;
+--
+.34.1

-New patch
+[PULL 17/36] target/arm: Define new fp_status_a32 and fp_status_a64
+We want to split the existing fp_status in the Arm CPUState into
+separate float_status fields for AArch32 and AArch64.  (This is
+because new control bits defined by FEAT_AFP only have an effect for
+AArch64, not AArch32.) To make this split we will:
+ * define new fp_status_a32 and fp_status_a64 which have
+   identical behaviour to the existing fp_status
+ * move existing uses of fp_status to fp_status_a32 or
+   fp_status_a64 as appropriate
+ * delete the old fp_status when it has no uses left
+In this patch we add the new float_status fields.
+We will also need to split fp_status_f16, but we will do that
+as a separate series of patches.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-7-peter.maydell@linaro.org
+---
+ target/arm/cpu.h           |  4 ++++
+ target/arm/tcg/translate.h | 12 ++++++++++++
+ target/arm/cpu.c           |  2 ++
+ target/arm/vfp_helper.c    | 12 ++++++++++++
+files changed, 30 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+         /* There are a number of distinct float control structures:
+          *
+          *  fp_status: is the "normal" fp status.
++         *  fp_status_a32: is the "normal" fp status for AArch32 insns
++         *  fp_status_a64: is the "normal" fp status for AArch64 insns
+          *  fp_status_fp16: used for half-precision calculations
+          *  standard_fp_status : the ARM "Standard FPSCR Value"
+          *  standard_fp_status_fp16 : used for half-precision
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          * an explicit FPSCR read.
+          */
+         float_status fp_status;
++        float_status fp_status_a32;
++        float_status fp_status_a64;
+         float_status fp_status_f16;
+         float_status standard_fp_status;
+         float_status standard_fp_status_f16;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
+  */
+ typedef enum ARMFPStatusFlavour {
+     FPST_FPCR,
++    FPST_A32,
++    FPST_A64,
+     FPST_FPCR_F16,
+     FPST_STD,
+     FPST_STD_F16,
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+  *
+  * FPST_FPCR
+  *   for non-FP16 operations controlled by the FPCR
++ * FPST_A32
++ *   for AArch32 non-FP16 operations controlled by the FPCR
++ * FPST_A64
++ *   for AArch64 non-FP16 operations controlled by the FPCR
+  * FPST_FPCR_F16
+  *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
+  * FPST_STD
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
+     case FPST_FPCR:
+         offset = offsetof(CPUARMState, vfp.fp_status);
+         break;
++    case FPST_A32:
++        offset = offsetof(CPUARMState, vfp.fp_status_a32);
++        break;
++    case FPST_A64:
++        offset = offsetof(CPUARMState, vfp.fp_status_a64);
++        break;
+     case FPST_FPCR_F16:
+         offset = offsetof(CPUARMState, vfp.fp_status_f16);
+         break;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
+     set_default_nan_mode(1, &env->vfp.standard_fp_status);
+     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status);
++    arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
++    arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+     uint32_t i;
+     i = get_float_exception_flags(&env->vfp.fp_status);
++    i |= get_float_exception_flags(&env->vfp.fp_status_a32);
++    i |= get_float_exception_flags(&env->vfp.fp_status_a64);
+     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
+     /* FZ16 does not generate an input denormal exception.  */
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+      * be the architecturally up-to-date exception flag information first.
+      */
+     set_float_exception_flags(0, &env->vfp.fp_status);
++    set_float_exception_flags(0, &env->vfp.fp_status_a32);
++    set_float_exception_flags(0, &env->vfp.fp_status_a64);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+             break;
+         }
+         set_float_rounding_mode(i, &env->vfp.fp_status);
++        set_float_rounding_mode(i, &env->vfp.fp_status_a32);
++        set_float_rounding_mode(i, &env->vfp.fp_status_a64);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+     }
+     if (changed & FPCR_FZ16) {
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         bool ftz_enabled = val & FPCR_FZ;
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
++        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
++        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
++        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
++        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
+     }
+     if (changed & FPCR_DN) {
+         bool dnan_enabled = val & FPCR_DN;
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
++        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
++        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+     }
+ }
+--
+.34.1

-New patch
+[PULL 18/36] target/arm: Use vfp.fp_status_a64 in A64-only helper functions
+Switch from vfp.fp_status to vfp.fp_status_a64 for helpers which:
+ * directly reference an fp_status field
+ * are called only from the A64 decoder
+ * are not called inside a set_rmode/restore_rmode sequence
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250124162836.2332150-8-peter.maydell@linaro.org
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/sme_helper.c | 2 +-
+ target/arm/tcg/vec_helper.c | 8 ++++----
+files changed, 5 insertions(+), 5 deletions(-)
+diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sme_helper.c
++++ b/target/arm/tcg/sme_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
+      * round-to-odd -- see above.
+      */
+     fpst_f16 = env->vfp.fp_status_f16;
+-    fpst_std = env->vfp.fp_status;
++    fpst_std = env->vfp.fp_status_a64;
+     set_default_nan_mode(true, &fpst_std);
+     set_default_nan_mode(true, &fpst_f16);
+     fpst_odd = fpst_std;
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
+ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
+                             CPUARMState *env, uint32_t desc)
+ {
+-    do_fmlal(vd, vn, vm, &env->vfp.fp_status, desc,
++    do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+              get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+ }
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
+     intptr_t i, oprsz = simd_oprsz(desc);
+     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+-    float_status *status = &env->vfp.fp_status;
++    float_status *status = &env->vfp.fp_status_a64;
+     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+     for (i = 0; i < oprsz; i += sizeof(float32)) {
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
+ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
+                                 CPUARMState *env, uint32_t desc)
+ {
+-    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status, desc,
++    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+                  get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+ }
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
+     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
+-    float_status *status = &env->vfp.fp_status;
++    float_status *status = &env->vfp.fp_status_a64;
+     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+     for (i = 0; i < oprsz; i += 16) {
+--
+.34.1

-New patch
+[PULL 19/36] target/arm: Use fp_status_a64 or fp_status_a32 in is_ebf()
+In is_ebf(), we might be called for A64 or A32, but we have
+the CPUARMState* so we can select fp_status_a64 or
+fp_status_a32 accordingly.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/vec_helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp)
+      */
+     bool ebf = is_a64(env) && env->vfp.fpcr & FPCR_EBF;
+-    *statusp = env->vfp.fp_status;
++    *statusp = is_a64(env) ? env->vfp.fp_status_a64 : env->vfp.fp_status_a32;
+     set_default_nan_mode(true, statusp);
+     if (ebf) {
+--
+.34.1

-New patch
+[PULL 20/36] target/arm: Use fp_status_a32 in vjvct helper
+Use fp_status_a32 in the vjcvt helper function; this is called only
+from the A32/T32 decoder and is not used inside a
+set_rmode/restore_rmode sequence.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-9-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(fjcvtzs)(float64 value, float_status *status)
+ uint32_t HELPER(vjcvt)(float64 value, CPUARMState *env)
+ {
+-    uint64_t pair = HELPER(fjcvtzs)(value, &env->vfp.fp_status);
++    uint64_t pair = HELPER(fjcvtzs)(value, &env->vfp.fp_status_a32);
+     uint32_t result = pair;
+     uint32_t z = (pair >> 32) == 0;
+--
+.34.1

-New patch
+[PULL 21/36] target/arm: Use fp_status_a32 in vfp_cmp helpers
+The helpers vfp_cmps, vfp_cmpes, vfp_cmpd, vfp_cmped are used only from
+the A32 decoder; the A64 decoder uses separate vfp_cmps_a64 etc helpers
+(because for A64 we update the main NZCV flags and for A32 we update
+the FPSCR NZCV flags). So we can make these helpers use the fp_status_a32
+field instead of fp_status.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-10-peter.maydell@linaro.org
+---
+ target/arm/vfp_helper.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
+         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
+ }
+ DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
+-DO_VFP_cmp(s, float32, float32, fp_status)
+-DO_VFP_cmp(d, float64, float64, fp_status)
++DO_VFP_cmp(s, float32, float32, fp_status_a32)
++DO_VFP_cmp(d, float64, float64, fp_status_a32)
+ #undef DO_VFP_cmp
+ /* Integer to float and float to integer conversions */
+--
+.34.1

-New patch
+[PULL 22/36] target/arm: Use FPST_A32 in A32 decoder
+In the A32 decoder, use FPST_A32 rather than FPST_FPCR.  By
+doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A32/g' target/arm/tcg/translate-vfp.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-11-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-vfp.c | 54 +++++++++++++++++-----------------
+file changed, 27 insertions(+), 27 deletions(-)
+diff --git a/target/arm/tcg/translate-vfp.c b/target/arm/tcg/translate-vfp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-vfp.c
++++ b/target/arm/tcg/translate-vfp.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
+     if (sz == 1) {
+         fpst = fpstatus_ptr(FPST_FPCR_F16);
+     } else {
+-        fpst = fpstatus_ptr(FPST_FPCR);
++        fpst = fpstatus_ptr(FPST_A32);
+     }
+     tcg_rmode = gen_set_rmode(rounding, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
+     if (sz == 1) {
+         fpst = fpstatus_ptr(FPST_FPCR_F16);
+     } else {
+-        fpst = fpstatus_ptr(FPST_FPCR);
++        fpst = fpstatus_ptr(FPST_A32);
+     }
+     tcg_shift = tcg_constant_i32(0);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_sp(DisasContext *s, VFPGen3OpSPFn *fn,
+     f0 = tcg_temp_new_i32();
+     f1 = tcg_temp_new_i32();
+     fd = tcg_temp_new_i32();
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vfp_load_reg32(f0, vn);
+     vfp_load_reg32(f1, vm);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
+     f0 = tcg_temp_new_i64();
+     f1 = tcg_temp_new_i64();
+     fd = tcg_temp_new_i64();
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vfp_load_reg64(f0, vn);
+     vfp_load_reg64(f1, vm);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfm_sp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
+         /* VFNMA, VFNMS */
+         gen_vfp_negs(vd, vd);
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_vfp_muladds(vd, vn, vm, vd, fpst);
+     vfp_store_reg32(vd, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool do_vfm_dp(DisasContext *s, arg_VFMA_dp *a, bool neg_n, bool neg_d)
+         /* VFNMA, VFNMS */
+         gen_vfp_negd(vd, vd);
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_vfp_muladdd(vd, vn, vm, vd, fpst);
+     vfp_store_reg64(vd, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static void gen_VSQRT_hp(TCGv_i32 vd, TCGv_i32 vm)
+ static void gen_VSQRT_sp(TCGv_i32 vd, TCGv_i32 vm)
+ {
+-    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_A32));
+ }
+ static void gen_VSQRT_dp(TCGv_i64 vd, TCGv_i64 vm)
+ {
+-    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_A32));
+ }
+ DO_VFP_2OP(VSQRT, hp, gen_VSQRT_hp, aa32_fp16_arith)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f32_f16(DisasContext *s, arg_VCVT_f32_f16 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+     /* The T bit tells us if we want the low or high 16 bits of Vm */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+     /* The T bit tells us if we want the low or high 16 bits of Vm */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_b16_f32(DisasContext *s, arg_VCVT_b16_f32 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f32(DisasContext *s, arg_VCVT_f16_f32 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     ahp_mode = get_ahp_flag();
+     tmp = tcg_temp_new_i32();
+     vm = tcg_temp_new_i64();
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rints(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
+     tmp = tcg_temp_new_i64();
+     vfp_load_reg64(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rintd(tmp, tmp, fpst);
+     vfp_store_reg64(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
+     gen_helper_rints(tmp, tmp, fpst);
+     gen_restore_rmode(tcg_rmode, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
+     tmp = tcg_temp_new_i64();
+     vfp_load_reg64(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
+     gen_helper_rintd(tmp, tmp, fpst);
+     gen_restore_rmode(tcg_rmode, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_sp(DisasContext *s, arg_VRINTX_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg32(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rints_exact(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
+     tmp = tcg_temp_new_i64();
+     vfp_load_reg64(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     gen_helper_rintd_exact(tmp, tmp, fpst);
+     vfp_store_reg64(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
+     vm = tcg_temp_new_i32();
+     vd = tcg_temp_new_i64();
+     vfp_load_reg32(vm, a->vm);
+-    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_A32));
+     vfp_store_reg64(vd, a->vd);
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
+     vd = tcg_temp_new_i32();
+     vm = tcg_temp_new_i64();
+     vfp_load_reg64(vm, a->vm);
+-    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_FPCR));
++    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_A32));
+     vfp_store_reg32(vd, a->vd);
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_sp(DisasContext *s, arg_VCVT_int_sp *a)
+     vm = tcg_temp_new_i32();
+     vfp_load_reg32(vm, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     if (a->s) {
+         /* i32 -> f32 */
+         gen_helper_vfp_sitos(vm, vm, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
+     vm = tcg_temp_new_i32();
+     vd = tcg_temp_new_i64();
+     vfp_load_reg32(vm, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     if (a->s) {
+         /* i32 -> f64 */
+         gen_helper_vfp_sitod(vd, vm, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_sp(DisasContext *s, arg_VCVT_fix_sp *a)
+     vd = tcg_temp_new_i32();
+     vfp_load_reg32(vd, a->vd);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     shift = tcg_constant_i32(frac_bits);
+     /* Switch on op:U:sx bits */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
+     vd = tcg_temp_new_i64();
+     vfp_load_reg64(vd, a->vd);
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     shift = tcg_constant_i32(frac_bits);
+     /* Switch on op:U:sx bits */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp_int(DisasContext *s, arg_VCVT_sp_int *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vm = tcg_temp_new_i32();
+     vfp_load_reg32(vm, a->vm);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A32);
+     vm = tcg_temp_new_i64();
+     vd = tcg_temp_new_i32();
+     vfp_load_reg64(vm, a->vm);
+--
+.34.1

-New patch
+[PULL 23/36] target/arm: Use FPST_A64 in A64 decoder
+In the A64 decoder, use FPST_A64 rather than FPST_FPCR.  By
+doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A64/g' target/arm/tcg/translate-{a64,sve,sme}.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-12-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-a64.c |  70 +++++++++++-----------
+ target/arm/tcg/translate-sme.c |   4 +-
+ target/arm/tcg/translate-sve.c | 106 ++++++++++++++++-----------------
+files changed, 90 insertions(+), 90 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, bool is_fp16, int data,
+                               gen_helper_gvec_3_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm), fpst,
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, int ra, bool is_fp16, int data,
+                               gen_helper_gvec_4_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_gen_gvec_4_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm),
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+         if (fp_access_check(s)) {
+             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
+             TCGv_i64 t1 = read_fp_dreg(s, a->rm);
+-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+         if (fp_access_check(s)) {
+             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
+             TCGv_i32 t1 = read_fp_sreg(s, a->rm);
+-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
+             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
+             TCGv_i64 t1 = tcg_constant_i64(0);
+             if (swap) {
+-                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
++                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_A64));
+             } else {
+-                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             }
+             write_fp_dreg(s, a->rd, t0);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
+             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
+             TCGv_i32 t1 = tcg_constant_i32(0);
+             if (swap) {
+-                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
++                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_A64));
+             } else {
+-                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             }
+             write_fp_sreg(s, a->rd, t0);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
+             TCGv_i64 t1 = tcg_temp_new_i64();
+             read_vec_element(s, t1, a->rm, a->idx, MO_64);
+-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
+             TCGv_i32 t1 = tcg_temp_new_i32();
+             read_vec_element_i32(s, t1, a->rm, a->idx, MO_32);
+-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+             if (neg) {
+                 gen_vfp_negd(t1, t1);
+             }
+-            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
++            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+             if (neg) {
+                 gen_vfp_negs(t1, t1);
+             }
+-            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
++            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
+             read_vec_element(s, t0, a->rn, 0, MO_64);
+             read_vec_element(s, t1, a->rn, 1, MO_64);
+-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_dreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
+             read_vec_element_i32(s, t0, a->rn, 0, MO_32);
+             read_vec_element_i32(s, t1, a->rn, 1, MO_32);
+-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
++            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             if (neg_n) {
+                 gen_vfp_negd(tn, tn);
+             }
+-            fpst = fpstatus_ptr(FPST_FPCR);
++            fpst = fpstatus_ptr(FPST_A64);
+             gen_helper_vfp_muladdd(ta, tn, tm, ta, fpst);
+             write_fp_dreg(s, a->rd, ta);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             if (neg_n) {
+                 gen_vfp_negs(tn, tn);
+             }
+-            fpst = fpstatus_ptr(FPST_FPCR);
++            fpst = fpstatus_ptr(FPST_A64);
+             gen_helper_vfp_muladds(ta, tn, tm, ta, fpst);
+             write_fp_sreg(s, a->rd, ta);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
+     if (fp_access_check(s)) {
+         MemOp esz = a->esz;
+         int elts = (a->q ? 16 : 8) >> esz;
+-        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+         TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst, fn);
+         write_fp_sreg(s, a->rd, res);
+     }
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, int size,
+                               bool cmp_with_zero, bool signal_all_nans)
+ {
+     TCGv_i64 tcg_flags = tcg_temp_new_i64();
+-    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     if (size == MO_64) {
+         TCGv_i64 tcg_vn, tcg_vm;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_sreg(s, a->rn);
+         TCGv_i64 tcg_rd = tcg_temp_new_i64();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvtds(tcg_rd, tcg_rn, fpst);
+         write_fp_dreg(s, a->rd, tcg_rd);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hs(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tmp = read_fp_sreg(s, a->rn);
+         TCGv_i32 ahp = get_ahp_flag();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+         /* write_fp_sreg is OK here because top half of result is zero */
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sd(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvtsd(tcg_rd, tcg_rn, fpst);
+         write_fp_sreg(s, a->rd, tcg_rd);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hd(DisasContext *s, arg_rr *a)
+         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+         TCGv_i32 ahp = get_ahp_flag();
+-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvt_f64_to_f16(tcg_rd, tcg_rn, fpst, ahp);
+         /* write_fp_sreg is OK here because top half of tcg_rd is zero */
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i64 tcg_rd = tcg_temp_new_i64();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
+     TCGv_i32 tcg_shift, tcg_single;
+     TCGv_i64 tcg_double;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     switch (esz) {
+@@ -XXX,XX +XXX,XX @@ static void do_fcvt_scalar(DisasContext *s, MemOp out, MemOp esz,
+     TCGv_ptr tcg_fpstatus;
+     TCGv_i32 tcg_shift, tcg_rmode, tcg_single;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     tcg_rmode = gen_set_rmode(rmode, tcg_fpstatus);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FJCVTZS(DisasContext *s, arg_FJCVTZS *a)
+     }
+     if (fp_access_check(s)) {
+         TCGv_i64 t = read_fp_dreg(s, a->rn);
+-        TCGv_ptr fpstatus = fpstatus_ptr(FPST_FPCR);
++        TCGv_ptr fpstatus = fpstatus_ptr(FPST_A64);
+         gen_helper_fjcvtzs(t, t, fpstatus);
+@@ -XXX,XX +XXX,XX @@ static void gen_fcvtxn_sd(TCGv_i64 d, TCGv_i64 n)
+      * with von Neumann rounding (round to odd)
+      */
+     TCGv_i32 tmp = tcg_temp_new_i32();
+-    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_FPCR));
++    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_A64));
+     tcg_gen_extu_i32_i64(d, tmp);
+ }
+@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
+ {
+     TCGv_i32 tcg_lo = tcg_temp_new_i32();
+     TCGv_i32 tcg_hi = tcg_temp_new_i32();
+-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+     TCGv_i32 ahp = get_ahp_flag();
+     tcg_gen_extr_i64_i32(tcg_lo, tcg_hi, n);
+@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
+ static void gen_fcvtn_sd(TCGv_i64 d, TCGv_i64 n)
+ {
+     TCGv_i32 tmp = tcg_temp_new_i32();
+-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+     gen_helper_vfp_fcvtsd(tmp, n, fpst);
+     tcg_gen_extu_i32_i64(d, tmp);
+@@ -XXX,XX +XXX,XX @@ TRANS(FCVTXN_v, do_2misc_narrow_vector, a, f_scalar_fcvtxn)
+ static void gen_bfcvtn_hs(TCGv_i64 d, TCGv_i64 n)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
++    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+     TCGv_i32 tmp = tcg_temp_new_i32();
+     gen_helper_bfcvt_pair(tmp, n, fpst);
+     tcg_gen_extu_i32_i64(d, tmp);
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_vector(DisasContext *s, arg_qrr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn), fpst,
+                        is_q ? 16 : 8, vec_full_reg_size(s),
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR);
++    fpst = fpstatus_ptr(FPST_A64);
+     if (a->esz == MO_64) {
+         /* 32 -> 64 bit fp conversion */
+         TCGv_i64 tcg_res[2];
+diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sme.c
++++ b/target/arm/tcg/translate-sme.c
+@@ -XXX,XX +XXX,XX @@ static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz,
+ TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_env, a,
+            MO_32, gen_helper_sme_fmopa_h)
+ TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a,
+-           MO_32, FPST_FPCR, gen_helper_sme_fmopa_s)
++           MO_32, FPST_A64, gen_helper_sme_fmopa_s)
+ TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a,
+-           MO_64, FPST_FPCR, gen_helper_sme_fmopa_d)
++           MO_64, FPST_A64, gen_helper_sme_fmopa_d)
+ TRANS_FEAT(BFMOPA, aa64_sme, do_outprod_env, a, MO_32, gen_helper_sme_bfmopa)
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
+                                  arg_rr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zz(s, fn, a->rd, a->rn, data,
+-                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 3 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
+                                   arg_rrr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
+-                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 4 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zpzz(DisasContext *s, gen_helper_gvec_4_ptr *fn,
+                                    arg_rprr_esz *a)
+ {
+     return gen_gvec_fpst_zzzp(s, fn, a->rd, a->rn, a->rm, a->pg, 0,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ /* Invoke a vector expander on two Zregs and an immediate.  */
+@@ -XXX,XX +XXX,XX @@ static bool do_FMLA_zzxz(DisasContext *s, arg_rrxr_esz *a, bool sub)
+     };
+     return gen_gvec_fpst_zzzz(s, fns[a->esz], a->rd, a->rn, a->rm, a->ra,
+                               (a->index << 1) | sub,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ }
+ TRANS_FEAT(FMLA_zzxz, aa64_sve, do_FMLA_zzxz, a, false)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const fmul_idx_fns[4] = {
+ };
+ TRANS_FEAT(FMUL_zzx, aa64_sve, gen_gvec_fpst_zzz,
+            fmul_idx_fns[a->esz], a->rd, a->rn, a->rm, a->index,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Fast Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool do_reduce(DisasContext *s, arg_rpr_esz *a,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, a->rn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     fn(temp, t_zn, t_pg, status, t_desc);
+@@ -XXX,XX +XXX,XX @@ static bool do_ppz_fp(DisasContext *s, arg_rpr_esz *a,
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+         TCGv_ptr status =
+-            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+         tcg_gen_gvec_3_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const ftmad_fns[4] = {
+ };
+ TRANS_FEAT_NONSTREAMING(FTMAD, aa64_sve, gen_gvec_fpst_zzz,
+                         ftmad_fns[a->esz], a->rd, a->rn, a->rm, a->imm,
+-                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Accumulating Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
+     t_pg = tcg_temp_new_ptr();
+     tcg_gen_addi_ptr(t_rm, tcg_env, vec_full_reg_offset(s, a->rm));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     t_desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fns[a->esz - 1](t_val, t_val, t_rm, t_pg, t_fpst, t_desc);
+@@ -XXX,XX +XXX,XX @@ static void do_fp_scalar(DisasContext *s, int zd, int zn, int pg, bool is_fp16,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, zn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));
+-    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
++    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
+     desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fn(t_zd, t_zn, t_pg, scalar, status, desc);
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_cmp(DisasContext *s, arg_rprr_esz *a,
+     }
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+-        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+         tcg_gen_gvec_4_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+                            vec_full_reg_offset(s, a->rm),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_4_ptr * const fcadd_fns[] = {
+ };
+ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+            a->rd, a->rn, a->rm, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ #define DO_FMLA(NAME, name) \
+     static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+     };                                                                  \
+     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp, name##_fns[a->esz], \
+                a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
+-               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ DO_FMLA(FMLA_zpzzz, fmla_zpzzz)
+ DO_FMLA(FMLS_zpzzz, fmls_zpzzz)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_5_ptr * const fcmla_fns[4] = {
+ };
+ TRANS_FEAT(FCMLA_zpzzz, aa64_sve, gen_gvec_fpst_zzzzp, fcmla_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static gen_helper_gvec_4_ptr * const fcmla_idx_fns[4] = {
+     NULL, gen_helper_gvec_fcmlah_idx, gen_helper_gvec_fcmlas_idx, NULL
+ };
+ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->index * 4 + a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Unary Operations Predicated Group
+  */
+ TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_sh, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hs, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
+ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_bfcvt, a, 0, FPST_FPCR)
++           gen_helper_sve_bfcvt, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_dh, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvtzs_hh, a, 0, FPST_FPCR_F16)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVTZU_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvtzu_hd, a, 0, FPST_FPCR_F16)
+ TRANS_FEAT(FCVTZS_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_ss, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_ss, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzs_dd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZU_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_fcvtzu_dd, a, 0, FPST_A64)
+ static gen_helper_gvec_3_ptr * const frint_fns[] = {
+     NULL,
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frint_fns[] = {
+     gen_helper_sve_frint_d
+ };
+ TRANS_FEAT(FRINTI, aa64_sve, gen_gvec_fpst_arg_zpz, frint_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     NULL,
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     gen_helper_sve_frintx_d
+ };
+ TRANS_FEAT(FRINTX, aa64_sve, gen_gvec_fpst_arg_zpz, frintx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+                           ARMFPRounding mode, gen_helper_gvec_3_ptr *fn)
+@@ -XXX,XX +XXX,XX @@ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+     }
+     vsz = vec_full_reg_size(s);
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
+     tmode = gen_set_rmode(mode, status);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, a->rd),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frecpx_fns[] = {
+     gen_helper_sve_frecpx_s, gen_helper_sve_frecpx_d,
+ };
+ TRANS_FEAT(FRECPX, aa64_sve, gen_gvec_fpst_arg_zpz, frecpx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const fsqrt_fns[] = {
+     NULL,                   gen_helper_sve_fsqrt_h,
+     gen_helper_sve_fsqrt_s, gen_helper_sve_fsqrt_d,
+ };
+ TRANS_FEAT(FSQRT, aa64_sve, gen_gvec_fpst_arg_zpz, fsqrt_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ TRANS_FEAT(SCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_hh, a, 0, FPST_FPCR_F16)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(SCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_dh, a, 0, FPST_FPCR_F16)
+ TRANS_FEAT(SCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_ss, a, 0, FPST_A64)
+ TRANS_FEAT(SCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(SCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(SCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_scvt_dd, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_ucvt_hh, a, 0, FPST_FPCR_F16)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(UCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_ucvt_dh, a, 0, FPST_FPCR_F16)
+ TRANS_FEAT(UCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_ss, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_ss, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_dd, a, 0, FPST_FPCR)
++           gen_helper_sve_ucvt_dd, a, 0, FPST_A64)
+ /*
+  *** SVE Memory - 32-bit Gather and Unsized Contiguous Group
+@@ -XXX,XX +XXX,XX @@ DO_ZPZZ_FP(FMINP, aa64_sve2, sve2_fminp_zpzz)
+ TRANS_FEAT_NONSTREAMING(FMMLA_s, aa64_sve_f32mm, gen_gvec_fpst_zzzz,
+                         gen_helper_fmmla_s, a->rd, a->rn, a->rm, a->ra,
+-                        0, FPST_FPCR)
++                        0, FPST_A64)
+ TRANS_FEAT_NONSTREAMING(FMMLA_d, aa64_sve_f64mm, gen_gvec_fpst_zzzz,
+                         gen_helper_fmmla_d, a->rd, a->rn, a->rm, a->ra,
+-                        0, FPST_FPCR)
++                        0, FPST_A64)
+ static gen_helper_gvec_4 * const sqdmlal_zzzw_fns[] = {
+     NULL,                           gen_helper_sve2_sqdmlal_zzzw_h,
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(RAX1, aa64_sve2_sha3, gen_gvec_fn_arg_zzz,
+                         gen_gvec_rax1, a)
+ TRANS_FEAT(FCVTNT_sh, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTNT_ds, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(BFCVTNT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_bfcvtnt, a, 0, FPST_FPCR)
++           gen_helper_sve_bfcvtnt, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTLT_hs, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTLT_sd, aa64_sve2, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_FPCR)
++           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTX_ds, aa64_sve2, do_frint_mode, a,
+            FPROUNDING_ODD, gen_helper_sve_fcvt_ds)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const flogb_fns[] = {
+     gen_helper_flogb_s, gen_helper_flogb_d
+ };
+ TRANS_FEAT(FLOGB, aa64_sve2, gen_gvec_fpst_arg_zpz, flogb_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
++           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
+ static bool do_FMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sub, bool sel)
+ {
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(BFMMLA, aa64_sve_bf16, gen_gvec_env_arg_zzzz,
+ static bool do_BFMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sel)
+ {
+     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal,
+-                              a->rd, a->rn, a->rm, a->ra, sel, FPST_FPCR);
++                              a->rd, a->rn, a->rm, a->ra, sel, FPST_A64);
+ }
+ TRANS_FEAT(BFMLALB_zzzw, aa64_sve_bf16, do_BFMLAL_zzzw, a, false)
+@@ -XXX,XX +XXX,XX @@ static bool do_BFMLAL_zzxw(DisasContext *s, arg_rrxr_esz *a, bool sel)
+ {
+     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal_idx,
+                               a->rd, a->rn, a->rm, a->ra,
+-                              (a->index << 1) | sel, FPST_FPCR);
++                              (a->index << 1) | sel, FPST_A64);
+ }
+ TRANS_FEAT(BFMLALB_zzxw, aa64_sve_bf16, do_BFMLAL_zzxw, a, false)
+--
+.34.1

-New patch
+[PULL 24/36] target/arm: Remove now-unused vfp.fp_status and FPST_FPCR
+Now we have moved all the uses of vfp.fp_status and FPST_FPCR
+to either the A32 or A64 fields, we can remove these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-13-peter.maydell@linaro.org
+---
+ target/arm/cpu.h           | 2 --
+ target/arm/tcg/translate.h | 6 ------
+ target/arm/cpu.c           | 1 -
+ target/arm/vfp_helper.c    | 8 +-------
+files changed, 1 insertion(+), 16 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+         /* There are a number of distinct float control structures:
+          *
+-         *  fp_status: is the "normal" fp status.
+          *  fp_status_a32: is the "normal" fp status for AArch32 insns
+          *  fp_status_a64: is the "normal" fp status for AArch64 insns
+          *  fp_status_fp16: used for half-precision calculations
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          * only thing which needs to read the exception flags being
+          * an explicit FPSCR read.
+          */
+-        float_status fp_status;
+         float_status fp_status_a32;
+         float_status fp_status_a64;
+         float_status fp_status_f16;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
+  * Enum for argument to fpstatus_ptr().
+  */
+ typedef enum ARMFPStatusFlavour {
+-    FPST_FPCR,
+     FPST_A32,
+     FPST_A64,
+     FPST_FPCR_F16,
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+  * been set up to point to the requested field in the CPU state struct.
+  * The options are:
+  *
+- * FPST_FPCR
+- *   for non-FP16 operations controlled by the FPCR
+  * FPST_A32
+  *   for AArch32 non-FP16 operations controlled by the FPCR
+  * FPST_A64
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
+     int offset;
+     switch (flavour) {
+-    case FPST_FPCR:
+-        offset = offsetof(CPUARMState, vfp.fp_status);
+-        break;
+     case FPST_A32:
+         offset = offsetof(CPUARMState, vfp.fp_status_a32);
+         break;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
+     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
+     set_default_nan_mode(1, &env->vfp.standard_fp_status);
+     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
+-    arm_set_default_fp_behaviours(&env->vfp.fp_status);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+ {
+-    uint32_t i;
++    uint32_t i = 0;
+-    i = get_float_exception_flags(&env->vfp.fp_status);
+     i |= get_float_exception_flags(&env->vfp.fp_status_a32);
+     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
+     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+      * values. The caller should have arranged for env->vfp.fpsr to
+      * be the architecturally up-to-date exception flag information first.
+      */
+-    set_float_exception_flags(0, &env->vfp.fp_status);
+     set_float_exception_flags(0, &env->vfp.fp_status_a32);
+     set_float_exception_flags(0, &env->vfp.fp_status_a64);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+             i = float_round_to_zero;
+             break;
+         }
+-        set_float_rounding_mode(i, &env->vfp.fp_status);
+         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+     }
+     if (changed & FPCR_FZ) {
+         bool ftz_enabled = val & FPCR_FZ;
+-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
+-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+     }
+     if (changed & FPCR_DN) {
+         bool dnan_enabled = val & FPCR_DN;
+-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+--
+.34.1

-[Qemu-devel] [PULL 08/12] aspeed/smc: Calculate checksum on normal DMA
+[PULL 25/36] target/arm: Define new fp_status_f16_a32 and fp_status_f16_a64
-From: Christian Svensson <bluecmd@google.com>
+As the first part of splitting the existing fp_status_f16
 into separate float_status fields for AArch32 and AArch64
 (so that we can make FEAT_AFP control bits apply only
 for AArch64), define the two new fp_status_f16_a32 and
 fp_status_f16_a64 fields, but don't use them yet.
-This patch adds the missing checksum calculation on normal DMA transfer.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-According to the datasheet this is how the SMC should behave.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20250124162836.2332150-14-peter.maydell@linaro.org
 ---
  target/arm/cpu.h           |  4 ++++
  target/arm/tcg/translate.h | 12 ++++++++++++
  target/arm/cpu.c           |  2 ++
  target/arm/vfp_helper.c    | 14 ++++++++++++++
 files changed, 32 insertions(+)
-Verified on AST1250 that the hardware matches the behaviour.
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 Signed-off-by: Christian Svensson <bluecmd@google.com>
 Reviewed-by: Joel Stanley <joel@jms.id.au>
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20190904070506.1052-9-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/ssi/aspeed_smc.c | 1 +
 file changed, 1 insertion(+)
 diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/aspeed_smc.c
+--- a/target/arm/cpu.h
-+++ b/hw/ssi/aspeed_smc.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_rw(AspeedSMCState *s)
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-         s->regs[R_DMA_FLASH_ADDR] += 4;
+          *  fp_status_a32: is the "normal" fp status for AArch32 insns
-         s->regs[R_DMA_DRAM_ADDR] += 4;
+          *  fp_status_a64: is the "normal" fp status for AArch64 insns
-         s->regs[R_DMA_LEN] -= 4;
+          *  fp_status_fp16: used for half-precision calculations
-+        s->regs[R_DMA_CHECKSUM] += data;
++         *  fp_status_fp16_a32: used for AArch32 half-precision calculations
 +         *  fp_status_fp16_a64: used for AArch64 half-precision calculations
           *  standard_fp_status : the ARM "Standard FPSCR Value"
           *  standard_fp_status_fp16 : used for half-precision
           *       calculations with the ARM "Standard FPSCR Value"
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          float_status fp_status_a32;
          float_status fp_status_a64;
          float_status fp_status_f16;
 +        float_status fp_status_f16_a32;
 +        float_status fp_status_f16_a64;
          float_status standard_fp_status;
          float_status standard_fp_status_f16;
 diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/translate.h
 +++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
      FPST_A32,
      FPST_A64,
      FPST_FPCR_F16,
 +    FPST_A32_F16,
 +    FPST_A64_F16,
      FPST_STD,
      FPST_STD_F16,
  } ARMFPStatusFlavour;
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
   *   for AArch64 non-FP16 operations controlled by the FPCR
   * FPST_FPCR_F16
   *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
 + * FPST_A32_F16
 + *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
 + * FPST_A64_F16
 + *   for AArch64 operations controlled by the FPCR where FPCR.FZ16 is to be used
   * FPST_STD
   *   for A32/T32 Neon operations using the "standard FPSCR value"
   * FPST_STD_F16
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
      case FPST_FPCR_F16:
          offset = offsetof(CPUARMState, vfp.fp_status_f16);
          break;
 +    case FPST_A32_F16:
 +        offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
 +        break;
 +    case FPST_A64_F16:
 +        offset = offsetof(CPUARMState, vfp.fp_status_f16_a64);
 +        break;
      case FPST_STD:
          offset = offsetof(CPUARMState, vfp.standard_fp_status);
          break;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
      arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
      arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
 +    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
 +    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
      arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
      /* FZ16 does not generate an input denormal exception.  */
      i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
            & ~float_flag_input_denormal);
 +    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
 +          & ~float_flag_input_denormal);
 +    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
 +          & ~float_flag_input_denormal);
      i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
            & ~float_flag_input_denormal);
      return vfp_exceptbits_from_host(i);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      set_float_exception_flags(0, &env->vfp.fp_status_a32);
      set_float_exception_flags(0, &env->vfp.fp_status_a64);
      set_float_exception_flags(0, &env->vfp.fp_status_f16);
 +    set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
 +    set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
      set_float_exception_flags(0, &env->vfp.standard_fp_status);
      set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
  }
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          set_float_rounding_mode(i, &env->vfp.fp_status_a32);
          set_float_rounding_mode(i, &env->vfp.fp_status_a64);
          set_float_rounding_mode(i, &env->vfp.fp_status_f16);
 +        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
 +        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
      }
      if (changed & FPCR_FZ16) {
          bool ftz_enabled = val & FPCR_FZ16;
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
 +        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
 +        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
          set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
 +        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
 +        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
      }
      if (changed & FPCR_FZ) {
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
 +        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
 +        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
      }
  }
 --
-.20.1
+.34.1

-New patch
+[PULL 26/36] target/arm: Use fp_status_f16_a32 in AArch32-only helpers
+We directly use fp_status_f16 in a handful of helpers that
+are AArch32-specific; switch to fp_status_f16_a32 for these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-15-peter.maydell@linaro.org
+---
+ target/arm/tcg/vec_helper.c | 4 ++--
+ target/arm/vfp_helper.c     | 2 +-
+files changed, 3 insertions(+), 3 deletions(-)
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
+                             CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, desc,
+-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
+ }
+ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
+                                 CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, desc,
+-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
+ }
+ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
+     softfloat_to_vfp_compare(env, \
+         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
+ }
+-DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
++DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16_a32)
+ DO_VFP_cmp(s, float32, float32, fp_status_a32)
+ DO_VFP_cmp(d, float64, float64, fp_status_a32)
+ #undef DO_VFP_cmp
+--
+.34.1

