Series comparison

-[PULL 00/32] target-arm queue
+[PULL 00/68] target-arm queue
-The following changes since commit b367db48126d4ee14579af6cf5cdbffeb9496627:
+Hi; this pullreq contains only my FEAT_AFP/FEAT_RPRES patches
 (plus a fix for a target/alpha latent bug that would otherwise
 be revealed by the fpu changes), because 68 patches is already
 longer than I prefer to send in at one time...
-  Merge remote-tracking branch 'remotes/aperard/tags/pull-xen-20220127' into staging (2022-01-28 11:05:29 +0000)
+thanks
 -- PMM
 The following changes since commit ffaf7f0376f8040ce9068d71ae9ae8722505c42e:
   Merge tag 'pull-10.0-testing-and-gdstub-updates-100225-1' of https://gitlab.com/stsquad/qemu into staging (2025-02-10 13:26:17 -0500)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220128
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250211
-for you to fetch changes up to 2c023d3675a3ffb54fc30504dcd715bc6f6e234f:
+for you to fetch changes up to ca4c34e07d1388df8e396520b5e7d60883cd3690:
-  target/arm: Use correct entrypoint for SVC taken from Hyp to Hyp (2022-01-28 14:30:36 +0000)
+  target/arm: Sink fp_status and fpcr access into do_fmlal* (2025-02-11 16:22:08 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Update copyright dates to 2022
+ * target/alpha: Don't corrupt error_code with unknown softfloat flags
- * hw/armv7m: Fix broken VMStateDescription
+ * target/arm: Implement FEAT_AFP and FEAT_RPRES
  * hw/char/exynos4210_uart: Fix crash on trying to load VM state
  * rtc: Move RTC function prototypes to their own header
  * xlnx-versal-virt: Support PMC SLCR
  * xlnx-versal-virt: Support OSPI flash memory controller
  * scripts: Explain the difference between linux-headers and standard-headers
  * target/arm: Log CPU index in 'Taking exception' log
  * arm_gicv3_its: Various bugfixes and cleanups
  * arm_gicv3_its: Implement the missing MOVI and MOVALL commands
  * ast2600: Fix address mapping of second SPI controller
  * target/arm: Use correct entrypoint for SVC taken from Hyp to Hyp
 ----------------------------------------------------------------
-Andrew Baumann (1):
+Peter Maydell (49):
-      MAINTAINERS: Remove myself (for raspi).
+      target/alpha: Don't corrupt error_code with unknown softfloat flags
       fpu: Add float_class_denormal
       fpu: Implement float_flag_input_denormal_used
       fpu: allow flushing of output denormals to be after rounding
       target/arm: Define FPCR AH, FIZ, NEP bits
       target/arm: Implement FPCR.FIZ handling
       target/arm: Adjust FP behaviour for FPCR.AH = 1
       target/arm: Adjust exception flag handling for AH = 1
       target/arm: Add FPCR.AH to tbflags
       target/arm: Set up float_status to use for FPCR.AH=1 behaviour
       target/arm: Use FPST_FPCR_AH for FRECPE, FRECPS, FRECPX, FRSQRTE, FRSQRTS
       target/arm: Use FPST_FPCR_AH for BFCVT* insns
       target/arm: Use FPST_FPCR_AH for BFMLAL*, BFMLSL* insns
       target/arm: Add FPCR.NEP to TBFLAGS
       target/arm: Define and use new write_fp_*reg_merging() functions
       target/arm: Handle FPCR.NEP for 3-input scalar operations
       target/arm: Handle FPCR.NEP for BFCVT scalar
       target/arm: Handle FPCR.NEP for 1-input scalar operations
       target/arm: Handle FPCR.NEP in do_cvtf_scalar()
       target/arm: Handle FPCR.NEP for scalar FABS and FNEG
       target/arm: Handle FPCR.NEP for FCVTXN (scalar)
       target/arm: Handle FPCR.NEP for NEP for FMUL, FMULX scalar by element
       target/arm: Implement FPCR.AH semantics for scalar FMIN/FMAX
       target/arm: Implement FPCR.AH semantics for vector FMIN/FMAX
       target/arm: Implement FPCR.AH semantics for FMAXV and FMINV
       target/arm: Implement FPCR.AH semantics for FMINP and FMAXP
       target/arm: Implement FPCR.AH semantics for SVE FMAXV and FMINV
       target/arm: Implement FPCR.AH semantics for SVE FMIN/FMAX immediate
       target/arm: Implement FPCR.AH semantics for SVE FMIN/FMAX vector
       target/arm: Implement FPCR.AH handling of negation of NaN
       target/arm: Implement FPCR.AH handling for scalar FABS and FABD
       target/arm: Handle FPCR.AH in vector FABD
       target/arm: Handle FPCR.AH in SVE FNEG
       target/arm: Handle FPCR.AH in SVE FABS
       target/arm: Handle FPCR.AH in SVE FABD
       target/arm: Handle FPCR.AH in negation steps in SVE FCADD
       target/arm: Handle FPCR.AH in negation steps in FCADD
       target/arm: Handle FPCR.AH in FRECPS and FRSQRTS scalar insns
       target/arm: Handle FPCR.AH in FRECPS and FRSQRTS vector insns
       target/arm: Handle FPCR.AH in negation step in FMLS (indexed)
       target/arm: Handle FPCR.AH in negation in FMLS (vector)
       target/arm: Handle FPCR.AH in negation step in SVE FMLS (vector)
       target/arm: Handle FPCR.AH in SVE FTSSEL
       target/arm: Handle FPCR.AH in SVE FTMAD
       target/arm: Enable FEAT_AFP for '-cpu max'
       target/arm: Plumb FEAT_RPRES frecpe and frsqrte through to new helper
       target/arm: Implement increased precision FRECPE
       target/arm: Implement increased precision FRSQRTE
       target/arm: Enable FEAT_RPRES for -cpu max
-Cédric Le Goater (1):
+Richard Henderson (19):
-      hw/arm: ast2600: Fix address mapping of second SPI controller
+      target/arm: Handle FPCR.AH in vector FCMLA
       target/arm: Handle FPCR.AH in FCMLA by index
       target/arm: Handle FPCR.AH in SVE FCMLA
       target/arm: Handle FPCR.AH in FMLSL (by element and vector)
       target/arm: Handle FPCR.AH in SVE FMLSL (indexed)
       target/arm: Handle FPCR.AH in SVE FMLSLB, FMLSLT (vectors)
       target/arm: Introduce CPUARMState.vfp.fp_status[]
       target/arm: Remove standard_fp_status_f16
       target/arm: Remove standard_fp_status
       target/arm: Remove ah_fp_status_f16
       target/arm: Remove ah_fp_status
       target/arm: Remove fp_status_f16_a64
       target/arm: Remove fp_status_f16_a32
       target/arm: Remove fp_status_a64
       target/arm: Remove fp_status_a32
       target/arm: Simplify fp_status indexing in mve_helper.c
       target/arm: Simplify DO_VFP_cmp in vfp_helper.c
       target/arm: Read fz16 from env->vfp.fpcr
       target/arm: Sink fp_status and fpcr access into do_fmlal*
-Francisco Iglesias (10):
+ docs/system/arm/emulation.rst   |   2 +
-      hw/misc: Add a model of Versal's PMC SLCR
+ include/fpu/softfloat-helpers.h |  11 +
-      hw/arm/xlnx-versal: 'Or' the interrupts from the BBRAM and RTC models
+ include/fpu/softfloat-types.h   |  25 ++
-      hw/arm/xlnx-versal: Connect Versal's PMC SLCR
+ target/arm/cpu-features.h       |  10 +
-      include/hw/dma/xlnx_csu_dma: Add in missing includes in the header
+ target/arm/cpu.h                |  97 +++--
-      hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method
+ target/arm/helper.h             |  26 ++
-      hw/ssi: Add a model of Xilinx Versal's OSPI flash memory controller
+ target/arm/internals.h          |   6 +
-      hw/arm/xlnx-versal: Connect the OSPI flash memory controller model
+ target/arm/tcg/helper-a64.h     |  13 +
-      hw/block/m25p80: Add support for Micron Xccela flash mt35xu01g
+ target/arm/tcg/helper-sve.h     | 120 ++++++
-      hw/arm/xlnx-versal-virt: Connect mt35xu01g flashes to the OSPI
+ target/arm/tcg/translate-a64.h  |  13 +
-      MAINTAINERS: Add an entry for Xilinx Versal OSPI
+ target/arm/tcg/translate.h      |  54 +--
+ target/arm/tcg/vec_internal.h   |  35 ++
-Peter Maydell (20):
+ target/mips/fpu_helper.h        |   6 +
-      Update copyright dates to 2022
+ fpu/softfloat.c                 |  66 +++-
-      hw/armv7m: Fix broken VMStateDescription
+ target/alpha/cpu.c              |   7 +
-      hw/char/exynos4210_uart: Fix crash on trying to load VM state
+ target/alpha/fpu_helper.c       |   2 +
-      rtc: Move RTC function prototypes to their own header
+ target/arm/cpu.c                |  46 +--
-      scripts: Explain the difference between linux-headers and standard-headers
+ target/arm/helper.c             |   2 +-
-      target/arm: Log CPU index in 'Taking exception' log
+ target/arm/tcg/cpu64.c          |   2 +
-      hw/intc/arm_gicv3_its: Add tracepoints
+ target/arm/tcg/helper-a64.c     | 151 ++++----
-      hw/intc/arm_gicv3: Initialise dma_as in GIC, not ITS
+ target/arm/tcg/hflags.c         |  13 +
-      hw/intc/arm_gicv3_its: Don't clear GITS_CREADR when GITS_CTLR.ENABLED is set
+ target/arm/tcg/mve_helper.c     |  44 +--
-      hw/intc/arm_gicv3_its: Don't clear GITS_CWRITER on writes to GITS_CBASER
+ target/arm/tcg/sme_helper.c     |   4 +-
-      hw/intc/arm_gicv3: Honour GICD_CTLR.EnableGrp1NS for LPIs
+ target/arm/tcg/sve_helper.c     | 367 ++++++++++++++-----
-      hw/intc/arm_gicv3_its: Sort ITS command list into numeric order
+ target/arm/tcg/translate-a64.c  | 782 ++++++++++++++++++++++++++++++++--------
-      hw/intc/arm_gicv3_redist: Remove unnecessary zero checks
+ target/arm/tcg/translate-sve.c  | 193 +++++++---
-      hw/intc/arm_gicv3: Set GICR_CTLR.CES if LPIs are supported
+ target/arm/tcg/vec_helper.c     | 387 ++++++++++++++------
-      hw/intc/arm_gicv3_its: Provide read accessor for translation_ops
+ target/arm/vfp_helper.c         | 374 +++++++++++++++----
-      hw/intc/arm_gicv3_its: Make GITS_BASER<n> RAZ/WI for unimplemented registers
+ target/hppa/fpu_helper.c        |  11 +
-      hw/intc/arm_gicv3_its: Check table bounds against correct limit
+ target/i386/tcg/fpu_helper.c    |   8 +
-      hw/intc/arm_gicv3_its: Implement MOVALL
+ target/mips/msa.c               |   9 +
-      hw/intc/arm_gicv3_its: Implement MOVI
+ target/ppc/cpu_init.c           |   3 +
-      target/arm: Use correct entrypoint for SVC taken from Hyp to Hyp
+ target/rx/cpu.c                 |   8 +
+ target/sh4/cpu.c                |   8 +
- docs/conf.py                               |    2 +-
+ target/tricore/helper.c         |   1 +
- hw/intc/gicv3_internal.h                   |   43 +-
+ tests/fp/fp-bench.c             |   1 +
- include/hw/arm/xlnx-versal.h               |   30 +-
+ fpu/softfloat-parts.c.inc       | 127 +++++--
- include/hw/dma/xlnx_csu_dma.h              |   24 +-
+files changed, 2325 insertions(+), 709 deletions(-)
  include/hw/intc/arm_gicv3_its_common.h     |    1 -
  include/hw/misc/xlnx-versal-pmc-iou-slcr.h |   78 ++
  include/hw/ssi/xlnx-versal-ospi.h          |  111 ++
  include/qemu-common.h                      |    5 +-
  include/sysemu/rtc.h                       |   58 +
  target/arm/internals.h                     |    2 +-
  hw/arm/armv7m.c                            |    4 +-
  hw/arm/aspeed_ast2600.c                    |    2 +-
  hw/arm/omap1.c                             |    2 +-
  hw/arm/pxa2xx.c                            |    2 +-
  hw/arm/strongarm.c                         |    2 +-
  hw/arm/xlnx-versal-virt.c                  |   25 +-
  hw/arm/xlnx-versal.c                       |  190 ++-
  hw/block/m25p80.c                          |    2 +
  hw/char/exynos4210_uart.c                  |    2 +-
  hw/dma/xlnx_csu_dma.c                      |   17 +
  hw/intc/arm_gicv3.c                        |    1 +
  hw/intc/arm_gicv3_common.c                 |    9 +
  hw/intc/arm_gicv3_its.c                    |  258 +++-
  hw/intc/arm_gicv3_redist.c                 |  115 +-
  hw/misc/mac_via.c                          |    2 +-
  hw/misc/macio/cuda.c                       |    2 +-
  hw/misc/macio/pmu.c                        |    2 +-
  hw/misc/xlnx-versal-pmc-iou-slcr.c         | 1446 ++++++++++++++++++++++
  hw/ppc/spapr_rtc.c                         |    2 +-
  hw/rtc/allwinner-rtc.c                     |    2 +-
  hw/rtc/aspeed_rtc.c                        |    2 +-
  hw/rtc/ds1338.c                            |    2 +-
  hw/rtc/exynos4210_rtc.c                    |    2 +-
  hw/rtc/goldfish_rtc.c                      |    2 +-
  hw/rtc/m41t80.c                            |    2 +-
  hw/rtc/m48t59.c                            |    2 +-
  hw/rtc/mc146818rtc.c                       |    2 +-
  hw/rtc/pl031.c                             |    2 +-
  hw/rtc/twl92230.c                          |    2 +-
  hw/rtc/xlnx-zynqmp-rtc.c                   |    2 +-
  hw/s390x/tod-tcg.c                         |    2 +-
  hw/scsi/megasas.c                          |    2 +-
  hw/ssi/xlnx-versal-ospi.c                  | 1853 ++++++++++++++++++++++++++++
  net/dump.c                                 |    2 +-
  softmmu/rtc.c                              |    2 +-
  target/arm/helper.c                        |   13 +-
  target/arm/m_helper.c                      |    2 +-
  MAINTAINERS                                |    7 +-
  hw/intc/trace-events                       |    8 +
  hw/misc/meson.build                        |    5 +-
  hw/ssi/meson.build                         |    1 +
  scripts/update-linux-headers.sh            |   16 +
 files changed, 4300 insertions(+), 74 deletions(-)
  create mode 100644 include/hw/misc/xlnx-versal-pmc-iou-slcr.h
  create mode 100644 include/hw/ssi/xlnx-versal-ospi.h
  create mode 100644 include/sysemu/rtc.h
  create mode 100644 hw/misc/xlnx-versal-pmc-iou-slcr.c
  create mode 100644 hw/ssi/xlnx-versal-ospi.c

-[PULL 12/32] hw/block/m25p80: Add support for Micron Xccela flash mt35xu01g
+[PULL 01/68] target/alpha: Don't corrupt error_code with unknown softfloat flags
-From: Francisco Iglesias <francisco.iglesias@xilinx.com>
+In do_cvttq() we set env->error_code with what is supposed to be a
 set of FPCR exception bit values.  However, if the set of float
 exception flags we get back from softfloat for the conversion
 includes a flag which is not one of the three we expect here
 (invalid_cvti, invalid, inexact) then we will fall through the
 if-ladder and set env->error_code to the unconverted softfloat
 exception_flag value.  This will then cause us to take a spurious
 exception.
-Add support for Micron Xccela flash mt35xu01g.
+This is harmless now, but when we add new floating point exception
 flags to softfloat it will cause problems.  Add an else clause to the
 if-ladder to make it ignore any float exception flags it doesn't care
 about.
-Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Specifically, without this fix, 'make check-tcg' will fail for Alpha
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+when the commit adding float_flag_input_denormal_used lands.
-Message-id: 20220121161141.14389-9-francisco.iglesias@xilinx.com
 Fixes: aa3bad5b59e7 ("target/alpha: Use float64_to_int64_modulo for CVTTQ")
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 ---
- hw/block/m25p80.c | 2 ++
+ target/alpha/fpu_helper.c | 2 ++
 file changed, 2 insertions(+)
-diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
+diff --git a/target/alpha/fpu_helper.c b/target/alpha/fpu_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/m25p80.c
+--- a/target/alpha/fpu_helper.c
-+++ b/hw/block/m25p80.c
++++ b/target/alpha/fpu_helper.c
-@@ -XXX,XX +XXX,XX @@ static const FlashPartInfo known_devices[] = {
+@@ -XXX,XX +XXX,XX @@ static uint64_t do_cvttq(CPUAlphaState *env, uint64_t a, int roundmode)
-     { INFO("n25q512a",    0x20ba20,      0,  64 << 10, 1024, ER_4K) },
+             exc = FPCR_INV;
-     { INFO("n25q512ax3",  0x20ba20,  0x1000,  64 << 10, 1024, ER_4K) },
+         } else if (exc & float_flag_inexact) {
-     { INFO("mt25ql512ab", 0x20ba20, 0x1044, 64 << 10, 1024, ER_4K | ER_32K) },
+             exc = FPCR_INE;
-+    { INFO_STACKED("mt35xu01g", 0x2c5b1b, 0x104100, 128 << 10, 1024,
++        } else {
-+                   ER_4K | ER_32K, 2) },
++            exc = 0;
-     { INFO_STACKED("n25q00",    0x20ba21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
+         }
-     { INFO_STACKED("n25q00a",   0x20bb21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
+     }
-     { INFO_STACKED("mt25ql01g", 0x20ba21, 0x1040, 64 << 10, 2048, ER_4K, 2) },
+     env->error_code = exc;
 --
-.25.1
+.34.1

-New patch
+[PULL 02/68] fpu: Add float_class_denormal
+Currently in softfloat we canonicalize input denormals and so the
+code that implements floating point operations does not need to care
+whether the input value was originally normal or denormal.  However,
+both x86 and Arm FEAT_AFP require that an exception flag is set if:
+ * an input is denormal
+ * that input is not squashed to zero
+ * that input is actually used in the calculation (e.g. we
+   did not find the other input was a NaN)
+So we need to track that the input was a non-squashed denormal.  To
+do this we add a new value to the FloatClass enum.  In this commit we
+add the value and adjust the code everywhere that looks at FloatClass
+values so that the new float_class_denormal behaves identically to
+float_class_normal.  We will add the code that does the "raise a new
+float exception flag if an input was an unsquashed denormal and we
+used it" in a subsequent commit.
+There should be no behavioural change in this commit.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ fpu/softfloat.c           | 32 ++++++++++++++++++++++++++++---
+ fpu/softfloat-parts.c.inc | 40 ++++++++++++++++++++++++---------------
+files changed, 54 insertions(+), 18 deletions(-)
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -XXX,XX +XXX,XX @@ float64_gen2(float64 xa, float64 xb, float_status *s,
+ /*
+  * Classify a floating point number. Everything above float_class_qnan
+  * is a NaN so cls >= float_class_qnan is any NaN.
++ *
++ * Note that we canonicalize denormals, so most code should treat
++ * class_normal and class_denormal identically.
+  */
+ typedef enum __attribute__ ((__packed__)) {
+     float_class_unclassified,
+     float_class_zero,
+     float_class_normal,
++    float_class_denormal, /* input was a non-squashed denormal */
+     float_class_inf,
+     float_class_qnan,  /* all NaNs from here */
+     float_class_snan,
+@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__ ((__packed__)) {
+ enum {
+     float_cmask_zero    = float_cmask(float_class_zero),
+     float_cmask_normal  = float_cmask(float_class_normal),
++    float_cmask_denormal = float_cmask(float_class_denormal),
+     float_cmask_inf     = float_cmask(float_class_inf),
+     float_cmask_qnan    = float_cmask(float_class_qnan),
+     float_cmask_snan    = float_cmask(float_class_snan),
+     float_cmask_infzero = float_cmask_zero | float_cmask_inf,
+     float_cmask_anynan  = float_cmask_qnan | float_cmask_snan,
++    float_cmask_anynorm = float_cmask_normal | float_cmask_denormal,
+ };
+ /* Flags for parts_minmax. */
+@@ -XXX,XX +XXX,XX @@ static inline __attribute__((unused)) bool is_qnan(FloatClass c)
+     return c == float_class_qnan;
+ }
++/*
++ * Return true if the float_cmask has only normals in it
++ * (including input denormals that were canonicalized)
++ */
++static inline bool cmask_is_only_normals(int cmask)
++{
++    return !(cmask & ~float_cmask_anynorm);
++}
++
++static inline bool is_anynorm(FloatClass c)
++{
++    return float_cmask(c) & float_cmask_anynorm;
++}
++
+ /*
+  * Structure holding all of the decomposed parts of a float.
+  * The exponent is unbiased and the fraction is normalized.
+@@ -XXX,XX +XXX,XX @@ static float64 float64r32_round_pack_canonical(FloatParts64 *p,
+      */
+     switch (p->cls) {
+     case float_class_normal:
++    case float_class_denormal:
+         if (unlikely(p->exp == 0)) {
+             /*
+              * The result is denormal for float32, but can be represented
+@@ -XXX,XX +XXX,XX @@ static floatx80 floatx80_round_pack_canonical(FloatParts128 *p,
+     switch (p->cls) {
+     case float_class_normal:
++    case float_class_denormal:
+         if (s->floatx80_rounding_precision == floatx80_precision_x) {
+             parts_uncanon_normal(p, s, fmt);
+             frac = p->frac_hi;
+@@ -XXX,XX +XXX,XX @@ static void parts_float_to_ahp(FloatParts64 *a, float_status *s)
+         break;
+     case float_class_normal:
++    case float_class_denormal:
+     case float_class_zero:
+         break;
+@@ -XXX,XX +XXX,XX @@ static void parts_float_to_float_narrow(FloatParts64 *a, FloatParts128 *b,
+     a->sign = b->sign;
+     a->exp = b->exp;
+-    if (a->cls == float_class_normal) {
++    if (is_anynorm(a->cls)) {
+         frac_truncjam(a, b);
+     } else if (is_nan(a->cls)) {
+         /* Discard the low bits of the NaN. */
+@@ -XXX,XX +XXX,XX @@ static Int128 float128_to_int128_scalbn(float128 a, FloatRoundMode rmode,
+         return int128_zero();
+     case float_class_normal:
++    case float_class_denormal:
+         if (parts_round_to_int_normal(&p, rmode, scale, 128 - 2)) {
+             flags = float_flag_inexact;
+         }
+@@ -XXX,XX +XXX,XX @@ static Int128 float128_to_uint128_scalbn(float128 a, FloatRoundMode rmode,
+         return int128_zero();
+     case float_class_normal:
++    case float_class_denormal:
+         if (parts_round_to_int_normal(&p, rmode, scale, 128 - 2)) {
+             flags = float_flag_inexact;
+             if (p.cls == float_class_zero) {
+@@ -XXX,XX +XXX,XX @@ float32 float32_exp2(float32 a, float_status *status)
+     float32_unpack_canonical(&xp, a, status);
+     if (unlikely(xp.cls != float_class_normal)) {
+         switch (xp.cls) {
++        case float_class_denormal:
++            break;
+         case float_class_snan:
+         case float_class_qnan:
+             parts_return_nan(&xp, status);
+@@ -XXX,XX +XXX,XX @@ float32 float32_exp2(float32 a, float_status *status)
+         case float_class_zero:
+             return float32_one;
+         default:
+-            break;
++            g_assert_not_reached();
+         }
+-        g_assert_not_reached();
+     }
+     float_raise(float_flag_inexact, status);
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-parts.c.inc
++++ b/fpu/softfloat-parts.c.inc
+@@ -XXX,XX +XXX,XX @@ static void partsN(canonicalize)(FloatPartsN *p, float_status *status,
+             frac_clear(p);
+         } else {
+             int shift = frac_normalize(p);
+-            p->cls = float_class_normal;
++            p->cls = float_class_denormal;
+             p->exp = fmt->frac_shift - fmt->exp_bias
+                    - shift + !fmt->m68k_denormal;
+         }
+@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
+ static void partsN(uncanon)(FloatPartsN *p, float_status *s,
+                             const FloatFmt *fmt)
+ {
+-    if (likely(p->cls == float_class_normal)) {
++    if (likely(is_anynorm(p->cls))) {
+         parts_uncanon_normal(p, s, fmt);
+     } else {
+         switch (p->cls) {
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(addsub)(FloatPartsN *a, FloatPartsN *b,
+     if (a->sign != b_sign) {
+         /* Subtraction */
+-        if (likely(ab_mask == float_cmask_normal)) {
++        if (likely(cmask_is_only_normals(ab_mask))) {
+             if (parts_sub_normal(a, b)) {
+                 return a;
+             }
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(addsub)(FloatPartsN *a, FloatPartsN *b,
+         }
+     } else {
+         /* Addition */
+-        if (likely(ab_mask == float_cmask_normal)) {
++        if (likely(cmask_is_only_normals(ab_mask))) {
+             parts_add_normal(a, b);
+             return a;
+         }
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(addsub)(FloatPartsN *a, FloatPartsN *b,
+     }
+     if (b->cls == float_class_zero) {
+-        g_assert(a->cls == float_class_normal);
++        g_assert(is_anynorm(a->cls));
+         return a;
+     }
+     g_assert(a->cls == float_class_zero);
+-    g_assert(b->cls == float_class_normal);
++    g_assert(is_anynorm(b->cls));
+  return_b:
+     b->sign = b_sign;
+     return b;
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(mul)(FloatPartsN *a, FloatPartsN *b,
+     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
+     bool sign = a->sign ^ b->sign;
+-    if (likely(ab_mask == float_cmask_normal)) {
++    if (likely(cmask_is_only_normals(ab_mask))) {
+         FloatPartsW tmp;
+         frac_mulw(&tmp, a, b);
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
+         a->sign ^= 1;
+     }
+-    if (unlikely(ab_mask != float_cmask_normal)) {
++    if (unlikely(!cmask_is_only_normals(ab_mask))) {
+         if (unlikely(ab_mask == float_cmask_infzero)) {
+             float_raise(float_flag_invalid | float_flag_invalid_imz, s);
+             goto d_nan;
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
+         }
+         g_assert(ab_mask & float_cmask_zero);
+-        if (c->cls == float_class_normal) {
++        if (is_anynorm(c->cls)) {
+             *a = *c;
+             goto return_normal;
+         }
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(div)(FloatPartsN *a, FloatPartsN *b,
+     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
+     bool sign = a->sign ^ b->sign;
+-    if (likely(ab_mask == float_cmask_normal)) {
++    if (likely(cmask_is_only_normals(ab_mask))) {
+         a->sign = sign;
+         a->exp -= b->exp + frac_div(a, b);
+         return a;
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(modrem)(FloatPartsN *a, FloatPartsN *b,
+ {
+     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
+-    if (likely(ab_mask == float_cmask_normal)) {
++    if (likely(cmask_is_only_normals(ab_mask))) {
+         frac_modrem(a, b, mod_quot);
+         return a;
+     }
+@@ -XXX,XX +XXX,XX @@ static void partsN(sqrt)(FloatPartsN *a, float_status *status,
+     if (unlikely(a->cls != float_class_normal)) {
+         switch (a->cls) {
++        case float_class_denormal:
++            break;
+         case float_class_snan:
+         case float_class_qnan:
+             parts_return_nan(a, status);
+@@ -XXX,XX +XXX,XX @@ static void partsN(round_to_int)(FloatPartsN *a, FloatRoundMode rmode,
+     case float_class_inf:
+         break;
+     case float_class_normal:
++    case float_class_denormal:
+         if (parts_round_to_int_normal(a, rmode, scale, fmt->frac_size)) {
+             float_raise(float_flag_inexact, s);
+         }
+@@ -XXX,XX +XXX,XX @@ static int64_t partsN(float_to_sint)(FloatPartsN *p, FloatRoundMode rmode,
+         return 0;
+     case float_class_normal:
++    case float_class_denormal:
+         /* TODO: N - 2 is frac_size for rounding; could use input fmt. */
+         if (parts_round_to_int_normal(p, rmode, scale, N - 2)) {
+             flags = float_flag_inexact;
+@@ -XXX,XX +XXX,XX @@ static uint64_t partsN(float_to_uint)(FloatPartsN *p, FloatRoundMode rmode,
+         return 0;
+     case float_class_normal:
++    case float_class_denormal:
+         /* TODO: N - 2 is frac_size for rounding; could use input fmt. */
+         if (parts_round_to_int_normal(p, rmode, scale, N - 2)) {
+             flags = float_flag_inexact;
+@@ -XXX,XX +XXX,XX @@ static int64_t partsN(float_to_sint_modulo)(FloatPartsN *p,
+         return 0;
+     case float_class_normal:
++    case float_class_denormal:
+         /* TODO: N - 2 is frac_size for rounding; could use input fmt. */
+         if (parts_round_to_int_normal(p, rmode, 0, N - 2)) {
+             flags = float_flag_inexact;
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(minmax)(FloatPartsN *a, FloatPartsN *b,
+     a_exp = a->exp;
+     b_exp = b->exp;
+-    if (unlikely(ab_mask != float_cmask_normal)) {
++    if (unlikely(!cmask_is_only_normals(ab_mask))) {
+         switch (a->cls) {
+         case float_class_normal:
++        case float_class_denormal:
+             break;
+         case float_class_inf:
+             a_exp = INT16_MAX;
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(minmax)(FloatPartsN *a, FloatPartsN *b,
+         }
+         switch (b->cls) {
+         case float_class_normal:
++        case float_class_denormal:
+             break;
+         case float_class_inf:
+             b_exp = INT16_MAX;
+@@ -XXX,XX +XXX,XX @@ static FloatRelation partsN(compare)(FloatPartsN *a, FloatPartsN *b,
+ {
+     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
+-    if (likely(ab_mask == float_cmask_normal)) {
++    if (likely(cmask_is_only_normals(ab_mask))) {
+         FloatRelation cmp;
+         if (a->sign != b->sign) {
+@@ -XXX,XX +XXX,XX @@ static void partsN(scalbn)(FloatPartsN *a, int n, float_status *s)
+     case float_class_inf:
+         break;
+     case float_class_normal:
++    case float_class_denormal:
+         a->exp += MIN(MAX(n, -0x10000), 0x10000);
+         break;
+     default:
+@@ -XXX,XX +XXX,XX @@ static void partsN(log2)(FloatPartsN *a, float_status *s, const FloatFmt *fmt)
+     if (unlikely(a->cls != float_class_normal)) {
+         switch (a->cls) {
++        case float_class_denormal:
++            break;
+         case float_class_snan:
+         case float_class_qnan:
+             parts_return_nan(a, s);
+@@ -XXX,XX +XXX,XX @@ static void partsN(log2)(FloatPartsN *a, float_status *s, const FloatFmt *fmt)
+             }
+             return;
+         default:
+-            break;
++            g_assert_not_reached();
+         }
+-        g_assert_not_reached();
+     }
+     if (unlikely(a->sign)) {
+         goto d_nan;
+--
+.34.1

-New patch
+[PULL 03/68] fpu: Implement float_flag_input_denormal_used
+For the x86 and the Arm FEAT_AFP semantics, we need to be able to
+tell the target code that the FPU operation has used an input
+denormal.  Implement this; when it happens we set the new
+float_flag_denormal_input_used.
+Note that we only set this when an input denormal is actually used by
+the operation: if the operation results in Invalid Operation or
+Divide By Zero or the result is a NaN because some other input was a
+NaN then we never needed to look at the input denormal and do not set
+denormal_input_used.
+We mostly do not need to adjust the hardfloat codepaths to deal with
+this flag, because almost all hardfloat operations are already gated
+on the input not being a denormal, and will fall back to softfloat
+for a denormal input.  The only exception is the comparison
+operations, where we need to add the check for input denormals, which
+must now fall back to softfloat where they did not before.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ include/fpu/softfloat-types.h |  7 ++++
+ fpu/softfloat.c               | 38 +++++++++++++++++---
+ fpu/softfloat-parts.c.inc     | 68 ++++++++++++++++++++++++++++++++++-
+files changed, 107 insertions(+), 6 deletions(-)
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/fpu/softfloat-types.h
++++ b/include/fpu/softfloat-types.h
+@@ -XXX,XX +XXX,XX @@ enum {
+     float_flag_invalid_sqrt    = 0x0800,  /* sqrt(-x) */
+     float_flag_invalid_cvti    = 0x1000,  /* non-nan to integer */
+     float_flag_invalid_snan    = 0x2000,  /* any operand was snan */
++    /*
++     * An input was denormal and we used it (without flushing it to zero).
++     * Not set if we do not actually use the denormal input (e.g.
++     * because some other input was a NaN, or because the operation
++     * wasn't actually carried out (divide-by-zero; invalid))
++     */
++    float_flag_input_denormal_used = 0x4000,
+ };
+ /*
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat.c
++++ b/fpu/softfloat.c
+@@ -XXX,XX +XXX,XX @@ static void parts_float_to_ahp(FloatParts64 *a, float_status *s)
+                                   float16_params_ahp.frac_size + 1);
+         break;
+-    case float_class_normal:
+     case float_class_denormal:
++        float_raise(float_flag_input_denormal_used, s);
++        break;
++    case float_class_normal:
+     case float_class_zero:
+         break;
+@@ -XXX,XX +XXX,XX @@ static void parts64_float_to_float(FloatParts64 *a, float_status *s)
+     if (is_nan(a->cls)) {
+         parts_return_nan(a, s);
+     }
++    if (a->cls == float_class_denormal) {
++        float_raise(float_flag_input_denormal_used, s);
++    }
+ }
+ static void parts128_float_to_float(FloatParts128 *a, float_status *s)
+@@ -XXX,XX +XXX,XX @@ static void parts128_float_to_float(FloatParts128 *a, float_status *s)
+     if (is_nan(a->cls)) {
+         parts_return_nan(a, s);
+     }
++    if (a->cls == float_class_denormal) {
++        float_raise(float_flag_input_denormal_used, s);
++    }
+ }
+ #define parts_float_to_float(P, S) \
+@@ -XXX,XX +XXX,XX @@ static void parts_float_to_float_narrow(FloatParts64 *a, FloatParts128 *b,
+     a->sign = b->sign;
+     a->exp = b->exp;
+-    if (is_anynorm(a->cls)) {
++    switch (a->cls) {
++    case float_class_denormal:
++        float_raise(float_flag_input_denormal_used, s);
++        /* fall through */
++    case float_class_normal:
+         frac_truncjam(a, b);
+-    } else if (is_nan(a->cls)) {
++        break;
++    case float_class_snan:
++    case float_class_qnan:
+         /* Discard the low bits of the NaN. */
+         a->frac = b->frac_hi;
+         parts_return_nan(a, s);
++        break;
++    default:
++        break;
+     }
+ }
+@@ -XXX,XX +XXX,XX @@ static void parts_float_to_float_widen(FloatParts128 *a, FloatParts64 *b,
+     if (is_nan(a->cls)) {
+         parts_return_nan(a, s);
+     }
++    if (a->cls == float_class_denormal) {
++        float_raise(float_flag_input_denormal_used, s);
++    }
+ }
+ float32 float16_to_float32(float16 a, bool ieee, float_status *s)
+@@ -XXX,XX +XXX,XX @@ float32_hs_compare(float32 xa, float32 xb, float_status *s, bool is_quiet)
+         goto soft;
+     }
+-    float32_input_flush2(&ua.s, &ub.s, s);
++    if (unlikely(float32_is_denormal(ua.s) || float32_is_denormal(ub.s))) {
++        /* We may need to set the input_denormal_used flag */
++        goto soft;
++    }
++
+     if (isgreaterequal(ua.h, ub.h)) {
+         if (isgreater(ua.h, ub.h)) {
+             return float_relation_greater;
+@@ -XXX,XX +XXX,XX @@ float64_hs_compare(float64 xa, float64 xb, float_status *s, bool is_quiet)
+         goto soft;
+     }
+-    float64_input_flush2(&ua.s, &ub.s, s);
++    if (unlikely(float64_is_denormal(ua.s) || float64_is_denormal(ub.s))) {
++        /* We may need to set the input_denormal_used flag */
++        goto soft;
++    }
++
+     if (isgreaterequal(ua.h, ub.h)) {
+         if (isgreater(ua.h, ub.h)) {
+             return float_relation_greater;
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-parts.c.inc
++++ b/fpu/softfloat-parts.c.inc
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(addsub)(FloatPartsN *a, FloatPartsN *b,
+     bool b_sign = b->sign ^ subtract;
+     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
++    /*
++     * For addition and subtraction, we will consume an
++     * input denormal unless the other input is a NaN.
++     */
++    if ((ab_mask & (float_cmask_denormal | float_cmask_anynan)) ==
++        float_cmask_denormal) {
++        float_raise(float_flag_input_denormal_used, s);
++    }
++
+     if (a->sign != b_sign) {
+         /* Subtraction */
+         if (likely(cmask_is_only_normals(ab_mask))) {
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(mul)(FloatPartsN *a, FloatPartsN *b,
+     if (likely(cmask_is_only_normals(ab_mask))) {
+         FloatPartsW tmp;
++        if (ab_mask & float_cmask_denormal) {
++            float_raise(float_flag_input_denormal_used, s);
++        }
++
+         frac_mulw(&tmp, a, b);
+         frac_truncjam(a, &tmp);
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(mul)(FloatPartsN *a, FloatPartsN *b,
+     }
+     /* Multiply by 0 or Inf */
++    if (ab_mask & float_cmask_denormal) {
++        float_raise(float_flag_input_denormal_used, s);
++    }
++
+     if (ab_mask & float_cmask_inf) {
+         a->cls = float_class_inf;
+         a->sign = sign;
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
+     if (flags & float_muladd_negate_result) {
+         a->sign ^= 1;
+     }
++
++    /*
++     * All result types except for "return the default NaN
++     * because this is an Invalid Operation" go through here;
++     * this matches the set of cases where we consumed a
++     * denormal input.
++     */
++    if (abc_mask & float_cmask_denormal) {
++        float_raise(float_flag_input_denormal_used, s);
++    }
+     return a;
+  return_sub_zero:
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(div)(FloatPartsN *a, FloatPartsN *b,
+     bool sign = a->sign ^ b->sign;
+     if (likely(cmask_is_only_normals(ab_mask))) {
++        if (ab_mask & float_cmask_denormal) {
++            float_raise(float_flag_input_denormal_used, s);
++        }
+         a->sign = sign;
+         a->exp -= b->exp + frac_div(a, b);
+         return a;
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(div)(FloatPartsN *a, FloatPartsN *b,
+         return parts_pick_nan(a, b, s);
+     }
++    if ((ab_mask & float_cmask_denormal) && b->cls != float_class_zero) {
++        float_raise(float_flag_input_denormal_used, s);
++    }
++
+     a->sign = sign;
+     /* Inf / X */
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(modrem)(FloatPartsN *a, FloatPartsN *b,
+     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
+     if (likely(cmask_is_only_normals(ab_mask))) {
++        if (ab_mask & float_cmask_denormal) {
++            float_raise(float_flag_input_denormal_used, s);
++        }
+         frac_modrem(a, b, mod_quot);
+         return a;
+     }
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(modrem)(FloatPartsN *a, FloatPartsN *b,
+         return a;
+     }
++    if (ab_mask & float_cmask_denormal) {
++        float_raise(float_flag_input_denormal_used, s);
++    }
++
+     /* N % Inf; 0 % N */
+     g_assert(b->cls == float_class_inf || a->cls == float_class_zero);
+     return a;
+@@ -XXX,XX +XXX,XX @@ static void partsN(sqrt)(FloatPartsN *a, float_status *status,
+     if (unlikely(a->cls != float_class_normal)) {
+         switch (a->cls) {
+         case float_class_denormal:
++            if (!a->sign) {
++                /* -ve denormal will be InvalidOperation */
++                float_raise(float_flag_input_denormal_used, status);
++            }
+             break;
+         case float_class_snan:
+         case float_class_qnan:
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(minmax)(FloatPartsN *a, FloatPartsN *b,
+         if ((flags & (minmax_isnum | minmax_isnumber))
+             && !(ab_mask & float_cmask_snan)
+             && (ab_mask & ~float_cmask_qnan)) {
++            if (ab_mask & float_cmask_denormal) {
++                float_raise(float_flag_input_denormal_used, s);
++            }
+             return is_nan(a->cls) ? b : a;
+         }
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(minmax)(FloatPartsN *a, FloatPartsN *b,
+         return parts_pick_nan(a, b, s);
+     }
++    if (ab_mask & float_cmask_denormal) {
++        float_raise(float_flag_input_denormal_used, s);
++    }
++
+     a_exp = a->exp;
+     b_exp = b->exp;
+@@ -XXX,XX +XXX,XX @@ static FloatRelation partsN(compare)(FloatPartsN *a, FloatPartsN *b,
+     if (likely(cmask_is_only_normals(ab_mask))) {
+         FloatRelation cmp;
++        if (ab_mask & float_cmask_denormal) {
++            float_raise(float_flag_input_denormal_used, s);
++        }
++
+         if (a->sign != b->sign) {
+             goto a_sign;
+         }
+@@ -XXX,XX +XXX,XX @@ static FloatRelation partsN(compare)(FloatPartsN *a, FloatPartsN *b,
+         return float_relation_unordered;
+     }
++    if (ab_mask & float_cmask_denormal) {
++        float_raise(float_flag_input_denormal_used, s);
++    }
++
+     if (ab_mask & float_cmask_zero) {
+         if (ab_mask == float_cmask_zero) {
+             return float_relation_equal;
+@@ -XXX,XX +XXX,XX @@ static void partsN(scalbn)(FloatPartsN *a, int n, float_status *s)
+     case float_class_zero:
+     case float_class_inf:
+         break;
+-    case float_class_normal:
+     case float_class_denormal:
++        float_raise(float_flag_input_denormal_used, s);
++        /* fall through */
++    case float_class_normal:
+         a->exp += MIN(MAX(n, -0x10000), 0x10000);
+         break;
+     default:
+@@ -XXX,XX +XXX,XX @@ static void partsN(log2)(FloatPartsN *a, float_status *s, const FloatFmt *fmt)
+     if (unlikely(a->cls != float_class_normal)) {
+         switch (a->cls) {
+         case float_class_denormal:
++            if (!a->sign) {
++                /* -ve denormal will be InvalidOperation */
++                float_raise(float_flag_input_denormal_used, s);
++            }
+             break;
+         case float_class_snan:
+         case float_class_qnan:
+--
+.34.1

-New patch
+[PULL 04/68] fpu: allow flushing of output denormals to be after rounding
+Currently we handle flushing of output denormals in uncanon_normal
 always before we deal with rounding.  This works for architectures
 that detect tininess before rounding, but is usually not the right
 place when the architecture detects tininess after rounding.  For
 example, for x86 the SDM states that the MXCSR FTZ control bit causes
 outputs to be flushed to zero "when it detects a floating-point
 underflow condition".  This means that we mustn't flush to zero if
 the input is such that after rounding it is no longer tiny.
 At least one of our guest architectures does underflow detection
 after rounding but flushing of denormals before rounding (MIPS MSA);
 this means we need to have a config knob for this that is separate
 from our existing tininess_before_rounding setting.
 Add an ftz_detection flag.  For consistency with
 tininess_before_rounding, we make it default to "detect ftz after
 rounding"; this means that we need to explicitly set the flag to
 "detect ftz before rounding" on every existing architecture that sets
 flush_to_zero, so that this commit has no behaviour change.
 (This means more code change here but for the long term a less
 confusing API.)
 For several architectures the current behaviour is either
 definitely or possibly wrong; annotate those with TODO comments.
 These architectures are definitely wrong (and should detect
 ftz after rounding):
  * x86
  * Alpha
 For these architectures the spec is unclear:
  * MIPS (for non-MSA)
  * RX
  * SH4
 PA-RISC makes ftz detection IMPDEF, but we aren't setting the
 "tininess before rounding" setting that we ought to.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  include/fpu/softfloat-helpers.h | 11 +++++++++++
  include/fpu/softfloat-types.h   | 18 ++++++++++++++++++
  target/mips/fpu_helper.h        |  6 ++++++
  target/alpha/cpu.c              |  7 +++++++
  target/arm/cpu.c                |  1 +
  target/hppa/fpu_helper.c        | 11 +++++++++++
  target/i386/tcg/fpu_helper.c    |  8 ++++++++
  target/mips/msa.c               |  9 +++++++++
  target/ppc/cpu_init.c           |  3 +++
  target/rx/cpu.c                 |  8 ++++++++
  target/sh4/cpu.c                |  8 ++++++++
  target/tricore/helper.c         |  1 +
  tests/fp/fp-bench.c             |  1 +
  fpu/softfloat-parts.c.inc       | 21 +++++++++++++++------
 files changed, 107 insertions(+), 6 deletions(-)
 diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/fpu/softfloat-helpers.h
 +++ b/include/fpu/softfloat-helpers.h
@@ -XXX,XX +XXX,XX @@ static inline void set_flush_inputs_to_zero(bool val, float_status *status)
      status->flush_inputs_to_zero = val;
  }
 +static inline void set_float_ftz_detection(FloatFTZDetection d,
 +                                           float_status *status)
 +{
 +    status->ftz_detection = d;
 +}
 +
  static inline void set_default_nan_mode(bool val, float_status *status)
  {
      status->default_nan_mode = val;
@@ -XXX,XX +XXX,XX @@ static inline bool get_default_nan_mode(const float_status *status)
      return status->default_nan_mode;
  }
 +static inline FloatFTZDetection get_float_ftz_detection(const float_status *status)
 +{
 +    return status->ftz_detection;
 +}
 +
  #endif /* SOFTFLOAT_HELPERS_H */
 diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/fpu/softfloat-types.h
 +++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
      float_infzeronan_suppress_invalid = (1 << 7),
  } FloatInfZeroNaNRule;
 +/*
 + * When flush_to_zero is set, should we detect denormal results to
 + * be flushed before or after rounding? For most architectures this
 + * should be set to match the tininess_before_rounding setting,
 + * but a few architectures, e.g. MIPS MSA, detect FTZ before
 + * rounding but tininess after rounding.
 + *
 + * This enum is arranged so that the default if the target doesn't
 + * configure it matches the default for tininess_before_rounding
 + * (i.e. "after rounding").
 + */
 +typedef enum __attribute__((__packed__)) {
 +    float_ftz_after_rounding = 0,
 +    float_ftz_before_rounding = 1,
 +} FloatFTZDetection;
 +
  /*
   * Floating Point Status. Individual architectures may maintain
   * several versions of float_status for different functions. The
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
      bool tininess_before_rounding;
      /* should denormalised results go to zero and set output_denormal_flushed? */
      bool flush_to_zero;
 +    /* do we detect and flush denormal results before or after rounding? */
 +    FloatFTZDetection ftz_detection;
      /* should denormalised inputs go to zero and set input_denormal_flushed? */
      bool flush_inputs_to_zero;
      bool default_nan_mode;
 diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/fpu_helper.h
 +++ b/target/mips/fpu_helper.h
@@ -XXX,XX +XXX,XX @@ static inline void fp_reset(CPUMIPSState *env)
       */
      set_float_2nan_prop_rule(float_2nan_prop_s_ab,
                               &env->active_fpu.fp_status);
 +    /*
 +     * TODO: the spec does't say clearly whether FTZ happens before
 +     * or after rounding for normal FPU operations.
 +     */
 +    set_float_ftz_detection(float_ftz_before_rounding,
 +                            &env->active_fpu.fp_status);
  }
  /* MSA */
 diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/alpha/cpu.c
 +++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_initfn(Object *obj)
      set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
      /* Default NaN: sign bit clear, msb frac bit set */
      set_float_default_nan_pattern(0b01000000, &env->fp_status);
 +    /*
 +     * TODO: this is incorrect. The Alpha Architecture Handbook version 4
 +     * section 4.7.7.11 says that we flush to zero for underflow cases, so
 +     * this should be float_ftz_after_rounding to match the
 +     * tininess_after_rounding (which is specified in section 4.7.5).
 +     */
 +    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
  #if defined(CONFIG_USER_ONLY)
      env->flags = ENV_FLAG_PS_USER | ENV_FLAG_FEN;
      cpu_alpha_store_fpcr(env, (uint64_t)(FPCR_INVD | FPCR_DZED | FPCR_OVFD
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
  static void arm_set_default_fp_behaviours(float_status *s)
  {
      set_float_detect_tininess(float_tininess_before_rounding, s);
 +    set_float_ftz_detection(float_ftz_before_rounding, s);
      set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
      set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
      set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
 diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/hppa/fpu_helper.c
 +++ b/target/hppa/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
      set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
      /* Default NaN: sign bit clear, msb-1 frac bit set */
      set_float_default_nan_pattern(0b00100000, &env->fp_status);
 +    /*
 +     * "PA-RISC 2.0 Architecture" says it is IMPDEF whether the flushing
 +     * enabled by FPSR.D happens before or after rounding. We pick "before"
 +     * for consistency with tininess detection.
 +     */
 +    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
 +    /*
 +     * TODO: "PA-RISC 2.0 Architecture" chapter 10 says that we should
 +     * detect tininess before rounding, but we don't set that here so we
 +     * get the default tininess after rounding.
 +     */
  }
  void cpu_hppa_loaded_fr0(CPUHPPAState *env)
 diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/i386/tcg/fpu_helper.c
 +++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
      set_float_default_nan_pattern(0b11000000, &env->fp_status);
      set_float_default_nan_pattern(0b11000000, &env->mmx_status);
      set_float_default_nan_pattern(0b11000000, &env->sse_status);
 +    /*
 +     * TODO: x86 does flush-to-zero detection after rounding (the SDM
 +     * section 10.2.3.3 on the FTZ bit of MXCSR says that we flush
 +     * when we detect underflow, which x86 does after rounding).
 +     */
 +    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
 +    set_float_ftz_detection(float_ftz_before_rounding, &env->mmx_status);
 +    set_float_ftz_detection(float_ftz_before_rounding, &env->sse_status);
  }
  static inline uint8_t save_exception_flags(CPUX86State *env)
 diff --git a/target/mips/msa.c b/target/mips/msa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/mips/msa.c
 +++ b/target/mips/msa.c
@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
      /* tininess detected after rounding.*/
      set_float_detect_tininess(float_tininess_after_rounding,
                                &env->active_tc.msa_fp_status);
 +    /*
 +     * MSACSR.FS detects tiny results to flush to zero before rounding
 +     * (per "MIPS Architecture for Programmers Volume IV-j: The MIPS64 SIMD
 +     * Architecture Module, Revision 1.1" section 3.5.4), even though it
 +     * detects tininess after rounding for underflow purposes (section 3.4.2
 +     * table 3.3).
 +     */
 +    set_float_ftz_detection(float_ftz_before_rounding,
 +                            &env->active_tc.msa_fp_status);
      /*
       * According to MIPS specifications, if one of the two operands is
 diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/ppc/cpu_init.c
 +++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
      /* tininess for underflow is detected before rounding */
      set_float_detect_tininess(float_tininess_before_rounding,
                                &env->fp_status);
 +    /* Similarly for flush-to-zero */
 +    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
 +
      /*
       * PowerPC propagation rules:
       *  1. A if it sNaN or qNaN
 diff --git a/target/rx/cpu.c b/target/rx/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/rx/cpu.c
 +++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_reset_hold(Object *obj, ResetType type)
      set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
      /* Default NaN value: sign bit clear, set frac msb */
      set_float_default_nan_pattern(0b01000000, &env->fp_status);
 +    /*
 +     * TODO: "RX Family RXv1 Instruction Set Architecture" is not 100% clear
 +     * on whether flush-to-zero should happen before or after rounding, but
 +     * section 1.3.2 says that it happens when underflow is detected, and
 +     * implies that underflow is detected after rounding. So this may not
 +     * be the correct setting.
 +     */
 +    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
  }
  static ObjectClass *rx_cpu_class_by_name(const char *cpu_model)
 diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sh4/cpu.c
 +++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_reset_hold(Object *obj, ResetType type)
      set_default_nan_mode(1, &env->fp_status);
      /* sign bit clear, set all frac bits other than msb */
      set_float_default_nan_pattern(0b00111111, &env->fp_status);
 +    /*
 +     * TODO: "SH-4 CPU Core Architecture ADCS 7182230F" doesn't say whether
 +     * it detects tininess before or after rounding. Section 6.4 is clear
 +     * that flush-to-zero happens when the result underflows, though, so
 +     * either this should be "detect ftz after rounding" or else we should
 +     * be setting "detect tininess before rounding".
 +     */
 +    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
  }
  static void superh_cpu_disas_set_info(CPUState *cpu, disassemble_info *info)
 diff --git a/target/tricore/helper.c b/target/tricore/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/tricore/helper.c
 +++ b/target/tricore/helper.c
@@ -XXX,XX +XXX,XX @@ void fpu_set_state(CPUTriCoreState *env)
      set_flush_inputs_to_zero(1, &env->fp_status);
      set_flush_to_zero(1, &env->fp_status);
      set_float_detect_tininess(float_tininess_before_rounding, &env->fp_status);
 +    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
      set_default_nan_mode(1, &env->fp_status);
      /* Default NaN pattern: sign bit clear, frac msb set */
      set_float_default_nan_pattern(0b01000000, &env->fp_status);
 diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/fp/fp-bench.c
 +++ b/tests/fp/fp-bench.c
@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
      set_float_3nan_prop_rule(float_3nan_prop_s_cab, &soft_status);
      set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
      set_float_default_nan_pattern(0b01000000, &soft_status);
 +    set_float_ftz_detection(float_ftz_before_rounding, &soft_status);
      f = bench_funcs[operation][precision];
      g_assert(f);
 diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-parts.c.inc
 +++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
              p->frac_lo &= ~round_mask;
          }
          frac_shr(p, frac_shift);
 -    } else if (s->flush_to_zero) {
 +    } else if (s->flush_to_zero &&
 +               s->ftz_detection == float_ftz_before_rounding) {
          flags |= float_flag_output_denormal_flushed;
          p->cls = float_class_zero;
          exp = 0;
@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
          exp = (p->frac_hi & DECOMPOSED_IMPLICIT_BIT) && !fmt->m68k_denormal;
          frac_shr(p, frac_shift);
 -        if (is_tiny && (flags & float_flag_inexact)) {
 -            flags |= float_flag_underflow;
 -        }
 -        if (exp == 0 && frac_eqz(p)) {
 -            p->cls = float_class_zero;
 +        if (is_tiny) {
 +            if (s->flush_to_zero) {
 +                assert(s->ftz_detection == float_ftz_after_rounding);
 +                flags |= float_flag_output_denormal_flushed;
 +                p->cls = float_class_zero;
 +                exp = 0;
 +                frac_clear(p);
 +            } else if (flags & float_flag_inexact) {
 +                flags |= float_flag_underflow;
 +            }
 +            if (exp == 0 && frac_eqz(p)) {
 +                p->cls = float_class_zero;
 +            }
          }
      }
      p->exp = exp;
 --
 .34.1