-New patch
+[PULL 27/36] target/arm: Use fp_status_f16_a64 in AArch64-only helpers
+We directly use fp_status_f16 in a handful of helpers that are
+AArch64-specific; switch to fp_status_f16_a64 for these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-16-peter.maydell@linaro.org
+---
+ target/arm/tcg/sme_helper.c | 4 ++--
+ target/arm/tcg/vec_helper.c | 8 ++++----
+files changed, 6 insertions(+), 6 deletions(-)
+diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sme_helper.c
++++ b/target/arm/tcg/sme_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
+     float_status fpst_odd, fpst_std, fpst_f16;
+     /*
+-     * Make copies of fp_status and fp_status_f16, because this operation
++     * Make copies of the fp status fields we use, because this operation
+      * does not update the cumulative fp exception status.  It also
+      * produces default NaNs. We also need a second copy of fp_status with
+      * round-to-odd -- see above.
+      */
+-    fpst_f16 = env->vfp.fp_status_f16;
++    fpst_f16 = env->vfp.fp_status_f16_a64;
+     fpst_std = env->vfp.fp_status_a64;
+     set_default_nan_mode(true, &fpst_std);
+     set_default_nan_mode(true, &fpst_f16);
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
+                             CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
+ }
+ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
+     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+     float_status *status = &env->vfp.fp_status_a64;
+-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
++    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
+     for (i = 0; i < oprsz; i += sizeof(float32)) {
+         float16 nn_16 = *(float16 *)(vn + H1_2(i + sel)) ^ negn;
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
+                                 CPUARMState *env, uint32_t desc)
+ {
+     do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
++                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
+ }
+ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
+     float_status *status = &env->vfp.fp_status_a64;
+-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
++    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
+     for (i = 0; i < oprsz; i += 16) {
+         float16 mm_16 = *(float16 *)(vm + i + idx);
+--
+.34.1

-New patch
+[PULL 28/36] target/arm: Use FPST_A32_F16 in A32 decoder
+In the A32 decoder, use FPST_A32_F16 rather than FPST_FPCR_F16.
+By doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A32_F16/g' target/arm/tcg/translate-vfp.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-17-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-vfp.c | 24 ++++++++++++------------
+file changed, 12 insertions(+), 12 deletions(-)
+diff --git a/target/arm/tcg/translate-vfp.c b/target/arm/tcg/translate-vfp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-vfp.c
++++ b/target/arm/tcg/translate-vfp.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
+     }
+     if (sz == 1) {
+-        fpst = fpstatus_ptr(FPST_FPCR_F16);
++        fpst = fpstatus_ptr(FPST_A32_F16);
+     } else {
+         fpst = fpstatus_ptr(FPST_A32);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
+     }
+     if (sz == 1) {
+-        fpst = fpstatus_ptr(FPST_FPCR_F16);
++        fpst = fpstatus_ptr(FPST_A32_F16);
+     } else {
+         fpst = fpstatus_ptr(FPST_A32);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_hp(DisasContext *s, VFPGen3OpSPFn *fn,
+     /*
+      * Do a half-precision operation. Functionally this is
+      * the same as do_vfp_3op_sp(), except:
+-     *  - it uses the FPST_FPCR_F16
++     *  - it uses the FPST_A32_F16
+      *  - it doesn't need the VFP vector handling (fp16 is a
+      *    v8 feature, and in v8 VFP vectors don't exist)
+      *  - it does the aa32_fp16_arith feature test
+@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_hp(DisasContext *s, VFPGen3OpSPFn *fn,
+     f0 = tcg_temp_new_i32();
+     f1 = tcg_temp_new_i32();
+     fd = tcg_temp_new_i32();
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     vfp_load_reg16(f0, vn);
+     vfp_load_reg16(f1, vm);
+@@ -XXX,XX +XXX,XX @@ static bool do_vfm_hp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
+         /* VFNMA, VFNMS */
+         gen_vfp_negh(vd, vd);
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     gen_helper_vfp_muladdh(vd, vn, vm, vd, fpst);
+     vfp_store_reg32(vd, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ DO_VFP_2OP(VNEG, dp, gen_vfp_negd, aa32_fpdp_v2)
+ static void gen_VSQRT_hp(TCGv_i32 vd, TCGv_i32 vm)
+ {
+-    gen_helper_vfp_sqrth(vd, vm, fpstatus_ptr(FPST_FPCR_F16));
++    gen_helper_vfp_sqrth(vd, vm, fpstatus_ptr(FPST_A32_F16));
+ }
+ static void gen_VSQRT_sp(TCGv_i32 vd, TCGv_i32 vm)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_hp(DisasContext *s, arg_VRINTR_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg16(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     gen_helper_rinth(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_hp(DisasContext *s, arg_VRINTZ_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg16(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
+     gen_helper_rinth(tmp, tmp, fpst);
+     gen_restore_rmode(tcg_rmode, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_hp(DisasContext *s, arg_VRINTX_sp *a)
+     tmp = tcg_temp_new_i32();
+     vfp_load_reg16(tmp, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     gen_helper_rinth_exact(tmp, tmp, fpst);
+     vfp_store_reg32(tmp, a->vd);
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_hp(DisasContext *s, arg_VCVT_int_sp *a)
+     vm = tcg_temp_new_i32();
+     vfp_load_reg32(vm, a->vm);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     if (a->s) {
+         /* i32 -> f16 */
+         gen_helper_vfp_sitoh(vm, vm, fpst);
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_hp(DisasContext *s, arg_VCVT_fix_sp *a)
+     vd = tcg_temp_new_i32();
+     vfp_load_reg32(vd, a->vd);
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     shift = tcg_constant_i32(frac_bits);
+     /* Switch on op:U:sx bits */
+@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_hp_int(DisasContext *s, arg_VCVT_sp_int *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_FPCR_F16);
++    fpst = fpstatus_ptr(FPST_A32_F16);
+     vm = tcg_temp_new_i32();
+     vfp_load_reg16(vm, a->vm);
+--
+.34.1

-New patch
+[PULL 29/36] target/arm: Use FPST_A64_F16 in A64 decoder
+In the A32 decoder, use FPST_A64_F16 rather than FPST_FPCR_F16.
+By doing an automated conversion of the whole file we avoid possibly
+using more than one fpst value in a set_rmode/op/restore_rmode
+sequence.
+Patch created with
+  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A64_F16/g' target/arm/tcg/translate-{a64,sve,sme}.c
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-18-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-a64.c | 32 ++++++++---------
+ target/arm/tcg/translate-sve.c | 66 +++++++++++++++++-----------------
+files changed, 49 insertions(+), 49 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, bool is_fp16, int data,
+                               gen_helper_gvec_3_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm), fpst,
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
+                               int rm, int ra, bool is_fp16, int data,
+                               gen_helper_gvec_4_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
++    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
+     tcg_gen_gvec_4_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm),
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+         if (fp_access_check(s)) {
+             TCGv_i32 t0 = read_fp_hreg(s, a->rn);
+             TCGv_i32 t1 = read_fp_hreg(s, a->rm);
+-            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
+             TCGv_i32 t0 = read_fp_hreg(s, a->rn);
+             TCGv_i32 t1 = tcg_constant_i32(0);
+             if (swap) {
+-                f->gen_h(t0, t1, t0, fpstatus_ptr(FPST_FPCR_F16));
++                f->gen_h(t0, t1, t0, fpstatus_ptr(FPST_A64_F16));
+             } else {
+-                f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++                f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             }
+             write_fp_sreg(s, a->rd, t0);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
+             TCGv_i32 t1 = tcg_temp_new_i32();
+             read_vec_element_i32(s, t1, a->rm, a->idx, MO_16);
+-            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+                 gen_vfp_negh(t1, t1);
+             }
+             gen_helper_advsimd_muladdh(t0, t1, t2, t0,
+-                                       fpstatus_ptr(FPST_FPCR_F16));
++                                       fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
+             read_vec_element_i32(s, t0, a->rn, 0, MO_16);
+             read_vec_element_i32(s, t1, a->rn, 1, MO_16);
+-            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_FPCR_F16));
++            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+             write_fp_sreg(s, a->rd, t0);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             if (neg_n) {
+                 gen_vfp_negh(tn, tn);
+             }
+-            fpst = fpstatus_ptr(FPST_FPCR_F16);
++            fpst = fpstatus_ptr(FPST_A64_F16);
+             gen_helper_advsimd_muladdh(ta, tn, tm, ta, fpst);
+             write_fp_sreg(s, a->rd, ta);
+         }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
+     if (fp_access_check(s)) {
+         MemOp esz = a->esz;
+         int elts = (a->q ? 16 : 8) >> esz;
+-        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+         TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst, fn);
+         write_fp_sreg(s, a->rd, res);
+     }
+@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, int size,
+                               bool cmp_with_zero, bool signal_all_nans)
+ {
+     TCGv_i64 tcg_flags = tcg_temp_new_i64();
+-    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_A64_F16 : FPST_A64);
+     if (size == MO_64) {
+         TCGv_i64 tcg_vn, tcg_vm;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
+     TCGv_i32 tcg_shift, tcg_single;
+     TCGv_i64 tcg_double;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     switch (esz) {
+@@ -XXX,XX +XXX,XX @@ static void do_fcvt_scalar(DisasContext *s, MemOp out, MemOp esz,
+     TCGv_ptr tcg_fpstatus;
+     TCGv_i32 tcg_shift, tcg_rmode, tcg_single;
+-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tcg_shift = tcg_constant_i32(shift);
+     tcg_rmode = gen_set_rmode(rmode, tcg_fpstatus);
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_vector(DisasContext *s, arg_qrr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn), fpst,
+                        is_q ? 16 : 8, vec_full_reg_size(s),
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
+                                  arg_rr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zz(s, fn, a->rd, a->rn, data,
+-                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 3 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
+                                   arg_rrr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
+-                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                             a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ /* Invoke an out-of-line helper on 4 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zpzz(DisasContext *s, gen_helper_gvec_4_ptr *fn,
+                                    arg_rprr_esz *a)
+ {
+     return gen_gvec_fpst_zzzp(s, fn, a->rd, a->rn, a->rm, a->pg, 0,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ /* Invoke a vector expander on two Zregs and an immediate.  */
+@@ -XXX,XX +XXX,XX @@ static bool do_FMLA_zzxz(DisasContext *s, arg_rrxr_esz *a, bool sub)
+     };
+     return gen_gvec_fpst_zzzz(s, fns[a->esz], a->rd, a->rn, a->rm, a->ra,
+                               (a->index << 1) | sub,
+-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
+ TRANS_FEAT(FMLA_zzxz, aa64_sve, do_FMLA_zzxz, a, false)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const fmul_idx_fns[4] = {
+ };
+ TRANS_FEAT(FMUL_zzx, aa64_sve, gen_gvec_fpst_zzz,
+            fmul_idx_fns[a->esz], a->rd, a->rn, a->rm, a->index,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Fast Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool do_reduce(DisasContext *s, arg_rpr_esz *a,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, a->rn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     fn(temp, t_zn, t_pg, status, t_desc);
+@@ -XXX,XX +XXX,XX @@ static bool do_ppz_fp(DisasContext *s, arg_rpr_esz *a,
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+         TCGv_ptr status =
+-            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++            fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+         tcg_gen_gvec_3_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const ftmad_fns[4] = {
+ };
+ TRANS_FEAT_NONSTREAMING(FTMAD, aa64_sve, gen_gvec_fpst_zzz,
+                         ftmad_fns[a->esz], a->rd, a->rn, a->rm, a->imm,
+-                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++                        a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Accumulating Reduction Group
+@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
+     t_pg = tcg_temp_new_ptr();
+     tcg_gen_addi_ptr(t_rm, tcg_env, vec_full_reg_offset(s, a->rm));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
+-    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     t_desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fns[a->esz - 1](t_val, t_val, t_rm, t_pg, t_fpst, t_desc);
+@@ -XXX,XX +XXX,XX @@ static void do_fp_scalar(DisasContext *s, int zd, int zn, int pg, bool is_fp16,
+     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, zn));
+     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));
+-    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
++    status = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
+     desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
+     fn(t_zd, t_zn, t_pg, scalar, status, desc);
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_cmp(DisasContext *s, arg_rprr_esz *a,
+     }
+     if (sve_access_check(s)) {
+         unsigned vsz = vec_full_reg_size(s);
+-        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+         tcg_gen_gvec_4_ptr(pred_full_reg_offset(s, a->rd),
+                            vec_full_reg_offset(s, a->rn),
+                            vec_full_reg_offset(s, a->rm),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_4_ptr * const fcadd_fns[] = {
+ };
+ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+            a->rd, a->rn, a->rm, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ #define DO_FMLA(NAME, name) \
+     static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+     };                                                                  \
+     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp, name##_fns[a->esz], \
+                a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
+-               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++               a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ DO_FMLA(FMLA_zpzzz, fmla_zpzzz)
+ DO_FMLA(FMLS_zpzzz, fmls_zpzzz)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_5_ptr * const fcmla_fns[4] = {
+ };
+ TRANS_FEAT(FCMLA_zpzzz, aa64_sve, gen_gvec_fpst_zzzzp, fcmla_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->pg, a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static gen_helper_gvec_4_ptr * const fcmla_idx_fns[4] = {
+     NULL, gen_helper_gvec_fcmlah_idx, gen_helper_gvec_fcmlas_idx, NULL
+ };
+ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
+            a->rd, a->rn, a->rm, a->ra, a->index * 4 + a->rot,
+-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Unary Operations Predicated Group
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_sd, a, 0, FPST_A64)
+ TRANS_FEAT(FCVTZS_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzs_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZU_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzu_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZS_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_hs, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzs_hs, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZU_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_hs, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzu_hs, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZS_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzs_hd, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzs_hd, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZU_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvtzu_hd, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_fcvtzu_hd, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVTZS_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvtzs_ss, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frint_fns[] = {
+     gen_helper_sve_frint_d
+ };
+ TRANS_FEAT(FRINTI, aa64_sve, gen_gvec_fpst_arg_zpz, frint_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     NULL,
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
+     gen_helper_sve_frintx_d
+ };
+ TRANS_FEAT(FRINTX, aa64_sve, gen_gvec_fpst_arg_zpz, frintx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+                           ARMFPRounding mode, gen_helper_gvec_3_ptr *fn)
+@@ -XXX,XX +XXX,XX @@ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
+     }
+     vsz = vec_full_reg_size(s);
+-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
++    status = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+     tmode = gen_set_rmode(mode, status);
+     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, a->rd),
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frecpx_fns[] = {
+     gen_helper_sve_frecpx_s, gen_helper_sve_frecpx_d,
+ };
+ TRANS_FEAT(FRECPX, aa64_sve, gen_gvec_fpst_arg_zpz, frecpx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static gen_helper_gvec_3_ptr * const fsqrt_fns[] = {
+     NULL,                   gen_helper_sve_fsqrt_h,
+     gen_helper_sve_fsqrt_s, gen_helper_sve_fsqrt_d,
+ };
+ TRANS_FEAT(FSQRT, aa64_sve, gen_gvec_fpst_arg_zpz, fsqrt_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ TRANS_FEAT(SCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_scvt_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(SCVTF_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_sh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_scvt_sh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(SCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_scvt_dh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_scvt_dh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(SCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_ss, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(SCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_scvt_dd, a, 0, FPST_A64)
+ TRANS_FEAT(UCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_hh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_ucvt_hh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(UCVTF_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_sh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_ucvt_sh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(UCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_ucvt_dh, a, 0, FPST_FPCR_F16)
++           gen_helper_sve_ucvt_dh, a, 0, FPST_A64_F16)
+ TRANS_FEAT(UCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_ucvt_ss, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const flogb_fns[] = {
+     gen_helper_flogb_s, gen_helper_flogb_d
+ };
+ TRANS_FEAT(FLOGB, aa64_sve2, gen_gvec_fpst_arg_zpz, flogb_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
++           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static bool do_FMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sub, bool sel)
+ {
+--
+.34.1

-New patch
+[PULL 30/36] target/arm: Remove now-unused vfp.fp_status_f16 and FPST_FPCR_F16
+Now we have moved all the uses of vfp.fp_status_f16 and FPST_FPCR_F16
+to the new A32 or A64 fields, we can remove these.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-19-peter.maydell@linaro.org
+---
+ target/arm/cpu.h           | 2 --
+ target/arm/tcg/translate.h | 6 ------
+ target/arm/cpu.c           | 1 -
+ target/arm/vfp_helper.c    | 7 -------
+files changed, 16 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          *
+          *  fp_status_a32: is the "normal" fp status for AArch32 insns
+          *  fp_status_a64: is the "normal" fp status for AArch64 insns
+-         *  fp_status_fp16: used for half-precision calculations
+          *  fp_status_fp16_a32: used for AArch32 half-precision calculations
+          *  fp_status_fp16_a64: used for AArch64 half-precision calculations
+          *  standard_fp_status : the ARM "Standard FPSCR Value"
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+          */
+         float_status fp_status_a32;
+         float_status fp_status_a64;
+-        float_status fp_status_f16;
+         float_status fp_status_f16_a32;
+         float_status fp_status_f16_a64;
+         float_status standard_fp_status;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
+ typedef enum ARMFPStatusFlavour {
+     FPST_A32,
+     FPST_A64,
+-    FPST_FPCR_F16,
+     FPST_A32_F16,
+     FPST_A64_F16,
+     FPST_STD,
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
+  *   for AArch32 non-FP16 operations controlled by the FPCR
+  * FPST_A64
+  *   for AArch64 non-FP16 operations controlled by the FPCR
+- * FPST_FPCR_F16
+- *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
+  * FPST_A32_F16
+  *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
+  * FPST_A64_F16
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
+     case FPST_A64:
+         offset = offsetof(CPUARMState, vfp.fp_status_a64);
+         break;
+-    case FPST_FPCR_F16:
+-        offset = offsetof(CPUARMState, vfp.fp_status_f16);
+-        break;
+     case FPST_A32_F16:
+         offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
+         break;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+-    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
+     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
+     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
+     /* FZ16 does not generate an input denormal exception.  */
+-    i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
+-          & ~float_flag_input_denormal);
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
+           & ~float_flag_input_denormal);
+     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+      */
+     set_float_exception_flags(0, &env->vfp.fp_status_a32);
+     set_float_exception_flags(0, &env->vfp.fp_status_a64);
+-    set_float_exception_flags(0, &env->vfp.fp_status_f16);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
+     set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
+     set_float_exception_flags(0, &env->vfp.standard_fp_status);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         }
+         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
+-        set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
+         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
+     }
+     if (changed & FPCR_FZ16) {
+         bool ftz_enabled = val & FPCR_FZ16;
+-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
+         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
+         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         bool dnan_enabled = val & FPCR_DN;
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
+-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
+     }
+--
+.34.1

-New patch
+[PULL 31/36] fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
+Our float_flag_input_denormal exception flag is set when the fpu code
 flushes an input denormal to zero.  This is what many guest
 architectures (eg classic Arm behaviour) require, but it is not the
 only donarmal-related reason we might want to set an exception flag.
 The x86 behaviour (which we do not currently model correctly) wants
 to see an exception flag when a denormal input is *not* flushed to
 zero and is actually used in an arithmetic operation. Arm's FEAT_AFP
 also wants these semantics.
 Rename float_flag_input_denormal to float_flag_input_denormal_flushed
 to make it clearer when it is set and to allow us to add a new
 float_flag_input_denormal_used next to it for the x86/FEAT_AFP
 semantics.
 Commit created with
  for f in `git grep -l float_flag_input_denormal`; do sed -i -e 's/float_flag_input_denormal/float_flag_input_denormal_flushed/' $f; done
 and manual editing of softfloat-types.h and softfloat.c to clean
 up the indentation afterwards and to fix a comment which wasn't
 using the full name of the flag.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20250124162836.2332150-20-peter.maydell@linaro.org
 ---
  include/fpu/softfloat-types.h |  5 +++--
  fpu/softfloat.c               |  4 ++--
  target/arm/tcg/sve_helper.c   |  6 +++---
  target/arm/vfp_helper.c       | 10 +++++-----
  target/i386/tcg/fpu_helper.c  |  6 +++---
  target/mips/tcg/msa_helper.c  |  2 +-
  target/rx/op_helper.c         |  2 +-
  fpu/softfloat-parts.c.inc     |  2 +-
 files changed, 19 insertions(+), 18 deletions(-)
 diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/fpu/softfloat-types.h
 +++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ enum {
      float_flag_overflow        = 0x0004,
      float_flag_underflow       = 0x0008,
      float_flag_inexact         = 0x0010,
 -    float_flag_input_denormal  = 0x0020,
 +    /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
 +    float_flag_input_denormal_flushed = 0x0020,
      float_flag_output_denormal = 0x0040,
      float_flag_invalid_isi     = 0x0080,  /* inf - inf */
      float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
      bool tininess_before_rounding;
      /* should denormalised results go to zero and set the inexact flag? */
      bool flush_to_zero;
 -    /* should denormalised inputs go to zero and set the input_denormal flag? */
 +    /* should denormalised inputs go to zero and set input_denormal_flushed? */
      bool flush_inputs_to_zero;
      bool default_nan_mode;
      /*
 diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat.c
 +++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ this code that are retained.
          if (unlikely(soft_t ## _is_denormal(*a))) {                     \
              *a = soft_t ## _set_sign(soft_t ## _zero,                   \
                                       soft_t ## _is_neg(*a));            \
 -            float_raise(float_flag_input_denormal, s);                  \
 +            float_raise(float_flag_input_denormal_flushed, s);          \
          }                                                               \
      }
@@ -XXX,XX +XXX,XX @@ float128 float128_silence_nan(float128 a, float_status *status)
  static bool parts_squash_denormal(FloatParts64 p, float_status *status)
  {
      if (p.exp == 0 && p.frac != 0) {
 -        float_raise(float_flag_input_denormal, status);
 +        float_raise(float_flag_input_denormal_flushed, status);
          return true;
      }
 diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/sve_helper.c
 +++ b/target/arm/tcg/sve_helper.c
@@ -XXX,XX +XXX,XX @@ static int16_t do_float16_logb_as_int(float16 a, float_status *s)
                  return -15 - clz32(frac);
              }
              /* flush to zero */
 -            float_raise(float_flag_input_denormal, s);
 +            float_raise(float_flag_input_denormal_flushed, s);
          }
      } else if (unlikely(exp == 0x1f)) {
          if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int32_t do_float32_logb_as_int(float32 a, float_status *s)
                  return -127 - clz32(frac);
              }
              /* flush to zero */
 -            float_raise(float_flag_input_denormal, s);
 +            float_raise(float_flag_input_denormal_flushed, s);
          }
      } else if (unlikely(exp == 0xff)) {
          if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int64_t do_float64_logb_as_int(float64 a, float_status *s)
                  return -1023 - clz64(frac);
              }
              /* flush to zero */
 -            float_raise(float_flag_input_denormal, s);
 +            float_raise(float_flag_input_denormal_flushed, s);
          }
      } else if (unlikely(exp == 0x7ff)) {
          if (frac == 0) {
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
      if (host_bits & float_flag_inexact) {
          target_bits |= FPSR_IXC;
      }
 -    if (host_bits & float_flag_input_denormal) {
 +    if (host_bits & float_flag_input_denormal_flushed) {
          target_bits |= FPSR_IDC;
      }
      return target_bits;
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
      i |= get_float_exception_flags(&env->vfp.standard_fp_status);
      /* FZ16 does not generate an input denormal exception.  */
      i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
 -          & ~float_flag_input_denormal);
 +          & ~float_flag_input_denormal_flushed);
      i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
 -          & ~float_flag_input_denormal);
 +          & ~float_flag_input_denormal_flushed);
      i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
 -          & ~float_flag_input_denormal);
 +          & ~float_flag_input_denormal_flushed);
      return vfp_exceptbits_from_host(i);
  }
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(fjcvtzs)(float64 value, float_status *status)
      /* Normal inexact, denormal with flush-to-zero, or overflow or NaN */
      inexact = e_new & (float_flag_inexact |
 -                       float_flag_input_denormal |
 +                       float_flag_input_denormal_flushed |
                         float_flag_invalid);
      /* While not inexact for IEEE FP, -0.0 is inexact for JavaScript. */
 diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/fpu_helper.c
 +++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void merge_exception_flags(CPUX86State *env, uint8_t old_flags)
                         (new_flags & float_flag_overflow ? FPUS_OE : 0) |
                         (new_flags & float_flag_underflow ? FPUS_UE : 0) |
                         (new_flags & float_flag_inexact ? FPUS_PE : 0) |
 -                       (new_flags & float_flag_input_denormal ? FPUS_DE : 0)));
 +                       (new_flags & float_flag_input_denormal_flushed ? FPUS_DE : 0)));
  }
  static inline floatx80 helper_fdiv(CPUX86State *env, floatx80 a, floatx80 b)
@@ -XXX,XX +XXX,XX @@ void helper_fxtract(CPUX86State *env)
              int shift = clz64(temp.l.lower);
              temp.l.lower <<= shift;
              expdif = 1 - EXPBIAS - shift;
 -            float_raise(float_flag_input_denormal, &env->fp_status);
 +            float_raise(float_flag_input_denormal_flushed, &env->fp_status);
          } else {
              expdif = EXPD(temp) - EXPBIAS;
          }
@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
      uint8_t flags = get_float_exception_flags(&env->sse_status);
      /*
       * The MXCSR denormal flag has opposite semantics to
 -     * float_flag_input_denormal (the softfloat code sets that flag
 +     * float_flag_input_denormal_flushed (the softfloat code sets that flag
       * only when flushing input denormals to zero, but SSE sets it
       * only when not flushing them to zero), so is not converted
       * here.
 diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/tcg/msa_helper.c
 +++ b/target/mips/tcg/msa_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
      enable = GET_FP_ENABLE(env->active_tc.msacsr) | FP_UNIMPLEMENTED;
      /* Set Inexact (I) when flushing inputs to zero */
 -    if ((ieee_exception_flags & float_flag_input_denormal) &&
 +    if ((ieee_exception_flags & float_flag_input_denormal_flushed) &&
              (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
          if (action & CLEAR_IS_INEXACT) {
              mips_exception_flags &= ~FP_INEXACT;
 diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/op_helper.c
 +++ b/target/rx/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
          if (xcpt & float_flag_inexact) {
              SET_FPSW(X);
          }
 -        if ((xcpt & (float_flag_input_denormal
 +        if ((xcpt & (float_flag_input_denormal_flushed
                       | float_flag_output_denormal))
              && !FIELD_EX32(env->fpsw, FPSW, DN)) {
              env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
 diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-parts.c.inc
 +++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(canonicalize)(FloatPartsN *p, float_status *status,
          if (likely(frac_eqz(p))) {
              p->cls = float_class_zero;
          } else if (status->flush_inputs_to_zero) {
 -            float_raise(float_flag_input_denormal, status);
 +            float_raise(float_flag_input_denormal_flushed, status);
              p->cls = float_class_zero;
              frac_clear(p);
          } else {
 --
 .34.1

-New patch
+[PULL 32/36] fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
+Our float_flag_output_denormal exception flag is set when
+the fpu code flushes an output denormal to zero. Rename
+it to float_flag_output_denormal_flushed:
+ * this keeps it parallel with the flag for flushing
+   input denormals, which we just renamed
+ * it makes it clearer that it doesn't mean "set when
+   the output is a denormal"
+Commit created with
+ for f in `git grep -l float_flag_output_denormal`; do sed -i -e 's/float_flag_output_denormal/float_flag_output_denormal_flushed/' $f; done
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-21-peter.maydell@linaro.org
+---
+ include/fpu/softfloat-types.h | 3 ++-
+ fpu/softfloat.c               | 2 +-
+ target/arm/vfp_helper.c       | 2 +-
+ target/i386/tcg/fpu_helper.c  | 2 +-
+ target/m68k/fpu_helper.c      | 2 +-
+ target/mips/tcg/msa_helper.c  | 2 +-
+ target/rx/op_helper.c         | 2 +-
+ target/tricore/fpu_helper.c   | 6 +++---
+ fpu/softfloat-parts.c.inc     | 2 +-
+files changed, 12 insertions(+), 11 deletions(-)
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/fpu/softfloat-types.h
++++ b/include/fpu/softfloat-types.h
+@@ -XXX,XX +XXX,XX @@ enum {
+     float_flag_inexact         = 0x0010,
+     /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
+     float_flag_input_denormal_flushed = 0x0020,
+-    float_flag_output_denormal = 0x0040,
++    /* We flushed an output denormal to 0 (because of flush_to_zero) */
++    float_flag_output_denormal_flushed = 0x0040,
+     float_flag_invalid_isi     = 0x0080,  /* inf - inf */
+     float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
+     float_flag_invalid_idi     = 0x0200,  /* inf / inf */
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -XXX,XX +XXX,XX @@ floatx80 roundAndPackFloatx80(FloatX80RoundPrec roundingPrecision, bool zSign,
+         }
+         if ( zExp <= 0 ) {
+             if (status->flush_to_zero) {
+-                float_raise(float_flag_output_denormal, status);
++                float_raise(float_flag_output_denormal_flushed, status);
+                 return packFloatx80(zSign, 0, 0);
+             }
+             isTiny = status->tininess_before_rounding
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+     if (host_bits & float_flag_overflow) {
+         target_bits |= FPSR_OFC;
+     }
+-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
++    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
+         target_bits |= FPSR_UFC;
+     }
+     if (host_bits & float_flag_inexact) {
+diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/fpu_helper.c
++++ b/target/i386/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
+                    (flags & float_flag_overflow ? FPUS_OE : 0) |
+                    (flags & float_flag_underflow ? FPUS_UE : 0) |
+                    (flags & float_flag_inexact ? FPUS_PE : 0) |
+-                   (flags & float_flag_output_denormal ? FPUS_UE | FPUS_PE :
++                   (flags & float_flag_output_denormal_flushed ? FPUS_UE | FPUS_PE :
+));
+ }
+diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/fpu_helper.c
++++ b/target/m68k/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ static int cpu_m68k_exceptbits_from_host(int host_bits)
+     if (host_bits & float_flag_overflow) {
+         target_bits |= 0x40;
+     }
+-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
++    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
+         target_bits |= 0x20;
+     }
+     if (host_bits & float_flag_divbyzero) {
+diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/tcg/msa_helper.c
++++ b/target/mips/tcg/msa_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
+     }
+     /* Set Inexact (I) and Underflow (U) when flushing outputs to zero */
+-    if ((ieee_exception_flags & float_flag_output_denormal) &&
++    if ((ieee_exception_flags & float_flag_output_denormal_flushed) &&
+             (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
+         mips_exception_flags |= FP_INEXACT;
+         if (action & CLEAR_FS_UNDERFLOW) {
+diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/rx/op_helper.c
++++ b/target/rx/op_helper.c
+@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
+             SET_FPSW(X);
+         }
+         if ((xcpt & (float_flag_input_denormal_flushed
+-                     | float_flag_output_denormal))
++                     | float_flag_output_denormal_flushed))
+             && !FIELD_EX32(env->fpsw, FPSW, DN)) {
+             env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
+         }
+diff --git a/target/tricore/fpu_helper.c b/target/tricore/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/tricore/fpu_helper.c
++++ b/target/tricore/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline uint8_t f_get_excp_flags(CPUTriCoreState *env)
+            & (float_flag_invalid
+               | float_flag_overflow
+               | float_flag_underflow
+-              | float_flag_output_denormal
++              | float_flag_output_denormal_flushed
+               | float_flag_divbyzero
+               | float_flag_inexact);
+ }
+@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
+         some_excp = 1;
+     }
+-    if (flags & float_flag_underflow || flags & float_flag_output_denormal) {
++    if (flags & float_flag_underflow || flags & float_flag_output_denormal_flushed) {
+         env->FPU_FU = 1 << 31;
+         some_excp = 1;
+     }
+@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
+         some_excp = 1;
+     }
+-    if (flags & float_flag_inexact || flags & float_flag_output_denormal) {
++    if (flags & float_flag_inexact || flags & float_flag_output_denormal_flushed) {
+         env->PSW |= 1 << 26;
+         some_excp = 1;
+     }
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-parts.c.inc
++++ b/fpu/softfloat-parts.c.inc
+@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
+         }
+         frac_shr(p, frac_shift);
+     } else if (s->flush_to_zero) {
+-        flags |= float_flag_output_denormal;
++        flags |= float_flag_output_denormal_flushed;
+         p->cls = float_class_zero;
+         exp = 0;
+         frac_clear(p);
+--
+.34.1

-New patch
+[PULL 33/36] fpu: Fix a comment in softfloat-types.h
+In softfloat-types.h a comment documents that if the float_status
+field flush_to_zero is set then we flush denormalised results to 0
+and set the inexact flag.  This isn't correct: the status flag that
+we set when flush_to_zero causes us to flush an output to zero is
+float_flag_output_denormal_flushed.
+Correct the comment.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-22-peter.maydell@linaro.org
+---
+ include/fpu/softfloat-types.h | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/fpu/softfloat-types.h
++++ b/include/fpu/softfloat-types.h
+@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
+     Float3NaNPropRule float_3nan_prop_rule;
+     FloatInfZeroNaNRule float_infzeronan_rule;
+     bool tininess_before_rounding;
+-    /* should denormalised results go to zero and set the inexact flag? */
++    /* should denormalised results go to zero and set output_denormal_flushed? */
+     bool flush_to_zero;
+     /* should denormalised inputs go to zero and set input_denormal_flushed? */
+     bool flush_inputs_to_zero;
+--
+.34.1

-New patch
+[PULL 34/36] target/arm: Remove redundant advsimd float16 helpers
+The advsimd_addh etc helpers defined in helper-a64.c are identical to
+the vfp_addh etc helpers defined in helper-vfp.c: both take two
+float16 inputs (in a uint32_t type) plus a float_status* and are
+simple wrappers around the softfloat float16_* functions.
+(The duplication seems to be a historical accident: we added the
+advsimd helpers in 2018 as part of the A64 implementation, and at
+that time there was no f16 emulation in A32.  Then later we added the
+A32 f16 handling by extending the existing VFP helper macros to
+generate f16 versions as well as f32 and f64, and didn't realise we
+could clean things up.)
+Remove the now-unnecessary advsimd helpers and make the places that
+generated calls to them use the vfp helpers instead. Many of the
+helper functions were already unused.
+(The remaining advsimd_ helpers are those which don't have vfp
+versions.)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-26-peter.maydell@linaro.org
+---
+ target/arm/tcg/helper-a64.h    |  8 --------
+ target/arm/tcg/helper-a64.c    |  9 ---------
+ target/arm/tcg/translate-a64.c | 16 ++++++++--------
+files changed, 8 insertions(+), 25 deletions(-)
+diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-a64.h
++++ b/target/arm/tcg/helper-a64.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(frecpx_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
+ DEF_HELPER_FLAGS_2(fcvtx_f64_to_f32, TCG_CALL_NO_RWG, f32, f64, fpst)
+ DEF_HELPER_FLAGS_3(crc32_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
+ DEF_HELPER_FLAGS_3(crc32c_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
+-DEF_HELPER_FLAGS_3(advsimd_maxh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_FLAGS_3(advsimd_minh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_FLAGS_3(advsimd_maxnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_FLAGS_3(advsimd_minnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_addh, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_subh, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_mulh, f16, f16, f16, fpst)
+-DEF_HELPER_3(advsimd_divh, f16, f16, f16, fpst)
+ DEF_HELPER_3(advsimd_ceq_f16, i32, f16, f16, fpst)
+ DEF_HELPER_3(advsimd_cge_f16, i32, f16, f16, fpst)
+ DEF_HELPER_3(advsimd_cgt_f16, i32, f16, f16, fpst)
+diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-a64.c
++++ b/target/arm/tcg/helper-a64.c
+@@ -XXX,XX +XXX,XX @@ uint32_t ADVSIMD_HELPER(name, h)(uint32_t a, uint32_t b, float_status *fpst) \
+     return float16_ ## name(a, b, fpst);    \
+ }
+-ADVSIMD_HALFOP(add)
+-ADVSIMD_HALFOP(sub)
+-ADVSIMD_HALFOP(mul)
+-ADVSIMD_HALFOP(div)
+-ADVSIMD_HALFOP(min)
+-ADVSIMD_HALFOP(max)
+-ADVSIMD_HALFOP(minnum)
+-ADVSIMD_HALFOP(maxnum)
+-
+ #define ADVSIMD_TWOHALFOP(name)                                         \
+ uint32_t ADVSIMD_HELPER(name, 2h)(uint32_t two_a, uint32_t two_b,       \
+                                   float_status *fpst)                   \
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fmul = {
+ TRANS(FMUL_s, do_fp3_scalar, a, &f_scalar_fmul)
+ static const FPScalar f_scalar_fmax = {
+-    gen_helper_advsimd_maxh,
++    gen_helper_vfp_maxh,
+     gen_helper_vfp_maxs,
+     gen_helper_vfp_maxd,
+ };
+ TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax)
+ static const FPScalar f_scalar_fmin = {
+-    gen_helper_advsimd_minh,
++    gen_helper_vfp_minh,
+     gen_helper_vfp_mins,
+     gen_helper_vfp_mind,
+ };
+ TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin)
+ static const FPScalar f_scalar_fmaxnm = {
+-    gen_helper_advsimd_maxnumh,
++    gen_helper_vfp_maxnumh,
+     gen_helper_vfp_maxnums,
+     gen_helper_vfp_maxnumd,
+ };
+ TRANS(FMAXNM_s, do_fp3_scalar, a, &f_scalar_fmaxnm)
+ static const FPScalar f_scalar_fminnm = {
+-    gen_helper_advsimd_minnumh,
++    gen_helper_vfp_minnumh,
+     gen_helper_vfp_minnums,
+     gen_helper_vfp_minnumd,
+ };
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
+     return true;
+ }
+-TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxnumh)
+-TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minnumh)
+-TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxh)
+-TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minh)
++TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxnumh)
++TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minnumh)
++TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxh)
++TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minh)
+ TRANS(FMAXNMV_s, do_fp_reduction, a, gen_helper_vfp_maxnums)
+ TRANS(FMINNMV_s, do_fp_reduction, a, gen_helper_vfp_minnums)
+--
+.34.1

-New patch
+[PULL 35/36] target/arm: Use FPST_A64_F16 for halfprec-to-other conversions
+We should be using the F16-specific float_status for conversions from
+half-precision, because halfprec inputs never set Input Denormal.
+Without FEAT_AHP, using the wrong fpst here had no effect, because
+the only difference between the A64_F16 and A64 fpst is its handling
+of flush-to-zero on input and output, and the helper functions
+vfp_fcvt_f16_to_* and vfp_fcvt_*_to_f16 all explicitly squash the
+relevant flushing flags, and flush_inputs_to_zero was the only way
+that IDC could be set.
+With FEAT_AHP, the FPCR.AH=1 behaviour sets IDC for
+input_denormal_used, which we will only ignore in
+vfp_get_fpsr_from_host() for the A64_F16 fpst; so it matters that we
+use that one for f16 inputs (and the normal one for single/double to
+f16 conversions).
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250124162836.2332150-27-peter.maydell@linaro.org
+---
+ target/arm/tcg/translate-a64.c | 9 ++++++---
+ target/arm/tcg/translate-sve.c | 4 ++--
+files changed, 8 insertions(+), 5 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i32 tcg_rd = tcg_temp_new_i32();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
+     if (fp_access_check(s)) {
+         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
+         TCGv_i64 tcg_rd = tcg_temp_new_i64();
+-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
++        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
+         return true;
+     }
+-    fpst = fpstatus_ptr(FPST_A64);
+     if (a->esz == MO_64) {
+         /* 32 -> 64 bit fp conversion */
+         TCGv_i64 tcg_res[2];
+         TCGv_i32 tcg_op = tcg_temp_new_i32();
+         int srcelt = a->q ? 2 : 0;
++        fpst = fpstatus_ptr(FPST_A64);
++
+         for (pass = 0; pass < 2; pass++) {
+             tcg_res[pass] = tcg_temp_new_i64();
+             read_vec_element_i32(s, tcg_op, a->rn, srcelt + pass, MO_32);
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
+         TCGv_i32 tcg_res[4];
+         TCGv_i32 ahp = get_ahp_flag();
++        fpst = fpstatus_ptr(FPST_A64_F16);
++
+         for (pass = 0; pass < 4; pass++) {
+             tcg_res[pass] = tcg_temp_new_i32();
+             read_vec_element_i32(s, tcg_res[pass], a->rn, srcelt + pass, MO_16);
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
+ TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
++           gen_helper_sve_fcvt_hs, a, 0, FPST_A64_F16)
+ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_bfcvt, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+ TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
++           gen_helper_sve_fcvt_hd, a, 0, FPST_A64_F16)
+ TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
+--
+.34.1

-[Qemu-devel] [PULL 03/12] aspeed: Remove unused SoC definitions
+[PULL 36/36] hw/usb/canokey: Fix buffer overflow for OUT packet
-From: Cédric Le Goater <clg@kaod.org>
+From: Hongren Zheng <i@zenithal.me>
-There are no QEMU Aspeed machines using the SoCs "ast2400-a0" or
+When USBPacket in OUT direction has larger payload
-"ast2400".
+than the ep_out_buffer (of size 512), a buffer overflow
 would occur.
-Signed-off-by: Cédric Le Goater <clg@kaod.org>
+It could be fixed by limiting the size of usb_packet_copy
-Message-id: 20190904070506.1052-4-clg@kaod.org
+to be at most buffer size. Further optimization gets rid
 of the ep_out_buffer and directly uses ep_out as the target
 buffer.
 This is reported by a security researcher who artificially
 constructed an OUT packet of size 2047. The report has gone
 through the QEMU security process, and as this device is for
 testing purpose and no deployment of it in virtualization
 environment is observed, it is triaged not to be a security bug.
 Cc: qemu-stable@nongnu.org
 Fixes: d7d34918551dc48 ("hw/usb: Add CanoKey Implementation")
 Reported-by: Juan Jose Lopez Jaimez <thatjiaozi@gmail.com>
 Signed-off-by: Hongren Zheng <i@zenithal.me>
 Message-id: Z4TfMOrZz6IQYl_h@Sun
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/aspeed_soc.c | 26 --------------------------
+ hw/usb/canokey.h | 4 ----
-file changed, 26 deletions(-)
+ hw/usb/canokey.c | 6 +++---
 files changed, 3 insertions(+), 7 deletions(-)
-diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
+diff --git a/hw/usb/canokey.h b/hw/usb/canokey.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_soc.c
+--- a/hw/usb/canokey.h
-+++ b/hw/arm/aspeed_soc.c
++++ b/hw/usb/canokey.h
-@@ -XXX,XX +XXX,XX @@ static const char *aspeed_soc_ast2500_typenames[] = {
+@@ -XXX,XX +XXX,XX @@
+ #define CANOKEY_EP_NUM 3
- static const AspeedSoCInfo aspeed_socs[] = {
+ /* BULK/INTR IN can be up to 1352 bytes, e.g. get key info */
-     {
+ #define CANOKEY_EP_IN_BUFFER_SIZE 2048
--        .name         = "ast2400-a0",
+-/* BULK OUT can be up to 270 bytes, e.g. PIV import cert */
--        .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
+-#define CANOKEY_EP_OUT_BUFFER_SIZE 512
--        .silicon_rev  = AST2400_A0_SILICON_REV,
--        .sram_size    = 0x8000,
+ typedef enum {
--        .spis_num     = 1,
+     CANOKEY_EP_IN_WAIT,
--        .fmc_typename = "aspeed.smc.fmc",
+@@ -XXX,XX +XXX,XX @@ typedef struct CanoKeyState {
--        .spi_typename = aspeed_soc_ast2400_typenames,
+     /* OUT pointer to canokey recv buffer */
--        .gpio_typename = "aspeed.gpio-ast2400",
+     uint8_t *ep_out[CANOKEY_EP_NUM];
--        .wdts_num     = 2,
+     uint32_t ep_out_size[CANOKEY_EP_NUM];
--        .irqmap       = aspeed_soc_ast2400_irqmap,
+-    /* For large BULK OUT, multiple write to ep_out is needed */
--        .memmap       = aspeed_soc_ast2400_memmap,
+-    uint8_t ep_out_buffer[CANOKEY_EP_NUM][CANOKEY_EP_OUT_BUFFER_SIZE];
--        .num_cpus     = 1,
--    }, {
+     /* Properties */
-         .name         = "ast2400-a1",
+     char *file; /* canokey-file */
-         .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
+diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
-         .silicon_rev  = AST2400_A1_SILICON_REV,
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
+--- a/hw/usb/canokey.c
-         .irqmap       = aspeed_soc_ast2400_irqmap,
++++ b/hw/usb/canokey.c
-         .memmap       = aspeed_soc_ast2400_memmap,
+@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
-         .num_cpus     = 1,
+     switch (p->pid) {
--    }, {
+     case USB_TOKEN_OUT:
--        .name         = "ast2400",
+         trace_canokey_handle_data_out(ep_out, p->iov.size);
--        .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
+-        usb_packet_copy(p, key->ep_out_buffer[ep_out], p->iov.size);
--        .silicon_rev  = AST2400_A0_SILICON_REV,
+         out_pos = 0;
--        .sram_size    = 0x8000,
++        /* segment packet into (possibly multiple) ep_out */
--        .spis_num     = 1,
+         while (out_pos != p->iov.size) {
--        .fmc_typename = "aspeed.smc.fmc",
+             /*
--        .spi_typename = aspeed_soc_ast2400_typenames,
+              * key->ep_out[ep_out] set by prepare_receive
--        .gpio_typename = "aspeed.gpio-ast2400",
+@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
--        .wdts_num     = 2,
+              * to be the buffer length
--        .irqmap       = aspeed_soc_ast2400_irqmap,
+              */
--        .memmap       = aspeed_soc_ast2400_memmap,
+             out_len = MIN(p->iov.size - out_pos, key->ep_out_size[ep_out]);
--        .num_cpus     = 1,
+-            memcpy(key->ep_out[ep_out],
-     }, {
+-                    key->ep_out_buffer[ep_out] + out_pos, out_len);
-         .name         = "ast2500-a1",
++            /* usb_packet_copy would update the pos offset internally */
-         .cpu_type     = ARM_CPU_TYPE_NAME("arm1176"),
++            usb_packet_copy(p, key->ep_out[ep_out], out_len);
              out_pos += out_len;
              /* update ep_out_size to actual len */
              key->ep_out_size[ep_out] = out_len;
 --
-.20.1
+.34.1

target-arm queue: mostly aspeed changes from Cédric.

thanks
-- PMM

The following changes since commit 85182c96de61f0b600bbe834d5a23e713162e892:

Merge remote-tracking branch 'remotes/dgilbert/tags/pull-migration-20190912a' into staging (2019-09-13 14:37:48 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190913

for you to fetch changes up to 27a296fce9821e3608d537756cffa6e43a46df3b:

qemu-ga: Convert invocation documentation to rST (2019-09-13 16:05:01 +0100)

----------------------------------------------------------------
target-arm queue:
 * aspeed: add a GPIO controller to the SoC
 * aspeed: Various refactorings
 * aspeed: Improve DMA controller modelling
 * atomic_template: fix indentation in GEN_ATOMIC_HELPER
 * qemu-ga: Convert invocation documentation to rST

----------------------------------------------------------------
Christian Svensson (1):
      aspeed/smc: Calculate checksum on normal DMA

Cédric Le Goater (7):
      aspeed: Remove unused SoC definitions
      aspeed: Use consistent typenames
      aspeed/smc: Add support for DMAs
      aspeed/smc: Add DMA calibration settings
      aspeed/smc: Inject errors in DMA checksum
      aspeed/scu: Introduce per-SoC SCU types
      aspeed/scu: Introduce a aspeed_scu_get_apb_freq() routine

Emilio G. Cota (1):
      atomic_template: fix indentation in GEN_ATOMIC_HELPER

Peter Maydell (1):
      qemu-ga: Convert invocation documentation to rST

Rashmica Gupta (2):
      hw/gpio: Add basic Aspeed GPIO model for AST2400 and AST2500
      aspeed: add a GPIO controller to the SoC

From: Rashmica Gupta <rashmica.g@gmail.com>

GPIO pins are arranged in groups of 8 pins labeled A,B,..,Y,Z,AA,AB,AC.
(Note that the ast2400 controller only goes up to group AB).
A set has four groups (except set AC which only has one) and is
referred to by the groups it is composed of (eg ABCD,EFGH,...,YZAAAB).
Each set is accessed and controlled by a bank of 14 registers.

These registers operate on a per pin level where each bit in the register
corresponds to a pin, except for the command source registers. The command
source registers operate on a per group level where bits 24, 16, 8 and 0
correspond to each group in the set.

eg. registers for set ABCD:
 |D7...D0|C7...C0|B7...B0|A7...A0| <- GPIOs
 |31...24|23...16|15....8|7.....0| <- bit position

Note that there are a couple of groups that only have 4 pins.

There are two ways that this model deviates from the behaviour of the
actual controller:
(1) The only control source driving the GPIO pins in the model is the ARM
model (as there currently aren't models for the LPC or Coprocessor).

(2) None of the registers in the model are reset tolerant (needs
integration with the watchdog).

Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
Tested-by: Andrew Jeffery <andrew@aj.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-2-clg@kaod.org
[clg: fixed missing header files
      made use of HWADDR_PRIx to fix compilation on windows ]
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/Makefile.objs         |   1 +
 include/hw/gpio/aspeed_gpio.h | 100 ++++
 hw/gpio/aspeed_gpio.c         | 884 ++++++++++++++++++++++++++++++++++
 3 files changed, 985 insertions(+)
 create mode 100644 include/hw/gpio/aspeed_gpio.h
 create mode 100644 hw/gpio/aspeed_gpio.c

diff --git a/hw/gpio/Makefile.objs b/hw/gpio/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/Makefile.objs
+++ b/hw/gpio/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_OMAP) += omap_gpio.o
 obj-$(CONFIG_IMX) += imx_gpio.o
 obj-$(CONFIG_RASPI) += bcm2835_gpio.o
 obj-$(CONFIG_NRF51_SOC) += nrf51_gpio.o
+obj-$(CONFIG_ASPEED_SOC) += aspeed_gpio.o
diff --git a/include/hw/gpio/aspeed_gpio.h b/include/hw/gpio/aspeed_gpio.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/gpio/aspeed_gpio.h
@@ -XXX,XX +XXX,XX @@
+/*
+ *  ASPEED GPIO Controller
+ *
+ *  Copyright (C) 2017-2018 IBM Corp.
+ *
+ * This code is licensed under the GPL version 2 or later.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#ifndef ASPEED_GPIO_H
+#define ASPEED_GPIO_H
+
+#include "hw/sysbus.h"
+
+#define TYPE_ASPEED_GPIO "aspeed.gpio"
+#define ASPEED_GPIO(obj) OBJECT_CHECK(AspeedGPIOState, (obj), TYPE_ASPEED_GPIO)
+#define ASPEED_GPIO_CLASS(klass) \
+     OBJECT_CLASS_CHECK(AspeedGPIOClass, (klass), TYPE_ASPEED_GPIO)
+#define ASPEED_GPIO_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(AspeedGPIOClass, (obj), TYPE_ASPEED_GPIO)
+
+#define ASPEED_GPIO_MAX_NR_SETS 8
+#define ASPEED_REGS_PER_BANK 14
+#define ASPEED_GPIO_MAX_NR_REGS (ASPEED_REGS_PER_BANK * ASPEED_GPIO_MAX_NR_SETS)
+#define ASPEED_GPIO_NR_PINS 228
+#define ASPEED_GROUPS_PER_SET 4
+#define ASPEED_GPIO_NR_DEBOUNCE_REGS 3
+#define ASPEED_CHARS_PER_GROUP_LABEL 4
+
+typedef struct GPIOSets GPIOSets;
+
+typedef struct GPIOSetProperties {
+    uint32_t input;
+    uint32_t output;
+    char group_label[ASPEED_GROUPS_PER_SET][ASPEED_CHARS_PER_GROUP_LABEL];
+} GPIOSetProperties;
+
+enum GPIORegType {
+    gpio_not_a_reg,
+    gpio_reg_data_value,
+    gpio_reg_direction,
+    gpio_reg_int_enable,
+    gpio_reg_int_sens_0,
+    gpio_reg_int_sens_1,
+    gpio_reg_int_sens_2,
+    gpio_reg_int_status,
+    gpio_reg_reset_tolerant,
+    gpio_reg_debounce_1,
+    gpio_reg_debounce_2,
+    gpio_reg_cmd_source_0,
+    gpio_reg_cmd_source_1,
+    gpio_reg_data_read,
+    gpio_reg_input_mask,
+};
+
+typedef struct AspeedGPIOReg {
+    uint16_t set_idx;
+    enum GPIORegType type;
+ } AspeedGPIOReg;
+
+typedef struct  AspeedGPIOClass {
+    SysBusDevice parent_obj;
+    const GPIOSetProperties *props;
+    uint32_t nr_gpio_pins;
+    uint32_t nr_gpio_sets;
+    uint32_t gap;
+    const AspeedGPIOReg *reg_table;
+}  AspeedGPIOClass;
+
+typedef struct AspeedGPIOState {
+    /* <private> */
+    SysBusDevice parent;
+
+    /*< public >*/
+    MemoryRegion iomem;
+    int pending;
+    qemu_irq irq;
+    qemu_irq gpios[ASPEED_GPIO_NR_PINS];
+
+/* Parallel GPIO Registers */
+    uint32_t debounce_regs[ASPEED_GPIO_NR_DEBOUNCE_REGS];
+    struct GPIOSets {
+        uint32_t data_value; /* Reflects pin values */
+        uint32_t data_read; /* Contains last value written to data value */
+        uint32_t direction;
+        uint32_t int_enable;
+        uint32_t int_sens_0;
+        uint32_t int_sens_1;
+        uint32_t int_sens_2;
+        uint32_t int_status;
+        uint32_t reset_tol;
+        uint32_t cmd_source_0;
+        uint32_t cmd_source_1;
+        uint32_t debounce_1;
+        uint32_t debounce_2;
+        uint32_t input_mask;
+    } sets[ASPEED_GPIO_MAX_NR_SETS];
+} AspeedGPIOState;
+
+#endif /* _ASPEED_GPIO_H_ */
diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@
+/*
+ *  ASPEED GPIO Controller
+ *
+ *  Copyright (C) 2017-2019 IBM Corp.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <assert.h>
+
+#include "qemu/osdep.h"
+#include "qemu/host-utils.h"
+#include "qemu/log.h"
+#include "hw/gpio/aspeed_gpio.h"
+#include "include/hw/misc/aspeed_scu.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+#include "hw/irq.h"
+#include "migration/vmstate.h"
+
+#define GPIOS_PER_REG 32
+#define GPIOS_PER_SET GPIOS_PER_REG
+#define GPIO_PIN_GAP_SIZE 4
+#define GPIOS_PER_GROUP 8
+#define GPIO_GROUP_SHIFT 3
+
+/* GPIO Source Types */
+#define ASPEED_CMD_SRC_MASK         0x01010101
+#define ASPEED_SOURCE_ARM           0
+#define ASPEED_SOURCE_LPC           1
+#define ASPEED_SOURCE_COPROCESSOR   2
+#define ASPEED_SOURCE_RESERVED      3
+
+/* GPIO Interrupt Triggers */
+/*
+ *  For each set of gpios there are three sensitivity registers that control
+ *  the interrupt trigger mode.
+ *
+ *  | 2 | 1 | 0 | trigger mode
+ *  -----------------------------
+ *  | 0 | 0 | 0 | falling-edge
+ *  | 0 | 0 | 1 | rising-edge
+ *  | 0 | 1 | 0 | level-low
+ *  | 0 | 1 | 1 | level-high
+ *  | 1 | X | X | dual-edge
+ */
+#define ASPEED_FALLING_EDGE 0
+#define ASPEED_RISING_EDGE  1
+#define ASPEED_LEVEL_LOW    2
+#define ASPEED_LEVEL_HIGH   3
+#define ASPEED_DUAL_EDGE    4
+
+/* GPIO Register Address Offsets */
+#define GPIO_ABCD_DATA_VALUE       (0x000 >> 2)
+#define GPIO_ABCD_DIRECTION        (0x004 >> 2)
+#define GPIO_ABCD_INT_ENABLE       (0x008 >> 2)
+#define GPIO_ABCD_INT_SENS_0       (0x00C >> 2)
+#define GPIO_ABCD_INT_SENS_1       (0x010 >> 2)
+#define GPIO_ABCD_INT_SENS_2       (0x014 >> 2)
+#define GPIO_ABCD_INT_STATUS       (0x018 >> 2)
+#define GPIO_ABCD_RESET_TOLERANT   (0x01C >> 2)
+#define GPIO_EFGH_DATA_VALUE       (0x020 >> 2)
+#define GPIO_EFGH_DIRECTION        (0x024 >> 2)
+#define GPIO_EFGH_INT_ENABLE       (0x028 >> 2)
+#define GPIO_EFGH_INT_SENS_0       (0x02C >> 2)
+#define GPIO_EFGH_INT_SENS_1       (0x030 >> 2)
+#define GPIO_EFGH_INT_SENS_2       (0x034 >> 2)
+#define GPIO_EFGH_INT_STATUS       (0x038 >> 2)
+#define GPIO_EFGH_RESET_TOLERANT   (0x03C >> 2)
+#define GPIO_ABCD_DEBOUNCE_1       (0x040 >> 2)
+#define GPIO_ABCD_DEBOUNCE_2       (0x044 >> 2)
+#define GPIO_EFGH_DEBOUNCE_1       (0x048 >> 2)
+#define GPIO_EFGH_DEBOUNCE_2       (0x04C >> 2)
+#define GPIO_DEBOUNCE_TIME_1       (0x050 >> 2)
+#define GPIO_DEBOUNCE_TIME_2       (0x054 >> 2)
+#define GPIO_DEBOUNCE_TIME_3       (0x058 >> 2)
+#define GPIO_ABCD_COMMAND_SRC_0    (0x060 >> 2)
+#define GPIO_ABCD_COMMAND_SRC_1    (0x064 >> 2)
+#define GPIO_EFGH_COMMAND_SRC_0    (0x068 >> 2)
+#define GPIO_EFGH_COMMAND_SRC_1    (0x06C >> 2)
+#define GPIO_IJKL_DATA_VALUE       (0x070 >> 2)
+#define GPIO_IJKL_DIRECTION        (0x074 >> 2)
+#define GPIO_MNOP_DATA_VALUE       (0x078 >> 2)
+#define GPIO_MNOP_DIRECTION        (0x07C >> 2)
+#define GPIO_QRST_DATA_VALUE       (0x080 >> 2)
+#define GPIO_QRST_DIRECTION        (0x084 >> 2)
+#define GPIO_UVWX_DATA_VALUE       (0x088 >> 2)
+#define GPIO_UVWX_DIRECTION        (0x08C >> 2)
+#define GPIO_IJKL_COMMAND_SRC_0    (0x090 >> 2)
+#define GPIO_IJKL_COMMAND_SRC_1    (0x094 >> 2)
+#define GPIO_IJKL_INT_ENABLE       (0x098 >> 2)
+#define GPIO_IJKL_INT_SENS_0       (0x09C >> 2)
+#define GPIO_IJKL_INT_SENS_1       (0x0A0 >> 2)
+#define GPIO_IJKL_INT_SENS_2       (0x0A4 >> 2)
+#define GPIO_IJKL_INT_STATUS       (0x0A8 >> 2)
+#define GPIO_IJKL_RESET_TOLERANT   (0x0AC >> 2)
+#define GPIO_IJKL_DEBOUNCE_1       (0x0B0 >> 2)
+#define GPIO_IJKL_DEBOUNCE_2       (0x0B4 >> 2)
+#define GPIO_IJKL_INPUT_MASK       (0x0B8 >> 2)
+#define GPIO_ABCD_DATA_READ        (0x0C0 >> 2)
+#define GPIO_EFGH_DATA_READ        (0x0C4 >> 2)
+#define GPIO_IJKL_DATA_READ        (0x0C8 >> 2)
+#define GPIO_MNOP_DATA_READ        (0x0CC >> 2)
+#define GPIO_QRST_DATA_READ        (0x0D0 >> 2)
+#define GPIO_UVWX_DATA_READ        (0x0D4 >> 2)
+#define GPIO_YZAAAB_DATA_READ      (0x0D8 >> 2)
+#define GPIO_AC_DATA_READ          (0x0DC >> 2)
+#define GPIO_MNOP_COMMAND_SRC_0    (0x0E0 >> 2)
+#define GPIO_MNOP_COMMAND_SRC_1    (0x0E4 >> 2)
+#define GPIO_MNOP_INT_ENABLE       (0x0E8 >> 2)
+#define GPIO_MNOP_INT_SENS_0       (0x0EC >> 2)
+#define GPIO_MNOP_INT_SENS_1       (0x0F0 >> 2)
+#define GPIO_MNOP_INT_SENS_2       (0x0F4 >> 2)
+#define GPIO_MNOP_INT_STATUS       (0x0F8 >> 2)
+#define GPIO_MNOP_RESET_TOLERANT   (0x0FC >> 2)
+#define GPIO_MNOP_DEBOUNCE_1       (0x100 >> 2)
+#define GPIO_MNOP_DEBOUNCE_2       (0x104 >> 2)
+#define GPIO_MNOP_INPUT_MASK       (0x108 >> 2)
+#define GPIO_QRST_COMMAND_SRC_0    (0x110 >> 2)
+#define GPIO_QRST_COMMAND_SRC_1    (0x114 >> 2)
+#define GPIO_QRST_INT_ENABLE       (0x118 >> 2)
+#define GPIO_QRST_INT_SENS_0       (0x11C >> 2)
+#define GPIO_QRST_INT_SENS_1       (0x120 >> 2)
+#define GPIO_QRST_INT_SENS_2       (0x124 >> 2)
+#define GPIO_QRST_INT_STATUS       (0x128 >> 2)
+#define GPIO_QRST_RESET_TOLERANT   (0x12C >> 2)
+#define GPIO_QRST_DEBOUNCE_1       (0x130 >> 2)
+#define GPIO_QRST_DEBOUNCE_2       (0x134 >> 2)
+#define GPIO_QRST_INPUT_MASK       (0x138 >> 2)
+#define GPIO_UVWX_COMMAND_SRC_0    (0x140 >> 2)
+#define GPIO_UVWX_COMMAND_SRC_1    (0x144 >> 2)
+#define GPIO_UVWX_INT_ENABLE       (0x148 >> 2)
+#define GPIO_UVWX_INT_SENS_0       (0x14C >> 2)
+#define GPIO_UVWX_INT_SENS_1       (0x150 >> 2)
+#define GPIO_UVWX_INT_SENS_2       (0x154 >> 2)
+#define GPIO_UVWX_INT_STATUS       (0x158 >> 2)
+#define GPIO_UVWX_RESET_TOLERANT   (0x15C >> 2)
+#define GPIO_UVWX_DEBOUNCE_1       (0x160 >> 2)
+#define GPIO_UVWX_DEBOUNCE_2       (0x164 >> 2)
+#define GPIO_UVWX_INPUT_MASK       (0x168 >> 2)
+#define GPIO_YZAAAB_COMMAND_SRC_0  (0x170 >> 2)
+#define GPIO_YZAAAB_COMMAND_SRC_1  (0x174 >> 2)
+#define GPIO_YZAAAB_INT_ENABLE     (0x178 >> 2)
+#define GPIO_YZAAAB_INT_SENS_0     (0x17C >> 2)
+#define GPIO_YZAAAB_INT_SENS_1     (0x180 >> 2)
+#define GPIO_YZAAAB_INT_SENS_2     (0x184 >> 2)
+#define GPIO_YZAAAB_INT_STATUS     (0x188 >> 2)
+#define GPIO_YZAAAB_RESET_TOLERANT (0x18C >> 2)
+#define GPIO_YZAAAB_DEBOUNCE_1     (0x190 >> 2)
+#define GPIO_YZAAAB_DEBOUNCE_2     (0x194 >> 2)
+#define GPIO_YZAAAB_INPUT_MASK     (0x198 >> 2)
+#define GPIO_AC_COMMAND_SRC_0      (0x1A0 >> 2)
+#define GPIO_AC_COMMAND_SRC_1      (0x1A4 >> 2)
+#define GPIO_AC_INT_ENABLE         (0x1A8 >> 2)
+#define GPIO_AC_INT_SENS_0         (0x1AC >> 2)
+#define GPIO_AC_INT_SENS_1         (0x1B0 >> 2)
+#define GPIO_AC_INT_SENS_2         (0x1B4 >> 2)
+#define GPIO_AC_INT_STATUS         (0x1B8 >> 2)
+#define GPIO_AC_RESET_TOLERANT     (0x1BC >> 2)
+#define GPIO_AC_DEBOUNCE_1         (0x1C0 >> 2)
+#define GPIO_AC_DEBOUNCE_2         (0x1C4 >> 2)
+#define GPIO_AC_INPUT_MASK         (0x1C8 >> 2)
+#define GPIO_ABCD_INPUT_MASK       (0x1D0 >> 2)
+#define GPIO_EFGH_INPUT_MASK       (0x1D4 >> 2)
+#define GPIO_YZAAAB_DATA_VALUE     (0x1E0 >> 2)
+#define GPIO_YZAAAB_DIRECTION      (0x1E4 >> 2)
+#define GPIO_AC_DATA_VALUE         (0x1E8 >> 2)
+#define GPIO_AC_DIRECTION          (0x1EC >> 2)
+#define GPIO_3_6V_MEM_SIZE         0x1F0
+#define GPIO_3_6V_REG_ARRAY_SIZE   (GPIO_3_6V_MEM_SIZE >> 2)
+
+static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
+{
+    uint32_t falling_edge = 0, rising_edge = 0;
+    uint32_t int_trigger = extract32(regs->int_sens_0, gpio, 1)
+                           | extract32(regs->int_sens_1, gpio, 1) << 1
+                           | extract32(regs->int_sens_2, gpio, 1) << 2;
+    uint32_t gpio_curr_high = extract32(regs->data_value, gpio, 1);
+    uint32_t gpio_int_enabled = extract32(regs->int_enable, gpio, 1);
+
+    if (!gpio_int_enabled) {
+        return 0;
+    }
+
+    /* Detect edges */
+    if (gpio_curr_high && !gpio_prev_high) {
+        rising_edge = 1;
+    } else if (!gpio_curr_high && gpio_prev_high) {
+        falling_edge = 1;
+    }
+
+    if (((int_trigger == ASPEED_FALLING_EDGE)  && falling_edge)  ||
+        ((int_trigger == ASPEED_RISING_EDGE)  && rising_edge)    ||
+        ((int_trigger == ASPEED_LEVEL_LOW)  && !gpio_curr_high)  ||
+        ((int_trigger == ASPEED_LEVEL_HIGH)  && gpio_curr_high)  ||
+        ((int_trigger >= ASPEED_DUAL_EDGE)  && (rising_edge || falling_edge)))
+    {
+        regs->int_status = deposit32(regs->int_status, gpio, 1, 1);
+        return 1;
+    }
+    return 0;
+}
+
+#define nested_struct_index(ta, pa, m, tb, pb) \
+        (pb - ((tb *)(((char *)pa) + offsetof(ta, m))))
+
+static ptrdiff_t aspeed_gpio_set_idx(AspeedGPIOState *s, GPIOSets *regs)
+{
+    return nested_struct_index(AspeedGPIOState, s, sets, GPIOSets, regs);
+}
+
+static void aspeed_gpio_update(AspeedGPIOState *s, GPIOSets *regs,
+                               uint32_t value)
+{
+    uint32_t input_mask = regs->input_mask;
+    uint32_t direction = regs->direction;
+    uint32_t old = regs->data_value;
+    uint32_t new = value;
+    uint32_t diff;
+    int gpio;
+
+    diff = old ^ new;
+    if (diff) {
+        for (gpio = 0; gpio < GPIOS_PER_REG; gpio++) {
+            uint32_t mask = 1 << gpio;
+
+            /* If the gpio needs to be updated... */
+            if (!(diff & mask)) {
+                continue;
+            }
+
+            /* ...and we're output or not input-masked... */
+            if (!(direction & mask) && (input_mask & mask)) {
+                continue;
+            }
+
+            /* ...then update the state. */
+            if (mask & new) {
+                regs->data_value |= mask;
+            } else {
+                regs->data_value &= ~mask;
+            }
+
+            /* If the gpio is set to output... */
+            if (direction & mask) {
+                /* ...trigger the line-state IRQ */
+                ptrdiff_t set = aspeed_gpio_set_idx(s, regs);
+                size_t offset = set * GPIOS_PER_SET + gpio;
+                qemu_set_irq(s->gpios[offset], !!(new & mask));
+            } else {
+                /* ...otherwise if we meet the line's current IRQ policy... */
+                if (aspeed_evaluate_irq(regs, old & mask, gpio)) {
+                    /* ...trigger the VIC IRQ */
+                    s->pending++;
+                }
+            }
+        }
+    }
+    qemu_set_irq(s->irq, !!(s->pending));
+}
+
+static uint32_t aspeed_adjust_pin(AspeedGPIOState *s, uint32_t pin)
+{
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    /*
+     * The 2500 has a 4 pin gap in group AB and the 2400 has a 4 pin
+     * gap in group Y (and only four pins in AB but this is the last group so
+     * it doesn't matter).
+     */
+    if (agc->gap && pin >= agc->gap) {
+        pin += GPIO_PIN_GAP_SIZE;
+    }
+
+    return pin;
+}
+
+static bool aspeed_gpio_get_pin_level(AspeedGPIOState *s, uint32_t set_idx,
+                                      uint32_t pin)
+{
+    uint32_t reg_val;
+    uint32_t pin_mask = 1 << pin;
+
+    reg_val = s->sets[set_idx].data_value;
+
+    return !!(reg_val & pin_mask);
+}
+
+static void aspeed_gpio_set_pin_level(AspeedGPIOState *s, uint32_t set_idx,
+                                      uint32_t pin, bool level)
+{
+    uint32_t value = s->sets[set_idx].data_value;
+    uint32_t pin_mask = 1 << pin;
+
+    if (level) {
+        value |= pin_mask;
+    } else {
+        value &= !pin_mask;
+    }
+
+    aspeed_gpio_update(s, &s->sets[set_idx], value);
+}
+
+/*
+ *  | src_1 | src_2 |  source     |
+ *  |-----------------------------|
+ *  |   0   |   0   |  ARM        |
+ *  |   0   |   1   |  LPC        |
+ *  |   1   |   0   |  Coprocessor|
+ *  |   1   |   1   |  Reserved   |
+ *
+ *  Once the source of a set is programmed, corresponding bits in the
+ *  data_value, direction, interrupt [enable, sens[0-2]], reset_tol and
+ *  debounce registers can only be written by the source.
+ *
+ *  Source is ARM by default
+ *  only bits 24, 16, 8, and 0 can be set
+ *
+ *  we don't currently have a model for the LPC or Coprocessor
+ */
+static uint32_t update_value_control_source(GPIOSets *regs, uint32_t old_value,
+                                            uint32_t value)
+{
+    int i;
+    int cmd_source;
+
+    /* assume the source is always ARM for now */
+    int source = ASPEED_SOURCE_ARM;
+
+    uint32_t new_value = 0;
+
+    /* for each group in set */
+    for (i = 0; i < GPIOS_PER_REG; i += GPIOS_PER_GROUP) {
+        cmd_source = extract32(regs->cmd_source_0, i, 1)
+                | (extract32(regs->cmd_source_1, i, 1) << 1);
+
+        if (source == cmd_source) {
+            new_value |= (0xff << i) & value;
+        } else {
+            new_value |= (0xff << i) & old_value;
+        }
+    }
+    return new_value;
+}
+
+static const AspeedGPIOReg aspeed_3_6v_gpios[GPIO_3_6V_REG_ARRAY_SIZE] = {
+    /* Set ABCD */
+    [GPIO_ABCD_DATA_VALUE] =     { 0, gpio_reg_data_value },
+    [GPIO_ABCD_DIRECTION] =      { 0, gpio_reg_direction },
+    [GPIO_ABCD_INT_ENABLE] =     { 0, gpio_reg_int_enable },
+    [GPIO_ABCD_INT_SENS_0] =     { 0, gpio_reg_int_sens_0 },
+    [GPIO_ABCD_INT_SENS_1] =     { 0, gpio_reg_int_sens_1 },
+    [GPIO_ABCD_INT_SENS_2] =     { 0, gpio_reg_int_sens_2 },
+    [GPIO_ABCD_INT_STATUS] =     { 0, gpio_reg_int_status },
+    [GPIO_ABCD_RESET_TOLERANT] = { 0, gpio_reg_reset_tolerant },
+    [GPIO_ABCD_DEBOUNCE_1] =     { 0, gpio_reg_debounce_1 },
+    [GPIO_ABCD_DEBOUNCE_2] =     { 0, gpio_reg_debounce_2 },
+    [GPIO_ABCD_COMMAND_SRC_0] =  { 0, gpio_reg_cmd_source_0 },
+    [GPIO_ABCD_COMMAND_SRC_1] =  { 0, gpio_reg_cmd_source_1 },
+    [GPIO_ABCD_DATA_READ] =      { 0, gpio_reg_data_read },
+    [GPIO_ABCD_INPUT_MASK] =     { 0, gpio_reg_input_mask },
+    /* Set EFGH */
+    [GPIO_EFGH_DATA_VALUE] =     { 1, gpio_reg_data_value },
+    [GPIO_EFGH_DIRECTION] =      { 1, gpio_reg_direction },
+    [GPIO_EFGH_INT_ENABLE] =     { 1, gpio_reg_int_enable },
+    [GPIO_EFGH_INT_SENS_0] =     { 1, gpio_reg_int_sens_0 },
+    [GPIO_EFGH_INT_SENS_1] =     { 1, gpio_reg_int_sens_1 },
+    [GPIO_EFGH_INT_SENS_2] =     { 1, gpio_reg_int_sens_2 },
+    [GPIO_EFGH_INT_STATUS] =     { 1, gpio_reg_int_status },
+    [GPIO_EFGH_RESET_TOLERANT] = { 1, gpio_reg_reset_tolerant },
+    [GPIO_EFGH_DEBOUNCE_1] =     { 1, gpio_reg_debounce_1 },
+    [GPIO_EFGH_DEBOUNCE_2] =     { 1, gpio_reg_debounce_2 },
+    [GPIO_EFGH_COMMAND_SRC_0] =  { 1, gpio_reg_cmd_source_0 },
+    [GPIO_EFGH_COMMAND_SRC_1] =  { 1, gpio_reg_cmd_source_1 },
+    [GPIO_EFGH_DATA_READ] =      { 1, gpio_reg_data_read },
+    [GPIO_EFGH_INPUT_MASK] =     { 1, gpio_reg_input_mask },
+    /* Set IJKL */
+    [GPIO_IJKL_DATA_VALUE] =     { 2, gpio_reg_data_value },
+    [GPIO_IJKL_DIRECTION] =      { 2, gpio_reg_direction },
+    [GPIO_IJKL_INT_ENABLE] =     { 2, gpio_reg_int_enable },
+    [GPIO_IJKL_INT_SENS_0] =     { 2, gpio_reg_int_sens_0 },
+    [GPIO_IJKL_INT_SENS_1] =     { 2, gpio_reg_int_sens_1 },
+    [GPIO_IJKL_INT_SENS_2] =     { 2, gpio_reg_int_sens_2 },
+    [GPIO_IJKL_INT_STATUS] =     { 2, gpio_reg_int_status },
+    [GPIO_IJKL_RESET_TOLERANT] = { 2, gpio_reg_reset_tolerant },
+    [GPIO_IJKL_DEBOUNCE_1] =     { 2, gpio_reg_debounce_1 },
+    [GPIO_IJKL_DEBOUNCE_2] =     { 2, gpio_reg_debounce_2 },
+    [GPIO_IJKL_COMMAND_SRC_0] =  { 2, gpio_reg_cmd_source_0 },
+    [GPIO_IJKL_COMMAND_SRC_1] =  { 2, gpio_reg_cmd_source_1 },
+    [GPIO_IJKL_DATA_READ] =      { 2, gpio_reg_data_read },
+    [GPIO_IJKL_INPUT_MASK] =     { 2, gpio_reg_input_mask },
+    /* Set MNOP */
+    [GPIO_MNOP_DATA_VALUE] =     { 3, gpio_reg_data_value },
+    [GPIO_MNOP_DIRECTION] =      { 3, gpio_reg_direction },
+    [GPIO_MNOP_INT_ENABLE] =     { 3, gpio_reg_int_enable },
+    [GPIO_MNOP_INT_SENS_0] =     { 3, gpio_reg_int_sens_0 },
+    [GPIO_MNOP_INT_SENS_1] =     { 3, gpio_reg_int_sens_1 },
+    [GPIO_MNOP_INT_SENS_2] =     { 3, gpio_reg_int_sens_2 },
+    [GPIO_MNOP_INT_STATUS] =     { 3, gpio_reg_int_status },
+    [GPIO_MNOP_RESET_TOLERANT] = { 3, gpio_reg_reset_tolerant },
+    [GPIO_MNOP_DEBOUNCE_1] =     { 3, gpio_reg_debounce_1 },
+    [GPIO_MNOP_DEBOUNCE_2] =     { 3, gpio_reg_debounce_2 },
+    [GPIO_MNOP_COMMAND_SRC_0] =  { 3, gpio_reg_cmd_source_0 },
+    [GPIO_MNOP_COMMAND_SRC_1] =  { 3, gpio_reg_cmd_source_1 },
+    [GPIO_MNOP_DATA_READ] =      { 3, gpio_reg_data_read },
+    [GPIO_MNOP_INPUT_MASK] =     { 3, gpio_reg_input_mask },
+    /* Set QRST */
+    [GPIO_QRST_DATA_VALUE] =     { 4, gpio_reg_data_value },
+    [GPIO_QRST_DIRECTION] =      { 4, gpio_reg_direction },
+    [GPIO_QRST_INT_ENABLE] =     { 4, gpio_reg_int_enable },
+    [GPIO_QRST_INT_SENS_0] =     { 4, gpio_reg_int_sens_0 },
+    [GPIO_QRST_INT_SENS_1] =     { 4, gpio_reg_int_sens_1 },
+    [GPIO_QRST_INT_SENS_2] =     { 4, gpio_reg_int_sens_2 },
+    [GPIO_QRST_INT_STATUS] =     { 4, gpio_reg_int_status },
+    [GPIO_QRST_RESET_TOLERANT] = { 4, gpio_reg_reset_tolerant },
+    [GPIO_QRST_DEBOUNCE_1] =     { 4, gpio_reg_debounce_1 },
+    [GPIO_QRST_DEBOUNCE_2] =     { 4, gpio_reg_debounce_2 },
+    [GPIO_QRST_COMMAND_SRC_0] =  { 4, gpio_reg_cmd_source_0 },
+    [GPIO_QRST_COMMAND_SRC_1] =  { 4, gpio_reg_cmd_source_1 },
+    [GPIO_QRST_DATA_READ] =      { 4, gpio_reg_data_read },
+    [GPIO_QRST_INPUT_MASK] =     { 4, gpio_reg_input_mask },
+    /* Set UVWX */
+    [GPIO_UVWX_DATA_VALUE] =     { 5, gpio_reg_data_value },
+    [GPIO_UVWX_DIRECTION] =      { 5, gpio_reg_direction },
+    [GPIO_UVWX_INT_ENABLE] =     { 5, gpio_reg_int_enable },
+    [GPIO_UVWX_INT_SENS_0] =     { 5, gpio_reg_int_sens_0 },
+    [GPIO_UVWX_INT_SENS_1] =     { 5, gpio_reg_int_sens_1 },
+    [GPIO_UVWX_INT_SENS_2] =     { 5, gpio_reg_int_sens_2 },
+    [GPIO_UVWX_INT_STATUS] =     { 5, gpio_reg_int_status },
+    [GPIO_UVWX_RESET_TOLERANT] = { 5, gpio_reg_reset_tolerant },
+    [GPIO_UVWX_DEBOUNCE_1] =     { 5, gpio_reg_debounce_1 },
+    [GPIO_UVWX_DEBOUNCE_2] =     { 5, gpio_reg_debounce_2 },
+    [GPIO_UVWX_COMMAND_SRC_0] =  { 5, gpio_reg_cmd_source_0 },
+    [GPIO_UVWX_COMMAND_SRC_1] =  { 5, gpio_reg_cmd_source_1 },
+    [GPIO_UVWX_DATA_READ] =      { 5, gpio_reg_data_read },
+    [GPIO_UVWX_INPUT_MASK] =     { 5, gpio_reg_input_mask },
+    /* Set YZAAAB */
+    [GPIO_YZAAAB_DATA_VALUE] =     { 6, gpio_reg_data_value },
+    [GPIO_YZAAAB_DIRECTION] =      { 6, gpio_reg_direction },
+    [GPIO_YZAAAB_INT_ENABLE] =     { 6, gpio_reg_int_enable },
+    [GPIO_YZAAAB_INT_SENS_0] =     { 6, gpio_reg_int_sens_0 },
+    [GPIO_YZAAAB_INT_SENS_1] =     { 6, gpio_reg_int_sens_1 },
+    [GPIO_YZAAAB_INT_SENS_2] =     { 6, gpio_reg_int_sens_2 },
+    [GPIO_YZAAAB_INT_STATUS] =     { 6, gpio_reg_int_status },
+    [GPIO_YZAAAB_RESET_TOLERANT] = { 6, gpio_reg_reset_tolerant },
+    [GPIO_YZAAAB_DEBOUNCE_1] =     { 6, gpio_reg_debounce_1 },
+    [GPIO_YZAAAB_DEBOUNCE_2] =     { 6, gpio_reg_debounce_2 },
+    [GPIO_YZAAAB_COMMAND_SRC_0] =  { 6, gpio_reg_cmd_source_0 },
+    [GPIO_YZAAAB_COMMAND_SRC_1] =  { 6, gpio_reg_cmd_source_1 },
+    [GPIO_YZAAAB_DATA_READ] =      { 6, gpio_reg_data_read },
+    [GPIO_YZAAAB_INPUT_MASK] =     { 6, gpio_reg_input_mask },
+    /* Set AC  (ast2500 only) */
+    [GPIO_AC_DATA_VALUE] =         { 7, gpio_reg_data_value },
+    [GPIO_AC_DIRECTION] =          { 7, gpio_reg_direction },
+    [GPIO_AC_INT_ENABLE] =         { 7, gpio_reg_int_enable },
+    [GPIO_AC_INT_SENS_0] =         { 7, gpio_reg_int_sens_0 },
+    [GPIO_AC_INT_SENS_1] =         { 7, gpio_reg_int_sens_1 },
+    [GPIO_AC_INT_SENS_2] =         { 7, gpio_reg_int_sens_2 },
+    [GPIO_AC_INT_STATUS] =         { 7, gpio_reg_int_status },
+    [GPIO_AC_RESET_TOLERANT] =     { 7, gpio_reg_reset_tolerant },
+    [GPIO_AC_DEBOUNCE_1] =         { 7, gpio_reg_debounce_1 },
+    [GPIO_AC_DEBOUNCE_2] =         { 7, gpio_reg_debounce_2 },
+    [GPIO_AC_COMMAND_SRC_0] =      { 7, gpio_reg_cmd_source_0 },
+    [GPIO_AC_COMMAND_SRC_1] =      { 7, gpio_reg_cmd_source_1 },
+    [GPIO_AC_DATA_READ] =          { 7, gpio_reg_data_read },
+    [GPIO_AC_INPUT_MASK] =         { 7, gpio_reg_input_mask },
+};
+
+static uint64_t aspeed_gpio_read(void *opaque, hwaddr offset, uint32_t size)
+{
+    AspeedGPIOState *s = ASPEED_GPIO(opaque);
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    uint64_t idx = -1;
+    const AspeedGPIOReg *reg;
+    GPIOSets *set;
+
+    idx = offset >> 2;
+    if (idx >= GPIO_DEBOUNCE_TIME_1 && idx <= GPIO_DEBOUNCE_TIME_3) {
+        idx -= GPIO_DEBOUNCE_TIME_1;
+        return (uint64_t) s->debounce_regs[idx];
+    }
+
+    reg = &agc->reg_table[idx];
+    if (reg->set_idx >= agc->nr_gpio_sets) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: no getter for offset 0x%"
+                      HWADDR_PRIx"\n", __func__, offset);
+        return 0;
+    }
+
+    set = &s->sets[reg->set_idx];
+    switch (reg->type) {
+    case gpio_reg_data_value:
+        return set->data_value;
+    case gpio_reg_direction:
+        return set->direction;
+    case gpio_reg_int_enable:
+        return set->int_enable;
+    case gpio_reg_int_sens_0:
+        return set->int_sens_0;
+    case gpio_reg_int_sens_1:
+        return set->int_sens_1;
+    case gpio_reg_int_sens_2:
+        return set->int_sens_2;
+    case gpio_reg_int_status:
+        return set->int_status;
+    case gpio_reg_reset_tolerant:
+        return set->reset_tol;
+    case gpio_reg_debounce_1:
+        return set->debounce_1;
+    case gpio_reg_debounce_2:
+        return set->debounce_2;
+    case gpio_reg_cmd_source_0:
+        return set->cmd_source_0;
+    case gpio_reg_cmd_source_1:
+        return set->cmd_source_1;
+    case gpio_reg_data_read:
+        return set->data_read;
+    case gpio_reg_input_mask:
+        return set->input_mask;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: no getter for offset 0x%"
+                      HWADDR_PRIx"\n", __func__, offset);
+        return 0;
+    };
+}
+
+static void aspeed_gpio_write(void *opaque, hwaddr offset, uint64_t data,
+                              uint32_t size)
+{
+    AspeedGPIOState *s = ASPEED_GPIO(opaque);
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    const GPIOSetProperties *props;
+    uint64_t idx = -1;
+    const AspeedGPIOReg *reg;
+    GPIOSets *set;
+    uint32_t cleared;
+
+    idx = offset >> 2;
+    if (idx >= GPIO_DEBOUNCE_TIME_1 && idx <= GPIO_DEBOUNCE_TIME_3) {
+        idx -= GPIO_DEBOUNCE_TIME_1;
+        s->debounce_regs[idx] = (uint32_t) data;
+        return;
+    }
+
+    reg = &agc->reg_table[idx];
+    if (reg->set_idx >= agc->nr_gpio_sets) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: no setter for offset 0x%"
+                      HWADDR_PRIx"\n", __func__, offset);
+        return;
+    }
+
+    set = &s->sets[reg->set_idx];
+    props = &agc->props[reg->set_idx];
+
+    switch (reg->type) {
+    case gpio_reg_data_value:
+        data &= props->output;
+        data = update_value_control_source(set, set->data_value, data);
+        set->data_read = data;
+        aspeed_gpio_update(s, set, data);
+        return;
+    case gpio_reg_direction:
+        /*
+         *   where data is the value attempted to be written to the pin:
+         *    pin type      | input mask | output mask | expected value
+         *    ------------------------------------------------------------
+         *   bidirectional  |   1       |   1        |  data
+         *   input only     |   1       |   0        |   0
+         *   output only    |   0       |   1        |   1
+         *   no pin / gap   |   0       |   0        |   0
+         *
+         *  which is captured by:
+         *  data = ( data | ~input) & output;
+         */
+        data = (data | ~props->input) & props->output;
+        set->direction = update_value_control_source(set, set->direction, data);
+        break;
+    case gpio_reg_int_enable:
+        set->int_enable = update_value_control_source(set, set->int_enable,
+                                                      data);
+        break;
+    case gpio_reg_int_sens_0:
+        set->int_sens_0 = update_value_control_source(set, set->int_sens_0,
+                                                      data);
+        break;
+    case gpio_reg_int_sens_1:
+        set->int_sens_1 = update_value_control_source(set, set->int_sens_1,
+                                                      data);
+        break;
+    case gpio_reg_int_sens_2:
+        set->int_sens_2 = update_value_control_source(set, set->int_sens_2,
+                                                      data);
+        break;
+    case gpio_reg_int_status:
+        cleared = ctpop32(data & set->int_status);
+        if (s->pending && cleared) {
+            assert(s->pending >= cleared);
+            s->pending -= cleared;
+        }
+        set->int_status &= ~data;
+        break;
+    case gpio_reg_reset_tolerant:
+        set->reset_tol = update_value_control_source(set, set->reset_tol,
+                                                     data);
+        return;
+    case gpio_reg_debounce_1:
+        set->debounce_1 = update_value_control_source(set, set->debounce_1,
+                                                      data);
+        return;
+    case gpio_reg_debounce_2:
+        set->debounce_2 = update_value_control_source(set, set->debounce_2,
+                                                      data);
+        return;
+    case gpio_reg_cmd_source_0:
+        set->cmd_source_0 = data & ASPEED_CMD_SRC_MASK;
+        return;
+    case gpio_reg_cmd_source_1:
+        set->cmd_source_1 = data & ASPEED_CMD_SRC_MASK;
+        return;
+    case gpio_reg_data_read:
+        /* Read only register */
+        return;
+    case gpio_reg_input_mask:
+        /*
+         * feeds into interrupt generation
+         * 0: read from data value reg will be updated
+         * 1: read from data value reg will not be updated
+         */
+         set->input_mask = data & props->input;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: no setter for offset 0x%"
+                      HWADDR_PRIx"\n", __func__, offset);
+        return;
+    }
+    aspeed_gpio_update(s, set, set->data_value);
+    return;
+}
+
+static int get_set_idx(AspeedGPIOState *s, const char *group, int *group_idx)
+{
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    int set_idx, g_idx = *group_idx;
+
+    for (set_idx = 0; set_idx < agc->nr_gpio_sets; set_idx++) {
+        const GPIOSetProperties *set_props = &agc->props[set_idx];
+        for (g_idx = 0; g_idx < ASPEED_GROUPS_PER_SET; g_idx++) {
+            if (!strncmp(group, set_props->group_label[g_idx], strlen(group))) {
+                *group_idx = g_idx;
+                return set_idx;
+            }
+        }
+    }
+    return -1;
+}
+
+static void aspeed_gpio_get_pin(Object *obj, Visitor *v, const char *name,
+                                void *opaque, Error **errp)
+{
+    int pin = 0xfff;
+    bool level = true;
+    char group[3];
+    AspeedGPIOState *s = ASPEED_GPIO(obj);
+    int set_idx, group_idx = 0;
+
+    if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
+        error_setg(errp, "%s: error reading %s", __func__, name);
+        return;
+    }
+    set_idx = get_set_idx(s, group, &group_idx);
+    if (set_idx == -1) {
+        error_setg(errp, "%s: invalid group %s", __func__, group);
+        return;
+    }
+    pin =  pin + group_idx * GPIOS_PER_GROUP;
+    level = aspeed_gpio_get_pin_level(s, set_idx, pin);
+    visit_type_bool(v, name, &level, errp);
+}
+
+static void aspeed_gpio_set_pin(Object *obj, Visitor *v, const char *name,
+                               void *opaque, Error **errp)
+{
+    Error *local_err = NULL;
+    bool level;
+    int pin = 0xfff;
+    char group[3];
+    AspeedGPIOState *s = ASPEED_GPIO(obj);
+    int set_idx, group_idx = 0;
+
+    visit_type_bool(v, name, &level, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        return;
+    }
+    if (sscanf(name, "gpio%2[A-Z]%1d", group, &pin) != 2) {
+        error_setg(errp, "%s: error reading %s", __func__, name);
+        return;
+    }
+    set_idx = get_set_idx(s, group, &group_idx);
+    if (set_idx == -1) {
+        error_setg(errp, "%s: invalid group %s", __func__, group);
+        return;
+    }
+    pin =  pin + group_idx * GPIOS_PER_GROUP;
+    aspeed_gpio_set_pin_level(s, set_idx, pin, level);
+}
+
+/****************** Setup functions ******************/
+static const GPIOSetProperties ast2400_set_props[] = {
+    [0] = {0xffffffff,  0xffffffff,  {"A", "B", "C", "D"} },
+    [1] = {0xffffffff,  0xffffffff,  {"E", "F", "G", "H"} },
+    [2] = {0xffffffff,  0xffffffff,  {"I", "J", "K", "L"} },
+    [3] = {0xffffffff,  0xffffffff,  {"M", "N", "O", "P"} },
+    [4] = {0xffffffff,  0xffffffff,  {"Q", "R", "S", "T"} },
+    [5] = {0xffffffff,  0x0000ffff,  {"U", "V", "W", "X"} },
+    [6] = {0x0000000f,  0x0fffff0f,  {"Y", "Z", "AA", "AB"} },
+};
+
+static const GPIOSetProperties ast2500_set_props[] = {
+    [0] = {0xffffffff,  0xffffffff,  {"A", "B", "C", "D"} },
+    [1] = {0xffffffff,  0xffffffff,  {"E", "F", "G", "H"} },
+    [2] = {0xffffffff,  0xffffffff,  {"I", "J", "K", "L"} },
+    [3] = {0xffffffff,  0xffffffff,  {"M", "N", "O", "P"} },
+    [4] = {0xffffffff,  0xffffffff,  {"Q", "R", "S", "T"} },
+    [5] = {0xffffffff,  0x0000ffff,  {"U", "V", "W", "X"} },
+    [6] = {0xffffff0f,  0x0fffff0f,  {"Y", "Z", "AA", "AB"} },
+    [7] = {0x000000ff,  0x000000ff,  {"AC"} },
+};
+
+static const MemoryRegionOps aspeed_gpio_ops = {
+    .read       = aspeed_gpio_read,
+    .write      = aspeed_gpio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+};
+
+static void aspeed_gpio_reset(DeviceState *dev)
+{
+    AspeedGPIOState *s = ASPEED_GPIO(dev);
+
+    /* TODO: respect the reset tolerance registers */
+    memset(s->sets, 0, sizeof(s->sets));
+}
+
+static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
+{
+    AspeedGPIOState *s = ASPEED_GPIO(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    int pin;
+
+    /* Interrupt parent line */
+    sysbus_init_irq(sbd, &s->irq);
+
+    /* Individual GPIOs */
+    for (pin = 0; pin < agc->nr_gpio_pins; pin++) {
+        sysbus_init_irq(sbd, &s->gpios[pin]);
+    }
+
+    memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
+            TYPE_ASPEED_GPIO, GPIO_3_6V_MEM_SIZE);
+
+    sysbus_init_mmio(sbd, &s->iomem);
+}
+
+static void aspeed_gpio_init(Object *obj)
+{
+    AspeedGPIOState *s = ASPEED_GPIO(obj);
+    AspeedGPIOClass *agc = ASPEED_GPIO_GET_CLASS(s);
+    int pin;
+
+    for (pin = 0; pin < agc->nr_gpio_pins; pin++) {
+        char *name;
+        int set_idx = pin / GPIOS_PER_SET;
+        int pin_idx = aspeed_adjust_pin(s, pin) - (set_idx * GPIOS_PER_SET);
+        int group_idx = pin_idx >> GPIO_GROUP_SHIFT;
+        const GPIOSetProperties *props = &agc->props[set_idx];
+
+        name = g_strdup_printf("gpio%s%d", props->group_label[group_idx],
+                               pin_idx % GPIOS_PER_GROUP);
+        object_property_add(obj, name, "bool", aspeed_gpio_get_pin,
+                            aspeed_gpio_set_pin, NULL, NULL, NULL);
+    }
+}
+
+static const VMStateDescription vmstate_gpio_regs = {
+    .name = TYPE_ASPEED_GPIO"/regs",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(data_value,   GPIOSets),
+        VMSTATE_UINT32(data_read,    GPIOSets),
+        VMSTATE_UINT32(direction,    GPIOSets),
+        VMSTATE_UINT32(int_enable,   GPIOSets),
+        VMSTATE_UINT32(int_sens_0,   GPIOSets),
+        VMSTATE_UINT32(int_sens_1,   GPIOSets),
+        VMSTATE_UINT32(int_sens_2,   GPIOSets),
+        VMSTATE_UINT32(int_status,   GPIOSets),
+        VMSTATE_UINT32(reset_tol,    GPIOSets),
+        VMSTATE_UINT32(cmd_source_0, GPIOSets),
+        VMSTATE_UINT32(cmd_source_1, GPIOSets),
+        VMSTATE_UINT32(debounce_1,   GPIOSets),
+        VMSTATE_UINT32(debounce_2,   GPIOSets),
+        VMSTATE_UINT32(input_mask,   GPIOSets),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static const VMStateDescription vmstate_aspeed_gpio = {
+    .name = TYPE_ASPEED_GPIO,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_STRUCT_ARRAY(sets, AspeedGPIOState, ASPEED_GPIO_MAX_NR_SETS,
+                             1, vmstate_gpio_regs, GPIOSets),
+        VMSTATE_UINT32_ARRAY(debounce_regs, AspeedGPIOState,
+                             ASPEED_GPIO_NR_DEBOUNCE_REGS),
+        VMSTATE_END_OF_LIST(),
+   }
+};
+
+static void aspeed_gpio_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = aspeed_gpio_realize;
+    dc->reset = aspeed_gpio_reset;
+    dc->desc = "Aspeed GPIO Controller";
+    dc->vmsd = &vmstate_aspeed_gpio;
+}
+
+static void aspeed_gpio_ast2400_class_init(ObjectClass *klass, void *data)
+{
+    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
+
+    agc->props = ast2400_set_props;
+    agc->nr_gpio_pins = 216;
+    agc->nr_gpio_sets = 7;
+    agc->gap = 196;
+    agc->reg_table = aspeed_3_6v_gpios;
+}
+
+static void aspeed_gpio_2500_class_init(ObjectClass *klass, void *data)
+{
+    AspeedGPIOClass *agc = ASPEED_GPIO_CLASS(klass);
+
+    agc->props = ast2500_set_props;
+    agc->nr_gpio_pins = 228;
+    agc->nr_gpio_sets = 8;
+    agc->gap = 220;
+    agc->reg_table = aspeed_3_6v_gpios;
+}
+
+static const TypeInfo aspeed_gpio_info = {
+    .name           = TYPE_ASPEED_GPIO,
+    .parent         = TYPE_SYS_BUS_DEVICE,
+    .instance_size  = sizeof(AspeedGPIOState),
+    .class_size     = sizeof(AspeedGPIOClass),
+    .class_init     = aspeed_gpio_class_init,
+    .abstract       = true,
+};
+
+static const TypeInfo aspeed_gpio_ast2400_info = {
+    .name           = TYPE_ASPEED_GPIO "-ast2400",
+    .parent         = TYPE_ASPEED_GPIO,
+    .class_init     = aspeed_gpio_ast2400_class_init,
+    .instance_init  = aspeed_gpio_init,
+};
+
+static const TypeInfo aspeed_gpio_ast2500_info = {
+    .name           = TYPE_ASPEED_GPIO "-ast2500",
+    .parent         = TYPE_ASPEED_GPIO,
+    .class_init     = aspeed_gpio_2500_class_init,
+    .instance_init  = aspeed_gpio_init,
+};
+
+static void aspeed_gpio_register_types(void)
+{
+    type_register_static(&aspeed_gpio_info);
+    type_register_static(&aspeed_gpio_ast2400_info);
+    type_register_static(&aspeed_gpio_ast2500_info);
+}
+
+type_init(aspeed_gpio_register_types);
-- 
2.20.1