-New patch
+[PULL 05/68] target/arm: Define FPCR AH, FIZ, NEP bits
+The Armv8.7 FEAT_AFP feature defines three new control bits in
+the FPCR:
+ * FPCR.AH: "alternate floating point mode"; this changes floating
+   point behaviour in a variety of ways, including:
+    - the sign of a default NaN is 1, not 0
+    - if FPCR.FZ is also 1, denormals detected after rounding
+      with an unbounded exponent has been applied are flushed to zero
+    - FPCR.FZ does not cause denormalized inputs to be flushed to zero
+    - miscellaneous other corner-case behaviour changes
+ * FPCR.FIZ: flush denormalized numbers to zero on input for
+   most instructions
+ * FPCR.NEP: makes scalar SIMD operations merge the result with
+   higher vector elements in one of the source registers, instead
+   of zeroing the higher elements of the destination
+This commit defines the new bits in the FPCR, and allows them to be
+read or written when FEAT_AFP is implemented.  Actual behaviour
+changes will be implemented in subsequent commits.
+Note that these are the first FPCR bits which don't appear in the
+AArch32 FPSCR view of the register, and which share bit positions
+with FPSR bits.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/cpu-features.h |  5 +++++
+ target/arm/cpu.h          |  3 +++
+ target/arm/vfp_helper.c   | 11 ++++++++---
+files changed, 16 insertions(+), 3 deletions(-)
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu-features.h
++++ b/target/arm/cpu-features.h
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_hcx(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, HCX) != 0;
+ }
++static inline bool isar_feature_aa64_afp(const ARMISARegisters *id)
++{
++    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, AFP) != 0;
++}
++
+ static inline bool isar_feature_aa64_tidcp1(const ARMISARegisters *id)
+ {
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, TIDCP1) != 0;
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ void vfp_set_fpscr(CPUARMState *env, uint32_t val);
+  */
+ /* FPCR bits */
++#define FPCR_FIZ    (1 << 0)    /* Flush Inputs to Zero (FEAT_AFP) */
++#define FPCR_AH     (1 << 1)    /* Alternate Handling (FEAT_AFP) */
++#define FPCR_NEP    (1 << 2)    /* SIMD scalar ops preserve elts (FEAT_AFP) */
+ #define FPCR_IOE    (1 << 8)    /* Invalid Operation exception trap enable */
+ #define FPCR_DZE    (1 << 9)    /* Divide by Zero exception trap enable */
+ #define FPCR_OFE    (1 << 10)   /* Overflow exception trap enable */
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_masked(CPUARMState *env, uint32_t val, uint32_t mask)
+     if (!cpu_isar_feature(any_fp16, cpu)) {
+         val &= ~FPCR_FZ16;
+     }
++    if (!cpu_isar_feature(aa64_afp, cpu)) {
++        val &= ~(FPCR_FIZ | FPCR_AH | FPCR_NEP);
++    }
+     if (!cpu_isar_feature(aa64_ebf16, cpu)) {
+         val &= ~FPCR_EBF;
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_masked(CPUARMState *env, uint32_t val, uint32_t mask)
+      * We don't implement trapped exception handling, so the
+      * trap enable bits, IDE|IXE|UFE|OFE|DZE|IOE are all RAZ/WI (not RES0!)
+      *
+-     * The FPCR bits we keep in vfp.fpcr are AHP, DN, FZ, RMode, EBF
+-     * and FZ16. Len, Stride and LTPSIZE we just handled. Store those bits
++     * The FPCR bits we keep in vfp.fpcr are AHP, DN, FZ, RMode, EBF, FZ16,
++     * FIZ, AH, and NEP.
++     * Len, Stride and LTPSIZE we just handled. Store those bits
+      * there, and zero any of the other FPCR bits and the RES0 and RAZ/WI
+      * bits.
+      */
+-    val &= FPCR_AHP | FPCR_DN | FPCR_FZ | FPCR_RMODE_MASK | FPCR_FZ16 | FPCR_EBF;
++    val &= FPCR_AHP | FPCR_DN | FPCR_FZ | FPCR_RMODE_MASK | FPCR_FZ16 |
++        FPCR_EBF | FPCR_FIZ | FPCR_AH | FPCR_NEP;
+     env->vfp.fpcr &= ~mask;
+     env->vfp.fpcr |= val;
+ }
+--
+.34.1

-New patch
+[PULL 06/68] target/arm: Implement FPCR.FIZ handling
+Part of FEAT_AFP is the new control bit FPCR.FIZ.  This bit affects
+flushing of single and double precision denormal inputs to zero for
+AArch64 floating point instructions.  (For half-precision, the
+existing FPCR.FZ16 control remains the only one.)
+FPCR.FIZ differs from FPCR.FZ in that if we flush an input denormal
+only because of FPCR.FIZ then we should *not* set the cumulative
+exception bit FPSR.IDC.
+FEAT_AFP also defines that in AArch64 the existing FPCR.FZ only
+applies when FPCR.AH is 0.
+We can implement this by setting the "flush inputs to zero" state
+appropriately when FPCR is written, and by not reflecting the
+float_flag_input_denormal status flag into FPSR reads when it is the
+result only of FPSR.FIZ.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/vfp_helper.c | 60 ++++++++++++++++++++++++++++++++++-------
+file changed, 50 insertions(+), 10 deletions(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+ {
+-    uint32_t i = 0;
++    uint32_t a32_flags = 0, a64_flags = 0;
+-    i |= get_float_exception_flags(&env->vfp.fp_status_a32);
+-    i |= get_float_exception_flags(&env->vfp.fp_status_a64);
+-    i |= get_float_exception_flags(&env->vfp.standard_fp_status);
++    a32_flags |= get_float_exception_flags(&env->vfp.fp_status_a32);
++    a32_flags |= get_float_exception_flags(&env->vfp.standard_fp_status);
+     /* FZ16 does not generate an input denormal exception.  */
+-    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
++    a32_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
+           & ~float_flag_input_denormal_flushed);
+-    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
++    a32_flags |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
+           & ~float_flag_input_denormal_flushed);
+-    i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
++
++    a64_flags |= get_float_exception_flags(&env->vfp.fp_status_a64);
++    a64_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
+           & ~float_flag_input_denormal_flushed);
+-    return vfp_exceptbits_from_host(i);
++    /*
++     * Flushing an input denormal *only* because FPCR.FIZ == 1 does
++     * not set FPSR.IDC; if FPCR.FZ is also set then this takes
++     * precedence and IDC is set (see the FPUnpackBase pseudocode).
++     * So squash it unless (FPCR.AH == 0 && FPCR.FZ == 1).
++     * We only do this for the a64 flags because FIZ has no effect
++     * on AArch32 even if it is set.
++     */
++    if ((env->vfp.fpcr & (FPCR_FZ | FPCR_AH)) != FPCR_FZ) {
++        a64_flags &= ~float_flag_input_denormal_flushed;
++    }
++    return vfp_exceptbits_from_host(a32_flags | a64_flags);
+ }
+ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
+ }
++static void vfp_sync_and_clear_float_status_exc_flags(CPUARMState *env)
++{
++    /*
++     * Synchronize any pending exception-flag information in the
++     * float_status values into env->vfp.fpsr, and then clear out
++     * the float_status data.
++     */
++    env->vfp.fpsr |= vfp_get_fpsr_from_host(env);
++    vfp_clear_float_status_exc_flags(env);
++}
++
+ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+ {
+     uint64_t changed = env->vfp.fpcr;
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+     if (changed & FPCR_FZ) {
+         bool ftz_enabled = val & FPCR_FZ;
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
+-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
++        /* FIZ is A64 only so FZ always makes A32 code flush inputs to zero */
++        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
++    }
++    if (changed & (FPCR_FZ | FPCR_AH | FPCR_FIZ)) {
++        /*
++         * A64: Flush denormalized inputs to zero if FPCR.FIZ = 1, or
++         * both FPCR.AH = 0 and FPCR.FZ = 1.
++         */
++        bool fitz_enabled = (val & FPCR_FIZ) ||
++            (val & (FPCR_FZ | FPCR_AH)) == FPCR_FZ;
++        set_flush_inputs_to_zero(fitz_enabled, &env->vfp.fp_status_a64);
+     }
+     if (changed & FPCR_DN) {
+         bool dnan_enabled = val & FPCR_DN;
+@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
+         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
+     }
++    /*
++     * If any bits changed that we look at in vfp_get_fpsr_from_host(),
++     * we must sync the float_status flags into vfp.fpsr now (under the
++     * old regime) before we update vfp.fpcr.
++     */
++    if (changed & (FPCR_FZ | FPCR_AH | FPCR_FIZ)) {
++        vfp_sync_and_clear_float_status_exc_flags(env);
++    }
+ }
+ #else
+--
+.34.1

-[PULL 17/32] target/arm: Log CPU index in 'Taking exception' log
+[PULL 07/68] target/arm: Adjust FP behaviour for FPCR.AH = 1
-In an SMP system it can be unclear which CPU is taking an exception;
+When FPCR.AH is set, various behaviours of AArch64 floating point
-add the CPU index (which is the same value used in the TCG 'Trace
+operations which are controlled by softfloat config settings change:
-%d:' logging) to the "Taking exception" log line to clarify it.
+ * tininess and ftz detection before/after rounding
  * NaN propagation order
  * result of 0 * Inf + NaN
  * default NaN value
 When the guest changes the value of the AH bit, switch these config
 settings on the fp_status_a64 and fp_status_f16_a64 float_status
 fields.
 This requires us to make the arm_set_default_fp_behaviours() function
 global, since we now need to call it from cpu.c and vfp_helper.c; we
 move it to vfp_helper.c so it can be next to the new
 arm_set_ah_fp_behaviours().
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-2-peter.maydell@linaro.org
 ---
- target/arm/internals.h | 2 +-
+ target/arm/internals.h  |  4 +++
- target/arm/helper.c    | 9 ++++++---
+ target/arm/cpu.c        | 23 ----------------
- target/arm/m_helper.c  | 2 +-
+ target/arm/vfp_helper.c | 58 ++++++++++++++++++++++++++++++++++++++++-
-files changed, 8 insertions(+), 5 deletions(-)
+files changed, 61 insertions(+), 24 deletions(-)
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ uint64_t gt_virt_cnt_offset(CPUARMState *env);
-                    ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
+  * all EL1" scope; this covers stage 1 and stage 2.
-     __attribute__((nonnull));
+  */
+ int alle1_tlbmask(CPUARMState *env);
--void arm_log_exception(int idx);
++
-+void arm_log_exception(CPUState *cs);
++/* Set the float_status behaviour to match the Arm defaults */
++void arm_set_default_fp_behaviours(float_status *s);
- #endif /* !CONFIG_USER_ONLY */
++
+ #endif
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/cpu.c
-+++ b/target/arm/helper.c
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
+@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
-     return target_el;
+     QLIST_INSERT_HEAD(&cpu->el_change_hooks, entry, node);
  }
--void arm_log_exception(int idx)
+-/*
-+void arm_log_exception(CPUState *cs)
+- * Set the float_status behaviour to match the Arm defaults:
 - *  * tininess-before-rounding
 - *  * 2-input NaN propagation prefers SNaN over QNaN, and then
 - *    operand A over operand B (see FPProcessNaNs() pseudocode)
 - *  * 3-input NaN propagation prefers SNaN over QNaN, and then
 - *    operand C over A over B (see FPProcessNaNs3() pseudocode,
 - *    but note that for QEMU muladd is a * b + c, whereas for
 - *    the pseudocode function the arguments are in the order c, a, b.
 - *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
 - *    and the input NaN if it is signalling
 - *  * Default NaN has sign bit clear, msb frac bit set
 - */
 -static void arm_set_default_fp_behaviours(float_status *s)
 -{
 -    set_float_detect_tininess(float_tininess_before_rounding, s);
 -    set_float_ftz_detection(float_ftz_before_rounding, s);
 -    set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
 -    set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
 -    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
 -    set_float_default_nan_pattern(0b01000000, s);
 -}
 -
  static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
  {
-+    int idx = cs->exception_index;
+     /* Reset a single ARMCPRegInfo register */
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/helper-proto.h"
  #include "internals.h"
  #include "cpu-features.h"
 +#include "fpu/softfloat.h"
  #ifdef CONFIG_TCG
  #include "qemu/log.h"
 -#include "fpu/softfloat.h"
  #endif
  /* VFP support.  We follow the convention used for VFP instructions:
     Single precision routines have a "s" suffix, double precision a
     "d" suffix.  */
 +/*
 + * Set the float_status behaviour to match the Arm defaults:
 + *  * tininess-before-rounding
 + *  * 2-input NaN propagation prefers SNaN over QNaN, and then
 + *    operand A over operand B (see FPProcessNaNs() pseudocode)
 + *  * 3-input NaN propagation prefers SNaN over QNaN, and then
 + *    operand C over A over B (see FPProcessNaNs3() pseudocode,
 + *    but note that for QEMU muladd is a * b + c, whereas for
 + *    the pseudocode function the arguments are in the order c, a, b.
 + *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
 + *    and the input NaN if it is signalling
 + *  * Default NaN has sign bit clear, msb frac bit set
 + */
 +void arm_set_default_fp_behaviours(float_status *s)
 +{
 +    set_float_detect_tininess(float_tininess_before_rounding, s);
 +    set_float_ftz_detection(float_ftz_before_rounding, s);
 +    set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
 +    set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
 +    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
 +    set_float_default_nan_pattern(0b01000000, s);
 +}
 +
-     if (qemu_loglevel_mask(CPU_LOG_INT)) {
++/*
-         const char *exc = NULL;
++ * Set the float_status behaviour to match the FEAT_AFP
-         static const char * const excnames[] = {
++ * FPCR.AH=1 requirements:
-@@ -XXX,XX +XXX,XX @@ void arm_log_exception(int idx)
++ *  * tininess-after-rounding
-         if (!exc) {
++ *  * 2-input NaN propagation prefers the first NaN
-             exc = "unknown";
++ *  * 3-input NaN propagation prefers a over b over c
-         }
++ *  * 0 * Inf + NaN always returns the input NaN and doesn't
--        qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc);
++ *    set Invalid for a QNaN
-+        qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s] on CPU %d\n",
++ *  * default NaN has sign bit set, msb frac bit set
-+                      idx, exc, cs->cpu_index);
++ */
 +static void arm_set_ah_fp_behaviours(float_status *s)
 +{
 +    set_float_detect_tininess(float_tininess_after_rounding, s);
 +    set_float_ftz_detection(float_ftz_after_rounding, s);
 +    set_float_2nan_prop_rule(float_2nan_prop_ab, s);
 +    set_float_3nan_prop_rule(float_3nan_prop_abc, s);
 +    set_float_infzeronan_rule(float_infzeronan_dnan_never |
 +                              float_infzeronan_suppress_invalid, s);
 +    set_float_default_nan_pattern(0b11000000, s);
 +}
 +
  #ifdef CONFIG_TCG
  /* Convert host exception flags to vfp form.  */
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
      }
- }
++    if (changed & FPCR_AH) {
++        bool ah_enabled = val & FPCR_AH;
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
++
++        if (ah_enabled) {
-     assert(!arm_feature(env, ARM_FEATURE_M));
++            /* Change behaviours for A64 FP operations */
++            arm_set_ah_fp_behaviours(&env->vfp.fp_status_a64);
--    arm_log_exception(cs->exception_index);
++            arm_set_ah_fp_behaviours(&env->vfp.fp_status_f16_a64);
-+    arm_log_exception(cs);
++        } else {
-     qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env),
++            arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
-                   new_el);
++            arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
-     if (qemu_loglevel_mask(CPU_LOG_INT)
++        }
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
++    }
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/m_helper.c
 +++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
      uint32_t lr;
      bool ignore_stackfaults;
 -    arm_log_exception(cs->exception_index);
 +    arm_log_exception(cs);
      /*
-      * For exceptions we just mark as pending on the NVIC, and let that
+      * If any bits changed that we look at in vfp_get_fpsr_from_host(),
       * we must sync the float_status flags into vfp.fpsr now (under the
 --
-.25.1
+.34.1

-New patch
+[PULL 08/68] target/arm: Adjust exception flag handling for AH = 1
+When FPCR.AH = 1, some of the cumulative exception flags in the FPSR
+behave slightly differently for A64 operations:
+ * IDC is set when a denormal input is used without flushing
+ * IXC (Inexact) is set when an output denormal is flushed to zero
+Update vfp_get_fpsr_from_host() to do this.
+Note that because half-precision operations never set IDC, we now
+need to add float_flag_input_denormal_used to the set we mask out of
+fp_status_f16_a64.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/vfp_helper.c | 17 ++++++++++++++---
+file changed, 14 insertions(+), 3 deletions(-)
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/vfp_helper.c
++++ b/target/arm/vfp_helper.c
+@@ -XXX,XX +XXX,XX @@ static void arm_set_ah_fp_behaviours(float_status *s)
+ #ifdef CONFIG_TCG
+ /* Convert host exception flags to vfp form.  */
+-static inline uint32_t vfp_exceptbits_from_host(int host_bits)
++static inline uint32_t vfp_exceptbits_from_host(int host_bits, bool ah)
+ {
+     uint32_t target_bits = 0;
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+     if (host_bits & float_flag_input_denormal_flushed) {
+         target_bits |= FPSR_IDC;
+     }
++    /*
++     * With FPCR.AH, IDC is set when an input denormal is used,
++     * and flushing an output denormal to zero sets both IXC and UFC.
++     */
++    if (ah && (host_bits & float_flag_input_denormal_used)) {
++        target_bits |= FPSR_IDC;
++    }
++    if (ah && (host_bits & float_flag_output_denormal_flushed)) {
++        target_bits |= FPSR_IXC;
++    }
+     return target_bits;
+ }
+@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+     a64_flags |= get_float_exception_flags(&env->vfp.fp_status_a64);
+     a64_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
+-          & ~float_flag_input_denormal_flushed);
++          & ~(float_flag_input_denormal_flushed | float_flag_input_denormal_used));
+     /*
+      * Flushing an input denormal *only* because FPCR.FIZ == 1 does
+      * not set FPSR.IDC; if FPCR.FZ is also set then this takes
+@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
+     if ((env->vfp.fpcr & (FPCR_FZ | FPCR_AH)) != FPCR_FZ) {
+         a64_flags &= ~float_flag_input_denormal_flushed;
+     }
+-    return vfp_exceptbits_from_host(a32_flags | a64_flags);
++    return vfp_exceptbits_from_host(a64_flags, env->vfp.fpcr & FPCR_AH) |
++        vfp_exceptbits_from_host(a32_flags, false);
+ }
+ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
+--
+.34.1

-[PULL 32/32] target/arm: Use correct entrypoint for SVC taken from Hyp to Hyp
+[PULL 09/68] target/arm: Add FPCR.AH to tbflags
-The exception caused by an SVC instruction may be taken to AArch32
+We are going to need to generate different code in some cases when
-Hyp mode for two reasons:
+FPCR.AH is 1.  For example:
- * HCR.TGE indicates that exceptions from EL0 should trap to EL2
+ * Floating point neg and abs must not flip the sign bit of NaNs
- * we were already in Hyp mode
+ * some insns (FRECPE, FRECPS, FRECPX, FRSQRTE, FRSQRTS, and various
    BFCVT and BFM bfloat16 ops) need to use a different float_status
    to the usual one
-The entrypoint in the vector table to be used differs in these two
+Encode FPCR.AH into the A64 tbflags, so we can refer to it at
-cases: for an exception routed to Hyp mode from EL0, we enter at the
+translate time.
 common 0x14 "hyp trap" entrypoint.  For SVC from Hyp mode to Hyp
 mode, we enter at the 0x08 (svc/hvc trap) entrypoint.
 In the v8A Arm ARM pseudocode this is done in AArch32.TakeSVCException.
-QEMU incorrectly routed both of these exceptions to the 0x14
+Because we now have a bit in FPCR that affects codegen, we can't mark
-entrypoint.  Correct the entrypoint for SVC from Hyp to Hyp by making
+the AArch64 FPCR register as being SUPPRESS_TB_END any more; writes
-use of the existing logic which handles "normal entrypoint for
+to it will now end the TB and trigger a regeneration of hflags.
 Hyp-to-Hyp, otherwise 0x14" for traps like UNDEF and data/prefetch
 aborts (reproduced here since it's outside the visible context
 in the diff for this commit):
     if (arm_current_el(env) != 2 && addr < 0x14) {
         addr = 0x14;
     }
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220117131953.3936137-1-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 4 ++--
+ target/arm/cpu.h               | 1 +
-file changed, 2 insertions(+), 2 deletions(-)
+ target/arm/tcg/translate.h     | 2 ++
  target/arm/helper.c            | 2 +-
  target/arm/tcg/hflags.c        | 4 ++++
  target/arm/tcg/translate-a64.c | 1 +
 files changed, 9 insertions(+), 1 deletion(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, NV2, 34, 1)
+ FIELD(TBFLAG_A64, NV2_MEM_E20, 35, 1)
+ /* Set if FEAT_NV2 RAM accesses are big-endian */
+ FIELD(TBFLAG_A64, NV2_MEM_BE, 36, 1)
++FIELD(TBFLAG_A64, AH, 37, 1)   /* FPCR.AH */
+ /*
+  * Helpers for using the above. Note that only the A64 accessors use
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+     bool nv2_mem_e20;
+     /* True if NV2 enabled and NV2 RAM accesses are big-endian */
+     bool nv2_mem_be;
++    /* True if FPCR.AH is 1 (alternate floating point handling) */
++    bool fpcr_ah;
+     /*
+      * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
+      *  < 0, set by the current instruction.
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
-      * separately here.
+       .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
-      *
+     { .name = "FPCR", .state = ARM_CP_STATE_AA64,
-      * The vector table entry used is always the 0x14 Hyp mode entry point,
+       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
--     * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp.
+-      .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
-+     * unless this is an UNDEF/SVC/HVC/abort taken from Hyp to Hyp.
++      .access = PL0_RW, .type = ARM_CP_FPU,
-      * The offset applied to the preferred return address is always zero
+       .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
-      * (see DDI0487C.a section G1.12.3).
+     { .name = "FPSR", .state = ARM_CP_STATE_AA64,
-      * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values.
+       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
+diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
-         addr = 0x04;
+index XXXXXXX..XXXXXXX 100644
-         break;
+--- a/target/arm/tcg/hflags.c
-     case EXCP_SWI:
++++ b/target/arm/tcg/hflags.c
--        addr = 0x14;
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
-+        addr = 0x08;
+         DP_TBFLAG_A64(flags, TCMA, aa64_va_parameter_tcma(tcr, mmu_idx));
-         break;
+     }
-     case EXCP_BKPT:
-         /* Fall through to prefetch abort.  */
++    if (env->vfp.fpcr & FPCR_AH) {
 +        DP_TBFLAG_A64(flags, AH, 1);
 +    }
 +
      return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
  }
 diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/translate-a64.c
 +++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
      dc->nv2 = EX_TBFLAG_A64(tb_flags, NV2);
      dc->nv2_mem_e20 = EX_TBFLAG_A64(tb_flags, NV2_MEM_E20);
      dc->nv2_mem_be = EX_TBFLAG_A64(tb_flags, NV2_MEM_BE);
 +    dc->fpcr_ah = EX_TBFLAG_A64(tb_flags, AH);
      dc->vec_len = 0;
      dc->vec_stride = 0;
      dc->cp_regs = arm_cpu->cp_regs;
 --
-.25.1
+.34.1

-New patch
+[PULL 10/68] target/arm: Set up float_status to use for FPCR.AH=1 behaviour
+When FPCR.AH is 1, the behaviour of some instructions changes:
  * AdvSIMD BFCVT, BFCVTN, BFCVTN2, BFMLALB, BFMLALT
  * SVE BFCVT, BFCVTNT, BFMLALB, BFMLALT, BFMLSLB, BFMLSLT
  * SME BFCVT, BFCVTN, BFMLAL, BFMLSL (these are all in SME2 which
    QEMU does not yet implement)
  * FRECPE, FRECPS, FRECPX, FRSQRTE, FRSQRTS
 The behaviour change is:
  * the instructions do not update the FPSR cumulative exception flags
  * trapped floating point exceptions are disabled (a no-op for QEMU,
    which doesn't implement FPCR.{IDE,IXE,UFE,OFE,DZE,IOE})
  * rounding is always round-to-nearest-even regardless of FPCR.RMode
  * denormalized inputs and outputs are always flushed to zero, as if
    FPCR.{FZ,FIZ} is {1,1}
  * FPCR.FZ16 is still honoured for half-precision inputs
 (See the Arm ARM DDI0487L.a section A1.5.9.)
 We can provide all these behaviours with another pair of float_status fields
 which we use only for these insns, when FPCR.AH is 1. These float_status
 fields will always have:
  * flush_to_zero and flush_inputs_to_zero set for the non-F16 field
  * rounding mode set to round-to-nearest-even
 and so the only FPCR fields they need to honour are DN and FZ16.
 In this commit we only define the new fp_status fields and give them
 the required behaviour when FPSR is updated.  In subsequent commits
 we will arrange to use this new fp_status field for the instructions
 that should be affected by FPCR.AH in this way.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  target/arm/cpu.h           | 15 +++++++++++++++
  target/arm/internals.h     |  2 ++
  target/arm/tcg/translate.h | 14 ++++++++++++++
  target/arm/cpu.c           |  4 ++++
  target/arm/vfp_helper.c    | 13 ++++++++++++-
 files changed, 47 insertions(+), 1 deletion(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
           *  standard_fp_status : the ARM "Standard FPSCR Value"
           *  standard_fp_status_fp16 : used for half-precision
           *       calculations with the ARM "Standard FPSCR Value"
 +         *  ah_fp_status: used for the A64 insns which change behaviour
 +         *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
 +         *       and the reciprocal and square root estimate/step insns)
 +         *  ah_fp_status_f16: used for the A64 insns which change behaviour
 +         *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
 +         *       and the reciprocal and square root estimate/step insns);
 +         *       for half-precision
           *
           * Half-precision operations are governed by a separate
           * flush-to-zero control bit in FPSCR:FZ16. We pass a separate
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
           * the "standard FPSCR" tracks the FPSCR.FZ16 bit rather than
           * using a fixed value for it.
           *
 +         * The ah_fp_status is needed because some insns have different
 +         * behaviour when FPCR.AH == 1: they don't update cumulative
 +         * exception flags, they act like FPCR.{FZ,FIZ} = {1,1} and
 +         * they ignore FPCR.RMode. But they don't ignore FPCR.FZ16,
 +         * which means we need an ah_fp_status_f16 as well.
 +         *
           * To avoid having to transfer exception bits around, we simply
           * say that the FPSCR cumulative exception flags are the logical
           * OR of the flags in the four fp statuses. This relies on the
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          float_status fp_status_f16_a64;
          float_status standard_fp_status;
          float_status standard_fp_status_f16;
 +        float_status ah_fp_status;
 +        float_status ah_fp_status_f16;
          uint64_t zcr_el[4];   /* ZCR_EL[1-3] */
          uint64_t smcr_el[4];  /* SMCR_EL[1-3] */
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int alle1_tlbmask(CPUARMState *env);
  /* Set the float_status behaviour to match the Arm defaults */
  void arm_set_default_fp_behaviours(float_status *s);
 +/* Set the float_status behaviour to match Arm FPCR.AH=1 behaviour */
 +void arm_set_ah_fp_behaviours(float_status *s);
  #endif
 diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/translate.h
 +++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
      FPST_A64,
      FPST_A32_F16,
      FPST_A64_F16,
 +    FPST_AH,
 +    FPST_AH_F16,
      FPST_STD,
      FPST_STD_F16,
  } ARMFPStatusFlavour;
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
   *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
   * FPST_A64_F16
   *   for AArch64 operations controlled by the FPCR where FPCR.FZ16 is to be used
 + * FPST_AH:
 + *   for AArch64 operations which change behaviour when AH=1 (specifically,
 + *   bfloat16 conversions and multiplies, and the reciprocal and square root
 + *   estimate/step insns)
 + * FPST_AH_F16:
 + *   ditto, but for half-precision operations
   * FPST_STD
   *   for A32/T32 Neon operations using the "standard FPSCR value"
   * FPST_STD_F16
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
      case FPST_A64_F16:
          offset = offsetof(CPUARMState, vfp.fp_status_f16_a64);
          break;
 +    case FPST_AH:
 +        offset = offsetof(CPUARMState, vfp.ah_fp_status);
 +        break;
 +    case FPST_AH_F16:
 +        offset = offsetof(CPUARMState, vfp.ah_fp_status_f16);
 +        break;
      case FPST_STD:
          offset = offsetof(CPUARMState, vfp.standard_fp_status);
          break;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
      arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
      arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
 +    arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status);
 +    set_flush_to_zero(1, &env->vfp.ah_fp_status);
 +    set_flush_inputs_to_zero(1, &env->vfp.ah_fp_status);
 +    arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status_f16);
  #ifndef CONFIG_USER_ONLY
      if (kvm_enabled()) {
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_set_default_fp_behaviours(float_status *s)
   *    set Invalid for a QNaN
   *  * default NaN has sign bit set, msb frac bit set
   */
 -static void arm_set_ah_fp_behaviours(float_status *s)
 +void arm_set_ah_fp_behaviours(float_status *s)
  {
      set_float_detect_tininess(float_tininess_after_rounding, s);
      set_float_ftz_detection(float_ftz_after_rounding, s);
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
      a64_flags |= get_float_exception_flags(&env->vfp.fp_status_a64);
      a64_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
            & ~(float_flag_input_denormal_flushed | float_flag_input_denormal_used));
 +    /*
 +     * We do not merge in flags from ah_fp_status or ah_fp_status_f16, because
 +     * they are used for insns that must not set the cumulative exception bits.
 +     */
 +
      /*
       * Flushing an input denormal *only* because FPCR.FIZ == 1 does
       * not set FPSR.IDC; if FPCR.FZ is also set then this takes
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
      set_float_exception_flags(0, &env->vfp.standard_fp_status);
      set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
 +    set_float_exception_flags(0, &env->vfp.ah_fp_status);
 +    set_float_exception_flags(0, &env->vfp.ah_fp_status_f16);
  }
  static void vfp_sync_and_clear_float_status_exc_flags(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
          set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
 +        set_flush_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
 +        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
      }
      if (changed & FPCR_FZ) {
          bool ftz_enabled = val & FPCR_FZ;
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
 +        set_default_nan_mode(dnan_enabled, &env->vfp.ah_fp_status);
 +        set_default_nan_mode(dnan_enabled, &env->vfp.ah_fp_status_f16);
      }
      if (changed & FPCR_AH) {
          bool ah_enabled = val & FPCR_AH;
 --
 .34.1

-[PULL 24/32] hw/intc/arm_gicv3_redist: Remove unnecessary zero checks
+[PULL 11/68] target/arm: Use FPST_FPCR_AH for FRECPE, FRECPS, FRECPX, FRSQRTE, FRSQRTS
-The ITS-related parts of the redistributor code make some checks for
+For the instructions FRECPE, FRECPS, FRECPX, FRSQRTE, FRSQRTS, use
-whether registers like GICR_PROPBASER and GICR_PENDBASER are zero.
+FPST_FPCR_AH or FPST_FPCR_AH_F16 when FPCR.AH is 1, so that they get
-There is no requirement in the specification for treating zeroes in
+the required behaviour changes.
 these address registers specially -- they contain guest physical
 addresses and it is entirely valid (if unusual) for the guest to
 choose to put the tables they address at guest physical address zero.
 We use these values only to calculate guest addresses, and attempts
 by the guest to use a bad address will be handled by the
 address_space_* functions which we use to do the loads and stores.
 Remove the unnecessary checks.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-9-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_redist.c | 8 +++-----
+ target/arm/tcg/translate-a64.h |  13 ++++
-file changed, 3 insertions(+), 5 deletions(-)
+ target/arm/tcg/translate-a64.c | 119 +++++++++++++++++++++++++--------
  target/arm/tcg/translate-sve.c |  30 ++++++---
 files changed, 127 insertions(+), 35 deletions(-)
-diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
+diff --git a/target/arm/tcg/translate-a64.h b/target/arm/tcg/translate-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_redist.c
+--- a/target/arm/tcg/translate-a64.h
-+++ b/hw/intc/arm_gicv3_redist.c
++++ b/target/arm/tcg/translate-a64.h
-@@ -XXX,XX +XXX,XX @@ void gicv3_redist_update_lpi_only(GICv3CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr pred_full_reg_ptr(DisasContext *s, int regno)
-     idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
+     return ret;
-                  GICD_TYPER_IDBITS);
+ }
--    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
++/*
--        !cs->gicr_pendbaser) {
++ * Return the ARMFPStatusFlavour to use based on element size and
-+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS)) {
++ * whether FPCR.AH is set.
-         return;
++ */
 +static inline ARMFPStatusFlavour select_ah_fpst(DisasContext *s, MemOp esz)
 +{
 +    if (s->fpcr_ah) {
 +        return esz == MO_16 ? FPST_AH_F16 : FPST_AH;
 +    } else {
 +        return esz == MO_16 ? FPST_A64_F16 : FPST_A64;
 +    }
 +}
 +
  bool disas_sve(DisasContext *, uint32_t);
  bool disas_sme(DisasContext *, uint32_t);
 diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/translate-a64.c
 +++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_ool(DisasContext *s, bool is_q, int rd,
   * an out-of-line helper.
   */
  static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
 -                              int rm, bool is_fp16, int data,
 +                              int rm, ARMFPStatusFlavour fpsttype, int data,
                                gen_helper_gvec_3_ptr *fn)
  {
 -    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
 +    TCGv_ptr fpst = fpstatus_ptr(fpsttype);
      tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
                         vec_full_reg_offset(s, rn),
                         vec_full_reg_offset(s, rm), fpst,
@@ -XXX,XX +XXX,XX @@ typedef struct FPScalar {
      void (*gen_d)(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_ptr);
  } FPScalar;
 -static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
 +static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
 +                                        const FPScalar *f,
 +                                        ARMFPStatusFlavour fpsttype)
  {
      switch (a->esz) {
      case MO_64:
          if (fp_access_check(s)) {
              TCGv_i64 t0 = read_fp_dreg(s, a->rn);
              TCGv_i64 t1 = read_fp_dreg(s, a->rm);
 -            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
 +            f->gen_d(t0, t0, t1, fpstatus_ptr(fpsttype));
              write_fp_dreg(s, a->rd, t0);
          }
          break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
          if (fp_access_check(s)) {
              TCGv_i32 t0 = read_fp_sreg(s, a->rn);
              TCGv_i32 t1 = read_fp_sreg(s, a->rm);
 -            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
 +            f->gen_s(t0, t0, t1, fpstatus_ptr(fpsttype));
              write_fp_sreg(s, a->rd, t0);
          }
          break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
          if (fp_access_check(s)) {
              TCGv_i32 t0 = read_fp_hreg(s, a->rn);
              TCGv_i32 t1 = read_fp_hreg(s, a->rm);
 -            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
 +            f->gen_h(t0, t0, t1, fpstatus_ptr(fpsttype));
              write_fp_sreg(s, a->rd, t0);
          }
          break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
      return true;
  }
 +static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
 +{
 +    return do_fp3_scalar_with_fpsttype(s, a, f,
 +                                       a->esz == MO_16 ?
 +                                       FPST_A64_F16 : FPST_A64);
 +}
 +
 +static bool do_fp3_scalar_ah(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
 +{
 +    return do_fp3_scalar_with_fpsttype(s, a, f, select_ah_fpst(s, a->esz));
 +}
 +
  static const FPScalar f_scalar_fadd = {
      gen_helper_vfp_addh,
      gen_helper_vfp_adds,
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_frecps = {
      gen_helper_recpsf_f32,
      gen_helper_recpsf_f64,
  };
 -TRANS(FRECPS_s, do_fp3_scalar, a, &f_scalar_frecps)
 +TRANS(FRECPS_s, do_fp3_scalar_ah, a, &f_scalar_frecps)
  static const FPScalar f_scalar_frsqrts = {
      gen_helper_rsqrtsf_f16,
      gen_helper_rsqrtsf_f32,
      gen_helper_rsqrtsf_f64,
  };
 -TRANS(FRSQRTS_s, do_fp3_scalar, a, &f_scalar_frsqrts)
 +TRANS(FRSQRTS_s, do_fp3_scalar_ah, a, &f_scalar_frsqrts)
  static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
                         const FPScalar *f, bool swap)
@@ -XXX,XX +XXX,XX @@ TRANS(CMHS_s, do_cmop_d, a, TCG_COND_GEU)
  TRANS(CMEQ_s, do_cmop_d, a, TCG_COND_EQ)
  TRANS(CMTST_s, do_cmop_d, a, TCG_COND_TSTNE)
 -static bool do_fp3_vector(DisasContext *s, arg_qrrr_e *a, int data,
 -                          gen_helper_gvec_3_ptr * const fns[3])
 +static bool do_fp3_vector_with_fpsttype(DisasContext *s, arg_qrrr_e *a,
 +                                        int data,
 +                                        gen_helper_gvec_3_ptr * const fns[3],
 +                                        ARMFPStatusFlavour fpsttype)
  {
      MemOp esz = a->esz;
      int check = fp_access_check_vector_hsd(s, a->q, esz);
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_vector(DisasContext *s, arg_qrrr_e *a, int data,
          return check == 0;
      }
-@@ -XXX,XX +XXX,XX @@ void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level)
+-    gen_gvec_op3_fpst(s, a->q, a->rd, a->rn, a->rm,
-     idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
+-                      esz == MO_16, data, fns[esz - 1]);
-                  GICD_TYPER_IDBITS);
++    gen_gvec_op3_fpst(s, a->q, a->rd, a->rn, a->rm, fpsttype,
++                      data, fns[esz - 1]);
--    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
+     return true;
--         !cs->gicr_pendbaser || (irq > (1ULL << (idbits + 1)) - 1) ||
+ }
--         irq < GICV3_LPI_INTID_START) {
-+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) ||
++static bool do_fp3_vector(DisasContext *s, arg_qrrr_e *a, int data,
-+        (irq > (1ULL << (idbits + 1)) - 1) || irq < GICV3_LPI_INTID_START) {
++                          gen_helper_gvec_3_ptr * const fns[3])
-         return;
++{
 +    return do_fp3_vector_with_fpsttype(s, a, data, fns,
 +                                       a->esz == MO_16 ?
 +                                       FPST_A64_F16 : FPST_A64);
 +}
 +
 +static bool do_fp3_vector_ah(DisasContext *s, arg_qrrr_e *a, int data,
 +                             gen_helper_gvec_3_ptr * const f[3])
 +{
 +    return do_fp3_vector_with_fpsttype(s, a, data, f,
 +                                       select_ah_fpst(s, a->esz));
 +}
 +
  static gen_helper_gvec_3_ptr * const f_vector_fadd[3] = {
      gen_helper_gvec_fadd_h,
      gen_helper_gvec_fadd_s,
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const f_vector_frecps[3] = {
      gen_helper_gvec_recps_s,
      gen_helper_gvec_recps_d,
  };
 -TRANS(FRECPS_v, do_fp3_vector, a, 0, f_vector_frecps)
 +TRANS(FRECPS_v, do_fp3_vector_ah, a, 0, f_vector_frecps)
  static gen_helper_gvec_3_ptr * const f_vector_frsqrts[3] = {
      gen_helper_gvec_rsqrts_h,
      gen_helper_gvec_rsqrts_s,
      gen_helper_gvec_rsqrts_d,
  };
 -TRANS(FRSQRTS_v, do_fp3_vector, a, 0, f_vector_frsqrts)
 +TRANS(FRSQRTS_v, do_fp3_vector_ah, a, 0, f_vector_frsqrts)
  static gen_helper_gvec_3_ptr * const f_vector_faddp[3] = {
      gen_helper_gvec_faddp_h,
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_vector_idx(DisasContext *s, arg_qrrx_e *a,
      }
+     gen_gvec_op3_fpst(s, a->q, a->rd, a->rn, a->rm,
+-                      esz == MO_16, a->idx, fns[esz - 1]);
++                      esz == MO_16 ? FPST_A64_F16 : FPST_A64,
++                      a->idx, fns[esz - 1]);
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ typedef struct FPScalar1 {
+     void (*gen_d)(TCGv_i64, TCGv_i64, TCGv_ptr);
+ } FPScalar1;
+-static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
+-                          const FPScalar1 *f, int rmode)
++static bool do_fp1_scalar_with_fpsttype(DisasContext *s, arg_rr_e *a,
++                                        const FPScalar1 *f, int rmode,
++                                        ARMFPStatusFlavour fpsttype)
+ {
+     TCGv_i32 tcg_rmode = NULL;
+     TCGv_ptr fpst;
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
++    fpst = fpstatus_ptr(fpsttype);
+     if (rmode >= 0) {
+         tcg_rmode = gen_set_rmode(rmode, fpst);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
+     return true;
+ }
++static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
++                          const FPScalar1 *f, int rmode)
++{
++    return do_fp1_scalar_with_fpsttype(s, a, f, rmode,
++                                       a->esz == MO_16 ?
++                                       FPST_A64_F16 : FPST_A64);
++}
++
++static bool do_fp1_scalar_ah(DisasContext *s, arg_rr_e *a,
++                             const FPScalar1 *f, int rmode)
++{
++    return do_fp1_scalar_with_fpsttype(s, a, f, rmode, select_ah_fpst(s, a->esz));
++}
++
+ static const FPScalar1 f_scalar_fsqrt = {
+     gen_helper_vfp_sqrth,
+     gen_helper_vfp_sqrts,
+@@ -XXX,XX +XXX,XX @@ static const FPScalar1 f_scalar_frecpe = {
+     gen_helper_recpe_f32,
+     gen_helper_recpe_f64,
+ };
+-TRANS(FRECPE_s, do_fp1_scalar, a, &f_scalar_frecpe, -1)
++TRANS(FRECPE_s, do_fp1_scalar_ah, a, &f_scalar_frecpe, -1)
+ static const FPScalar1 f_scalar_frecpx = {
+     gen_helper_frecpx_f16,
+     gen_helper_frecpx_f32,
+     gen_helper_frecpx_f64,
+ };
+-TRANS(FRECPX_s, do_fp1_scalar, a, &f_scalar_frecpx, -1)
++TRANS(FRECPX_s, do_fp1_scalar_ah, a, &f_scalar_frecpx, -1)
+ static const FPScalar1 f_scalar_frsqrte = {
+     gen_helper_rsqrte_f16,
+     gen_helper_rsqrte_f32,
+     gen_helper_rsqrte_f64,
+ };
+-TRANS(FRSQRTE_s, do_fp1_scalar, a, &f_scalar_frsqrte, -1)
++TRANS(FRSQRTE_s, do_fp1_scalar_ah, a, &f_scalar_frsqrte, -1)
+ static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
+ {
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FRINT64Z_v, aa64_frint, do_fp1_vector, a,
+            &f_scalar_frint64, FPROUNDING_ZERO)
+ TRANS_FEAT(FRINT64X_v, aa64_frint, do_fp1_vector, a, &f_scalar_frint64, -1)
+-static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
+-                             int rd, int rn, int data,
+-                             gen_helper_gvec_2_ptr * const fns[3])
++static bool do_gvec_op2_fpst_with_fpsttype(DisasContext *s, MemOp esz,
++                                           bool is_q, int rd, int rn, int data,
++                                           gen_helper_gvec_2_ptr * const fns[3],
++                                           ARMFPStatusFlavour fpsttype)
+ {
+     int check = fp_access_check_vector_hsd(s, is_q, esz);
+     TCGv_ptr fpst;
+@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
+         return check == 0;
+     }
+-    fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
++    fpst = fpstatus_ptr(fpsttype);
+     tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn), fpst,
+                        is_q ? 16 : 8, vec_full_reg_size(s),
+@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
+     return true;
+ }
++static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
++                             int rd, int rn, int data,
++                             gen_helper_gvec_2_ptr * const fns[3])
++{
++    return do_gvec_op2_fpst_with_fpsttype(s, esz, is_q, rd, rn, data, fns,
++                                          esz == MO_16 ? FPST_A64_F16 :
++                                          FPST_A64);
++}
++
++static bool do_gvec_op2_ah_fpst(DisasContext *s, MemOp esz, bool is_q,
++                                int rd, int rn, int data,
++                                gen_helper_gvec_2_ptr * const fns[3])
++{
++    return do_gvec_op2_fpst_with_fpsttype(s, esz, is_q, rd, rn, data,
++                                          fns, select_ah_fpst(s, esz));
++}
++
+ static gen_helper_gvec_2_ptr * const f_scvtf_v[] = {
+     gen_helper_gvec_vcvt_sh,
+     gen_helper_gvec_vcvt_sf,
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_2_ptr * const f_frecpe[] = {
+     gen_helper_gvec_frecpe_s,
+     gen_helper_gvec_frecpe_d,
+ };
+-TRANS(FRECPE_v, do_gvec_op2_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frecpe)
++TRANS(FRECPE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frecpe)
+ static gen_helper_gvec_2_ptr * const f_frsqrte[] = {
+     gen_helper_gvec_frsqrte_h,
+     gen_helper_gvec_frsqrte_s,
+     gen_helper_gvec_frsqrte_d,
+ };
+-TRANS(FRSQRTE_v, do_gvec_op2_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frsqrte)
++TRANS(FRSQRTE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frsqrte)
+ static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
+ {
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
+     return true;
+ }
+-static bool gen_gvec_fpst_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
+-                                 arg_rr_esz *a, int data)
++static bool gen_gvec_fpst_ah_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
++                                    arg_rr_esz *a, int data)
+ {
+     return gen_gvec_fpst_zz(s, fn, a->rd, a->rn, data,
+-                            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
++                            select_ah_fpst(s, a->esz));
+ }
+ /* Invoke an out-of-line helper on 3 Zregs. */
+@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
+                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+ }
++static bool gen_gvec_fpst_ah_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
++                                     arg_rrr_esz *a, int data)
++{
++    return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
++                             select_ah_fpst(s, a->esz));
++}
++
+ /* Invoke an out-of-line helper on 4 Zregs. */
+ static bool gen_gvec_ool_zzzz(DisasContext *s, gen_helper_gvec_4 *fn,
+                               int rd, int rn, int rm, int ra, int data)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_2_ptr * const frecpe_fns[] = {
+     NULL,                     gen_helper_gvec_frecpe_h,
+     gen_helper_gvec_frecpe_s, gen_helper_gvec_frecpe_d,
+ };
+-TRANS_FEAT(FRECPE, aa64_sve, gen_gvec_fpst_arg_zz, frecpe_fns[a->esz], a, 0)
++TRANS_FEAT(FRECPE, aa64_sve, gen_gvec_fpst_ah_arg_zz, frecpe_fns[a->esz], a, 0)
+ static gen_helper_gvec_2_ptr * const frsqrte_fns[] = {
+     NULL,                      gen_helper_gvec_frsqrte_h,
+     gen_helper_gvec_frsqrte_s, gen_helper_gvec_frsqrte_d,
+ };
+-TRANS_FEAT(FRSQRTE, aa64_sve, gen_gvec_fpst_arg_zz, frsqrte_fns[a->esz], a, 0)
++TRANS_FEAT(FRSQRTE, aa64_sve, gen_gvec_fpst_ah_arg_zz, frsqrte_fns[a->esz], a, 0)
+ /*
+  *** SVE Floating Point Compare with Zero Group
+@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
+     };                                                              \
+     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_arg_zzz, name##_fns[a->esz], a, 0)
++#define DO_FP3_AH(NAME, name) \
++    static gen_helper_gvec_3_ptr * const name##_fns[4] = {          \
++        NULL, gen_helper_gvec_##name##_h,                           \
++        gen_helper_gvec_##name##_s, gen_helper_gvec_##name##_d      \
++    };                                                              \
++    TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_ah_arg_zzz, name##_fns[a->esz], a, 0)
++
+ DO_FP3(FADD_zzz, fadd)
+ DO_FP3(FSUB_zzz, fsub)
+ DO_FP3(FMUL_zzz, fmul)
+-DO_FP3(FRECPS, recps)
+-DO_FP3(FRSQRTS, rsqrts)
++DO_FP3_AH(FRECPS, recps)
++DO_FP3_AH(FRSQRTS, rsqrts)
+ #undef DO_FP3
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frecpx_fns[] = {
+     gen_helper_sve_frecpx_s, gen_helper_sve_frecpx_d,
+ };
+ TRANS_FEAT(FRECPX, aa64_sve, gen_gvec_fpst_arg_zpz, frecpx_fns[a->esz],
+-           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
++           a, 0, select_ah_fpst(s, a->esz))
+ static gen_helper_gvec_3_ptr * const fsqrt_fns[] = {
+     NULL,                   gen_helper_sve_fsqrt_h,
 --
-.25.1
+.34.1

-New patch
+[PULL 12/68] target/arm: Use FPST_FPCR_AH for BFCVT* insns
+When FPCR.AH is 1, use FPST_FPCR_AH for:
+ * AdvSIMD BFCVT, BFCVTN, BFCVTN2
+ * SVE BFCVT, BFCVTNT
+so that they get the required behaviour changes.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/translate-a64.c | 27 +++++++++++++++++++++------
+ target/arm/tcg/translate-sve.c |  6 ++++--
+files changed, 25 insertions(+), 8 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ TRANS(FRINTX_s, do_fp1_scalar, a, &f_scalar_frintx, -1)
+ static const FPScalar1 f_scalar_bfcvt = {
+     .gen_s = gen_helper_bfcvt,
+ };
+-TRANS_FEAT(BFCVT_s, aa64_bf16, do_fp1_scalar, a, &f_scalar_bfcvt, -1)
++TRANS_FEAT(BFCVT_s, aa64_bf16, do_fp1_scalar_ah, a, &f_scalar_bfcvt, -1)
+ static const FPScalar1 f_scalar_frint32 = {
+     NULL,
+@@ -XXX,XX +XXX,XX @@ static void gen_bfcvtn_hs(TCGv_i64 d, TCGv_i64 n)
+     tcg_gen_extu_i32_i64(d, tmp);
+ }
+-static ArithOneOp * const f_vector_bfcvtn[] = {
+-    NULL,
+-    gen_bfcvtn_hs,
+-    NULL,
++static void gen_bfcvtn_ah_hs(TCGv_i64 d, TCGv_i64 n)
++{
++    TCGv_ptr fpst = fpstatus_ptr(FPST_AH);
++    TCGv_i32 tmp = tcg_temp_new_i32();
++    gen_helper_bfcvt_pair(tmp, n, fpst);
++    tcg_gen_extu_i32_i64(d, tmp);
++}
++
++static ArithOneOp * const f_vector_bfcvtn[2][3] = {
++    {
++        NULL,
++        gen_bfcvtn_hs,
++        NULL,
++    }, {
++        NULL,
++        gen_bfcvtn_ah_hs,
++        NULL,
++    }
+ };
+-TRANS_FEAT(BFCVTN_v, aa64_bf16, do_2misc_narrow_vector, a, f_vector_bfcvtn)
++TRANS_FEAT(BFCVTN_v, aa64_bf16, do_2misc_narrow_vector, a,
++           f_vector_bfcvtn[s->fpcr_ah])
+ static bool trans_SHLL_v(DisasContext *s, arg_qrr_e *a)
+ {
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_hs, a, 0, FPST_A64_F16)
+ TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_bfcvt, a, 0, FPST_A64)
++           gen_helper_sve_bfcvt, a, 0,
++           s->fpcr_ah ? FPST_AH : FPST_A64)
+ TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVTNT_ds, aa64_sve2, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve2_fcvtnt_ds, a, 0, FPST_A64)
+ TRANS_FEAT(BFCVTNT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
+-           gen_helper_sve_bfcvtnt, a, 0, FPST_A64)
++           gen_helper_sve_bfcvtnt, a, 0,
++           s->fpcr_ah ? FPST_AH : FPST_A64)
+ TRANS_FEAT(FCVTLT_hs, aa64_sve2, gen_gvec_fpst_arg_zpz,
+            gen_helper_sve2_fcvtlt_hs, a, 0, FPST_A64)
+--
+.34.1

-New patch
+[PULL 13/68] target/arm: Use FPST_FPCR_AH for BFMLAL*, BFMLSL* insns
+When FPCR.AH is 1, use FPST_FPCR_AH for:
+ * AdvSIMD BFMLALB, BFMLALT
+ * SVE BFMLALB, BFMLALT, BFMLSLB, BFMLSLT
+so that they get the required behaviour changes.
+We do this by making gen_gvec_op4_fpst() take an ARMFPStatusFlavour
+rather than a bool is_fp16; existing callsites now select
+FPST_FPCR_F16_A64 vs FPST_FPCR_A64 themselves rather than passing in
+the boolean.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/translate-a64.c | 20 +++++++++++++-------
+ target/arm/tcg/translate-sve.c |  6 ++++--
+files changed, 17 insertions(+), 9 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_env(DisasContext *s, bool is_q, int rd, int rn,
+  * an out-of-line helper.
+  */
+ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
+-                              int rm, int ra, bool is_fp16, int data,
++                              int rm, int ra, ARMFPStatusFlavour fpsttype,
++                              int data,
+                               gen_helper_gvec_4_ptr *fn)
+ {
+-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
++    TCGv_ptr fpst = fpstatus_ptr(fpsttype);
+     tcg_gen_gvec_4_ptr(vec_full_reg_offset(s, rd),
+                        vec_full_reg_offset(s, rn),
+                        vec_full_reg_offset(s, rm),
+@@ -XXX,XX +XXX,XX @@ static bool trans_BFMLAL_v(DisasContext *s, arg_qrrr_e *a)
+     }
+     if (fp_access_check(s)) {
+         /* Q bit selects BFMLALB vs BFMLALT. */
+-        gen_gvec_op4_fpst(s, true, a->rd, a->rn, a->rm, a->rd, false, a->q,
++        gen_gvec_op4_fpst(s, true, a->rd, a->rn, a->rm, a->rd,
++                          s->fpcr_ah ? FPST_AH : FPST_A64, a->q,
+                           gen_helper_gvec_bfmlal);
+     }
+     return true;
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCMLA_v(DisasContext *s, arg_FCMLA_v *a)
+     }
+     gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
+-                      a->esz == MO_16, a->rot, fn[a->esz]);
++                      a->esz == MO_16 ? FPST_A64_F16 : FPST_A64,
++                      a->rot, fn[a->esz]);
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_vector_idx(DisasContext *s, arg_qrrx_e *a, bool neg)
+     }
+     gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
+-                      esz == MO_16, (a->idx << 1) | neg,
++                      esz == MO_16 ? FPST_A64_F16 : FPST_A64,
++                      (a->idx << 1) | neg,
+                       fns[esz - 1]);
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_BFMLAL_vi(DisasContext *s, arg_qrrx_e *a)
+     }
+     if (fp_access_check(s)) {
+         /* Q bit selects BFMLALB vs BFMLALT. */
+-        gen_gvec_op4_fpst(s, true, a->rd, a->rn, a->rm, a->rd, 0,
++        gen_gvec_op4_fpst(s, true, a->rd, a->rn, a->rm, a->rd,
++                          s->fpcr_ah ? FPST_AH : FPST_A64,
+                           (a->idx << 1) | a->q,
+                           gen_helper_gvec_bfmlal_idx);
+     }
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCMLA_vi(DisasContext *s, arg_FCMLA_vi *a)
+     }
+     if (fp_access_check(s)) {
+         gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
+-                          a->esz == MO_16, (a->idx << 2) | a->rot, fn);
++                          a->esz == MO_16 ? FPST_A64_F16 : FPST_A64,
++                          (a->idx << 2) | a->rot, fn);
+     }
+     return true;
+ }
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(BFMMLA, aa64_sve_bf16, gen_gvec_env_arg_zzzz,
+ static bool do_BFMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sel)
+ {
+     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal,
+-                              a->rd, a->rn, a->rm, a->ra, sel, FPST_A64);
++                              a->rd, a->rn, a->rm, a->ra, sel,
++                              s->fpcr_ah ? FPST_AH : FPST_A64);
+ }
+ TRANS_FEAT(BFMLALB_zzzw, aa64_sve_bf16, do_BFMLAL_zzzw, a, false)
+@@ -XXX,XX +XXX,XX @@ static bool do_BFMLAL_zzxw(DisasContext *s, arg_rrxr_esz *a, bool sel)
+ {
+     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal_idx,
+                               a->rd, a->rn, a->rm, a->ra,
+-                              (a->index << 1) | sel, FPST_A64);
++                              (a->index << 1) | sel,
++                              s->fpcr_ah ? FPST_AH : FPST_A64);
+ }
+ TRANS_FEAT(BFMLALB_zzxw, aa64_sve_bf16, do_BFMLAL_zzxw, a, false)
+--
+.34.1

-New patch
+[PULL 14/68] target/arm: Add FPCR.NEP to TBFLAGS
+For FEAT_AFP, we want to emit different code when FPCR.NEP is set, so
+that instead of zeroing the high elements of a vector register when
+we write the output of a scalar operation to it, we instead merge in
+those elements from one of the source registers.  Since this affects
+the generated code, we need to put FPCR.NEP into the TBFLAGS.
+FPCR.NEP is treated as 0 when in streaming SVE mode and FEAT_SME_FA64
+is not implemented or not enabled; we can implement this logic in
+rebuild_hflags_a64().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/cpu.h               | 1 +
+ target/arm/tcg/translate.h     | 2 ++
+ target/arm/tcg/hflags.c        | 9 +++++++++
+ target/arm/tcg/translate-a64.c | 1 +
+files changed, 13 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, NV2_MEM_E20, 35, 1)
+ /* Set if FEAT_NV2 RAM accesses are big-endian */
+ FIELD(TBFLAG_A64, NV2_MEM_BE, 36, 1)
+ FIELD(TBFLAG_A64, AH, 37, 1)   /* FPCR.AH */
++FIELD(TBFLAG_A64, NEP, 38, 1)   /* FPCR.NEP */
+ /*
+  * Helpers for using the above. Note that only the A64 accessors use
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+     bool nv2_mem_be;
+     /* True if FPCR.AH is 1 (alternate floating point handling) */
+     bool fpcr_ah;
++    /* True if FPCR.NEP is 1 (FEAT_AFP scalar upper-element result handling) */
++    bool fpcr_nep;
+     /*
+      * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
+      *  < 0, set by the current instruction.
+diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/hflags.c
++++ b/target/arm/tcg/hflags.c
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
+     if (env->vfp.fpcr & FPCR_AH) {
+         DP_TBFLAG_A64(flags, AH, 1);
+     }
++    if (env->vfp.fpcr & FPCR_NEP) {
++        /*
++         * In streaming-SVE without FA64, NEP behaves as if zero;
++         * compare pseudocode IsMerging()
++         */
++        if (!(EX_TBFLAG_A64(flags, PSTATE_SM) && !sme_fa64(env, el))) {
++            DP_TBFLAG_A64(flags, NEP, 1);
++        }
++    }
+     return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
+ }
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
+     dc->nv2_mem_e20 = EX_TBFLAG_A64(tb_flags, NV2_MEM_E20);
+     dc->nv2_mem_be = EX_TBFLAG_A64(tb_flags, NV2_MEM_BE);
+     dc->fpcr_ah = EX_TBFLAG_A64(tb_flags, AH);
++    dc->fpcr_nep = EX_TBFLAG_A64(tb_flags, NEP);
+     dc->vec_len = 0;
+     dc->vec_stride = 0;
+     dc->cp_regs = arm_cpu->cp_regs;
+--
+.34.1

-[PULL 30/32] hw/intc/arm_gicv3_its: Implement MOVI
+[PULL 15/68] target/arm: Define and use new write_fp_*reg_merging() functions
-Implement the ITS MOVI command. This command specifies a (physical) LPI
+For FEAT_AFP's FPCR.NEP bit, we need to programmatically change the
-by DeviceID and EventID and provides a new ICID for it. The ITS must
+behaviour of the writeback of the result for most SIMD scalar
-find the interrupt translation table entry for the LPI, which will
+operations, so that instead of zeroing the upper part of the result
-tell it the old ICID. It then moves the pending state of the LPI from
+register it merges the upper elements from one of the input
-the old redistributor to the new one and updates the ICID field in
+registers.
-the translation table entry.
+Provide new functions write_fp_*reg_merging() which can be used
-This is another GICv3 ITS command that we forgot to implement.  Linux
+instead of the existing write_fp_*reg() functions when we want this
-does use this one, but only if the guest powers off one of its CPUs.
+"merge the result with one of the input registers if FPCR.NEP is
 enabled" handling, and use them in do_fp3_scalar_with_fpsttype().
 Note that (as documented in the description of the FPCR.NEP bit)
 which input register to use as the merge source varies by
 instruction: for these 2-input scalar operations, the comparison
 instructions take from Rm, not Rn.
 We'll extend this to also provide the merging behaviour for
 the remaining scalar insns in subsequent commits.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-15-peter.maydell@linaro.org
 ---
- hw/intc/gicv3_internal.h   |  16 ++++
+ target/arm/tcg/translate-a64.c | 117 +++++++++++++++++++++++++--------
- hw/intc/arm_gicv3_its.c    | 146 +++++++++++++++++++++++++++++++++++++
+file changed, 91 insertions(+), 26 deletions(-)
- hw/intc/arm_gicv3_redist.c |  53 ++++++++++++++
-files changed, 215 insertions(+)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/target/arm/tcg/translate-a64.c
-+++ b/hw/intc/gicv3_internal.h
++++ b/target/arm/tcg/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
+@@ -XXX,XX +XXX,XX @@ static void write_fp_sreg(DisasContext *s, int reg, TCGv_i32 v)
- #define CMD_MASK                  0xff
+     write_fp_dreg(s, reg, tmp);
+ }
- /* ITS Commands */
-+#define GITS_CMD_MOVI             0x01
++/*
- #define GITS_CMD_INT              0x03
++ * Write a double result to 128 bit vector register reg, honouring FPCR.NEP:
- #define GITS_CMD_CLEAR            0x04
++ * - if FPCR.NEP == 0, clear the high elements of reg
- #define GITS_CMD_SYNC             0x05
++ * - if FPCR.NEP == 1, set the high elements of reg from mergereg
-@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
++ *   (i.e. merge the result with those high elements)
- FIELD(MOVALL_2, RDBASE1, 16, 36)
++ * In either case, SVE register bits above 128 are zeroed (per R_WKYLB).
  FIELD(MOVALL_3, RDBASE2, 16, 36)
 +/* MOVI command fields */
 +FIELD(MOVI_0, DEVICEID, 32, 32)
 +FIELD(MOVI_1, EVENTID, 0, 32)
 +FIELD(MOVI_2, ICID, 0, 16)
 +
  /*
   * 12 bytes Interrupt translation Table Entry size
   * as per Table 5.3 in GICv3 spec
@@ -XXX,XX +XXX,XX @@ void gicv3_redist_update_lpi(GICv3CPUState *cs);
   * an incoming migration has loaded new state.
   */
  void gicv3_redist_update_lpi_only(GICv3CPUState *cs);
 +/**
 + * gicv3_redist_mov_lpi:
 + * @src: source redistributor
 + * @dest: destination redistributor
 + * @irq: LPI to update
 + *
 + * Move the pending state of the specified LPI from @src to @dest,
 + * as required by the ITS MOVI command.
 + */
-+void gicv3_redist_mov_lpi(GICv3CPUState *src, GICv3CPUState *dest, int irq);
++static void write_fp_dreg_merging(DisasContext *s, int reg, int mergereg,
- /**
++                                  TCGv_i64 v)
   * gicv3_redist_movall_lpis:
   * @src: source redistributor
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its.c
 +++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_movall(GICv3ITSState *s, uint64_t value,
      return CMD_CONTINUE;
  }
 +static ItsCmdResult process_movi(GICv3ITSState *s, uint64_t value,
 +                                 uint32_t offset)
 +{
-+    AddressSpace *as = &s->gicv3->dma_as;
++    if (!s->fpcr_nep) {
-+    MemTxResult res = MEMTX_OK;
++        write_fp_dreg(s, reg, v);
 +    uint32_t devid, eventid, intid;
 +    uint16_t old_icid, new_icid;
 +    uint64_t old_cte, new_cte;
 +    uint64_t old_rdbase, new_rdbase;
 +    uint64_t dte;
 +    bool dte_valid, ite_valid, cte_valid;
 +    uint64_t num_eventids;
 +    IteEntry ite = {};
 +
 +    devid = FIELD_EX64(value, MOVI_0, DEVICEID);
 +
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +    if (res != MEMTX_OK) {
 +        return CMD_STALL;
 +    }
 +    eventid = FIELD_EX64(value, MOVI_1, EVENTID);
 +
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +    if (res != MEMTX_OK) {
 +        return CMD_STALL;
 +    }
 +    new_icid = FIELD_EX64(value, MOVI_2, ICID);
 +
 +    if (devid >= s->dt.num_entries) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid command attributes: devid %d>=%d",
 +                      __func__, devid, s->dt.num_entries);
 +        return CMD_CONTINUE;
 +    }
 +    dte = get_dte(s, devid, &res);
 +    if (res != MEMTX_OK) {
 +        return CMD_STALL;
 +    }
 +
 +    dte_valid = FIELD_EX64(dte, DTE, VALID);
 +    if (!dte_valid) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid command attributes: "
 +                      "invalid dte: %"PRIx64" for %d\n",
 +                      __func__, dte, devid);
 +        return CMD_CONTINUE;
 +    }
 +
 +    num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
 +    if (eventid >= num_eventids) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid command attributes: eventid %d >= %"
 +                      PRId64 "\n",
 +                      __func__, eventid, num_eventids);
 +        return CMD_CONTINUE;
 +    }
 +
 +    ite_valid = get_ite(s, eventid, dte, &old_icid, &intid, &res);
 +    if (res != MEMTX_OK) {
 +        return CMD_STALL;
 +    }
 +
 +    if (!ite_valid) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid command attributes: invalid ITE\n",
 +                      __func__);
 +        return CMD_CONTINUE;
 +    }
 +
 +    if (old_icid >= s->ct.num_entries) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid ICID 0x%x in ITE (table corrupted?)\n",
 +                      __func__, old_icid);
 +        return CMD_CONTINUE;
 +    }
 +
 +    if (new_icid >= s->ct.num_entries) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid command attributes: ICID 0x%x\n",
 +                      __func__, new_icid);
 +        return CMD_CONTINUE;
 +    }
 +
 +    cte_valid = get_cte(s, old_icid, &old_cte, &res);
 +    if (res != MEMTX_OK) {
 +        return CMD_STALL;
 +    }
 +    if (!cte_valid) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid command attributes: "
 +                      "invalid cte: %"PRIx64"\n",
 +                      __func__, old_cte);
 +        return CMD_CONTINUE;
 +    }
 +
 +    cte_valid = get_cte(s, new_icid, &new_cte, &res);
 +    if (res != MEMTX_OK) {
 +        return CMD_STALL;
 +    }
 +    if (!cte_valid) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid command attributes: "
 +                      "invalid cte: %"PRIx64"\n",
 +                      __func__, new_cte);
 +        return CMD_CONTINUE;
 +    }
 +
 +    old_rdbase = FIELD_EX64(old_cte, CTE, RDBASE);
 +    if (old_rdbase >= s->gicv3->num_cpu) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: CTE has invalid rdbase 0x%"PRIx64"\n",
 +                      __func__, old_rdbase);
 +        return CMD_CONTINUE;
 +    }
 +
 +    new_rdbase = FIELD_EX64(new_cte, CTE, RDBASE);
 +    if (new_rdbase >= s->gicv3->num_cpu) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: CTE has invalid rdbase 0x%"PRIx64"\n",
 +                      __func__, new_rdbase);
 +        return CMD_CONTINUE;
 +    }
 +
 +    if (old_rdbase != new_rdbase) {
 +        /* Move the LPI from the old redistributor to the new one */
 +        gicv3_redist_mov_lpi(&s->gicv3->cpu[old_rdbase],
 +                             &s->gicv3->cpu[new_rdbase],
 +                             intid);
 +    }
 +
 +    /* Update the ICID field in the interrupt translation table entry */
 +    ite.itel = FIELD_DP64(ite.itel, ITE_L, VALID, 1);
 +    ite.itel = FIELD_DP64(ite.itel, ITE_L, INTTYPE, ITE_INTTYPE_PHYSICAL);
 +    ite.itel = FIELD_DP64(ite.itel, ITE_L, INTID, intid);
 +    ite.itel = FIELD_DP64(ite.itel, ITE_L, DOORBELL, INTID_SPURIOUS);
 +    ite.iteh = FIELD_DP32(ite.iteh, ITE_H, ICID, new_icid);
 +    return update_ite(s, eventid, dte, ite) ? CMD_CONTINUE : CMD_STALL;
 +}
 +
  /*
   * Current implementation blocks until all
   * commands are processed
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
                  gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
              }
              break;
 +        case GITS_CMD_MOVI:
 +            result = process_movi(s, data, cq_offset);
 +            break;
          case GITS_CMD_MOVALL:
              result = process_movall(s, data, cq_offset);
              break;
 diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_redist.c
 +++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level)
      gicv3_redist_lpi_pending(cs, irq, level);
  }
 +void gicv3_redist_mov_lpi(GICv3CPUState *src, GICv3CPUState *dest, int irq)
 +{
 +    /*
 +     * Move the specified LPI's pending state from the source redistributor
 +     * to the destination.
 +     *
 +     * If LPIs are disabled on dest this is CONSTRAINED UNPREDICTABLE:
 +     * we choose to NOP. If LPIs are disabled on source there's nothing
 +     * to be transferred anyway.
 +     */
 +    AddressSpace *as = &src->gic->dma_as;
 +    uint64_t idbits;
 +    uint32_t pendt_size;
 +    uint64_t src_baddr;
 +    uint8_t src_pend;
 +
 +    if (!(src->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) ||
 +        !(dest->gicr_ctlr & GICR_CTLR_ENABLE_LPIS)) {
 +        return;
 +    }
 +
-+    idbits = MIN(FIELD_EX64(src->gicr_propbaser, GICR_PROPBASER, IDBITS),
++    /*
-+                 GICD_TYPER_IDBITS);
++     * Move from mergereg to reg; this sets the high elements and
-+    idbits = MIN(FIELD_EX64(dest->gicr_propbaser, GICR_PROPBASER, IDBITS),
++     * clears the bits above 128 as a side effect.
-+                 idbits);
++     */
-+
++    tcg_gen_gvec_mov(MO_64, vec_full_reg_offset(s, reg),
-+    pendt_size = 1ULL << (idbits + 1);
++                     vec_full_reg_offset(s, mergereg),
-+    if ((irq / 8) >= pendt_size) {
++                     16, vec_full_reg_size(s));
 +    tcg_gen_st_i64(v, tcg_env, vec_full_reg_offset(s, reg));
 +}
 +
 +/*
 + * Write a single-prec result, but only clear the higher elements
 + * of the destination register if FPCR.NEP is 0; otherwise preserve them.
 + */
 +static void write_fp_sreg_merging(DisasContext *s, int reg, int mergereg,
 +                                  TCGv_i32 v)
 +{
 +    if (!s->fpcr_nep) {
 +        write_fp_sreg(s, reg, v);
 +        return;
 +    }
 +
-+    src_baddr = src->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
++    tcg_gen_gvec_mov(MO_64, vec_full_reg_offset(s, reg),
-+
++                     vec_full_reg_offset(s, mergereg),
-+    address_space_read(as, src_baddr + (irq / 8),
++                     16, vec_full_reg_size(s));
-+                       MEMTXATTRS_UNSPECIFIED, &src_pend, sizeof(src_pend));
++    tcg_gen_st_i32(v, tcg_env, fp_reg_offset(s, reg, MO_32));
-+    if (!extract32(src_pend, irq % 8, 1)) {
++}
-+        /* Not pending on source, nothing to do */
++
 +/*
 + * Write a half-prec result, but only clear the higher elements
 + * of the destination register if FPCR.NEP is 0; otherwise preserve them.
 + * The caller must ensure that the top 16 bits of v are zero.
 + */
 +static void write_fp_hreg_merging(DisasContext *s, int reg, int mergereg,
 +                                  TCGv_i32 v)
 +{
 +    if (!s->fpcr_nep) {
 +        write_fp_sreg(s, reg, v);
 +        return;
 +    }
-+    src_pend &= ~(1 << (irq % 8));
++
-+    address_space_write(as, src_baddr + (irq / 8),
++    tcg_gen_gvec_mov(MO_64, vec_full_reg_offset(s, reg),
-+                        MEMTXATTRS_UNSPECIFIED, &src_pend, sizeof(src_pend));
++                     vec_full_reg_offset(s, mergereg),
-+    if (irq == src->hpplpi.irq) {
++                     16, vec_full_reg_size(s));
-+        /*
++    tcg_gen_st16_i32(v, tcg_env, fp_reg_offset(s, reg, MO_16));
 +         * We just made this LPI not-pending so only need to update
 +         * if it was previously the highest priority pending LPI
 +         */
 +        gicv3_redist_update_lpi(src);
 +    }
 +    /* Mark it pending on the destination */
 +    gicv3_redist_lpi_pending(dest, irq, 1);
 +}
 +
- void gicv3_redist_movall_lpis(GICv3CPUState *src, GICv3CPUState *dest)
+ /* Expand a 2-operand AdvSIMD vector operation using an expander function.  */
- {
+ static void gen_gvec_fn2(DisasContext *s, bool is_q, int rd, int rn,
-     /*
+                          GVecGen2Fn *gvec_fn, int vece)
@@ -XXX,XX +XXX,XX @@ typedef struct FPScalar {
  } FPScalar;
  static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
 -                                        const FPScalar *f,
 +                                        const FPScalar *f, int mergereg,
                                          ARMFPStatusFlavour fpsttype)
  {
      switch (a->esz) {
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
              TCGv_i64 t0 = read_fp_dreg(s, a->rn);
              TCGv_i64 t1 = read_fp_dreg(s, a->rm);
              f->gen_d(t0, t0, t1, fpstatus_ptr(fpsttype));
 -            write_fp_dreg(s, a->rd, t0);
 +            write_fp_dreg_merging(s, a->rd, mergereg, t0);
          }
          break;
      case MO_32:
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
              TCGv_i32 t0 = read_fp_sreg(s, a->rn);
              TCGv_i32 t1 = read_fp_sreg(s, a->rm);
              f->gen_s(t0, t0, t1, fpstatus_ptr(fpsttype));
 -            write_fp_sreg(s, a->rd, t0);
 +            write_fp_sreg_merging(s, a->rd, mergereg, t0);
          }
          break;
      case MO_16:
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
              TCGv_i32 t0 = read_fp_hreg(s, a->rn);
              TCGv_i32 t1 = read_fp_hreg(s, a->rm);
              f->gen_h(t0, t0, t1, fpstatus_ptr(fpsttype));
 -            write_fp_sreg(s, a->rd, t0);
 +            write_fp_hreg_merging(s, a->rd, mergereg, t0);
          }
          break;
      default:
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
      return true;
  }
 -static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
 +static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f,
 +                          int mergereg)
  {
 -    return do_fp3_scalar_with_fpsttype(s, a, f,
 +    return do_fp3_scalar_with_fpsttype(s, a, f, mergereg,
                                         a->esz == MO_16 ?
                                         FPST_A64_F16 : FPST_A64);
  }
 -static bool do_fp3_scalar_ah(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
 +static bool do_fp3_scalar_ah(DisasContext *s, arg_rrr_e *a, const FPScalar *f,
 +                             int mergereg)
  {
 -    return do_fp3_scalar_with_fpsttype(s, a, f, select_ah_fpst(s, a->esz));
 +    return do_fp3_scalar_with_fpsttype(s, a, f, mergereg,
 +                                       select_ah_fpst(s, a->esz));
  }
  static const FPScalar f_scalar_fadd = {
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fadd = {
      gen_helper_vfp_adds,
      gen_helper_vfp_addd,
  };
 -TRANS(FADD_s, do_fp3_scalar, a, &f_scalar_fadd)
 +TRANS(FADD_s, do_fp3_scalar, a, &f_scalar_fadd, a->rn)
  static const FPScalar f_scalar_fsub = {
      gen_helper_vfp_subh,
      gen_helper_vfp_subs,
      gen_helper_vfp_subd,
  };
 -TRANS(FSUB_s, do_fp3_scalar, a, &f_scalar_fsub)
 +TRANS(FSUB_s, do_fp3_scalar, a, &f_scalar_fsub, a->rn)
  static const FPScalar f_scalar_fdiv = {
      gen_helper_vfp_divh,
      gen_helper_vfp_divs,
      gen_helper_vfp_divd,
  };
 -TRANS(FDIV_s, do_fp3_scalar, a, &f_scalar_fdiv)
 +TRANS(FDIV_s, do_fp3_scalar, a, &f_scalar_fdiv, a->rn)
  static const FPScalar f_scalar_fmul = {
      gen_helper_vfp_mulh,
      gen_helper_vfp_muls,
      gen_helper_vfp_muld,
  };
 -TRANS(FMUL_s, do_fp3_scalar, a, &f_scalar_fmul)
 +TRANS(FMUL_s, do_fp3_scalar, a, &f_scalar_fmul, a->rn)
  static const FPScalar f_scalar_fmax = {
      gen_helper_vfp_maxh,
      gen_helper_vfp_maxs,
      gen_helper_vfp_maxd,
  };
 -TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax)
 +TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax, a->rn)
  static const FPScalar f_scalar_fmin = {
      gen_helper_vfp_minh,
      gen_helper_vfp_mins,
      gen_helper_vfp_mind,
  };
 -TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin)
 +TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin, a->rn)
  static const FPScalar f_scalar_fmaxnm = {
      gen_helper_vfp_maxnumh,
      gen_helper_vfp_maxnums,
      gen_helper_vfp_maxnumd,
  };
 -TRANS(FMAXNM_s, do_fp3_scalar, a, &f_scalar_fmaxnm)
 +TRANS(FMAXNM_s, do_fp3_scalar, a, &f_scalar_fmaxnm, a->rn)
  static const FPScalar f_scalar_fminnm = {
      gen_helper_vfp_minnumh,
      gen_helper_vfp_minnums,
      gen_helper_vfp_minnumd,
  };
 -TRANS(FMINNM_s, do_fp3_scalar, a, &f_scalar_fminnm)
 +TRANS(FMINNM_s, do_fp3_scalar, a, &f_scalar_fminnm, a->rn)
  static const FPScalar f_scalar_fmulx = {
      gen_helper_advsimd_mulxh,
      gen_helper_vfp_mulxs,
      gen_helper_vfp_mulxd,
  };
 -TRANS(FMULX_s, do_fp3_scalar, a, &f_scalar_fmulx)
 +TRANS(FMULX_s, do_fp3_scalar, a, &f_scalar_fmulx, a->rn)
  static void gen_fnmul_h(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
  {
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fnmul = {
      gen_fnmul_s,
      gen_fnmul_d,
  };
 -TRANS(FNMUL_s, do_fp3_scalar, a, &f_scalar_fnmul)
 +TRANS(FNMUL_s, do_fp3_scalar, a, &f_scalar_fnmul, a->rn)
  static const FPScalar f_scalar_fcmeq = {
      gen_helper_advsimd_ceq_f16,
      gen_helper_neon_ceq_f32,
      gen_helper_neon_ceq_f64,
  };
 -TRANS(FCMEQ_s, do_fp3_scalar, a, &f_scalar_fcmeq)
 +TRANS(FCMEQ_s, do_fp3_scalar, a, &f_scalar_fcmeq, a->rm)
  static const FPScalar f_scalar_fcmge = {
      gen_helper_advsimd_cge_f16,
      gen_helper_neon_cge_f32,
      gen_helper_neon_cge_f64,
  };
 -TRANS(FCMGE_s, do_fp3_scalar, a, &f_scalar_fcmge)
 +TRANS(FCMGE_s, do_fp3_scalar, a, &f_scalar_fcmge, a->rm)
  static const FPScalar f_scalar_fcmgt = {
      gen_helper_advsimd_cgt_f16,
      gen_helper_neon_cgt_f32,
      gen_helper_neon_cgt_f64,
  };
 -TRANS(FCMGT_s, do_fp3_scalar, a, &f_scalar_fcmgt)
 +TRANS(FCMGT_s, do_fp3_scalar, a, &f_scalar_fcmgt, a->rm)
  static const FPScalar f_scalar_facge = {
      gen_helper_advsimd_acge_f16,
      gen_helper_neon_acge_f32,
      gen_helper_neon_acge_f64,
  };
 -TRANS(FACGE_s, do_fp3_scalar, a, &f_scalar_facge)
 +TRANS(FACGE_s, do_fp3_scalar, a, &f_scalar_facge, a->rm)
  static const FPScalar f_scalar_facgt = {
      gen_helper_advsimd_acgt_f16,
      gen_helper_neon_acgt_f32,
      gen_helper_neon_acgt_f64,
  };
 -TRANS(FACGT_s, do_fp3_scalar, a, &f_scalar_facgt)
 +TRANS(FACGT_s, do_fp3_scalar, a, &f_scalar_facgt, a->rm)
  static void gen_fabd_h(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
  {
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fabd = {
      gen_fabd_s,
      gen_fabd_d,
  };
 -TRANS(FABD_s, do_fp3_scalar, a, &f_scalar_fabd)
 +TRANS(FABD_s, do_fp3_scalar, a, &f_scalar_fabd, a->rn)
  static const FPScalar f_scalar_frecps = {
      gen_helper_recpsf_f16,
      gen_helper_recpsf_f32,
      gen_helper_recpsf_f64,
  };
 -TRANS(FRECPS_s, do_fp3_scalar_ah, a, &f_scalar_frecps)
 +TRANS(FRECPS_s, do_fp3_scalar_ah, a, &f_scalar_frecps, a->rn)
  static const FPScalar f_scalar_frsqrts = {
      gen_helper_rsqrtsf_f16,
      gen_helper_rsqrtsf_f32,
      gen_helper_rsqrtsf_f64,
  };
 -TRANS(FRSQRTS_s, do_fp3_scalar_ah, a, &f_scalar_frsqrts)
 +TRANS(FRSQRTS_s, do_fp3_scalar_ah, a, &f_scalar_frsqrts, a->rn)
  static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
                         const FPScalar *f, bool swap)
 --
-.25.1
+.34.1

-New patch
+[PULL 16/68] target/arm: Handle FPCR.NEP for 3-input scalar operations
+Handle FPCR.NEP for the 3-input scalar operations which use
+do_fmla_scalar_idx() and do_fmadd(), by making them call the
+appropriate write_fp_*reg_merging() functions.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/translate-a64.c | 12 ++++++------
+file changed, 6 insertions(+), 6 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+                 gen_vfp_negd(t1, t1);
+             }
+             gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
+-            write_fp_dreg(s, a->rd, t0);
++            write_fp_dreg_merging(s, a->rd, a->rd, t0);
+         }
+         break;
+     case MO_32:
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+                 gen_vfp_negs(t1, t1);
+             }
+             gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
+-            write_fp_sreg(s, a->rd, t0);
++            write_fp_sreg_merging(s, a->rd, a->rd, t0);
+         }
+         break;
+     case MO_16:
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
+             }
+             gen_helper_advsimd_muladdh(t0, t1, t2, t0,
+                                        fpstatus_ptr(FPST_A64_F16));
+-            write_fp_sreg(s, a->rd, t0);
++            write_fp_hreg_merging(s, a->rd, a->rd, t0);
+         }
+         break;
+     default:
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             }
+             fpst = fpstatus_ptr(FPST_A64);
+             gen_helper_vfp_muladdd(ta, tn, tm, ta, fpst);
+-            write_fp_dreg(s, a->rd, ta);
++            write_fp_dreg_merging(s, a->rd, a->ra, ta);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             }
+             fpst = fpstatus_ptr(FPST_A64);
+             gen_helper_vfp_muladds(ta, tn, tm, ta, fpst);
+-            write_fp_sreg(s, a->rd, ta);
++            write_fp_sreg_merging(s, a->rd, a->ra, ta);
+         }
+         break;
+@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
+             }
+             fpst = fpstatus_ptr(FPST_A64_F16);
+             gen_helper_advsimd_muladdh(ta, tn, tm, ta, fpst);
+-            write_fp_sreg(s, a->rd, ta);
++            write_fp_hreg_merging(s, a->rd, a->ra, ta);
+         }
+         break;
+--
+.34.1

-New patch
+[PULL 17/68] target/arm: Handle FPCR.NEP for BFCVT scalar
+Currently we implement BFCVT scalar via do_fp1_scalar().  This works
+even though BFCVT is a narrowing operation from 32 to 16 bits,
+because we can use write_fp_sreg() for float16. However, FPCR.NEP
+support requires that we use write_fp_hreg_merging() for float16
+outputs, so we can't continue to borrow the non-narrowing
+do_fp1_scalar() function for this. Split out trans_BFCVT_s()
+into its own implementation that honours FPCR.NEP.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/translate-a64.c | 25 +++++++++++++++++++++----
+file changed, 21 insertions(+), 4 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static const FPScalar1 f_scalar_frintx = {
+ };
+ TRANS(FRINTX_s, do_fp1_scalar, a, &f_scalar_frintx, -1)
+-static const FPScalar1 f_scalar_bfcvt = {
+-    .gen_s = gen_helper_bfcvt,
+-};
+-TRANS_FEAT(BFCVT_s, aa64_bf16, do_fp1_scalar_ah, a, &f_scalar_bfcvt, -1)
++static bool trans_BFCVT_s(DisasContext *s, arg_rr_e *a)
++{
++    ARMFPStatusFlavour fpsttype = s->fpcr_ah ? FPST_AH : FPST_A64;
++    TCGv_i32 t32;
++    int check;
++
++    if (!dc_isar_feature(aa64_bf16, s)) {
++        return false;
++    }
++
++    check = fp_access_check_scalar_hsd(s, a->esz);
++
++    if (check <= 0) {
++        return check == 0;
++    }
++
++    t32 = read_fp_sreg(s, a->rn);
++    gen_helper_bfcvt(t32, t32, fpstatus_ptr(fpsttype));
++    write_fp_hreg_merging(s, a->rd, a->rd, t32);
++    return true;
++}
+ static const FPScalar1 f_scalar_frint32 = {
+     NULL,
+--
+.34.1

-New patch
+[PULL 18/68] target/arm: Handle FPCR.NEP for 1-input scalar operations
+Handle FPCR.NEP for the 1-input scalar operations.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/translate-a64.c | 26 ++++++++++++++------------
+file changed, 14 insertions(+), 12 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar_with_fpsttype(DisasContext *s, arg_rr_e *a,
+     case MO_64:
+         t64 = read_fp_dreg(s, a->rn);
+         f->gen_d(t64, t64, fpst);
+-        write_fp_dreg(s, a->rd, t64);
++        write_fp_dreg_merging(s, a->rd, a->rd, t64);
+         break;
+     case MO_32:
+         t32 = read_fp_sreg(s, a->rn);
+         f->gen_s(t32, t32, fpst);
+-        write_fp_sreg(s, a->rd, t32);
++        write_fp_sreg_merging(s, a->rd, a->rd, t32);
+         break;
+     case MO_16:
+         t32 = read_fp_hreg(s, a->rn);
+         f->gen_h(t32, t32, fpst);
+-        write_fp_sreg(s, a->rd, t32);
++        write_fp_hreg_merging(s, a->rd, a->rd, t32);
+         break;
+     default:
+         g_assert_not_reached();
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
+         TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvtds(tcg_rd, tcg_rn, fpst);
+-        write_fp_dreg(s, a->rd, tcg_rd);
++        write_fp_dreg_merging(s, a->rd, a->rd, tcg_rd);
+     }
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hs(DisasContext *s, arg_rr *a)
+         TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
+-        /* write_fp_sreg is OK here because top half of result is zero */
+-        write_fp_sreg(s, a->rd, tmp);
++        /* write_fp_hreg_merging is OK here because top half of result is zero */
++        write_fp_hreg_merging(s, a->rd, a->rd, tmp);
+     }
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sd(DisasContext *s, arg_rr *a)
+         TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvtsd(tcg_rd, tcg_rn, fpst);
+-        write_fp_sreg(s, a->rd, tcg_rd);
++        write_fp_sreg_merging(s, a->rd, a->rd, tcg_rd);
+     }
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hd(DisasContext *s, arg_rr *a)
+         TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
+         gen_helper_vfp_fcvt_f64_to_f16(tcg_rd, tcg_rn, fpst, ahp);
+-        /* write_fp_sreg is OK here because top half of tcg_rd is zero */
+-        write_fp_sreg(s, a->rd, tcg_rd);
++        /* write_fp_hreg_merging is OK here because top half of tcg_rd is zero */
++        write_fp_hreg_merging(s, a->rd, a->rd, tcg_rd);
+     }
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+-        write_fp_sreg(s, a->rd, tcg_rd);
++        write_fp_sreg_merging(s, a->rd, a->rd, tcg_rd);
+     }
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
+         TCGv_i32 tcg_ahp = get_ahp_flag();
+         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
+-        write_fp_dreg(s, a->rd, tcg_rd);
++        write_fp_dreg_merging(s, a->rd, a->rd, tcg_rd);
+     }
+     return true;
+ }
+@@ -XXX,XX +XXX,XX @@ static bool do_fcvt_f(DisasContext *s, arg_fcvt *a,
+     do_fcvt_scalar(s, a->esz | (is_signed ? MO_SIGN : 0),
+                    a->esz, tcg_int, a->shift, a->rn, rmode);
+-    clear_vec(s, a->rd);
++    if (!s->fpcr_nep) {
++        clear_vec(s, a->rd);
++    }
+     write_vec_element(s, tcg_int, a->rd, 0, a->esz);
+     return true;
+ }
+--
+.34.1

-New patch
+[PULL 19/68] target/arm: Handle FPCR.NEP in do_cvtf_scalar()
+Handle FPCR.NEP in the operations handled by do_cvtf_scalar().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/translate-a64.c | 6 +++---
+file changed, 3 insertions(+), 3 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
+         } else {
+             gen_helper_vfp_uqtod(tcg_double, tcg_int, tcg_shift, tcg_fpstatus);
+         }
+-        write_fp_dreg(s, rd, tcg_double);
++        write_fp_dreg_merging(s, rd, rd, tcg_double);
+         break;
+     case MO_32:
+@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
+         } else {
+             gen_helper_vfp_uqtos(tcg_single, tcg_int, tcg_shift, tcg_fpstatus);
+         }
+-        write_fp_sreg(s, rd, tcg_single);
++        write_fp_sreg_merging(s, rd, rd, tcg_single);
+         break;
+     case MO_16:
+@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
+         } else {
+             gen_helper_vfp_uqtoh(tcg_single, tcg_int, tcg_shift, tcg_fpstatus);
+         }
+-        write_fp_sreg(s, rd, tcg_single);
++        write_fp_hreg_merging(s, rd, rd, tcg_single);
+         break;
+     default:
+--
+.34.1

-New patch
+[PULL 20/68] target/arm: Handle FPCR.NEP for scalar FABS and FNEG
+Handle FPCR.NEP merging for scalar FABS and FNEG; this requires
+an extra parameter to do_fp1_scalar_int(), since FMOV scalar
+does not have the merging behaviour.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/translate-a64.c | 27 ++++++++++++++++++++-------
+file changed, 20 insertions(+), 7 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ typedef struct FPScalar1Int {
+ } FPScalar1Int;
+ static bool do_fp1_scalar_int(DisasContext *s, arg_rr_e *a,
+-                              const FPScalar1Int *f)
++                              const FPScalar1Int *f,
++                              bool merging)
+ {
+     switch (a->esz) {
+     case MO_64:
+         if (fp_access_check(s)) {
+             TCGv_i64 t = read_fp_dreg(s, a->rn);
+             f->gen_d(t, t);
+-            write_fp_dreg(s, a->rd, t);
++            if (merging) {
++                write_fp_dreg_merging(s, a->rd, a->rd, t);
++            } else {
++                write_fp_dreg(s, a->rd, t);
++            }
+         }
+         break;
+     case MO_32:
+         if (fp_access_check(s)) {
+             TCGv_i32 t = read_fp_sreg(s, a->rn);
+             f->gen_s(t, t);
+-            write_fp_sreg(s, a->rd, t);
++            if (merging) {
++                write_fp_sreg_merging(s, a->rd, a->rd, t);
++            } else {
++                write_fp_sreg(s, a->rd, t);
++            }
+         }
+         break;
+     case MO_16:
+@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar_int(DisasContext *s, arg_rr_e *a,
+         if (fp_access_check(s)) {
+             TCGv_i32 t = read_fp_hreg(s, a->rn);
+             f->gen_h(t, t);
+-            write_fp_sreg(s, a->rd, t);
++            if (merging) {
++                write_fp_hreg_merging(s, a->rd, a->rd, t);
++            } else {
++                write_fp_sreg(s, a->rd, t);
++            }
+         }
+         break;
+     default:
+@@ -XXX,XX +XXX,XX @@ static const FPScalar1Int f_scalar_fmov = {
+     tcg_gen_mov_i32,
+     tcg_gen_mov_i64,
+ };
+-TRANS(FMOV_s, do_fp1_scalar_int, a, &f_scalar_fmov)
++TRANS(FMOV_s, do_fp1_scalar_int, a, &f_scalar_fmov, false)
+ static const FPScalar1Int f_scalar_fabs = {
+     gen_vfp_absh,
+     gen_vfp_abss,
+     gen_vfp_absd,
+ };
+-TRANS(FABS_s, do_fp1_scalar_int, a, &f_scalar_fabs)
++TRANS(FABS_s, do_fp1_scalar_int, a, &f_scalar_fabs, true)
+ static const FPScalar1Int f_scalar_fneg = {
+     gen_vfp_negh,
+     gen_vfp_negs,
+     gen_vfp_negd,
+ };
+-TRANS(FNEG_s, do_fp1_scalar_int, a, &f_scalar_fneg)
++TRANS(FNEG_s, do_fp1_scalar_int, a, &f_scalar_fneg, true)
+ typedef struct FPScalar1 {
+     void (*gen_h)(TCGv_i32, TCGv_i32, TCGv_ptr);
+--
+.34.1

-[PULL 26/32] hw/intc/arm_gicv3_its: Provide read accessor for translation_ops
+[PULL 21/68] target/arm: Handle FPCR.NEP for FCVTXN (scalar)
-The MemoryRegionOps gicv3_its_translation_ops currently provides only
+Unlike the other users of do_2misc_narrow_scalar(), FCVTXN (scalar)
-a .write_with_attrs function, because the only register in this
+is always double-to-single and must honour FPCR.NEP.  Implement this
-region is the write-only GITS_TRANSLATER.  However, if you don't
+directly in a trans function rather than using
-provide a read function and the guest tries reading from this memory
+do_2misc_narrow_scalar().
 region, QEMU will crash because
 memory_region_read_with_attrs_accessor() calls a NULL pointer.
-Add a read function which always returns 0, to cover both bogus
+We still need gen_fcvtxn_sd() and the f_scalar_fcvtxn[] array for
-attempts to read GITS_TRANSLATER and also reads from the rest of the
+the FCVTXN (vector) insn, so we move those down in the file to
-region, which is documented to be reserved, RES0.
+where they are used.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-11-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_its.c | 13 +++++++++++++
+ target/arm/tcg/translate-a64.c | 43 ++++++++++++++++++++++------------
-file changed, 13 insertions(+)
+file changed, 28 insertions(+), 15 deletions(-)
-diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its.c
+--- a/target/arm/tcg/translate-a64.c
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/target/arm/tcg/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void extract_cmdq_params(GICv3ITSState *s)
+@@ -XXX,XX +XXX,XX @@ static ArithOneOp * const f_scalar_uqxtn[] = {
-     }
+ };
  TRANS(UQXTN_s, do_2misc_narrow_scalar, a, f_scalar_uqxtn)
 -static void gen_fcvtxn_sd(TCGv_i64 d, TCGv_i64 n)
 +static bool trans_FCVTXN_s(DisasContext *s, arg_rr_e *a)
  {
 -    /*
 -     * 64 bit to 32 bit float conversion
 -     * with von Neumann rounding (round to odd)
 -     */
 -    TCGv_i32 tmp = tcg_temp_new_i32();
 -    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_A64));
 -    tcg_gen_extu_i32_i64(d, tmp);
 +    if (fp_access_check(s)) {
 +        /*
 +         * 64 bit to 32 bit float conversion
 +         * with von Neumann rounding (round to odd)
 +         */
 +        TCGv_i64 src = read_fp_dreg(s, a->rn);
 +        TCGv_i32 dst = tcg_temp_new_i32();
 +        gen_helper_fcvtx_f64_to_f32(dst, src, fpstatus_ptr(FPST_A64));
 +        write_fp_sreg_merging(s, a->rd, a->rd, dst);
 +    }
 +    return true;
  }
-+static MemTxResult gicv3_its_translation_read(void *opaque, hwaddr offset,
+-static ArithOneOp * const f_scalar_fcvtxn[] = {
-+                                              uint64_t *data, unsigned size,
+-    NULL,
-+                                              MemTxAttrs attrs)
+-    NULL,
 -    gen_fcvtxn_sd,
 -};
 -TRANS(FCVTXN_s, do_2misc_narrow_scalar, a, f_scalar_fcvtxn)
 -
  #undef WRAP_ENV
  static bool do_gvec_fn2(DisasContext *s, arg_qrr_e *a, GVecGen2Fn *fn)
@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_sd(TCGv_i64 d, TCGv_i64 n)
      tcg_gen_extu_i32_i64(d, tmp);
  }
 +static void gen_fcvtxn_sd(TCGv_i64 d, TCGv_i64 n)
 +{
 +    /*
-+     * GITS_TRANSLATER is write-only, and all other addresses
++     * 64 bit to 32 bit float conversion
-+     * in the interrupt translation space frame are RES0.
++     * with von Neumann rounding (round to odd)
 +     */
-+    *data = 0;
++    TCGv_i32 tmp = tcg_temp_new_i32();
-+    return MEMTX_OK;
++    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_A64));
 +    tcg_gen_extu_i32_i64(d, tmp);
 +}
 +
- static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
+ static ArithOneOp * const f_vector_fcvtn[] = {
-                                                uint64_t data, unsigned size,
+     NULL,
-                                                MemTxAttrs attrs)
+     gen_fcvtn_hs,
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps gicv3_its_control_ops = {
+     gen_fcvtn_sd,
  };
++static ArithOneOp * const f_scalar_fcvtxn[] = {
- static const MemoryRegionOps gicv3_its_translation_ops = {
++    NULL,
-+    .read_with_attrs = gicv3_its_translation_read,
++    NULL,
-     .write_with_attrs = gicv3_its_translation_write,
++    gen_fcvtxn_sd,
-     .valid.min_access_size = 2,
++};
-     .valid.max_access_size = 4,
+ TRANS(FCVTN_v, do_2misc_narrow_vector, a, f_vector_fcvtn)
  TRANS(FCVTXN_v, do_2misc_narrow_vector, a, f_scalar_fcvtxn)
 --
-.25.1
+.34.1

-[PULL 21/32] hw/intc/arm_gicv3_its: Don't clear GITS_CWRITER on writes to GITS_CBASER
+[PULL 22/68] target/arm: Handle FPCR.NEP for NEP for FMUL, FMULX scalar by element
-The ITS specification says that when the guest writes to GITS_CBASER
+do_fp3_scalar_idx() is used only for the FMUL and FMULX scalar by
-this causes GITS_CREADR to be cleared.  However it does not have an
+element instructions; these both need to merge the result with the Rn
-equivalent clause for GITS_CWRITER.  (This is because GITS_CREADR is
+register when FPCR.NEP is set.
 read-only, but GITS_CWRITER is writable and the guest can initialize
 it.) Remove the code that clears GITS_CWRITER on GITS_CBASER writes.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-6-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_its.c | 3 ---
+ target/arm/tcg/translate-a64.c | 6 +++---
-file changed, 3 deletions(-)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its.c
+--- a/target/arm/tcg/translate-a64.c
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/target/arm/tcg/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
-         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
-             s->cbaser = deposit64(s->cbaser, 0, 32, value);
+             read_vec_element(s, t1, a->rm, a->idx, MO_64);
-             s->creadr = 0;
+             f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
--            s->cwriter = s->creadr;
+-            write_fp_dreg(s, a->rd, t0);
 +            write_fp_dreg_merging(s, a->rd, a->rn, t0);
          }
          break;
-     case GITS_CBASER + 4:
+     case MO_32:
-@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
-         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
-             s->cbaser = deposit64(s->cbaser, 32, 32, value);
+             read_vec_element_i32(s, t1, a->rm, a->idx, MO_32);
-             s->creadr = 0;
+             f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
--            s->cwriter = s->creadr;
+-            write_fp_sreg(s, a->rd, t0);
 +            write_fp_sreg_merging(s, a->rd, a->rn, t0);
          }
          break;
-     case GITS_CWRITER:
+     case MO_16:
-@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
-         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
-             s->cbaser = value;
+             read_vec_element_i32(s, t1, a->rm, a->idx, MO_16);
-             s->creadr = 0;
+             f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
--            s->cwriter = s->creadr;
+-            write_fp_sreg(s, a->rd, t0);
 +            write_fp_hreg_merging(s, a->rd, a->rn, t0);
          }
          break;
-     case GITS_CWRITER:
+     default:
 --
-.25.1
+.34.1

-[PULL 19/32] hw/intc/arm_gicv3: Initialise dma_as in GIC, not ITS
+[PULL 23/68] target/arm: Implement FPCR.AH semantics for scalar FMIN/FMAX
-In our implementation, all ITSes connected to a GIC share a single
+When FPCR.AH == 1, floating point FMIN and FMAX have some odd special
-AddressSpace, which we keep in the GICv3State::dma_as field and
+cases:
 initialized based on the GIC's 'sysmem' property. The right place
 to set it up by calling address_space_init() is therefore in the
 GIC's realize method, not the ITS's realize.
-This fixes a theoretical bug where QEMU hangs on startup if the board
+ * comparing two zeroes (even of different sign) or comparing a NaN
-model creates two ITSes connected to the same GIC -- we would call
+   with anything always returns the second argument (possibly
-address_space_init() twice on the same AddressSpace*, which creates
+   squashed to zero)
-an infinite loop in the QTAILQ that softmmu/memory.c uses to store
+ * denormal outputs are not squashed to zero regardless of FZ or FZ16
-its list of AddressSpaces and causes any subsequent attempt to
-iterate through that list to loop forever.  There aren't any board
+Implement these semantics in new helper functions and select them at
-models like that in the tree at the moment, though.
+translate time if FPCR.AH is 1 for the scalar FMAX and FMIN insns.
 (We will convert the other FMAX and FMIN insns in subsequent
 commits.)
 Note that FMINNM and FMAXNM are not affected.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-4-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_common.c | 5 +++++
+ target/arm/tcg/helper-a64.h    |  7 +++++++
- hw/intc/arm_gicv3_its.c    | 3 ---
+ target/arm/tcg/helper-a64.c    | 36 ++++++++++++++++++++++++++++++++++
-files changed, 5 insertions(+), 3 deletions(-)
+ target/arm/tcg/translate-a64.c | 23 ++++++++++++++++++++--
 files changed, 64 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
+diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_common.c
+--- a/target/arm/tcg/helper-a64.h
-+++ b/hw/intc/arm_gicv3_common.c
++++ b/target/arm/tcg/helper-a64.h
-@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(advsimd_muladd2h, i32, i32, i32, i32, fpst)
-         return;
+ DEF_HELPER_2(advsimd_rinth_exact, f16, f16, fpst)
-     }
+ DEF_HELPER_2(advsimd_rinth, f16, f16, fpst)
-+    if (s->lpi_enable) {
++DEF_HELPER_3(vfp_ah_minh, f16, f16, f16, fpst)
-+        address_space_init(&s->dma_as, s->dma,
++DEF_HELPER_3(vfp_ah_mins, f32, f32, f32, fpst)
-+                           "gicv3-its-sysmem");
++DEF_HELPER_3(vfp_ah_mind, f64, f64, f64, fpst)
 +DEF_HELPER_3(vfp_ah_maxh, f16, f16, f16, fpst)
 +DEF_HELPER_3(vfp_ah_maxs, f32, f32, f32, fpst)
 +DEF_HELPER_3(vfp_ah_maxd, f64, f64, f64, fpst)
 +
  DEF_HELPER_2(exception_return, void, env, i64)
  DEF_HELPER_FLAGS_2(dc_zva, TCG_CALL_NO_WG, void, env, i64)
 diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/helper-a64.c
 +++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ float32 HELPER(fcvtx_f64_to_f32)(float64 a, float_status *fpst)
      return r;
  }
 +/*
 + * AH=1 min/max have some odd special cases:
 + * comparing two zeroes (regardless of sign), (NaN, anything),
 + * or (anything, NaN) should return the second argument (possibly
 + * squashed to zero).
 + * Also, denormal outputs are not squashed to zero regardless of FZ or FZ16.
 + */
 +#define AH_MINMAX_HELPER(NAME, CTYPE, FLOATTYPE, MINMAX)                \
 +    CTYPE HELPER(NAME)(CTYPE a, CTYPE b, float_status *fpst)            \
 +    {                                                                   \
 +        bool save;                                                      \
 +        CTYPE r;                                                        \
 +        a = FLOATTYPE ## _squash_input_denormal(a, fpst);               \
 +        b = FLOATTYPE ## _squash_input_denormal(b, fpst);               \
 +        if (FLOATTYPE ## _is_zero(a) && FLOATTYPE ## _is_zero(b)) {     \
 +            return b;                                                   \
 +        }                                                               \
 +        if (FLOATTYPE ## _is_any_nan(a) ||                              \
 +            FLOATTYPE ## _is_any_nan(b)) {                              \
 +            float_raise(float_flag_invalid, fpst);                      \
 +            return b;                                                   \
 +        }                                                               \
 +        save = get_flush_to_zero(fpst);                                 \
 +        set_flush_to_zero(false, fpst);                                 \
 +        r = FLOATTYPE ## _ ## MINMAX(a, b, fpst);                       \
 +        set_flush_to_zero(save, fpst);                                  \
 +        return r;                                                       \
 +    }
 +
-     s->cpu = g_new0(GICv3CPUState, s->num_cpu);
++AH_MINMAX_HELPER(vfp_ah_minh, dh_ctype_f16, float16, min)
++AH_MINMAX_HELPER(vfp_ah_mins, float32, float32, min)
-     for (i = 0; i < s->num_cpu; i++) {
++AH_MINMAX_HELPER(vfp_ah_mind, float64, float64, min)
-diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
++AH_MINMAX_HELPER(vfp_ah_maxh, dh_ctype_f16, float16, max)
 +AH_MINMAX_HELPER(vfp_ah_maxs, float32, float32, max)
 +AH_MINMAX_HELPER(vfp_ah_maxd, float64, float64, max)
 +
  /* 64-bit versions of the CRC helpers. Note that although the operation
   * (and the prototypes of crc32c() and crc32() mean that only the bottom
   * 32 bits of the accumulator and result are used, we pass and return
 diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its.c
+--- a/target/arm/tcg/translate-a64.c
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/target/arm/tcg/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_ah(DisasContext *s, arg_rrr_e *a, const FPScalar *f,
+                                        select_ah_fpst(s, a->esz));
-     gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
+ }
--    address_space_init(&s->gicv3->dma_as, s->gicv3->dma,
++/* Some insns need to call different helpers when FPCR.AH == 1 */
--                       "gicv3-its-sysmem");
++static bool do_fp3_scalar_2fn(DisasContext *s, arg_rrr_e *a,
--
++                              const FPScalar *fnormal,
-     /* set the ITS default features supported */
++                              const FPScalar *fah,
-     s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL, 1);
++                              int mergereg)
-     s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE,
++{
 +    return do_fp3_scalar(s, a, s->fpcr_ah ? fah : fnormal, mergereg);
 +}
 +
  static const FPScalar f_scalar_fadd = {
      gen_helper_vfp_addh,
      gen_helper_vfp_adds,
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fmax = {
      gen_helper_vfp_maxs,
      gen_helper_vfp_maxd,
  };
 -TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax, a->rn)
 +static const FPScalar f_scalar_fmax_ah = {
 +    gen_helper_vfp_ah_maxh,
 +    gen_helper_vfp_ah_maxs,
 +    gen_helper_vfp_ah_maxd,
 +};
 +TRANS(FMAX_s, do_fp3_scalar_2fn, a, &f_scalar_fmax, &f_scalar_fmax_ah, a->rn)
  static const FPScalar f_scalar_fmin = {
      gen_helper_vfp_minh,
      gen_helper_vfp_mins,
      gen_helper_vfp_mind,
  };
 -TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin, a->rn)
 +static const FPScalar f_scalar_fmin_ah = {
 +    gen_helper_vfp_ah_minh,
 +    gen_helper_vfp_ah_mins,
 +    gen_helper_vfp_ah_mind,
 +};
 +TRANS(FMIN_s, do_fp3_scalar_2fn, a, &f_scalar_fmin, &f_scalar_fmin_ah, a->rn)
  static const FPScalar f_scalar_fmaxnm = {
      gen_helper_vfp_maxnumh,
 --
-.25.1
+.34.1