From: Rashmica Gupta <rashmica.g@gmail.com>

Signed-off-by: Rashmica Gupta <rashmica.g@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-3-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |  3 +++
 hw/arm/aspeed_soc.c         | 17 +++++++++++++++++
 2 files changed, 20 insertions(+)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/watchdog/wdt_aspeed.h"
 #include "hw/net/ftgmac100.h"
 #include "target/arm/cpu.h"
+#include "hw/gpio/aspeed_gpio.h"
 
 #define ASPEED_SPIS_NUM  2
 #define ASPEED_WDTS_NUM  3
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
     AspeedSDMCState sdmc;
     AspeedWDTState wdt[ASPEED_WDTS_NUM];
     FTGMAC100State ftgmac100[ASPEED_MACS_NUM];
+    AspeedGPIOState gpio;
 } AspeedSoCState;
 
 #define TYPE_ASPEED_SOC "aspeed-soc"
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
     int spis_num;
     const char *fmc_typename;
     const char **spi_typename;
+    const char *gpio_typename;
     int wdts_num;
     const int *irqmap;
     const hwaddr *memmap;
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spis_num     = 1,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .gpio_typename = "aspeed.gpio-ast2400",
         .wdts_num     = 2,
         .irqmap       = aspeed_soc_ast2400_irqmap,
         .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spis_num     = 1,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .gpio_typename = "aspeed.gpio-ast2400",
         .wdts_num     = 2,
         .irqmap       = aspeed_soc_ast2400_irqmap,
         .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spis_num     = 1,
         .fmc_typename = "aspeed.smc.fmc",
         .spi_typename = aspeed_soc_ast2400_typenames,
+        .gpio_typename = "aspeed.gpio-ast2400",
         .wdts_num     = 2,
         .irqmap       = aspeed_soc_ast2400_irqmap,
         .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .spis_num     = 2,
         .fmc_typename = "aspeed.smc.ast2500-fmc",
         .spi_typename = aspeed_soc_ast2500_typenames,
+        .gpio_typename = "aspeed.gpio-ast2500",
         .wdts_num     = 3,
         .irqmap       = aspeed_soc_ast2500_irqmap,
         .memmap       = aspeed_soc_ast2500_memmap,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
 
     sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
                           TYPE_ASPEED_XDMA);
+
+    sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
+                          sc->info->gpio_typename);
 }
 
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
                     sc->info->memmap[ASPEED_XDMA]);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->xdma), 0,
                        aspeed_soc_get_irq(s, ASPEED_XDMA));
+
+    /* GPIO */
+    object_property_set_bool(OBJECT(&s->gpio), true, "realized", &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->gpio), 0, sc->info->memmap[ASPEED_GPIO]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->gpio), 0,
+                       aspeed_soc_get_irq(s, ASPEED_GPIO));
 }
 static Property aspeed_soc_properties[] = {
     DEFINE_PROP_UINT32("num-cpus", AspeedSoCState, num_cpus, 0),
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

There are no QEMU Aspeed machines using the SoCs "ast2400-a0" or
"ast2400".

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-4-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed_soc.c | 26 --------------------------
 1 file changed, 26 deletions(-)

diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const char *aspeed_soc_ast2500_typenames[] = {
 
 static const AspeedSoCInfo aspeed_socs[] = {
     {
-        .name         = "ast2400-a0",
-        .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
-        .silicon_rev  = AST2400_A0_SILICON_REV,
-        .sram_size    = 0x8000,
-        .spis_num     = 1,
-        .fmc_typename = "aspeed.smc.fmc",
-        .spi_typename = aspeed_soc_ast2400_typenames,
-        .gpio_typename = "aspeed.gpio-ast2400",
-        .wdts_num     = 2,
-        .irqmap       = aspeed_soc_ast2400_irqmap,
-        .memmap       = aspeed_soc_ast2400_memmap,
-        .num_cpus     = 1,
-    }, {
         .name         = "ast2400-a1",
         .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
         .silicon_rev  = AST2400_A1_SILICON_REV,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .irqmap       = aspeed_soc_ast2400_irqmap,
         .memmap       = aspeed_soc_ast2400_memmap,
         .num_cpus     = 1,
-    }, {
-        .name         = "ast2400",
-        .cpu_type     = ARM_CPU_TYPE_NAME("arm926"),
-        .silicon_rev  = AST2400_A0_SILICON_REV,
-        .sram_size    = 0x8000,
-        .spis_num     = 1,
-        .fmc_typename = "aspeed.smc.fmc",
-        .spi_typename = aspeed_soc_ast2400_typenames,
-        .gpio_typename = "aspeed.gpio-ast2400",
-        .wdts_num     = 2,
-        .irqmap       = aspeed_soc_ast2400_irqmap,
-        .memmap       = aspeed_soc_ast2400_memmap,
-        .num_cpus     = 1,
     }, {
         .name         = "ast2500-a1",
         .cpu_type     = ARM_CPU_TYPE_NAME("arm1176"),
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

Improve the naming of the different controller models to ease their
generation when initializing the SoC. The rename of the SMC types is
breaking migration compatibility.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-5-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/aspeed_soc.h |  3 ---
 hw/arm/aspeed_soc.c         | 25 ++++++++++++-------------
 hw/ssi/aspeed_smc.c         | 12 ++++++------
 3 files changed, 18 insertions(+), 22 deletions(-)

diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCInfo {
     uint32_t silicon_rev;
     uint64_t sram_size;
     int spis_num;
-    const char *fmc_typename;
-    const char **spi_typename;
-    const char *gpio_typename;
     int wdts_num;
     const int *irqmap;
     const hwaddr *memmap;
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static const int aspeed_soc_ast2400_irqmap[] = {
 
 #define aspeed_soc_ast2500_irqmap aspeed_soc_ast2400_irqmap
 
-static const char *aspeed_soc_ast2400_typenames[] = { "aspeed.smc.spi" };
-static const char *aspeed_soc_ast2500_typenames[] = {
-    "aspeed.smc.ast2500-spi1", "aspeed.smc.ast2500-spi2" };
-
 static const AspeedSoCInfo aspeed_socs[] = {
     {
         .name         = "ast2400-a1",
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .silicon_rev  = AST2400_A1_SILICON_REV,
         .sram_size    = 0x8000,
         .spis_num     = 1,
-        .fmc_typename = "aspeed.smc.fmc",
-        .spi_typename = aspeed_soc_ast2400_typenames,
-        .gpio_typename = "aspeed.gpio-ast2400",
         .wdts_num     = 2,
         .irqmap       = aspeed_soc_ast2400_irqmap,
         .memmap       = aspeed_soc_ast2400_memmap,
@@ -XXX,XX +XXX,XX @@ static const AspeedSoCInfo aspeed_socs[] = {
         .silicon_rev  = AST2500_A1_SILICON_REV,
         .sram_size    = 0x9000,
         .spis_num     = 2,
-        .fmc_typename = "aspeed.smc.ast2500-fmc",
-        .spi_typename = aspeed_soc_ast2500_typenames,
-        .gpio_typename = "aspeed.gpio-ast2500",
         .wdts_num     = 3,
         .irqmap       = aspeed_soc_ast2500_irqmap,
         .memmap       = aspeed_soc_ast2500_memmap,
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     AspeedSoCState *s = ASPEED_SOC(obj);
     AspeedSoCClass *sc = ASPEED_SOC_GET_CLASS(s);
     int i;
+    char socname[8];
+    char typename[64];
+
+    if (sscanf(sc->info->name, "%7s", socname) != 1) {
+        g_assert_not_reached();
+    }
 
     for (i = 0; i < sc->info->num_cpus; i++) {
         object_initialize_child(obj, "cpu[*]", OBJECT(&s->cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     sysbus_init_child_obj(obj, "i2c", OBJECT(&s->i2c), sizeof(s->i2c),
                           TYPE_ASPEED_I2C);
 
+    snprintf(typename, sizeof(typename), "aspeed.fmc-%s", socname);
     sysbus_init_child_obj(obj, "fmc", OBJECT(&s->fmc), sizeof(s->fmc),
-                          sc->info->fmc_typename);
+                          typename);
     object_property_add_alias(obj, "num-cs", OBJECT(&s->fmc), "num-cs",
                               &error_abort);
 
     for (i = 0; i < sc->info->spis_num; i++) {
+        snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
         sysbus_init_child_obj(obj, "spi[*]", OBJECT(&s->spi[i]),
-                              sizeof(s->spi[i]), sc->info->spi_typename[i]);
+                              sizeof(s->spi[i]), typename);
     }
 
     sysbus_init_child_obj(obj, "sdmc", OBJECT(&s->sdmc), sizeof(s->sdmc),
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     sysbus_init_child_obj(obj, "xdma", OBJECT(&s->xdma), sizeof(s->xdma),
                           TYPE_ASPEED_XDMA);
 
+    snprintf(typename, sizeof(typename), "aspeed.gpio-%s", socname);
     sysbus_init_child_obj(obj, "gpio", OBJECT(&s->gpio), sizeof(s->gpio),
-                          sc->info->gpio_typename);
+                          typename);
 }
 
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSegments aspeed_segments_ast2500_spi2[] = {
 
 static const AspeedSMCController controllers[] = {
     {
-        .name              = "aspeed.smc.smc",
+        .name              = "aspeed.smc-ast2400",
         .r_conf            = R_CONF,
         .r_ce_ctrl         = R_CE_CTRL,
         .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .has_dma           = false,
         .nregs             = ASPEED_SMC_R_SMC_MAX,
     }, {
-        .name              = "aspeed.smc.fmc",
+        .name              = "aspeed.fmc-ast2400",
         .r_conf            = R_CONF,
         .r_ce_ctrl         = R_CE_CTRL,
         .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .has_dma           = true,
         .nregs             = ASPEED_SMC_R_MAX,
     }, {
-        .name              = "aspeed.smc.spi",
+        .name              = "aspeed.spi1-ast2400",
         .r_conf            = R_SPI_CONF,
         .r_ce_ctrl         = 0xff,
         .r_ctrl0           = R_SPI_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .has_dma           = false,
         .nregs             = ASPEED_SMC_R_SPI_MAX,
     }, {
-        .name              = "aspeed.smc.ast2500-fmc",
+        .name              = "aspeed.fmc-ast2500",
         .r_conf            = R_CONF,
         .r_ce_ctrl         = R_CE_CTRL,
         .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .has_dma           = true,
         .nregs             = ASPEED_SMC_R_MAX,
     }, {
-        .name              = "aspeed.smc.ast2500-spi1",
+        .name              = "aspeed.spi1-ast2500",
         .r_conf            = R_CONF,
         .r_ce_ctrl         = R_CE_CTRL,
         .r_ctrl0           = R_CTRL0,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .has_dma           = false,
         .nregs             = ASPEED_SMC_R_MAX,
     }, {
-        .name              = "aspeed.smc.ast2500-spi2",
+        .name              = "aspeed.spi2-ast2500",
         .r_conf            = R_CONF,
         .r_ce_ctrl         = R_CE_CTRL,
         .r_ctrl0           = R_CTRL0,
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

The FMC controller on the Aspeed SoCs support DMA to access the flash
modules. It can operate in a normal mode, to copy to or from the flash
module mapping window, or in a checksum calculation mode, to evaluate
the best clock settings for reads.

The model introduces two custom address spaces for DMAs: one for the
AHB window of the FMC flash devices and one for the DRAM. The latter
is populated using a "dram" link set from the machine with the RAM
container region.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190904070506.1052-6-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/ssi/aspeed_smc.h |   6 +
 hw/arm/aspeed.c             |   2 +
 hw/arm/aspeed_soc.c         |   2 +
 hw/ssi/aspeed_smc.c         | 222 +++++++++++++++++++++++++++++++++++-
 4 files changed, 226 insertions(+), 6 deletions(-)

diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ssi/aspeed_smc.h
+++ b/include/hw/ssi/aspeed_smc.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCController {
     hwaddr flash_window_base;
     uint32_t flash_window_size;
     bool has_dma;
+    hwaddr dma_flash_mask;
+    hwaddr dma_dram_mask;
     uint32_t nregs;
 } AspeedSMCController;
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCState {
     /* for DMA support */
     uint64_t sdram_base;
 
+    AddressSpace flash_as;
+    MemoryRegion *dram_mr;
+    AddressSpace dram_as;
+
     AspeedSMCFlash *flashes;
 
     uint8_t snoop_index;
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_board_init(MachineState *machine,
                             &error_abort);
     object_property_set_int(OBJECT(&bmc->soc), machine->smp.cpus, "num-cpus",
                             &error_abort);
+    object_property_set_link(OBJECT(&bmc->soc), OBJECT(&bmc->ram_container),
+                             "dram", &error_abort);
     if (machine->kernel_filename) {
         /*
          * When booting with a -kernel command line there is no u-boot
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                           typename);
     object_property_add_alias(obj, "num-cs", OBJECT(&s->fmc), "num-cs",
                               &error_abort);
+    object_property_add_alias(obj, "dram", OBJECT(&s->fmc), "dram",
+                              &error_abort);
 
     for (i = 0; i < sc->info->spis_num; i++) {
         snprintf(typename, sizeof(typename), "aspeed.spi%d-%s", i + 1, socname);
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "qemu/error-report.h"
+#include "qapi/error.h"
+#include "exec/address-spaces.h"
 
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@
 #define   DMA_CTRL_FREQ_SHIFT   4
 #define   DMA_CTRL_MODE         (1 << 3)
 #define   DMA_CTRL_CKSUM        (1 << 2)
-#define   DMA_CTRL_DIR          (1 << 1)
-#define   DMA_CTRL_EN           (1 << 0)
+#define   DMA_CTRL_WRITE        (1 << 1)
+#define   DMA_CTRL_ENABLE       (1 << 0)
 
 /* DMA Flash Side Address */
 #define R_DMA_FLASH_ADDR  (0x84 / 4)
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_SOC_SPI_FLASH_BASE   0x30000000
 #define ASPEED_SOC_SPI2_FLASH_BASE  0x38000000
 
+/*
+ * DMA DRAM addresses should be 4 bytes aligned and the valid address
+ * range is 0x40000000 - 0x5FFFFFFF (AST2400)
+ *          0x80000000 - 0xBFFFFFFF (AST2500)
+ *
+ * DMA flash addresses should be 4 bytes aligned and the valid address
+ * range is 0x20000000 - 0x2FFFFFFF.
+ *
+ * DMA length is from 4 bytes to 32MB
+ *   0: 4 bytes
+ *   0x7FFFFF: 32M bytes
+ */
+#define DMA_DRAM_ADDR(s, val)   ((s)->sdram_base | \
+                                 ((val) & (s)->ctrl->dma_dram_mask))
+#define DMA_FLASH_ADDR(s, val)  ((s)->ctrl->flash_window_base | \
+                                ((val) & (s)->ctrl->dma_flash_mask))
+#define DMA_LENGTH(val)         ((val) & 0x01FFFFFC)
+
 /* Flash opcodes. */
 #define SPI_OP_READ       0x03    /* Read data bytes (low frequency) */
 
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
         .flash_window_size = 0x10000000,
         .has_dma           = true,
+        .dma_flash_mask    = 0x0FFFFFFC,
+        .dma_dram_mask     = 0x1FFFFFFC,
         .nregs             = ASPEED_SMC_R_MAX,
     }, {
         .name              = "aspeed.spi1-ast2400",
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .flash_window_base = ASPEED_SOC_FMC_FLASH_BASE,
         .flash_window_size = 0x10000000,
         .has_dma           = true,
+        .dma_flash_mask    = 0x0FFFFFFC,
+        .dma_dram_mask     = 0x3FFFFFFC,
         .nregs             = ASPEED_SMC_R_MAX,
     }, {
         .name              = "aspeed.spi1-ast2500",
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_reset(DeviceState *d)
 
     memset(s->regs, 0, sizeof s->regs);
 
-    /* Pretend DMA is done (u-boot initialization) */
-    s->regs[R_INTR_CTRL] = INTR_CTRL_DMA_STATUS;
-
     /* Unselect all slaves */
     for (i = 0; i < s->num_cs; ++i) {
         s->regs[s->r_ctrl0 + i] |= CTRL_CE_STOP_ACTIVE;
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
         addr == s->r_ce_ctrl ||
         addr == R_INTR_CTRL ||
         addr == R_DUMMY_DATA ||
+        (s->ctrl->has_dma && addr == R_DMA_CTRL) ||
+        (s->ctrl->has_dma && addr == R_DMA_FLASH_ADDR) ||
+        (s->ctrl->has_dma && addr == R_DMA_DRAM_ADDR) ||
+        (s->ctrl->has_dma && addr == R_DMA_LEN) ||
+        (s->ctrl->has_dma && addr == R_DMA_CHECKSUM) ||
         (addr >= R_SEG_ADDR0 && addr < R_SEG_ADDR0 + s->ctrl->max_slaves) ||
         (addr >= s->r_ctrl0 && addr < s->r_ctrl0 + s->ctrl->max_slaves)) {
         return s->regs[addr];
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
     }
 }
 
+/*
+ * Accumulate the result of the reads to provide a checksum that will
+ * be used to validate the read timing settings.
+ */
+static void aspeed_smc_dma_checksum(AspeedSMCState *s)
+{
+    MemTxResult result;
+    uint32_t data;
+
+    if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid direction for DMA checksum\n",  __func__);
+        return;
+    }
+
+    while (s->regs[R_DMA_LEN]) {
+        data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
+                                    MEMTXATTRS_UNSPECIFIED, &result);
+        if (result != MEMTX_OK) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash read failed @%08x\n",
+                          __func__, s->regs[R_DMA_FLASH_ADDR]);
+            return;
+        }
+
+        /*
+         * When the DMA is on-going, the DMA registers are updated
+         * with the current working addresses and length.
+         */
+        s->regs[R_DMA_CHECKSUM] += data;
+        s->regs[R_DMA_FLASH_ADDR] += 4;
+        s->regs[R_DMA_LEN] -= 4;
+    }
+}
+
+static void aspeed_smc_dma_rw(AspeedSMCState *s)
+{
+    MemTxResult result;
+    uint32_t data;
+
+    while (s->regs[R_DMA_LEN]) {
+        if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
+            data = address_space_ldl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
+                                        MEMTXATTRS_UNSPECIFIED, &result);
+            if (result != MEMTX_OK) {
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM read failed @%08x\n",
+                              __func__, s->regs[R_DMA_DRAM_ADDR]);
+                return;
+            }
+
+            address_space_stl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
+                                 data, MEMTXATTRS_UNSPECIFIED, &result);
+            if (result != MEMTX_OK) {
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash write failed @%08x\n",
+                              __func__, s->regs[R_DMA_FLASH_ADDR]);
+                return;
+            }
+        } else {
+            data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
+                                        MEMTXATTRS_UNSPECIFIED, &result);
+            if (result != MEMTX_OK) {
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: Flash read failed @%08x\n",
+                              __func__, s->regs[R_DMA_FLASH_ADDR]);
+                return;
+            }
+
+            address_space_stl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
+                                 data, MEMTXATTRS_UNSPECIFIED, &result);
+            if (result != MEMTX_OK) {
+                qemu_log_mask(LOG_GUEST_ERROR, "%s: DRAM write failed @%08x\n",
+                              __func__, s->regs[R_DMA_DRAM_ADDR]);
+                return;
+            }
+        }
+
+        /*
+         * When the DMA is on-going, the DMA registers are updated
+         * with the current working addresses and length.
+         */
+        s->regs[R_DMA_FLASH_ADDR] += 4;
+        s->regs[R_DMA_DRAM_ADDR] += 4;
+        s->regs[R_DMA_LEN] -= 4;
+    }
+}
+
+static void aspeed_smc_dma_stop(AspeedSMCState *s)
+{
+    /*
+     * When the DMA is disabled, INTR_CTRL_DMA_STATUS=0 means the
+     * engine is idle
+     */
+    s->regs[R_INTR_CTRL] &= ~INTR_CTRL_DMA_STATUS;
+    s->regs[R_DMA_CHECKSUM] = 0;
+
+    /*
+     * Lower the DMA irq in any case. The IRQ control register could
+     * have been cleared before disabling the DMA.
+     */
+    qemu_irq_lower(s->irq);
+}
+
+/*
+ * When INTR_CTRL_DMA_STATUS=1, the DMA has completed and a new DMA
+ * can start even if the result of the previous was not collected.
+ */
+static bool aspeed_smc_dma_in_progress(AspeedSMCState *s)
+{
+    return s->regs[R_DMA_CTRL] & DMA_CTRL_ENABLE &&
+        !(s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_STATUS);
+}
+
+static void aspeed_smc_dma_done(AspeedSMCState *s)
+{
+    s->regs[R_INTR_CTRL] |= INTR_CTRL_DMA_STATUS;
+    if (s->regs[R_INTR_CTRL] & INTR_CTRL_DMA_EN) {
+        qemu_irq_raise(s->irq);
+    }
+}
+
+static void aspeed_smc_dma_ctrl(AspeedSMCState *s, uint64_t dma_ctrl)
+{
+    if (!(dma_ctrl & DMA_CTRL_ENABLE)) {
+        s->regs[R_DMA_CTRL] = dma_ctrl;
+
+        aspeed_smc_dma_stop(s);
+        return;
+    }
+
+    if (aspeed_smc_dma_in_progress(s)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: DMA in progress\n",  __func__);
+        return;
+    }
+
+    s->regs[R_DMA_CTRL] = dma_ctrl;
+
+    if (s->regs[R_DMA_CTRL] & DMA_CTRL_CKSUM) {
+        aspeed_smc_dma_checksum(s);
+    } else {
+        aspeed_smc_dma_rw(s);
+    }
+
+    aspeed_smc_dma_done(s);
+}
+
 static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
                              unsigned int size)
 {
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_write(void *opaque, hwaddr addr, uint64_t data,
         }
     } else if (addr == R_DUMMY_DATA) {
         s->regs[addr] = value & 0xff;
+    } else if (addr == R_INTR_CTRL) {
+        s->regs[addr] = value;
+    } else if (s->ctrl->has_dma && addr == R_DMA_CTRL) {
+        aspeed_smc_dma_ctrl(s, value);
+    } else if (s->ctrl->has_dma && addr == R_DMA_DRAM_ADDR) {
+        s->regs[addr] = DMA_DRAM_ADDR(s, value);
+    } else if (s->ctrl->has_dma && addr == R_DMA_FLASH_ADDR) {
+        s->regs[addr] = DMA_FLASH_ADDR(s, value);
+    } else if (s->ctrl->has_dma && addr == R_DMA_LEN) {
+        s->regs[addr] = DMA_LENGTH(value);
     } else {
         qemu_log_mask(LOG_UNIMP, "%s: not implemented: 0x%" HWADDR_PRIx "\n",
                       __func__, addr);
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps aspeed_smc_ops = {
     .valid.unaligned = true,
 };
 
+
+/*
+ * Initialize the custom address spaces for DMAs
+ */
+static void aspeed_smc_dma_setup(AspeedSMCState *s, Error **errp)
+{
+    char *name;
+
+    if (!s->dram_mr) {
+        error_setg(errp, TYPE_ASPEED_SMC ": 'dram' link not set");
+        return;
+    }
+
+    name = g_strdup_printf("%s-dma-flash", s->ctrl->name);
+    address_space_init(&s->flash_as, &s->mmio_flash, name);
+    g_free(name);
+
+    name = g_strdup_printf("%s-dma-dram", s->ctrl->name);
+    address_space_init(&s->dram_as, s->dram_mr, name);
+    g_free(name);
+}
+
 static void aspeed_smc_realize(DeviceState *dev, Error **errp)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
         s->num_cs = s->ctrl->max_slaves;
     }
 
+    /* DMA irq. Keep it first for the initialization in the SoC */
+    sysbus_init_irq(sbd, &s->irq);
+
     s->spi = ssi_create_bus(dev, "spi");
 
     /* Setup cs_lines for slaves */
-    sysbus_init_irq(sbd, &s->irq);
     s->cs_lines = g_new0(qemu_irq, s->num_cs);
     ssi_auto_connect_slaves(dev, s->cs_lines, s->spi);
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_realize(DeviceState *dev, Error **errp)
         memory_region_add_subregion(&s->mmio_flash, offset, &fl->mmio);
         offset += fl->size;
     }
+
+    /* DMA support */
+    if (s->ctrl->has_dma) {
+        aspeed_smc_dma_setup(s, errp);
+    }
 }
 
 static const VMStateDescription vmstate_aspeed_smc = {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_smc = {
 static Property aspeed_smc_properties[] = {
     DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
     DEFINE_PROP_UINT64("sdram-base", AspeedSMCState, sdram_base, 0),
+    DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
+                     TYPE_MEMORY_REGION, MemoryRegion *),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

When doing calibration, the SPI clock rate in the CE0 Control Register
and the read delay cycles in the Read Timing Compensation Register are
set using bit[11:4] of the DMA Control Register.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Acked-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190904070506.1052-7-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/aspeed_smc.c | 64 ++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 63 insertions(+), 1 deletion(-)

diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@
 #define   CTRL_CMD_MASK            0xff
 #define   CTRL_DUMMY_HIGH_SHIFT    14
 #define   CTRL_AST2400_SPI_4BYTE   (1 << 13)
+#define CE_CTRL_CLOCK_FREQ_SHIFT   8
+#define CE_CTRL_CLOCK_FREQ_MASK    0xf
+#define CE_CTRL_CLOCK_FREQ(div)                                         \
+    (((div) & CE_CTRL_CLOCK_FREQ_MASK) << CE_CTRL_CLOCK_FREQ_SHIFT)
 #define   CTRL_DUMMY_LOW_SHIFT     6 /* 2 bits [7:6] */
 #define   CTRL_CE_STOP_ACTIVE      (1 << 2)
 #define   CTRL_CMD_MODE_MASK       0x3
@@ -XXX,XX +XXX,XX @@
 #define   DMA_CTRL_DELAY_SHIFT  8
 #define   DMA_CTRL_FREQ_MASK    0xf
 #define   DMA_CTRL_FREQ_SHIFT   4
-#define   DMA_CTRL_MODE         (1 << 3)
+#define   DMA_CTRL_CALIB        (1 << 3)
 #define   DMA_CTRL_CKSUM        (1 << 2)
 #define   DMA_CTRL_WRITE        (1 << 1)
 #define   DMA_CTRL_ENABLE       (1 << 0)
@@ -XXX,XX +XXX,XX @@ static uint64_t aspeed_smc_read(void *opaque, hwaddr addr, unsigned int size)
     }
 }
 
+static uint8_t aspeed_smc_hclk_divisor(uint8_t hclk_mask)
+{
+    /* HCLK/1 .. HCLK/16 */
+    const uint8_t hclk_divisors[] = {
+        15, 7, 14, 6, 13, 5, 12, 4, 11, 3, 10, 2, 9, 1, 8, 0
+    };
+    int i;
+
+    for (i = 0; i < ARRAY_SIZE(hclk_divisors); i++) {
+        if (hclk_mask == hclk_divisors[i]) {
+            return i + 1;
+        }
+    }
+
+    qemu_log_mask(LOG_GUEST_ERROR, "invalid HCLK mask %x", hclk_mask);
+    return 0;
+}
+
+/*
+ * When doing calibration, the SPI clock rate in the CE0 Control
+ * Register and the read delay cycles in the Read Timing Compensation
+ * Register are set using bit[11:4] of the DMA Control Register.
+ */
+static void aspeed_smc_dma_calibration(AspeedSMCState *s)
+{
+    uint8_t delay =
+        (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
+    uint8_t hclk_mask =
+        (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
+    uint8_t hclk_div = aspeed_smc_hclk_divisor(hclk_mask);
+    uint32_t hclk_shift = (hclk_div - 1) << 2;
+    uint8_t cs;
+
+    /*
+     * The Read Timing Compensation Register values apply to all CS on
+     * the SPI bus and only HCLK/1 - HCLK/5 can have tunable delays
+     */
+    if (hclk_div && hclk_div < 6) {
+        s->regs[s->r_timings] &= ~(0xf << hclk_shift);
+        s->regs[s->r_timings] |= delay << hclk_shift;
+    }
+
+    /*
+     * TODO: compute the CS from the DMA address and the segment
+     * registers. This is not really a problem for now because the
+     * Timing Register values apply to all CS and software uses CS0 to
+     * do calibration.
+     */
+    cs = 0;
+    s->regs[s->r_ctrl0 + cs] &=
+        ~(CE_CTRL_CLOCK_FREQ_MASK << CE_CTRL_CLOCK_FREQ_SHIFT);
+    s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
+}
+
 /*
  * Accumulate the result of the reads to provide a checksum that will
  * be used to validate the read timing settings.
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_checksum(AspeedSMCState *s)
         return;
     }
 
+    if (s->regs[R_DMA_CTRL] & DMA_CTRL_CALIB) {
+        aspeed_smc_dma_calibration(s);
+    }
+
     while (s->regs[R_DMA_LEN]) {
         data = address_space_ldl_le(&s->flash_as, s->regs[R_DMA_FLASH_ADDR],
                                     MEMTXATTRS_UNSPECIFIED, &result);
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

Emulate read errors in the DMA Checksum Register for high frequencies
and optimistic settings of the Read Timing Compensation Register. This
will help in tuning the SPI timing calibration algorithm. Errors are
only injected when the property "inject_failure" is set to true as
suggested by Philippe.

The values below are those to expect from the first flash device of
the FMC controller of a palmetto-bmc machine.

Cc: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20190904070506.1052-8-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/ssi/aspeed_smc.h |  1 +
 hw/ssi/aspeed_smc.c         | 36 ++++++++++++++++++++++++++++++++++++
 2 files changed, 37 insertions(+)

diff --git a/include/hw/ssi/aspeed_smc.h b/include/hw/ssi/aspeed_smc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ssi/aspeed_smc.h
+++ b/include/hw/ssi/aspeed_smc.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSMCState {
 
     uint32_t num_cs;
     qemu_irq *cs_lines;
+    bool inject_failure;
 
     SSIBus *spi;
 
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_calibration(AspeedSMCState *s)
     s->regs[s->r_ctrl0 + cs] |= CE_CTRL_CLOCK_FREQ(hclk_div);
 }
 
+/*
+ * Emulate read errors in the DMA Checksum Register for high
+ * frequencies and optimistic settings of the Read Timing Compensation
+ * Register. This will help in tuning the SPI timing calibration
+ * algorithm.
+ */
+static bool aspeed_smc_inject_read_failure(AspeedSMCState *s)
+{
+    uint8_t delay =
+        (s->regs[R_DMA_CTRL] >> DMA_CTRL_DELAY_SHIFT) & DMA_CTRL_DELAY_MASK;
+    uint8_t hclk_mask =
+        (s->regs[R_DMA_CTRL] >> DMA_CTRL_FREQ_SHIFT) & DMA_CTRL_FREQ_MASK;
+
+    /*
+     * Typical values of a palmetto-bmc machine.
+     */
+    switch (aspeed_smc_hclk_divisor(hclk_mask)) {
+    case 4 ... 16:
+        return false;
+    case 3: /* at least one HCLK cycle delay */
+        return (delay & 0x7) < 1;
+    case 2: /* at least two HCLK cycle delay */
+        return (delay & 0x7) < 2;
+    case 1: /* (> 100MHz) is above the max freq of the controller */
+        return true;
+    default:
+        g_assert_not_reached();
+    }
+}
+
 /*
  * Accumulate the result of the reads to provide a checksum that will
  * be used to validate the read timing settings.
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_checksum(AspeedSMCState *s)
         s->regs[R_DMA_FLASH_ADDR] += 4;
         s->regs[R_DMA_LEN] -= 4;
     }
+
+    if (s->inject_failure && aspeed_smc_inject_read_failure(s)) {
+        s->regs[R_DMA_CHECKSUM] = 0xbadc0de;
+    }
+
 }
 
 static void aspeed_smc_dma_rw(AspeedSMCState *s)
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_aspeed_smc = {
 
 static Property aspeed_smc_properties[] = {
     DEFINE_PROP_UINT32("num-cs", AspeedSMCState, num_cs, 1),
+    DEFINE_PROP_BOOL("inject-failure", AspeedSMCState, inject_failure, false),
     DEFINE_PROP_UINT64("sdram-base", AspeedSMCState, sdram_base, 0),
     DEFINE_PROP_LINK("dram", AspeedSMCState, dram_mr,
                      TYPE_MEMORY_REGION, MemoryRegion *),
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

and use a class AspeedSCUClass to define each SoC characteristics.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-10-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/aspeed_scu.h | 15 +++++++
 hw/arm/aspeed_soc.c          |  3 +-
 hw/misc/aspeed_scu.c         | 83 ++++++++++++++++++++----------------
 3 files changed, 64 insertions(+), 37 deletions(-)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -XXX,XX +XXX,XX @@
 
 #define TYPE_ASPEED_SCU "aspeed.scu"
 #define ASPEED_SCU(obj) OBJECT_CHECK(AspeedSCUState, (obj), TYPE_ASPEED_SCU)
+#define TYPE_ASPEED_2400_SCU TYPE_ASPEED_SCU "-ast2400"
+#define TYPE_ASPEED_2500_SCU TYPE_ASPEED_SCU "-ast2500"
 
 #define ASPEED_SCU_NR_REGS (0x1A8 >> 2)
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
 
 extern bool is_supported_silicon_rev(uint32_t silicon_rev);
 
+#define ASPEED_SCU_CLASS(klass) \
+     OBJECT_CLASS_CHECK(AspeedSCUClass, (klass), TYPE_ASPEED_SCU)
+#define ASPEED_SCU_GET_CLASS(obj) \
+     OBJECT_GET_CLASS(AspeedSCUClass, (obj), TYPE_ASPEED_SCU)
+
+typedef struct  AspeedSCUClass {
+    SysBusDeviceClass parent_class;
+
+    const uint32_t *resets;
+    uint32_t (*calc_hpll)(AspeedSCUState *s);
+    uint32_t apb_divider;
+}  AspeedSCUClass;
+
 #define ASPEED_SCU_PROT_KEY      0x1688A8A8
 
 /*
diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
                                 &error_abort, NULL);
     }
 
+    snprintf(typename, sizeof(typename), "aspeed.scu-%s", socname);
     sysbus_init_child_obj(obj, "scu", OBJECT(&s->scu), sizeof(s->scu),
-                          TYPE_ASPEED_SCU);
+                          typename);
     qdev_prop_set_uint32(DEVICE(&s->scu), "silicon-rev",
                          sc->info->silicon_rev);
     object_property_add_alias(obj, "hw-strap1", OBJECT(&s->scu),
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_get_random(void)
 
 static void aspeed_scu_set_apb_freq(AspeedSCUState *s)
 {
-    uint32_t apb_divider;
-
-    switch (s->silicon_rev) {
-    case AST2400_A0_SILICON_REV:
-    case AST2400_A1_SILICON_REV:
-        apb_divider = 2;
-        break;
-    case AST2500_A0_SILICON_REV:
-    case AST2500_A1_SILICON_REV:
-        apb_divider = 4;
-        break;
-    default:
-        g_assert_not_reached();
-    }
+    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(s);
 
     s->apb_freq = s->hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
-        / apb_divider;
+        / asc->apb_divider;
 }
 
 static uint64_t aspeed_scu_read(void *opaque, hwaddr offset, unsigned size)
@@ -XXX,XX +XXX,XX @@ static const uint32_t hpll_ast2400_freqs[][4] = {
     { 400, 375, 350, 425 }, /* 25MHz */
 };
 
-static uint32_t aspeed_scu_calc_hpll_ast2400(AspeedSCUState *s)
+static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
 {
     uint32_t hpll_reg = s->regs[HPLL_PARAM];
     uint8_t freq_select;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_calc_hpll_ast2400(AspeedSCUState *s)
     return hpll_ast2400_freqs[clk_25m_in][freq_select] * 1000000;
 }
 
-static uint32_t aspeed_scu_calc_hpll_ast2500(AspeedSCUState *s)
+static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
 {
     uint32_t hpll_reg   = s->regs[HPLL_PARAM];
     uint32_t multiplier = 1;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_calc_hpll_ast2500(AspeedSCUState *s)
 static void aspeed_scu_reset(DeviceState *dev)
 {
     AspeedSCUState *s = ASPEED_SCU(dev);
-    const uint32_t *reset;
-    uint32_t (*calc_hpll)(AspeedSCUState *s);
+    AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(dev);
 
-    switch (s->silicon_rev) {
-    case AST2400_A0_SILICON_REV:
-    case AST2400_A1_SILICON_REV:
-        reset = ast2400_a0_resets;
-        calc_hpll = aspeed_scu_calc_hpll_ast2400;
-        break;
-    case AST2500_A0_SILICON_REV:
-    case AST2500_A1_SILICON_REV:
-        reset = ast2500_a1_resets;
-        calc_hpll = aspeed_scu_calc_hpll_ast2500;
-        break;
-    default:
-        g_assert_not_reached();
-    }
-
-    memcpy(s->regs, reset, sizeof(s->regs));
+    memcpy(s->regs, asc->resets, sizeof(s->regs));
     s->regs[SILICON_REV] = s->silicon_rev;
     s->regs[HW_STRAP1] = s->hw_strap1;
     s->regs[HW_STRAP2] = s->hw_strap2;
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_reset(DeviceState *dev)
      * All registers are set. Now compute the frequencies of the main clocks
      */
     s->clkin = aspeed_scu_get_clkin(s);
-    s->hpll = calc_hpll(s);
+    s->hpll = asc->calc_hpll(s);
     aspeed_scu_set_apb_freq(s);
 }
 
@@ -XXX,XX +XXX,XX @@ static const TypeInfo aspeed_scu_info = {
     .parent = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(AspeedSCUState),
     .class_init = aspeed_scu_class_init,
+    .class_size    = sizeof(AspeedSCUClass),
+    .abstract      = true,
+};
+
+static void aspeed_2400_scu_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
+
+    dc->desc = "ASPEED 2400 System Control Unit";
+    asc->resets = ast2400_a0_resets;
+    asc->calc_hpll = aspeed_2400_scu_calc_hpll;
+    asc->apb_divider = 2;
+}
+
+static const TypeInfo aspeed_2400_scu_info = {
+    .name = TYPE_ASPEED_2400_SCU,
+    .parent = TYPE_ASPEED_SCU,
+    .instance_size = sizeof(AspeedSCUState),
+    .class_init = aspeed_2400_scu_class_init,
+};
+
+static void aspeed_2500_scu_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    AspeedSCUClass *asc = ASPEED_SCU_CLASS(klass);
+
+    dc->desc = "ASPEED 2500 System Control Unit";
+    asc->resets = ast2500_a1_resets;
+    asc->calc_hpll = aspeed_2500_scu_calc_hpll;
+    asc->apb_divider = 4;
+}
+
+static const TypeInfo aspeed_2500_scu_info = {
+    .name = TYPE_ASPEED_2500_SCU,
+    .parent = TYPE_ASPEED_SCU,
+    .instance_size = sizeof(AspeedSCUState),
+    .class_init = aspeed_2500_scu_class_init,
 };
 
 static void aspeed_scu_register_types(void)
 {
     type_register_static(&aspeed_scu_info);
+    type_register_static(&aspeed_2400_scu_info);
+    type_register_static(&aspeed_2500_scu_info);
 }
 
 type_init(aspeed_scu_register_types);
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

The APB frequency can be calculated directly when needed from the
HPLL_PARAM and CLK_SEL register values. This removes useless state in
the model.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20190904070506.1052-11-clg@kaod.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/aspeed_scu.h |  8 +++-----
 hw/misc/aspeed_scu.c         | 25 +++++++++----------------
 hw/timer/aspeed_timer.c      |  3 ++-
 3 files changed, 14 insertions(+), 22 deletions(-)

diff --git a/include/hw/misc/aspeed_scu.h b/include/hw/misc/aspeed_scu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/aspeed_scu.h
+++ b/include/hw/misc/aspeed_scu.h
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSCUState {
     uint32_t hw_strap1;
     uint32_t hw_strap2;
     uint32_t hw_prot_key;
-
-    uint32_t clkin;
-    uint32_t hpll;
-    uint32_t apb_freq;
 } AspeedSCUState;
 
 #define AST2400_A0_SILICON_REV   0x02000303U
@@ -XXX,XX +XXX,XX @@ typedef struct  AspeedSCUClass {
     SysBusDeviceClass parent_class;
 
     const uint32_t *resets;
-    uint32_t (*calc_hpll)(AspeedSCUState *s);
+    uint32_t (*calc_hpll)(AspeedSCUState *s, uint32_t hpll_reg);
     uint32_t apb_divider;
 }  AspeedSCUClass;
 
 #define ASPEED_SCU_PROT_KEY      0x1688A8A8
 
+uint32_t aspeed_scu_get_apb_freq(AspeedSCUState *s);
+
 /*
  * Extracted from Aspeed SDK v00.03.21. Fixes and extra definitions
  * were added.
diff --git a/hw/misc/aspeed_scu.c b/hw/misc/aspeed_scu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/aspeed_scu.c
+++ b/hw/misc/aspeed_scu.c
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_scu_get_random(void)
     return num;
 }
 
-static void aspeed_scu_set_apb_freq(AspeedSCUState *s)
+uint32_t aspeed_scu_get_apb_freq(AspeedSCUState *s)
 {
     AspeedSCUClass *asc = ASPEED_SCU_GET_CLASS(s);
+    uint32_t hpll = asc->calc_hpll(s, s->regs[HPLL_PARAM]);
 
-    s->apb_freq = s->hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
+    return hpll / (SCU_CLK_GET_PCLK_DIV(s->regs[CLK_SEL]) + 1)
         / asc->apb_divider;
 }
 
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_write(void *opaque, hwaddr offset, uint64_t data,
         return;
     case CLK_SEL:
         s->regs[reg] = data;
-        aspeed_scu_set_apb_freq(s);
         break;
     case HW_STRAP1:
         if (ASPEED_IS_AST2500(s->regs[SILICON_REV])) {
@@ -XXX,XX +XXX,XX @@ static const uint32_t hpll_ast2400_freqs[][4] = {
     { 400, 375, 350, 425 }, /* 25MHz */
 };
 
-static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
+static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s, uint32_t hpll_reg)
 {
-    uint32_t hpll_reg = s->regs[HPLL_PARAM];
     uint8_t freq_select;
     bool clk_25m_in;
+    uint32_t clkin = aspeed_scu_get_clkin(s);
 
     if (hpll_reg & SCU_AST2400_H_PLL_OFF) {
         return 0;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
             multiplier = (2 - od) * ((n + 2) / (d + 1));
         }
 
-        return s->clkin * multiplier;
+        return clkin * multiplier;
     }
 
     /* HW strapping */
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2400_scu_calc_hpll(AspeedSCUState *s)
     return hpll_ast2400_freqs[clk_25m_in][freq_select] * 1000000;
 }
 
-static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
+static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s, uint32_t hpll_reg)
 {
-    uint32_t hpll_reg   = s->regs[HPLL_PARAM];
     uint32_t multiplier = 1;
+    uint32_t clkin = aspeed_scu_get_clkin(s);
 
     if (hpll_reg & SCU_H_PLL_OFF) {
         return 0;
@@ -XXX,XX +XXX,XX @@ static uint32_t aspeed_2500_scu_calc_hpll(AspeedSCUState *s)
         multiplier = ((m + 1) / (n + 1)) / (p + 1);
     }
 
-    return s->clkin * multiplier;
+    return clkin * multiplier;
 }
 
 static void aspeed_scu_reset(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static void aspeed_scu_reset(DeviceState *dev)
     s->regs[HW_STRAP1] = s->hw_strap1;
     s->regs[HW_STRAP2] = s->hw_strap2;
     s->regs[PROT_KEY] = s->hw_prot_key;
-
-    /*
-     * All registers are set. Now compute the frequencies of the main clocks
-     */
-    s->clkin = aspeed_scu_get_clkin(s);
-    s->hpll = asc->calc_hpll(s);
-    aspeed_scu_set_apb_freq(s);
 }
 
 static uint32_t aspeed_silicon_revs[] = {
diff --git a/hw/timer/aspeed_timer.c b/hw/timer/aspeed_timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/aspeed_timer.c
+++ b/hw/timer/aspeed_timer.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t calculate_rate(struct AspeedTimer *t)
 {
     AspeedTimerCtrlState *s = timer_to_ctrl(t);
 
-    return timer_external_clock(t) ? TIMER_CLOCK_EXT_HZ : s->scu->apb_freq;
+    return timer_external_clock(t) ? TIMER_CLOCK_EXT_HZ :
+        aspeed_scu_get_apb_freq(s->scu);
 }
 
 static inline uint32_t calculate_ticks(struct AspeedTimer *t, uint64_t now_ns)
-- 
2.20.1

From: "Emilio G. Cota" <cota@braap.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Emilio G. Cota <cota@braap.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 accel/tcg/atomic_template.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/accel/tcg/atomic_template.h b/accel/tcg/atomic_template.h
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/atomic_template.h
+++ b/accel/tcg/atomic_template.h
@@ -XXX,XX +XXX,XX @@ ABI_TYPE ATOMIC_NAME(xchg)(CPUArchState *env, target_ulong addr,
 
 #define GEN_ATOMIC_HELPER(X)                                        \
 ABI_TYPE ATOMIC_NAME(X)(CPUArchState *env, target_ulong addr,       \
-                 ABI_TYPE val EXTRA_ARGS)                           \
+                        ABI_TYPE val EXTRA_ARGS)                    \
 {                                                                   \
     ATOMIC_MMU_DECLS;                                               \
     DATA_TYPE *haddr = ATOMIC_MMU_LOOKUP;                           \
-- 
2.20.1

The qemu-ga documentation is currently in qemu-ga.texi in
Texinfo format, which we present to the user as:
 * a qemu-ga manpage
 * a section of the main qemu-doc HTML documentation

Convert the documentation to rST format, and present it to
the user as:
 * a qemu-ga manpage
 * part of the interop/ Sphinx manual

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Tested-by: Michael Roth <mdroth@linux.vnet.ibm.com>
Message-id: 20190905131040.8350-1-peter.maydell@linaro.org
---
 Makefile                 |  24 ++++---
 MAINTAINERS              |   2 +-
 docs/conf.py             |  18 ++---
 docs/interop/conf.py     |   7 ++
 docs/interop/index.rst   |   1 +
 docs/interop/qemu-ga.rst | 133 +++++++++++++++++++++++++++++++++++++
 qemu-doc.texi            |   5 --
 qemu-ga.texi             | 137 ---------------------------------------
 8 files changed, 166 insertions(+), 161 deletions(-)
 create mode 100644 docs/interop/qemu-ga.rst
 delete mode 100644 qemu-ga.texi

diff --git a/Makefile b/Makefile
index XXXXXXX..XXXXXXX 100644
--- a/Makefile
+++ b/Makefile
@@ -XXX,XX +XXX,XX @@ endif
 endif
 
 ifdef BUILD_DOCS
-DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 qemu-ga.8
+DOCS=qemu-doc.html qemu-doc.txt qemu.1 qemu-img.1 qemu-nbd.8 docs/interop/qemu-ga.8
 DOCS+=docs/interop/qemu-qmp-ref.html docs/interop/qemu-qmp-ref.txt docs/interop/qemu-qmp-ref.7
 DOCS+=docs/interop/qemu-ga-ref.html docs/interop/qemu-ga-ref.txt docs/interop/qemu-ga-ref.7
 DOCS+=docs/qemu-block-drivers.7
@@ -XXX,XX +XXX,XX @@ DESCS=
 endif
 
 # Note that we manually filter-out the non-Sphinx documentation which
-# is currently built into the docs/interop directory in the build tree.
+# is currently built into the docs/interop directory in the build tree,
+# and also any sphinx-built manpages.
 define install-manual =
 for d in $$(cd $(MANUAL_BUILDDIR) && find $1 -type d); do $(INSTALL_DIR) "$(DESTDIR)$(qemu_docdir)/$$d"; done
-for f in $$(cd $(MANUAL_BUILDDIR) && find $1 -type f -a '!' '(' -name 'qemu-*-qapi.*' -o -name 'qemu-*-ref.*' ')' ); do $(INSTALL_DATA) "$(MANUAL_BUILDDIR)/$$f" "$(DESTDIR)$(qemu_docdir)/$$f"; done
+for f in $$(cd $(MANUAL_BUILDDIR) && find $1 -type f -a '!' '(' -name '*.[0-9]' -o -name 'qemu-*-qapi.*' -o -name 'qemu-*-ref.*' ')' ); do $(INSTALL_DATA) "$(MANUAL_BUILDDIR)/$$f" "$(DESTDIR)$(qemu_docdir)/$$f"; done
 endef
 
 # Note that we deliberately do not install the "devel" manual: it is
@@ -XXX,XX +XXX,XX @@ ifdef CONFIG_TRACE_SYSTEMTAP
 	$(INSTALL_DATA) scripts/qemu-trace-stap.1 "$(DESTDIR)$(mandir)/man1"
 endif
 ifneq (,$(findstring qemu-ga,$(TOOLS)))
-	$(INSTALL_DATA) qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
+	$(INSTALL_DATA) docs/interop/qemu-ga.8 "$(DESTDIR)$(mandir)/man8"
 	$(INSTALL_DATA) docs/interop/qemu-ga-ref.html "$(DESTDIR)$(qemu_docdir)"
 	$(INSTALL_DATA) docs/interop/qemu-ga-ref.txt "$(DESTDIR)$(qemu_docdir)"
 	$(INSTALL_DATA) docs/interop/qemu-ga-ref.7 "$(DESTDIR)$(mandir)/man7"
@@ -XXX,XX +XXX,XX @@ docs/version.texi: $(SRC_PATH)/VERSION config-host.mak
 sphinxdocs: $(MANUAL_BUILDDIR)/devel/index.html $(MANUAL_BUILDDIR)/interop/index.html $(MANUAL_BUILDDIR)/specs/index.html
 
 # Canned command to build a single manual
-build-manual = $(call quiet-command,sphinx-build $(if $(V),,-q) -W -n -b html -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
+# Arguments: $1 = manual name, $2 = Sphinx builder ('html' or 'man')
+build-manual = $(call quiet-command,CONFDIR="$(qemu_confdir)" sphinx-build $(if $(V),,-q) -W -n -b $2 -D version=$(VERSION) -D release="$(FULL_VERSION)" -d .doctrees/$1 $(SRC_PATH)/docs/$1 $(MANUAL_BUILDDIR)/$1 ,"SPHINX","$(MANUAL_BUILDDIR)/$1")
 # We assume all RST files in the manual's directory are used in it
 manual-deps = $(wildcard $(SRC_PATH)/docs/$1/*.rst) $(SRC_PATH)/docs/$1/conf.py $(SRC_PATH)/docs/conf.py
 
 $(MANUAL_BUILDDIR)/devel/index.html: $(call manual-deps,devel)
-	$(call build-manual,devel)
+	$(call build-manual,devel,html)
 
 $(MANUAL_BUILDDIR)/interop/index.html: $(call manual-deps,interop)
-	$(call build-manual,interop)
+	$(call build-manual,interop,html)
 
 $(MANUAL_BUILDDIR)/specs/index.html: $(call manual-deps,specs)
-	$(call build-manual,specs)
+	$(call build-manual,specs,html)
+
+$(MANUAL_BUILDDIR)/interop/qemu-ga.8: $(call manual-deps,interop)
+	$(call build-manual,interop,man)
 
 qemu-options.texi: $(SRC_PATH)/qemu-options.hx $(SRC_PATH)/scripts/hxtool
 	$(call quiet-command,sh $(SRC_PATH)/scripts/hxtool -t < $< > $@,"GEN","$@")
@@ -XXX,XX +XXX,XX @@ qemu.1: qemu-option-trace.texi
 qemu-img.1: qemu-img.texi qemu-option-trace.texi qemu-img-cmds.texi
 fsdev/virtfs-proxy-helper.1: fsdev/virtfs-proxy-helper.texi
 qemu-nbd.8: qemu-nbd.texi qemu-option-trace.texi
-qemu-ga.8: qemu-ga.texi
 docs/qemu-block-drivers.7: docs/qemu-block-drivers.texi
 docs/qemu-cpu-models.7: docs/qemu-cpu-models.texi
 scripts/qemu-trace-stap.1: scripts/qemu-trace-stap.texi
@@ -XXX,XX +XXX,XX @@ txt: qemu-doc.txt docs/interop/qemu-qmp-ref.txt docs/interop/qemu-ga-ref.txt
 qemu-doc.html qemu-doc.info qemu-doc.pdf qemu-doc.txt: \
 	qemu-img.texi qemu-nbd.texi qemu-options.texi \
 	qemu-tech.texi qemu-option-trace.texi \
-	qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi qemu-ga.texi \
+	qemu-deprecated.texi qemu-monitor.texi qemu-img-cmds.texi \
 	qemu-monitor-info.texi docs/qemu-block-drivers.texi \
 	docs/qemu-cpu-models.texi docs/security.texi
 
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ QEMU Guest Agent
 M: Michael Roth <mdroth@linux.vnet.ibm.com>
 S: Maintained
 F: qga/
-F: qemu-ga.texi
+F: docs/interop/qemu-ga.rst
 F: scripts/qemu-guest-agent/
 F: tests/test-qga.c
 F: docs/interop/qemu-ga-ref.texi
diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@ todo_include_todos = False
 # with "option::" in the document being processed. Turn that off.
 suppress_warnings = ["ref.option"]
 
+# The rst_epilog fragment is effectively included in every rST file.
+# We use it to define substitutions based on build config that
+# can then be used in the documentation. The fallback if the
+# environment variable is not set is for the benefit of readthedocs
+# style document building; our Makefile always sets the variable.
+confdir = os.getenv('CONFDIR', "/etc/qemu")
+rst_epilog = ".. |CONFDIR| replace:: ``" + confdir + "``\n"
+
 # -- Options for HTML output ----------------------------------------------
 
 # The theme to use for HTML and HTML Help pages.  See the documentation for
@@ -XXX,XX +XXX,XX @@ latex_documents = [
 
 
 # -- Options for manual page output ---------------------------------------
-
-# One entry per manual page. List of tuples
-# (source start file, name, description, authors, manual section).
-man_pages = [
-    (master_doc, 'qemu', u'QEMU Documentation',
-     [author], 1)
-]
-
+# Individual manual/conf.py can override this to create man pages
+man_pages = []
 
 # -- Options for Texinfo output -------------------------------------------
 
diff --git a/docs/interop/conf.py b/docs/interop/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/conf.py
+++ b/docs/interop/conf.py
@@ -XXX,XX +XXX,XX @@ exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 # This slightly misuses the 'description', but is the best way to get
 # the manual title to appear in the sidebar.
 html_theme_options['description'] = u'System Emulation Management and Interoperability Guide'
+
+# One entry per manual page. List of tuples
+# (source start file, name, description, authors, manual section).
+man_pages = [
+    ('qemu-ga', 'qemu-ga', u'QEMU Guest Agent',
+     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8)
+]
diff --git a/docs/interop/index.rst b/docs/interop/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/index.rst
+++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
    bitmaps
    live-block-operations
    pr-helper
+   qemu-ga
    vhost-user
    vhost-user-gpu
diff --git a/docs/interop/qemu-ga.rst b/docs/interop/qemu-ga.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/interop/qemu-ga.rst
@@ -XXX,XX +XXX,XX @@
+QEMU Guest Agent
+================
+
+Synopsis
+--------
+
+**qemu-ga** [*OPTIONS*]
+
+Description
+-----------
+
+The QEMU Guest Agent is a daemon intended to be run within virtual
+machines. It allows the hypervisor host to perform various operations
+in the guest, such as:
+
+- get information from the guest
+- set the guest's system time
+- read/write a file
+- sync and freeze the filesystems
+- suspend the guest
+- reconfigure guest local processors
+- set user's password
+- ...
+
+qemu-ga will read a system configuration file on startup (located at
+|CONFDIR|\ ``/qemu-ga.conf`` by default), then parse remaining
+configuration options on the command line. For the same key, the last
+option wins, but the lists accumulate (see below for configuration
+file format).
+
+Options
+-------
+
+.. program:: qemu-ga
+
+.. option:: -m, --method=METHOD
+
+  Transport method: one of ``unix-listen``, ``virtio-serial``, or
+  ``isa-serial`` (``virtio-serial`` is the default).
+
+.. option:: -p, --path=PATH
+
+  Device/socket path (the default for virtio-serial is
+  ``/dev/virtio-ports/org.qemu.guest_agent.0``,
+  the default for isa-serial is ``/dev/ttyS0``)
+
+.. option:: -l, --logfile=PATH
+
+  Set log file path (default is stderr).
+
+.. option:: -f, --pidfile=PATH
+
+  Specify pid file (default is ``/var/run/qemu-ga.pid``).
+
+.. option:: -F, --fsfreeze-hook=PATH
+
+  Enable fsfreeze hook. Accepts an optional argument that specifies
+  script to run on freeze/thaw. Script will be called with
+  'freeze'/'thaw' arguments accordingly (default is
+  |CONFDIR|\ ``/fsfreeze-hook``). If using -F with an argument, do
+  not follow -F with a space (for example:
+  ``-F/var/run/fsfreezehook.sh``).
+
+.. option:: -t, --statedir=PATH
+
+  Specify the directory to store state information (absolute paths only,
+  default is ``/var/run``).
+
+.. option:: -v, --verbose
+
+  Log extra debugging information.
+
+.. option:: -V, --version
+
+  Print version information and exit.
+
+.. option:: -d, --daemon
+
+  Daemonize after startup (detach from terminal).
+
+.. option:: -b, --blacklist=LIST
+
+  Comma-separated list of RPCs to disable (no spaces, ``?`` to list
+  available RPCs).
+
+.. option:: -D, --dump-conf
+
+  Dump the configuration in a format compatible with ``qemu-ga.conf``
+  and exit.
+
+.. option:: -h, --help
+
+  Display this help and exit.
+
+Files
+-----
+
+
+The syntax of the ``qemu-ga.conf`` configuration file follows the
+Desktop Entry Specification, here is a quick summary: it consists of
+groups of key-value pairs, interspersed with comments.
+
+::
+
+    # qemu-ga configuration sample
+    [general]
+    daemonize = 0
+    pidfile = /var/run/qemu-ga.pid
+    verbose = 0
+    method = virtio-serial
+    path = /dev/virtio-ports/org.qemu.guest_agent.0
+    statedir = /var/run
+
+The list of keys follows the command line options:
+
+=============  ===========
+Key             Key type
+=============  ===========
+daemon         boolean
+method         string
+path           string
+logfile        string
+pidfile        string
+fsfreeze-hook  string
+statedir       string
+verbose        boolean
+blacklist      string list
+=============  ===========
+
+See also
+--------
+
+:manpage:`qemu(1)`
diff --git a/qemu-doc.texi b/qemu-doc.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@ so should only be used with trusted guest OS.
 