-[PULL 11/32] hw/arm/xlnx-versal: Connect the OSPI flash memory controller model
+[PULL 24/68] target/arm: Implement FPCR.AH semantics for vector FMIN/FMAX
-From: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Implement the FPCR.AH == 1 semantics for vector FMIN/FMAX, by
 creating new _ah_ versions of the gvec helpers which invoke the
 scalar fmin_ah and fmax_ah helpers on each element.
-Connect the OSPI flash memory controller model (including the source and
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-destination DMA).
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  target/arm/tcg/helper-sve.h    | 14 ++++++++++++++
  target/arm/tcg/translate-a64.c | 21 +++++++++++++++++++--
  target/arm/tcg/vec_helper.c    |  8 ++++++++
 files changed, 41 insertions(+), 2 deletions(-)
-Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20220121161141.14389-8-francisco.iglesias@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/arm/xlnx-versal.h | 20 ++++++++
  hw/arm/xlnx-versal.c         | 93 ++++++++++++++++++++++++++++++++++++
 files changed, 113 insertions(+)
 diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
+--- a/target/arm/tcg/helper-sve.h
-+++ b/include/hw/arm/xlnx-versal.h
++++ b/target/arm/tcg/helper-sve.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_rsqrts_s, TCG_CALL_NO_RWG,
- #include "hw/misc/xlnx-versal-xramc.h"
+ DEF_HELPER_FLAGS_5(gvec_rsqrts_d, TCG_CALL_NO_RWG,
- #include "hw/nvram/xlnx-bbram.h"
+                    void, ptr, ptr, ptr, fpst, i32)
- #include "hw/nvram/xlnx-versal-efuse.h"
-+#include "hw/ssi/xlnx-versal-ospi.h"
++DEF_HELPER_FLAGS_5(gvec_ah_fmax_h, TCG_CALL_NO_RWG,
-+#include "hw/dma/xlnx_csu_dma.h"
++                   void, ptr, ptr, ptr, fpst, i32)
- #include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
++DEF_HELPER_FLAGS_5(gvec_ah_fmax_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
- #define TYPE_XLNX_VERSAL "xlnx-versal"
++DEF_HELPER_FLAGS_5(gvec_ah_fmax_d, TCG_CALL_NO_RWG,
-@@ -XXX,XX +XXX,XX @@ struct Versal {
++                   void, ptr, ptr, ptr, fpst, i32)
          struct {
              SDHCIState sd[XLNX_VERSAL_NR_SDS];
              XlnxVersalPmcIouSlcr slcr;
 +
-+            struct {
++DEF_HELPER_FLAGS_5(gvec_ah_fmin_h, TCG_CALL_NO_RWG,
-+                XlnxVersalOspi ospi;
++                   void, ptr, ptr, ptr, fpst, i32)
-+                XlnxCSUDMA dma_src;
++DEF_HELPER_FLAGS_5(gvec_ah_fmin_s, TCG_CALL_NO_RWG,
-+                XlnxCSUDMA dma_dst;
++                   void, ptr, ptr, ptr, fpst, i32)
-+                MemoryRegion linear_mr;
++DEF_HELPER_FLAGS_5(gvec_ah_fmin_d, TCG_CALL_NO_RWG,
-+                qemu_or_irq irq_orgate;
++                   void, ptr, ptr, ptr, fpst, i32)
 +            } ospi;
          } iou;
          XlnxZynqMPRTC rtc;
@@ -XXX,XX +XXX,XX @@ struct Versal {
  #define VERSAL_ADMA_IRQ_0          60
  #define VERSAL_XRAM_IRQ_0          79
  #define VERSAL_PMC_APB_IRQ         121
 +#define VERSAL_OSPI_IRQ            124
  #define VERSAL_SD0_IRQ_0           126
  #define VERSAL_EFUSE_IRQ           139
  #define VERSAL_RTC_ALARM_IRQ       142
@@ -XXX,XX +XXX,XX @@ struct Versal {
  #define MM_PMC_PMC_IOU_SLCR         0xf1060000
  #define MM_PMC_PMC_IOU_SLCR_SIZE    0x10000
 +#define MM_PMC_OSPI                 0xf1010000
 +#define MM_PMC_OSPI_SIZE            0x10000
 +
-+#define MM_PMC_OSPI_DAC             0xc0000000
+ DEF_HELPER_FLAGS_4(sve_faddv_h, TCG_CALL_NO_RWG,
-+#define MM_PMC_OSPI_DAC_SIZE        0x20000000
+                    i64, ptr, ptr, fpst, i32)
-+
+ DEF_HELPER_FLAGS_4(sve_faddv_s, TCG_CALL_NO_RWG,
-+#define MM_PMC_OSPI_DMA_DST         0xf1011800
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 +#define MM_PMC_OSPI_DMA_SRC         0xf1011000
 +
  #define MM_PMC_SD0                  0xf1040000U
  #define MM_PMC_SD0_SIZE             0x10000
  #define MM_PMC_BBRAM_CTRL           0xf11f0000
 diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-versal.c
+--- a/target/arm/tcg/translate-a64.c
-+++ b/hw/arm/xlnx-versal.c
++++ b/target/arm/tcg/translate-a64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_vector(DisasContext *s, arg_qrrr_e *a, int data,
- #define GEM_REVISION        0x40070106
+                                        FPST_A64_F16 : FPST_A64);
  #define VERSAL_NUM_PMC_APB_IRQS 3
 +#define NUM_OSPI_IRQ_LINES 3
  static void versal_create_apu_cpus(Versal *s)
  {
@@ -XXX,XX +XXX,XX @@ static void versal_create_pmc_iou_slcr(Versal *s, qemu_irq *pic)
                         qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 2));
  }
-+static void versal_create_ospi(Versal *s, qemu_irq *pic)
++static bool do_fp3_vector_2fn(DisasContext *s, arg_qrrr_e *a, int data,
 +                              gen_helper_gvec_3_ptr * const fnormal[3],
 +                              gen_helper_gvec_3_ptr * const fah[3])
 +{
-+    SysBusDevice *sbd;
++    return do_fp3_vector(s, a, data, s->fpcr_ah ? fah : fnormal);
 +    MemoryRegion *mr_dac;
 +    qemu_irq ospi_mux_sel;
 +    DeviceState *orgate;
 +
 +    memory_region_init(&s->pmc.iou.ospi.linear_mr, OBJECT(s),
 +                       "versal-ospi-linear-mr" , MM_PMC_OSPI_DAC_SIZE);
 +
 +    object_initialize_child(OBJECT(s), "versal-ospi", &s->pmc.iou.ospi.ospi,
 +                            TYPE_XILINX_VERSAL_OSPI);
 +
 +    mr_dac = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->pmc.iou.ospi.ospi), 1);
 +    memory_region_add_subregion(&s->pmc.iou.ospi.linear_mr, 0x0, mr_dac);
 +
 +    /* Create the OSPI destination DMA */
 +    object_initialize_child(OBJECT(s), "versal-ospi-dma-dst",
 +                            &s->pmc.iou.ospi.dma_dst,
 +                            TYPE_XLNX_CSU_DMA);
 +
 +    object_property_set_link(OBJECT(&s->pmc.iou.ospi.dma_dst),
 +                            "dma", OBJECT(get_system_memory()),
 +                             &error_abort);
 +
 +    sbd = SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_dst);
 +    sysbus_realize(sbd, &error_fatal);
 +
 +    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI_DMA_DST,
 +                                sysbus_mmio_get_region(sbd, 0));
 +
 +    /* Create the OSPI source DMA */
 +    object_initialize_child(OBJECT(s), "versal-ospi-dma-src",
 +                            &s->pmc.iou.ospi.dma_src,
 +                            TYPE_XLNX_CSU_DMA);
 +
 +    object_property_set_bool(OBJECT(&s->pmc.iou.ospi.dma_src), "is-dst",
 +                             false, &error_abort);
 +
 +    object_property_set_link(OBJECT(&s->pmc.iou.ospi.dma_src),
 +                            "dma", OBJECT(mr_dac), &error_abort);
 +
 +    object_property_set_link(OBJECT(&s->pmc.iou.ospi.dma_src),
 +                            "stream-connected-dma",
 +                             OBJECT(&s->pmc.iou.ospi.dma_dst),
 +                             &error_abort);
 +
 +    sbd = SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_src);
 +    sysbus_realize(sbd, &error_fatal);
 +
 +    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI_DMA_SRC,
 +                                sysbus_mmio_get_region(sbd, 0));
 +
 +    /* Realize the OSPI */
 +    object_property_set_link(OBJECT(&s->pmc.iou.ospi.ospi), "dma-src",
 +                             OBJECT(&s->pmc.iou.ospi.dma_src), &error_abort);
 +
 +    sbd = SYS_BUS_DEVICE(&s->pmc.iou.ospi.ospi);
 +    sysbus_realize(sbd, &error_fatal);
 +
 +    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI,
 +                                sysbus_mmio_get_region(sbd, 0));
 +
 +    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI_DAC,
 +                                &s->pmc.iou.ospi.linear_mr);
 +
 +    /* ospi_mux_sel */
 +    ospi_mux_sel = qdev_get_gpio_in_named(DEVICE(&s->pmc.iou.ospi.ospi),
 +                                          "ospi-mux-sel", 0);
 +    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr), "ospi-mux-sel", 0,
 +                                ospi_mux_sel);
 +
 +    /* OSPI irq */
 +    object_initialize_child(OBJECT(s), "ospi-irq-orgate",
 +                            &s->pmc.iou.ospi.irq_orgate, TYPE_OR_IRQ);
 +    object_property_set_int(OBJECT(&s->pmc.iou.ospi.irq_orgate),
 +                            "num-lines", NUM_OSPI_IRQ_LINES, &error_fatal);
 +
 +    orgate = DEVICE(&s->pmc.iou.ospi.irq_orgate);
 +    qdev_realize(orgate, NULL, &error_fatal);
 +
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pmc.iou.ospi.ospi), 0,
 +                       qdev_get_gpio_in(orgate, 0));
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_src), 0,
 +                       qdev_get_gpio_in(orgate, 1));
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_dst), 0,
 +                       qdev_get_gpio_in(orgate, 2));
 +
 +    qdev_connect_gpio_out(orgate, 0, pic[VERSAL_OSPI_IRQ]);
 +}
 +
- /* This takes the board allocated linear DDR memory and creates aliases
+ static bool do_fp3_vector_ah(DisasContext *s, arg_qrrr_e *a, int data,
-  * for each split DDR range/aperture on the Versal address map.
+                              gen_helper_gvec_3_ptr * const f[3])
-  */
+ {
-@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const f_vector_fmax[3] = {
-     versal_create_bbram(s, pic);
+     gen_helper_gvec_fmax_s,
-     versal_create_efuse(s, pic);
+     gen_helper_gvec_fmax_d,
-     versal_create_pmc_iou_slcr(s, pic);
+ };
-+    versal_create_ospi(s, pic);
+-TRANS(FMAX_v, do_fp3_vector, a, 0, f_vector_fmax)
-     versal_map_ddr(s);
++static gen_helper_gvec_3_ptr * const f_vector_fmax_ah[3] = {
-     versal_unimp(s);
++    gen_helper_gvec_ah_fmax_h,
 +    gen_helper_gvec_ah_fmax_s,
 +    gen_helper_gvec_ah_fmax_d,
 +};
 +TRANS(FMAX_v, do_fp3_vector_2fn, a, 0, f_vector_fmax, f_vector_fmax_ah)
  static gen_helper_gvec_3_ptr * const f_vector_fmin[3] = {
      gen_helper_gvec_fmin_h,
      gen_helper_gvec_fmin_s,
      gen_helper_gvec_fmin_d,
  };
 -TRANS(FMIN_v, do_fp3_vector, a, 0, f_vector_fmin)
 +static gen_helper_gvec_3_ptr * const f_vector_fmin_ah[3] = {
 +    gen_helper_gvec_ah_fmin_h,
 +    gen_helper_gvec_ah_fmin_s,
 +    gen_helper_gvec_ah_fmin_d,
 +};
 +TRANS(FMIN_v, do_fp3_vector_2fn, a, 0, f_vector_fmin, f_vector_fmin_ah)
  static gen_helper_gvec_3_ptr * const f_vector_fmaxnm[3] = {
      gen_helper_gvec_fmaxnum_h,
 diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/vec_helper.c
 +++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ DO_3OP(gvec_rsqrts_h, helper_rsqrtsf_f16, float16)
  DO_3OP(gvec_rsqrts_s, helper_rsqrtsf_f32, float32)
  DO_3OP(gvec_rsqrts_d, helper_rsqrtsf_f64, float64)
 +DO_3OP(gvec_ah_fmax_h, helper_vfp_ah_maxh, float16)
 +DO_3OP(gvec_ah_fmax_s, helper_vfp_ah_maxs, float32)
 +DO_3OP(gvec_ah_fmax_d, helper_vfp_ah_maxd, float64)
 +
 +DO_3OP(gvec_ah_fmin_h, helper_vfp_ah_minh, float16)
 +DO_3OP(gvec_ah_fmin_s, helper_vfp_ah_mins, float32)
 +DO_3OP(gvec_ah_fmin_d, helper_vfp_ah_mind, float64)
 +
  #endif
  #undef DO_3OP
 --
-.25.1
+.34.1

-New patch
+[PULL 25/68] target/arm: Implement FPCR.AH semantics for FMAXV and FMINV
+Implement the FPCR.AH semantics for FMAXV and FMINV.  These are the
+"recursively reduce all lanes of a vector to a scalar result" insns;
+we just need to use the _ah_ helper for the reduction step when
+FPCR.AH == 1.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/translate-a64.c | 28 ++++++++++++++++++----------
+file changed, 18 insertions(+), 10 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static TCGv_i32 do_reduction_op(DisasContext *s, int rn, MemOp esz,
+ }
+ static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
+-                              NeonGenTwoSingleOpFn *fn)
++                            NeonGenTwoSingleOpFn *fnormal,
++                            NeonGenTwoSingleOpFn *fah)
+ {
+     if (fp_access_check(s)) {
+         MemOp esz = a->esz;
+         int elts = (a->q ? 16 : 8) >> esz;
+         TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+-        TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst, fn);
++        TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst,
++                                       s->fpcr_ah ? fah : fnormal);
+         write_fp_sreg(s, a->rd, res);
+     }
+     return true;
+ }
+-TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxnumh)
+-TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minnumh)
+-TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxh)
+-TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minh)
++TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a,
++           gen_helper_vfp_maxnumh, gen_helper_vfp_maxnumh)
++TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a,
++           gen_helper_vfp_minnumh, gen_helper_vfp_minnumh)
++TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a,
++           gen_helper_vfp_maxh, gen_helper_vfp_ah_maxh)
++TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a,
++           gen_helper_vfp_minh, gen_helper_vfp_ah_minh)
+-TRANS(FMAXNMV_s, do_fp_reduction, a, gen_helper_vfp_maxnums)
+-TRANS(FMINNMV_s, do_fp_reduction, a, gen_helper_vfp_minnums)
+-TRANS(FMAXV_s, do_fp_reduction, a, gen_helper_vfp_maxs)
+-TRANS(FMINV_s, do_fp_reduction, a, gen_helper_vfp_mins)
++TRANS(FMAXNMV_s, do_fp_reduction, a,
++      gen_helper_vfp_maxnums, gen_helper_vfp_maxnums)
++TRANS(FMINNMV_s, do_fp_reduction, a,
++      gen_helper_vfp_minnums, gen_helper_vfp_minnums)
++TRANS(FMAXV_s, do_fp_reduction, a, gen_helper_vfp_maxs, gen_helper_vfp_ah_maxs)
++TRANS(FMINV_s, do_fp_reduction, a, gen_helper_vfp_mins, gen_helper_vfp_ah_mins)
+ /*
+  * Floating-point Immediate
+--
+.34.1

-New patch
+[PULL 26/68] target/arm: Implement FPCR.AH semantics for FMINP and FMAXP
+Implement the FPCR.AH semantics for the pairwise floating
+point minimum/maximum insns FMINP and FMAXP.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/helper-sve.h    | 14 ++++++++++++++
+ target/arm/tcg/translate-a64.c | 25 +++++++++++++++++++++----
+ target/arm/tcg/vec_helper.c    | 10 ++++++++++
+files changed, 45 insertions(+), 4 deletions(-)
+diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-sve.h
++++ b/target/arm/tcg/helper-sve.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_ah_fmin_s, TCG_CALL_NO_RWG,
+ DEF_HELPER_FLAGS_5(gvec_ah_fmin_d, TCG_CALL_NO_RWG,
+                    void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_fmaxp_h, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_fmaxp_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_fmaxp_d, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++
++DEF_HELPER_FLAGS_5(gvec_ah_fminp_h, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_fminp_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_fminp_d, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++
+ DEF_HELPER_FLAGS_4(sve_faddv_h, TCG_CALL_NO_RWG,
+                    i64, ptr, ptr, fpst, i32)
+ DEF_HELPER_FLAGS_4(sve_faddv_s, TCG_CALL_NO_RWG,
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const f_vector_fmaxp[3] = {
+     gen_helper_gvec_fmaxp_s,
+     gen_helper_gvec_fmaxp_d,
+ };
+-TRANS(FMAXP_v, do_fp3_vector, a, 0, f_vector_fmaxp)
++static gen_helper_gvec_3_ptr * const f_vector_ah_fmaxp[3] = {
++    gen_helper_gvec_ah_fmaxp_h,
++    gen_helper_gvec_ah_fmaxp_s,
++    gen_helper_gvec_ah_fmaxp_d,
++};
++TRANS(FMAXP_v, do_fp3_vector_2fn, a, 0, f_vector_fmaxp, f_vector_ah_fmaxp)
+ static gen_helper_gvec_3_ptr * const f_vector_fminp[3] = {
+     gen_helper_gvec_fminp_h,
+     gen_helper_gvec_fminp_s,
+     gen_helper_gvec_fminp_d,
+ };
+-TRANS(FMINP_v, do_fp3_vector, a, 0, f_vector_fminp)
++static gen_helper_gvec_3_ptr * const f_vector_ah_fminp[3] = {
++    gen_helper_gvec_ah_fminp_h,
++    gen_helper_gvec_ah_fminp_s,
++    gen_helper_gvec_ah_fminp_d,
++};
++TRANS(FMINP_v, do_fp3_vector_2fn, a, 0, f_vector_fminp, f_vector_ah_fminp)
+ static gen_helper_gvec_3_ptr * const f_vector_fmaxnmp[3] = {
+     gen_helper_gvec_fmaxnump_h,
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_pair(DisasContext *s, arg_rr_e *a, const FPScalar *f)
+     return true;
+ }
++static bool do_fp3_scalar_pair_2fn(DisasContext *s, arg_rr_e *a,
++                                   const FPScalar *fnormal,
++                                   const FPScalar *fah)
++{
++    return do_fp3_scalar_pair(s, a, s->fpcr_ah ? fah : fnormal);
++}
++
+ TRANS(FADDP_s, do_fp3_scalar_pair, a, &f_scalar_fadd)
+-TRANS(FMAXP_s, do_fp3_scalar_pair, a, &f_scalar_fmax)
+-TRANS(FMINP_s, do_fp3_scalar_pair, a, &f_scalar_fmin)
++TRANS(FMAXP_s, do_fp3_scalar_pair_2fn, a, &f_scalar_fmax, &f_scalar_fmax_ah)
++TRANS(FMINP_s, do_fp3_scalar_pair_2fn, a, &f_scalar_fmin, &f_scalar_fmin_ah)
+ TRANS(FMAXNMP_s, do_fp3_scalar_pair, a, &f_scalar_fmaxnm)
+ TRANS(FMINNMP_s, do_fp3_scalar_pair, a, &f_scalar_fminnm)
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ DO_3OP_PAIR(gvec_fminnump_h, float16_minnum, float16, H2)
+ DO_3OP_PAIR(gvec_fminnump_s, float32_minnum, float32, H4)
+ DO_3OP_PAIR(gvec_fminnump_d, float64_minnum, float64, )
++#ifdef TARGET_AARCH64
++DO_3OP_PAIR(gvec_ah_fmaxp_h, helper_vfp_ah_maxh, float16, H2)
++DO_3OP_PAIR(gvec_ah_fmaxp_s, helper_vfp_ah_maxs, float32, H4)
++DO_3OP_PAIR(gvec_ah_fmaxp_d, helper_vfp_ah_maxd, float64, )
++
++DO_3OP_PAIR(gvec_ah_fminp_h, helper_vfp_ah_minh, float16, H2)
++DO_3OP_PAIR(gvec_ah_fminp_s, helper_vfp_ah_mins, float32, H4)
++DO_3OP_PAIR(gvec_ah_fminp_d, helper_vfp_ah_mind, float64, )
++#endif
++
+ #undef DO_3OP_PAIR
+ #define DO_3OP_PAIR(NAME, FUNC, TYPE, H) \
+--
+.34.1

-New patch
+[PULL 27/68] target/arm: Implement FPCR.AH semantics for SVE FMAXV and FMINV
+Implement the FPCR.AH semantics for the SVE FMAXV and FMINV
+vector-reduction-to-scalar max/min operations.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/helper-sve.h    | 14 +++++++++++
+ target/arm/tcg/sve_helper.c    | 43 +++++++++++++++++++++-------------
+ target/arm/tcg/translate-sve.c | 16 +++++++++++--
+files changed, 55 insertions(+), 18 deletions(-)
+diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-sve.h
++++ b/target/arm/tcg/helper-sve.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(sve_fminv_s, TCG_CALL_NO_RWG,
+ DEF_HELPER_FLAGS_4(sve_fminv_d, TCG_CALL_NO_RWG,
+                    i64, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_4(sve_ah_fmaxv_h, TCG_CALL_NO_RWG,
++                   i64, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_4(sve_ah_fmaxv_s, TCG_CALL_NO_RWG,
++                   i64, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_4(sve_ah_fmaxv_d, TCG_CALL_NO_RWG,
++                   i64, ptr, ptr, fpst, i32)
++
++DEF_HELPER_FLAGS_4(sve_ah_fminv_h, TCG_CALL_NO_RWG,
++                   i64, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_4(sve_ah_fminv_s, TCG_CALL_NO_RWG,
++                   i64, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_4(sve_ah_fminv_d, TCG_CALL_NO_RWG,
++                   i64, ptr, ptr, fpst, i32)
++
+ DEF_HELPER_FLAGS_5(sve_fadda_h, TCG_CALL_NO_RWG,
+                    i64, i64, ptr, ptr, fpst, i32)
+ DEF_HELPER_FLAGS_5(sve_fadda_s, TCG_CALL_NO_RWG,
+diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sve_helper.c
++++ b/target/arm/tcg/sve_helper.c
+@@ -XXX,XX +XXX,XX @@ static TYPE NAME##_reduce(TYPE *data, float_status *status, uintptr_t n) \
+         uintptr_t half = n / 2;                                       \
+         TYPE lo = NAME##_reduce(data, status, half);                  \
+         TYPE hi = NAME##_reduce(data + half, status, half);           \
+-        return TYPE##_##FUNC(lo, hi, status);                         \
++        return FUNC(lo, hi, status);                                  \
+     }                                                                 \
+ }                                                                     \
+ uint64_t HELPER(NAME)(void *vn, void *vg, float_status *s, uint32_t desc) \
+@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(NAME)(void *vn, void *vg, float_status *s, uint32_t desc) \
+     return NAME##_reduce(data, s, maxsz / sizeof(TYPE));              \
+ }
+-DO_REDUCE(sve_faddv_h, float16, H1_2, add, float16_zero)
+-DO_REDUCE(sve_faddv_s, float32, H1_4, add, float32_zero)
+-DO_REDUCE(sve_faddv_d, float64, H1_8, add, float64_zero)
++DO_REDUCE(sve_faddv_h, float16, H1_2, float16_add, float16_zero)
++DO_REDUCE(sve_faddv_s, float32, H1_4, float32_add, float32_zero)
++DO_REDUCE(sve_faddv_d, float64, H1_8, float64_add, float64_zero)
+ /* Identity is floatN_default_nan, without the function call.  */
+-DO_REDUCE(sve_fminnmv_h, float16, H1_2, minnum, 0x7E00)
+-DO_REDUCE(sve_fminnmv_s, float32, H1_4, minnum, 0x7FC00000)
+-DO_REDUCE(sve_fminnmv_d, float64, H1_8, minnum, 0x7FF8000000000000ULL)
++DO_REDUCE(sve_fminnmv_h, float16, H1_2, float16_minnum, 0x7E00)
++DO_REDUCE(sve_fminnmv_s, float32, H1_4, float32_minnum, 0x7FC00000)
++DO_REDUCE(sve_fminnmv_d, float64, H1_8, float64_minnum, 0x7FF8000000000000ULL)
+-DO_REDUCE(sve_fmaxnmv_h, float16, H1_2, maxnum, 0x7E00)
+-DO_REDUCE(sve_fmaxnmv_s, float32, H1_4, maxnum, 0x7FC00000)
+-DO_REDUCE(sve_fmaxnmv_d, float64, H1_8, maxnum, 0x7FF8000000000000ULL)
++DO_REDUCE(sve_fmaxnmv_h, float16, H1_2, float16_maxnum, 0x7E00)
++DO_REDUCE(sve_fmaxnmv_s, float32, H1_4, float32_maxnum, 0x7FC00000)
++DO_REDUCE(sve_fmaxnmv_d, float64, H1_8, float64_maxnum, 0x7FF8000000000000ULL)
+-DO_REDUCE(sve_fminv_h, float16, H1_2, min, float16_infinity)
+-DO_REDUCE(sve_fminv_s, float32, H1_4, min, float32_infinity)
+-DO_REDUCE(sve_fminv_d, float64, H1_8, min, float64_infinity)
++DO_REDUCE(sve_fminv_h, float16, H1_2, float16_min, float16_infinity)
++DO_REDUCE(sve_fminv_s, float32, H1_4, float32_min, float32_infinity)
++DO_REDUCE(sve_fminv_d, float64, H1_8, float64_min, float64_infinity)
+-DO_REDUCE(sve_fmaxv_h, float16, H1_2, max, float16_chs(float16_infinity))
+-DO_REDUCE(sve_fmaxv_s, float32, H1_4, max, float32_chs(float32_infinity))
+-DO_REDUCE(sve_fmaxv_d, float64, H1_8, max, float64_chs(float64_infinity))
++DO_REDUCE(sve_fmaxv_h, float16, H1_2, float16_max, float16_chs(float16_infinity))
++DO_REDUCE(sve_fmaxv_s, float32, H1_4, float32_max, float32_chs(float32_infinity))
++DO_REDUCE(sve_fmaxv_d, float64, H1_8, float64_max, float64_chs(float64_infinity))
++
++DO_REDUCE(sve_ah_fminv_h, float16, H1_2, helper_vfp_ah_minh, float16_infinity)
++DO_REDUCE(sve_ah_fminv_s, float32, H1_4, helper_vfp_ah_mins, float32_infinity)
++DO_REDUCE(sve_ah_fminv_d, float64, H1_8, helper_vfp_ah_mind, float64_infinity)
++
++DO_REDUCE(sve_ah_fmaxv_h, float16, H1_2, helper_vfp_ah_maxh,
++          float16_chs(float16_infinity))
++DO_REDUCE(sve_ah_fmaxv_s, float32, H1_4, helper_vfp_ah_maxs,
++          float32_chs(float32_infinity))
++DO_REDUCE(sve_ah_fmaxv_d, float64, H1_8, helper_vfp_ah_maxd,
++          float64_chs(float64_infinity))
+ #undef DO_REDUCE
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static bool do_reduce(DisasContext *s, arg_rpr_esz *a,
+     };                                                                   \
+     TRANS_FEAT(NAME, aa64_sve, do_reduce, a, name##_fns[a->esz])
++#define DO_VPZ_AH(NAME, name)                                            \
++    static gen_helper_fp_reduce * const name##_fns[4] = {                \
++        NULL,                      gen_helper_sve_##name##_h,            \
++        gen_helper_sve_##name##_s, gen_helper_sve_##name##_d,            \
++    };                                                                   \
++    static gen_helper_fp_reduce * const name##_ah_fns[4] = {             \
++        NULL,                      gen_helper_sve_ah_##name##_h,         \
++        gen_helper_sve_ah_##name##_s, gen_helper_sve_ah_##name##_d,      \
++    };                                                                   \
++    TRANS_FEAT(NAME, aa64_sve, do_reduce, a,                             \
++               s->fpcr_ah ? name##_ah_fns[a->esz] : name##_fns[a->esz])
++
+ DO_VPZ(FADDV, faddv)
+ DO_VPZ(FMINNMV, fminnmv)
+ DO_VPZ(FMAXNMV, fmaxnmv)
+-DO_VPZ(FMINV, fminv)
+-DO_VPZ(FMAXV, fmaxv)
++DO_VPZ_AH(FMINV, fminv)
++DO_VPZ_AH(FMAXV, fmaxv)
+ #undef DO_VPZ
+--
+.34.1

-New patch
+[PULL 28/68] target/arm: Implement FPCR.AH semantics for SVE FMIN/FMAX immediate
+Implement the FPCR.AH semantics for the SVE FMAX and FMIN operations
+that take an immediate as the second operand.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/helper-sve.h    | 14 ++++++++++++++
+ target/arm/tcg/sve_helper.c    |  8 ++++++++
+ target/arm/tcg/translate-sve.c | 25 +++++++++++++++++++++++--
+files changed, 45 insertions(+), 2 deletions(-)
+diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-sve.h
++++ b/target/arm/tcg/helper-sve.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_6(sve_fmins_s, TCG_CALL_NO_RWG,
+ DEF_HELPER_FLAGS_6(sve_fmins_d, TCG_CALL_NO_RWG,
+                    void, ptr, ptr, ptr, i64, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fmaxs_h, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, i64, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fmaxs_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, i64, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fmaxs_d, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, i64, fpst, i32)
++
++DEF_HELPER_FLAGS_6(sve_ah_fmins_h, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, i64, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fmins_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, i64, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fmins_d, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, i64, fpst, i32)
++
+ DEF_HELPER_FLAGS_5(sve_fcvt_sh, TCG_CALL_NO_RWG,
+                    void, ptr, ptr, ptr, fpst, i32)
+ DEF_HELPER_FLAGS_5(sve_fcvt_dh, TCG_CALL_NO_RWG,
+diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sve_helper.c
++++ b/target/arm/tcg/sve_helper.c
+@@ -XXX,XX +XXX,XX @@ DO_ZPZS_FP(sve_fmins_h, float16, H1_2, float16_min)
+ DO_ZPZS_FP(sve_fmins_s, float32, H1_4, float32_min)
+ DO_ZPZS_FP(sve_fmins_d, float64, H1_8, float64_min)
++DO_ZPZS_FP(sve_ah_fmaxs_h, float16, H1_2, helper_vfp_ah_maxh)
++DO_ZPZS_FP(sve_ah_fmaxs_s, float32, H1_4, helper_vfp_ah_maxs)
++DO_ZPZS_FP(sve_ah_fmaxs_d, float64, H1_8, helper_vfp_ah_maxd)
++
++DO_ZPZS_FP(sve_ah_fmins_h, float16, H1_2, helper_vfp_ah_minh)
++DO_ZPZS_FP(sve_ah_fmins_s, float32, H1_4, helper_vfp_ah_mins)
++DO_ZPZS_FP(sve_ah_fmins_d, float64, H1_8, helper_vfp_ah_mind)
++
+ /* Fully general two-operand expander, controlled by a predicate,
+  * With the extra float_status parameter.
+  */
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static bool do_fp_imm(DisasContext *s, arg_rpri_esz *a, uint64_t imm,
+     TRANS_FEAT(NAME##_zpzi, aa64_sve, do_fp_imm, a,                     \
+                name##_const[a->esz][a->imm], name##_fns[a->esz])
++#define DO_FP_AH_IMM(NAME, name, const0, const1)                        \
++    static gen_helper_sve_fp2scalar * const name##_fns[4] = {           \
++        NULL, gen_helper_sve_##name##_h,                                \
++        gen_helper_sve_##name##_s,                                      \
++        gen_helper_sve_##name##_d                                       \
++    };                                                                  \
++    static gen_helper_sve_fp2scalar * const name##_ah_fns[4] = {        \
++        NULL, gen_helper_sve_ah_##name##_h,                             \
++        gen_helper_sve_ah_##name##_s,                                   \
++        gen_helper_sve_ah_##name##_d                                    \
++    };                                                                  \
++    static uint64_t const name##_const[4][2] = {                        \
++        { -1, -1 },                                                     \
++        { float16_##const0, float16_##const1 },                         \
++        { float32_##const0, float32_##const1 },                         \
++        { float64_##const0, float64_##const1 },                         \
++    };                                                                  \
++    TRANS_FEAT(NAME##_zpzi, aa64_sve, do_fp_imm, a,                     \
++               name##_const[a->esz][a->imm],                            \
++               s->fpcr_ah ? name##_ah_fns[a->esz] : name##_fns[a->esz])
++
+ DO_FP_IMM(FADD, fadds, half, one)
+ DO_FP_IMM(FSUB, fsubs, half, one)
+ DO_FP_IMM(FMUL, fmuls, half, two)
+ DO_FP_IMM(FSUBR, fsubrs, half, one)
+ DO_FP_IMM(FMAXNM, fmaxnms, zero, one)
+ DO_FP_IMM(FMINNM, fminnms, zero, one)
+-DO_FP_IMM(FMAX, fmaxs, zero, one)
+-DO_FP_IMM(FMIN, fmins, zero, one)
++DO_FP_AH_IMM(FMAX, fmaxs, zero, one)
++DO_FP_AH_IMM(FMIN, fmins, zero, one)
+ #undef DO_FP_IMM
+--
+.34.1

-New patch
+[PULL 29/68] target/arm: Implement FPCR.AH semantics for SVE FMIN/FMAX vector
+Implement the FPCR.AH semantics for the SVE FMAX and FMIN
+operations that take two vector operands.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/helper-sve.h    | 14 ++++++++++++++
+ target/arm/tcg/sve_helper.c    |  8 ++++++++
+ target/arm/tcg/translate-sve.c | 17 +++++++++++++++--
+files changed, 37 insertions(+), 2 deletions(-)
+diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-sve.h
++++ b/target/arm/tcg/helper-sve.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_6(sve_fmax_s, TCG_CALL_NO_RWG,
+ DEF_HELPER_FLAGS_6(sve_fmax_d, TCG_CALL_NO_RWG,
+                    void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fmin_h, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fmin_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fmin_d, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++
++DEF_HELPER_FLAGS_6(sve_ah_fmax_h, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fmax_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fmax_d, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++
+ DEF_HELPER_FLAGS_6(sve_fminnum_h, TCG_CALL_NO_RWG,
+                    void, ptr, ptr, ptr, ptr, fpst, i32)
+ DEF_HELPER_FLAGS_6(sve_fminnum_s, TCG_CALL_NO_RWG,
+diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sve_helper.c
++++ b/target/arm/tcg/sve_helper.c
+@@ -XXX,XX +XXX,XX @@ DO_ZPZZ_FP(sve_fmax_h, uint16_t, H1_2, float16_max)
+ DO_ZPZZ_FP(sve_fmax_s, uint32_t, H1_4, float32_max)
+ DO_ZPZZ_FP(sve_fmax_d, uint64_t, H1_8, float64_max)
++DO_ZPZZ_FP(sve_ah_fmin_h, uint16_t, H1_2, helper_vfp_ah_minh)
++DO_ZPZZ_FP(sve_ah_fmin_s, uint32_t, H1_4, helper_vfp_ah_mins)
++DO_ZPZZ_FP(sve_ah_fmin_d, uint64_t, H1_8, helper_vfp_ah_mind)
++
++DO_ZPZZ_FP(sve_ah_fmax_h, uint16_t, H1_2, helper_vfp_ah_maxh)
++DO_ZPZZ_FP(sve_ah_fmax_s, uint32_t, H1_4, helper_vfp_ah_maxs)
++DO_ZPZZ_FP(sve_ah_fmax_d, uint64_t, H1_8, helper_vfp_ah_maxd)
++
+ DO_ZPZZ_FP(sve_fminnum_h, uint16_t, H1_2, float16_minnum)
+ DO_ZPZZ_FP(sve_fminnum_s, uint32_t, H1_4, float32_minnum)
+ DO_ZPZZ_FP(sve_fminnum_d, uint64_t, H1_8, float64_minnum)
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(FTSMUL, aa64_sve, gen_gvec_fpst_arg_zzz,
+     };                                                          \
+     TRANS_FEAT(NAME, FEAT, gen_gvec_fpst_arg_zpzz, name##_zpzz_fns[a->esz], a)
++#define DO_ZPZZ_AH_FP(NAME, FEAT, name, ah_name)                        \
++    static gen_helper_gvec_4_ptr * const name##_zpzz_fns[4] = {         \
++        NULL,                  gen_helper_##name##_h,                   \
++        gen_helper_##name##_s, gen_helper_##name##_d                    \
++    };                                                                  \
++    static gen_helper_gvec_4_ptr * const name##_ah_zpzz_fns[4] = {      \
++        NULL,                  gen_helper_##ah_name##_h,                \
++        gen_helper_##ah_name##_s, gen_helper_##ah_name##_d              \
++    };                                                                  \
++    TRANS_FEAT(NAME, FEAT, gen_gvec_fpst_arg_zpzz,                      \
++               s->fpcr_ah ? name##_ah_zpzz_fns[a->esz] :                \
++               name##_zpzz_fns[a->esz], a)
++
+ DO_ZPZZ_FP(FADD_zpzz, aa64_sve, sve_fadd)
+ DO_ZPZZ_FP(FSUB_zpzz, aa64_sve, sve_fsub)
+ DO_ZPZZ_FP(FMUL_zpzz, aa64_sve, sve_fmul)
+-DO_ZPZZ_FP(FMIN_zpzz, aa64_sve, sve_fmin)
+-DO_ZPZZ_FP(FMAX_zpzz, aa64_sve, sve_fmax)
++DO_ZPZZ_AH_FP(FMIN_zpzz, aa64_sve, sve_fmin, sve_ah_fmin)
++DO_ZPZZ_AH_FP(FMAX_zpzz, aa64_sve, sve_fmax, sve_ah_fmax)
+ DO_ZPZZ_FP(FMINNM_zpzz, aa64_sve, sve_fminnum)
+ DO_ZPZZ_FP(FMAXNM_zpzz, aa64_sve, sve_fmaxnum)
+ DO_ZPZZ_FP(FABD, aa64_sve, sve_fabd)
+--
+.34.1

-New patch
+[PULL 30/68] target/arm: Implement FPCR.AH handling of negation of NaN
+FPCR.AH == 1 mandates that negation of a NaN value should not flip
 its sign bit.  This means we can no longer use gen_vfp_neg*()
 everywhere but must instead generate slightly more complex code when
 FPCR.AH is set.
 Make this change for the scalar FNEG and for those places in
 translate-a64.c which were previously directly calling
 gen_vfp_neg*().
 This change in semantics also affects any other instruction whose
 pseudocode calls FPNeg(); in following commits we extend this
 change to the other affected instructions.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  target/arm/tcg/translate-a64.c | 125 ++++++++++++++++++++++++++++++---
 file changed, 114 insertions(+), 11 deletions(-)
 diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/translate-a64.c
 +++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
                         is_q ? 16 : 8, vec_full_reg_size(s), data, fn);
  }
 +/*
 + * When FPCR.AH == 1, NEG and ABS do not flip the sign bit of a NaN.
 + * These functions implement
 + *   d = floatN_is_any_nan(s) ? s : floatN_chs(s)
 + * which for float32 is
 + *   d = (s & ~(1 << 31)) > 0x7f800000UL) ? s : (s ^ (1 << 31))
 + * and similarly for the other float sizes.
 + */
 +static void gen_vfp_ah_negh(TCGv_i32 d, TCGv_i32 s)
 +{
 +    TCGv_i32 abs_s = tcg_temp_new_i32(), chs_s = tcg_temp_new_i32();
 +
 +    gen_vfp_negh(chs_s, s);
 +    gen_vfp_absh(abs_s, s);
 +    tcg_gen_movcond_i32(TCG_COND_GTU, d,
 +                        abs_s, tcg_constant_i32(0x7c00),
 +                        s, chs_s);
 +}
 +
 +static void gen_vfp_ah_negs(TCGv_i32 d, TCGv_i32 s)
 +{
 +    TCGv_i32 abs_s = tcg_temp_new_i32(), chs_s = tcg_temp_new_i32();
 +
 +    gen_vfp_negs(chs_s, s);
 +    gen_vfp_abss(abs_s, s);
 +    tcg_gen_movcond_i32(TCG_COND_GTU, d,
 +                        abs_s, tcg_constant_i32(0x7f800000UL),
 +                        s, chs_s);
 +}
 +
 +static void gen_vfp_ah_negd(TCGv_i64 d, TCGv_i64 s)
 +{
 +    TCGv_i64 abs_s = tcg_temp_new_i64(), chs_s = tcg_temp_new_i64();
 +
 +    gen_vfp_negd(chs_s, s);
 +    gen_vfp_absd(abs_s, s);
 +    tcg_gen_movcond_i64(TCG_COND_GTU, d,
 +                        abs_s, tcg_constant_i64(0x7ff0000000000000ULL),
 +                        s, chs_s);
 +}
 +
 +static void gen_vfp_maybe_ah_negh(DisasContext *dc, TCGv_i32 d, TCGv_i32 s)
 +{
 +    if (dc->fpcr_ah) {
 +        gen_vfp_ah_negh(d, s);
 +    } else {
 +        gen_vfp_negh(d, s);
 +    }
 +}
 +
 +static void gen_vfp_maybe_ah_negs(DisasContext *dc, TCGv_i32 d, TCGv_i32 s)
 +{
 +    if (dc->fpcr_ah) {
 +        gen_vfp_ah_negs(d, s);
 +    } else {
 +        gen_vfp_negs(d, s);
 +    }
 +}
 +
 +static void gen_vfp_maybe_ah_negd(DisasContext *dc, TCGv_i64 d, TCGv_i64 s)
 +{
 +    if (dc->fpcr_ah) {
 +        gen_vfp_ah_negd(d, s);
 +    } else {
 +        gen_vfp_negd(d, s);
 +    }
 +}
 +
  /* Set ZF and NF based on a 64 bit result. This is alas fiddlier
   * than the 32 bit equivalent.
   */
@@ -XXX,XX +XXX,XX @@ static void gen_fnmul_d(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m, TCGv_ptr s)
      gen_vfp_negd(d, d);
  }
 +static void gen_fnmul_ah_h(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
 +{
 +    gen_helper_vfp_mulh(d, n, m, s);
 +    gen_vfp_ah_negh(d, d);
 +}
 +
 +static void gen_fnmul_ah_s(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
 +{
 +    gen_helper_vfp_muls(d, n, m, s);
 +    gen_vfp_ah_negs(d, d);
 +}
 +
 +static void gen_fnmul_ah_d(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m, TCGv_ptr s)
 +{
 +    gen_helper_vfp_muld(d, n, m, s);
 +    gen_vfp_ah_negd(d, d);
 +}
 +
  static const FPScalar f_scalar_fnmul = {
      gen_fnmul_h,
      gen_fnmul_s,
      gen_fnmul_d,
  };
 -TRANS(FNMUL_s, do_fp3_scalar, a, &f_scalar_fnmul, a->rn)
 +static const FPScalar f_scalar_ah_fnmul = {
 +    gen_fnmul_ah_h,
 +    gen_fnmul_ah_s,
 +    gen_fnmul_ah_d,
 +};
 +TRANS(FNMUL_s, do_fp3_scalar_2fn, a, &f_scalar_fnmul, &f_scalar_ah_fnmul, a->rn)
  static const FPScalar f_scalar_fcmeq = {
      gen_helper_advsimd_ceq_f16,
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
              read_vec_element(s, t2, a->rm, a->idx, MO_64);
              if (neg) {
 -                gen_vfp_negd(t1, t1);
 +                gen_vfp_maybe_ah_negd(s, t1, t1);
              }
              gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
              write_fp_dreg_merging(s, a->rd, a->rd, t0);
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
              read_vec_element_i32(s, t2, a->rm, a->idx, MO_32);
              if (neg) {
 -                gen_vfp_negs(t1, t1);
 +                gen_vfp_maybe_ah_negs(s, t1, t1);
              }
              gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
              write_fp_sreg_merging(s, a->rd, a->rd, t0);
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
              read_vec_element_i32(s, t2, a->rm, a->idx, MO_16);
              if (neg) {
 -                gen_vfp_negh(t1, t1);
 +                gen_vfp_maybe_ah_negh(s, t1, t1);
              }
              gen_helper_advsimd_muladdh(t0, t1, t2, t0,
                                         fpstatus_ptr(FPST_A64_F16));
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
              TCGv_i64 ta = read_fp_dreg(s, a->ra);
              if (neg_a) {
 -                gen_vfp_negd(ta, ta);
 +                gen_vfp_maybe_ah_negd(s, ta, ta);
              }
              if (neg_n) {
 -                gen_vfp_negd(tn, tn);
 +                gen_vfp_maybe_ah_negd(s, tn, tn);
              }
              fpst = fpstatus_ptr(FPST_A64);
              gen_helper_vfp_muladdd(ta, tn, tm, ta, fpst);
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
              TCGv_i32 ta = read_fp_sreg(s, a->ra);
              if (neg_a) {
 -                gen_vfp_negs(ta, ta);
 +                gen_vfp_maybe_ah_negs(s, ta, ta);
              }
              if (neg_n) {
 -                gen_vfp_negs(tn, tn);
 +                gen_vfp_maybe_ah_negs(s, tn, tn);
              }
              fpst = fpstatus_ptr(FPST_A64);
              gen_helper_vfp_muladds(ta, tn, tm, ta, fpst);
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
              TCGv_i32 ta = read_fp_hreg(s, a->ra);
              if (neg_a) {
 -                gen_vfp_negh(ta, ta);
 +                gen_vfp_maybe_ah_negh(s, ta, ta);
              }
              if (neg_n) {
 -                gen_vfp_negh(tn, tn);
 +                gen_vfp_maybe_ah_negh(s, tn, tn);
              }
              fpst = fpstatus_ptr(FPST_A64_F16);
              gen_helper_advsimd_muladdh(ta, tn, tm, ta, fpst);
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar_int(DisasContext *s, arg_rr_e *a,
      return true;
  }
 +static bool do_fp1_scalar_int_2fn(DisasContext *s, arg_rr_e *a,
 +                                  const FPScalar1Int *fnormal,
 +                                  const FPScalar1Int *fah)
 +{
 +    return do_fp1_scalar_int(s, a, s->fpcr_ah ? fah : fnormal, true);
 +}
 +
  static const FPScalar1Int f_scalar_fmov = {
      tcg_gen_mov_i32,
      tcg_gen_mov_i32,
@@ -XXX,XX +XXX,XX @@ static const FPScalar1Int f_scalar_fneg = {
      gen_vfp_negs,
      gen_vfp_negd,
  };
 -TRANS(FNEG_s, do_fp1_scalar_int, a, &f_scalar_fneg, true)
 +static const FPScalar1Int f_scalar_ah_fneg = {
 +    gen_vfp_ah_negh,
 +    gen_vfp_ah_negs,
 +    gen_vfp_ah_negd,
 +};
 +TRANS(FNEG_s, do_fp1_scalar_int_2fn, a, &f_scalar_fneg, &f_scalar_ah_fneg)
  typedef struct FPScalar1 {
      void (*gen_h)(TCGv_i32, TCGv_i32, TCGv_ptr);
 --
 .34.1