 @c man end
 
-@node QEMU Guest Agent
-@chapter QEMU Guest Agent invocation
-
-@include qemu-ga.texi
-
 @node QEMU User space emulator
 @chapter QEMU User space emulator
 
diff --git a/qemu-ga.texi b/qemu-ga.texi
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/qemu-ga.texi
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-@example
-@c man begin SYNOPSIS
-@command{qemu-ga} [@var{OPTIONS}]
-@c man end
-@end example
-
-@c man begin DESCRIPTION
-
-The QEMU Guest Agent is a daemon intended to be run within virtual
-machines. It allows the hypervisor host to perform various operations
-in the guest, such as:
-
-@itemize
-@item
-get information from the guest
-@item
-set the guest's system time
-@item
-read/write a file
-@item
-sync and freeze the filesystems
-@item
-suspend the guest
-@item
-reconfigure guest local processors
-@item
-set user's password
-@item
-...
-@end itemize
-
-qemu-ga will read a system configuration file on startup (located at
-@file{@value{CONFDIR}/qemu-ga.conf} by default), then parse remaining
-configuration options on the command line. For the same key, the last
-option wins, but the lists accumulate (see below for configuration
-file format).
-
-@c man end
-
-@c man begin OPTIONS
-@table @option
-@item -m, --method=@var{method}
-  Transport method: one of @samp{unix-listen}, @samp{virtio-serial}, or
-  @samp{isa-serial} (@samp{virtio-serial} is the default).
-
-@item -p, --path=@var{path}
-  Device/socket path (the default for virtio-serial is
-  @samp{/dev/virtio-ports/org.qemu.guest_agent.0},
-  the default for isa-serial is @samp{/dev/ttyS0})
-
-@item -l, --logfile=@var{path}
-  Set log file path (default is stderr).
-
-@item -f, --pidfile=@var{path}
-  Specify pid file (default is @samp{/var/run/qemu-ga.pid}).
-
-@item -F, --fsfreeze-hook=@var{path}
-  Enable fsfreeze hook. Accepts an optional argument that specifies
-  script to run on freeze/thaw. Script will be called with
-  'freeze'/'thaw' arguments accordingly (default is
-  @samp{@value{CONFDIR}/fsfreeze-hook}). If using -F with an argument, do
-  not follow -F with a space (for example:
-  @samp{-F/var/run/fsfreezehook.sh}).
-
-@item -t, --statedir=@var{path}
-  Specify the directory to store state information (absolute paths only,
-  default is @samp{/var/run}).
-
-@item -v, --verbose
-  Log extra debugging information.
-
-@item -V, --version
-  Print version information and exit.
-
-@item -d, --daemon
-  Daemonize after startup (detach from terminal).
-
-@item -b, --blacklist=@var{list}
-  Comma-separated list of RPCs to disable (no spaces, @samp{?} to list
-  available RPCs).
-
-@item -D, --dump-conf
-  Dump the configuration in a format compatible with @file{qemu-ga.conf}
-  and exit.
-
-@item -h, --help
-  Display this help and exit.
-@end table
-
-@c man end
-
-@c man begin FILES
-
-The syntax of the @file{qemu-ga.conf} configuration file follows the
-Desktop Entry Specification, here is a quick summary: it consists of
-groups of key-value pairs, interspersed with comments.
-
-@example
-# qemu-ga configuration sample
-[general]
-daemonize = 0
-pidfile = /var/run/qemu-ga.pid
-verbose = 0
-method = virtio-serial
-path = /dev/virtio-ports/org.qemu.guest_agent.0
-statedir = /var/run
-@end example
-
-The list of keys follows the command line options:
-@table @option
-@item daemon= boolean
-@item method= string
-@item path= string
-@item logfile= string
-@item pidfile= string
-@item fsfreeze-hook= string
-@item statedir= string
-@item verbose= boolean
-@item blacklist= string list
-@end table
-
-@c man end
-
-@ignore
-
-@setfilename qemu-ga
-@settitle QEMU Guest Agent
-
-@c man begin AUTHOR
-Michael Roth <mdroth@linux.vnet.ibm.com>
-@c man end
-
-@c man begin SEEALSO
-qemu(1)
-@c man end
-
-@end ignore
-- 
2.20.1

Hi; here's another arm pullreq; by volume most of this is
refactoring from me, but there are also some bugfixes and
other bits and pieces here.

thanks
-- PMM

The following changes since commit ed734377ab3f3f3cc15d7aa301a87ab6370f2eed:

Merge tag 'linux-user-fix-gupnp-pull-request' of https://github.com/hdeller/qemu-hppa into staging (2025-01-24 14:43:07 -0500)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250128-1

for you to fetch changes up to 664280abddcb3cacc9c6204706bb739fcc1316f7:

hw/usb/canokey: Fix buffer overflow for OUT packet (2025-01-28 18:40:19 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm: Remove various uses of first_cpu global
 * hw/char/imx_serial: Fix reset value of UFCR register
 * hw/char/imx_serial: Update all state before restarting ageing timer
 * hw/pci-host/designware: Expose MSI IRQ
 * hw/arm/stellaris: refactoring, cleanup
 * hw/arm/stellaris: map both I2C controllers
 * tests/functional: Add a test for the arm microbit machine
 * target/arm: arm_reset_sve_state() should set FPSR, not FPCR
 * target/arm: refactorings preparatory to FEAT_AFP implementation
 * fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
 * fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
 * hw/usb/canokey: Fix buffer overflow for OUT packet

----------------------------------------------------------------
Bernhard Beschow (3):
      hw/char/imx_serial: Fix reset value of UFCR register
      hw/char/imx_serial: Update all state before restarting ageing timer
      hw/pci-host/designware: Expose MSI IRQ

Hongren Zheng (1):
      hw/usb/canokey: Fix buffer overflow for OUT packet

Peter Maydell (22):
      target/arm: arm_reset_sve_state() should set FPSR, not FPCR
      target/arm: Use FPSR_ constants in vfp_exceptbits_from_host()
      target/arm: Use uint32_t in vfp_exceptbits_from_host()
      target/arm: Define new fp_status_a32 and fp_status_a64
      target/arm: Use vfp.fp_status_a64 in A64-only helper functions
      target/arm: Use fp_status_a64 or fp_status_a32 in is_ebf()
      target/arm: Use fp_status_a32 in vjvct helper
      target/arm: Use fp_status_a32 in vfp_cmp helpers
      target/arm: Use FPST_A32 in A32 decoder
      target/arm: Use FPST_A64 in A64 decoder
      target/arm: Remove now-unused vfp.fp_status and FPST_FPCR
      target/arm: Define new fp_status_f16_a32 and fp_status_f16_a64
      target/arm: Use fp_status_f16_a32 in AArch32-only helpers
      target/arm: Use fp_status_f16_a64 in AArch64-only helpers
      target/arm: Use FPST_A32_F16 in A32 decoder
      target/arm: Use FPST_A64_F16 in A64 decoder
      target/arm: Remove now-unused vfp.fp_status_f16 and FPST_FPCR_F16
      fpu: Rename float_flag_input_denormal to float_flag_input_denormal_flushed
      fpu: Rename float_flag_output_denormal to float_flag_output_denormal_flushed
      fpu: Fix a comment in softfloat-types.h
      target/arm: Remove redundant advsimd float16 helpers
      target/arm: Use FPST_A64_F16 for halfprec-to-other conversions

Philippe Mathieu-Daudé (9):
      hw/arm/nrf51: Rename ARMv7MState 'cpu' -> 'armv7m'
      hw/arm/stellaris: Add 'armv7m' local variable
      hw/arm/v7m: Remove use of &first_cpu in machine_init()
      hw/arm/stellaris: Link each board schematic
      hw/arm/stellaris: Constify read-only arrays
      hw/arm/stellaris: Remove incorrect unimplemented i2c-0 at 0x40002000
      hw/arm/stellaris: Replace magic numbers by definitions
      hw/arm/stellaris: Use DEVCAP macro to access DeviceCapability registers
      hw/arm/stellaris: Map both I2C controllers

Thomas Huth (1):
      tests/functional: Add a test for the arm microbit machine

From: Philippe Mathieu-Daudé <philmd@linaro.org>

The ARMv7MState object is not simply a CPU, it also
contains the NVIC, SysTick timer, and various MemoryRegions.

Rename the field as 'armv7m', like other Cortex-M boards.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20250112225614.33723-2-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/nrf51_soc.h |  2 +-
 hw/arm/nrf51_soc.c         | 18 +++++++++---------
 2 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/include/hw/arm/nrf51_soc.h b/include/hw/arm/nrf51_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/nrf51_soc.h
+++ b/include/hw/arm/nrf51_soc.h
@@ -XXX,XX +XXX,XX @@ struct NRF51State {
     SysBusDevice parent_obj;
 
     /*< public >*/
-    ARMv7MState cpu;
+    ARMv7MState armv7m;
 
     NRF51UARTState uart;
     NRF51RNGState rng;
diff --git a/hw/arm/nrf51_soc.c b/hw/arm/nrf51_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nrf51_soc.c
+++ b/hw/arm/nrf51_soc.c
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     /* This clock doesn't need migration because it is fixed-frequency */
     clock_set_hz(s->sysclk, HCLK_FRQ);
-    qdev_connect_clock_in(DEVICE(&s->cpu), "cpuclk", s->sysclk);
+    qdev_connect_clock_in(DEVICE(&s->armv7m), "cpuclk", s->sysclk);
     /*
      * This SoC has no systick device, so don't connect refclk.
      * TODO: model the lack of systick (currently the armv7m object
      * will always provide one).
      */
 
-    object_property_set_link(OBJECT(&s->cpu), "memory", OBJECT(&s->container),
+    object_property_set_link(OBJECT(&s->armv7m), "memory", OBJECT(&s->container),
                              &error_abort);
-    if (!sysbus_realize(SYS_BUS_DEVICE(&s->cpu), errp)) {
+    if (!sysbus_realize(SYS_BUS_DEVICE(&s->armv7m), errp)) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->uart), 0);
     memory_region_add_subregion_overlap(&s->container, NRF51_UART_BASE, mr, 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->uart), 0,
-                       qdev_get_gpio_in(DEVICE(&s->cpu),
+                       qdev_get_gpio_in(DEVICE(&s->armv7m),
                        BASE_TO_IRQ(NRF51_UART_BASE)));
 
     /* RNG */
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
     mr = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->rng), 0);
     memory_region_add_subregion_overlap(&s->container, NRF51_RNG_BASE, mr, 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->rng), 0,
-                       qdev_get_gpio_in(DEVICE(&s->cpu),
+                       qdev_get_gpio_in(DEVICE(&s->armv7m),
                        BASE_TO_IRQ(NRF51_RNG_BASE)));
 
     /* UICR, FICR, NVMC, FLASH */
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_realize(DeviceState *dev_soc, Error **errp)
 
         sysbus_mmio_map(SYS_BUS_DEVICE(&s->timer[i]), 0, base_addr);
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->timer[i]), 0,
-                           qdev_get_gpio_in(DEVICE(&s->cpu),
+                           qdev_get_gpio_in(DEVICE(&s->armv7m),
                                             BASE_TO_IRQ(base_addr)));
     }
 
@@ -XXX,XX +XXX,XX @@ static void nrf51_soc_init(Object *obj)
 
     memory_region_init(&s->container, obj, "nrf51-container", UINT64_MAX);
 
-    object_initialize_child(OBJECT(s), "armv6m", &s->cpu, TYPE_ARMV7M);
-    qdev_prop_set_string(DEVICE(&s->cpu), "cpu-type",
+    object_initialize_child(OBJECT(s), "armv6m", &s->armv7m, TYPE_ARMV7M);
+    qdev_prop_set_string(DEVICE(&s->armv7m), "cpu-type",
                          ARM_CPU_TYPE_NAME("cortex-m0"));
-    qdev_prop_set_uint32(DEVICE(&s->cpu), "num-irq", 32);
+    qdev_prop_set_uint32(DEVICE(&s->armv7m), "num-irq", 32);
 
     object_initialize_child(obj, "uart", &s->uart, TYPE_NRF51_UART);
     object_property_add_alias(obj, "serial0", OBJECT(&s->uart), "chardev");
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

While the TYPE_ARMV7M object forward its NVIC interrupt lines,
it is somehow misleading to name it 'nvic'. Add the 'armv7m'
local variable for clarity, but also keep the 'nvic' variable
behaving like before when used for wiring IRQ lines.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20250112225614.33723-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 21 +++++++++++----------
 1 file changed, 11 insertions(+), 10 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      */
 
     Object *soc_container;
-    DeviceState *gpio_dev[7], *nvic;
+    DeviceState *gpio_dev[7], *armv7m, *nvic;
     qemu_irq gpio_in[7][8];
     qemu_irq gpio_out[7][8];
     qemu_irq adc;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     qdev_prop_set_uint32(ssys_dev, "dc4", board->dc4);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(ssys_dev), &error_fatal);
 
-    nvic = qdev_new(TYPE_ARMV7M);
-    object_property_add_child(soc_container, "v7m", OBJECT(nvic));
-    qdev_prop_set_uint32(nvic, "num-irq", NUM_IRQ_LINES);
-    qdev_prop_set_uint8(nvic, "num-prio-bits", NUM_PRIO_BITS);
-    qdev_prop_set_string(nvic, "cpu-type", ms->cpu_type);
-    qdev_prop_set_bit(nvic, "enable-bitband", true);
-    qdev_connect_clock_in(nvic, "cpuclk",
+    armv7m = qdev_new(TYPE_ARMV7M);
+    object_property_add_child(soc_container, "v7m", OBJECT(armv7m));
+    qdev_prop_set_uint32(armv7m, "num-irq", NUM_IRQ_LINES);
+    qdev_prop_set_uint8(armv7m, "num-prio-bits", NUM_PRIO_BITS);
+    qdev_prop_set_string(armv7m, "cpu-type", ms->cpu_type);
+    qdev_prop_set_bit(armv7m, "enable-bitband", true);
+    qdev_connect_clock_in(armv7m, "cpuclk",
                           qdev_get_clock_out(ssys_dev, "SYSCLK"));
     /* This SoC does not connect the systick reference clock */
-    object_property_set_link(OBJECT(nvic), "memory",
+    object_property_set_link(OBJECT(armv7m), "memory",
                              OBJECT(get_system_memory()), &error_abort);
     /* This will exit with an error if the user passed us a bad cpu_type */
-    sysbus_realize_and_unref(SYS_BUS_DEVICE(nvic), &error_fatal);
+    sysbus_realize_and_unref(SYS_BUS_DEVICE(armv7m), &error_fatal);
+    nvic = armv7m;
 
     /* Now we can wire up the IRQ and MMIO of the system registers */
     sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

When instanciating the machine model, the machine_init()
implementations usually create the CPUs, so have access
to its first CPU. Use that rather then the &first_cpu
global.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Samuel Tardieu <sam@rfc1149.net>
Message-id: 20250112225614.33723-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/b-l475e-iot01a.c    | 2 +-
 hw/arm/microbit.c          | 2 +-
 hw/arm/mps2-tz.c           | 2 +-
 hw/arm/mps2.c              | 2 +-
 hw/arm/msf2-som.c          | 2 +-
 hw/arm/musca.c             | 2 +-
 hw/arm/netduino2.c         | 2 +-
 hw/arm/netduinoplus2.c     | 2 +-
 hw/arm/olimex-stm32-h405.c | 2 +-
 hw/arm/stellaris.c         | 2 +-
 hw/arm/stm32vldiscovery.c  | 2 +-
 11 files changed, 11 insertions(+), 11 deletions(-)

diff --git a/hw/arm/b-l475e-iot01a.c b/hw/arm/b-l475e-iot01a.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/b-l475e-iot01a.c
+++ b/hw/arm/b-l475e-iot01a.c
@@ -XXX,XX +XXX,XX @@ static void bl475e_init(MachineState *machine)
     sysbus_realize(SYS_BUS_DEVICE(&s->soc), &error_fatal);
 
     sc = STM32L4X5_SOC_GET_CLASS(&s->soc);
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename, 0,
+    armv7m_load_kernel(s->soc.armv7m.cpu, machine->kernel_filename, 0,
                        sc->flash_size);
 
     if (object_class_by_name(TYPE_DM163)) {
diff --git a/hw/arm/microbit.c b/hw/arm/microbit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/microbit.c
+++ b/hw/arm/microbit.c
@@ -XXX,XX +XXX,XX @@ static void microbit_init(MachineState *machine)
     memory_region_add_subregion_overlap(&s->nrf51.container, NRF51_TWI_BASE,
                                         mr, -1);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(s->nrf51.armv7m.cpu, machine->kernel_filename,
                        0, s->nrf51.flash_size);
 }
 
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                                     mms->remap_irq);
     }
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(mms->iotkit.armv7m[0].cpu, machine->kernel_filename,
                        0, boot_ram_size(mms));
 }
 
diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                  qdev_get_gpio_in(armv7m,
                                   mmc->fpga_type == FPGA_AN511 ? 47 : 13));
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(mms->armv7m.cpu, machine->kernel_filename,
                        0, 0x400000);
 }
 
diff --git a/hw/arm/msf2-som.c b/hw/arm/msf2-som.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/msf2-som.c
+++ b/hw/arm/msf2-som.c
@@ -XXX,XX +XXX,XX @@ static void emcraft_sf2_s2s010_init(MachineState *machine)
     cs_line = qdev_get_gpio_in_named(spi_flash, SSI_GPIO_CS, 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&soc->spi[0]), 1, cs_line);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(soc->armv7m.cpu, machine->kernel_filename,
                        0, soc->envm_size);
 }
 
diff --git a/hw/arm/musca.c b/hw/arm/musca.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musca.c
+++ b/hw/arm/musca.c
@@ -XXX,XX +XXX,XX @@ static void musca_init(MachineState *machine)
                                                      "cfg_sec_resp", 0));
     }
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(mms->sse.armv7m[0].cpu, machine->kernel_filename,
                        0, 0x2000000);
 }
 
diff --git a/hw/arm/netduino2.c b/hw/arm/netduino2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduino2.c
+++ b/hw/arm/netduino2.c
@@ -XXX,XX +XXX,XX @@ static void netduino2_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), machine->kernel_filename,
+    armv7m_load_kernel(STM32F205_SOC(dev)->armv7m.cpu, machine->kernel_filename,
                        0, FLASH_SIZE);
 }
 
diff --git a/hw/arm/netduinoplus2.c b/hw/arm/netduinoplus2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/netduinoplus2.c
+++ b/hw/arm/netduinoplus2.c
@@ -XXX,XX +XXX,XX @@ static void netduinoplus2_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu),
+    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                        machine->kernel_filename,
                        0, FLASH_SIZE);
 }
diff --git a/hw/arm/olimex-stm32-h405.c b/hw/arm/olimex-stm32-h405.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/olimex-stm32-h405.c
+++ b/hw/arm/olimex-stm32-h405.c
@@ -XXX,XX +XXX,XX @@ static void olimex_stm32_h405_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu),
+    armv7m_load_kernel(STM32F405_SOC(dev)->armv7m.cpu,
                        machine->kernel_filename,
                        0, FLASH_SIZE);
 }
diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     create_unimplemented_device("hibernation", 0x400fc000, 0x1000);
     create_unimplemented_device("flash-control", 0x400fd000, 0x1000);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu), ms->kernel_filename, 0, flash_size);
+    armv7m_load_kernel(ARMV7M(armv7m)->cpu, ms->kernel_filename, 0, flash_size);
 }
 
 /* FIXME: Figure out how to generate these from stellaris_boards.  */
diff --git a/hw/arm/stm32vldiscovery.c b/hw/arm/stm32vldiscovery.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32vldiscovery.c
+++ b/hw/arm/stm32vldiscovery.c
@@ -XXX,XX +XXX,XX @@ static void stm32vldiscovery_init(MachineState *machine)
     qdev_connect_clock_in(dev, "sysclk", sysclk);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
 
-    armv7m_load_kernel(ARM_CPU(first_cpu),
+    armv7m_load_kernel(STM32F100_SOC(dev)->armv7m.cpu,
                        machine->kernel_filename,
                        0, FLASH_SIZE);
 }
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

The value of the UCFR register is respected when echoing characters to the
terminal, but its reset value is reserved. Fix the reset value to the one
documented in the datasheet.

While at it move the related attribute out of the section of unimplemented
registers since its value is actually respected.

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -XXX,XX +XXX,XX @@ struct IMXSerialState {
     uint32_t ucr1;
     uint32_t ucr2;
     uint32_t uts1;
+    uint32_t ufcr;
 
     /*
      * The registers below are implemented just so that the
      * guest OS sees what it has written
      */
     uint32_t onems;
-    uint32_t ufcr;
     uint32_t ubmr;
     uint32_t ubrc;
     uint32_t ucr3;
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static void imx_serial_reset(IMXSerialState *s)
     s->ucr3 = 0x700;
     s->ubmr = 0;
     s->ubrc = 4;
+    s->ufcr = BIT(11) | BIT(0);
 
     fifo32_reset(&s->rx_fifo);
     timer_del(&s->ageing_timer);
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

Fixes characters to be "echoed" after each keystroke rather than after every
other since imx_serial_rx_fifo_ageing_timer_restart() would see ~UTS1_RXEMPTY
only after every other keystroke.

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static void imx_put_data(void *opaque, uint32_t value)
     if (fifo32_num_used(&s->rx_fifo) >= rxtl) {
         s->usr1 |= USR1_RRDY;
     }
-
-    imx_serial_rx_fifo_ageing_timer_restart(s);
-
     s->usr2 |= USR2_RDR;
     s->uts1 &= ~UTS1_RXEMPTY;
     if (value & URXD_BRK) {
         s->usr2 |= USR2_BRCD;
     }
+
+    imx_serial_rx_fifo_ageing_timer_restart(s);
+
     imx_update(s);
 }
 
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

Fixes INTD and MSI interrupts poking the same IRQ line without keeping track of
each other's IRQ level. Furthermore, SoCs such as the i.MX 8M Plus don't share
the MSI IRQ with the INTx lines, so expose it as a dedicated pin.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h        |  4 +++-
 include/hw/arm/fsl-imx7.h        |  4 +++-
 include/hw/pci-host/designware.h |  1 +
 hw/arm/fsl-imx6.c                | 13 ++++++++++++-
 hw/arm/fsl-imx7.c                | 13 ++++++++++++-
 hw/pci-host/designware.c         |  7 +++----
 hw/arm/Kconfig                   |  2 ++
 7 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/usb/chipidea.h"
 #include "hw/usb/imx-usb-phy.h"
 #include "hw/pci-host/designware.h"
+#include "hw/or-irq.h"
 #include "exec/memory.h"
 #include "cpu.h"
 #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
     ChipideaState      usb[FSL_IMX6_NUM_USBS];
     IMXFECState        eth;
     DesignwarePCIEHost pcie;
+    OrIRQState         pcie4_msi_irq;
     MemoryRegion       rom;
     MemoryRegion       caam;
     MemoryRegion       ocram;
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
 #define FSL_IMX6_PCIE1_IRQ 120
 #define FSL_IMX6_PCIE2_IRQ 121
 #define FSL_IMX6_PCIE3_IRQ 122
-#define FSL_IMX6_PCIE4_IRQ 123
+#define FSL_IMX6_PCIE4_MSI_IRQ 123
 #define FSL_IMX6_DCIC1_IRQ 124
 #define FSL_IMX6_DCIC2_IRQ 125
 #define FSL_IMX6_MLB150_HIGH_IRQ 126
diff --git a/include/hw/arm/fsl-imx7.h b/include/hw/arm/fsl-imx7.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx7.h
+++ b/include/hw/arm/fsl-imx7.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/net/imx_fec.h"
 #include "hw/pci-host/designware.h"
 #include "hw/usb/chipidea.h"
+#include "hw/or-irq.h"
 #include "cpu.h"
 #include "qom/object.h"
 #include "qemu/units.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX7State {
     IMX7GPRState       gpr;
     ChipideaState      usb[FSL_IMX7_NUM_USBS];
     DesignwarePCIEHost pcie;
+    OrIRQState         pcie4_msi_irq;
     MemoryRegion       rom;
     MemoryRegion       caam;
     MemoryRegion       ocram;
@@ -XXX,XX +XXX,XX @@ enum FslIMX7IRQs {
     FSL_IMX7_PCI_INTA_IRQ = 125,
     FSL_IMX7_PCI_INTB_IRQ = 124,
     FSL_IMX7_PCI_INTC_IRQ = 123,
-    FSL_IMX7_PCI_INTD_IRQ = 122,
+    FSL_IMX7_PCI_INTD_MSI_IRQ = 122,
 
     FSL_IMX7_UART7_IRQ    = 126,
 
diff --git a/include/hw/pci-host/designware.h b/include/hw/pci-host/designware.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci-host/designware.h
+++ b/include/hw/pci-host/designware.h
@@ -XXX,XX +XXX,XX @@ struct DesignwarePCIEHost {
         MemoryRegion io;
 
         qemu_irq     irqs[4];
+        qemu_irq     msi;
     } pci;
 
     MemoryRegion mmio;
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
     object_initialize_child(obj, "eth", &s->eth, TYPE_IMX_ENET);
 
     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
+    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
+                            TYPE_OR_IRQ);
 }
 
 static void fsl_imx6_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX6_PCIe_REG_ADDR);
 
+    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
+                            &error_abort);
+    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
+
+    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_MSI_IRQ);
+    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
+
     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE1_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE2_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE3_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
-    irq = qdev_get_gpio_in(DEVICE(&s->a9mpcore), FSL_IMX6_PCIE4_IRQ);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
 
     /*
      * PCIe PHY
diff --git a/hw/arm/fsl-imx7.c b/hw/arm/fsl-imx7.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx7.c
+++ b/hw/arm/fsl-imx7.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_init(Object *obj)
      * PCIE
      */
     object_initialize_child(obj, "pcie", &s->pcie, TYPE_DESIGNWARE_PCIE_HOST);
+    object_initialize_child(obj, "pcie4-msi-irq", &s->pcie4_msi_irq,
+                            TYPE_OR_IRQ);
 
     /*
      * USBs
@@ -XXX,XX +XXX,XX @@ static void fsl_imx7_realize(DeviceState *dev, Error **errp)
     sysbus_realize(SYS_BUS_DEVICE(&s->pcie), &error_abort);
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->pcie), 0, FSL_IMX7_PCIE_REG_ADDR);
 
+    object_property_set_int(OBJECT(&s->pcie4_msi_irq), "num-lines", 2,
+                            &error_abort);
+    qdev_realize(DEVICE(&s->pcie4_msi_irq), NULL, &error_abort);
+
+    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_MSI_IRQ);
+    qdev_connect_gpio_out(DEVICE(&s->pcie4_msi_irq), 0, irq);
+
     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTA_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 0, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTB_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 1, irq);
     irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTC_IRQ);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 2, irq);
-    irq = qdev_get_gpio_in(DEVICE(&s->a7mpcore), FSL_IMX7_PCI_INTD_IRQ);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 0);
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 3, irq);
+    irq = qdev_get_gpio_in(DEVICE(&s->pcie4_msi_irq), 1);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pcie), 4, irq);
 
     /*
      * USBs
diff --git a/hw/pci-host/designware.c b/hw/pci-host/designware.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci-host/designware.c
+++ b/hw/pci-host/designware.c
@@ -XXX,XX +XXX,XX @@
 #define DESIGNWARE_PCIE_ATU_DEVFN(x)               (((x) >> 16) & 0xff)
 #define DESIGNWARE_PCIE_ATU_UPPER_TARGET           0x91C
 
-#define DESIGNWARE_PCIE_IRQ_MSI                    3
-
 static DesignwarePCIEHost *
 designware_pcie_root_to_host(DesignwarePCIERoot *root)
 {
@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_msi_write(void *opaque, hwaddr addr,
     root->msi.intr[0].status |= BIT(val) & root->msi.intr[0].enable;
 
     if (root->msi.intr[0].status & ~root->msi.intr[0].mask) {
-        qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 1);
+        qemu_set_irq(host->pci.msi, 1);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void designware_pcie_root_config_write(PCIDevice *d, uint32_t address,
     case DESIGNWARE_PCIE_MSI_INTR0_STATUS:
         root->msi.intr[0].status ^= val;
         if (!root->msi.intr[0].status) {
-            qemu_set_irq(host->pci.irqs[DESIGNWARE_PCIE_IRQ_MSI], 0);
+            qemu_set_irq(host->pci.msi, 0);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static void designware_pcie_host_realize(DeviceState *dev, Error **errp)
     for (i = 0; i < ARRAY_SIZE(s->pci.irqs); i++) {
         sysbus_init_irq(sbd, &s->pci.irqs[i]);
     }
+    sysbus_init_irq(sbd, &s->pci.msi);
 
     memory_region_init_io(&s->mmio,
                           OBJECT(s),
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
     select PL310  # cache controller
     select PCI_EXPRESS_DESIGNWARE
     select SDHCI
+    select OR_IRQ
 
 config ASPEED_SOC
     bool
@@ -XXX,XX +XXX,XX @@ config FSL_IMX7
     select WDT_IMX2
     select PCI_EXPRESS_DESIGNWARE
     select SDHCI
+    select OR_IRQ
     select UNIMP
 
 config ARM_SMMUV3
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Board schematic is useful to corroborate GPIOs/IRQs wiring.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-2-philmd@linaro.org
[PMM: Use https:// URLs]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void lm3s6965evb_init(MachineState *machine)
     stellaris_init(machine, &stellaris_boards[1]);
 }
 
+/*
+ * Stellaris LM3S811 Evaluation Board Schematics:
+ * https://www.ti.com/lit/ug/symlink/spmu030.pdf
+ */
 static void lm3s811evb_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo lm3s811evb_type = {
     .class_init = lm3s811evb_class_init,
 };
 
+/*
+ * Stellaris: LM3S6965 Evaluation Board Schematics:
+ * https://www.ti.com/lit/ug/symlink/spmu029.pdf
+ */
 static void lm3s6965evb_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void ssys_update(ssys_state *s)
   qemu_set_irq(s->irq, (s->int_status & s->int_mask) != 0);
 }
 
-static uint32_t pllcfg_sandstorm[16] = {
+static const uint32_t pllcfg_sandstorm[16] = {
     0x31c0, /* 1 Mhz */
     0x1ae0, /* 1.8432 Mhz */
     0x18c0, /* 2 Mhz */
@@ -XXX,XX +XXX,XX @@ static uint32_t pllcfg_sandstorm[16] = {
     0x585b /* 8.192 Mhz */
 };
 
-static uint32_t pllcfg_fury[16] = {
+static const uint32_t pllcfg_fury[16] = {
     0x3200, /* 1 Mhz */
     0x1b20, /* 1.8432 Mhz */
     0x1900, /* 2 Mhz */
@@ -XXX,XX +XXX,XX @@ static void stellaris_adc_init(Object *obj)
 }
 
 /* Board init.  */
-static stellaris_board_info stellaris_boards[] = {
+static const stellaris_board_info stellaris_boards[] = {
   { "LM3S811EVB",
     0,
     0x0032000e,
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

There is nothing mapped at 0x40002000.

I2C#0 is already mapped at 0x40021000.

Remove the invalid mapping added in commits aecfbbc97a2 & 394c8bbfb7a.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 2 --
 1 file changed, 2 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      * http://www.ti.com/lit/ds/symlink/lm3s6965.pdf
      *
      * 40000000 wdtimer
-     * 40002000 i2c (unimplemented)
      * 40004000 GPIO
      * 40005000 GPIO
      * 40006000 GPIO
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     /* Add dummy regions for the devices we don't implement yet,
      * so guest accesses don't cause unlogged crashes.
      */
-    create_unimplemented_device("i2c-0", 0x40002000, 0x1000);
     create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
     create_unimplemented_device("PWM", 0x40028000, 0x1000);
     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Add definitions for the number of controllers.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-5-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
 #define NUM_IRQ_LINES 64
 #define NUM_PRIO_BITS 3
 
+#define NUM_GPIO    7
+#define NUM_UART    4
+#define NUM_GPTM    4
+#define NUM_I2C     2
+
 typedef const struct {
     const char *name;
     uint32_t did0;
@@ -XXX,XX +XXX,XX @@ static const stellaris_board_info stellaris_boards[] = {
 
 static void stellaris_init(MachineState *ms, stellaris_board_info *board)
 {
-    static const int uart_irq[] = {5, 6, 33, 34};
-    static const int timer_irq[] = {19, 21, 23, 35};
-    static const uint32_t gpio_addr[7] =
+    static const int uart_irq[NUM_UART] = {5, 6, 33, 34};
+    static const int timer_irq[NUM_GPTM] = {19, 21, 23, 35};
+    static const uint32_t gpio_addr[NUM_GPIO] =
       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
         0x40024000, 0x40025000, 0x40026000};
-    static const int gpio_irq[7] = {0, 1, 2, 3, 4, 30, 31};
+    static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
 
     /* Memory map of SoC devices, from
      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
      */
 
     Object *soc_container;
-    DeviceState *gpio_dev[7], *armv7m, *nvic;
-    qemu_irq gpio_in[7][8];
-    qemu_irq gpio_out[7][8];
+    DeviceState *gpio_dev[NUM_GPIO], *armv7m, *nvic;
+    qemu_irq gpio_in[NUM_GPIO][8];
+    qemu_irq gpio_out[NUM_GPIO][8];
     qemu_irq adc;
     int sram_size;
     int flash_size;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     } else {
         adc = NULL;
     }
-    for (i = 0; i < 4; i++) {
+    for (i = 0; i < NUM_GPTM; i++) {
         if (board->dc2 & (0x10000 << i)) {
             SysBusDevice *sbd;
 
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     }
 
 
-    for (i = 0; i < 7; i++) {
+    for (i = 0; i < NUM_GPIO; i++) {
         if (board->dc4 & (1 << i)) {
             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
                                                qdev_get_gpio_in(nvic,
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    for (i = 0; i < 4; i++) {
+    for (i = 0; i < NUM_UART; i++) {
         if (board->dc2 & (1 << i)) {
             SysBusDevice *sbd;
 
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Add definitions (DCx_periph) for the DeviceCapability bits,
replace direct bitmask checks with the DEV_CAP() macro,
which use the extract/deposit API.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-6-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 37 +++++++++++++++++++++++++++++--------
 1 file changed, 29 insertions(+), 8 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "qapi/error.h"
 #include "hw/core/split-irq.h"
 #include "hw/sysbus.h"
@@ -XXX,XX +XXX,XX @@
 #define NUM_GPTM    4
 #define NUM_I2C     2
 
+/*
+ * See Stellaris Data Sheet chapter 5.2.5 "System Control",
+ * Register 13 .. 17: Device Capabilities 0 .. 4 (DC0 .. DC4).
+ */
+#define DC1_WDT          3
+#define DC1_HIB          6
+#define DC1_MPU          7
+#define DC1_ADC          16
+#define DC1_PWM          20
+#define DC2_UART(n)     (n)
+#define DC2_SSI          4
+#define DC2_QEI(n)      (8 + n)
+#define DC2_I2C(n)      (12 + 2 * n)
+#define DC2_GPTM(n)     (16 + n)
+#define DC2_COMP(n)     (24 + n)
+#define DC4_GPIO(n)     (n)
+#define DC4_EMAC         28
+
+#define DEV_CAP(_dc, _cap) extract32(board->dc##_dc, DC##_dc##_##_cap, 1)
+
 typedef const struct {
     const char *name;
     uint32_t did0;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     sysbus_mmio_map(SYS_BUS_DEVICE(ssys_dev), 0, 0x400fe000);
     sysbus_connect_irq(SYS_BUS_DEVICE(ssys_dev), 0, qdev_get_gpio_in(nvic, 28));
 
-    if (board->dc1 & (1 << 16)) {
+    if (DEV_CAP(1, ADC)) {
         dev = sysbus_create_varargs(TYPE_STELLARIS_ADC, 0x40038000,
                                     qdev_get_gpio_in(nvic, 14),
                                     qdev_get_gpio_in(nvic, 15),
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         adc = NULL;
     }
     for (i = 0; i < NUM_GPTM; i++) {
-        if (board->dc2 & (0x10000 << i)) {
+        if (DEV_CAP(2, GPTM(i))) {
             SysBusDevice *sbd;
 
             dev = qdev_new(TYPE_STELLARIS_GPTM);
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    if (board->dc1 & (1 << 3)) { /* watchdog present */
+    if (DEV_CAP(1, WDT)) {
         dev = qdev_new(TYPE_LUMINARY_WATCHDOG);
         object_property_add_child(soc_container, "wdg", OBJECT(dev));
         qdev_connect_clock_in(dev, "WDOGCLK",
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
 
 
     for (i = 0; i < NUM_GPIO; i++) {
-        if (board->dc4 & (1 << i)) {
+        if (DEV_CAP(4, GPIO(i))) {
             gpio_dev[i] = sysbus_create_simple("pl061_luminary", gpio_addr[i],
                                                qdev_get_gpio_in(nvic,
                                                                 gpio_irq[i]));
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    if (board->dc2 & (1 << 12)) {
+    if (DEV_CAP(2, I2C(0))) {
         dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
                                    qdev_get_gpio_in(nvic, 8));
         i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     }
 
     for (i = 0; i < NUM_UART; i++) {
-        if (board->dc2 & (1 << i)) {
+        if (DEV_CAP(2, UART(i))) {
             SysBusDevice *sbd;
 
             dev = qdev_new("pl011_luminary");
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
             sysbus_connect_irq(sbd, 0, qdev_get_gpio_in(nvic, uart_irq[i]));
         }
     }
-    if (board->dc2 & (1 << 4)) {
+    if (DEV_CAP(2, SSI)) {
         dev = sysbus_create_simple("pl022", 0x40008000,
                                    qdev_get_gpio_in(nvic, 7));
         if (board->peripherals & BP_OLED_SSI) {
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
             qemu_irq_raise(gpio_out[GPIO_D][0]);
         }
     }
-    if (board->dc4 & (1 << 28)) {
+    if (DEV_CAP(4, EMAC)) {
         DeviceState *enet;
 
         enet = qdev_new("stellaris_enet");
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

There are 2 I2C controllers, map them both, removing
the unimplemented one. Keep the OLED controller on the
first I2C bus.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250110160204.74997-7-philmd@linaro.org
[PMM: tweak to appease maybe-use-uninitialized warning]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/stellaris.c | 21 +++++++++++++--------
 1 file changed, 13 insertions(+), 8 deletions(-)

diff --git a/hw/arm/stellaris.c b/hw/arm/stellaris.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stellaris.c
+++ b/hw/arm/stellaris.c
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
       { 0x40004000, 0x40005000, 0x40006000, 0x40007000,
         0x40024000, 0x40025000, 0x40026000};
     static const int gpio_irq[NUM_GPIO] = {0, 1, 2, 3, 4, 30, 31};
+    static const uint32_t i2c_addr[NUM_I2C] = {0x40020000, 0x40021000};
+    static const int i2c_irq[NUM_I2C] = {8, 37};
 
     /* Memory map of SoC devices, from
      * Stellaris LM3S6965 Microcontroller Data Sheet (rev I)
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     qemu_irq adc;
     int sram_size;
     int flash_size;
-    I2CBus *i2c;
+    DeviceState *i2c_dev[NUM_I2C] = { };
     DeviceState *dev;
     DeviceState *ssys_dev;
     int i;
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
         }
     }
 
-    if (DEV_CAP(2, I2C(0))) {
-        dev = sysbus_create_simple(TYPE_STELLARIS_I2C, 0x40020000,
-                                   qdev_get_gpio_in(nvic, 8));
-        i2c = (I2CBus *)qdev_get_child_bus(dev, "i2c");
-        if (board->peripherals & BP_OLED_I2C) {
-            i2c_slave_create_simple(i2c, "ssd0303", 0x3d);
+    for (i = 0; i < NUM_I2C; i++) {
+        if (DEV_CAP(2, I2C(i))) {
+            i2c_dev[i] = sysbus_create_simple(TYPE_STELLARIS_I2C, i2c_addr[i],
+                                              qdev_get_gpio_in(nvic,
+                                                               i2c_irq[i]));
         }
     }
+    if (board->peripherals & BP_OLED_I2C) {
+        I2CBus *bus = (I2CBus *)qdev_get_child_bus(i2c_dev[0], "i2c");
+
+        i2c_slave_create_simple(bus, "ssd0303", 0x3d);
+    }
 
     for (i = 0; i < NUM_UART; i++) {
         if (DEV_CAP(2, UART(i))) {
@@ -XXX,XX +XXX,XX @@ static void stellaris_init(MachineState *ms, stellaris_board_info *board)
     /* Add dummy regions for the devices we don't implement yet,
      * so guest accesses don't cause unlogged crashes.
      */
-    create_unimplemented_device("i2c-2", 0x40021000, 0x1000);
     create_unimplemented_device("PWM", 0x40028000, 0x1000);
     create_unimplemented_device("QEI-0", 0x4002c000, 0x1000);
     create_unimplemented_device("QEI-1", 0x4002d000, 0x1000);
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

We don't have any functional tests for this machine yet, thus let's
add a test with a MicroPython binary that is available online
(thanks to Joel Stanley for providing it, see:
 https://www.mail-archive.com/qemu-devel@nongnu.org/msg606064.html ).