-[PULL 05/32] hw/misc: Add a model of Versal's PMC SLCR
+[PULL 31/68] target/arm: Implement FPCR.AH handling for scalar FABS and FABD
-From: Francisco Iglesias <francisco.iglesias@xilinx.com>
+FPCR.AH == 1 mandates that taking the absolute value of a NaN should
 not change its sign bit.  This means we can no longer use
 gen_vfp_abs*() everywhere but must instead generate slightly more
 complex code when FPCR.AH is set.
-Add a model of Versal's PMC SLCR (system-level control registers).
+Implement these semantics for scalar FABS and FABD.  This change also
 affects all other instructions whose psuedocode calls FPAbs(); we
 will extend the change to those instructions in following commits.
-Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Luc Michel <luc@lmichel.fr>
-Message-id: 20220121161141.14389-2-francisco.iglesias@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/hw/misc/xlnx-versal-pmc-iou-slcr.h |   78 ++
+ target/arm/tcg/translate-a64.c | 69 +++++++++++++++++++++++++++++++++-
- hw/misc/xlnx-versal-pmc-iou-slcr.c         | 1446 ++++++++++++++++++++
+file changed, 67 insertions(+), 2 deletions(-)
  hw/misc/meson.build                        |    5 +-
 files changed, 1528 insertions(+), 1 deletion(-)
  create mode 100644 include/hw/misc/xlnx-versal-pmc-iou-slcr.h
  create mode 100644 hw/misc/xlnx-versal-pmc-iou-slcr.c
-diff --git a/include/hw/misc/xlnx-versal-pmc-iou-slcr.h b/include/hw/misc/xlnx-versal-pmc-iou-slcr.h
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/target/arm/tcg/translate-a64.c
---- /dev/null
++++ b/target/arm/tcg/translate-a64.c
-+++ b/include/hw/misc/xlnx-versal-pmc-iou-slcr.h
+@@ -XXX,XX +XXX,XX @@ static void gen_vfp_ah_negd(TCGv_i64 d, TCGv_i64 s)
-@@ -XXX,XX +XXX,XX @@
+                         s, chs_s);
  }
 +/*
-+ * Header file for the Xilinx Versal's PMC IOU SLCR
++ * These functions implement
-+ *
++ *  d = floatN_is_any_nan(s) ? s : floatN_abs(s)
-+ * Copyright (C) 2021 Xilinx Inc
++ * which for float32 is
-+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
++ *  d = (s & ~(1 << 31)) > 0x7f800000UL) ? s : (s & ~(1 << 31))
-+ *
++ * and similarly for the other float sizes.
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
++static void gen_vfp_ah_absh(TCGv_i32 d, TCGv_i32 s)
++{
++    TCGv_i32 abs_s = tcg_temp_new_i32();
 +
-+/*
++    gen_vfp_absh(abs_s, s);
-+ * This is a model of Xilinx Versal's PMC I/O Peripheral Control and Status
++    tcg_gen_movcond_i32(TCG_COND_GTU, d,
-+ * module documented in Versal's Technical Reference manual [1] and the Versal
++                        abs_s, tcg_constant_i32(0x7c00),
-+ * ACAP Register reference [2].
++                        s, abs_s);
 + *
 + * References:
 + *
 + * [1] Versal ACAP Technical Reference Manual,
 + *     https://www.xilinx.com/support/documentation/architecture-manuals/am011-versal-acap-trm.pdf
 + *
 + * [2] Versal ACAP Register Reference,
 + *     https://www.xilinx.com/html_docs/registers/am012/am012-versal-register-reference.html#mod___pmc_iop_slcr.html
 + *
 + * QEMU interface:
 + * + sysbus MMIO region 0: MemoryRegion for the device's registers
 + * + sysbus IRQ 0: PMC (AXI and APB) parity error interrupt detected by the PMC
 + *   I/O peripherals.
 + * + sysbus IRQ 1: Device interrupt.
 + * + Named GPIO output "sd-emmc-sel[0]": Enables 0: SD mode or 1: eMMC mode on
 + *   SD/eMMC controller 0.
 + * + Named GPIO output "sd-emmc-sel[1]": Enables 0: SD mode or 1: eMMC mode on
 + *   SD/eMMC controller 1.
 + * + Named GPIO output "qspi-ospi-mux-sel": Selects 0: QSPI linear region or 1:
 + *   OSPI linear region.
 + * + Named GPIO output "ospi-mux-sel": Selects 0: OSPI Indirect access mode or
 + *   1: OSPI direct access mode.
 + */
 +
 +#ifndef XILINX_VERSAL_PMC_IOU_SLCR_H
 +#define XILINX_VERSAL_PMC_IOU_SLCR_H
 +
 +#include "hw/register.h"
 +
 +#define TYPE_XILINX_VERSAL_PMC_IOU_SLCR "xlnx.versal-pmc-iou-slcr"
 +
 +OBJECT_DECLARE_SIMPLE_TYPE(XlnxVersalPmcIouSlcr, XILINX_VERSAL_PMC_IOU_SLCR)
 +
 +#define XILINX_VERSAL_PMC_IOU_SLCR_R_MAX (0x828 / 4 + 1)
 +
 +struct XlnxVersalPmcIouSlcr {
 +    SysBusDevice parent_obj;
 +    MemoryRegion iomem;
 +    qemu_irq irq_parity_imr;
 +    qemu_irq irq_imr;
 +    qemu_irq sd_emmc_sel[2];
 +    qemu_irq qspi_ospi_mux_sel;
 +    qemu_irq ospi_mux_sel;
 +
 +    uint32_t regs[XILINX_VERSAL_PMC_IOU_SLCR_R_MAX];
 +    RegisterInfo regs_info[XILINX_VERSAL_PMC_IOU_SLCR_R_MAX];
 +};
 +
 +#endif /* XILINX_VERSAL_PMC_IOU_SLCR_H */
 diff --git a/hw/misc/xlnx-versal-pmc-iou-slcr.c b/hw/misc/xlnx-versal-pmc-iou-slcr.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/misc/xlnx-versal-pmc-iou-slcr.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU model of Versal's PMC IOU SLCR (system level control registers)
 + *
 + * Copyright (c) 2021 Xilinx Inc.
 + * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "hw/sysbus.h"
 +#include "hw/register.h"
 +#include "hw/irq.h"
 +#include "qemu/bitops.h"
 +#include "qemu/log.h"
 +#include "migration/vmstate.h"
 +#include "hw/qdev-properties.h"
 +#include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
 +
 +#ifndef XILINX_VERSAL_PMC_IOU_SLCR_ERR_DEBUG
 +#define XILINX_VERSAL_PMC_IOU_SLCR_ERR_DEBUG 0
 +#endif
 +
 +REG32(MIO_PIN_0, 0x0)
 +    FIELD(MIO_PIN_0, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_0, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_0, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_0, L0_SEL, 1, 2)
 +REG32(MIO_PIN_1, 0x4)
 +    FIELD(MIO_PIN_1, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_1, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_1, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_1, L0_SEL, 1, 2)
 +REG32(MIO_PIN_2, 0x8)
 +    FIELD(MIO_PIN_2, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_2, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_2, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_2, L0_SEL, 1, 2)
 +REG32(MIO_PIN_3, 0xc)
 +    FIELD(MIO_PIN_3, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_3, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_3, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_3, L0_SEL, 1, 2)
 +REG32(MIO_PIN_4, 0x10)
 +    FIELD(MIO_PIN_4, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_4, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_4, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_4, L0_SEL, 1, 2)
 +REG32(MIO_PIN_5, 0x14)
 +    FIELD(MIO_PIN_5, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_5, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_5, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_5, L0_SEL, 1, 2)
 +REG32(MIO_PIN_6, 0x18)
 +    FIELD(MIO_PIN_6, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_6, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_6, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_6, L0_SEL, 1, 2)
 +REG32(MIO_PIN_7, 0x1c)
 +    FIELD(MIO_PIN_7, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_7, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_7, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_7, L0_SEL, 1, 2)
 +REG32(MIO_PIN_8, 0x20)
 +    FIELD(MIO_PIN_8, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_8, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_8, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_8, L0_SEL, 1, 2)
 +REG32(MIO_PIN_9, 0x24)
 +    FIELD(MIO_PIN_9, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_9, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_9, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_9, L0_SEL, 1, 2)
 +REG32(MIO_PIN_10, 0x28)
 +    FIELD(MIO_PIN_10, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_10, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_10, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_10, L0_SEL, 1, 2)
 +REG32(MIO_PIN_11, 0x2c)
 +    FIELD(MIO_PIN_11, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_11, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_11, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_11, L0_SEL, 1, 2)
 +REG32(MIO_PIN_12, 0x30)
 +    FIELD(MIO_PIN_12, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_12, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_12, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_12, L0_SEL, 1, 2)
 +REG32(MIO_PIN_13, 0x34)
 +    FIELD(MIO_PIN_13, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_13, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_13, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_13, L0_SEL, 1, 2)
 +REG32(MIO_PIN_14, 0x38)
 +    FIELD(MIO_PIN_14, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_14, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_14, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_14, L0_SEL, 1, 2)
 +REG32(MIO_PIN_15, 0x3c)
 +    FIELD(MIO_PIN_15, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_15, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_15, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_15, L0_SEL, 1, 2)
 +REG32(MIO_PIN_16, 0x40)
 +    FIELD(MIO_PIN_16, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_16, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_16, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_16, L0_SEL, 1, 2)
 +REG32(MIO_PIN_17, 0x44)
 +    FIELD(MIO_PIN_17, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_17, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_17, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_17, L0_SEL, 1, 2)
 +REG32(MIO_PIN_18, 0x48)
 +    FIELD(MIO_PIN_18, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_18, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_18, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_18, L0_SEL, 1, 2)
 +REG32(MIO_PIN_19, 0x4c)
 +    FIELD(MIO_PIN_19, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_19, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_19, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_19, L0_SEL, 1, 2)
 +REG32(MIO_PIN_20, 0x50)
 +    FIELD(MIO_PIN_20, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_20, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_20, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_20, L0_SEL, 1, 2)
 +REG32(MIO_PIN_21, 0x54)
 +    FIELD(MIO_PIN_21, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_21, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_21, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_21, L0_SEL, 1, 2)
 +REG32(MIO_PIN_22, 0x58)
 +    FIELD(MIO_PIN_22, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_22, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_22, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_22, L0_SEL, 1, 2)
 +REG32(MIO_PIN_23, 0x5c)
 +    FIELD(MIO_PIN_23, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_23, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_23, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_23, L0_SEL, 1, 2)
 +REG32(MIO_PIN_24, 0x60)
 +    FIELD(MIO_PIN_24, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_24, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_24, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_24, L0_SEL, 1, 2)
 +REG32(MIO_PIN_25, 0x64)
 +    FIELD(MIO_PIN_25, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_25, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_25, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_25, L0_SEL, 1, 2)
 +REG32(MIO_PIN_26, 0x68)
 +    FIELD(MIO_PIN_26, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_26, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_26, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_26, L0_SEL, 1, 2)
 +REG32(MIO_PIN_27, 0x6c)
 +    FIELD(MIO_PIN_27, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_27, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_27, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_27, L0_SEL, 1, 2)
 +REG32(MIO_PIN_28, 0x70)
 +    FIELD(MIO_PIN_28, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_28, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_28, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_28, L0_SEL, 1, 2)
 +REG32(MIO_PIN_29, 0x74)
 +    FIELD(MIO_PIN_29, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_29, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_29, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_29, L0_SEL, 1, 2)
 +REG32(MIO_PIN_30, 0x78)
 +    FIELD(MIO_PIN_30, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_30, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_30, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_30, L0_SEL, 1, 2)
 +REG32(MIO_PIN_31, 0x7c)
 +    FIELD(MIO_PIN_31, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_31, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_31, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_31, L0_SEL, 1, 2)
 +REG32(MIO_PIN_32, 0x80)
 +    FIELD(MIO_PIN_32, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_32, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_32, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_32, L0_SEL, 1, 2)
 +REG32(MIO_PIN_33, 0x84)
 +    FIELD(MIO_PIN_33, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_33, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_33, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_33, L0_SEL, 1, 2)
 +REG32(MIO_PIN_34, 0x88)
 +    FIELD(MIO_PIN_34, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_34, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_34, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_34, L0_SEL, 1, 2)
 +REG32(MIO_PIN_35, 0x8c)
 +    FIELD(MIO_PIN_35, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_35, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_35, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_35, L0_SEL, 1, 2)
 +REG32(MIO_PIN_36, 0x90)
 +    FIELD(MIO_PIN_36, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_36, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_36, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_36, L0_SEL, 1, 2)
 +REG32(MIO_PIN_37, 0x94)
 +    FIELD(MIO_PIN_37, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_37, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_37, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_37, L0_SEL, 1, 2)
 +REG32(MIO_PIN_38, 0x98)
 +    FIELD(MIO_PIN_38, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_38, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_38, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_38, L0_SEL, 1, 2)
 +REG32(MIO_PIN_39, 0x9c)
 +    FIELD(MIO_PIN_39, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_39, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_39, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_39, L0_SEL, 1, 2)
 +REG32(MIO_PIN_40, 0xa0)
 +    FIELD(MIO_PIN_40, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_40, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_40, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_40, L0_SEL, 1, 2)
 +REG32(MIO_PIN_41, 0xa4)
 +    FIELD(MIO_PIN_41, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_41, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_41, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_41, L0_SEL, 1, 2)
 +REG32(MIO_PIN_42, 0xa8)
 +    FIELD(MIO_PIN_42, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_42, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_42, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_42, L0_SEL, 1, 2)
 +REG32(MIO_PIN_43, 0xac)
 +    FIELD(MIO_PIN_43, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_43, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_43, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_43, L0_SEL, 1, 2)
 +REG32(MIO_PIN_44, 0xb0)
 +    FIELD(MIO_PIN_44, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_44, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_44, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_44, L0_SEL, 1, 2)
 +REG32(MIO_PIN_45, 0xb4)
 +    FIELD(MIO_PIN_45, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_45, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_45, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_45, L0_SEL, 1, 2)
 +REG32(MIO_PIN_46, 0xb8)
 +    FIELD(MIO_PIN_46, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_46, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_46, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_46, L0_SEL, 1, 2)
 +REG32(MIO_PIN_47, 0xbc)
 +    FIELD(MIO_PIN_47, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_47, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_47, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_47, L0_SEL, 1, 2)
 +REG32(MIO_PIN_48, 0xc0)
 +    FIELD(MIO_PIN_48, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_48, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_48, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_48, L0_SEL, 1, 2)
 +REG32(MIO_PIN_49, 0xc4)
 +    FIELD(MIO_PIN_49, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_49, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_49, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_49, L0_SEL, 1, 2)
 +REG32(MIO_PIN_50, 0xc8)
 +    FIELD(MIO_PIN_50, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_50, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_50, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_50, L0_SEL, 1, 2)
 +REG32(MIO_PIN_51, 0xcc)
 +    FIELD(MIO_PIN_51, L3_SEL, 7, 3)
 +    FIELD(MIO_PIN_51, L2_SEL, 5, 2)
 +    FIELD(MIO_PIN_51, L1_SEL, 3, 2)
 +    FIELD(MIO_PIN_51, L0_SEL, 1, 2)
 +REG32(BNK0_EN_RX, 0x100)
 +    FIELD(BNK0_EN_RX, BNK0_EN_RX, 0, 26)
 +REG32(BNK0_SEL_RX0, 0x104)
 +REG32(BNK0_SEL_RX1, 0x108)
 +    FIELD(BNK0_SEL_RX1, BNK0_SEL_RX, 0, 20)
 +REG32(BNK0_EN_RX_SCHMITT_HYST, 0x10c)
 +    FIELD(BNK0_EN_RX_SCHMITT_HYST, BNK0_EN_RX_SCHMITT_HYST, 0, 26)
 +REG32(BNK0_EN_WK_PD, 0x110)
 +    FIELD(BNK0_EN_WK_PD, BNK0_EN_WK_PD, 0, 26)
 +REG32(BNK0_EN_WK_PU, 0x114)
 +    FIELD(BNK0_EN_WK_PU, BNK0_EN_WK_PU, 0, 26)
 +REG32(BNK0_SEL_DRV0, 0x118)
 +REG32(BNK0_SEL_DRV1, 0x11c)
 +    FIELD(BNK0_SEL_DRV1, BNK0_SEL_DRV, 0, 20)
 +REG32(BNK0_SEL_SLEW, 0x120)
 +    FIELD(BNK0_SEL_SLEW, BNK0_SEL_SLEW, 0, 26)
 +REG32(BNK0_EN_DFT_OPT_INV, 0x124)
 +    FIELD(BNK0_EN_DFT_OPT_INV, BNK0_EN_DFT_OPT_INV, 0, 26)
 +REG32(BNK0_EN_PAD2PAD_LOOPBACK, 0x128)
 +    FIELD(BNK0_EN_PAD2PAD_LOOPBACK, BNK0_EN_PAD2PAD_LOOPBACK, 0, 13)
 +REG32(BNK0_RX_SPARE0, 0x12c)
 +REG32(BNK0_RX_SPARE1, 0x130)
 +    FIELD(BNK0_RX_SPARE1, BNK0_RX_SPARE, 0, 20)
 +REG32(BNK0_TX_SPARE0, 0x134)
 +REG32(BNK0_TX_SPARE1, 0x138)
 +    FIELD(BNK0_TX_SPARE1, BNK0_TX_SPARE, 0, 20)
 +REG32(BNK0_SEL_EN1P8, 0x13c)
 +    FIELD(BNK0_SEL_EN1P8, BNK0_SEL_EN1P8, 0, 1)
 +REG32(BNK0_EN_B_POR_DETECT, 0x140)
 +    FIELD(BNK0_EN_B_POR_DETECT, BNK0_EN_B_POR_DETECT, 0, 1)
 +REG32(BNK0_LPF_BYP_POR_DETECT, 0x144)
 +    FIELD(BNK0_LPF_BYP_POR_DETECT, BNK0_LPF_BYP_POR_DETECT, 0, 1)
 +REG32(BNK0_EN_LATCH, 0x148)
 +    FIELD(BNK0_EN_LATCH, BNK0_EN_LATCH, 0, 1)
 +REG32(BNK0_VBG_LPF_BYP_B, 0x14c)
 +    FIELD(BNK0_VBG_LPF_BYP_B, BNK0_VBG_LPF_BYP_B, 0, 1)
 +REG32(BNK0_EN_AMP_B, 0x150)
 +    FIELD(BNK0_EN_AMP_B, BNK0_EN_AMP_B, 0, 2)
 +REG32(BNK0_SPARE_BIAS, 0x154)
 +    FIELD(BNK0_SPARE_BIAS, BNK0_SPARE_BIAS, 0, 4)
 +REG32(BNK0_DRIVER_BIAS, 0x158)
 +    FIELD(BNK0_DRIVER_BIAS, BNK0_DRIVER_BIAS, 0, 15)
 +REG32(BNK0_VMODE, 0x15c)
 +    FIELD(BNK0_VMODE, BNK0_VMODE, 0, 1)
 +REG32(BNK0_SEL_AUX_IO_RX, 0x160)
 +    FIELD(BNK0_SEL_AUX_IO_RX, BNK0_SEL_AUX_IO_RX, 0, 26)
 +REG32(BNK0_EN_TX_HS_MODE, 0x164)
 +    FIELD(BNK0_EN_TX_HS_MODE, BNK0_EN_TX_HS_MODE, 0, 26)
 +REG32(MIO_MST_TRI0, 0x200)
 +    FIELD(MIO_MST_TRI0, PIN_25_TRI, 25, 1)
 +    FIELD(MIO_MST_TRI0, PIN_24_TRI, 24, 1)
 +    FIELD(MIO_MST_TRI0, PIN_23_TRI, 23, 1)
 +    FIELD(MIO_MST_TRI0, PIN_22_TRI, 22, 1)
 +    FIELD(MIO_MST_TRI0, PIN_21_TRI, 21, 1)
 +    FIELD(MIO_MST_TRI0, PIN_20_TRI, 20, 1)
 +    FIELD(MIO_MST_TRI0, PIN_19_TRI, 19, 1)
 +    FIELD(MIO_MST_TRI0, PIN_18_TRI, 18, 1)
 +    FIELD(MIO_MST_TRI0, PIN_17_TRI, 17, 1)
 +    FIELD(MIO_MST_TRI0, PIN_16_TRI, 16, 1)
 +    FIELD(MIO_MST_TRI0, PIN_15_TRI, 15, 1)
 +    FIELD(MIO_MST_TRI0, PIN_14_TRI, 14, 1)
 +    FIELD(MIO_MST_TRI0, PIN_13_TRI, 13, 1)
 +    FIELD(MIO_MST_TRI0, PIN_12_TRI, 12, 1)
 +    FIELD(MIO_MST_TRI0, PIN_11_TRI, 11, 1)
 +    FIELD(MIO_MST_TRI0, PIN_10_TRI, 10, 1)
 +    FIELD(MIO_MST_TRI0, PIN_09_TRI, 9, 1)
 +    FIELD(MIO_MST_TRI0, PIN_08_TRI, 8, 1)
 +    FIELD(MIO_MST_TRI0, PIN_07_TRI, 7, 1)
 +    FIELD(MIO_MST_TRI0, PIN_06_TRI, 6, 1)
 +    FIELD(MIO_MST_TRI0, PIN_05_TRI, 5, 1)
 +    FIELD(MIO_MST_TRI0, PIN_04_TRI, 4, 1)
 +    FIELD(MIO_MST_TRI0, PIN_03_TRI, 3, 1)
 +    FIELD(MIO_MST_TRI0, PIN_02_TRI, 2, 1)
 +    FIELD(MIO_MST_TRI0, PIN_01_TRI, 1, 1)
 +    FIELD(MIO_MST_TRI0, PIN_00_TRI, 0, 1)
 +REG32(MIO_MST_TRI1, 0x204)
 +    FIELD(MIO_MST_TRI1, PIN_51_TRI, 25, 1)
 +    FIELD(MIO_MST_TRI1, PIN_50_TRI, 24, 1)
 +    FIELD(MIO_MST_TRI1, PIN_49_TRI, 23, 1)
 +    FIELD(MIO_MST_TRI1, PIN_48_TRI, 22, 1)
 +    FIELD(MIO_MST_TRI1, PIN_47_TRI, 21, 1)
 +    FIELD(MIO_MST_TRI1, PIN_46_TRI, 20, 1)
 +    FIELD(MIO_MST_TRI1, PIN_45_TRI, 19, 1)
 +    FIELD(MIO_MST_TRI1, PIN_44_TRI, 18, 1)
 +    FIELD(MIO_MST_TRI1, PIN_43_TRI, 17, 1)
 +    FIELD(MIO_MST_TRI1, PIN_42_TRI, 16, 1)
 +    FIELD(MIO_MST_TRI1, PIN_41_TRI, 15, 1)
 +    FIELD(MIO_MST_TRI1, PIN_40_TRI, 14, 1)
 +    FIELD(MIO_MST_TRI1, PIN_39_TRI, 13, 1)
 +    FIELD(MIO_MST_TRI1, PIN_38_TRI, 12, 1)
 +    FIELD(MIO_MST_TRI1, PIN_37_TRI, 11, 1)
 +    FIELD(MIO_MST_TRI1, PIN_36_TRI, 10, 1)
 +    FIELD(MIO_MST_TRI1, PIN_35_TRI, 9, 1)
 +    FIELD(MIO_MST_TRI1, PIN_34_TRI, 8, 1)
 +    FIELD(MIO_MST_TRI1, PIN_33_TRI, 7, 1)
 +    FIELD(MIO_MST_TRI1, PIN_32_TRI, 6, 1)
 +    FIELD(MIO_MST_TRI1, PIN_31_TRI, 5, 1)
 +    FIELD(MIO_MST_TRI1, PIN_30_TRI, 4, 1)
 +    FIELD(MIO_MST_TRI1, PIN_29_TRI, 3, 1)
 +    FIELD(MIO_MST_TRI1, PIN_28_TRI, 2, 1)
 +    FIELD(MIO_MST_TRI1, PIN_27_TRI, 1, 1)
 +    FIELD(MIO_MST_TRI1, PIN_26_TRI, 0, 1)
 +REG32(BNK1_EN_RX, 0x300)
 +    FIELD(BNK1_EN_RX, BNK1_EN_RX, 0, 26)
 +REG32(BNK1_SEL_RX0, 0x304)
 +REG32(BNK1_SEL_RX1, 0x308)
 +    FIELD(BNK1_SEL_RX1, BNK1_SEL_RX, 0, 20)
 +REG32(BNK1_EN_RX_SCHMITT_HYST, 0x30c)
 +    FIELD(BNK1_EN_RX_SCHMITT_HYST, BNK1_EN_RX_SCHMITT_HYST, 0, 26)
 +REG32(BNK1_EN_WK_PD, 0x310)
 +    FIELD(BNK1_EN_WK_PD, BNK1_EN_WK_PD, 0, 26)
 +REG32(BNK1_EN_WK_PU, 0x314)
 +    FIELD(BNK1_EN_WK_PU, BNK1_EN_WK_PU, 0, 26)
 +REG32(BNK1_SEL_DRV0, 0x318)
 +REG32(BNK1_SEL_DRV1, 0x31c)
 +    FIELD(BNK1_SEL_DRV1, BNK1_SEL_DRV, 0, 20)
 +REG32(BNK1_SEL_SLEW, 0x320)
 +    FIELD(BNK1_SEL_SLEW, BNK1_SEL_SLEW, 0, 26)
 +REG32(BNK1_EN_DFT_OPT_INV, 0x324)
 +    FIELD(BNK1_EN_DFT_OPT_INV, BNK1_EN_DFT_OPT_INV, 0, 26)
 +REG32(BNK1_EN_PAD2PAD_LOOPBACK, 0x328)
 +    FIELD(BNK1_EN_PAD2PAD_LOOPBACK, BNK1_EN_PAD2PAD_LOOPBACK, 0, 13)
 +REG32(BNK1_RX_SPARE0, 0x32c)
 +REG32(BNK1_RX_SPARE1, 0x330)
 +    FIELD(BNK1_RX_SPARE1, BNK1_RX_SPARE, 0, 20)
 +REG32(BNK1_TX_SPARE0, 0x334)
 +REG32(BNK1_TX_SPARE1, 0x338)
 +    FIELD(BNK1_TX_SPARE1, BNK1_TX_SPARE, 0, 20)
 +REG32(BNK1_SEL_EN1P8, 0x33c)
 +    FIELD(BNK1_SEL_EN1P8, BNK1_SEL_EN1P8, 0, 1)
 +REG32(BNK1_EN_B_POR_DETECT, 0x340)
 +    FIELD(BNK1_EN_B_POR_DETECT, BNK1_EN_B_POR_DETECT, 0, 1)
 +REG32(BNK1_LPF_BYP_POR_DETECT, 0x344)
 +    FIELD(BNK1_LPF_BYP_POR_DETECT, BNK1_LPF_BYP_POR_DETECT, 0, 1)
 +REG32(BNK1_EN_LATCH, 0x348)
 +    FIELD(BNK1_EN_LATCH, BNK1_EN_LATCH, 0, 1)
 +REG32(BNK1_VBG_LPF_BYP_B, 0x34c)
 +    FIELD(BNK1_VBG_LPF_BYP_B, BNK1_VBG_LPF_BYP_B, 0, 1)
 +REG32(BNK1_EN_AMP_B, 0x350)
 +    FIELD(BNK1_EN_AMP_B, BNK1_EN_AMP_B, 0, 2)
 +REG32(BNK1_SPARE_BIAS, 0x354)
 +    FIELD(BNK1_SPARE_BIAS, BNK1_SPARE_BIAS, 0, 4)
 +REG32(BNK1_DRIVER_BIAS, 0x358)
 +    FIELD(BNK1_DRIVER_BIAS, BNK1_DRIVER_BIAS, 0, 15)
 +REG32(BNK1_VMODE, 0x35c)
 +    FIELD(BNK1_VMODE, BNK1_VMODE, 0, 1)
 +REG32(BNK1_SEL_AUX_IO_RX, 0x360)
 +    FIELD(BNK1_SEL_AUX_IO_RX, BNK1_SEL_AUX_IO_RX, 0, 26)
 +REG32(BNK1_EN_TX_HS_MODE, 0x364)
 +    FIELD(BNK1_EN_TX_HS_MODE, BNK1_EN_TX_HS_MODE, 0, 26)
 +REG32(SD0_CLK_CTRL, 0x400)
 +    FIELD(SD0_CLK_CTRL, SDIO0_FBCLK_SEL, 2, 1)
 +    FIELD(SD0_CLK_CTRL, SDIO0_RX_SRC_SEL, 0, 2)
 +REG32(SD0_CTRL_REG, 0x404)
 +    FIELD(SD0_CTRL_REG, SD0_EMMC_SEL, 0, 1)
 +REG32(SD0_CONFIG_REG1, 0x410)
 +    FIELD(SD0_CONFIG_REG1, SD0_BASECLK, 7, 8)
 +    FIELD(SD0_CONFIG_REG1, SD0_TUNIGCOUNT, 1, 6)
 +    FIELD(SD0_CONFIG_REG1, SD0_ASYNCWKPENA, 0, 1)
 +REG32(SD0_CONFIG_REG2, 0x414)
 +    FIELD(SD0_CONFIG_REG2, SD0_SLOTTYPE, 12, 2)
 +    FIELD(SD0_CONFIG_REG2, SD0_ASYCINTR, 11, 1)
 +    FIELD(SD0_CONFIG_REG2, SD0_64BIT, 10, 1)
 +    FIELD(SD0_CONFIG_REG2, SD0_1P8V, 9, 1)
 +    FIELD(SD0_CONFIG_REG2, SD0_3P0V, 8, 1)
 +    FIELD(SD0_CONFIG_REG2, SD0_3P3V, 7, 1)
 +    FIELD(SD0_CONFIG_REG2, SD0_SUSPRES, 6, 1)
 +    FIELD(SD0_CONFIG_REG2, SD0_SDMA, 5, 1)
 +    FIELD(SD0_CONFIG_REG2, SD0_HIGHSPEED, 4, 1)
 +    FIELD(SD0_CONFIG_REG2, SD0_ADMA2, 3, 1)
 +    FIELD(SD0_CONFIG_REG2, SD0_8BIT, 2, 1)
 +    FIELD(SD0_CONFIG_REG2, SD0_MAXBLK, 0, 2)
 +REG32(SD0_CONFIG_REG3, 0x418)
 +    FIELD(SD0_CONFIG_REG3, SD0_TUNINGSDR50, 10, 1)
 +    FIELD(SD0_CONFIG_REG3, SD0_RETUNETMR, 6, 4)
 +    FIELD(SD0_CONFIG_REG3, SD0_DDRIVER, 5, 1)
 +    FIELD(SD0_CONFIG_REG3, SD0_CDRIVER, 4, 1)
 +    FIELD(SD0_CONFIG_REG3, SD0_ADRIVER, 3, 1)
 +    FIELD(SD0_CONFIG_REG3, SD0_DDR50, 2, 1)
 +    FIELD(SD0_CONFIG_REG3, SD0_SDR104, 1, 1)
 +    FIELD(SD0_CONFIG_REG3, SD0_SDR50, 0, 1)
 +REG32(SD0_INITPRESET, 0x41c)
 +    FIELD(SD0_INITPRESET, SD0_INITPRESET, 0, 13)
 +REG32(SD0_DSPPRESET, 0x420)
 +    FIELD(SD0_DSPPRESET, SD0_DSPPRESET, 0, 13)
 +REG32(SD0_HSPDPRESET, 0x424)
 +    FIELD(SD0_HSPDPRESET, SD0_HSPDPRESET, 0, 13)
 +REG32(SD0_SDR12PRESET, 0x428)
 +    FIELD(SD0_SDR12PRESET, SD0_SDR12PRESET, 0, 13)
 +REG32(SD0_SDR25PRESET, 0x42c)
 +    FIELD(SD0_SDR25PRESET, SD0_SDR25PRESET, 0, 13)
 +REG32(SD0_SDR50PRSET, 0x430)
 +    FIELD(SD0_SDR50PRSET, SD0_SDR50PRESET, 0, 13)
 +REG32(SD0_SDR104PRST, 0x434)
 +    FIELD(SD0_SDR104PRST, SD0_SDR104PRESET, 0, 13)
 +REG32(SD0_DDR50PRESET, 0x438)
 +    FIELD(SD0_DDR50PRESET, SD0_DDR50PRESET, 0, 13)
 +REG32(SD0_MAXCUR1P8, 0x43c)
 +    FIELD(SD0_MAXCUR1P8, SD0_MAXCUR1P8, 0, 8)
 +REG32(SD0_MAXCUR3P0, 0x440)
 +    FIELD(SD0_MAXCUR3P0, SD0_MAXCUR3P0, 0, 8)
 +REG32(SD0_MAXCUR3P3, 0x444)
 +    FIELD(SD0_MAXCUR3P3, SD0_MAXCUR3P3, 0, 8)
 +REG32(SD0_DLL_CTRL, 0x448)
 +    FIELD(SD0_DLL_CTRL, SD0_CLKSTABLE_CFG, 9, 1)
 +    FIELD(SD0_DLL_CTRL, SD0_DLL_CFG, 5, 4)
 +    FIELD(SD0_DLL_CTRL, SD0_DLL_PSDONE, 4, 1)
 +    FIELD(SD0_DLL_CTRL, SD0_DLL_OVF, 3, 1)
 +    FIELD(SD0_DLL_CTRL, SD0_DLL_RST, 2, 1)
 +    FIELD(SD0_DLL_CTRL, SD0_DLL_TESTMODE, 1, 1)
 +    FIELD(SD0_DLL_CTRL, SD0_DLL_LOCK, 0, 1)
 +REG32(SD0_CDN_CTRL, 0x44c)
 +    FIELD(SD0_CDN_CTRL, SD0_CDN_CTRL, 0, 1)
 +REG32(SD0_DLL_TEST, 0x450)
 +    FIELD(SD0_DLL_TEST, DLL_DIV, 16, 8)
 +    FIELD(SD0_DLL_TEST, DLL_TX_SEL, 9, 7)
 +    FIELD(SD0_DLL_TEST, DLL_RX_SEL, 0, 9)
 +REG32(SD0_RX_TUNING_SEL, 0x454)
 +    FIELD(SD0_RX_TUNING_SEL, SD0_RX_SEL, 0, 9)
 +REG32(SD0_DLL_DIV_MAP0, 0x458)
 +    FIELD(SD0_DLL_DIV_MAP0, DIV_3, 24, 8)
 +    FIELD(SD0_DLL_DIV_MAP0, DIV_2, 16, 8)
 +    FIELD(SD0_DLL_DIV_MAP0, DIV_1, 8, 8)
 +    FIELD(SD0_DLL_DIV_MAP0, DIV_0, 0, 8)
 +REG32(SD0_DLL_DIV_MAP1, 0x45c)
 +    FIELD(SD0_DLL_DIV_MAP1, DIV_7, 24, 8)
 +    FIELD(SD0_DLL_DIV_MAP1, DIV_6, 16, 8)
 +    FIELD(SD0_DLL_DIV_MAP1, DIV_5, 8, 8)
 +    FIELD(SD0_DLL_DIV_MAP1, DIV_4, 0, 8)
 +REG32(SD0_IOU_COHERENT_CTRL, 0x460)
 +    FIELD(SD0_IOU_COHERENT_CTRL, SD0_AXI_COH, 0, 4)
 +REG32(SD0_IOU_INTERCONNECT_ROUTE, 0x464)
 +    FIELD(SD0_IOU_INTERCONNECT_ROUTE, SD0, 0, 1)
 +REG32(SD0_IOU_RAM, 0x468)
 +    FIELD(SD0_IOU_RAM, EMASA0, 6, 1)
 +    FIELD(SD0_IOU_RAM, EMAB0, 3, 3)
 +    FIELD(SD0_IOU_RAM, EMAA0, 0, 3)
 +REG32(SD0_IOU_INTERCONNECT_QOS, 0x46c)
 +    FIELD(SD0_IOU_INTERCONNECT_QOS, SD0_QOS, 0, 4)
 +REG32(SD1_CLK_CTRL, 0x480)
 +    FIELD(SD1_CLK_CTRL, SDIO1_FBCLK_SEL, 1, 1)
 +    FIELD(SD1_CLK_CTRL, SDIO1_RX_SRC_SEL, 0, 1)
 +REG32(SD1_CTRL_REG, 0x484)
 +    FIELD(SD1_CTRL_REG, SD1_EMMC_SEL, 0, 1)
 +REG32(SD1_CONFIG_REG1, 0x490)
 +    FIELD(SD1_CONFIG_REG1, SD1_BASECLK, 7, 8)
 +    FIELD(SD1_CONFIG_REG1, SD1_TUNIGCOUNT, 1, 6)
 +    FIELD(SD1_CONFIG_REG1, SD1_ASYNCWKPENA, 0, 1)
 +REG32(SD1_CONFIG_REG2, 0x494)
 +    FIELD(SD1_CONFIG_REG2, SD1_SLOTTYPE, 12, 2)
 +    FIELD(SD1_CONFIG_REG2, SD1_ASYCINTR, 11, 1)
 +    FIELD(SD1_CONFIG_REG2, SD1_64BIT, 10, 1)
 +    FIELD(SD1_CONFIG_REG2, SD1_1P8V, 9, 1)
 +    FIELD(SD1_CONFIG_REG2, SD1_3P0V, 8, 1)
 +    FIELD(SD1_CONFIG_REG2, SD1_3P3V, 7, 1)
 +    FIELD(SD1_CONFIG_REG2, SD1_SUSPRES, 6, 1)
 +    FIELD(SD1_CONFIG_REG2, SD1_SDMA, 5, 1)
 +    FIELD(SD1_CONFIG_REG2, SD1_HIGHSPEED, 4, 1)
 +    FIELD(SD1_CONFIG_REG2, SD1_ADMA2, 3, 1)
 +    FIELD(SD1_CONFIG_REG2, SD1_8BIT, 2, 1)
 +    FIELD(SD1_CONFIG_REG2, SD1_MAXBLK, 0, 2)
 +REG32(SD1_CONFIG_REG3, 0x498)
 +    FIELD(SD1_CONFIG_REG3, SD1_TUNINGSDR50, 10, 1)
 +    FIELD(SD1_CONFIG_REG3, SD1_RETUNETMR, 6, 4)
 +    FIELD(SD1_CONFIG_REG3, SD1_DDRIVER, 5, 1)
 +    FIELD(SD1_CONFIG_REG3, SD1_CDRIVER, 4, 1)
 +    FIELD(SD1_CONFIG_REG3, SD1_ADRIVER, 3, 1)
 +    FIELD(SD1_CONFIG_REG3, SD1_DDR50, 2, 1)
 +    FIELD(SD1_CONFIG_REG3, SD1_SDR104, 1, 1)
 +    FIELD(SD1_CONFIG_REG3, SD1_SDR50, 0, 1)
 +REG32(SD1_INITPRESET, 0x49c)
 +    FIELD(SD1_INITPRESET, SD1_INITPRESET, 0, 13)
 +REG32(SD1_DSPPRESET, 0x4a0)
 +    FIELD(SD1_DSPPRESET, SD1_DSPPRESET, 0, 13)
 +REG32(SD1_HSPDPRESET, 0x4a4)
 +    FIELD(SD1_HSPDPRESET, SD1_HSPDPRESET, 0, 13)
 +REG32(SD1_SDR12PRESET, 0x4a8)
 +    FIELD(SD1_SDR12PRESET, SD1_SDR12PRESET, 0, 13)
 +REG32(SD1_SDR25PRESET, 0x4ac)
 +    FIELD(SD1_SDR25PRESET, SD1_SDR25PRESET, 0, 13)
 +REG32(SD1_SDR50PRSET, 0x4b0)
 +    FIELD(SD1_SDR50PRSET, SD1_SDR50PRESET, 0, 13)
 +REG32(SD1_SDR104PRST, 0x4b4)
 +    FIELD(SD1_SDR104PRST, SD1_SDR104PRESET, 0, 13)
 +REG32(SD1_DDR50PRESET, 0x4b8)
 +    FIELD(SD1_DDR50PRESET, SD1_DDR50PRESET, 0, 13)
 +REG32(SD1_MAXCUR1P8, 0x4bc)
 +    FIELD(SD1_MAXCUR1P8, SD1_MAXCUR1P8, 0, 8)
 +REG32(SD1_MAXCUR3P0, 0x4c0)
 +    FIELD(SD1_MAXCUR3P0, SD1_MAXCUR3P0, 0, 8)
 +REG32(SD1_MAXCUR3P3, 0x4c4)
 +    FIELD(SD1_MAXCUR3P3, SD1_MAXCUR3P3, 0, 8)
 +REG32(SD1_DLL_CTRL, 0x4c8)
 +    FIELD(SD1_DLL_CTRL, SD1_CLKSTABLE_CFG, 9, 1)
 +    FIELD(SD1_DLL_CTRL, SD1_DLL_CFG, 5, 4)
 +    FIELD(SD1_DLL_CTRL, SD1_DLL_PSDONE, 4, 1)
 +    FIELD(SD1_DLL_CTRL, SD1_DLL_OVF, 3, 1)
 +    FIELD(SD1_DLL_CTRL, SD1_DLL_RST, 2, 1)
 +    FIELD(SD1_DLL_CTRL, SD1_DLL_TESTMODE, 1, 1)
 +    FIELD(SD1_DLL_CTRL, SD1_DLL_LOCK, 0, 1)
 +REG32(SD1_CDN_CTRL, 0x4cc)
 +    FIELD(SD1_CDN_CTRL, SD1_CDN_CTRL, 0, 1)
 +REG32(SD1_DLL_TEST, 0x4d0)
 +    FIELD(SD1_DLL_TEST, DLL_DIV, 16, 8)
 +    FIELD(SD1_DLL_TEST, DLL_TX_SEL, 9, 7)
 +    FIELD(SD1_DLL_TEST, DLL_RX_SEL, 0, 9)
 +REG32(SD1_RX_TUNING_SEL, 0x4d4)
 +    FIELD(SD1_RX_TUNING_SEL, SD1_RX_SEL, 0, 9)
 +REG32(SD1_DLL_DIV_MAP0, 0x4d8)
 +    FIELD(SD1_DLL_DIV_MAP0, DIV_3, 24, 8)
 +    FIELD(SD1_DLL_DIV_MAP0, DIV_2, 16, 8)
 +    FIELD(SD1_DLL_DIV_MAP0, DIV_1, 8, 8)
 +    FIELD(SD1_DLL_DIV_MAP0, DIV_0, 0, 8)
 +REG32(SD1_DLL_DIV_MAP1, 0x4dc)
 +    FIELD(SD1_DLL_DIV_MAP1, DIV_7, 24, 8)
 +    FIELD(SD1_DLL_DIV_MAP1, DIV_6, 16, 8)
 +    FIELD(SD1_DLL_DIV_MAP1, DIV_5, 8, 8)
 +    FIELD(SD1_DLL_DIV_MAP1, DIV_4, 0, 8)
 +REG32(SD1_IOU_COHERENT_CTRL, 0x4e0)
 +    FIELD(SD1_IOU_COHERENT_CTRL, SD1_AXI_COH, 0, 4)
 +REG32(SD1_IOU_INTERCONNECT_ROUTE, 0x4e4)
 +    FIELD(SD1_IOU_INTERCONNECT_ROUTE, SD1, 0, 1)
 +REG32(SD1_IOU_RAM, 0x4e8)
 +    FIELD(SD1_IOU_RAM, EMASA0, 6, 1)
 +    FIELD(SD1_IOU_RAM, EMAB0, 3, 3)
 +    FIELD(SD1_IOU_RAM, EMAA0, 0, 3)
 +REG32(SD1_IOU_INTERCONNECT_QOS, 0x4ec)
 +    FIELD(SD1_IOU_INTERCONNECT_QOS, SD1_QOS, 0, 4)
 +REG32(OSPI_QSPI_IOU_AXI_MUX_SEL, 0x504)
 +    FIELD(OSPI_QSPI_IOU_AXI_MUX_SEL, OSPI_MUX_SEL, 1, 1)
 +    FIELD(OSPI_QSPI_IOU_AXI_MUX_SEL, QSPI_OSPI_MUX_SEL, 0, 1)
 +REG32(QSPI_IOU_COHERENT_CTRL, 0x508)
 +    FIELD(QSPI_IOU_COHERENT_CTRL, QSPI_AXI_COH, 0, 4)
 +REG32(QSPI_IOU_INTERCONNECT_ROUTE, 0x50c)
 +    FIELD(QSPI_IOU_INTERCONNECT_ROUTE, QSPI, 0, 1)
 +REG32(QSPI_IOU_RAM, 0x510)
 +    FIELD(QSPI_IOU_RAM, EMASA1, 13, 1)
 +    FIELD(QSPI_IOU_RAM, EMAB1, 10, 3)
 +    FIELD(QSPI_IOU_RAM, EMAA1, 7, 3)
 +    FIELD(QSPI_IOU_RAM, EMASA0, 6, 1)
 +    FIELD(QSPI_IOU_RAM, EMAB0, 3, 3)
 +    FIELD(QSPI_IOU_RAM, EMAA0, 0, 3)
 +REG32(QSPI_IOU_INTERCONNECT_QOS, 0x514)
 +    FIELD(QSPI_IOU_INTERCONNECT_QOS, QSPI_QOS, 0, 4)
 +REG32(OSPI_IOU_COHERENT_CTRL, 0x530)
 +    FIELD(OSPI_IOU_COHERENT_CTRL, OSPI_AXI_COH, 0, 4)
 +REG32(OSPI_IOU_INTERCONNECT_ROUTE, 0x534)
 +    FIELD(OSPI_IOU_INTERCONNECT_ROUTE, OSPI, 0, 1)
 +REG32(OSPI_IOU_RAM, 0x538)
 +    FIELD(OSPI_IOU_RAM, EMAS0, 5, 1)
 +    FIELD(OSPI_IOU_RAM, EMAW0, 3, 2)
 +    FIELD(OSPI_IOU_RAM, EMA0, 0, 3)
 +REG32(OSPI_IOU_INTERCONNECT_QOS, 0x53c)
 +    FIELD(OSPI_IOU_INTERCONNECT_QOS, OSPI_QOS, 0, 4)
 +REG32(OSPI_REFCLK_DLY_CTRL, 0x540)
 +    FIELD(OSPI_REFCLK_DLY_CTRL, DLY1, 3, 2)
 +    FIELD(OSPI_REFCLK_DLY_CTRL, DLY0, 0, 3)
 +REG32(CUR_PWR_ST, 0x600)
 +    FIELD(CUR_PWR_ST, U2PMU, 0, 2)
 +REG32(CONNECT_ST, 0x604)
 +    FIELD(CONNECT_ST, U2PMU, 0, 1)
 +REG32(PW_STATE_REQ, 0x608)
 +    FIELD(PW_STATE_REQ, BIT_1_0, 0, 2)
 +REG32(HOST_U2_PORT_DISABLE, 0x60c)
 +    FIELD(HOST_U2_PORT_DISABLE, BIT_0, 0, 1)
 +REG32(DBG_U2PMU, 0x610)
 +REG32(DBG_U2PMU_EXT1, 0x614)
 +REG32(DBG_U2PMU_EXT2, 0x618)
 +    FIELD(DBG_U2PMU_EXT2, BIT_67_64, 0, 4)
 +REG32(PME_GEN_U2PMU, 0x61c)
 +    FIELD(PME_GEN_U2PMU, BIT_0, 0, 1)
 +REG32(PWR_CONFIG_USB2, 0x620)
 +    FIELD(PWR_CONFIG_USB2, STRAP, 0, 30)
 +REG32(PHY_HUB, 0x624)
 +    FIELD(PHY_HUB, VBUS_CTRL, 1, 1)
 +    FIELD(PHY_HUB, OVER_CURRENT, 0, 1)
 +REG32(CTRL, 0x700)
 +    FIELD(CTRL, SLVERR_ENABLE, 0, 1)
 +REG32(ISR, 0x800)
 +    FIELD(ISR, ADDR_DECODE_ERR, 0, 1)
 +REG32(IMR, 0x804)
 +    FIELD(IMR, ADDR_DECODE_ERR, 0, 1)
 +REG32(IER, 0x808)
 +    FIELD(IER, ADDR_DECODE_ERR, 0, 1)
 +REG32(IDR, 0x80c)
 +    FIELD(IDR, ADDR_DECODE_ERR, 0, 1)
 +REG32(ITR, 0x810)
 +    FIELD(ITR, ADDR_DECODE_ERR, 0, 1)
 +REG32(PARITY_ISR, 0x814)
 +    FIELD(PARITY_ISR, PERR_AXI_SD1_IOU, 12, 1)
 +    FIELD(PARITY_ISR, PERR_AXI_SD0_IOU, 11, 1)
 +    FIELD(PARITY_ISR, PERR_AXI_QSPI_IOU, 10, 1)
 +    FIELD(PARITY_ISR, PERR_AXI_OSPI_IOU, 9, 1)
 +    FIELD(PARITY_ISR, PERR_IOU_SD1, 8, 1)
 +    FIELD(PARITY_ISR, PERR_IOU_SD0, 7, 1)
 +    FIELD(PARITY_ISR, PERR_IOU_QSPI1, 6, 1)
 +    FIELD(PARITY_ISR, PERR_IOUSLCR_SECURE_APB, 5, 1)
 +    FIELD(PARITY_ISR, PERR_IOUSLCR_APB, 4, 1)
 +    FIELD(PARITY_ISR, PERR_QSPI0_APB, 3, 1)
 +    FIELD(PARITY_ISR, PERR_OSPI_APB, 2, 1)
 +    FIELD(PARITY_ISR, PERR_I2C_APB, 1, 1)
 +    FIELD(PARITY_ISR, PERR_GPIO_APB, 0, 1)
 +REG32(PARITY_IMR, 0x818)
 +    FIELD(PARITY_IMR, PERR_AXI_SD1_IOU, 12, 1)
 +    FIELD(PARITY_IMR, PERR_AXI_SD0_IOU, 11, 1)
 +    FIELD(PARITY_IMR, PERR_AXI_QSPI_IOU, 10, 1)
 +    FIELD(PARITY_IMR, PERR_AXI_OSPI_IOU, 9, 1)
 +    FIELD(PARITY_IMR, PERR_IOU_SD1, 8, 1)
 +    FIELD(PARITY_IMR, PERR_IOU_SD0, 7, 1)
 +    FIELD(PARITY_IMR, PERR_IOU_QSPI1, 6, 1)
 +    FIELD(PARITY_IMR, PERR_IOUSLCR_SECURE_APB, 5, 1)
 +    FIELD(PARITY_IMR, PERR_IOUSLCR_APB, 4, 1)
 +    FIELD(PARITY_IMR, PERR_QSPI0_APB, 3, 1)
 +    FIELD(PARITY_IMR, PERR_OSPI_APB, 2, 1)
 +    FIELD(PARITY_IMR, PERR_I2C_APB, 1, 1)
 +    FIELD(PARITY_IMR, PERR_GPIO_APB, 0, 1)
 +REG32(PARITY_IER, 0x81c)
 +    FIELD(PARITY_IER, PERR_AXI_SD1_IOU, 12, 1)
 +    FIELD(PARITY_IER, PERR_AXI_SD0_IOU, 11, 1)
 +    FIELD(PARITY_IER, PERR_AXI_QSPI_IOU, 10, 1)
 +    FIELD(PARITY_IER, PERR_AXI_OSPI_IOU, 9, 1)
 +    FIELD(PARITY_IER, PERR_IOU_SD1, 8, 1)
 +    FIELD(PARITY_IER, PERR_IOU_SD0, 7, 1)
 +    FIELD(PARITY_IER, PERR_IOU_QSPI1, 6, 1)
 +    FIELD(PARITY_IER, PERR_IOUSLCR_SECURE_APB, 5, 1)
 +    FIELD(PARITY_IER, PERR_IOUSLCR_APB, 4, 1)
 +    FIELD(PARITY_IER, PERR_QSPI0_APB, 3, 1)
 +    FIELD(PARITY_IER, PERR_OSPI_APB, 2, 1)
 +    FIELD(PARITY_IER, PERR_I2C_APB, 1, 1)
 +    FIELD(PARITY_IER, PERR_GPIO_APB, 0, 1)
 +REG32(PARITY_IDR, 0x820)
 +    FIELD(PARITY_IDR, PERR_AXI_SD1_IOU, 12, 1)
 +    FIELD(PARITY_IDR, PERR_AXI_SD0_IOU, 11, 1)
 +    FIELD(PARITY_IDR, PERR_AXI_QSPI_IOU, 10, 1)
 +    FIELD(PARITY_IDR, PERR_AXI_OSPI_IOU, 9, 1)
 +    FIELD(PARITY_IDR, PERR_IOU_SD1, 8, 1)
 +    FIELD(PARITY_IDR, PERR_IOU_SD0, 7, 1)
 +    FIELD(PARITY_IDR, PERR_IOU_QSPI1, 6, 1)
 +    FIELD(PARITY_IDR, PERR_IOUSLCR_SECURE_APB, 5, 1)
 +    FIELD(PARITY_IDR, PERR_IOUSLCR_APB, 4, 1)
 +    FIELD(PARITY_IDR, PERR_QSPI0_APB, 3, 1)
 +    FIELD(PARITY_IDR, PERR_OSPI_APB, 2, 1)
 +    FIELD(PARITY_IDR, PERR_I2C_APB, 1, 1)
 +    FIELD(PARITY_IDR, PERR_GPIO_APB, 0, 1)
 +REG32(PARITY_ITR, 0x824)
 +    FIELD(PARITY_ITR, PERR_AXI_SD1_IOU, 12, 1)
 +    FIELD(PARITY_ITR, PERR_AXI_SD0_IOU, 11, 1)
 +    FIELD(PARITY_ITR, PERR_AXI_QSPI_IOU, 10, 1)
 +    FIELD(PARITY_ITR, PERR_AXI_OSPI_IOU, 9, 1)
 +    FIELD(PARITY_ITR, PERR_IOU_SD1, 8, 1)
 +    FIELD(PARITY_ITR, PERR_IOU_SD0, 7, 1)
 +    FIELD(PARITY_ITR, PERR_IOU_QSPI1, 6, 1)
 +    FIELD(PARITY_ITR, PERR_IOUSLCR_SECURE_APB, 5, 1)
 +    FIELD(PARITY_ITR, PERR_IOUSLCR_APB, 4, 1)
 +    FIELD(PARITY_ITR, PERR_QSPI0_APB, 3, 1)
 +    FIELD(PARITY_ITR, PERR_OSPI_APB, 2, 1)
 +    FIELD(PARITY_ITR, PERR_I2C_APB, 1, 1)
 +    FIELD(PARITY_ITR, PERR_GPIO_APB, 0, 1)
 +REG32(WPROT0, 0x828)
 +    FIELD(WPROT0, ACTIVE, 0, 1)
 +
 +static void parity_imr_update_irq(XlnxVersalPmcIouSlcr *s)
 +{
 +    bool pending = s->regs[R_PARITY_ISR] & ~s->regs[R_PARITY_IMR];
 +    qemu_set_irq(s->irq_parity_imr, pending);
 +}
 +
-+static void parity_isr_postw(RegisterInfo *reg, uint64_t val64)
++static void gen_vfp_ah_abss(TCGv_i32 d, TCGv_i32 s)
 +{
-+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
++    TCGv_i32 abs_s = tcg_temp_new_i32();
-+    parity_imr_update_irq(s);
++
 +    gen_vfp_abss(abs_s, s);
 +    tcg_gen_movcond_i32(TCG_COND_GTU, d,
 +                        abs_s, tcg_constant_i32(0x7f800000UL),
 +                        s, abs_s);
 +}
 +
-+static uint64_t parity_ier_prew(RegisterInfo *reg, uint64_t val64)
++static void gen_vfp_ah_absd(TCGv_i64 d, TCGv_i64 s)
 +{
-+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
++    TCGv_i64 abs_s = tcg_temp_new_i64();
 +    uint32_t val = val64;
 +
-+    s->regs[R_PARITY_IMR] &= ~val;
++    gen_vfp_absd(abs_s, s);
-+    parity_imr_update_irq(s);
++    tcg_gen_movcond_i64(TCG_COND_GTU, d,
-+    return 0;
++                        abs_s, tcg_constant_i64(0x7ff0000000000000ULL),
 +                        s, abs_s);
 +}
 +
-+static uint64_t parity_idr_prew(RegisterInfo *reg, uint64_t val64)
+ static void gen_vfp_maybe_ah_negh(DisasContext *dc, TCGv_i32 d, TCGv_i32 s)
  {
      if (dc->fpcr_ah) {
@@ -XXX,XX +XXX,XX @@ static void gen_fabd_d(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m, TCGv_ptr s)
      gen_vfp_absd(d, d);
  }
 +static void gen_fabd_ah_h(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
 +{
-+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
++    gen_helper_vfp_subh(d, n, m, s);
-+    uint32_t val = val64;
++    gen_vfp_ah_absh(d, d);
 +
 +    s->regs[R_PARITY_IMR] |= val;
 +    parity_imr_update_irq(s);
 +    return 0;
 +}
 +
-+static uint64_t parity_itr_prew(RegisterInfo *reg, uint64_t val64)
++static void gen_fabd_ah_s(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
 +{
-+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
++    gen_helper_vfp_subs(d, n, m, s);
-+    uint32_t val = val64;
++    gen_vfp_ah_abss(d, d);
 +
 +    s->regs[R_PARITY_ISR] |= val;
 +    parity_imr_update_irq(s);
 +    return 0;
 +}
 +
-+static void imr_update_irq(XlnxVersalPmcIouSlcr *s)
++static void gen_fabd_ah_d(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m, TCGv_ptr s)
 +{
-+    bool pending = s->regs[R_ISR] & ~s->regs[R_IMR];
++    gen_helper_vfp_subd(d, n, m, s);
-+    qemu_set_irq(s->irq_imr, pending);
++    gen_vfp_ah_absd(d, d);
 +}
 +
-+static void isr_postw(RegisterInfo *reg, uint64_t val64)
+ static const FPScalar f_scalar_fabd = {
-+{
+     gen_fabd_h,
-+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+     gen_fabd_s,
-+    imr_update_irq(s);
+     gen_fabd_d,
-+}
+ };
-+
+-TRANS(FABD_s, do_fp3_scalar, a, &f_scalar_fabd, a->rn)
-+static uint64_t ier_prew(RegisterInfo *reg, uint64_t val64)
++static const FPScalar f_scalar_ah_fabd = {
-+{
++    gen_fabd_ah_h,
-+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
++    gen_fabd_ah_s,
-+    uint32_t val = val64;
++    gen_fabd_ah_d,
 +
 +    s->regs[R_IMR] &= ~val;
 +    imr_update_irq(s);
 +    return 0;
 +}
 +
 +static uint64_t idr_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
 +    uint32_t val = val64;
 +
 +    s->regs[R_IMR] |= val;
 +    imr_update_irq(s);
 +    return 0;
 +}
 +
 +static uint64_t itr_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
 +    uint32_t val = val64;
 +
 +    s->regs[R_ISR] |= val;
 +    imr_update_irq(s);
 +    return 0;
 +}
 +
 +static uint64_t sd0_ctrl_reg_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
 +    uint32_t prev = ARRAY_FIELD_EX32(s->regs, SD0_CTRL_REG, SD0_EMMC_SEL);
 +
 +    if (prev != (val64 & R_SD0_CTRL_REG_SD0_EMMC_SEL_MASK)) {
 +        qemu_set_irq(s->sd_emmc_sel[0], !!val64);
 +    }
 +
 +    return val64;
 +}
 +
 +static uint64_t sd1_ctrl_reg_prew(RegisterInfo *reg, uint64_t val64)
 +{
 +    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
 +    uint32_t prev = ARRAY_FIELD_EX32(s->regs, SD1_CTRL_REG, SD1_EMMC_SEL);
 +
 +    if (prev != (val64 & R_SD1_CTRL_REG_SD1_EMMC_SEL_MASK)) {
 +        qemu_set_irq(s->sd_emmc_sel[1], !!val64);
 +    }
 +
 +    return val64;
 +}
 +
 +static uint64_t ospi_qspi_iou_axi_mux_sel_prew(RegisterInfo *reg,
 +                                               uint64_t val64)
 +{
 +    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
 +    uint32_t val32 = (uint32_t) val64;
 +    uint8_t ospi_mux_sel = FIELD_EX32(val32, OSPI_QSPI_IOU_AXI_MUX_SEL,
 +                                      OSPI_MUX_SEL);
 +    uint8_t qspi_ospi_mux_sel = FIELD_EX32(val32, OSPI_QSPI_IOU_AXI_MUX_SEL,
 +                                      QSPI_OSPI_MUX_SEL);
 +
 +    if (ospi_mux_sel !=
 +        ARRAY_FIELD_EX32(s->regs, OSPI_QSPI_IOU_AXI_MUX_SEL, OSPI_MUX_SEL)) {
 +        qemu_set_irq(s->ospi_mux_sel, !!ospi_mux_sel);
 +    }
 +
 +    if (qspi_ospi_mux_sel !=
 +        ARRAY_FIELD_EX32(s->regs, OSPI_QSPI_IOU_AXI_MUX_SEL,
 +                         QSPI_OSPI_MUX_SEL)) {
 +        qemu_set_irq(s->qspi_ospi_mux_sel, !!qspi_ospi_mux_sel);
 +    }
 +
 +    return val64;
 +}
 +
 +static RegisterAccessInfo pmc_iou_slcr_regs_info[] = {
 +    {   .name = "MIO_PIN_0",  .addr = A_MIO_PIN_0,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_1",  .addr = A_MIO_PIN_1,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_2",  .addr = A_MIO_PIN_2,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_3",  .addr = A_MIO_PIN_3,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_4",  .addr = A_MIO_PIN_4,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_5",  .addr = A_MIO_PIN_5,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_6",  .addr = A_MIO_PIN_6,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_7",  .addr = A_MIO_PIN_7,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_8",  .addr = A_MIO_PIN_8,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_9",  .addr = A_MIO_PIN_9,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_10",  .addr = A_MIO_PIN_10,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_11",  .addr = A_MIO_PIN_11,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_12",  .addr = A_MIO_PIN_12,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_13",  .addr = A_MIO_PIN_13,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_14",  .addr = A_MIO_PIN_14,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_15",  .addr = A_MIO_PIN_15,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_16",  .addr = A_MIO_PIN_16,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_17",  .addr = A_MIO_PIN_17,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_18",  .addr = A_MIO_PIN_18,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_19",  .addr = A_MIO_PIN_19,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_20",  .addr = A_MIO_PIN_20,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_21",  .addr = A_MIO_PIN_21,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_22",  .addr = A_MIO_PIN_22,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_23",  .addr = A_MIO_PIN_23,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_24",  .addr = A_MIO_PIN_24,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_25",  .addr = A_MIO_PIN_25,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_26",  .addr = A_MIO_PIN_26,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_27",  .addr = A_MIO_PIN_27,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_28",  .addr = A_MIO_PIN_28,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_29",  .addr = A_MIO_PIN_29,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_30",  .addr = A_MIO_PIN_30,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_31",  .addr = A_MIO_PIN_31,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_32",  .addr = A_MIO_PIN_32,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_33",  .addr = A_MIO_PIN_33,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_34",  .addr = A_MIO_PIN_34,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_35",  .addr = A_MIO_PIN_35,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_36",  .addr = A_MIO_PIN_36,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_37",  .addr = A_MIO_PIN_37,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_38",  .addr = A_MIO_PIN_38,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_39",  .addr = A_MIO_PIN_39,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_40",  .addr = A_MIO_PIN_40,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_41",  .addr = A_MIO_PIN_41,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_42",  .addr = A_MIO_PIN_42,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_43",  .addr = A_MIO_PIN_43,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_44",  .addr = A_MIO_PIN_44,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_45",  .addr = A_MIO_PIN_45,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_46",  .addr = A_MIO_PIN_46,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_47",  .addr = A_MIO_PIN_47,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_48",  .addr = A_MIO_PIN_48,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_49",  .addr = A_MIO_PIN_49,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_50",  .addr = A_MIO_PIN_50,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "MIO_PIN_51",  .addr = A_MIO_PIN_51,
 +        .rsvd = 0xfffffc01,
 +    },{ .name = "BNK0_EN_RX",  .addr = A_BNK0_EN_RX,
 +        .reset = 0x3ffffff,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK0_SEL_RX0",  .addr = A_BNK0_SEL_RX0,
 +        .reset = 0xffffffff,
 +    },{ .name = "BNK0_SEL_RX1",  .addr = A_BNK0_SEL_RX1,
 +        .reset = 0xfffff,
 +        .rsvd = 0xfff00000,
 +    },{ .name = "BNK0_EN_RX_SCHMITT_HYST",  .addr = A_BNK0_EN_RX_SCHMITT_HYST,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK0_EN_WK_PD",  .addr = A_BNK0_EN_WK_PD,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK0_EN_WK_PU",  .addr = A_BNK0_EN_WK_PU,
 +        .reset = 0x3ffffff,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK0_SEL_DRV0",  .addr = A_BNK0_SEL_DRV0,
 +        .reset = 0xffffffff,
 +    },{ .name = "BNK0_SEL_DRV1",  .addr = A_BNK0_SEL_DRV1,
 +        .reset = 0xfffff,
 +        .rsvd = 0xfff00000,
 +    },{ .name = "BNK0_SEL_SLEW",  .addr = A_BNK0_SEL_SLEW,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK0_EN_DFT_OPT_INV",  .addr = A_BNK0_EN_DFT_OPT_INV,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK0_EN_PAD2PAD_LOOPBACK",
 +        .addr = A_BNK0_EN_PAD2PAD_LOOPBACK,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "BNK0_RX_SPARE0",  .addr = A_BNK0_RX_SPARE0,
 +    },{ .name = "BNK0_RX_SPARE1",  .addr = A_BNK0_RX_SPARE1,
 +        .rsvd = 0xfff00000,
 +    },{ .name = "BNK0_TX_SPARE0",  .addr = A_BNK0_TX_SPARE0,
 +    },{ .name = "BNK0_TX_SPARE1",  .addr = A_BNK0_TX_SPARE1,
 +        .rsvd = 0xfff00000,
 +    },{ .name = "BNK0_SEL_EN1P8",  .addr = A_BNK0_SEL_EN1P8,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "BNK0_EN_B_POR_DETECT",  .addr = A_BNK0_EN_B_POR_DETECT,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "BNK0_LPF_BYP_POR_DETECT",  .addr = A_BNK0_LPF_BYP_POR_DETECT,
 +        .reset = 0x1,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "BNK0_EN_LATCH",  .addr = A_BNK0_EN_LATCH,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "BNK0_VBG_LPF_BYP_B",  .addr = A_BNK0_VBG_LPF_BYP_B,
 +        .reset = 0x1,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "BNK0_EN_AMP_B",  .addr = A_BNK0_EN_AMP_B,
 +        .rsvd = 0xfffffffc,
 +    },{ .name = "BNK0_SPARE_BIAS",  .addr = A_BNK0_SPARE_BIAS,
 +        .rsvd = 0xfffffff0,
 +    },{ .name = "BNK0_DRIVER_BIAS",  .addr = A_BNK0_DRIVER_BIAS,
 +        .rsvd = 0xffff8000,
 +    },{ .name = "BNK0_VMODE",  .addr = A_BNK0_VMODE,
 +        .rsvd = 0xfffffffe,
 +        .ro = 0x1,
 +    },{ .name = "BNK0_SEL_AUX_IO_RX",  .addr = A_BNK0_SEL_AUX_IO_RX,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK0_EN_TX_HS_MODE",  .addr = A_BNK0_EN_TX_HS_MODE,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "MIO_MST_TRI0",  .addr = A_MIO_MST_TRI0,
 +        .reset = 0x3ffffff,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "MIO_MST_TRI1",  .addr = A_MIO_MST_TRI1,
 +        .reset = 0x3ffffff,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK1_EN_RX",  .addr = A_BNK1_EN_RX,
 +        .reset = 0x3ffffff,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK1_SEL_RX0",  .addr = A_BNK1_SEL_RX0,
 +        .reset = 0xffffffff,
 +    },{ .name = "BNK1_SEL_RX1",  .addr = A_BNK1_SEL_RX1,
 +        .reset = 0xfffff,
 +        .rsvd = 0xfff00000,
 +    },{ .name = "BNK1_EN_RX_SCHMITT_HYST",  .addr = A_BNK1_EN_RX_SCHMITT_HYST,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK1_EN_WK_PD",  .addr = A_BNK1_EN_WK_PD,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK1_EN_WK_PU",  .addr = A_BNK1_EN_WK_PU,
 +        .reset = 0x3ffffff,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK1_SEL_DRV0",  .addr = A_BNK1_SEL_DRV0,
 +        .reset = 0xffffffff,
 +    },{ .name = "BNK1_SEL_DRV1",  .addr = A_BNK1_SEL_DRV1,
 +        .reset = 0xfffff,
 +        .rsvd = 0xfff00000,
 +    },{ .name = "BNK1_SEL_SLEW",  .addr = A_BNK1_SEL_SLEW,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK1_EN_DFT_OPT_INV",  .addr = A_BNK1_EN_DFT_OPT_INV,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK1_EN_PAD2PAD_LOOPBACK",
 +        .addr = A_BNK1_EN_PAD2PAD_LOOPBACK,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "BNK1_RX_SPARE0",  .addr = A_BNK1_RX_SPARE0,
 +    },{ .name = "BNK1_RX_SPARE1",  .addr = A_BNK1_RX_SPARE1,
 +        .rsvd = 0xfff00000,
 +    },{ .name = "BNK1_TX_SPARE0",  .addr = A_BNK1_TX_SPARE0,
 +    },{ .name = "BNK1_TX_SPARE1",  .addr = A_BNK1_TX_SPARE1,
 +        .rsvd = 0xfff00000,
 +    },{ .name = "BNK1_SEL_EN1P8",  .addr = A_BNK1_SEL_EN1P8,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "BNK1_EN_B_POR_DETECT",  .addr = A_BNK1_EN_B_POR_DETECT,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "BNK1_LPF_BYP_POR_DETECT",  .addr = A_BNK1_LPF_BYP_POR_DETECT,
 +        .reset = 0x1,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "BNK1_EN_LATCH",  .addr = A_BNK1_EN_LATCH,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "BNK1_VBG_LPF_BYP_B",  .addr = A_BNK1_VBG_LPF_BYP_B,
 +        .reset = 0x1,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "BNK1_EN_AMP_B",  .addr = A_BNK1_EN_AMP_B,
 +        .rsvd = 0xfffffffc,
 +    },{ .name = "BNK1_SPARE_BIAS",  .addr = A_BNK1_SPARE_BIAS,
 +        .rsvd = 0xfffffff0,
 +    },{ .name = "BNK1_DRIVER_BIAS",  .addr = A_BNK1_DRIVER_BIAS,
 +        .rsvd = 0xffff8000,
 +    },{ .name = "BNK1_VMODE",  .addr = A_BNK1_VMODE,
 +        .rsvd = 0xfffffffe,
 +        .ro = 0x1,
 +    },{ .name = "BNK1_SEL_AUX_IO_RX",  .addr = A_BNK1_SEL_AUX_IO_RX,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "BNK1_EN_TX_HS_MODE",  .addr = A_BNK1_EN_TX_HS_MODE,
 +        .rsvd = 0xfc000000,
 +    },{ .name = "SD0_CLK_CTRL",  .addr = A_SD0_CLK_CTRL,
 +        .rsvd = 0xfffffff8,
 +    },{ .name = "SD0_CTRL_REG",  .addr = A_SD0_CTRL_REG,
 +        .rsvd = 0xfffffffe,
 +        .pre_write = sd0_ctrl_reg_prew,
 +    },{ .name = "SD0_CONFIG_REG1",  .addr = A_SD0_CONFIG_REG1,
 +        .reset = 0x3250,
 +        .rsvd = 0xffff8000,
 +    },{ .name = "SD0_CONFIG_REG2",  .addr = A_SD0_CONFIG_REG2,
 +        .reset = 0xffc,
 +        .rsvd = 0xffffc000,
 +    },{ .name = "SD0_CONFIG_REG3",  .addr = A_SD0_CONFIG_REG3,
 +        .reset = 0x407,
 +        .rsvd = 0xfffff800,
 +    },{ .name = "SD0_INITPRESET",  .addr = A_SD0_INITPRESET,
 +        .reset = 0x100,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD0_DSPPRESET",  .addr = A_SD0_DSPPRESET,
 +        .reset = 0x4,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD0_HSPDPRESET",  .addr = A_SD0_HSPDPRESET,
 +        .reset = 0x2,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD0_SDR12PRESET",  .addr = A_SD0_SDR12PRESET,
 +        .reset = 0x4,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD0_SDR25PRESET",  .addr = A_SD0_SDR25PRESET,
 +        .reset = 0x2,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD0_SDR50PRSET",  .addr = A_SD0_SDR50PRSET,
 +        .reset = 0x1,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD0_SDR104PRST",  .addr = A_SD0_SDR104PRST,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD0_DDR50PRESET",  .addr = A_SD0_DDR50PRESET,
 +        .reset = 0x2,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD0_MAXCUR1P8",  .addr = A_SD0_MAXCUR1P8,
 +        .rsvd = 0xffffff00,
 +    },{ .name = "SD0_MAXCUR3P0",  .addr = A_SD0_MAXCUR3P0,
 +        .rsvd = 0xffffff00,
 +    },{ .name = "SD0_MAXCUR3P3",  .addr = A_SD0_MAXCUR3P3,
 +        .rsvd = 0xffffff00,
 +    },{ .name = "SD0_DLL_CTRL",  .addr = A_SD0_DLL_CTRL,
 +        .reset = 0x1,
 +        .rsvd = 0xfffffc00,
 +        .ro = 0x19,
 +    },{ .name = "SD0_CDN_CTRL",  .addr = A_SD0_CDN_CTRL,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "SD0_DLL_TEST",  .addr = A_SD0_DLL_TEST,
 +        .rsvd = 0xff000000,
 +    },{ .name = "SD0_RX_TUNING_SEL",  .addr = A_SD0_RX_TUNING_SEL,
 +        .rsvd = 0xfffffe00,
 +        .ro = 0x1ff,
 +    },{ .name = "SD0_DLL_DIV_MAP0",  .addr = A_SD0_DLL_DIV_MAP0,
 +        .reset = 0x50505050,
 +    },{ .name = "SD0_DLL_DIV_MAP1",  .addr = A_SD0_DLL_DIV_MAP1,
 +        .reset = 0x50505050,
 +    },{ .name = "SD0_IOU_COHERENT_CTRL",  .addr = A_SD0_IOU_COHERENT_CTRL,
 +        .rsvd = 0xfffffff0,
 +    },{ .name = "SD0_IOU_INTERCONNECT_ROUTE",
 +        .addr = A_SD0_IOU_INTERCONNECT_ROUTE,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "SD0_IOU_RAM",  .addr = A_SD0_IOU_RAM,
 +        .reset = 0x24,
 +        .rsvd = 0xffffff80,
 +    },{ .name = "SD0_IOU_INTERCONNECT_QOS",
 +        .addr = A_SD0_IOU_INTERCONNECT_QOS,
 +        .rsvd = 0xfffffff0,
 +    },{ .name = "SD1_CLK_CTRL",  .addr = A_SD1_CLK_CTRL,
 +        .rsvd = 0xfffffffc,
 +    },{ .name = "SD1_CTRL_REG",  .addr = A_SD1_CTRL_REG,
 +        .rsvd = 0xfffffffe,
 +        .pre_write = sd1_ctrl_reg_prew,
 +    },{ .name = "SD1_CONFIG_REG1",  .addr = A_SD1_CONFIG_REG1,
 +        .reset = 0x3250,
 +        .rsvd = 0xffff8000,
 +    },{ .name = "SD1_CONFIG_REG2",  .addr = A_SD1_CONFIG_REG2,
 +        .reset = 0xffc,
 +        .rsvd = 0xffffc000,
 +    },{ .name = "SD1_CONFIG_REG3",  .addr = A_SD1_CONFIG_REG3,
 +        .reset = 0x407,
 +        .rsvd = 0xfffff800,
 +    },{ .name = "SD1_INITPRESET",  .addr = A_SD1_INITPRESET,
 +        .reset = 0x100,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD1_DSPPRESET",  .addr = A_SD1_DSPPRESET,
 +        .reset = 0x4,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD1_HSPDPRESET",  .addr = A_SD1_HSPDPRESET,
 +        .reset = 0x2,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD1_SDR12PRESET",  .addr = A_SD1_SDR12PRESET,
 +        .reset = 0x4,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD1_SDR25PRESET",  .addr = A_SD1_SDR25PRESET,
 +        .reset = 0x2,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD1_SDR50PRSET",  .addr = A_SD1_SDR50PRSET,
 +        .reset = 0x1,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD1_SDR104PRST",  .addr = A_SD1_SDR104PRST,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD1_DDR50PRESET",  .addr = A_SD1_DDR50PRESET,
 +        .reset = 0x2,
 +        .rsvd = 0xffffe000,
 +    },{ .name = "SD1_MAXCUR1P8",  .addr = A_SD1_MAXCUR1P8,
 +        .rsvd = 0xffffff00,
 +    },{ .name = "SD1_MAXCUR3P0",  .addr = A_SD1_MAXCUR3P0,
 +        .rsvd = 0xffffff00,
 +    },{ .name = "SD1_MAXCUR3P3",  .addr = A_SD1_MAXCUR3P3,
 +        .rsvd = 0xffffff00,
 +    },{ .name = "SD1_DLL_CTRL",  .addr = A_SD1_DLL_CTRL,
 +        .reset = 0x1,
 +        .rsvd = 0xfffffc00,
 +        .ro = 0x19,
 +    },{ .name = "SD1_CDN_CTRL",  .addr = A_SD1_CDN_CTRL,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "SD1_DLL_TEST",  .addr = A_SD1_DLL_TEST,
 +        .rsvd = 0xff000000,
 +    },{ .name = "SD1_RX_TUNING_SEL",  .addr = A_SD1_RX_TUNING_SEL,
 +        .rsvd = 0xfffffe00,
 +        .ro = 0x1ff,
 +    },{ .name = "SD1_DLL_DIV_MAP0",  .addr = A_SD1_DLL_DIV_MAP0,
 +        .reset = 0x50505050,
 +    },{ .name = "SD1_DLL_DIV_MAP1",  .addr = A_SD1_DLL_DIV_MAP1,
 +        .reset = 0x50505050,
 +    },{ .name = "SD1_IOU_COHERENT_CTRL",  .addr = A_SD1_IOU_COHERENT_CTRL,
 +        .rsvd = 0xfffffff0,
 +    },{ .name = "SD1_IOU_INTERCONNECT_ROUTE",
 +        .addr = A_SD1_IOU_INTERCONNECT_ROUTE,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "SD1_IOU_RAM",  .addr = A_SD1_IOU_RAM,
 +        .reset = 0x24,
 +        .rsvd = 0xffffff80,
 +    },{ .name = "SD1_IOU_INTERCONNECT_QOS",
 +        .addr = A_SD1_IOU_INTERCONNECT_QOS,
 +        .rsvd = 0xfffffff0,
 +    },{ .name = "OSPI_QSPI_IOU_AXI_MUX_SEL",
 +        .addr = A_OSPI_QSPI_IOU_AXI_MUX_SEL,
 +        .reset = 0x1,
 +        .rsvd = 0xfffffffc,
 +        .pre_write = ospi_qspi_iou_axi_mux_sel_prew,
 +    },{ .name = "QSPI_IOU_COHERENT_CTRL",  .addr = A_QSPI_IOU_COHERENT_CTRL,
 +        .rsvd = 0xfffffff0,
 +    },{ .name = "QSPI_IOU_INTERCONNECT_ROUTE",
 +        .addr = A_QSPI_IOU_INTERCONNECT_ROUTE,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "QSPI_IOU_RAM",  .addr = A_QSPI_IOU_RAM,
 +        .reset = 0x1224,
 +        .rsvd = 0xffffc000,
 +    },{ .name = "QSPI_IOU_INTERCONNECT_QOS",
 +        .addr = A_QSPI_IOU_INTERCONNECT_QOS,
 +        .rsvd = 0xfffffff0,
 +    },{ .name = "OSPI_IOU_COHERENT_CTRL",  .addr = A_OSPI_IOU_COHERENT_CTRL,
 +        .rsvd = 0xfffffff0,
 +    },{ .name = "OSPI_IOU_INTERCONNECT_ROUTE",
 +        .addr = A_OSPI_IOU_INTERCONNECT_ROUTE,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "OSPI_IOU_RAM",  .addr = A_OSPI_IOU_RAM,
 +        .reset = 0xa,
 +        .rsvd = 0xffffffc0,
 +    },{ .name = "OSPI_IOU_INTERCONNECT_QOS",
 +        .addr = A_OSPI_IOU_INTERCONNECT_QOS,
 +        .rsvd = 0xfffffff0,
 +    },{ .name = "OSPI_REFCLK_DLY_CTRL",  .addr = A_OSPI_REFCLK_DLY_CTRL,
 +        .reset = 0x13,
 +        .rsvd = 0xffffffe0,
 +    },{ .name = "CUR_PWR_ST",  .addr = A_CUR_PWR_ST,
 +        .rsvd = 0xfffffffc,
 +        .ro = 0x3,
 +    },{ .name = "CONNECT_ST",  .addr = A_CONNECT_ST,
 +        .rsvd = 0xfffffffe,
 +        .ro = 0x1,
 +    },{ .name = "PW_STATE_REQ",  .addr = A_PW_STATE_REQ,
 +        .rsvd = 0xfffffffc,
 +    },{ .name = "HOST_U2_PORT_DISABLE",  .addr = A_HOST_U2_PORT_DISABLE,
 +        .rsvd = 0xfffffffe,
 +    },{ .name = "DBG_U2PMU",  .addr = A_DBG_U2PMU,
 +        .ro = 0xffffffff,
 +    },{ .name = "DBG_U2PMU_EXT1",  .addr = A_DBG_U2PMU_EXT1,
 +        .ro = 0xffffffff,
 +    },{ .name = "DBG_U2PMU_EXT2",  .addr = A_DBG_U2PMU_EXT2,
 +        .rsvd = 0xfffffff0,
 +        .ro = 0xf,
 +    },{ .name = "PME_GEN_U2PMU",  .addr = A_PME_GEN_U2PMU,
 +        .rsvd = 0xfffffffe,
 +        .ro = 0x1,
 +    },{ .name = "PWR_CONFIG_USB2",  .addr = A_PWR_CONFIG_USB2,
 +        .rsvd = 0xc0000000,
 +    },{ .name = "PHY_HUB",  .addr = A_PHY_HUB,
 +        .rsvd = 0xfffffffc,
 +        .ro = 0x2,
 +    },{ .name = "CTRL",  .addr = A_CTRL,
 +    },{ .name = "ISR",  .addr = A_ISR,
 +        .w1c = 0x1,
 +        .post_write = isr_postw,
 +    },{ .name = "IMR",  .addr = A_IMR,
 +        .reset = 0x1,
 +        .ro = 0x1,
 +    },{ .name = "IER",  .addr = A_IER,
 +        .pre_write = ier_prew,
 +    },{ .name = "IDR",  .addr = A_IDR,
 +        .pre_write = idr_prew,
 +    },{ .name = "ITR",  .addr = A_ITR,
 +        .pre_write = itr_prew,
 +    },{ .name = "PARITY_ISR",  .addr = A_PARITY_ISR,
 +        .w1c = 0x1fff,
 +        .post_write = parity_isr_postw,
 +    },{ .name = "PARITY_IMR",  .addr = A_PARITY_IMR,
 +        .reset = 0x1fff,
 +        .ro = 0x1fff,
 +    },{ .name = "PARITY_IER",  .addr = A_PARITY_IER,
 +        .pre_write = parity_ier_prew,
 +    },{ .name = "PARITY_IDR",  .addr = A_PARITY_IDR,
 +        .pre_write = parity_idr_prew,
 +    },{ .name = "PARITY_ITR",  .addr = A_PARITY_ITR,
 +        .pre_write = parity_itr_prew,
 +    },{ .name = "WPROT0",  .addr = A_WPROT0,
 +        .reset = 0x1,
 +    }
 +};
-+
++TRANS(FABD_s, do_fp3_scalar_2fn, a, &f_scalar_fabd, &f_scalar_ah_fabd, a->rn)
-+static void xlnx_versal_pmc_iou_slcr_reset_init(Object *obj, ResetType type)
-+{
+ static const FPScalar f_scalar_frecps = {
-+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(obj);
+     gen_helper_recpsf_f16,
-+    unsigned int i;
+@@ -XXX,XX +XXX,XX @@ static const FPScalar1Int f_scalar_fabs = {
-+
+     gen_vfp_abss,
-+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+     gen_vfp_absd,
-+        register_reset(&s->regs_info[i]);
+ };
-+    }
+-TRANS(FABS_s, do_fp1_scalar_int, a, &f_scalar_fabs, true)
-+}
++static const FPScalar1Int f_scalar_ah_fabs = {
-+
++    gen_vfp_ah_absh,
-+static void xlnx_versal_pmc_iou_slcr_reset_hold(Object *obj)
++    gen_vfp_ah_abss,
-+{
++    gen_vfp_ah_absd,
 +    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(obj);
 +
 +    parity_imr_update_irq(s);
 +    imr_update_irq(s);
 +
 +    /*
 +     * Setup OSPI_QSPI mux
 +     * By default axi slave interface is enabled for ospi-dma
 +     */
 +    qemu_set_irq(s->ospi_mux_sel, 0);
 +    qemu_set_irq(s->qspi_ospi_mux_sel, 1);
 +}
 +
 +static const MemoryRegionOps pmc_iou_slcr_ops = {
 +    .read = register_read_memory,
 +    .write = register_write_memory,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +};
-+
++TRANS(FABS_s, do_fp1_scalar_int_2fn, a, &f_scalar_fabs, &f_scalar_ah_fabs)
-+static void xlnx_versal_pmc_iou_slcr_realize(DeviceState *dev, Error **errp)
-+{
+ static const FPScalar1Int f_scalar_fneg = {
-+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(dev);
+     gen_vfp_negh,
 +
 +    qdev_init_gpio_out_named(dev, s->sd_emmc_sel, "sd-emmc-sel", 2);
 +    qdev_init_gpio_out_named(dev, &s->qspi_ospi_mux_sel,
 +                             "qspi-ospi-mux-sel", 1);
 +    qdev_init_gpio_out_named(dev, &s->ospi_mux_sel, "ospi-mux-sel", 1);
 +}
 +
 +static void xlnx_versal_pmc_iou_slcr_init(Object *obj)
 +{
 +    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    RegisterInfoArray *reg_array;
 +
 +    memory_region_init(&s->iomem, obj, TYPE_XILINX_VERSAL_PMC_IOU_SLCR,
 +                       XILINX_VERSAL_PMC_IOU_SLCR_R_MAX * 4);
 +    reg_array =
 +        register_init_block32(DEVICE(obj), pmc_iou_slcr_regs_info,
 +                              ARRAY_SIZE(pmc_iou_slcr_regs_info),
 +                              s->regs_info, s->regs,
 +                              &pmc_iou_slcr_ops,
 +                              XILINX_VERSAL_PMC_IOU_SLCR_ERR_DEBUG,
 +                              XILINX_VERSAL_PMC_IOU_SLCR_R_MAX * 4);
 +    memory_region_add_subregion(&s->iomem,
 +                                0x0,
 +                                &reg_array->mem);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +    sysbus_init_irq(sbd, &s->irq_parity_imr);
 +    sysbus_init_irq(sbd, &s->irq_imr);
 +}
 +
 +static const VMStateDescription vmstate_pmc_iou_slcr = {
 +    .name = TYPE_XILINX_VERSAL_PMC_IOU_SLCR,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32_ARRAY(regs, XlnxVersalPmcIouSlcr,
 +                             XILINX_VERSAL_PMC_IOU_SLCR_R_MAX),
 +        VMSTATE_END_OF_LIST(),
 +    }
 +};
 +
 +static void xlnx_versal_pmc_iou_slcr_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +
 +    dc->realize = xlnx_versal_pmc_iou_slcr_realize;
 +    dc->vmsd = &vmstate_pmc_iou_slcr;
 +    rc->phases.enter = xlnx_versal_pmc_iou_slcr_reset_init;
 +    rc->phases.hold  = xlnx_versal_pmc_iou_slcr_reset_hold;
 +}
 +
 +static const TypeInfo xlnx_versal_pmc_iou_slcr_info = {
 +    .name          = TYPE_XILINX_VERSAL_PMC_IOU_SLCR,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(XlnxVersalPmcIouSlcr),
 +    .class_init    = xlnx_versal_pmc_iou_slcr_class_init,
 +    .instance_init = xlnx_versal_pmc_iou_slcr_init,
 +};
 +
 +static void xlnx_versal_pmc_iou_slcr_register_types(void)
 +{
 +    type_register_static(&xlnx_versal_pmc_iou_slcr_info);
 +}
 +
 +type_init(xlnx_versal_pmc_iou_slcr_register_types)
 diff --git a/hw/misc/meson.build b/hw/misc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/meson.build
 +++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
  ))
  softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
  softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
 -softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-xramc.c'))
 +softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
 +  'xlnx-versal-xramc.c',
 +  'xlnx-versal-pmc-iou-slcr.c',
 +))
  softmmu_ss.add(when: 'CONFIG_STM32F2XX_SYSCFG', if_true: files('stm32f2xx_syscfg.c'))
  softmmu_ss.add(when: 'CONFIG_STM32F4XX_SYSCFG', if_true: files('stm32f4xx_syscfg.c'))
  softmmu_ss.add(when: 'CONFIG_STM32F4XX_EXTI', if_true: files('stm32f4xx_exti.c'))
 --
-.25.1
+.34.1