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20250124101709.1591761-1-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                           |  1 +
 tests/functional/meson.build          |  1 +
 tests/functional/test_arm_microbit.py | 31 +++++++++++++++++++++++++++
 3 files changed, 33 insertions(+)
 create mode 100755 tests/functional/test_arm_microbit.py

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/*/microbit*.c
 F: include/hw/*/nrf51*.h
 F: include/hw/*/microbit*.h
 F: tests/qtest/microbit-test.c
+F: tests/functional/test_arm_microbit.py
 F: docs/system/arm/nrf.rst
 
 ARM PL011 Rust device
diff --git a/tests/functional/meson.build b/tests/functional/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/functional/meson.build
+++ b/tests/functional/meson.build
@@ -XXX,XX +XXX,XX @@ tests_arm_system_thorough = [
   'arm_cubieboard',
   'arm_emcraft_sf2',
   'arm_integratorcp',
+  'arm_microbit',
   'arm_orangepi',
   'arm_quanta_gsj',
   'arm_raspi2',
diff --git a/tests/functional/test_arm_microbit.py b/tests/functional/test_arm_microbit.py
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/functional/test_arm_microbit.py
@@ -XXX,XX +XXX,XX @@
+#!/usr/bin/env python3
+#
+# SPDX-License-Identifier: GPL-2.0-or-later
+#
+# Copyright 2025, The QEMU Project Developers.
+#
+# A functional test that runs MicroPython on the arm microbit machine.
+
+from qemu_test import QemuSystemTest, Asset, exec_command_and_wait_for_pattern
+from qemu_test import wait_for_console_pattern
+
+
+class MicrobitMachine(QemuSystemTest):
+
+    ASSET_MICRO = Asset('https://ozlabs.org/~joel/microbit-micropython.hex',
+        '021641f93dfb11767d4978dbb3ca7f475d1b13c69e7f4aec3382f212636bffd6')
+
+    def test_arm_microbit(self):
+        self.set_machine('microbit')
+
+        micropython = self.ASSET_MICRO.fetch()
+        self.vm.set_console()
+        self.vm.add_args('-device', f'loader,file={micropython}')
+        self.vm.launch()
+        wait_for_console_pattern(self, 'Type "help()" for more information.')
+        exec_command_and_wait_for_pattern(self, 'import machine as mch', '>>>')
+        exec_command_and_wait_for_pattern(self, 'mch.reset()', 'MicroPython')
+        wait_for_console_pattern(self, '>>>')
+
+if __name__ == '__main__':
+    QemuSystemTest.main()
-- 
2.34.1

The pseudocode ResetSVEState() does:
    FPSR = ZeroExtend(0x0800009f<31:0>, 64);
but QEMU's arm_reset_sve_state() called vfp_set_fpcr() by accident.

Before the advent of FEAT_AFP, this was only setting a collection of
RES0 bits, which vfp_set_fpsr() would then ignore, so the only effect
was that we didn't actually set the FPSR the way we are supposed to
do.  Once FEAT_AFP is implemented, setting the bottom bits of FPSR
will change the floating point behaviour.

Call vfp_set_fpsr(), as we ought to.

(Note for stable backports: commit 7f2a01e7368f9 moved this function
from sme_helper.c to helper.c, but it had the same bug before the
move too.)

Cc: qemu-stable@nongnu.org
Fixes: f84734b87461 ("target/arm: Implement SMSTART, SMSTOP")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-4-peter.maydell@linaro.org
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void arm_reset_sve_state(CPUARMState *env)
     memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
     /* Recall that FFR is stored as pregs[16]. */
     memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
-    vfp_set_fpcr(env, 0x0800009f);
+    vfp_set_fpsr(env, 0x0800009f);
 }
 
 void aarch64_set_svcr(CPUARMState *env, uint64_t new, uint64_t mask)
-- 
2.34.1

Use the FPSR_ named constants in vfp_exceptbits_from_host(),
rather than hardcoded magic numbers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-5-peter.maydell@linaro.org
---
 target/arm/vfp_helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int vfp_exceptbits_from_host(int host_bits)
     int target_bits = 0;
 
     if (host_bits & float_flag_invalid) {
-        target_bits |= 1;
+        target_bits |= FPSR_IOC;
     }
     if (host_bits & float_flag_divbyzero) {
-        target_bits |= 2;
+        target_bits |= FPSR_DZC;
     }
     if (host_bits & float_flag_overflow) {
-        target_bits |= 4;
+        target_bits |= FPSR_OFC;
     }
     if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
-        target_bits |= 8;
+        target_bits |= FPSR_UFC;
     }
     if (host_bits & float_flag_inexact) {
-        target_bits |= 0x10;
+        target_bits |= FPSR_IXC;
     }
     if (host_bits & float_flag_input_denormal) {
-        target_bits |= 0x80;
+        target_bits |= FPSR_IDC;
     }
     return target_bits;
 }
-- 
2.34.1

In vfp_exceptbits_from_host(), we accumulate the FPSR flags in
an "int", and our return type is also "int". However, the only
callsite returns the same information as a uint32_t, and
more generally we handle FPSR values in the code as uint32_t,
not int. Bring this function in to line with that convention.

There is no behaviour change because none of the FPSR bits
we set in this function are bit 31. The input argument to
the function remains 'int' because that is the return type
of the softfloat get_float_exception_flags().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-6-peter.maydell@linaro.org
---
 target/arm/vfp_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@
 #ifdef CONFIG_TCG
 
 /* Convert host exception flags to vfp form.  */
-static inline int vfp_exceptbits_from_host(int host_bits)
+static inline uint32_t vfp_exceptbits_from_host(int host_bits)
 {
-    int target_bits = 0;
+    uint32_t target_bits = 0;
 
     if (host_bits & float_flag_invalid) {
         target_bits |= FPSR_IOC;
-- 
2.34.1

We want to split the existing fp_status in the Arm CPUState into
separate float_status fields for AArch32 and AArch64.  (This is
because new control bits defined by FEAT_AFP only have an effect for
AArch64, not AArch32.) To make this split we will:
 * define new fp_status_a32 and fp_status_a64 which have
   identical behaviour to the existing fp_status
 * move existing uses of fp_status to fp_status_a32 or
   fp_status_a64 as appropriate
 * delete the old fp_status when it has no uses left

In this patch we add the new float_status fields.

We will also need to split fp_status_f16, but we will do that
as a separate series of patches.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-7-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  4 ++++
 target/arm/tcg/translate.h | 12 ++++++++++++
 target/arm/cpu.c           |  2 ++
 target/arm/vfp_helper.c    | 12 ++++++++++++
 4 files changed, 30 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         /* There are a number of distinct float control structures:
          *
          *  fp_status: is the "normal" fp status.
+         *  fp_status_a32: is the "normal" fp status for AArch32 insns
+         *  fp_status_a64: is the "normal" fp status for AArch64 insns
          *  fp_status_fp16: used for half-precision calculations
          *  standard_fp_status : the ARM "Standard FPSCR Value"
          *  standard_fp_status_fp16 : used for half-precision
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          * an explicit FPSCR read.
          */
         float_status fp_status;
+        float_status fp_status_a32;
+        float_status fp_status_a64;
         float_status fp_status_f16;
         float_status standard_fp_status;
         float_status standard_fp_status_f16;
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
  */
 typedef enum ARMFPStatusFlavour {
     FPST_FPCR,
+    FPST_A32,
+    FPST_A64,
     FPST_FPCR_F16,
     FPST_STD,
     FPST_STD_F16,
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  *
  * FPST_FPCR
  *   for non-FP16 operations controlled by the FPCR
+ * FPST_A32
+ *   for AArch32 non-FP16 operations controlled by the FPCR
+ * FPST_A64
+ *   for AArch64 non-FP16 operations controlled by the FPCR
  * FPST_FPCR_F16
  *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_STD
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     case FPST_FPCR:
         offset = offsetof(CPUARMState, vfp.fp_status);
         break;
+    case FPST_A32:
+        offset = offsetof(CPUARMState, vfp.fp_status_a32);
+        break;
+    case FPST_A64:
+        offset = offsetof(CPUARMState, vfp.fp_status_a64);
+        break;
     case FPST_FPCR_F16:
         offset = offsetof(CPUARMState, vfp.fp_status_f16);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     set_default_nan_mode(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
     arm_set_default_fp_behaviours(&env->vfp.fp_status);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     uint32_t i;
 
     i = get_float_exception_flags(&env->vfp.fp_status);
+    i |= get_float_exception_flags(&env->vfp.fp_status_a32);
+    i |= get_float_exception_flags(&env->vfp.fp_status_a64);
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
     /* FZ16 does not generate an input denormal exception.  */
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      * be the architecturally up-to-date exception flag information first.
      */
     set_float_exception_flags(0, &env->vfp.fp_status);
+    set_float_exception_flags(0, &env->vfp.fp_status_a32);
+    set_float_exception_flags(0, &env->vfp.fp_status_a64);
     set_float_exception_flags(0, &env->vfp.fp_status_f16);
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
             break;
         }
         set_float_rounding_mode(i, &env->vfp.fp_status);
+        set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+        set_float_rounding_mode(i, &env->vfp.fp_status_a64);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
     }
     if (changed & FPCR_FZ16) {
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         bool ftz_enabled = val & FPCR_FZ;
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
     }
     if (changed & FPCR_DN) {
         bool dnan_enabled = val & FPCR_DN;
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
     }
 }
-- 
2.34.1

Switch from vfp.fp_status to vfp.fp_status_a64 for helpers which:
 * directly reference an fp_status field
 * are called only from the A64 decoder
 * are not called inside a set_rmode/restore_rmode sequence

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20250124162836.2332150-8-peter.maydell@linaro.org
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/sme_helper.c | 2 +-
 target/arm/tcg/vec_helper.c | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
      * round-to-odd -- see above.
      */
     fpst_f16 = env->vfp.fp_status_f16;
-    fpst_std = env->vfp.fp_status;
+    fpst_std = env->vfp.fp_status_a64;
     set_default_nan_mode(true, &fpst_std);
     set_default_nan_mode(true, &fpst_f16);
     fpst_odd = fpst_std;
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
 void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
                             CPUARMState *env, uint32_t desc)
 {
-    do_fmlal(vd, vn, vm, &env->vfp.fp_status, desc,
+    do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
              get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
 }
 
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
     intptr_t i, oprsz = simd_oprsz(desc);
     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
-    float_status *status = &env->vfp.fp_status;
+    float_status *status = &env->vfp.fp_status_a64;
     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
 
     for (i = 0; i < oprsz; i += sizeof(float32)) {
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
 void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
                                 CPUARMState *env, uint32_t desc)
 {
-    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status, desc,
+    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
                  get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
 }
 
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
-    float_status *status = &env->vfp.fp_status;
+    float_status *status = &env->vfp.fp_status_a64;
     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
 
     for (i = 0; i < oprsz; i += 16) {
-- 
2.34.1

The helpers vfp_cmps, vfp_cmpes, vfp_cmpd, vfp_cmped are used only from
the A32 decoder; the A64 decoder uses separate vfp_cmps_a64 etc helpers
(because for A64 we update the main NZCV flags and for A32 we update
the FPSCR NZCV flags). So we can make these helpers use the fp_status_a32
field instead of fp_status.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-10-peter.maydell@linaro.org
---
 target/arm/vfp_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
 }
 DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
-DO_VFP_cmp(s, float32, float32, fp_status)
-DO_VFP_cmp(d, float64, float64, fp_status)
+DO_VFP_cmp(s, float32, float32, fp_status_a32)
+DO_VFP_cmp(d, float64, float64, fp_status_a32)
 #undef DO_VFP_cmp
 
 /* Integer to float and float to integer conversions */
-- 
2.34.1

In the A32 decoder, use FPST_A32 rather than FPST_FPCR.  By
doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with
  perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A32/g' target/arm/tcg/translate-vfp.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-11-peter.maydell@linaro.org
---
 target/arm/tcg/translate-vfp.c | 54 +++++++++++++++++-----------------
 1 file changed, 27 insertions(+), 27 deletions(-)

diff --git a/target/arm/tcg/translate-vfp.c b/target/arm/tcg/translate-vfp.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-vfp.c
+++ b/target/arm/tcg/translate-vfp.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINT(DisasContext *s, arg_VRINT *a)
     if (sz == 1) {
         fpst = fpstatus_ptr(FPST_FPCR_F16);
     } else {
-        fpst = fpstatus_ptr(FPST_FPCR);
+        fpst = fpstatus_ptr(FPST_A32);
     }
 
     tcg_rmode = gen_set_rmode(rounding, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT(DisasContext *s, arg_VCVT *a)
     if (sz == 1) {
         fpst = fpstatus_ptr(FPST_FPCR_F16);
     } else {
-        fpst = fpstatus_ptr(FPST_FPCR);
+        fpst = fpstatus_ptr(FPST_A32);
     }
 
     tcg_shift = tcg_constant_i32(0);
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_sp(DisasContext *s, VFPGen3OpSPFn *fn,
     f0 = tcg_temp_new_i32();
     f1 = tcg_temp_new_i32();
     fd = tcg_temp_new_i32();
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
 
     vfp_load_reg32(f0, vn);
     vfp_load_reg32(f1, vm);
@@ -XXX,XX +XXX,XX @@ static bool do_vfp_3op_dp(DisasContext *s, VFPGen3OpDPFn *fn,
     f0 = tcg_temp_new_i64();
     f1 = tcg_temp_new_i64();
     fd = tcg_temp_new_i64();
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
 
     vfp_load_reg64(f0, vn);
     vfp_load_reg64(f1, vm);
@@ -XXX,XX +XXX,XX @@ static bool do_vfm_sp(DisasContext *s, arg_VFMA_sp *a, bool neg_n, bool neg_d)
         /* VFNMA, VFNMS */
         gen_vfp_negs(vd, vd);
     }
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_vfp_muladds(vd, vn, vm, vd, fpst);
     vfp_store_reg32(vd, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool do_vfm_dp(DisasContext *s, arg_VFMA_dp *a, bool neg_n, bool neg_d)
         /* VFNMA, VFNMS */
         gen_vfp_negd(vd, vd);
     }
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_vfp_muladdd(vd, vn, vm, vd, fpst);
     vfp_store_reg64(vd, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static void gen_VSQRT_hp(TCGv_i32 vd, TCGv_i32 vm)
 
 static void gen_VSQRT_sp(TCGv_i32 vd, TCGv_i32 vm)
 {
-    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_sqrts(vd, vm, fpstatus_ptr(FPST_A32));
 }
 
 static void gen_VSQRT_dp(TCGv_i64 vd, TCGv_i64 vm)
 {
-    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_sqrtd(vd, vm, fpstatus_ptr(FPST_A32));
 }
 
 DO_VFP_2OP(VSQRT, hp, gen_VSQRT_hp, aa32_fp16_arith)
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f32_f16(DisasContext *s, arg_VCVT_f32_f16 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
     /* The T bit tells us if we want the low or high 16 bits of Vm */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f64_f16(DisasContext *s, arg_VCVT_f64_f16 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
     /* The T bit tells us if we want the low or high 16 bits of Vm */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_b16_f32(DisasContext *s, arg_VCVT_b16_f32 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     tmp = tcg_temp_new_i32();
 
     vfp_load_reg32(tmp, a->vm);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f32(DisasContext *s, arg_VCVT_f16_f32 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_f16_f64(DisasContext *s, arg_VCVT_f16_f64 *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     ahp_mode = get_ahp_flag();
     tmp = tcg_temp_new_i32();
     vm = tcg_temp_new_i64();
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_sp(DisasContext *s, arg_VRINTR_sp *a)
 
     tmp = tcg_temp_new_i32();
     vfp_load_reg32(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rints(tmp, tmp, fpst);
     vfp_store_reg32(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTR_dp(DisasContext *s, arg_VRINTR_dp *a)
 
     tmp = tcg_temp_new_i64();
     vfp_load_reg64(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rintd(tmp, tmp, fpst);
     vfp_store_reg64(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_sp(DisasContext *s, arg_VRINTZ_sp *a)
 
     tmp = tcg_temp_new_i32();
     vfp_load_reg32(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
     gen_helper_rints(tmp, tmp, fpst);
     gen_restore_rmode(tcg_rmode, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTZ_dp(DisasContext *s, arg_VRINTZ_dp *a)
 
     tmp = tcg_temp_new_i64();
     vfp_load_reg64(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     tcg_rmode = gen_set_rmode(FPROUNDING_ZERO, fpst);
     gen_helper_rintd(tmp, tmp, fpst);
     gen_restore_rmode(tcg_rmode, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_sp(DisasContext *s, arg_VRINTX_sp *a)
 
     tmp = tcg_temp_new_i32();
     vfp_load_reg32(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rints_exact(tmp, tmp, fpst);
     vfp_store_reg32(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VRINTX_dp(DisasContext *s, arg_VRINTX_dp *a)
 
     tmp = tcg_temp_new_i64();
     vfp_load_reg64(tmp, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     gen_helper_rintd_exact(tmp, tmp, fpst);
     vfp_store_reg64(tmp, a->vd);
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp(DisasContext *s, arg_VCVT_sp *a)
     vm = tcg_temp_new_i32();
     vd = tcg_temp_new_i64();
     vfp_load_reg32(vm, a->vm);
-    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_fcvtds(vd, vm, fpstatus_ptr(FPST_A32));
     vfp_store_reg64(vd, a->vd);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp(DisasContext *s, arg_VCVT_dp *a)
     vd = tcg_temp_new_i32();
     vm = tcg_temp_new_i64();
     vfp_load_reg64(vm, a->vm);
-    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_FPCR));
+    gen_helper_vfp_fcvtsd(vd, vm, fpstatus_ptr(FPST_A32));
     vfp_store_reg32(vd, a->vd);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_sp(DisasContext *s, arg_VCVT_int_sp *a)
 
     vm = tcg_temp_new_i32();
     vfp_load_reg32(vm, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     if (a->s) {
         /* i32 -> f32 */
         gen_helper_vfp_sitos(vm, vm, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_int_dp(DisasContext *s, arg_VCVT_int_dp *a)
     vm = tcg_temp_new_i32();
     vd = tcg_temp_new_i64();
     vfp_load_reg32(vm, a->vm);
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     if (a->s) {
         /* i32 -> f64 */
         gen_helper_vfp_sitod(vd, vm, fpst);
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_sp(DisasContext *s, arg_VCVT_fix_sp *a)
     vd = tcg_temp_new_i32();
     vfp_load_reg32(vd, a->vd);
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     shift = tcg_constant_i32(frac_bits);
 
     /* Switch on op:U:sx bits */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_fix_dp(DisasContext *s, arg_VCVT_fix_dp *a)
     vd = tcg_temp_new_i64();
     vfp_load_reg64(vd, a->vd);
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     shift = tcg_constant_i32(frac_bits);
 
     /* Switch on op:U:sx bits */
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_sp_int(DisasContext *s, arg_VCVT_sp_int *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     vm = tcg_temp_new_i32();
     vfp_load_reg32(vm, a->vm);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_VCVT_dp_int(DisasContext *s, arg_VCVT_dp_int *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A32);
     vm = tcg_temp_new_i64();
     vd = tcg_temp_new_i32();
     vfp_load_reg64(vm, a->vm);
-- 
2.34.1

In the A64 decoder, use FPST_A64 rather than FPST_FPCR.  By
doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with

perl -p -i -e 's/FPST_FPCR(?!_)/FPST_A64/g' target/arm/tcg/translate-{a64,sve,sme}.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-12-peter.maydell@linaro.org
---
 target/arm/tcg/translate-a64.c |  70 +++++++++++-----------
 target/arm/tcg/translate-sme.c |   4 +-
 target/arm/tcg/translate-sve.c | 106 ++++++++++++++++-----------------
 3 files changed, 90 insertions(+), 90 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
                               int rm, bool is_fp16, int data,
                               gen_helper_gvec_3_ptr *fn)
 {
-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn),
                        vec_full_reg_offset(s, rm), fpst,
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
                               int rm, int ra, bool is_fp16, int data,
                               gen_helper_gvec_4_ptr *fn)
 {
-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_gen_gvec_4_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn),
                        vec_full_reg_offset(s, rm),
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
         if (fp_access_check(s)) {
             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
             TCGv_i64 t1 = read_fp_dreg(s, a->rm);
-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
         if (fp_access_check(s)) {
             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
             TCGv_i32 t1 = read_fp_sreg(s, a->rm);
-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
             TCGv_i64 t1 = tcg_constant_i64(0);
             if (swap) {
-                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
+                f->gen_d(t0, t1, t0, fpstatus_ptr(FPST_A64));
             } else {
-                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+                f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             }
             write_fp_dreg(s, a->rd, t0);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
             TCGv_i32 t1 = tcg_constant_i32(0);
             if (swap) {
-                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_FPCR));
+                f->gen_s(t0, t1, t0, fpstatus_ptr(FPST_A64));
             } else {
-                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+                f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             }
             write_fp_sreg(s, a->rd, t0);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
             TCGv_i64 t1 = tcg_temp_new_i64();
 
             read_vec_element(s, t1, a->rm, a->idx, MO_64);
-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
             TCGv_i32 t1 = tcg_temp_new_i32();
 
             read_vec_element_i32(s, t1, a->rm, a->idx, MO_32);
-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
             if (neg) {
                 gen_vfp_negd(t1, t1);
             }
-            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
+            gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
             if (neg) {
                 gen_vfp_negs(t1, t1);
             }
-            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_FPCR));
+            gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
 
             read_vec_element(s, t0, a->rn, 0, MO_64);
             read_vec_element(s, t1, a->rn, 1, MO_64);
-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
 
             read_vec_element_i32(s, t0, a->rn, 0, MO_32);
             read_vec_element_i32(s, t1, a->rn, 1, MO_32);
-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_FPCR));
+            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             if (neg_n) {
                 gen_vfp_negd(tn, tn);
             }
-            fpst = fpstatus_ptr(FPST_FPCR);
+            fpst = fpstatus_ptr(FPST_A64);
             gen_helper_vfp_muladdd(ta, tn, tm, ta, fpst);
             write_fp_dreg(s, a->rd, ta);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             if (neg_n) {
                 gen_vfp_negs(tn, tn);
             }
-            fpst = fpstatus_ptr(FPST_FPCR);
+            fpst = fpstatus_ptr(FPST_A64);
             gen_helper_vfp_muladds(ta, tn, tm, ta, fpst);
             write_fp_sreg(s, a->rd, ta);
         }
@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
     if (fp_access_check(s)) {
         MemOp esz = a->esz;
         int elts = (a->q ? 16 : 8) >> esz;
-        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
         TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst, fn);
         write_fp_sreg(s, a->rd, res);
     }
@@ -XXX,XX +XXX,XX @@ static void handle_fp_compare(DisasContext *s, int size,
                               bool cmp_with_zero, bool signal_all_nans)
 {
     TCGv_i64 tcg_flags = tcg_temp_new_i64();
-    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(size == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
     if (size == MO_64) {
         TCGv_i64 tcg_vn, tcg_vm;
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
         return check == 0;
     }
 
-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     if (rmode >= 0) {
         tcg_rmode = gen_set_rmode(rmode, fpst);
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_sreg(s, a->rn);
         TCGv_i64 tcg_rd = tcg_temp_new_i64();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvtds(tcg_rd, tcg_rn, fpst);
         write_fp_dreg(s, a->rd, tcg_rd);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hs(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tmp = read_fp_sreg(s, a->rn);
         TCGv_i32 ahp = get_ahp_flag();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
         /* write_fp_sreg is OK here because top half of result is zero */
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sd(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvtsd(tcg_rd, tcg_rn, fpst);
         write_fp_sreg(s, a->rd, tcg_rd);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hd(DisasContext *s, arg_rr *a)
         TCGv_i64 tcg_rn = read_fp_dreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
         TCGv_i32 ahp = get_ahp_flag();
-        TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvt_f64_to_f16(tcg_rd, tcg_rn, fpst, ahp);
         /* write_fp_sreg is OK here because top half of tcg_rd is zero */
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i64 tcg_rd = tcg_temp_new_i64();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
     TCGv_i32 tcg_shift, tcg_single;
     TCGv_i64 tcg_double;
 
-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_shift = tcg_constant_i32(shift);
 
     switch (esz) {
@@ -XXX,XX +XXX,XX @@ static void do_fcvt_scalar(DisasContext *s, MemOp out, MemOp esz,
     TCGv_ptr tcg_fpstatus;
     TCGv_i32 tcg_shift, tcg_rmode, tcg_single;
 
-    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    tcg_fpstatus = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_shift = tcg_constant_i32(shift);
     tcg_rmode = gen_set_rmode(rmode, tcg_fpstatus);
 
@@ -XXX,XX +XXX,XX @@ static bool trans_FJCVTZS(DisasContext *s, arg_FJCVTZS *a)
     }
     if (fp_access_check(s)) {
         TCGv_i64 t = read_fp_dreg(s, a->rn);
-        TCGv_ptr fpstatus = fpstatus_ptr(FPST_FPCR);
+        TCGv_ptr fpstatus = fpstatus_ptr(FPST_A64);
 
         gen_helper_fjcvtzs(t, t, fpstatus);
 
@@ -XXX,XX +XXX,XX @@ static void gen_fcvtxn_sd(TCGv_i64 d, TCGv_i64 n)
      * with von Neumann rounding (round to odd)
      */
     TCGv_i32 tmp = tcg_temp_new_i32();
-    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_FPCR));
+    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_A64));
     tcg_gen_extu_i32_i64(d, tmp);
 }
 
@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
 {
     TCGv_i32 tcg_lo = tcg_temp_new_i32();
     TCGv_i32 tcg_hi = tcg_temp_new_i32();
-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
     TCGv_i32 ahp = get_ahp_flag();
 
     tcg_gen_extr_i64_i32(tcg_lo, tcg_hi, n);
@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_hs(TCGv_i64 d, TCGv_i64 n)
 static void gen_fcvtn_sd(TCGv_i64 d, TCGv_i64 n)
 {
     TCGv_i32 tmp = tcg_temp_new_i32();
-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
     gen_helper_vfp_fcvtsd(tmp, n, fpst);
     tcg_gen_extu_i32_i64(d, tmp);
@@ -XXX,XX +XXX,XX @@ TRANS(FCVTXN_v, do_2misc_narrow_vector, a, f_scalar_fcvtxn)
 
 static void gen_bfcvtn_hs(TCGv_i64 d, TCGv_i64 n)
 {
-    TCGv_ptr fpst = fpstatus_ptr(FPST_FPCR);
+    TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
     TCGv_i32 tmp = tcg_temp_new_i32();
     gen_helper_bfcvt_pair(tmp, n, fpst);
     tcg_gen_extu_i32_i64(d, tmp);
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_vector(DisasContext *s, arg_qrr_e *a,
         return check == 0;
     }
 
-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     if (rmode >= 0) {
         tcg_rmode = gen_set_rmode(rmode, fpst);
     }
@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
         return check == 0;
     }
 
-    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    fpst = fpstatus_ptr(esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn), fpst,
                        is_q ? 16 : 8, vec_full_reg_size(s),
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_FPCR);
+    fpst = fpstatus_ptr(FPST_A64);
     if (a->esz == MO_64) {
         /* 32 -> 64 bit fp conversion */
         TCGv_i64 tcg_res[2];
diff --git a/target/arm/tcg/translate-sme.c b/target/arm/tcg/translate-sme.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sme.c
+++ b/target/arm/tcg/translate-sme.c
@@ -XXX,XX +XXX,XX @@ static bool do_outprod_env(DisasContext *s, arg_op *a, MemOp esz,
 TRANS_FEAT(FMOPA_h, aa64_sme, do_outprod_env, a,
            MO_32, gen_helper_sme_fmopa_h)
 TRANS_FEAT(FMOPA_s, aa64_sme, do_outprod_fpst, a,
-           MO_32, FPST_FPCR, gen_helper_sme_fmopa_s)
+           MO_32, FPST_A64, gen_helper_sme_fmopa_s)
 TRANS_FEAT(FMOPA_d, aa64_sme_f64f64, do_outprod_fpst, a,
-           MO_64, FPST_FPCR, gen_helper_sme_fmopa_d)
+           MO_64, FPST_A64, gen_helper_sme_fmopa_d)
 
 TRANS_FEAT(BFMOPA, aa64_sme, do_outprod_env, a, MO_32, gen_helper_sme_bfmopa)
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
                                  arg_rr_esz *a, int data)
 {
     return gen_gvec_fpst_zz(s, fn, a->rd, a->rn, data,
-                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                            a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 /* Invoke an out-of-line helper on 3 Zregs. */
@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
                                   arg_rrr_esz *a, int data)
 {
     return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
-                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                             a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 /* Invoke an out-of-line helper on 4 Zregs. */
@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zpzz(DisasContext *s, gen_helper_gvec_4_ptr *fn,
                                    arg_rprr_esz *a)
 {
     return gen_gvec_fpst_zzzp(s, fn, a->rd, a->rn, a->rm, a->pg, 0,
-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 /* Invoke a vector expander on two Zregs and an immediate.  */
@@ -XXX,XX +XXX,XX @@ static bool do_FMLA_zzxz(DisasContext *s, arg_rrxr_esz *a, bool sub)
     };
     return gen_gvec_fpst_zzzz(s, fns[a->esz], a->rd, a->rn, a->rm, a->ra,
                               (a->index << 1) | sub,
-                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+                              a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 }
 
 TRANS_FEAT(FMLA_zzxz, aa64_sve, do_FMLA_zzxz, a, false)
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const fmul_idx_fns[4] = {
 };
 TRANS_FEAT(FMUL_zzx, aa64_sve, gen_gvec_fpst_zzz,
            fmul_idx_fns[a->esz], a->rd, a->rn, a->rm, a->index,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 /*
  *** SVE Floating Point Fast Reduction Group
@@ -XXX,XX +XXX,XX @@ static bool do_reduce(DisasContext *s, arg_rpr_esz *a,
 
     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, a->rn));
     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
     fn(temp, t_zn, t_pg, status, t_desc);
 
@@ -XXX,XX +XXX,XX @@ static bool do_ppz_fp(DisasContext *s, arg_rpr_esz *a,
     if (sve_access_check(s)) {
         unsigned vsz = vec_full_reg_size(s);
         TCGv_ptr status =
-            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+            fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
         tcg_gen_gvec_3_ptr(pred_full_reg_offset(s, a->rd),
                            vec_full_reg_offset(s, a->rn),
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const ftmad_fns[4] = {
 };
 TRANS_FEAT_NONSTREAMING(FTMAD, aa64_sve, gen_gvec_fpst_zzz,
                         ftmad_fns[a->esz], a->rd, a->rn, a->rm, a->imm,
-                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+                        a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 /*
  *** SVE Floating Point Accumulating Reduction Group
@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
     t_pg = tcg_temp_new_ptr();
     tcg_gen_addi_ptr(t_rm, tcg_env, vec_full_reg_offset(s, a->rm));
     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, a->pg));
-    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    t_fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     t_desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
 
     fns[a->esz - 1](t_val, t_val, t_rm, t_pg, t_fpst, t_desc);
@@ -XXX,XX +XXX,XX @@ static void do_fp_scalar(DisasContext *s, int zd, int zn, int pg, bool is_fp16,
     tcg_gen_addi_ptr(t_zn, tcg_env, vec_full_reg_offset(s, zn));
     tcg_gen_addi_ptr(t_pg, tcg_env, pred_full_reg_offset(s, pg));
 
-    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_FPCR);
+    status = fpstatus_ptr(is_fp16 ? FPST_FPCR_F16 : FPST_A64);
     desc = tcg_constant_i32(simd_desc(vsz, vsz, 0));
     fn(t_zd, t_zn, t_pg, scalar, status, desc);
 }
@@ -XXX,XX +XXX,XX @@ static bool do_fp_cmp(DisasContext *s, arg_rprr_esz *a,
     }
     if (sve_access_check(s)) {
         unsigned vsz = vec_full_reg_size(s);
-        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+        TCGv_ptr status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
         tcg_gen_gvec_4_ptr(pred_full_reg_offset(s, a->rd),
                            vec_full_reg_offset(s, a->rn),
                            vec_full_reg_offset(s, a->rm),
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_4_ptr * const fcadd_fns[] = {
 };
 TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
            a->rd, a->rn, a->rm, a->pg, a->rot,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 #define DO_FMLA(NAME, name) \
     static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
     };                                                                  \
     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp, name##_fns[a->esz], \
                a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
-               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+               a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 DO_FMLA(FMLA_zpzzz, fmla_zpzzz)
 DO_FMLA(FMLS_zpzzz, fmls_zpzzz)
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_5_ptr * const fcmla_fns[4] = {
 };
 TRANS_FEAT(FCMLA_zpzzz, aa64_sve, gen_gvec_fpst_zzzzp, fcmla_fns[a->esz],
            a->rd, a->rn, a->rm, a->ra, a->pg, a->rot,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static gen_helper_gvec_4_ptr * const fcmla_idx_fns[4] = {
     NULL, gen_helper_gvec_fcmlah_idx, gen_helper_gvec_fcmlas_idx, NULL
 };
 TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
            a->rd, a->rn, a->rm, a->ra, a->index * 4 + a->rot,
-           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 /*
  *** SVE Floating Point Unary Operations Predicated Group
  */
 
 TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_sh, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hs, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
 
 TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_bfcvt, a, 0, FPST_FPCR)
+           gen_helper_sve_bfcvt, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_dh, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvt_sd, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTZS_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvtzs_hh, a, 0, FPST_FPCR_F16)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVTZU_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvtzu_hd, a, 0, FPST_FPCR_F16)
 
 TRANS_FEAT(FCVTZS_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_ss, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_ss, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZS_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_sd, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_sd, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZS_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_ds, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_ds, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTZS_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzs_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzs_dd, a, 0, FPST_A64)
 TRANS_FEAT(FCVTZU_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvtzu_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_fcvtzu_dd, a, 0, FPST_A64)
 
 static gen_helper_gvec_3_ptr * const frint_fns[] = {
     NULL,
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frint_fns[] = {
     gen_helper_sve_frint_d
 };
 TRANS_FEAT(FRINTI, aa64_sve, gen_gvec_fpst_arg_zpz, frint_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static gen_helper_gvec_3_ptr * const frintx_fns[] = {
     NULL,
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frintx_fns[] = {
     gen_helper_sve_frintx_d
 };
 TRANS_FEAT(FRINTX, aa64_sve, gen_gvec_fpst_arg_zpz, frintx_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
 
 static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
                           ARMFPRounding mode, gen_helper_gvec_3_ptr *fn)
@@ -XXX,XX +XXX,XX @@ static bool do_frint_mode(DisasContext *s, arg_rpr_esz *a,
     }
 
     vsz = vec_full_reg_size(s);
-    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR);
+    status = fpstatus_ptr(a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64);
     tmode = gen_set_rmode(mode, status);
 
     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, a->rd),
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frecpx_fns[] = {
     gen_helper_sve_frecpx_s, gen_helper_sve_frecpx_d,
 };
 TRANS_FEAT(FRECPX, aa64_sve, gen_gvec_fpst_arg_zpz, frecpx_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static gen_helper_gvec_3_ptr * const fsqrt_fns[] = {
     NULL,                   gen_helper_sve_fsqrt_h,
     gen_helper_sve_fsqrt_s, gen_helper_sve_fsqrt_d,
 };
 TRANS_FEAT(FSQRT, aa64_sve, gen_gvec_fpst_arg_zpz, fsqrt_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 TRANS_FEAT(SCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_scvt_hh, a, 0, FPST_FPCR_F16)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(SCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_scvt_dh, a, 0, FPST_FPCR_F16)
 
 TRANS_FEAT(SCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_ss, a, 0, FPST_A64)
 TRANS_FEAT(SCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_ds, a, 0, FPST_A64)
 
 TRANS_FEAT(SCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_sd, a, 0, FPST_A64)
 TRANS_FEAT(SCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_scvt_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_scvt_dd, a, 0, FPST_A64)
 
 TRANS_FEAT(UCVTF_hh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_ucvt_hh, a, 0, FPST_FPCR_F16)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(UCVTF_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_ucvt_dh, a, 0, FPST_FPCR_F16)
 
 TRANS_FEAT(UCVTF_ss, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_ss, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_ss, a, 0, FPST_A64)
 TRANS_FEAT(UCVTF_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_ds, a, 0, FPST_A64)
 TRANS_FEAT(UCVTF_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_sd, a, 0, FPST_A64)
 
 TRANS_FEAT(UCVTF_dd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_ucvt_dd, a, 0, FPST_FPCR)
+           gen_helper_sve_ucvt_dd, a, 0, FPST_A64)
 
 /*
  *** SVE Memory - 32-bit Gather and Unsized Contiguous Group
@@ -XXX,XX +XXX,XX @@ DO_ZPZZ_FP(FMINP, aa64_sve2, sve2_fminp_zpzz)
 
 TRANS_FEAT_NONSTREAMING(FMMLA_s, aa64_sve_f32mm, gen_gvec_fpst_zzzz,
                         gen_helper_fmmla_s, a->rd, a->rn, a->rm, a->ra,
-                        0, FPST_FPCR)
+                        0, FPST_A64)
 TRANS_FEAT_NONSTREAMING(FMMLA_d, aa64_sve_f64mm, gen_gvec_fpst_zzzz,
                         gen_helper_fmmla_d, a->rd, a->rn, a->rm, a->ra,
-                        0, FPST_FPCR)
+                        0, FPST_A64)
 
 static gen_helper_gvec_4 * const sqdmlal_zzzw_fns[] = {
     NULL,                           gen_helper_sve2_sqdmlal_zzzw_h,
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(RAX1, aa64_sve2_sha3, gen_gvec_fn_arg_zzz,
                         gen_gvec_rax1, a)
 