-New patch
+[PULL 32/68] target/arm: Handle FPCR.AH in vector FABD
+Split the handling of vector FABD so that it calls a different set
+of helpers when FPCR.AH is 1, which implement the "no negation of
+the sign of a NaN" semantics.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/helper.h            |  4 ++++
+ target/arm/tcg/translate-a64.c |  7 ++++++-
+ target/arm/tcg/vec_helper.c    | 23 +++++++++++++++++++++++
+files changed, 33 insertions(+), 1 deletion(-)
+diff --git a/target/arm/helper.h b/target/arm/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.h
++++ b/target/arm/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_fabd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+ DEF_HELPER_FLAGS_5(gvec_fabd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+ DEF_HELPER_FLAGS_5(gvec_fabd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_fabd_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_fabd_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_fabd_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
++
+ DEF_HELPER_FLAGS_5(gvec_fceq_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+ DEF_HELPER_FLAGS_5(gvec_fceq_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+ DEF_HELPER_FLAGS_5(gvec_fceq_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const f_vector_fabd[3] = {
+     gen_helper_gvec_fabd_s,
+     gen_helper_gvec_fabd_d,
+ };
+-TRANS(FABD_v, do_fp3_vector, a, 0, f_vector_fabd)
++static gen_helper_gvec_3_ptr * const f_vector_ah_fabd[3] = {
++    gen_helper_gvec_ah_fabd_h,
++    gen_helper_gvec_ah_fabd_s,
++    gen_helper_gvec_ah_fabd_d,
++};
++TRANS(FABD_v, do_fp3_vector_2fn, a, 0, f_vector_fabd, f_vector_ah_fabd)
+ static gen_helper_gvec_3_ptr * const f_vector_frecps[3] = {
+     gen_helper_gvec_recps_h,
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ static float64 float64_abd(float64 op1, float64 op2, float_status *stat)
+     return float64_abs(float64_sub(op1, op2, stat));
+ }
++/* ABD when FPCR.AH = 1: avoid flipping sign bit of a NaN result */
++static float16 float16_ah_abd(float16 op1, float16 op2, float_status *stat)
++{
++    float16 r = float16_sub(op1, op2, stat);
++    return float16_is_any_nan(r) ? r : float16_abs(r);
++}
++
++static float32 float32_ah_abd(float32 op1, float32 op2, float_status *stat)
++{
++    float32 r = float32_sub(op1, op2, stat);
++    return float32_is_any_nan(r) ? r : float32_abs(r);
++}
++
++static float64 float64_ah_abd(float64 op1, float64 op2, float_status *stat)
++{
++    float64 r = float64_sub(op1, op2, stat);
++    return float64_is_any_nan(r) ? r : float64_abs(r);
++}
++
+ /*
+  * Reciprocal step. These are the AArch32 version which uses a
+  * non-fused multiply-and-subtract.
+@@ -XXX,XX +XXX,XX @@ DO_3OP(gvec_fabd_h, float16_abd, float16)
+ DO_3OP(gvec_fabd_s, float32_abd, float32)
+ DO_3OP(gvec_fabd_d, float64_abd, float64)
++DO_3OP(gvec_ah_fabd_h, float16_ah_abd, float16)
++DO_3OP(gvec_ah_fabd_s, float32_ah_abd, float32)
++DO_3OP(gvec_ah_fabd_d, float64_ah_abd, float64)
++
+ DO_3OP(gvec_fceq_h, float16_ceq, float16)
+ DO_3OP(gvec_fceq_s, float32_ceq, float32)
+ DO_3OP(gvec_fceq_d, float64_ceq, float64)
+--
+.34.1

-New patch
+[PULL 33/68] target/arm: Handle FPCR.AH in SVE FNEG
+Make SVE FNEG honour the FPCR.AH "don't negate the sign of a NaN"
+semantics.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/helper-sve.h    | 4 ++++
+ target/arm/tcg/sve_helper.c    | 8 ++++++++
+ target/arm/tcg/translate-sve.c | 7 ++++++-
+files changed, 18 insertions(+), 1 deletion(-)
+diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-sve.h
++++ b/target/arm/tcg/helper-sve.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(sve_fneg_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(sve_fneg_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(sve_fneg_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
++DEF_HELPER_FLAGS_4(sve_ah_fneg_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
++DEF_HELPER_FLAGS_4(sve_ah_fneg_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
++DEF_HELPER_FLAGS_4(sve_ah_fneg_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
++
+ DEF_HELPER_FLAGS_4(sve_not_zpz_b, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(sve_not_zpz_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(sve_not_zpz_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sve_helper.c
++++ b/target/arm/tcg/sve_helper.c
+@@ -XXX,XX +XXX,XX @@ DO_ZPZ(sve_fneg_h, uint16_t, H1_2, DO_FNEG)
+ DO_ZPZ(sve_fneg_s, uint32_t, H1_4, DO_FNEG)
+ DO_ZPZ_D(sve_fneg_d, uint64_t, DO_FNEG)
++#define DO_AH_FNEG_H(N) (float16_is_any_nan(N) ? (N) : DO_FNEG(N))
++#define DO_AH_FNEG_S(N) (float32_is_any_nan(N) ? (N) : DO_FNEG(N))
++#define DO_AH_FNEG_D(N) (float64_is_any_nan(N) ? (N) : DO_FNEG(N))
++
++DO_ZPZ(sve_ah_fneg_h, uint16_t, H1_2, DO_AH_FNEG_H)
++DO_ZPZ(sve_ah_fneg_s, uint32_t, H1_4, DO_AH_FNEG_S)
++DO_ZPZ_D(sve_ah_fneg_d, uint64_t, DO_AH_FNEG_D)
++
+ #define DO_NOT(N)    (~N)
+ DO_ZPZ(sve_not_zpz_b, uint8_t, H1, DO_NOT)
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3 * const fneg_fns[4] = {
+     NULL,                  gen_helper_sve_fneg_h,
+     gen_helper_sve_fneg_s, gen_helper_sve_fneg_d,
+ };
+-TRANS_FEAT(FNEG, aa64_sve, gen_gvec_ool_arg_zpz, fneg_fns[a->esz], a, 0)
++static gen_helper_gvec_3 * const fneg_ah_fns[4] = {
++    NULL,                  gen_helper_sve_ah_fneg_h,
++    gen_helper_sve_ah_fneg_s, gen_helper_sve_ah_fneg_d,
++};
++TRANS_FEAT(FNEG, aa64_sve, gen_gvec_ool_arg_zpz,
++           s->fpcr_ah ? fneg_ah_fns[a->esz] : fneg_fns[a->esz], a, 0)
+ static gen_helper_gvec_3 * const sxtb_fns[4] = {
+     NULL,                  gen_helper_sve_sxtb_h,
+--
+.34.1

-New patch
+[PULL 34/68] target/arm: Handle FPCR.AH in SVE FABS
+Make SVE FABS honour the FPCR.AH "don't negate the sign of a NaN"
+semantics.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/helper-sve.h    | 4 ++++
+ target/arm/tcg/sve_helper.c    | 8 ++++++++
+ target/arm/tcg/translate-sve.c | 7 ++++++-
+files changed, 18 insertions(+), 1 deletion(-)
+diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-sve.h
++++ b/target/arm/tcg/helper-sve.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(sve_fabs_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(sve_fabs_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(sve_fabs_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
++DEF_HELPER_FLAGS_4(sve_ah_fabs_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
++DEF_HELPER_FLAGS_4(sve_ah_fabs_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
++DEF_HELPER_FLAGS_4(sve_ah_fabs_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
++
+ DEF_HELPER_FLAGS_4(sve_fneg_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(sve_fneg_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_4(sve_fneg_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, i32)
+diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sve_helper.c
++++ b/target/arm/tcg/sve_helper.c
+@@ -XXX,XX +XXX,XX @@ DO_ZPZ(sve_fabs_h, uint16_t, H1_2, DO_FABS)
+ DO_ZPZ(sve_fabs_s, uint32_t, H1_4, DO_FABS)
+ DO_ZPZ_D(sve_fabs_d, uint64_t, DO_FABS)
++#define DO_AH_FABS_H(N) (float16_is_any_nan(N) ? (N) : DO_FABS(N))
++#define DO_AH_FABS_S(N) (float32_is_any_nan(N) ? (N) : DO_FABS(N))
++#define DO_AH_FABS_D(N) (float64_is_any_nan(N) ? (N) : DO_FABS(N))
++
++DO_ZPZ(sve_ah_fabs_h, uint16_t, H1_2, DO_AH_FABS_H)
++DO_ZPZ(sve_ah_fabs_s, uint32_t, H1_4, DO_AH_FABS_S)
++DO_ZPZ_D(sve_ah_fabs_d, uint64_t, DO_AH_FABS_D)
++
+ #define DO_FNEG(N)    (N ^ ~((__typeof(N))-1 >> 1))
+ DO_ZPZ(sve_fneg_h, uint16_t, H1_2, DO_FNEG)
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3 * const fabs_fns[4] = {
+     NULL,                  gen_helper_sve_fabs_h,
+     gen_helper_sve_fabs_s, gen_helper_sve_fabs_d,
+ };
+-TRANS_FEAT(FABS, aa64_sve, gen_gvec_ool_arg_zpz, fabs_fns[a->esz], a, 0)
++static gen_helper_gvec_3 * const fabs_ah_fns[4] = {
++    NULL,                  gen_helper_sve_ah_fabs_h,
++    gen_helper_sve_ah_fabs_s, gen_helper_sve_ah_fabs_d,
++};
++TRANS_FEAT(FABS, aa64_sve, gen_gvec_ool_arg_zpz,
++           s->fpcr_ah ? fabs_ah_fns[a->esz] : fabs_fns[a->esz], a, 0)
+ static gen_helper_gvec_3 * const fneg_fns[4] = {
+     NULL,                  gen_helper_sve_fneg_h,
+--
+.34.1

-New patch
+[PULL 35/68] target/arm: Handle FPCR.AH in SVE FABD
+Make the SVE FABD insn honour the FPCR.AH "don't negate the sign
+of a NaN" semantics.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/helper-sve.h    |  7 +++++++
+ target/arm/tcg/sve_helper.c    | 22 ++++++++++++++++++++++
+ target/arm/tcg/translate-sve.c |  2 +-
+files changed, 30 insertions(+), 1 deletion(-)
+diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-sve.h
++++ b/target/arm/tcg/helper-sve.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_6(sve_fabd_s, TCG_CALL_NO_RWG,
+ DEF_HELPER_FLAGS_6(sve_fabd_d, TCG_CALL_NO_RWG,
+                    void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fabd_h, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fabd_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(sve_ah_fabd_d, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++
+ DEF_HELPER_FLAGS_6(sve_fscalbn_h, TCG_CALL_NO_RWG,
+                    void, ptr, ptr, ptr, ptr, fpst, i32)
+ DEF_HELPER_FLAGS_6(sve_fscalbn_s, TCG_CALL_NO_RWG,
+diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sve_helper.c
++++ b/target/arm/tcg/sve_helper.c
+@@ -XXX,XX +XXX,XX @@ static inline float64 abd_d(float64 a, float64 b, float_status *s)
+     return float64_abs(float64_sub(a, b, s));
+ }
++/* ABD when FPCR.AH = 1: avoid flipping sign bit of a NaN result */
++static float16 ah_abd_h(float16 op1, float16 op2, float_status *stat)
++{
++    float16 r = float16_sub(op1, op2, stat);
++    return float16_is_any_nan(r) ? r : float16_abs(r);
++}
++
++static float32 ah_abd_s(float32 op1, float32 op2, float_status *stat)
++{
++    float32 r = float32_sub(op1, op2, stat);
++    return float32_is_any_nan(r) ? r : float32_abs(r);
++}
++
++static float64 ah_abd_d(float64 op1, float64 op2, float_status *stat)
++{
++    float64 r = float64_sub(op1, op2, stat);
++    return float64_is_any_nan(r) ? r : float64_abs(r);
++}
++
+ DO_ZPZZ_FP(sve_fabd_h, uint16_t, H1_2, abd_h)
+ DO_ZPZZ_FP(sve_fabd_s, uint32_t, H1_4, abd_s)
+ DO_ZPZZ_FP(sve_fabd_d, uint64_t, H1_8, abd_d)
++DO_ZPZZ_FP(sve_ah_fabd_h, uint16_t, H1_2, ah_abd_h)
++DO_ZPZZ_FP(sve_ah_fabd_s, uint32_t, H1_4, ah_abd_s)
++DO_ZPZZ_FP(sve_ah_fabd_d, uint64_t, H1_8, ah_abd_d)
+ static inline float64 scalbn_d(float64 a, int64_t b, float_status *s)
+ {
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ DO_ZPZZ_AH_FP(FMIN_zpzz, aa64_sve, sve_fmin, sve_ah_fmin)
+ DO_ZPZZ_AH_FP(FMAX_zpzz, aa64_sve, sve_fmax, sve_ah_fmax)
+ DO_ZPZZ_FP(FMINNM_zpzz, aa64_sve, sve_fminnum)
+ DO_ZPZZ_FP(FMAXNM_zpzz, aa64_sve, sve_fmaxnum)
+-DO_ZPZZ_FP(FABD, aa64_sve, sve_fabd)
++DO_ZPZZ_AH_FP(FABD, aa64_sve, sve_fabd, sve_ah_fabd)
+ DO_ZPZZ_FP(FSCALE, aa64_sve, sve_fscalbn)
+ DO_ZPZZ_FP(FDIV, aa64_sve, sve_fdiv)
+ DO_ZPZZ_FP(FMULX, aa64_sve, sve_fmulx)
+--
+.34.1

-New patch
+[PULL 36/68] target/arm: Handle FPCR.AH in negation steps in SVE FCADD
+The negation steps in FCADD must honour FPCR.AH's "don't change the
+sign of a NaN" semantics.  Implement this in the same way we did for
+the base ASIMD FCADD, by encoding FPCR.AH into the SIMD data field
+passed to the helper and using that to decide whether to negate the
+values.
+The construction of neg_imag and neg_real were done to make it easy
+to apply both in parallel with two simple logical operations.  This
+changed with FPCR.AH, which is more complex than that. Switch to
+an approach that follows the pseudocode more closely, by extracting
+the 'rot=1' parameter from the SIMD data field and changing the
+sign of the appropriate input value.
+Note that there was a naming issue with neg_imag and neg_real.
+They were named backward, with neg_imag being non-zero for rot=1,
+and vice versa.  This was combined with reversed usage within the
+loop, so that the negation in the end turned out correct.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/vec_internal.h  | 17 ++++++++++++++
+ target/arm/tcg/sve_helper.c    | 42 ++++++++++++++++++++++++----------
+ target/arm/tcg/translate-sve.c |  2 +-
+files changed, 48 insertions(+), 13 deletions(-)
+diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_internal.h
++++ b/target/arm/tcg/vec_internal.h
+@@ -XXX,XX +XXX,XX @@
+ #ifndef TARGET_ARM_VEC_INTERNAL_H
+ #define TARGET_ARM_VEC_INTERNAL_H
++#include "fpu/softfloat.h"
++
+ /*
+  * Note that vector data is stored in host-endian 64-bit chunks,
+  * so addressing units smaller than that needs a host-endian fixup.
+@@ -XXX,XX +XXX,XX @@ float32 bfdotadd_ebf(float32 sum, uint32_t e1, uint32_t e2,
+  */
+ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp);
++static inline float16 float16_maybe_ah_chs(float16 a, bool fpcr_ah)
++{
++    return fpcr_ah && float16_is_any_nan(a) ? a : float16_chs(a);
++}
++
++static inline float32 float32_maybe_ah_chs(float32 a, bool fpcr_ah)
++{
++    return fpcr_ah && float32_is_any_nan(a) ? a : float32_chs(a);
++}
++
++static inline float64 float64_maybe_ah_chs(float64 a, bool fpcr_ah)
++{
++    return fpcr_ah && float64_is_any_nan(a) ? a : float64_chs(a);
++}
++
+ #endif /* TARGET_ARM_VEC_INTERNAL_H */
+diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sve_helper.c
++++ b/target/arm/tcg/sve_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_h)(void *vd, void *vn, void *vm, void *vg,
+ {
+     intptr_t j, i = simd_oprsz(desc);
+     uint64_t *g = vg;
+-    float16 neg_imag = float16_set_sign(0, simd_data(desc));
+-    float16 neg_real = float16_chs(neg_imag);
++    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
++    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+     do {
+         uint64_t pg = g[(i - 1) >> 6];
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_h)(void *vd, void *vn, void *vm, void *vg,
+             i -= 2 * sizeof(float16);
+             e0 = *(float16 *)(vn + H1_2(i));
+-            e1 = *(float16 *)(vm + H1_2(j)) ^ neg_real;
++            e1 = *(float16 *)(vm + H1_2(j));
+             e2 = *(float16 *)(vn + H1_2(j));
+-            e3 = *(float16 *)(vm + H1_2(i)) ^ neg_imag;
++            e3 = *(float16 *)(vm + H1_2(i));
++
++            if (rot) {
++                e3 = float16_maybe_ah_chs(e3, fpcr_ah);
++            } else {
++                e1 = float16_maybe_ah_chs(e1, fpcr_ah);
++            }
+             if (likely((pg >> (i & 63)) & 1)) {
+                 *(float16 *)(vd + H1_2(i)) = float16_add(e0, e1, s);
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_s)(void *vd, void *vn, void *vm, void *vg,
+ {
+     intptr_t j, i = simd_oprsz(desc);
+     uint64_t *g = vg;
+-    float32 neg_imag = float32_set_sign(0, simd_data(desc));
+-    float32 neg_real = float32_chs(neg_imag);
++    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
++    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+     do {
+         uint64_t pg = g[(i - 1) >> 6];
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_s)(void *vd, void *vn, void *vm, void *vg,
+             i -= 2 * sizeof(float32);
+             e0 = *(float32 *)(vn + H1_2(i));
+-            e1 = *(float32 *)(vm + H1_2(j)) ^ neg_real;
++            e1 = *(float32 *)(vm + H1_2(j));
+             e2 = *(float32 *)(vn + H1_2(j));
+-            e3 = *(float32 *)(vm + H1_2(i)) ^ neg_imag;
++            e3 = *(float32 *)(vm + H1_2(i));
++
++            if (rot) {
++                e3 = float32_maybe_ah_chs(e3, fpcr_ah);
++            } else {
++                e1 = float32_maybe_ah_chs(e1, fpcr_ah);
++            }
+             if (likely((pg >> (i & 63)) & 1)) {
+                 *(float32 *)(vd + H1_2(i)) = float32_add(e0, e1, s);
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_d)(void *vd, void *vn, void *vm, void *vg,
+ {
+     intptr_t j, i = simd_oprsz(desc);
+     uint64_t *g = vg;
+-    float64 neg_imag = float64_set_sign(0, simd_data(desc));
+-    float64 neg_real = float64_chs(neg_imag);
++    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
++    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+     do {
+         uint64_t pg = g[(i - 1) >> 6];
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_d)(void *vd, void *vn, void *vm, void *vg,
+             i -= 2 * sizeof(float64);
+             e0 = *(float64 *)(vn + H1_2(i));
+-            e1 = *(float64 *)(vm + H1_2(j)) ^ neg_real;
++            e1 = *(float64 *)(vm + H1_2(j));
+             e2 = *(float64 *)(vn + H1_2(j));
+-            e3 = *(float64 *)(vm + H1_2(i)) ^ neg_imag;
++            e3 = *(float64 *)(vm + H1_2(i));
++
++            if (rot) {
++                e3 = float64_maybe_ah_chs(e3, fpcr_ah);
++            } else {
++                e1 = float64_maybe_ah_chs(e1, fpcr_ah);
++            }
+             if (likely((pg >> (i & 63)) & 1)) {
+                 *(float64 *)(vd + H1_2(i)) = float64_add(e0, e1, s);
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_4_ptr * const fcadd_fns[] = {
+     gen_helper_sve_fcadd_s, gen_helper_sve_fcadd_d,
+ };
+ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
+-           a->rd, a->rn, a->rm, a->pg, a->rot,
++           a->rd, a->rn, a->rm, a->pg, a->rot | (s->fpcr_ah << 1),
+            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ #define DO_FMLA(NAME, name) \
+--
+.34.1

-New patch
+[PULL 37/68] target/arm: Handle FPCR.AH in negation steps in FCADD
+The negation steps in FCADD must honour FPCR.AH's "don't change the
+sign of a NaN" semantics.  Implement this by encoding FPCR.AH into
+the SIMD data field passed to the helper and using that to decide
+whether to negate the values.
+The construction of neg_imag and neg_real were done to make it easy
+to apply both in parallel with two simple logical operations.  This
+changed with FPCR.AH, which is more complex than that. Switch to
+an approach closer to the pseudocode, where we extract the rot
+parameter from the SIMD data word and negate the appropriate
+input value.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/translate-a64.c | 10 +++++--
+ target/arm/tcg/vec_helper.c    | 54 +++++++++++++++++++---------------
+files changed, 38 insertions(+), 26 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const f_vector_fcadd[3] = {
+     gen_helper_gvec_fcadds,
+     gen_helper_gvec_fcaddd,
+ };
+-TRANS_FEAT(FCADD_90, aa64_fcma, do_fp3_vector, a, 0, f_vector_fcadd)
+-TRANS_FEAT(FCADD_270, aa64_fcma, do_fp3_vector, a, 1, f_vector_fcadd)
++/*
++ * Encode FPCR.AH into the data so the helper knows whether the
++ * negations it does should avoid flipping the sign bit on a NaN
++ */
++TRANS_FEAT(FCADD_90, aa64_fcma, do_fp3_vector, a, 0 | (s->fpcr_ah << 1),
++           f_vector_fcadd)
++TRANS_FEAT(FCADD_270, aa64_fcma, do_fp3_vector, a, 1 | (s->fpcr_ah << 1),
++           f_vector_fcadd)
+ static bool trans_FCMLA_v(DisasContext *s, arg_FCMLA_v *a)
+ {
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcaddh)(void *vd, void *vn, void *vm,
+     float16 *d = vd;
+     float16 *n = vn;
+     float16 *m = vm;
+-    uint32_t neg_real = extract32(desc, SIMD_DATA_SHIFT, 1);
+-    uint32_t neg_imag = neg_real ^ 1;
++    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
++    bool fpcr_ah = extract64(desc, SIMD_DATA_SHIFT + 1, 1);
+     uintptr_t i;
+-    /* Shift boolean to the sign bit so we can xor to negate.  */
+-    neg_real <<= 15;
+-    neg_imag <<= 15;
+-
+     for (i = 0; i < opr_sz / 2; i += 2) {
+         float16 e0 = n[H2(i)];
+-        float16 e1 = m[H2(i + 1)] ^ neg_imag;
++        float16 e1 = m[H2(i + 1)];
+         float16 e2 = n[H2(i + 1)];
+-        float16 e3 = m[H2(i)] ^ neg_real;
++        float16 e3 = m[H2(i)];
++
++        if (rot) {
++            e3 = float16_maybe_ah_chs(e3, fpcr_ah);
++        } else {
++            e1 = float16_maybe_ah_chs(e1, fpcr_ah);
++        }
+         d[H2(i)] = float16_add(e0, e1, fpst);
+         d[H2(i + 1)] = float16_add(e2, e3, fpst);
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcadds)(void *vd, void *vn, void *vm,
+     float32 *d = vd;
+     float32 *n = vn;
+     float32 *m = vm;
+-    uint32_t neg_real = extract32(desc, SIMD_DATA_SHIFT, 1);
+-    uint32_t neg_imag = neg_real ^ 1;
++    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
++    bool fpcr_ah = extract64(desc, SIMD_DATA_SHIFT + 1, 1);
+     uintptr_t i;
+-    /* Shift boolean to the sign bit so we can xor to negate.  */
+-    neg_real <<= 31;
+-    neg_imag <<= 31;
+-
+     for (i = 0; i < opr_sz / 4; i += 2) {
+         float32 e0 = n[H4(i)];
+-        float32 e1 = m[H4(i + 1)] ^ neg_imag;
++        float32 e1 = m[H4(i + 1)];
+         float32 e2 = n[H4(i + 1)];
+-        float32 e3 = m[H4(i)] ^ neg_real;
++        float32 e3 = m[H4(i)];
++
++        if (rot) {
++            e3 = float32_maybe_ah_chs(e3, fpcr_ah);
++        } else {
++            e1 = float32_maybe_ah_chs(e1, fpcr_ah);
++        }
+         d[H4(i)] = float32_add(e0, e1, fpst);
+         d[H4(i + 1)] = float32_add(e2, e3, fpst);
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcaddd)(void *vd, void *vn, void *vm,
+     float64 *d = vd;
+     float64 *n = vn;
+     float64 *m = vm;
+-    uint64_t neg_real = extract64(desc, SIMD_DATA_SHIFT, 1);
+-    uint64_t neg_imag = neg_real ^ 1;
++    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
++    bool fpcr_ah = extract64(desc, SIMD_DATA_SHIFT + 1, 1);
+     uintptr_t i;
+-    /* Shift boolean to the sign bit so we can xor to negate.  */
+-    neg_real <<= 63;
+-    neg_imag <<= 63;
+-
+     for (i = 0; i < opr_sz / 8; i += 2) {
+         float64 e0 = n[i];
+-        float64 e1 = m[i + 1] ^ neg_imag;
++        float64 e1 = m[i + 1];
+         float64 e2 = n[i + 1];
+-        float64 e3 = m[i] ^ neg_real;
++        float64 e3 = m[i];
++
++        if (rot) {
++            e3 = float64_maybe_ah_chs(e3, fpcr_ah);
++        } else {
++            e1 = float64_maybe_ah_chs(e1, fpcr_ah);
++        }
+         d[i] = float64_add(e0, e1, fpst);
+         d[i + 1] = float64_add(e2, e3, fpst);
+--
+.34.1

-New patch
+[PULL 38/68] target/arm: Handle FPCR.AH in FRECPS and FRSQRTS scalar insns
+Handle the FPCR.AH semantics that we do not change the sign of an
+input NaN in the FRECPS and FRSQRTS scalar insns, by providing
+new helper functions that do the CHS part of the operation
+differently.
+Since the extra helper functions would be very repetitive if written
+out longhand, we condense them and the existing non-AH helpers into
+being emitted via macros.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/helper-a64.h    |   6 ++
+ target/arm/tcg/vec_internal.h  |  18 ++++++
+ target/arm/tcg/helper-a64.c    | 115 ++++++++++++---------------------
+ target/arm/tcg/translate-a64.c |  25 +++++--
+files changed, 83 insertions(+), 81 deletions(-)
+diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-a64.h
++++ b/target/arm/tcg/helper-a64.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(neon_cgt_f64, TCG_CALL_NO_RWG, i64, i64, i64, fpst)
+ DEF_HELPER_FLAGS_3(recpsf_f16, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+ DEF_HELPER_FLAGS_3(recpsf_f32, TCG_CALL_NO_RWG, f32, f32, f32, fpst)
+ DEF_HELPER_FLAGS_3(recpsf_f64, TCG_CALL_NO_RWG, f64, f64, f64, fpst)
++DEF_HELPER_FLAGS_3(recpsf_ah_f16, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
++DEF_HELPER_FLAGS_3(recpsf_ah_f32, TCG_CALL_NO_RWG, f32, f32, f32, fpst)
++DEF_HELPER_FLAGS_3(recpsf_ah_f64, TCG_CALL_NO_RWG, f64, f64, f64, fpst)
+ DEF_HELPER_FLAGS_3(rsqrtsf_f16, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+ DEF_HELPER_FLAGS_3(rsqrtsf_f32, TCG_CALL_NO_RWG, f32, f32, f32, fpst)
+ DEF_HELPER_FLAGS_3(rsqrtsf_f64, TCG_CALL_NO_RWG, f64, f64, f64, fpst)
++DEF_HELPER_FLAGS_3(rsqrtsf_ah_f16, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
++DEF_HELPER_FLAGS_3(rsqrtsf_ah_f32, TCG_CALL_NO_RWG, f32, f32, f32, fpst)
++DEF_HELPER_FLAGS_3(rsqrtsf_ah_f64, TCG_CALL_NO_RWG, f64, f64, f64, fpst)
+ DEF_HELPER_FLAGS_2(frecpx_f64, TCG_CALL_NO_RWG, f64, f64, fpst)
+ DEF_HELPER_FLAGS_2(frecpx_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
+ DEF_HELPER_FLAGS_2(frecpx_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
+diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_internal.h
++++ b/target/arm/tcg/vec_internal.h
+@@ -XXX,XX +XXX,XX @@ float32 bfdotadd_ebf(float32 sum, uint32_t e1, uint32_t e2,
+  */
+ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp);
++/*
++ * Negate as for FPCR.AH=1 -- do not negate NaNs.
++ */
++static inline float16 float16_ah_chs(float16 a)
++{
++    return float16_is_any_nan(a) ? a : float16_chs(a);
++}
++
++static inline float32 float32_ah_chs(float32 a)
++{
++    return float32_is_any_nan(a) ? a : float32_chs(a);
++}
++
++static inline float64 float64_ah_chs(float64 a)
++{
++    return float64_is_any_nan(a) ? a : float64_chs(a);
++}
++
+ static inline float16 float16_maybe_ah_chs(float16 a, bool fpcr_ah)
+ {
+     return fpcr_ah && float16_is_any_nan(a) ? a : float16_chs(a);
+diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-a64.c
++++ b/target/arm/tcg/helper-a64.c
+@@ -XXX,XX +XXX,XX @@
+ #ifdef CONFIG_USER_ONLY
+ #include "user/page-protection.h"
+ #endif
++#include "vec_internal.h"
+ /* C2.4.7 Multiply and divide */
+ /* special cases for 0 and LLONG_MIN are mandated by the standard */
+@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_cgt_f64)(float64 a, float64 b, float_status *fpst)
+     return -float64_lt(b, a, fpst);
+ }
+-/* Reciprocal step and sqrt step. Note that unlike the A32/T32
++/*
++ * Reciprocal step and sqrt step. Note that unlike the A32/T32
+  * versions, these do a fully fused multiply-add or
+  * multiply-add-and-halve.
++ * The FPCR.AH == 1 versions need to avoid flipping the sign of NaN.
+  */
+-
+-uint32_t HELPER(recpsf_f16)(uint32_t a, uint32_t b, float_status *fpst)
+-{
+-    a = float16_squash_input_denormal(a, fpst);
+-    b = float16_squash_input_denormal(b, fpst);
+-
+-    a = float16_chs(a);
+-    if ((float16_is_infinity(a) && float16_is_zero(b)) ||
+-        (float16_is_infinity(b) && float16_is_zero(a))) {
+-        return float16_two;
++#define DO_RECPS(NAME, CTYPE, FLOATTYPE, CHSFN)                         \
++    CTYPE HELPER(NAME)(CTYPE a, CTYPE b, float_status *fpst)            \
++    {                                                                   \
++        a = FLOATTYPE ## _squash_input_denormal(a, fpst);               \
++        b = FLOATTYPE ## _squash_input_denormal(b, fpst);               \
++        a = FLOATTYPE ## _ ## CHSFN(a);                                 \
++        if ((FLOATTYPE ## _is_infinity(a) && FLOATTYPE ## _is_zero(b)) || \
++            (FLOATTYPE ## _is_infinity(b) && FLOATTYPE ## _is_zero(a))) { \
++            return FLOATTYPE ## _two;                                   \
++        }                                                               \
++        return FLOATTYPE ## _muladd(a, b, FLOATTYPE ## _two, 0, fpst);  \
+     }
+-    return float16_muladd(a, b, float16_two, 0, fpst);
+-}
+-float32 HELPER(recpsf_f32)(float32 a, float32 b, float_status *fpst)
+-{
+-    a = float32_squash_input_denormal(a, fpst);
+-    b = float32_squash_input_denormal(b, fpst);
++DO_RECPS(recpsf_f16, uint32_t, float16, chs)
++DO_RECPS(recpsf_f32, float32, float32, chs)
++DO_RECPS(recpsf_f64, float64, float64, chs)
++DO_RECPS(recpsf_ah_f16, uint32_t, float16, ah_chs)
++DO_RECPS(recpsf_ah_f32, float32, float32, ah_chs)
++DO_RECPS(recpsf_ah_f64, float64, float64, ah_chs)
+-    a = float32_chs(a);
+-    if ((float32_is_infinity(a) && float32_is_zero(b)) ||
+-        (float32_is_infinity(b) && float32_is_zero(a))) {
+-        return float32_two;
+-    }
+-    return float32_muladd(a, b, float32_two, 0, fpst);
+-}
++#define DO_RSQRTSF(NAME, CTYPE, FLOATTYPE, CHSFN)                       \
++    CTYPE HELPER(NAME)(CTYPE a, CTYPE b, float_status *fpst)            \
++    {                                                                   \
++        a = FLOATTYPE ## _squash_input_denormal(a, fpst);               \
++        b = FLOATTYPE ## _squash_input_denormal(b, fpst);               \
++        a = FLOATTYPE ## _ ## CHSFN(a);                                 \
++        if ((FLOATTYPE ## _is_infinity(a) && FLOATTYPE ## _is_zero(b)) || \
++            (FLOATTYPE ## _is_infinity(b) && FLOATTYPE ## _is_zero(a))) { \
++            return FLOATTYPE ## _one_point_five;                        \
++        }                                                               \
++        return FLOATTYPE ## _muladd_scalbn(a, b, FLOATTYPE ## _three,   \
++                                           -1, 0, fpst);                \
++    }                                                                   \
+-float64 HELPER(recpsf_f64)(float64 a, float64 b, float_status *fpst)
+-{
+-    a = float64_squash_input_denormal(a, fpst);
+-    b = float64_squash_input_denormal(b, fpst);
+-
+-    a = float64_chs(a);
+-    if ((float64_is_infinity(a) && float64_is_zero(b)) ||
+-        (float64_is_infinity(b) && float64_is_zero(a))) {
+-        return float64_two;
+-    }
+-    return float64_muladd(a, b, float64_two, 0, fpst);
+-}
+-
+-uint32_t HELPER(rsqrtsf_f16)(uint32_t a, uint32_t b, float_status *fpst)
+-{
+-    a = float16_squash_input_denormal(a, fpst);
+-    b = float16_squash_input_denormal(b, fpst);
+-
+-    a = float16_chs(a);
+-    if ((float16_is_infinity(a) && float16_is_zero(b)) ||
+-        (float16_is_infinity(b) && float16_is_zero(a))) {
+-        return float16_one_point_five;
+-    }
+-    return float16_muladd_scalbn(a, b, float16_three, -1, 0, fpst);
+-}
+-
+-float32 HELPER(rsqrtsf_f32)(float32 a, float32 b, float_status *fpst)
+-{
+-    a = float32_squash_input_denormal(a, fpst);
+-    b = float32_squash_input_denormal(b, fpst);
+-
+-    a = float32_chs(a);
+-    if ((float32_is_infinity(a) && float32_is_zero(b)) ||
+-        (float32_is_infinity(b) && float32_is_zero(a))) {
+-        return float32_one_point_five;
+-    }
+-    return float32_muladd_scalbn(a, b, float32_three, -1, 0, fpst);
+-}
+-
+-float64 HELPER(rsqrtsf_f64)(float64 a, float64 b, float_status *fpst)
+-{
+-    a = float64_squash_input_denormal(a, fpst);
+-    b = float64_squash_input_denormal(b, fpst);
+-
+-    a = float64_chs(a);
+-    if ((float64_is_infinity(a) && float64_is_zero(b)) ||
+-        (float64_is_infinity(b) && float64_is_zero(a))) {
+-        return float64_one_point_five;
+-    }
+-    return float64_muladd_scalbn(a, b, float64_three, -1, 0, fpst);
+-}
++DO_RSQRTSF(rsqrtsf_f16, uint32_t, float16, chs)
++DO_RSQRTSF(rsqrtsf_f32, float32, float32, chs)
++DO_RSQRTSF(rsqrtsf_f64, float64, float64, chs)
++DO_RSQRTSF(rsqrtsf_ah_f16, uint32_t, float16, ah_chs)
++DO_RSQRTSF(rsqrtsf_ah_f32, float32, float32, ah_chs)
++DO_RSQRTSF(rsqrtsf_ah_f64, float64, float64, ah_chs)
+ /* Floating-point reciprocal exponent - see FPRecpX in ARM ARM */
+ uint32_t HELPER(frecpx_f16)(uint32_t a, float_status *fpst)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f,
+                                        FPST_A64_F16 : FPST_A64);
+ }
+-static bool do_fp3_scalar_ah(DisasContext *s, arg_rrr_e *a, const FPScalar *f,
+-                             int mergereg)
++static bool do_fp3_scalar_ah_2fn(DisasContext *s, arg_rrr_e *a,
++                                 const FPScalar *fnormal, const FPScalar *fah,
++                                 int mergereg)
+ {
+-    return do_fp3_scalar_with_fpsttype(s, a, f, mergereg,
+-                                       select_ah_fpst(s, a->esz));
++    return do_fp3_scalar_with_fpsttype(s, a, s->fpcr_ah ? fah : fnormal,
++                                       mergereg, select_ah_fpst(s, a->esz));
+ }
+ /* Some insns need to call different helpers when FPCR.AH == 1 */
+@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_frecps = {
+     gen_helper_recpsf_f32,
+     gen_helper_recpsf_f64,
+ };
+-TRANS(FRECPS_s, do_fp3_scalar_ah, a, &f_scalar_frecps, a->rn)
++static const FPScalar f_scalar_ah_frecps = {
++    gen_helper_recpsf_ah_f16,
++    gen_helper_recpsf_ah_f32,
++    gen_helper_recpsf_ah_f64,
++};
++TRANS(FRECPS_s, do_fp3_scalar_ah_2fn, a,
++      &f_scalar_frecps, &f_scalar_ah_frecps, a->rn)
+ static const FPScalar f_scalar_frsqrts = {
+     gen_helper_rsqrtsf_f16,
+     gen_helper_rsqrtsf_f32,
+     gen_helper_rsqrtsf_f64,
+ };
+-TRANS(FRSQRTS_s, do_fp3_scalar_ah, a, &f_scalar_frsqrts, a->rn)
++static const FPScalar f_scalar_ah_frsqrts = {
++    gen_helper_rsqrtsf_ah_f16,
++    gen_helper_rsqrtsf_ah_f32,
++    gen_helper_rsqrtsf_ah_f64,
++};
++TRANS(FRSQRTS_s, do_fp3_scalar_ah_2fn, a,
++      &f_scalar_frsqrts, &f_scalar_ah_frsqrts, a->rn)
+ static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
+                        const FPScalar *f, bool swap)
+--
+.34.1

-New patch
+[PULL 39/68] target/arm: Handle FPCR.AH in FRECPS and FRSQRTS vector insns
+Handle the FPCR.AH "don't negate the sign of a NaN" semantics
+in the vector versions of FRECPS and FRSQRTS, by implementing
+new vector wrappers that call the _ah_ scalar helpers.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/tcg/helper-sve.h    | 14 ++++++++++++++
+ target/arm/tcg/translate-a64.c | 21 ++++++++++++++++-----
+ target/arm/tcg/translate-sve.c |  7 ++++++-
+ target/arm/tcg/vec_helper.c    |  8 ++++++++
+files changed, 44 insertions(+), 6 deletions(-)
+diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/helper-sve.h
++++ b/target/arm/tcg/helper-sve.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_rsqrts_s, TCG_CALL_NO_RWG,
+ DEF_HELPER_FLAGS_5(gvec_rsqrts_d, TCG_CALL_NO_RWG,
+                    void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_recps_h, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_recps_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_recps_d, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++
++DEF_HELPER_FLAGS_5(gvec_ah_rsqrts_h, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_rsqrts_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_rsqrts_d, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, fpst, i32)
++
+ DEF_HELPER_FLAGS_5(gvec_ah_fmax_h, TCG_CALL_NO_RWG,
+                    void, ptr, ptr, ptr, fpst, i32)
+ DEF_HELPER_FLAGS_5(gvec_ah_fmax_s, TCG_CALL_NO_RWG,
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool do_fp3_vector_2fn(DisasContext *s, arg_qrrr_e *a, int data,
+     return do_fp3_vector(s, a, data, s->fpcr_ah ? fah : fnormal);
+ }
+-static bool do_fp3_vector_ah(DisasContext *s, arg_qrrr_e *a, int data,
+-                             gen_helper_gvec_3_ptr * const f[3])
++static bool do_fp3_vector_ah_2fn(DisasContext *s, arg_qrrr_e *a, int data,
++                                 gen_helper_gvec_3_ptr * const fnormal[3],
++                                 gen_helper_gvec_3_ptr * const fah[3])
+ {
+-    return do_fp3_vector_with_fpsttype(s, a, data, f,
++    return do_fp3_vector_with_fpsttype(s, a, data, s->fpcr_ah ? fah : fnormal,
+                                        select_ah_fpst(s, a->esz));
+ }
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const f_vector_frecps[3] = {
+     gen_helper_gvec_recps_s,
+     gen_helper_gvec_recps_d,
+ };
+-TRANS(FRECPS_v, do_fp3_vector_ah, a, 0, f_vector_frecps)
++static gen_helper_gvec_3_ptr * const f_vector_ah_frecps[3] = {
++    gen_helper_gvec_ah_recps_h,
++    gen_helper_gvec_ah_recps_s,
++    gen_helper_gvec_ah_recps_d,
++};
++TRANS(FRECPS_v, do_fp3_vector_ah_2fn, a, 0, f_vector_frecps, f_vector_ah_frecps)
+ static gen_helper_gvec_3_ptr * const f_vector_frsqrts[3] = {
+     gen_helper_gvec_rsqrts_h,
+     gen_helper_gvec_rsqrts_s,
+     gen_helper_gvec_rsqrts_d,
+ };
+-TRANS(FRSQRTS_v, do_fp3_vector_ah, a, 0, f_vector_frsqrts)
++static gen_helper_gvec_3_ptr * const f_vector_ah_frsqrts[3] = {
++    gen_helper_gvec_ah_rsqrts_h,
++    gen_helper_gvec_ah_rsqrts_s,
++    gen_helper_gvec_ah_rsqrts_d,
++};
++TRANS(FRSQRTS_v, do_fp3_vector_ah_2fn, a, 0, f_vector_frsqrts, f_vector_ah_frsqrts)
+ static gen_helper_gvec_3_ptr * const f_vector_faddp[3] = {
+     gen_helper_gvec_faddp_h,
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
+         NULL, gen_helper_gvec_##name##_h,                           \
+         gen_helper_gvec_##name##_s, gen_helper_gvec_##name##_d      \
+     };                                                              \
+-    TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_ah_arg_zzz, name##_fns[a->esz], a, 0)
++    static gen_helper_gvec_3_ptr * const name##_ah_fns[4] = {       \
++        NULL, gen_helper_gvec_ah_##name##_h,                        \
++        gen_helper_gvec_ah_##name##_s, gen_helper_gvec_ah_##name##_d    \
++    };                                                              \
++    TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_ah_arg_zzz,            \
++               s->fpcr_ah ? name##_ah_fns[a->esz] : name##_fns[a->esz], a, 0)
+ DO_FP3(FADD_zzz, fadd)
+ DO_FP3(FSUB_zzz, fsub)
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ DO_3OP(gvec_rsqrts_h, helper_rsqrtsf_f16, float16)
+ DO_3OP(gvec_rsqrts_s, helper_rsqrtsf_f32, float32)
+ DO_3OP(gvec_rsqrts_d, helper_rsqrtsf_f64, float64)
++DO_3OP(gvec_ah_recps_h, helper_recpsf_ah_f16, float16)
++DO_3OP(gvec_ah_recps_s, helper_recpsf_ah_f32, float32)
++DO_3OP(gvec_ah_recps_d, helper_recpsf_ah_f64, float64)
++
++DO_3OP(gvec_ah_rsqrts_h, helper_rsqrtsf_ah_f16, float16)
++DO_3OP(gvec_ah_rsqrts_s, helper_rsqrtsf_ah_f32, float32)
++DO_3OP(gvec_ah_rsqrts_d, helper_rsqrtsf_ah_f64, float64)
++
+ DO_3OP(gvec_ah_fmax_h, helper_vfp_ah_maxh, float16)
+ DO_3OP(gvec_ah_fmax_s, helper_vfp_ah_maxs, float32)
+ DO_3OP(gvec_ah_fmax_d, helper_vfp_ah_maxd, float64)
+--
+.34.1

-New patch
+[PULL 40/68] target/arm: Handle FPCR.AH in negation step in FMLS (indexed)
+Handle the FPCR.AH "don't negate the sign of a NaN" semantics in FMLS
+(indexed). We do this by creating 6 new helpers, which allow us to
+do the negation either by XOR (for AH=0) or by muladd flags
+(for AH=1).
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: Mostly from RTH's patch; error in index order into fns[][]
+ fixed]
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/helper.h            | 14 ++++++++++++++
+ target/arm/tcg/translate-a64.c | 17 +++++++++++------
+ target/arm/tcg/translate-sve.c | 31 +++++++++++++++++--------------
+ target/arm/tcg/vec_helper.c    | 24 +++++++++++++++---------
+files changed, 57 insertions(+), 29 deletions(-)
+diff --git a/target/arm/helper.h b/target/arm/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.h
++++ b/target/arm/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_6(gvec_fmla_idx_s, TCG_CALL_NO_RWG,
+ DEF_HELPER_FLAGS_6(gvec_fmla_idx_d, TCG_CALL_NO_RWG,
+                    void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(gvec_fmls_idx_h, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(gvec_fmls_idx_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(gvec_fmls_idx_d, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++
++DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_h, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_s, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_d, TCG_CALL_NO_RWG,
++                   void, ptr, ptr, ptr, ptr, fpst, i32)
++
+ DEF_HELPER_FLAGS_5(gvec_uqadd_b, TCG_CALL_NO_RWG,
+                    void, ptr, ptr, ptr, ptr, i32)
+ DEF_HELPER_FLAGS_5(gvec_uqadd_h, TCG_CALL_NO_RWG,
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ TRANS(FMULX_vi, do_fp3_vector_idx, a, f_vector_idx_fmulx)
+ static bool do_fmla_vector_idx(DisasContext *s, arg_qrrx_e *a, bool neg)
+ {
+-    static gen_helper_gvec_4_ptr * const fns[3] = {
+-        gen_helper_gvec_fmla_idx_h,
+-        gen_helper_gvec_fmla_idx_s,
+-        gen_helper_gvec_fmla_idx_d,
++    static gen_helper_gvec_4_ptr * const fns[3][3] = {
++        { gen_helper_gvec_fmla_idx_h,
++          gen_helper_gvec_fmla_idx_s,
++          gen_helper_gvec_fmla_idx_d },
++        { gen_helper_gvec_fmls_idx_h,
++          gen_helper_gvec_fmls_idx_s,
++          gen_helper_gvec_fmls_idx_d },
++        { gen_helper_gvec_ah_fmls_idx_h,
++          gen_helper_gvec_ah_fmls_idx_s,
++          gen_helper_gvec_ah_fmls_idx_d },
+     };
+     MemOp esz = a->esz;
+     int check = fp_access_check_vector_hsd(s, a->q, esz);
+@@ -XXX,XX +XXX,XX @@ static bool do_fmla_vector_idx(DisasContext *s, arg_qrrx_e *a, bool neg)
+     gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
+                       esz == MO_16 ? FPST_A64_F16 : FPST_A64,
+-                      (a->idx << 1) | neg,
+-                      fns[esz - 1]);
++                      a->idx, fns[neg ? 1 + s->fpcr_ah : 0][esz - 1]);
+     return true;
+ }
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ DO_SVE2_RRXR_ROT(CDOT_zzxw_d, gen_helper_sve2_cdot_idx_d)
+  *** SVE Floating Point Multiply-Add Indexed Group
+  */
+-static bool do_FMLA_zzxz(DisasContext *s, arg_rrxr_esz *a, bool sub)
+-{
+-    static gen_helper_gvec_4_ptr * const fns[4] = {
+-        NULL,
+-        gen_helper_gvec_fmla_idx_h,
+-        gen_helper_gvec_fmla_idx_s,
+-        gen_helper_gvec_fmla_idx_d,
+-    };
+-    return gen_gvec_fpst_zzzz(s, fns[a->esz], a->rd, a->rn, a->rm, a->ra,
+-                              (a->index << 1) | sub,
+-                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+-}
++static gen_helper_gvec_4_ptr * const fmla_idx_fns[4] = {
++    NULL,                       gen_helper_gvec_fmla_idx_h,
++    gen_helper_gvec_fmla_idx_s, gen_helper_gvec_fmla_idx_d
++};
++TRANS_FEAT(FMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz,
++           fmla_idx_fns[a->esz], a->rd, a->rn, a->rm, a->ra, a->index,
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+-TRANS_FEAT(FMLA_zzxz, aa64_sve, do_FMLA_zzxz, a, false)
+-TRANS_FEAT(FMLS_zzxz, aa64_sve, do_FMLA_zzxz, a, true)
++static gen_helper_gvec_4_ptr * const fmls_idx_fns[4][2] = {
++    { NULL, NULL },
++    { gen_helper_gvec_fmls_idx_h, gen_helper_gvec_ah_fmls_idx_h },
++    { gen_helper_gvec_fmls_idx_s, gen_helper_gvec_ah_fmls_idx_s },
++    { gen_helper_gvec_fmls_idx_d, gen_helper_gvec_ah_fmls_idx_d },
++};
++TRANS_FEAT(FMLS_zzxz, aa64_sve, gen_gvec_fpst_zzzz,
++           fmls_idx_fns[a->esz][s->fpcr_ah],
++           a->rd, a->rn, a->rm, a->ra, a->index,
++           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ /*
+  *** SVE Floating Point Multiply Indexed Group
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ DO_FMUL_IDX(gvec_fmls_nf_idx_s, float32_sub, float32_mul, float32, H4)
+ #undef DO_FMUL_IDX
+-#define DO_FMLA_IDX(NAME, TYPE, H)                                         \
++#define DO_FMLA_IDX(NAME, TYPE, H, NEGX, NEGF)                             \
+ void HELPER(NAME)(void *vd, void *vn, void *vm, void *va,                  \
+                   float_status *stat, uint32_t desc)                       \
+ {                                                                          \
+     intptr_t i, j, oprsz = simd_oprsz(desc);                               \
+     intptr_t segment = MIN(16, oprsz) / sizeof(TYPE);                      \
+-    TYPE op1_neg = extract32(desc, SIMD_DATA_SHIFT, 1);                    \
+-    intptr_t idx = desc >> (SIMD_DATA_SHIFT + 1);                          \
++    intptr_t idx = simd_data(desc);                                        \
+     TYPE *d = vd, *n = vn, *m = vm, *a = va;                               \
+-    op1_neg <<= (8 * sizeof(TYPE) - 1);                                    \
+     for (i = 0; i < oprsz / sizeof(TYPE); i += segment) {                  \
+         TYPE mm = m[H(i + idx)];                                           \
+         for (j = 0; j < segment; j++) {                                    \
+-            d[i + j] = TYPE##_muladd(n[i + j] ^ op1_neg,                   \
+-                                     mm, a[i + j], 0, stat);               \
++            d[i + j] = TYPE##_muladd(n[i + j] ^ NEGX, mm,                  \
++                                     a[i + j], NEGF, stat);                \
+         }                                                                  \
+     }                                                                      \
+     clear_tail(d, oprsz, simd_maxsz(desc));                                \
+ }
+-DO_FMLA_IDX(gvec_fmla_idx_h, float16, H2)
+-DO_FMLA_IDX(gvec_fmla_idx_s, float32, H4)
+-DO_FMLA_IDX(gvec_fmla_idx_d, float64, H8)
++DO_FMLA_IDX(gvec_fmla_idx_h, float16, H2, 0, 0)
++DO_FMLA_IDX(gvec_fmla_idx_s, float32, H4, 0, 0)
++DO_FMLA_IDX(gvec_fmla_idx_d, float64, H8, 0, 0)
++
++DO_FMLA_IDX(gvec_fmls_idx_h, float16, H2, INT16_MIN, 0)
++DO_FMLA_IDX(gvec_fmls_idx_s, float32, H4, INT32_MIN, 0)
++DO_FMLA_IDX(gvec_fmls_idx_d, float64, H8, INT64_MIN, 0)
++
++DO_FMLA_IDX(gvec_ah_fmls_idx_h, float16, H2, 0, float_muladd_negate_product)
++DO_FMLA_IDX(gvec_ah_fmls_idx_s, float32, H4, 0, float_muladd_negate_product)
++DO_FMLA_IDX(gvec_ah_fmls_idx_d, float64, H8, 0, float_muladd_negate_product)
+ #undef DO_FMLA_IDX
+--
+.34.1

-[PULL 29/32] hw/intc/arm_gicv3_its: Implement MOVALL
+[PULL 41/68] target/arm: Handle FPCR.AH in negation in FMLS (vector)
-Implement the ITS MOVALL command, which takes all the pending
+Handle the FPCR.AH "don't negate the sign of a NaN" semantics
-interrupts on a source redistributor and makes the not-pending on
+in FMLS (vector), by implementing a new set of helpers for
-that source redistributor and pending on a destination redistributor.
+the AH=1 case.
-This is a GICv3 ITS command which we forgot to implement. (It is
+The float_muladd_negate_product flag produces the same result
-not used by Linux guests.)
+as negating either of the multiplication operands, assuming
 neither of the operands are NaNs.  But since FEAT_AFP does not
 negate NaNs, this behaviour is exactly what we need.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-14-peter.maydell@linaro.org
 ---
- hw/intc/gicv3_internal.h   | 16 +++++++++++
+ target/arm/helper.h            |  4 ++++
- hw/intc/arm_gicv3_its.c    | 55 ++++++++++++++++++++++++++++++++++++++
+ target/arm/tcg/translate-a64.c |  7 ++++++-
- hw/intc/arm_gicv3_redist.c | 54 +++++++++++++++++++++++++++++++++++++
+ target/arm/tcg/vec_helper.c    | 22 ++++++++++++++++++++++
-files changed, 125 insertions(+)
+files changed, 32 insertions(+), 1 deletion(-)
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
+diff --git a/target/arm/helper.h b/target/arm/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/target/arm/helper.h
-+++ b/hw/intc/gicv3_internal.h
++++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_5(gvec_vfms_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
- #define GITS_CMD_MAPI             0x0B
+ DEF_HELPER_FLAGS_5(gvec_vfms_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
- #define GITS_CMD_INV              0x0C
+ DEF_HELPER_FLAGS_5(gvec_vfms_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
- #define GITS_CMD_INVALL           0x0D
-+#define GITS_CMD_MOVALL           0x0E
++DEF_HELPER_FLAGS_5(gvec_ah_vfms_h, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
- #define GITS_CMD_DISCARD          0x0F
++DEF_HELPER_FLAGS_5(gvec_ah_vfms_s, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
++DEF_HELPER_FLAGS_5(gvec_ah_vfms_d, TCG_CALL_NO_RWG, void, ptr, ptr, ptr, fpst, i32)
  /* MAPC command fields */
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
  #define L2_TABLE_VALID_MASK       CMD_FIELD_VALID_MASK
  #define TABLE_ENTRY_VALID_MASK    (1ULL << 0)
 +/* MOVALL command fields */
 +FIELD(MOVALL_2, RDBASE1, 16, 36)
 +FIELD(MOVALL_3, RDBASE2, 16, 36)
 +
- /*
+ DEF_HELPER_FLAGS_5(gvec_ftsmul_h, TCG_CALL_NO_RWG,
-  * 12 bytes Interrupt translation Table Entry size
+                    void, ptr, ptr, ptr, fpst, i32)
-  * as per Table 5.3 in GICv3 spec
+ DEF_HELPER_FLAGS_5(gvec_ftsmul_s, TCG_CALL_NO_RWG,
-@@ -XXX,XX +XXX,XX @@ void gicv3_redist_update_lpi(GICv3CPUState *cs);
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
   * an incoming migration has loaded new state.
   */
  void gicv3_redist_update_lpi_only(GICv3CPUState *cs);
 +/**
 + * gicv3_redist_movall_lpis:
 + * @src: source redistributor
 + * @dest: destination redistributor
 + *
 + * Scan the LPI pending table for @src, and for each pending LPI there
 + * mark it as not-pending for @src and pending for @dest, as required
 + * by the ITS MOVALL command.
 + */
 +void gicv3_redist_movall_lpis(GICv3CPUState *src, GICv3CPUState *dest);
 +
  void gicv3_redist_send_sgi(GICv3CPUState *cs, int grp, int irq, bool ns);
  void gicv3_init_cpuif(GICv3State *s);
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its.c
+--- a/target/arm/tcg/translate-a64.c
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/target/arm/tcg/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_mapd(GICv3ITSState *s, uint64_t value,
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const f_vector_fmls[3] = {
-     return update_dte(s, devid, valid, size, itt_addr) ? CMD_CONTINUE : CMD_STALL;
+     gen_helper_gvec_vfms_s,
      gen_helper_gvec_vfms_d,
  };
 -TRANS(FMLS_v, do_fp3_vector, a, 0, f_vector_fmls)
 +static gen_helper_gvec_3_ptr * const f_vector_fmls_ah[3] = {
 +    gen_helper_gvec_ah_vfms_h,
 +    gen_helper_gvec_ah_vfms_s,
 +    gen_helper_gvec_ah_vfms_d,
 +};
 +TRANS(FMLS_v, do_fp3_vector_2fn, a, 0, f_vector_fmls, f_vector_fmls_ah)
  static gen_helper_gvec_3_ptr * const f_vector_fcmeq[3] = {
      gen_helper_gvec_fceq_h,
 diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/vec_helper.c
 +++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ static float64 float64_mulsub_f(float64 dest, float64 op1, float64 op2,
      return float64_muladd(float64_chs(op1), op2, dest, 0, stat);
  }
-+static ItsCmdResult process_movall(GICv3ITSState *s, uint64_t value,
++static float16 float16_ah_mulsub_f(float16 dest, float16 op1, float16 op2,
-+                                   uint32_t offset)
++                                 float_status *stat)
 +{
-+    AddressSpace *as = &s->gicv3->dma_as;
++    return float16_muladd(op1, op2, dest, float_muladd_negate_product, stat);
 +    MemTxResult res = MEMTX_OK;
 +    uint64_t rd1, rd2;
 +
 +    /* No fields in dwords 0 or 1 */
 +    offset += NUM_BYTES_IN_DW;
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +    if (res != MEMTX_OK) {
 +        return CMD_STALL;
 +    }
 +
 +    rd1 = FIELD_EX64(value, MOVALL_2, RDBASE1);
 +    if (rd1 >= s->gicv3->num_cpu) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: RDBASE1 %" PRId64
 +                      " out of range (must be less than %d)\n",
 +                      __func__, rd1, s->gicv3->num_cpu);
 +        return CMD_CONTINUE;
 +    }
 +
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +    if (res != MEMTX_OK) {
 +        return CMD_STALL;
 +    }
 +
 +    rd2 = FIELD_EX64(value, MOVALL_3, RDBASE2);
 +    if (rd2 >= s->gicv3->num_cpu) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: RDBASE2 %" PRId64
 +                      " out of range (must be less than %d)\n",
 +                      __func__, rd2, s->gicv3->num_cpu);
 +        return CMD_CONTINUE;
 +    }
 +
 +    if (rd1 == rd2) {
 +        /* Move to same target must succeed as a no-op */
 +        return CMD_CONTINUE;
 +    }
 +
 +    /* Move all pending LPIs from redistributor 1 to redistributor 2 */
 +    gicv3_redist_movall_lpis(&s->gicv3->cpu[rd1], &s->gicv3->cpu[rd2]);
 +
 +    return CMD_CONTINUE;
 +}
 +
- /*
++static float32 float32_ah_mulsub_f(float32 dest, float32 op1, float32 op2,
-  * Current implementation blocks until all
++                                 float_status *stat)
   * commands are processed
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
                  gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
              }
              break;
 +        case GITS_CMD_MOVALL:
 +            result = process_movall(s, data, cq_offset);
 +            break;
          default:
              break;
          }
 diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_redist.c
 +++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level)
      gicv3_redist_lpi_pending(cs, irq, level);
  }
 +void gicv3_redist_movall_lpis(GICv3CPUState *src, GICv3CPUState *dest)
 +{
-+    /*
++    return float32_muladd(op1, op2, dest, float_muladd_negate_product, stat);
 +     * We must move all pending LPIs from the source redistributor
 +     * to the destination. That is, for every pending LPI X on
 +     * src, we must set it not-pending on src and pending on dest.
 +     * LPIs that are already pending on dest are not cleared.
 +     *
 +     * If LPIs are disabled on dest this is CONSTRAINED UNPREDICTABLE:
 +     * we choose to NOP. If LPIs are disabled on source there's nothing
 +     * to be transferred anyway.
 +     */
 +    AddressSpace *as = &src->gic->dma_as;
 +    uint64_t idbits;
 +    uint32_t pendt_size;
 +    uint64_t src_baddr, dest_baddr;
 +    int i;
 +
 +    if (!(src->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) ||
 +        !(dest->gicr_ctlr & GICR_CTLR_ENABLE_LPIS)) {
 +        return;
 +    }
 +
 +    idbits = MIN(FIELD_EX64(src->gicr_propbaser, GICR_PROPBASER, IDBITS),
 +                 GICD_TYPER_IDBITS);
 +    idbits = MIN(FIELD_EX64(dest->gicr_propbaser, GICR_PROPBASER, IDBITS),
 +                 idbits);
 +
 +    pendt_size = 1ULL << (idbits + 1);
 +    src_baddr = src->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
 +    dest_baddr = dest->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
 +
 +    for (i = GICV3_LPI_INTID_START / 8; i < pendt_size / 8; i++) {
 +        uint8_t src_pend, dest_pend;
 +
 +        address_space_read(as, src_baddr + i, MEMTXATTRS_UNSPECIFIED,
 +                           &src_pend, sizeof(src_pend));
 +        if (!src_pend) {
 +            continue;
 +        }
 +        address_space_read(as, dest_baddr + i, MEMTXATTRS_UNSPECIFIED,
 +                           &dest_pend, sizeof(dest_pend));
 +        dest_pend |= src_pend;
 +        src_pend = 0;
 +        address_space_write(as, src_baddr + i, MEMTXATTRS_UNSPECIFIED,
 +                            &src_pend, sizeof(src_pend));
 +        address_space_write(as, dest_baddr + i, MEMTXATTRS_UNSPECIFIED,
 +                            &dest_pend, sizeof(dest_pend));
 +    }
 +
 +    gicv3_redist_update_lpi(src);
 +    gicv3_redist_update_lpi(dest);
 +}
 +
- void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level)
++static float64 float64_ah_mulsub_f(float64 dest, float64 op1, float64 op2,
- {
++                                 float_status *stat)
-     /* Update redistributor state for a change in an external PPI input line */
++{
 +    return float64_muladd(op1, op2, dest, float_muladd_negate_product, stat);
 +}
 +
  #define DO_MULADD(NAME, FUNC, TYPE)                                        \
  void HELPER(NAME)(void *vd, void *vn, void *vm,                            \
                    float_status *stat, uint32_t desc)                       \
@@ -XXX,XX +XXX,XX @@ DO_MULADD(gvec_vfms_h, float16_mulsub_f, float16)
  DO_MULADD(gvec_vfms_s, float32_mulsub_f, float32)
  DO_MULADD(gvec_vfms_d, float64_mulsub_f, float64)
 +DO_MULADD(gvec_ah_vfms_h, float16_ah_mulsub_f, float16)
 +DO_MULADD(gvec_ah_vfms_s, float32_ah_mulsub_f, float32)
 +DO_MULADD(gvec_ah_vfms_d, float64_ah_mulsub_f, float64)
 +
  /* For the indexed ops, SVE applies the index per 128-bit vector segment.
   * For AdvSIMD, there is of course only one such vector segment.
   */
 --
-.25.1
+.34.1

-[PULL 27/32] hw/intc/arm_gicv3_its: Make GITS_BASER<n> RAZ/WI for unimplemented registers
+[PULL 42/68] target/arm: Handle FPCR.AH in negation step in SVE FMLS (vector)
-The ITS has a bank of 8 GITS_BASER<n> registers, which allow the
+Handle the FPCR.AH "don't negate the sign of a NaN" semantics fro the
-guest to specify the base address of various data tables.  Each
+SVE FMLS (vector) insns, by providing new helpers for the AH=1 case
-register has a read-only type field indicating which table it is for
+which end up passing fpcr_ah = true to the do_fmla_zpzzz_* functions
-and a read-write field where the guest can write in the base address
+that do the work.
 (among other things).  We currently allow the guest to write the
 writeable fields for all eight registers, even if the type field is 0
 indicating "Unimplemented".  This means the guest can provoke QEMU
 into asserting by writing an address into one of these unimplemented
 base registers, which bypasses the "if (!value) continue" check in
 extract_table_params() and lets us hit the assertion that the type
 field is one of the permitted table types.
-Prevent the assertion by not allowing the guest to write to the
+The float*_muladd functions have a flags argument that can
-unimplemented base registers. This means their value will remain 0
+perform optional negation of various operand.  We don't use
-and extract_table_params() will ignore them.
+that for "normal" arm fmla, because the muladd flags are not
 applied when an input is a NaN.  But since FEAT_AFP does not
 negate NaNs, this behaviour is exactly what we need.
 The non-AH helpers pass in a zero flags argument and control the
 negation via the neg1 and neg3 arguments; the AH helpers always pass
 in neg1 and neg3 as zero and control the negation via the flags
 argument.  This allows us to avoid conditional branches within the
 inner loop.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-12-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_its.c | 8 ++++++++
+ target/arm/tcg/helper-sve.h    | 21 ++++++++
-file changed, 8 insertions(+)
+ target/arm/tcg/sve_helper.c    | 99 +++++++++++++++++++++++++++-------
  target/arm/tcg/translate-sve.c | 18 ++++---
 files changed, 114 insertions(+), 24 deletions(-)
-diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
+diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its.c
+--- a/target/arm/tcg/helper-sve.h
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/target/arm/tcg/helper-sve.h
-@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_7(sve_fnmls_zpzzz_s, TCG_CALL_NO_RWG,
-         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
+ DEF_HELPER_FLAGS_7(sve_fnmls_zpzzz_d, TCG_CALL_NO_RWG,
-             index = (offset - GITS_BASER) / 8;
+                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
-+            if (s->baser[index] == 0) {
++DEF_HELPER_FLAGS_7(sve_ah_fmls_zpzzz_h, TCG_CALL_NO_RWG,
-+                /* Unimplemented GITS_BASERn: RAZ/WI */
++                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
-+                break;
++DEF_HELPER_FLAGS_7(sve_ah_fmls_zpzzz_s, TCG_CALL_NO_RWG,
-+            }
++                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
-             if (offset & 7) {
++DEF_HELPER_FLAGS_7(sve_ah_fmls_zpzzz_d, TCG_CALL_NO_RWG,
-                 value <<= 32;
++                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
-                 value &= ~GITS_BASER_RO_MASK;
++
-@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
++DEF_HELPER_FLAGS_7(sve_ah_fnmla_zpzzz_h, TCG_CALL_NO_RWG,
-          */
++                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
-         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
++DEF_HELPER_FLAGS_7(sve_ah_fnmla_zpzzz_s, TCG_CALL_NO_RWG,
-             index = (offset - GITS_BASER) / 8;
++                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
-+            if (s->baser[index] == 0) {
++DEF_HELPER_FLAGS_7(sve_ah_fnmla_zpzzz_d, TCG_CALL_NO_RWG,
-+                /* Unimplemented GITS_BASERn: RAZ/WI */
++                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
-+                break;
++
-+            }
++DEF_HELPER_FLAGS_7(sve_ah_fnmls_zpzzz_h, TCG_CALL_NO_RWG,
-             s->baser[index] &= GITS_BASER_RO_MASK;
++                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
-             s->baser[index] |= (value & ~GITS_BASER_RO_MASK);
++DEF_HELPER_FLAGS_7(sve_ah_fnmls_zpzzz_s, TCG_CALL_NO_RWG,
-         }
++                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 +DEF_HELPER_FLAGS_7(sve_ah_fnmls_zpzzz_d, TCG_CALL_NO_RWG,
 +                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 +
  DEF_HELPER_FLAGS_7(sve_fcmla_zpzzz_h, TCG_CALL_NO_RWG,
                     void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
  DEF_HELPER_FLAGS_7(sve_fcmla_zpzzz_s, TCG_CALL_NO_RWG,
 diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/sve_helper.c
 +++ b/target/arm/tcg/sve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_ZPZ_FP(flogb_d, float64, H1_8, do_float64_logb_as_int)
  static void do_fmla_zpzzz_h(void *vd, void *vn, void *vm, void *va, void *vg,
                              float_status *status, uint32_t desc,
 -                            uint16_t neg1, uint16_t neg3)
 +                            uint16_t neg1, uint16_t neg3, int flags)
  {
      intptr_t i = simd_oprsz(desc);
      uint64_t *g = vg;
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_h(void *vd, void *vn, void *vm, void *va, void *vg,
                  e1 = *(uint16_t *)(vn + H1_2(i)) ^ neg1;
                  e2 = *(uint16_t *)(vm + H1_2(i));
                  e3 = *(uint16_t *)(va + H1_2(i)) ^ neg3;
 -                r = float16_muladd(e1, e2, e3, 0, status);
 +                r = float16_muladd(e1, e2, e3, flags, status);
                  *(uint16_t *)(vd + H1_2(i)) = r;
              }
          } while (i & 63);
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_h(void *vd, void *vn, void *vm, void *va, void *vg,
  void HELPER(sve_fmla_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0);
 +    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0, 0);
  }
  void HELPER(sve_fmls_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0x8000, 0);
 +    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0x8000, 0, 0);
  }
  void HELPER(sve_fnmla_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
                                 void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0x8000, 0x8000);
 +    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0x8000, 0x8000, 0);
  }
  void HELPER(sve_fnmls_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
                                 void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0x8000);
 +    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0x8000, 0);
 +}
 +
 +void HELPER(sve_ah_fmls_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
 +                              void *vg, float_status *status, uint32_t desc)
 +{
 +    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0,
 +                    float_muladd_negate_product);
 +}
 +
 +void HELPER(sve_ah_fnmla_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
 +                               void *vg, float_status *status, uint32_t desc)
 +{
 +    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0,
 +                    float_muladd_negate_product | float_muladd_negate_c);
 +}
 +
 +void HELPER(sve_ah_fnmls_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
 +                               void *vg, float_status *status, uint32_t desc)
 +{
 +    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0,
 +                    float_muladd_negate_c);
  }
  static void do_fmla_zpzzz_s(void *vd, void *vn, void *vm, void *va, void *vg,
                              float_status *status, uint32_t desc,
 -                            uint32_t neg1, uint32_t neg3)
 +                            uint32_t neg1, uint32_t neg3, int flags)
  {
      intptr_t i = simd_oprsz(desc);
      uint64_t *g = vg;
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_s(void *vd, void *vn, void *vm, void *va, void *vg,
                  e1 = *(uint32_t *)(vn + H1_4(i)) ^ neg1;
                  e2 = *(uint32_t *)(vm + H1_4(i));
                  e3 = *(uint32_t *)(va + H1_4(i)) ^ neg3;
 -                r = float32_muladd(e1, e2, e3, 0, status);
 +                r = float32_muladd(e1, e2, e3, flags, status);
                  *(uint32_t *)(vd + H1_4(i)) = r;
              }
          } while (i & 63);
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_s(void *vd, void *vn, void *vm, void *va, void *vg,
  void HELPER(sve_fmla_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0);
 +    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0, 0);
  }
  void HELPER(sve_fmls_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0x80000000, 0);
 +    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0x80000000, 0, 0);
  }
  void HELPER(sve_fnmla_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
                                 void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0x80000000, 0x80000000);
 +    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0x80000000, 0x80000000, 0);
  }
  void HELPER(sve_fnmls_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
                                 void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0x80000000);
 +    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0x80000000, 0);
 +}
 +
 +void HELPER(sve_ah_fmls_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
 +                              void *vg, float_status *status, uint32_t desc)
 +{
 +    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0,
 +                    float_muladd_negate_product);
 +}
 +
 +void HELPER(sve_ah_fnmla_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
 +                               void *vg, float_status *status, uint32_t desc)
 +{
 +    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0,
 +                    float_muladd_negate_product | float_muladd_negate_c);
 +}
 +
 +void HELPER(sve_ah_fnmls_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
 +                               void *vg, float_status *status, uint32_t desc)
 +{
 +    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0,
 +                    float_muladd_negate_c);
  }
  static void do_fmla_zpzzz_d(void *vd, void *vn, void *vm, void *va, void *vg,
                              float_status *status, uint32_t desc,
 -                            uint64_t neg1, uint64_t neg3)
 +                            uint64_t neg1, uint64_t neg3, int flags)
  {
      intptr_t i = simd_oprsz(desc);
      uint64_t *g = vg;
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_d(void *vd, void *vn, void *vm, void *va, void *vg,
                  e1 = *(uint64_t *)(vn + i) ^ neg1;
                  e2 = *(uint64_t *)(vm + i);
                  e3 = *(uint64_t *)(va + i) ^ neg3;
 -                r = float64_muladd(e1, e2, e3, 0, status);
 +                r = float64_muladd(e1, e2, e3, flags, status);
                  *(uint64_t *)(vd + i) = r;
              }
          } while (i & 63);
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_d(void *vd, void *vn, void *vm, void *va, void *vg,
  void HELPER(sve_fmla_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, 0);
 +    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, 0, 0);
  }
  void HELPER(sve_fmls_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, INT64_MIN, 0);
 +    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, INT64_MIN, 0, 0);
  }
  void HELPER(sve_fnmla_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
                                 void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, INT64_MIN, INT64_MIN);
 +    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, INT64_MIN, INT64_MIN, 0);
  }
  void HELPER(sve_fnmls_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
                                 void *vg, float_status *status, uint32_t desc)
  {
 -    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, INT64_MIN);
 +    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, INT64_MIN, 0);
 +}
 +
 +void HELPER(sve_ah_fmls_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
 +                              void *vg, float_status *status, uint32_t desc)
 +{
 +    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, 0,
 +                    float_muladd_negate_product);
 +}
 +
 +void HELPER(sve_ah_fnmla_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
 +                               void *vg, float_status *status, uint32_t desc)
 +{
 +    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, 0,
 +                    float_muladd_negate_product | float_muladd_negate_c);
 +}
 +
 +void HELPER(sve_ah_fnmls_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
 +                               void *vg, float_status *status, uint32_t desc)
 +{
 +    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, 0,
 +                    float_muladd_negate_c);
  }
  /* Two operand floating-point comparison controlled by a predicate.
 diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/translate-sve.c
 +++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
             a->rd, a->rn, a->rm, a->pg, a->rot | (s->fpcr_ah << 1),
             a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
 -#define DO_FMLA(NAME, name) \
 +#define DO_FMLA(NAME, name, ah_name)                                    \
      static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
          NULL, gen_helper_sve_##name##_h,                                \
          gen_helper_sve_##name##_s, gen_helper_sve_##name##_d            \
      };                                                                  \
 -    TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp, name##_fns[a->esz], \
 +    static gen_helper_gvec_5_ptr * const name##_ah_fns[4] = {           \
 +        NULL, gen_helper_sve_##ah_name##_h,                             \
 +        gen_helper_sve_##ah_name##_s, gen_helper_sve_##ah_name##_d      \
 +    };                                                                  \
 +    TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp,                     \
 +               s->fpcr_ah ? name##_ah_fns[a->esz] : name##_fns[a->esz], \
                 a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
                 a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
 -DO_FMLA(FMLA_zpzzz, fmla_zpzzz)
 -DO_FMLA(FMLS_zpzzz, fmls_zpzzz)
 -DO_FMLA(FNMLA_zpzzz, fnmla_zpzzz)
 -DO_FMLA(FNMLS_zpzzz, fnmls_zpzzz)
 +/* We don't need an ah_fmla_zpzzz because fmla doesn't negate anything */
 +DO_FMLA(FMLA_zpzzz, fmla_zpzzz, fmla_zpzzz)
 +DO_FMLA(FMLS_zpzzz, fmls_zpzzz, ah_fmls_zpzzz)
 +DO_FMLA(FNMLA_zpzzz, fnmla_zpzzz, ah_fnmla_zpzzz)
 +DO_FMLA(FNMLS_zpzzz, fnmls_zpzzz, ah_fnmls_zpzzz)
  #undef DO_FMLA
 --
-.25.1
+.34.1