 TRANS_FEAT(FCVTNT_sh, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtnt_sh, a, 0, FPST_A64)
 TRANS_FEAT(FCVTNT_ds, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtnt_ds, a, 0, FPST_A64)
 
 TRANS_FEAT(BFCVTNT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_bfcvtnt, a, 0, FPST_FPCR)
+           gen_helper_sve_bfcvtnt, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTLT_hs, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtlt_hs, a, 0, FPST_A64)
 TRANS_FEAT(FCVTLT_sd, aa64_sve2, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_FPCR)
+           gen_helper_sve2_fcvtlt_sd, a, 0, FPST_A64)
 
 TRANS_FEAT(FCVTX_ds, aa64_sve2, do_frint_mode, a,
            FPROUNDING_ODD, gen_helper_sve_fcvt_ds)
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const flogb_fns[] = {
     gen_helper_flogb_s, gen_helper_flogb_d
 };
 TRANS_FEAT(FLOGB, aa64_sve2, gen_gvec_fpst_arg_zpz, flogb_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_FPCR)
+           a, 0, a->esz == MO_16 ? FPST_FPCR_F16 : FPST_A64)
 
 static bool do_FMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sub, bool sel)
 {
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(BFMMLA, aa64_sve_bf16, gen_gvec_env_arg_zzzz,
 static bool do_BFMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sel)
 {
     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal,
-                              a->rd, a->rn, a->rm, a->ra, sel, FPST_FPCR);
+                              a->rd, a->rn, a->rm, a->ra, sel, FPST_A64);
 }
 
 TRANS_FEAT(BFMLALB_zzzw, aa64_sve_bf16, do_BFMLAL_zzzw, a, false)
@@ -XXX,XX +XXX,XX @@ static bool do_BFMLAL_zzxw(DisasContext *s, arg_rrxr_esz *a, bool sel)
 {
     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal_idx,
                               a->rd, a->rn, a->rm, a->ra,
-                              (a->index << 1) | sel, FPST_FPCR);
+                              (a->index << 1) | sel, FPST_A64);
 }
 
 TRANS_FEAT(BFMLALB_zzxw, aa64_sve_bf16, do_BFMLAL_zzxw, a, false)
-- 
2.34.1

Now we have moved all the uses of vfp.fp_status and FPST_FPCR
to either the A32 or A64 fields, we can remove these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-13-peter.maydell@linaro.org
---
 target/arm/cpu.h           | 2 --
 target/arm/tcg/translate.h | 6 ------
 target/arm/cpu.c           | 1 -
 target/arm/vfp_helper.c    | 8 +-------
 4 files changed, 1 insertion(+), 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
 
         /* There are a number of distinct float control structures:
          *
-         *  fp_status: is the "normal" fp status.
          *  fp_status_a32: is the "normal" fp status for AArch32 insns
          *  fp_status_a64: is the "normal" fp status for AArch64 insns
          *  fp_status_fp16: used for half-precision calculations
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          * only thing which needs to read the exception flags being
          * an explicit FPSCR read.
          */
-        float_status fp_status;
         float_status fp_status_a32;
         float_status fp_status_a64;
         float_status fp_status_f16;
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
  * Enum for argument to fpstatus_ptr().
  */
 typedef enum ARMFPStatusFlavour {
-    FPST_FPCR,
     FPST_A32,
     FPST_A64,
     FPST_FPCR_F16,
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  * been set up to point to the requested field in the CPU state struct.
  * The options are:
  *
- * FPST_FPCR
- *   for non-FP16 operations controlled by the FPCR
  * FPST_A32
  *   for AArch32 non-FP16 operations controlled by the FPCR
  * FPST_A64
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     int offset;
 
     switch (flavour) {
-    case FPST_FPCR:
-        offset = offsetof(CPUARMState, vfp.fp_status);
-        break;
     case FPST_A32:
         offset = offsetof(CPUARMState, vfp.fp_status_a32);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
-    arm_set_default_fp_behaviours(&env->vfp.fp_status);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
 
 static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
 {
-    uint32_t i;
+    uint32_t i = 0;
 
-    i = get_float_exception_flags(&env->vfp.fp_status);
     i |= get_float_exception_flags(&env->vfp.fp_status_a32);
     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      * values. The caller should have arranged for env->vfp.fpsr to
      * be the architecturally up-to-date exception flag information first.
      */
-    set_float_exception_flags(0, &env->vfp.fp_status);
     set_float_exception_flags(0, &env->vfp.fp_status_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_a64);
     set_float_exception_flags(0, &env->vfp.fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
             i = float_round_to_zero;
             break;
         }
-        set_float_rounding_mode(i, &env->vfp.fp_status);
         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
     }
     if (changed & FPCR_FZ) {
         bool ftz_enabled = val & FPCR_FZ;
-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status);
-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
     }
     if (changed & FPCR_DN) {
         bool dnan_enabled = val & FPCR_DN;
-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
-- 
2.34.1

As the first part of splitting the existing fp_status_f16
into separate float_status fields for AArch32 and AArch64
(so that we can make FEAT_AFP control bits apply only
for AArch64), define the two new fp_status_f16_a32 and
fp_status_f16_a64 fields, but don't use them yet.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-14-peter.maydell@linaro.org
---
 target/arm/cpu.h           |  4 ++++
 target/arm/tcg/translate.h | 12 ++++++++++++
 target/arm/cpu.c           |  2 ++
 target/arm/vfp_helper.c    | 14 ++++++++++++++
 4 files changed, 32 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          *  fp_status_a32: is the "normal" fp status for AArch32 insns
          *  fp_status_a64: is the "normal" fp status for AArch64 insns
          *  fp_status_fp16: used for half-precision calculations
+         *  fp_status_fp16_a32: used for AArch32 half-precision calculations
+         *  fp_status_fp16_a64: used for AArch64 half-precision calculations
          *  standard_fp_status : the ARM "Standard FPSCR Value"
          *  standard_fp_status_fp16 : used for half-precision
          *       calculations with the ARM "Standard FPSCR Value"
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         float_status fp_status_a32;
         float_status fp_status_a64;
         float_status fp_status_f16;
+        float_status fp_status_f16_a32;
+        float_status fp_status_f16_a64;
         float_status standard_fp_status;
         float_status standard_fp_status_f16;
 
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
     FPST_A32,
     FPST_A64,
     FPST_FPCR_F16,
+    FPST_A32_F16,
+    FPST_A64_F16,
     FPST_STD,
     FPST_STD_F16,
 } ARMFPStatusFlavour;
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  *   for AArch64 non-FP16 operations controlled by the FPCR
  * FPST_FPCR_F16
  *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
+ * FPST_A32_F16
+ *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
+ * FPST_A64_F16
+ *   for AArch64 operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_STD
  *   for A32/T32 Neon operations using the "standard FPSCR value"
  * FPST_STD_F16
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     case FPST_FPCR_F16:
         offset = offsetof(CPUARMState, vfp.fp_status_f16);
         break;
+    case FPST_A32_F16:
+        offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
+        break;
+    case FPST_A64_F16:
+        offset = offsetof(CPUARMState, vfp.fp_status_f16_a64);
+        break;
     case FPST_STD:
         offset = offsetof(CPUARMState, vfp.standard_fp_status);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     /* FZ16 does not generate an input denormal exception.  */
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
           & ~float_flag_input_denormal);
+    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
+          & ~float_flag_input_denormal);
+    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
+          & ~float_flag_input_denormal);
     i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
           & ~float_flag_input_denormal);
     return vfp_exceptbits_from_host(i);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
     set_float_exception_flags(0, &env->vfp.fp_status_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_a64);
     set_float_exception_flags(0, &env->vfp.fp_status_f16);
+    set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
+    set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
 }
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16);
+        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
+        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
     }
     if (changed & FPCR_FZ16) {
         bool ftz_enabled = val & FPCR_FZ16;
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
     }
     if (changed & FPCR_FZ) {
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
     }
 }
 
-- 
2.34.1

We directly use fp_status_f16 in a handful of helpers that
are AArch32-specific; switch to fp_status_f16_a32 for these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-15-peter.maydell@linaro.org
---
 target/arm/tcg/vec_helper.c | 4 ++--
 target/arm/vfp_helper.c     | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
                             CPUARMState *env, uint32_t desc)
 {
     do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, desc,
-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
 }
 
 void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
                                 CPUARMState *env, uint32_t desc)
 {
     do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, desc,
-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
 }
 
 void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
     softfloat_to_vfp_compare(env, \
         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
 }
-DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16)
+DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16_a32)
 DO_VFP_cmp(s, float32, float32, fp_status_a32)
 DO_VFP_cmp(d, float64, float64, fp_status_a32)
 #undef DO_VFP_cmp
-- 
2.34.1

We directly use fp_status_f16 in a handful of helpers that are
AArch64-specific; switch to fp_status_f16_a64 for these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-16-peter.maydell@linaro.org
---
 target/arm/tcg/sme_helper.c | 4 ++--
 target/arm/tcg/vec_helper.c | 8 ++++----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sme_helper.c
+++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
     float_status fpst_odd, fpst_std, fpst_f16;
 
     /*
-     * Make copies of fp_status and fp_status_f16, because this operation
+     * Make copies of the fp status fields we use, because this operation
      * does not update the cumulative fp exception status.  It also
      * produces default NaNs. We also need a second copy of fp_status with
      * round-to-odd -- see above.
      */
-    fpst_f16 = env->vfp.fp_status_f16;
+    fpst_f16 = env->vfp.fp_status_f16_a64;
     fpst_std = env->vfp.fp_status_a64;
     set_default_nan_mode(true, &fpst_std);
     set_default_nan_mode(true, &fpst_f16);
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
                             CPUARMState *env, uint32_t desc)
 {
     do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
 }
 
 void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
     uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     float_status *status = &env->vfp.fp_status_a64;
-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
 
     for (i = 0; i < oprsz; i += sizeof(float32)) {
         float16 nn_16 = *(float16 *)(vn + H1_2(i + sel)) ^ negn;
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
                                 CPUARMState *env, uint32_t desc)
 {
     do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16));
+                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
 }
 
 void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
     float_status *status = &env->vfp.fp_status_a64;
-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16);
+    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
 
     for (i = 0; i < oprsz; i += 16) {
         float16 mm_16 = *(float16 *)(vm + i + idx);
-- 
2.34.1

In the A32 decoder, use FPST_A32_F16 rather than FPST_FPCR_F16.
By doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with
  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A32_F16/g' target/arm/tcg/translate-vfp.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-17-peter.maydell@linaro.org
---
 target/arm/tcg/translate-vfp.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

In the A32 decoder, use FPST_A64_F16 rather than FPST_FPCR_F16.
By doing an automated conversion of the whole file we avoid possibly
using more than one fpst value in a set_rmode/op/restore_rmode
sequence.

Patch created with
  perl -p -i -e 's/FPST_FPCR_F16(?!_)/FPST_A64_F16/g' target/arm/tcg/translate-{a64,sve,sme}.c

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-18-peter.maydell@linaro.org
---
 target/arm/tcg/translate-a64.c | 32 ++++++++---------
 target/arm/tcg/translate-sve.c | 66 +++++++++++++++++-----------------
 2 files changed, 49 insertions(+), 49 deletions(-)

Now we have moved all the uses of vfp.fp_status_f16 and FPST_FPCR_F16
to the new A32 or A64 fields, we can remove these.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-19-peter.maydell@linaro.org
---
 target/arm/cpu.h           | 2 --
 target/arm/tcg/translate.h | 6 ------
 target/arm/cpu.c           | 1 -
 target/arm/vfp_helper.c    | 7 -------
 4 files changed, 16 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          *
          *  fp_status_a32: is the "normal" fp status for AArch32 insns
          *  fp_status_a64: is the "normal" fp status for AArch64 insns
-         *  fp_status_fp16: used for half-precision calculations
          *  fp_status_fp16_a32: used for AArch32 half-precision calculations
          *  fp_status_fp16_a64: used for AArch64 half-precision calculations
          *  standard_fp_status : the ARM "Standard FPSCR Value"
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          */
         float_status fp_status_a32;
         float_status fp_status_a64;
-        float_status fp_status_f16;
         float_status fp_status_f16_a32;
         float_status fp_status_f16_a64;
         float_status standard_fp_status;
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
 typedef enum ARMFPStatusFlavour {
     FPST_A32,
     FPST_A64,
-    FPST_FPCR_F16,
     FPST_A32_F16,
     FPST_A64_F16,
     FPST_STD,
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  *   for AArch32 non-FP16 operations controlled by the FPCR
  * FPST_A64
  *   for AArch64 non-FP16 operations controlled by the FPCR
- * FPST_FPCR_F16
- *   for operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_A32_F16
  *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_A64_F16
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     case FPST_A64:
         offset = offsetof(CPUARMState, vfp.fp_status_a64);
         break;
-    case FPST_FPCR_F16:
-        offset = offsetof(CPUARMState, vfp.fp_status_f16);
-        break;
     case FPST_A32_F16:
         offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
-    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     i |= get_float_exception_flags(&env->vfp.fp_status_a64);
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
     /* FZ16 does not generate an input denormal exception.  */
-    i |= (get_float_exception_flags(&env->vfp.fp_status_f16)
-          & ~float_flag_input_denormal);
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
           & ~float_flag_input_denormal);
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      */
     set_float_exception_flags(0, &env->vfp.fp_status_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_a64);
-    set_float_exception_flags(0, &env->vfp.fp_status_f16);
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         }
         set_float_rounding_mode(i, &env->vfp.fp_status_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_a64);
-        set_float_rounding_mode(i, &env->vfp.fp_status_f16);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
         set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
     }
     if (changed & FPCR_FZ16) {
         bool ftz_enabled = val & FPCR_FZ16;
-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         bool dnan_enabled = val & FPCR_DN;
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
     }
-- 
2.34.1

Our float_flag_input_denormal exception flag is set when the fpu code
flushes an input denormal to zero.  This is what many guest
architectures (eg classic Arm behaviour) require, but it is not the
only donarmal-related reason we might want to set an exception flag.
The x86 behaviour (which we do not currently model correctly) wants
to see an exception flag when a denormal input is *not* flushed to
zero and is actually used in an arithmetic operation. Arm's FEAT_AFP
also wants these semantics.

Rename float_flag_input_denormal to float_flag_input_denormal_flushed
to make it clearer when it is set and to allow us to add a new
float_flag_input_denormal_used next to it for the x86/FEAT_AFP
semantics.

Commit created with
 for f in `git grep -l float_flag_input_denormal`; do sed -i -e 's/float_flag_input_denormal/float_flag_input_denormal_flushed/' $f; done

and manual editing of softfloat-types.h and softfloat.c to clean
up the indentation afterwards and to fix a comment which wasn't
using the full name of the flag.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-20-peter.maydell@linaro.org
---
 include/fpu/softfloat-types.h |  5 +++--
 fpu/softfloat.c               |  4 ++--
 target/arm/tcg/sve_helper.c   |  6 +++---
 target/arm/vfp_helper.c       | 10 +++++-----
 target/i386/tcg/fpu_helper.c  |  6 +++---
 target/mips/tcg/msa_helper.c  |  2 +-
 target/rx/op_helper.c         |  2 +-
 fpu/softfloat-parts.c.inc     |  2 +-
 8 files changed, 19 insertions(+), 18 deletions(-)

diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ enum {
     float_flag_overflow        = 0x0004,
     float_flag_underflow       = 0x0008,
     float_flag_inexact         = 0x0010,
-    float_flag_input_denormal  = 0x0020,
+    /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
+    float_flag_input_denormal_flushed = 0x0020,
     float_flag_output_denormal = 0x0040,
     float_flag_invalid_isi     = 0x0080,  /* inf - inf */
     float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
     bool tininess_before_rounding;
     /* should denormalised results go to zero and set the inexact flag? */
     bool flush_to_zero;
-    /* should denormalised inputs go to zero and set the input_denormal flag? */
+    /* should denormalised inputs go to zero and set input_denormal_flushed? */
     bool flush_inputs_to_zero;
     bool default_nan_mode;
     /*
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ this code that are retained.
         if (unlikely(soft_t ## _is_denormal(*a))) {                     \
             *a = soft_t ## _set_sign(soft_t ## _zero,                   \
                                      soft_t ## _is_neg(*a));            \
-            float_raise(float_flag_input_denormal, s);                  \
+            float_raise(float_flag_input_denormal_flushed, s);          \
         }                                                               \
     }
 
@@ -XXX,XX +XXX,XX @@ float128 float128_silence_nan(float128 a, float_status *status)
 static bool parts_squash_denormal(FloatParts64 p, float_status *status)
 {
     if (p.exp == 0 && p.frac != 0) {
-        float_raise(float_flag_input_denormal, status);
+        float_raise(float_flag_input_denormal_flushed, status);
         return true;
     }
 
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -XXX,XX +XXX,XX @@ static int16_t do_float16_logb_as_int(float16 a, float_status *s)
                 return -15 - clz32(frac);
             }
             /* flush to zero */
-            float_raise(float_flag_input_denormal, s);
+            float_raise(float_flag_input_denormal_flushed, s);
         }
     } else if (unlikely(exp == 0x1f)) {
         if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int32_t do_float32_logb_as_int(float32 a, float_status *s)
                 return -127 - clz32(frac);
             }
             /* flush to zero */
-            float_raise(float_flag_input_denormal, s);
+            float_raise(float_flag_input_denormal_flushed, s);
         }
     } else if (unlikely(exp == 0xff)) {
         if (frac == 0) {
@@ -XXX,XX +XXX,XX @@ static int64_t do_float64_logb_as_int(float64 a, float_status *s)
                 return -1023 - clz64(frac);
             }
             /* flush to zero */
-            float_raise(float_flag_input_denormal, s);
+            float_raise(float_flag_input_denormal_flushed, s);
         }
     } else if (unlikely(exp == 0x7ff)) {
         if (frac == 0) {
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
     if (host_bits & float_flag_inexact) {
         target_bits |= FPSR_IXC;
     }
-    if (host_bits & float_flag_input_denormal) {
+    if (host_bits & float_flag_input_denormal_flushed) {
         target_bits |= FPSR_IDC;
     }
     return target_bits;
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     i |= get_float_exception_flags(&env->vfp.standard_fp_status);
     /* FZ16 does not generate an input denormal exception.  */
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
-          & ~float_flag_input_denormal);
+          & ~float_flag_input_denormal_flushed);
     i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
-          & ~float_flag_input_denormal);
+          & ~float_flag_input_denormal_flushed);
     i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
-          & ~float_flag_input_denormal);
+          & ~float_flag_input_denormal_flushed);
     return vfp_exceptbits_from_host(i);
 }
 
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(fjcvtzs)(float64 value, float_status *status)
 
     /* Normal inexact, denormal with flush-to-zero, or overflow or NaN */
     inexact = e_new & (float_flag_inexact |
-                       float_flag_input_denormal |
+                       float_flag_input_denormal_flushed |
                        float_flag_invalid);
 
     /* While not inexact for IEEE FP, -0.0 is inexact for JavaScript. */
diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static void merge_exception_flags(CPUX86State *env, uint8_t old_flags)
                        (new_flags & float_flag_overflow ? FPUS_OE : 0) |
                        (new_flags & float_flag_underflow ? FPUS_UE : 0) |
                        (new_flags & float_flag_inexact ? FPUS_PE : 0) |
-                       (new_flags & float_flag_input_denormal ? FPUS_DE : 0)));
+                       (new_flags & float_flag_input_denormal_flushed ? FPUS_DE : 0)));
 }
 
 static inline floatx80 helper_fdiv(CPUX86State *env, floatx80 a, floatx80 b)
@@ -XXX,XX +XXX,XX @@ void helper_fxtract(CPUX86State *env)
             int shift = clz64(temp.l.lower);
             temp.l.lower <<= shift;
             expdif = 1 - EXPBIAS - shift;
-            float_raise(float_flag_input_denormal, &env->fp_status);
+            float_raise(float_flag_input_denormal_flushed, &env->fp_status);
         } else {
             expdif = EXPD(temp) - EXPBIAS;
         }
@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
     uint8_t flags = get_float_exception_flags(&env->sse_status);
     /*
      * The MXCSR denormal flag has opposite semantics to
-     * float_flag_input_denormal (the softfloat code sets that flag
+     * float_flag_input_denormal_flushed (the softfloat code sets that flag
      * only when flushing input denormals to zero, but SSE sets it
      * only when not flushing them to zero), so is not converted
      * here.
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
     enable = GET_FP_ENABLE(env->active_tc.msacsr) | FP_UNIMPLEMENTED;
 
     /* Set Inexact (I) when flushing inputs to zero */
-    if ((ieee_exception_flags & float_flag_input_denormal) &&
+    if ((ieee_exception_flags & float_flag_input_denormal_flushed) &&
             (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
         if (action & CLEAR_IS_INEXACT) {
             mips_exception_flags &= ~FP_INEXACT;
diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/op_helper.c
+++ b/target/rx/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
         if (xcpt & float_flag_inexact) {
             SET_FPSW(X);
         }
-        if ((xcpt & (float_flag_input_denormal
+        if ((xcpt & (float_flag_input_denormal_flushed
                      | float_flag_output_denormal))
             && !FIELD_EX32(env->fpsw, FPSW, DN)) {
             env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(canonicalize)(FloatPartsN *p, float_status *status,
         if (likely(frac_eqz(p))) {
             p->cls = float_class_zero;
         } else if (status->flush_inputs_to_zero) {
-            float_raise(float_flag_input_denormal, status);
+            float_raise(float_flag_input_denormal_flushed, status);
             p->cls = float_class_zero;
             frac_clear(p);
         } else {
-- 
2.34.1

Our float_flag_output_denormal exception flag is set when
the fpu code flushes an output denormal to zero. Rename
it to float_flag_output_denormal_flushed:
 * this keeps it parallel with the flag for flushing
   input denormals, which we just renamed
 * it makes it clearer that it doesn't mean "set when
   the output is a denormal"

Commit created with
 for f in `git grep -l float_flag_output_denormal`; do sed -i -e 's/float_flag_output_denormal/float_flag_output_denormal_flushed/' $f; done

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-21-peter.maydell@linaro.org
---
 include/fpu/softfloat-types.h | 3 ++-
 fpu/softfloat.c               | 2 +-
 target/arm/vfp_helper.c       | 2 +-
 target/i386/tcg/fpu_helper.c  | 2 +-
 target/m68k/fpu_helper.c      | 2 +-
 target/mips/tcg/msa_helper.c  | 2 +-
 target/rx/op_helper.c         | 2 +-
 target/tricore/fpu_helper.c   | 6 +++---
 fpu/softfloat-parts.c.inc     | 2 +-
 9 files changed, 12 insertions(+), 11 deletions(-)

diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ enum {
     float_flag_inexact         = 0x0010,
     /* We flushed an input denormal to 0 (because of flush_inputs_to_zero) */
     float_flag_input_denormal_flushed = 0x0020,
-    float_flag_output_denormal = 0x0040,
+    /* We flushed an output denormal to 0 (because of flush_to_zero) */
+    float_flag_output_denormal_flushed = 0x0040,
     float_flag_invalid_isi     = 0x0080,  /* inf - inf */
     float_flag_invalid_imz     = 0x0100,  /* inf * 0 */
     float_flag_invalid_idi     = 0x0200,  /* inf / inf */
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ floatx80 roundAndPackFloatx80(FloatX80RoundPrec roundingPrecision, bool zSign,
         }
         if ( zExp <= 0 ) {
             if (status->flush_to_zero) {
-                float_raise(float_flag_output_denormal, status);
+                float_raise(float_flag_output_denormal_flushed, status);
                 return packFloatx80(zSign, 0, 0);
             }
             isTiny = status->tininess_before_rounding
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
     if (host_bits & float_flag_overflow) {
         target_bits |= FPSR_OFC;
     }
-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
+    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
         target_bits |= FPSR_UFC;
     }
     if (host_bits & float_flag_inexact) {
diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void update_mxcsr_from_sse_status(CPUX86State *env)
                    (flags & float_flag_overflow ? FPUS_OE : 0) |
                    (flags & float_flag_underflow ? FPUS_UE : 0) |
                    (flags & float_flag_inexact ? FPUS_PE : 0) |
-                   (flags & float_flag_output_denormal ? FPUS_UE | FPUS_PE :
+                   (flags & float_flag_output_denormal_flushed ? FPUS_UE | FPUS_PE :
                     0));
 }
 
diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/fpu_helper.c
+++ b/target/m68k/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static int cpu_m68k_exceptbits_from_host(int host_bits)
     if (host_bits & float_flag_overflow) {
         target_bits |= 0x40;
     }
-    if (host_bits & (float_flag_underflow | float_flag_output_denormal)) {
+    if (host_bits & (float_flag_underflow | float_flag_output_denormal_flushed)) {
         target_bits |= 0x20;
     }
     if (host_bits & float_flag_divbyzero) {
diff --git a/target/mips/tcg/msa_helper.c b/target/mips/tcg/msa_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/tcg/msa_helper.c
+++ b/target/mips/tcg/msa_helper.c
@@ -XXX,XX +XXX,XX @@ static inline int update_msacsr(CPUMIPSState *env, int action, int denormal)
     }
 
     /* Set Inexact (I) and Underflow (U) when flushing outputs to zero */
-    if ((ieee_exception_flags & float_flag_output_denormal) &&
+    if ((ieee_exception_flags & float_flag_output_denormal_flushed) &&
             (env->active_tc.msacsr & MSACSR_FS_MASK) != 0) {
         mips_exception_flags |= FP_INEXACT;
         if (action & CLEAR_FS_UNDERFLOW) {
diff --git a/target/rx/op_helper.c b/target/rx/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/op_helper.c
+++ b/target/rx/op_helper.c
@@ -XXX,XX +XXX,XX @@ static void update_fpsw(CPURXState *env, float32 ret, uintptr_t retaddr)
             SET_FPSW(X);
         }
         if ((xcpt & (float_flag_input_denormal_flushed
-                     | float_flag_output_denormal))
+                     | float_flag_output_denormal_flushed))
             && !FIELD_EX32(env->fpsw, FPSW, DN)) {
             env->fpsw = FIELD_DP32(env->fpsw, FPSW, CE, 1);
         }
diff --git a/target/tricore/fpu_helper.c b/target/tricore/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/fpu_helper.c
+++ b/target/tricore/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint8_t f_get_excp_flags(CPUTriCoreState *env)
            & (float_flag_invalid
               | float_flag_overflow
               | float_flag_underflow
-              | float_flag_output_denormal
+              | float_flag_output_denormal_flushed
               | float_flag_divbyzero
               | float_flag_inexact);
 }
@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
         some_excp = 1;
     }
 
-    if (flags & float_flag_underflow || flags & float_flag_output_denormal) {
+    if (flags & float_flag_underflow || flags & float_flag_output_denormal_flushed) {
         env->FPU_FU = 1 << 31;
         some_excp = 1;
     }
@@ -XXX,XX +XXX,XX @@ static void f_update_psw_flags(CPUTriCoreState *env, uint8_t flags)
         some_excp = 1;
     }
 
-    if (flags & float_flag_inexact || flags & float_flag_output_denormal) {
+    if (flags & float_flag_inexact || flags & float_flag_output_denormal_flushed) {
         env->PSW |= 1 << 26;
         some_excp = 1;
     }
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
         }
         frac_shr(p, frac_shift);
     } else if (s->flush_to_zero) {
-        flags |= float_flag_output_denormal;
+        flags |= float_flag_output_denormal_flushed;
         p->cls = float_class_zero;
         exp = 0;
         frac_clear(p);
-- 
2.34.1

In softfloat-types.h a comment documents that if the float_status
field flush_to_zero is set then we flush denormalised results to 0
and set the inexact flag.  This isn't correct: the status flag that
we set when flush_to_zero causes us to flush an output to zero is
float_flag_output_denormal_flushed.

Correct the comment.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-22-peter.maydell@linaro.org
---
 include/fpu/softfloat-types.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
     Float3NaNPropRule float_3nan_prop_rule;
     FloatInfZeroNaNRule float_infzeronan_rule;
     bool tininess_before_rounding;
-    /* should denormalised results go to zero and set the inexact flag? */
+    /* should denormalised results go to zero and set output_denormal_flushed? */
     bool flush_to_zero;
     /* should denormalised inputs go to zero and set input_denormal_flushed? */
     bool flush_inputs_to_zero;
-- 
2.34.1

The advsimd_addh etc helpers defined in helper-a64.c are identical to
the vfp_addh etc helpers defined in helper-vfp.c: both take two
float16 inputs (in a uint32_t type) plus a float_status* and are
simple wrappers around the softfloat float16_* functions.

(The duplication seems to be a historical accident: we added the
advsimd helpers in 2018 as part of the A64 implementation, and at
that time there was no f16 emulation in A32.  Then later we added the
A32 f16 handling by extending the existing VFP helper macros to
generate f16 versions as well as f32 and f64, and didn't realise we
could clean things up.)

Remove the now-unnecessary advsimd helpers and make the places that
generated calls to them use the vfp helpers instead. Many of the
helper functions were already unused.

(The remaining advsimd_ helpers are those which don't have vfp
versions.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-26-peter.maydell@linaro.org
---
 target/arm/tcg/helper-a64.h    |  8 --------
 target/arm/tcg/helper-a64.c    |  9 ---------
 target/arm/tcg/translate-a64.c | 16 ++++++++--------
 3 files changed, 8 insertions(+), 25 deletions(-)

diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.h
+++ b/target/arm/tcg/helper-a64.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(frecpx_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
 DEF_HELPER_FLAGS_2(fcvtx_f64_to_f32, TCG_CALL_NO_RWG, f32, f64, fpst)
 DEF_HELPER_FLAGS_3(crc32_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
 DEF_HELPER_FLAGS_3(crc32c_64, TCG_CALL_NO_RWG_SE, i64, i64, i64, i32)
-DEF_HELPER_FLAGS_3(advsimd_maxh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_FLAGS_3(advsimd_minh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_FLAGS_3(advsimd_maxnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_FLAGS_3(advsimd_minnumh, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_addh, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_subh, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_mulh, f16, f16, f16, fpst)
-DEF_HELPER_3(advsimd_divh, f16, f16, f16, fpst)
 DEF_HELPER_3(advsimd_ceq_f16, i32, f16, f16, fpst)
 DEF_HELPER_3(advsimd_cge_f16, i32, f16, f16, fpst)
 DEF_HELPER_3(advsimd_cgt_f16, i32, f16, f16, fpst)
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ uint32_t ADVSIMD_HELPER(name, h)(uint32_t a, uint32_t b, float_status *fpst) \
     return float16_ ## name(a, b, fpst);    \
 }
 
-ADVSIMD_HALFOP(add)
-ADVSIMD_HALFOP(sub)
-ADVSIMD_HALFOP(mul)
-ADVSIMD_HALFOP(div)
-ADVSIMD_HALFOP(min)
-ADVSIMD_HALFOP(max)
-ADVSIMD_HALFOP(minnum)
-ADVSIMD_HALFOP(maxnum)
-
 #define ADVSIMD_TWOHALFOP(name)                                         \
 uint32_t ADVSIMD_HELPER(name, 2h)(uint32_t two_a, uint32_t two_b,       \
                                   float_status *fpst)                   \
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fmul = {
 TRANS(FMUL_s, do_fp3_scalar, a, &f_scalar_fmul)
 
 static const FPScalar f_scalar_fmax = {
-    gen_helper_advsimd_maxh,
+    gen_helper_vfp_maxh,
     gen_helper_vfp_maxs,
     gen_helper_vfp_maxd,
 };
 TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax)
 
 static const FPScalar f_scalar_fmin = {
-    gen_helper_advsimd_minh,
+    gen_helper_vfp_minh,
     gen_helper_vfp_mins,
     gen_helper_vfp_mind,
 };
 TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin)
 
 static const FPScalar f_scalar_fmaxnm = {
-    gen_helper_advsimd_maxnumh,
+    gen_helper_vfp_maxnumh,
     gen_helper_vfp_maxnums,
     gen_helper_vfp_maxnumd,
 };
 TRANS(FMAXNM_s, do_fp3_scalar, a, &f_scalar_fmaxnm)
 
 static const FPScalar f_scalar_fminnm = {
-    gen_helper_advsimd_minnumh,
+    gen_helper_vfp_minnumh,
     gen_helper_vfp_minnums,
     gen_helper_vfp_minnumd,
 };
@@ -XXX,XX +XXX,XX @@ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
     return true;
 }
 
-TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxnumh)
-TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minnumh)
-TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_maxh)
-TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_advsimd_minh)
+TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxnumh)
+TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minnumh)
+TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxh)
+TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minh)
 
 TRANS(FMAXNMV_s, do_fp_reduction, a, gen_helper_vfp_maxnums)
 TRANS(FMINNMV_s, do_fp_reduction, a, gen_helper_vfp_minnums)
-- 
2.34.1

We should be using the F16-specific float_status for conversions from
half-precision, because halfprec inputs never set Input Denormal.

Without FEAT_AHP, using the wrong fpst here had no effect, because
the only difference between the A64_F16 and A64 fpst is its handling
of flush-to-zero on input and output, and the helper functions
vfp_fcvt_f16_to_* and vfp_fcvt_*_to_f16 all explicitly squash the
relevant flushing flags, and flush_inputs_to_zero was the only way
that IDC could be set.

With FEAT_AHP, the FPCR.AH=1 behaviour sets IDC for
input_denormal_used, which we will only ignore in
vfp_get_fpsr_from_host() for the A64_F16 fpst; so it matters that we
use that one for f16 inputs (and the normal one for single/double to
f16 conversions).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250124162836.2332150-27-peter.maydell@linaro.org
---
 target/arm/tcg/translate-a64.c | 9 ++++++---
 target/arm/tcg/translate-sve.c | 4 ++--
 2 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i32 tcg_rd = tcg_temp_new_i32();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
     if (fp_access_check(s)) {
         TCGv_i32 tcg_rn = read_fp_hreg(s, a->rn);
         TCGv_i64 tcg_rd = tcg_temp_new_i64();
-        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64);
+        TCGv_ptr tcg_fpst = fpstatus_ptr(FPST_A64_F16);
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
         return true;
     }
 
-    fpst = fpstatus_ptr(FPST_A64);
     if (a->esz == MO_64) {
         /* 32 -> 64 bit fp conversion */
         TCGv_i64 tcg_res[2];
         TCGv_i32 tcg_op = tcg_temp_new_i32();
         int srcelt = a->q ? 2 : 0;
 
+        fpst = fpstatus_ptr(FPST_A64);
+
         for (pass = 0; pass < 2; pass++) {
             tcg_res[pass] = tcg_temp_new_i64();
             read_vec_element_i32(s, tcg_op, a->rn, srcelt + pass, MO_32);
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
         TCGv_i32 tcg_res[4];
         TCGv_i32 ahp = get_ahp_flag();
 
+        fpst = fpstatus_ptr(FPST_A64_F16);
+
         for (pass = 0; pass < 4; pass++) {
             tcg_res[pass] = tcg_temp_new_i32();
             read_vec_element_i32(s, tcg_res[pass], a->rn, srcelt + pass, MO_16);
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz, fcmla_idx_fns[a->esz],
 TRANS_FEAT(FCVT_sh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvt_sh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hs, a, 0, FPST_A64)
+           gen_helper_sve_fcvt_hs, a, 0, FPST_A64_F16)
 
 TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_bfcvt, a, 0, FPST_A64)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
 TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_hd, aa64_sve, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_fcvt_hd, a, 0, FPST_A64)
+           gen_helper_sve_fcvt_hd, a, 0, FPST_A64_F16)
 TRANS_FEAT(FCVT_ds, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvt_ds, a, 0, FPST_A64)
 TRANS_FEAT(FCVT_sd, aa64_sve, gen_gvec_fpst_arg_zpz,
-- 
2.34.1

From: Hongren Zheng <i@zenithal.me>

When USBPacket in OUT direction has larger payload
than the ep_out_buffer (of size 512), a buffer overflow
would occur.

It could be fixed by limiting the size of usb_packet_copy
to be at most buffer size. Further optimization gets rid
of the ep_out_buffer and directly uses ep_out as the target
buffer.

This is reported by a security researcher who artificially
constructed an OUT packet of size 2047. The report has gone
through the QEMU security process, and as this device is for
testing purpose and no deployment of it in virtualization
environment is observed, it is triaged not to be a security bug.

Cc: qemu-stable@nongnu.org
Fixes: d7d34918551dc48 ("hw/usb: Add CanoKey Implementation")
Reported-by: Juan Jose Lopez Jaimez <thatjiaozi@gmail.com>
Signed-off-by: Hongren Zheng <i@zenithal.me>
Message-id: Z4TfMOrZz6IQYl_h@Sun
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/canokey.h | 4 ----
 hw/usb/canokey.c | 6 +++---
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/hw/usb/canokey.h b/hw/usb/canokey.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/canokey.h
+++ b/hw/usb/canokey.h
@@ -XXX,XX +XXX,XX @@
 #define CANOKEY_EP_NUM 3
 /* BULK/INTR IN can be up to 1352 bytes, e.g. get key info */
 #define CANOKEY_EP_IN_BUFFER_SIZE 2048
-/* BULK OUT can be up to 270 bytes, e.g. PIV import cert */
-#define CANOKEY_EP_OUT_BUFFER_SIZE 512
 
 typedef enum {
     CANOKEY_EP_IN_WAIT,
@@ -XXX,XX +XXX,XX @@ typedef struct CanoKeyState {
     /* OUT pointer to canokey recv buffer */
     uint8_t *ep_out[CANOKEY_EP_NUM];
     uint32_t ep_out_size[CANOKEY_EP_NUM];
-    /* For large BULK OUT, multiple write to ep_out is needed */
-    uint8_t ep_out_buffer[CANOKEY_EP_NUM][CANOKEY_EP_OUT_BUFFER_SIZE];
 
     /* Properties */
     char *file; /* canokey-file */
diff --git a/hw/usb/canokey.c b/hw/usb/canokey.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/canokey.c
+++ b/hw/usb/canokey.c
@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
     switch (p->pid) {
     case USB_TOKEN_OUT:
         trace_canokey_handle_data_out(ep_out, p->iov.size);
-        usb_packet_copy(p, key->ep_out_buffer[ep_out], p->iov.size);
         out_pos = 0;
+        /* segment packet into (possibly multiple) ep_out */
         while (out_pos != p->iov.size) {
             /*
              * key->ep_out[ep_out] set by prepare_receive
@@ -XXX,XX +XXX,XX @@ static void canokey_handle_data(USBDevice *dev, USBPacket *p)
              * to be the buffer length
              */
             out_len = MIN(p->iov.size - out_pos, key->ep_out_size[ep_out]);
-            memcpy(key->ep_out[ep_out],
-                    key->ep_out_buffer[ep_out] + out_pos, out_len);
+            /* usb_packet_copy would update the pos offset internally */
+            usb_packet_copy(p, key->ep_out[ep_out], out_len);
             out_pos += out_len;
             /* update ep_out_size to actual len */
             key->ep_out_size[ep_out] = out_len;
-- 
2.34.1