-[PULL 28/32] hw/intc/arm_gicv3_its: Check table bounds against correct limit
+[PULL 43/68] target/arm: Handle FPCR.AH in SVE FTSSEL
-Currently when we fill in a TableDesc based on the value the guest
+The negation step in the SVE FTSSEL insn mustn't negate a NaN when
-has written to the GITS_BASER<n> register, we calculate both:
+FPCR.AH is set.  Pass FPCR.AH to the helper via the SIMD data field
- * num_entries : the number of entries in the table, constrained
+and use that to determine whether to do the negation.
    by the amount of memory the guest has given it
  * num_ids : the number of IDs we support for this table,
    constrained by the implementation choices and the architecture
    (eg DeviceIDs are 16 bits, so num_ids is 1 << 16)
 When validating ITS commands, however, we check only num_ids,
 thus allowing a broken guest to specify table entries that
 index off the end of it. This will only corrupt guest memory,
 but the ITS is supposed to reject such commands as invalid.
 Instead of calculating both num_entries and num_ids, set
 num_entries to the minimum of the two limits, and check that.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-13-peter.maydell@linaro.org
 ---
- include/hw/intc/arm_gicv3_its_common.h |  1 -
+ target/arm/tcg/sve_helper.c    | 18 +++++++++++++++---
- hw/intc/arm_gicv3_its.c                | 18 +++++++++---------
+ target/arm/tcg/translate-sve.c |  4 ++--
-files changed, 9 insertions(+), 10 deletions(-)
+files changed, 17 insertions(+), 5 deletions(-)
-diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
+diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/arm_gicv3_its_common.h
+--- a/target/arm/tcg/sve_helper.c
-+++ b/include/hw/intc/arm_gicv3_its_common.h
++++ b/target/arm/tcg/sve_helper.c
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fexpa_d)(void *vd, void *vn, uint32_t desc)
-     uint16_t entry_sz;
+ void HELPER(sve_ftssel_h)(void *vd, void *vn, void *vm, uint32_t desc)
-     uint32_t page_sz;
+ {
-     uint32_t num_entries;
+     intptr_t i, opr_sz = simd_oprsz(desc) / 2;
--    uint32_t num_ids;
++    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT, 1);
-     uint64_t base_addr;
+     uint16_t *d = vd, *n = vn, *m = vm;
- } TableDesc;
+     for (i = 0; i < opr_sz; i += 1) {
+         uint16_t nn = n[i];
-diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_ftssel_h)(void *vd, void *vn, void *vm, uint32_t desc)
-index XXXXXXX..XXXXXXX 100644
+         if (mm & 1) {
---- a/hw/intc/arm_gicv3_its.c
+             nn = float16_one;
 +++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value,
      eventid = (value & EVENTID_MASK);
 -    if (devid >= s->dt.num_ids) {
 +    if (devid >= s->dt.num_entries) {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "%s: invalid command attributes: devid %d>=%d",
 -                      __func__, devid, s->dt.num_ids);
 +                      __func__, devid, s->dt.num_entries);
          return CMD_CONTINUE;
      }
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value,
          return CMD_CONTINUE;
      }
 -    if (icid >= s->ct.num_ids) {
 +    if (icid >= s->ct.num_entries) {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "%s: invalid ICID 0x%x in ITE (table corrupted?)\n",
                        __func__, icid);
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_mapti(GICv3ITSState *s, uint64_t value,
      icid = value & ICID_MASK;
 -    if (devid >= s->dt.num_ids) {
 +    if (devid >= s->dt.num_entries) {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "%s: invalid command attributes: devid %d>=%d",
 -                      __func__, devid, s->dt.num_ids);
 +                      __func__, devid, s->dt.num_entries);
          return CMD_CONTINUE;
      }
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_mapti(GICv3ITSState *s, uint64_t value,
      num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
      num_intids = 1ULL << (GICD_TYPER_IDBITS + 1);
 -    if ((icid >= s->ct.num_ids)
 +    if ((icid >= s->ct.num_entries)
              || !dte_valid || (eventid >= num_eventids) ||
              (((pIntid < GICV3_LPI_INTID_START) || (pIntid >= num_intids)) &&
               (pIntid != INTID_SPURIOUS))) {
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_mapc(GICv3ITSState *s, uint32_t offset)
      valid = (value & CMD_FIELD_VALID_MASK);
 -    if ((icid >= s->ct.num_ids) || (rdbase >= s->gicv3->num_cpu)) {
 +    if ((icid >= s->ct.num_entries) || (rdbase >= s->gicv3->num_cpu)) {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "ITS MAPC: invalid collection table attributes "
                        "icid %d rdbase %" PRIu64 "\n",  icid, rdbase);
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_mapd(GICv3ITSState *s, uint64_t value,
      valid = (value & CMD_FIELD_VALID_MASK);
 -    if ((devid >= s->dt.num_ids) ||
 +    if ((devid >= s->dt.num_entries) ||
          (size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS))) {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "ITS MAPD: invalid device table attributes "
@@ -XXX,XX +XXX,XX @@ static void extract_table_params(GICv3ITSState *s)
                                    L1TABLE_ENTRY_SIZE) *
                                   (page_sz / td->entry_sz));
          }
--        td->num_ids = 1ULL << idbits;
+-        d[i] = nn ^ (mm & 2) << 14;
-+        td->num_entries = MIN(td->num_entries, 1ULL << idbits);
++        if (mm & 2) {
 +            nn = float16_maybe_ah_chs(nn, fpcr_ah);
 +        }
 +        d[i] = nn;
      }
  }
+ void HELPER(sve_ftssel_s)(void *vd, void *vn, void *vm, uint32_t desc)
+ {
+     intptr_t i, opr_sz = simd_oprsz(desc) / 4;
++    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT, 1);
+     uint32_t *d = vd, *n = vn, *m = vm;
+     for (i = 0; i < opr_sz; i += 1) {
+         uint32_t nn = n[i];
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_ftssel_s)(void *vd, void *vn, void *vm, uint32_t desc)
+         if (mm & 1) {
+             nn = float32_one;
+         }
+-        d[i] = nn ^ (mm & 2) << 30;
++        if (mm & 2) {
++            nn = float32_maybe_ah_chs(nn, fpcr_ah);
++        }
++        d[i] = nn;
+     }
+ }
+ void HELPER(sve_ftssel_d)(void *vd, void *vn, void *vm, uint32_t desc)
+ {
+     intptr_t i, opr_sz = simd_oprsz(desc) / 8;
++    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT, 1);
+     uint64_t *d = vd, *n = vn, *m = vm;
+     for (i = 0; i < opr_sz; i += 1) {
+         uint64_t nn = n[i];
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_ftssel_d)(void *vd, void *vn, void *vm, uint32_t desc)
+         if (mm & 1) {
+             nn = float64_one;
+         }
+-        d[i] = nn ^ (mm & 2) << 62;
++        if (mm & 2) {
++            nn = float64_maybe_ah_chs(nn, fpcr_ah);
++        }
++        d[i] = nn;
+     }
+ }
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_2 * const fexpa_fns[4] = {
+     gen_helper_sve_fexpa_s, gen_helper_sve_fexpa_d,
+ };
+ TRANS_FEAT_NONSTREAMING(FEXPA, aa64_sve, gen_gvec_ool_zz,
+-                        fexpa_fns[a->esz], a->rd, a->rn, 0)
++                        fexpa_fns[a->esz], a->rd, a->rn, s->fpcr_ah)
+ static gen_helper_gvec_3 * const ftssel_fns[4] = {
+     NULL,                    gen_helper_sve_ftssel_h,
+     gen_helper_sve_ftssel_s, gen_helper_sve_ftssel_d,
+ };
+ TRANS_FEAT_NONSTREAMING(FTSSEL, aa64_sve, gen_gvec_ool_arg_zzz,
+-                        ftssel_fns[a->esz], a, 0)
++                        ftssel_fns[a->esz], a, s->fpcr_ah)
+ /*
+  *** SVE Predicate Logical Operations Group
 --
-.25.1
+.34.1

-[PULL 25/32] hw/intc/arm_gicv3: Set GICR_CTLR.CES if LPIs are supported
+[PULL 44/68] target/arm: Handle FPCR.AH in SVE FTMAD
-The GICR_CTLR.CES bit is a read-only bit which is set to 1 to indicate
+The negation step in the SVE FTMAD insn mustn't negate a NaN when
-that the GICR_CTLR.EnableLPIs bit can be written to 0 to disable
+FPCR.AH is set.  Pass FPCR.AH to the helper via the SIMD data field,
-LPIs (as opposed to allowing LPIs to be enabled but not subsequently
+so we can select the correct behaviour.
-disabled). Our implementation permits this, so advertise it
-by setting CES to 1.
+Because the operand is known to be negative, negating the operand
 is the same as taking the absolute value.  Defer this to the muladd
 operation via flags, so that it happens after NaN detection, which
 is correct for FPCR.AH.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-10-peter.maydell@linaro.org
 ---
- hw/intc/gicv3_internal.h   | 1 +
+ target/arm/tcg/sve_helper.c    | 42 ++++++++++++++++++++++++++--------
- hw/intc/arm_gicv3_common.c | 4 ++++
+ target/arm/tcg/translate-sve.c |  3 ++-
-files changed, 5 insertions(+)
+files changed, 35 insertions(+), 10 deletions(-)
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
+diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/target/arm/tcg/sve_helper.c
-+++ b/hw/intc/gicv3_internal.h
++++ b/target/arm/tcg/sve_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_ftmad_h)(void *vd, void *vn, void *vm,
- #define GICR_NSACR            (GICR_SGI_OFFSET + 0x0E00)
+x3c00, 0xb800, 0x293a, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+     };
- #define GICR_CTLR_ENABLE_LPIS        (1U << 0)
+     intptr_t i, opr_sz = simd_oprsz(desc) / sizeof(float16);
-+#define GICR_CTLR_CES                (1U << 1)
+-    intptr_t x = simd_data(desc);
- #define GICR_CTLR_RWP                (1U << 3)
++    intptr_t x = extract32(desc, SIMD_DATA_SHIFT, 3);
- #define GICR_CTLR_DPG0               (1U << 24)
++    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 3, 1);
- #define GICR_CTLR_DPG1NS             (1U << 25)
+     float16 *d = vd, *n = vn, *m = vm;
-diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
++
      for (i = 0; i < opr_sz; i++) {
          float16 mm = m[i];
          intptr_t xx = x;
 +        int flags = 0;
 +
          if (float16_is_neg(mm)) {
 -            mm = float16_abs(mm);
 +            if (fpcr_ah) {
 +                flags = float_muladd_negate_product;
 +            } else {
 +                mm = float16_abs(mm);
 +            }
              xx += 8;
          }
 -        d[i] = float16_muladd(n[i], mm, coeff[xx], 0, s);
 +        d[i] = float16_muladd(n[i], mm, coeff[xx], flags, s);
      }
  }
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_ftmad_s)(void *vd, void *vn, void *vm,
 x37cd37cc, 0x00000000, 0x00000000, 0x00000000,
      };
      intptr_t i, opr_sz = simd_oprsz(desc) / sizeof(float32);
 -    intptr_t x = simd_data(desc);
 +    intptr_t x = extract32(desc, SIMD_DATA_SHIFT, 3);
 +    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 3, 1);
      float32 *d = vd, *n = vn, *m = vm;
 +
      for (i = 0; i < opr_sz; i++) {
          float32 mm = m[i];
          intptr_t xx = x;
 +        int flags = 0;
 +
          if (float32_is_neg(mm)) {
 -            mm = float32_abs(mm);
 +            if (fpcr_ah) {
 +                flags = float_muladd_negate_product;
 +            } else {
 +                mm = float32_abs(mm);
 +            }
              xx += 8;
          }
 -        d[i] = float32_muladd(n[i], mm, coeff[xx], 0, s);
 +        d[i] = float32_muladd(n[i], mm, coeff[xx], flags, s);
      }
  }
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_ftmad_d)(void *vd, void *vn, void *vm,
 x3e21ee96d2641b13ull, 0xbda8f76380fbb401ull,
      };
      intptr_t i, opr_sz = simd_oprsz(desc) / sizeof(float64);
 -    intptr_t x = simd_data(desc);
 +    intptr_t x = extract32(desc, SIMD_DATA_SHIFT, 3);
 +    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 3, 1);
      float64 *d = vd, *n = vn, *m = vm;
 +
      for (i = 0; i < opr_sz; i++) {
          float64 mm = m[i];
          intptr_t xx = x;
 +        int flags = 0;
 +
          if (float64_is_neg(mm)) {
 -            mm = float64_abs(mm);
 +            if (fpcr_ah) {
 +                flags = float_muladd_negate_product;
 +            } else {
 +                mm = float64_abs(mm);
 +            }
              xx += 8;
          }
 -        d[i] = float64_muladd(n[i], mm, coeff[xx], 0, s);
 +        d[i] = float64_muladd(n[i], mm, coeff[xx], flags, s);
      }
  }
 diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_common.c
+--- a/target/arm/tcg/translate-sve.c
-+++ b/hw/intc/arm_gicv3_common.c
++++ b/target/arm/tcg/translate-sve.c
-@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_reset(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const ftmad_fns[4] = {
+     gen_helper_sve_ftmad_s, gen_helper_sve_ftmad_d,
-         cs->level = 0;
+ };
-         cs->gicr_ctlr = 0;
+ TRANS_FEAT_NONSTREAMING(FTMAD, aa64_sve, gen_gvec_fpst_zzz,
-+        if (s->lpi_enable) {
+-                        ftmad_fns[a->esz], a->rd, a->rn, a->rm, a->imm,
-+            /* Our implementation supports clearing GICR_CTLR.EnableLPIs */
++                        ftmad_fns[a->esz], a->rd, a->rn, a->rm,
-+            cs->gicr_ctlr |= GICR_CTLR_CES;
++                        a->imm | (s->fpcr_ah << 3),
-+        }
+                         a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
-         cs->gicr_statusr[GICV3_S] = 0;
-         cs->gicr_statusr[GICV3_NS] = 0;
+ /*
          cs->gicr_waker = GICR_WAKER_ProcessorSleep | GICR_WAKER_ChildrenAsleep;
 --
-.25.1
+.34.1

-New patch
+[PULL 45/68] target/arm: Handle FPCR.AH in vector FCMLA
+From: Richard Henderson <richard.henderson@linaro.org>
+The negation step in FCMLA mustn't negate a NaN when FPCR.AH
+is set. Handle this by passing FPCR.AH to the helper via the
+SIMD data field, and use this to select whether to do the
+negation via XOR or via the muladd negate_product flag.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250129013857.135256-26-richard.henderson@linaro.org
+[PMM: Expanded commit message]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/tcg/translate-a64.c |  2 +-
+ target/arm/tcg/vec_helper.c    | 66 ++++++++++++++++++++--------------
+files changed, 40 insertions(+), 28 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCMLA_v(DisasContext *s, arg_FCMLA_v *a)
+     gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
+                       a->esz == MO_16 ? FPST_A64_F16 : FPST_A64,
+-                      a->rot, fn[a->esz]);
++                      a->rot | (s->fpcr_ah << 2), fn[a->esz]);
+     return true;
+ }
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcmlah)(void *vd, void *vn, void *vm, void *va,
+     uintptr_t opr_sz = simd_oprsz(desc);
+     float16 *d = vd, *n = vn, *m = vm, *a = va;
+     intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+-    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+-    uint32_t neg_real = flip ^ neg_imag;
++    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
++    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
++    uint32_t negf_real = flip ^ negf_imag;
++    float16 negx_imag, negx_real;
+     uintptr_t i;
+-    /* Shift boolean to the sign bit so we can xor to negate.  */
+-    neg_real <<= 15;
+-    neg_imag <<= 15;
++    /* With AH=0, use negx; with AH=1 use negf. */
++    negx_real = (negf_real & ~fpcr_ah) << 15;
++    negx_imag = (negf_imag & ~fpcr_ah) << 15;
++    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
++    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
+     for (i = 0; i < opr_sz / 2; i += 2) {
+         float16 e2 = n[H2(i + flip)];
+-        float16 e1 = m[H2(i + flip)] ^ neg_real;
++        float16 e1 = m[H2(i + flip)] ^ negx_real;
+         float16 e4 = e2;
+-        float16 e3 = m[H2(i + 1 - flip)] ^ neg_imag;
++        float16 e3 = m[H2(i + 1 - flip)] ^ negx_imag;
+-        d[H2(i)] = float16_muladd(e2, e1, a[H2(i)], 0, fpst);
+-        d[H2(i + 1)] = float16_muladd(e4, e3, a[H2(i + 1)], 0, fpst);
++        d[H2(i)] = float16_muladd(e2, e1, a[H2(i)], negf_real, fpst);
++        d[H2(i + 1)] = float16_muladd(e4, e3, a[H2(i + 1)], negf_imag, fpst);
+     }
+     clear_tail(d, opr_sz, simd_maxsz(desc));
+ }
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcmlas)(void *vd, void *vn, void *vm, void *va,
+     uintptr_t opr_sz = simd_oprsz(desc);
+     float32 *d = vd, *n = vn, *m = vm, *a = va;
+     intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+-    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+-    uint32_t neg_real = flip ^ neg_imag;
++    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
++    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
++    uint32_t negf_real = flip ^ negf_imag;
++    float32 negx_imag, negx_real;
+     uintptr_t i;
+-    /* Shift boolean to the sign bit so we can xor to negate.  */
+-    neg_real <<= 31;
+-    neg_imag <<= 31;
++    /* With AH=0, use negx; with AH=1 use negf. */
++    negx_real = (negf_real & ~fpcr_ah) << 31;
++    negx_imag = (negf_imag & ~fpcr_ah) << 31;
++    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
++    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
+     for (i = 0; i < opr_sz / 4; i += 2) {
+         float32 e2 = n[H4(i + flip)];
+-        float32 e1 = m[H4(i + flip)] ^ neg_real;
++        float32 e1 = m[H4(i + flip)] ^ negx_real;
+         float32 e4 = e2;
+-        float32 e3 = m[H4(i + 1 - flip)] ^ neg_imag;
++        float32 e3 = m[H4(i + 1 - flip)] ^ negx_imag;
+-        d[H4(i)] = float32_muladd(e2, e1, a[H4(i)], 0, fpst);
+-        d[H4(i + 1)] = float32_muladd(e4, e3, a[H4(i + 1)], 0, fpst);
++        d[H4(i)] = float32_muladd(e2, e1, a[H4(i)], negf_real, fpst);
++        d[H4(i + 1)] = float32_muladd(e4, e3, a[H4(i + 1)], negf_imag, fpst);
+     }
+     clear_tail(d, opr_sz, simd_maxsz(desc));
+ }
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcmlad)(void *vd, void *vn, void *vm, void *va,
+     uintptr_t opr_sz = simd_oprsz(desc);
+     float64 *d = vd, *n = vn, *m = vm, *a = va;
+     intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+-    uint64_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+-    uint64_t neg_real = flip ^ neg_imag;
++    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
++    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
++    uint32_t negf_real = flip ^ negf_imag;
++    float64 negx_real, negx_imag;
+     uintptr_t i;
+-    /* Shift boolean to the sign bit so we can xor to negate.  */
+-    neg_real <<= 63;
+-    neg_imag <<= 63;
++    /* With AH=0, use negx; with AH=1 use negf. */
++    negx_real = (uint64_t)(negf_real & ~fpcr_ah) << 63;
++    negx_imag = (uint64_t)(negf_imag & ~fpcr_ah) << 63;
++    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
++    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
+     for (i = 0; i < opr_sz / 8; i += 2) {
+         float64 e2 = n[i + flip];
+-        float64 e1 = m[i + flip] ^ neg_real;
++        float64 e1 = m[i + flip] ^ negx_real;
+         float64 e4 = e2;
+-        float64 e3 = m[i + 1 - flip] ^ neg_imag;
++        float64 e3 = m[i + 1 - flip] ^ negx_imag;
+-        d[i] = float64_muladd(e2, e1, a[i], 0, fpst);
+-        d[i + 1] = float64_muladd(e4, e3, a[i + 1], 0, fpst);
++        d[i] = float64_muladd(e2, e1, a[i], negf_real, fpst);
++        d[i + 1] = float64_muladd(e4, e3, a[i + 1], negf_imag, fpst);
+     }
+     clear_tail(d, opr_sz, simd_maxsz(desc));
+ }
+--
+.34.1

-New patch
+[PULL 46/68] target/arm: Handle FPCR.AH in FCMLA by index
+From: Richard Henderson <richard.henderson@linaro.org>
+The negation step in FCMLA by index mustn't negate a NaN when
+FPCR.AH is set. Use the same approach as vector FCMLA of
+passing in FPCR.AH and using it to select whether to negate
+by XOR or by the muladd negate_product flag.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250129013857.135256-27-richard.henderson@linaro.org
+[PMM: Expanded commit message]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/tcg/translate-a64.c |  2 +-
+ target/arm/tcg/vec_helper.c    | 44 ++++++++++++++++++++--------------
+files changed, 27 insertions(+), 19 deletions(-)
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-a64.c
++++ b/target/arm/tcg/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static bool trans_FCMLA_vi(DisasContext *s, arg_FCMLA_vi *a)
+     if (fp_access_check(s)) {
+         gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
+                           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64,
+-                          (a->idx << 2) | a->rot, fn);
++                          (s->fpcr_ah << 4) | (a->idx << 2) | a->rot, fn);
+     }
+     return true;
+ }
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcmlah_idx)(void *vd, void *vn, void *vm, void *va,
+     uintptr_t opr_sz = simd_oprsz(desc);
+     float16 *d = vd, *n = vn, *m = vm, *a = va;
+     intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+-    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
++    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+     intptr_t index = extract32(desc, SIMD_DATA_SHIFT + 2, 2);
+-    uint32_t neg_real = flip ^ neg_imag;
++    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 4, 1);
++    uint32_t negf_real = flip ^ negf_imag;
+     intptr_t elements = opr_sz / sizeof(float16);
+     intptr_t eltspersegment = MIN(16 / sizeof(float16), elements);
++    float16 negx_imag, negx_real;
+     intptr_t i, j;
+-    /* Shift boolean to the sign bit so we can xor to negate.  */
+-    neg_real <<= 15;
+-    neg_imag <<= 15;
++    /* With AH=0, use negx; with AH=1 use negf. */
++    negx_real = (negf_real & ~fpcr_ah) << 15;
++    negx_imag = (negf_imag & ~fpcr_ah) << 15;
++    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
++    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
+     for (i = 0; i < elements; i += eltspersegment) {
+         float16 mr = m[H2(i + 2 * index + 0)];
+         float16 mi = m[H2(i + 2 * index + 1)];
+-        float16 e1 = neg_real ^ (flip ? mi : mr);
+-        float16 e3 = neg_imag ^ (flip ? mr : mi);
++        float16 e1 = negx_real ^ (flip ? mi : mr);
++        float16 e3 = negx_imag ^ (flip ? mr : mi);
+         for (j = i; j < i + eltspersegment; j += 2) {
+             float16 e2 = n[H2(j + flip)];
+             float16 e4 = e2;
+-            d[H2(j)] = float16_muladd(e2, e1, a[H2(j)], 0, fpst);
+-            d[H2(j + 1)] = float16_muladd(e4, e3, a[H2(j + 1)], 0, fpst);
++            d[H2(j)] = float16_muladd(e2, e1, a[H2(j)], negf_real, fpst);
++            d[H2(j + 1)] = float16_muladd(e4, e3, a[H2(j + 1)], negf_imag, fpst);
+         }
+     }
+     clear_tail(d, opr_sz, simd_maxsz(desc));
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcmlas_idx)(void *vd, void *vn, void *vm, void *va,
+     uintptr_t opr_sz = simd_oprsz(desc);
+     float32 *d = vd, *n = vn, *m = vm, *a = va;
+     intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+-    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
++    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+     intptr_t index = extract32(desc, SIMD_DATA_SHIFT + 2, 2);
+-    uint32_t neg_real = flip ^ neg_imag;
++    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 4, 1);
++    uint32_t negf_real = flip ^ negf_imag;
+     intptr_t elements = opr_sz / sizeof(float32);
+     intptr_t eltspersegment = MIN(16 / sizeof(float32), elements);
++    float32 negx_imag, negx_real;
+     intptr_t i, j;
+-    /* Shift boolean to the sign bit so we can xor to negate.  */
+-    neg_real <<= 31;
+-    neg_imag <<= 31;
++    /* With AH=0, use negx; with AH=1 use negf. */
++    negx_real = (negf_real & ~fpcr_ah) << 31;
++    negx_imag = (negf_imag & ~fpcr_ah) << 31;
++    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
++    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
+     for (i = 0; i < elements; i += eltspersegment) {
+         float32 mr = m[H4(i + 2 * index + 0)];
+         float32 mi = m[H4(i + 2 * index + 1)];
+-        float32 e1 = neg_real ^ (flip ? mi : mr);
+-        float32 e3 = neg_imag ^ (flip ? mr : mi);
++        float32 e1 = negx_real ^ (flip ? mi : mr);
++        float32 e3 = negx_imag ^ (flip ? mr : mi);
+         for (j = i; j < i + eltspersegment; j += 2) {
+             float32 e2 = n[H4(j + flip)];
+             float32 e4 = e2;
+-            d[H4(j)] = float32_muladd(e2, e1, a[H4(j)], 0, fpst);
+-            d[H4(j + 1)] = float32_muladd(e4, e3, a[H4(j + 1)], 0, fpst);
++            d[H4(j)] = float32_muladd(e2, e1, a[H4(j)], negf_real, fpst);
++            d[H4(j + 1)] = float32_muladd(e4, e3, a[H4(j + 1)], negf_imag, fpst);
+         }
+     }
+     clear_tail(d, opr_sz, simd_maxsz(desc));
+--
+.34.1

-New patch
+[PULL 47/68] target/arm: Handle FPCR.AH in SVE FCMLA
+From: Richard Henderson <richard.henderson@linaro.org>
+The negation step in SVE FCMLA mustn't negate a NaN when FPCR.AH is
+set.  Use the same approach as we did for A64 FCMLA of passing in
+FPCR.AH and using it to select whether to negate by XOR or by the
+muladd negate_product flag.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250129013857.135256-28-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/tcg/sve_helper.c    | 69 +++++++++++++++++++++-------------
+ target/arm/tcg/translate-sve.c |  2 +-
+files changed, 43 insertions(+), 28 deletions(-)
+diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/sve_helper.c
++++ b/target/arm/tcg/sve_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
+                                void *vg, float_status *status, uint32_t desc)
+ {
+     intptr_t j, i = simd_oprsz(desc);
+-    unsigned rot = simd_data(desc);
+-    bool flip = rot & 1;
+-    float16 neg_imag, neg_real;
++    bool flip = extract32(desc, SIMD_DATA_SHIFT, 1);
++    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
++    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
++    uint32_t negf_real = flip ^ negf_imag;
++    float16 negx_imag, negx_real;
+     uint64_t *g = vg;
+-    neg_imag = float16_set_sign(0, (rot & 2) != 0);
+-    neg_real = float16_set_sign(0, rot == 1 || rot == 2);
++    /* With AH=0, use negx; with AH=1 use negf. */
++    negx_real = (negf_real & ~fpcr_ah) << 15;
++    negx_imag = (negf_imag & ~fpcr_ah) << 15;
++    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
++    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
+     do {
+         uint64_t pg = g[(i - 1) >> 6];
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
+             mi = *(float16 *)(vm + H1_2(j));
+             e2 = (flip ? ni : nr);
+-            e1 = (flip ? mi : mr) ^ neg_real;
++            e1 = (flip ? mi : mr) ^ negx_real;
+             e4 = e2;
+-            e3 = (flip ? mr : mi) ^ neg_imag;
++            e3 = (flip ? mr : mi) ^ negx_imag;
+             if (likely((pg >> (i & 63)) & 1)) {
+                 d = *(float16 *)(va + H1_2(i));
+-                d = float16_muladd(e2, e1, d, 0, status);
++                d = float16_muladd(e2, e1, d, negf_real, status);
+                 *(float16 *)(vd + H1_2(i)) = d;
+             }
+             if (likely((pg >> (j & 63)) & 1)) {
+                 d = *(float16 *)(va + H1_2(j));
+-                d = float16_muladd(e4, e3, d, 0, status);
++                d = float16_muladd(e4, e3, d, negf_imag, status);
+                 *(float16 *)(vd + H1_2(j)) = d;
+             }
+         } while (i & 63);
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
+                                void *vg, float_status *status, uint32_t desc)
+ {
+     intptr_t j, i = simd_oprsz(desc);
+-    unsigned rot = simd_data(desc);
+-    bool flip = rot & 1;
+-    float32 neg_imag, neg_real;
++    bool flip = extract32(desc, SIMD_DATA_SHIFT, 1);
++    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
++    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
++    uint32_t negf_real = flip ^ negf_imag;
++    float32 negx_imag, negx_real;
+     uint64_t *g = vg;
+-    neg_imag = float32_set_sign(0, (rot & 2) != 0);
+-    neg_real = float32_set_sign(0, rot == 1 || rot == 2);
++    /* With AH=0, use negx; with AH=1 use negf. */
++    negx_real = (negf_real & ~fpcr_ah) << 31;
++    negx_imag = (negf_imag & ~fpcr_ah) << 31;
++    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
++    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
+     do {
+         uint64_t pg = g[(i - 1) >> 6];
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
+             mi = *(float32 *)(vm + H1_2(j));
+             e2 = (flip ? ni : nr);
+-            e1 = (flip ? mi : mr) ^ neg_real;
++            e1 = (flip ? mi : mr) ^ negx_real;
+             e4 = e2;
+-            e3 = (flip ? mr : mi) ^ neg_imag;
++            e3 = (flip ? mr : mi) ^ negx_imag;
+             if (likely((pg >> (i & 63)) & 1)) {
+                 d = *(float32 *)(va + H1_2(i));
+-                d = float32_muladd(e2, e1, d, 0, status);
++                d = float32_muladd(e2, e1, d, negf_real, status);
+                 *(float32 *)(vd + H1_2(i)) = d;
+             }
+             if (likely((pg >> (j & 63)) & 1)) {
+                 d = *(float32 *)(va + H1_2(j));
+-                d = float32_muladd(e4, e3, d, 0, status);
++                d = float32_muladd(e4, e3, d, negf_imag, status);
+                 *(float32 *)(vd + H1_2(j)) = d;
+             }
+         } while (i & 63);
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
+                                void *vg, float_status *status, uint32_t desc)
+ {
+     intptr_t j, i = simd_oprsz(desc);
+-    unsigned rot = simd_data(desc);
+-    bool flip = rot & 1;
+-    float64 neg_imag, neg_real;
++    bool flip = extract32(desc, SIMD_DATA_SHIFT, 1);
++    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
++    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
++    uint32_t negf_real = flip ^ negf_imag;
++    float64 negx_imag, negx_real;
+     uint64_t *g = vg;
+-    neg_imag = float64_set_sign(0, (rot & 2) != 0);
+-    neg_real = float64_set_sign(0, rot == 1 || rot == 2);
++    /* With AH=0, use negx; with AH=1 use negf. */
++    negx_real = (uint64_t)(negf_real & ~fpcr_ah) << 63;
++    negx_imag = (uint64_t)(negf_imag & ~fpcr_ah) << 63;
++    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
++    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
+     do {
+         uint64_t pg = g[(i - 1) >> 6];
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
+             mi = *(float64 *)(vm + H1_2(j));
+             e2 = (flip ? ni : nr);
+-            e1 = (flip ? mi : mr) ^ neg_real;
++            e1 = (flip ? mi : mr) ^ negx_real;
+             e4 = e2;
+-            e3 = (flip ? mr : mi) ^ neg_imag;
++            e3 = (flip ? mr : mi) ^ negx_imag;
+             if (likely((pg >> (i & 63)) & 1)) {
+                 d = *(float64 *)(va + H1_2(i));
+-                d = float64_muladd(e2, e1, d, 0, status);
++                d = float64_muladd(e2, e1, d, negf_real, status);
+                 *(float64 *)(vd + H1_2(i)) = d;
+             }
+             if (likely((pg >> (j & 63)) & 1)) {
+                 d = *(float64 *)(va + H1_2(j));
+-                d = float64_muladd(e4, e3, d, 0, status);
++                d = float64_muladd(e4, e3, d, negf_imag, status);
+                 *(float64 *)(vd + H1_2(j)) = d;
+             }
+         } while (i & 63);
+diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate-sve.c
++++ b/target/arm/tcg/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_5_ptr * const fcmla_fns[4] = {
+     gen_helper_sve_fcmla_zpzzz_s, gen_helper_sve_fcmla_zpzzz_d,
+ };
+ TRANS_FEAT(FCMLA_zpzzz, aa64_sve, gen_gvec_fpst_zzzzp, fcmla_fns[a->esz],
+-           a->rd, a->rn, a->rm, a->ra, a->pg, a->rot,
++           a->rd, a->rn, a->rm, a->ra, a->pg, a->rot | (s->fpcr_ah << 2),
+            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+ static gen_helper_gvec_4_ptr * const fcmla_idx_fns[4] = {
+--
+.34.1

-[PULL 10/32] hw/ssi: Add a model of Xilinx Versal's OSPI flash memory controller
+[PULL 48/68] target/arm: Handle FPCR.AH in FMLSL (by element and vector)
-From: Francisco Iglesias <francisco.iglesias@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add a model of Xilinx Versal's OSPI flash memory controller.
+Handle FPCR.AH's requirement to not negate the sign of a NaN
 in FMLSL by element and vector, using the usual trick of
 negating by XOR when AH=0 and by muladd flags when AH=1.
-Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Since we have the CPUARMState* in the helper anyway, we can
-Reviewed-by: Luc Michel <luc@lmichel.fr>
+look directly at env->vfp.fpcr and don't need toa pass in the
-Message-id: 20220121161141.14389-7-francisco.iglesias@xilinx.com
+FPCR.AH value via the SIMD data word.
-[PMM: fixed indent]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20250129013857.135256-31-richard.henderson@linaro.org
 [PMM: commit message tweaked]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/ssi/xlnx-versal-ospi.h |  111 ++
+ target/arm/tcg/vec_helper.c | 71 ++++++++++++++++++++++++-------------
- hw/ssi/xlnx-versal-ospi.c         | 1853 +++++++++++++++++++++++++++++
+file changed, 46 insertions(+), 25 deletions(-)
  hw/ssi/meson.build                |    1 +
 files changed, 1965 insertions(+)
  create mode 100644 include/hw/ssi/xlnx-versal-ospi.h
  create mode 100644 hw/ssi/xlnx-versal-ospi.c
-diff --git a/include/hw/ssi/xlnx-versal-ospi.h b/include/hw/ssi/xlnx-versal-ospi.h
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/target/arm/tcg/vec_helper.c
---- /dev/null
++++ b/target/arm/tcg/vec_helper.c
-+++ b/include/hw/ssi/xlnx-versal-ospi.h
+@@ -XXX,XX +XXX,XX @@ static uint64_t load4_f16(uint64_t *ptr, int is_q, int is_2)
-@@ -XXX,XX +XXX,XX @@
+  */
-+/*
-+ * Header file for the Xilinx Versal's OSPI controller
+ static void do_fmlal(float32 *d, void *vn, void *vm, float_status *fpst,
-+ *
+-                     uint32_t desc, bool fz16)
-+ * Copyright (C) 2021 Xilinx Inc
++                     uint64_t negx, int negf, uint32_t desc, bool fz16)
-+ * Written by Francisco Iglesias <francisco.iglesias@xilinx.com>
+ {
-+ *
+     intptr_t i, oprsz = simd_oprsz(desc);
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+-    int is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
-+ * of this software and associated documentation files (the "Software"), to deal
+     int is_2 = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
-+ * in the Software without restriction, including without limitation the rights
+     int is_q = oprsz == 16;
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+     uint64_t n_4, m_4;
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
+-    /* Pre-load all of the f16 data, avoiding overlap issues.  */
-+ *
+-    n_4 = load4_f16(vn, is_q, is_2);
-+ * The above copyright notice and this permission notice shall be included in
++    /*
-+ * all copies or substantial portions of the Software.
++     * Pre-load all of the f16 data, avoiding overlap issues.
-+ *
++     * Negate all inputs for AH=0 FMLSL at once.
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
++     */
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
++    n_4 = load4_f16(vn, is_q, is_2) ^ negx;
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+     m_4 = load4_f16(vm, is_q, is_2);
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+-    /* Negate all inputs for FMLSL at once.  */
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+-    if (is_s) {
-+ * THE SOFTWARE.
+-        n_4 ^= 0x8000800080008000ull;
-+ */
+-    }
 -
      for (i = 0; i < oprsz / 4; i++) {
          float32 n_1 = float16_to_float32_by_bits(n_4 >> (i * 16), fz16);
          float32 m_1 = float16_to_float32_by_bits(m_4 >> (i * 16), fz16);
 -        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], 0, fpst);
 +        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], negf, fpst);
      }
      clear_tail(d, oprsz, simd_maxsz(desc));
  }
@@ -XXX,XX +XXX,XX @@ static void do_fmlal(float32 *d, void *vn, void *vm, float_status *fpst,
  void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
                              CPUARMState *env, uint32_t desc)
  {
 -    do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, desc,
 +    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
 +    uint64_t negx = is_s ? 0x8000800080008000ull : 0;
 +
-+/*
++    do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, negx, 0, desc,
-+ * This is a model of Xilinx Versal's Octal SPI flash memory controller
+              get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
-+ * documented in Versal's Technical Reference manual [1] and the Versal ACAP
+ }
-+ * Register reference [2].
-+ *
+ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
-+ * References:
+                             CPUARMState *env, uint32_t desc)
-+ *
+ {
-+ * [1] Versal ACAP Technical Reference Manual,
+-    do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
-+ *     https://www.xilinx.com/support/documentation/architecture-manuals/am011-versal-acap-trm.pdf
++    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
-+ *
++    uint64_t negx = 0;
-+ * [2] Versal ACAP Register Reference,
++    int negf = 0;
 + *     https://www.xilinx.com/html_docs/registers/am012/am012-versal-register-reference.html#mod___ospi.html
 + *
 + *
 + * QEMU interface:
 + * + sysbus MMIO region 0: MemoryRegion for the device's registers
 + * + sysbus MMIO region 1: MemoryRegion for flash memory linear address space
 + *   (data transfer).
 + * + sysbus IRQ 0: Device interrupt.
 + * + Named GPIO input "ospi-mux-sel": 0: enables indirect access mode
 + *   and 1: enables direct access mode.
 + * + Property "dac-with-indac": Allow both direct accesses and indirect
 + *   accesses simultaneously.
 + * + Property "indac-write-disabled": Disable indirect access writes.
 + */
 +
-+#ifndef XILINX_VERSAL_OSPI_H
++    if (is_s) {
-+#define XILINX_VERSAL_OSPI_H
++        if (env->vfp.fpcr & FPCR_AH) {
-+
++            negf = float_muladd_negate_product;
-+#include "hw/register.h"
++        } else {
-+#include "hw/ssi/ssi.h"
++            negx = 0x8000800080008000ull;
 +#include "qemu/fifo8.h"
 +#include "hw/dma/xlnx_csu_dma.h"
 +
 +#define TYPE_XILINX_VERSAL_OSPI "xlnx.versal-ospi"
 +
 +OBJECT_DECLARE_SIMPLE_TYPE(XlnxVersalOspi, XILINX_VERSAL_OSPI)
 +
 +#define XILINX_VERSAL_OSPI_R_MAX (0xfc / 4 + 1)
 +
 +/*
 + * Indirect operations
 + */
 +typedef struct IndOp {
 +    uint32_t flash_addr;
 +    uint32_t num_bytes;
 +    uint32_t done_bytes;
 +    bool completed;
 +} IndOp;
 +
 +struct XlnxVersalOspi {
 +    SysBusDevice parent_obj;
 +
 +    MemoryRegion iomem;
 +    MemoryRegion iomem_dac;
 +
 +    uint8_t num_cs;
 +    qemu_irq *cs_lines;
 +
 +    SSIBus *spi;
 +
 +    Fifo8 rx_fifo;
 +    Fifo8 tx_fifo;
 +
 +    Fifo8 rx_sram;
 +    Fifo8 tx_sram;
 +
 +    qemu_irq irq;
 +
 +    XlnxCSUDMA *dma_src;
 +    bool ind_write_disabled;
 +    bool dac_with_indac;
 +    bool dac_enable;
 +    bool src_dma_inprog;
 +
 +    IndOp rd_ind_op[2];
 +    IndOp wr_ind_op[2];
 +
 +    uint32_t regs[XILINX_VERSAL_OSPI_R_MAX];
 +    RegisterInfo regs_info[XILINX_VERSAL_OSPI_R_MAX];
 +
 +    /* Maximum inferred membank size is 512 bytes */
 +    uint8_t stig_membank[512];
 +};
 +
 +#endif /* XILINX_VERSAL_OSPI_H */
 diff --git a/hw/ssi/xlnx-versal-ospi.c b/hw/ssi/xlnx-versal-ospi.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/ssi/xlnx-versal-ospi.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QEMU model of Xilinx Versal's OSPI controller.
 + *
 + * Copyright (c) 2021 Xilinx Inc.
 + * Written by Francisco Iglesias <francisco.iglesias@xilinx.com>
 + *
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
 +#include "qemu/osdep.h"
 +#include "hw/sysbus.h"
 +#include "migration/vmstate.h"
 +#include "hw/qdev-properties.h"
 +#include "qemu/bitops.h"
 +#include "qemu/log.h"
 +#include "hw/irq.h"
 +#include "hw/ssi/xlnx-versal-ospi.h"
 +
 +#ifndef XILINX_VERSAL_OSPI_ERR_DEBUG
 +#define XILINX_VERSAL_OSPI_ERR_DEBUG 0
 +#endif
 +
 +REG32(CONFIG_REG, 0x0)
 +    FIELD(CONFIG_REG, IDLE_FLD, 31, 1)
 +    FIELD(CONFIG_REG, DUAL_BYTE_OPCODE_EN_FLD, 30, 1)
 +    FIELD(CONFIG_REG, CRC_ENABLE_FLD, 29, 1)
 +    FIELD(CONFIG_REG, CONFIG_RESV2_FLD, 26, 3)
 +    FIELD(CONFIG_REG, PIPELINE_PHY_FLD, 25, 1)
 +    FIELD(CONFIG_REG, ENABLE_DTR_PROTOCOL_FLD, 24, 1)
 +    FIELD(CONFIG_REG, ENABLE_AHB_DECODER_FLD, 23, 1)
 +    FIELD(CONFIG_REG, MSTR_BAUD_DIV_FLD, 19, 4)
 +    FIELD(CONFIG_REG, ENTER_XIP_MODE_IMM_FLD, 18, 1)
 +    FIELD(CONFIG_REG, ENTER_XIP_MODE_FLD, 17, 1)
 +    FIELD(CONFIG_REG, ENB_AHB_ADDR_REMAP_FLD, 16, 1)
 +    FIELD(CONFIG_REG, ENB_DMA_IF_FLD, 15, 1)
 +    FIELD(CONFIG_REG, WR_PROT_FLASH_FLD, 14, 1)
 +    FIELD(CONFIG_REG, PERIPH_CS_LINES_FLD, 10, 4)
 +    FIELD(CONFIG_REG, PERIPH_SEL_DEC_FLD, 9, 1)
 +    FIELD(CONFIG_REG, ENB_LEGACY_IP_MODE_FLD, 8, 1)
 +    FIELD(CONFIG_REG, ENB_DIR_ACC_CTLR_FLD, 7, 1)
 +    FIELD(CONFIG_REG, RESET_CFG_FLD, 6, 1)
 +    FIELD(CONFIG_REG, RESET_PIN_FLD, 5, 1)
 +    FIELD(CONFIG_REG, HOLD_PIN_FLD, 4, 1)
 +    FIELD(CONFIG_REG, PHY_MODE_ENABLE_FLD, 3, 1)
 +    FIELD(CONFIG_REG, SEL_CLK_PHASE_FLD, 2, 1)
 +    FIELD(CONFIG_REG, SEL_CLK_POL_FLD, 1, 1)
 +    FIELD(CONFIG_REG, ENB_SPI_FLD, 0, 1)
 +REG32(DEV_INSTR_RD_CONFIG_REG, 0x4)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, RD_INSTR_RESV5_FLD, 29, 3)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, DUMMY_RD_CLK_CYCLES_FLD, 24, 5)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, RD_INSTR_RESV4_FLD, 21, 3)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, MODE_BIT_ENABLE_FLD, 20, 1)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, RD_INSTR_RESV3_FLD, 18, 2)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, DATA_XFER_TYPE_EXT_MODE_FLD, 16, 2)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, RD_INSTR_RESV2_FLD, 14, 2)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, ADDR_XFER_TYPE_STD_MODE_FLD, 12, 2)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, PRED_DIS_FLD, 11, 1)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, DDR_EN_FLD, 10, 1)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, INSTR_TYPE_FLD, 8, 2)
 +    FIELD(DEV_INSTR_RD_CONFIG_REG, RD_OPCODE_NON_XIP_FLD, 0, 8)
 +REG32(DEV_INSTR_WR_CONFIG_REG, 0x8)
 +    FIELD(DEV_INSTR_WR_CONFIG_REG, WR_INSTR_RESV4_FLD, 29, 3)
 +    FIELD(DEV_INSTR_WR_CONFIG_REG, DUMMY_WR_CLK_CYCLES_FLD, 24, 5)
 +    FIELD(DEV_INSTR_WR_CONFIG_REG, WR_INSTR_RESV3_FLD, 18, 6)
 +    FIELD(DEV_INSTR_WR_CONFIG_REG, DATA_XFER_TYPE_EXT_MODE_FLD, 16, 2)
 +    FIELD(DEV_INSTR_WR_CONFIG_REG, WR_INSTR_RESV2_FLD, 14, 2)
 +    FIELD(DEV_INSTR_WR_CONFIG_REG, ADDR_XFER_TYPE_STD_MODE_FLD, 12, 2)
 +    FIELD(DEV_INSTR_WR_CONFIG_REG, WR_INSTR_RESV1_FLD, 9, 3)
 +    FIELD(DEV_INSTR_WR_CONFIG_REG, WEL_DIS_FLD, 8, 1)
 +    FIELD(DEV_INSTR_WR_CONFIG_REG, WR_OPCODE_FLD, 0, 8)
 +REG32(DEV_DELAY_REG, 0xc)
 +    FIELD(DEV_DELAY_REG, D_NSS_FLD, 24, 8)
 +    FIELD(DEV_DELAY_REG, D_BTWN_FLD, 16, 8)
 +    FIELD(DEV_DELAY_REG, D_AFTER_FLD, 8, 8)
 +    FIELD(DEV_DELAY_REG, D_INIT_FLD, 0, 8)
 +REG32(RD_DATA_CAPTURE_REG, 0x10)
 +    FIELD(RD_DATA_CAPTURE_REG, RD_DATA_RESV3_FLD, 20, 12)
 +    FIELD(RD_DATA_CAPTURE_REG, DDR_READ_DELAY_FLD, 16, 4)
 +    FIELD(RD_DATA_CAPTURE_REG, RD_DATA_RESV2_FLD, 9, 7)
 +    FIELD(RD_DATA_CAPTURE_REG, DQS_ENABLE_FLD, 8, 1)
 +    FIELD(RD_DATA_CAPTURE_REG, RD_DATA_RESV1_FLD, 6, 2)
 +    FIELD(RD_DATA_CAPTURE_REG, SAMPLE_EDGE_SEL_FLD, 5, 1)
 +    FIELD(RD_DATA_CAPTURE_REG, DELAY_FLD, 1, 4)
 +    FIELD(RD_DATA_CAPTURE_REG, BYPASS_FLD, 0, 1)
 +REG32(DEV_SIZE_CONFIG_REG, 0x14)
 +    FIELD(DEV_SIZE_CONFIG_REG, DEV_SIZE_RESV_FLD, 29, 3)
 +    FIELD(DEV_SIZE_CONFIG_REG, MEM_SIZE_ON_CS3_FLD, 27, 2)
 +    FIELD(DEV_SIZE_CONFIG_REG, MEM_SIZE_ON_CS2_FLD, 25, 2)
 +    FIELD(DEV_SIZE_CONFIG_REG, MEM_SIZE_ON_CS1_FLD, 23, 2)
 +    FIELD(DEV_SIZE_CONFIG_REG, MEM_SIZE_ON_CS0_FLD, 21, 2)
 +    FIELD(DEV_SIZE_CONFIG_REG, BYTES_PER_SUBSECTOR_FLD, 16, 5)
 +    FIELD(DEV_SIZE_CONFIG_REG, BYTES_PER_DEVICE_PAGE_FLD, 4, 12)
 +    FIELD(DEV_SIZE_CONFIG_REG, NUM_ADDR_BYTES_FLD, 0, 4)
 +REG32(SRAM_PARTITION_CFG_REG, 0x18)
 +    FIELD(SRAM_PARTITION_CFG_REG, SRAM_PARTITION_RESV_FLD, 8, 24)
 +    FIELD(SRAM_PARTITION_CFG_REG, ADDR_FLD, 0, 8)
 +REG32(IND_AHB_ADDR_TRIGGER_REG, 0x1c)
 +REG32(DMA_PERIPH_CONFIG_REG, 0x20)
 +    FIELD(DMA_PERIPH_CONFIG_REG, DMA_PERIPH_RESV2_FLD, 12, 20)
 +    FIELD(DMA_PERIPH_CONFIG_REG, NUM_BURST_REQ_BYTES_FLD, 8, 4)
 +    FIELD(DMA_PERIPH_CONFIG_REG, DMA_PERIPH_RESV1_FLD, 4, 4)
 +    FIELD(DMA_PERIPH_CONFIG_REG, NUM_SINGLE_REQ_BYTES_FLD, 0, 4)
 +REG32(REMAP_ADDR_REG, 0x24)
 +REG32(MODE_BIT_CONFIG_REG, 0x28)
 +    FIELD(MODE_BIT_CONFIG_REG, RX_CRC_DATA_LOW_FLD, 24, 8)
 +    FIELD(MODE_BIT_CONFIG_REG, RX_CRC_DATA_UP_FLD, 16, 8)
 +    FIELD(MODE_BIT_CONFIG_REG, CRC_OUT_ENABLE_FLD, 15, 1)
 +    FIELD(MODE_BIT_CONFIG_REG, MODE_BIT_RESV1_FLD, 11, 4)
 +    FIELD(MODE_BIT_CONFIG_REG, CHUNK_SIZE_FLD, 8, 3)
 +    FIELD(MODE_BIT_CONFIG_REG, MODE_FLD, 0, 8)
 +REG32(SRAM_FILL_REG, 0x2c)
 +    FIELD(SRAM_FILL_REG, SRAM_FILL_INDAC_WRITE_FLD, 16, 16)
 +    FIELD(SRAM_FILL_REG, SRAM_FILL_INDAC_READ_FLD, 0, 16)
 +REG32(TX_THRESH_REG, 0x30)
 +    FIELD(TX_THRESH_REG, TX_THRESH_RESV_FLD, 5, 27)
 +    FIELD(TX_THRESH_REG, LEVEL_FLD, 0, 5)
 +REG32(RX_THRESH_REG, 0x34)
 +    FIELD(RX_THRESH_REG, RX_THRESH_RESV_FLD, 5, 27)
 +    FIELD(RX_THRESH_REG, LEVEL_FLD, 0, 5)
 +REG32(WRITE_COMPLETION_CTRL_REG, 0x38)
 +    FIELD(WRITE_COMPLETION_CTRL_REG, POLL_REP_DELAY_FLD, 24, 8)
 +    FIELD(WRITE_COMPLETION_CTRL_REG, POLL_COUNT_FLD, 16, 8)
 +    FIELD(WRITE_COMPLETION_CTRL_REG, ENABLE_POLLING_EXP_FLD, 15, 1)
 +    FIELD(WRITE_COMPLETION_CTRL_REG, DISABLE_POLLING_FLD, 14, 1)
 +    FIELD(WRITE_COMPLETION_CTRL_REG, POLLING_POLARITY_FLD, 13, 1)
 +    FIELD(WRITE_COMPLETION_CTRL_REG, WR_COMP_CTRL_RESV1_FLD, 12, 1)
 +    FIELD(WRITE_COMPLETION_CTRL_REG, POLLING_ADDR_EN_FLD, 11, 1)
 +    FIELD(WRITE_COMPLETION_CTRL_REG, POLLING_BIT_INDEX_FLD, 8, 3)
 +    FIELD(WRITE_COMPLETION_CTRL_REG, OPCODE_FLD, 0, 8)
 +REG32(NO_OF_POLLS_BEF_EXP_REG, 0x3c)
 +REG32(IRQ_STATUS_REG, 0x40)
 +    FIELD(IRQ_STATUS_REG, IRQ_STAT_RESV_FLD, 20, 12)
 +    FIELD(IRQ_STATUS_REG, ECC_FAIL_FLD, 19, 1)
 +    FIELD(IRQ_STATUS_REG, TX_CRC_CHUNK_BRK_FLD, 18, 1)
 +    FIELD(IRQ_STATUS_REG, RX_CRC_DATA_VAL_FLD, 17, 1)
 +    FIELD(IRQ_STATUS_REG, RX_CRC_DATA_ERR_FLD, 16, 1)
 +    FIELD(IRQ_STATUS_REG, IRQ_STAT_RESV1_FLD, 15, 1)
 +    FIELD(IRQ_STATUS_REG, STIG_REQ_INT_FLD, 14, 1)
 +    FIELD(IRQ_STATUS_REG, POLL_EXP_INT_FLD, 13, 1)
 +    FIELD(IRQ_STATUS_REG, INDRD_SRAM_FULL_FLD, 12, 1)
 +    FIELD(IRQ_STATUS_REG, RX_FIFO_FULL_FLD, 11, 1)
 +    FIELD(IRQ_STATUS_REG, RX_FIFO_NOT_EMPTY_FLD, 10, 1)
 +    FIELD(IRQ_STATUS_REG, TX_FIFO_FULL_FLD, 9, 1)
 +    FIELD(IRQ_STATUS_REG, TX_FIFO_NOT_FULL_FLD, 8, 1)
 +    FIELD(IRQ_STATUS_REG, RECV_OVERFLOW_FLD, 7, 1)
 +    FIELD(IRQ_STATUS_REG, INDIRECT_XFER_LEVEL_BREACH_FLD, 6, 1)
 +    FIELD(IRQ_STATUS_REG, ILLEGAL_ACCESS_DET_FLD, 5, 1)
 +    FIELD(IRQ_STATUS_REG, PROT_WR_ATTEMPT_FLD, 4, 1)
 +    FIELD(IRQ_STATUS_REG, INDIRECT_TRANSFER_REJECT_FLD, 3, 1)
 +    FIELD(IRQ_STATUS_REG, INDIRECT_OP_DONE_FLD, 2, 1)
 +    FIELD(IRQ_STATUS_REG, UNDERFLOW_DET_FLD, 1, 1)
 +    FIELD(IRQ_STATUS_REG, MODE_M_FAIL_FLD, 0, 1)
 +REG32(IRQ_MASK_REG, 0x44)
 +    FIELD(IRQ_MASK_REG, IRQ_MASK_RESV_FLD, 20, 12)
 +    FIELD(IRQ_MASK_REG, ECC_FAIL_MASK_FLD, 19, 1)
 +    FIELD(IRQ_MASK_REG, TX_CRC_CHUNK_BRK_MASK_FLD, 18, 1)
 +    FIELD(IRQ_MASK_REG, RX_CRC_DATA_VAL_MASK_FLD, 17, 1)
 +    FIELD(IRQ_MASK_REG, RX_CRC_DATA_ERR_MASK_FLD, 16, 1)
 +    FIELD(IRQ_MASK_REG, IRQ_MASK_RESV1_FLD, 15, 1)
 +    FIELD(IRQ_MASK_REG, STIG_REQ_MASK_FLD, 14, 1)
 +    FIELD(IRQ_MASK_REG, POLL_EXP_INT_MASK_FLD, 13, 1)
 +    FIELD(IRQ_MASK_REG, INDRD_SRAM_FULL_MASK_FLD, 12, 1)
 +    FIELD(IRQ_MASK_REG, RX_FIFO_FULL_MASK_FLD, 11, 1)
 +    FIELD(IRQ_MASK_REG, RX_FIFO_NOT_EMPTY_MASK_FLD, 10, 1)
 +    FIELD(IRQ_MASK_REG, TX_FIFO_FULL_MASK_FLD, 9, 1)
 +    FIELD(IRQ_MASK_REG, TX_FIFO_NOT_FULL_MASK_FLD, 8, 1)
 +    FIELD(IRQ_MASK_REG, RECV_OVERFLOW_MASK_FLD, 7, 1)
 +    FIELD(IRQ_MASK_REG, INDIRECT_XFER_LEVEL_BREACH_MASK_FLD, 6, 1)
 +    FIELD(IRQ_MASK_REG, ILLEGAL_ACCESS_DET_MASK_FLD, 5, 1)
 +    FIELD(IRQ_MASK_REG, PROT_WR_ATTEMPT_MASK_FLD, 4, 1)
 +    FIELD(IRQ_MASK_REG, INDIRECT_TRANSFER_REJECT_MASK_FLD, 3, 1)
 +    FIELD(IRQ_MASK_REG, INDIRECT_OP_DONE_MASK_FLD, 2, 1)
 +    FIELD(IRQ_MASK_REG, UNDERFLOW_DET_MASK_FLD, 1, 1)
 +    FIELD(IRQ_MASK_REG, MODE_M_FAIL_MASK_FLD, 0, 1)
 +REG32(LOWER_WR_PROT_REG, 0x50)
 +REG32(UPPER_WR_PROT_REG, 0x54)
 +REG32(WR_PROT_CTRL_REG, 0x58)
 +    FIELD(WR_PROT_CTRL_REG, WR_PROT_CTRL_RESV_FLD, 2, 30)
 +    FIELD(WR_PROT_CTRL_REG, ENB_FLD, 1, 1)
 +    FIELD(WR_PROT_CTRL_REG, INV_FLD, 0, 1)
 +REG32(INDIRECT_READ_XFER_CTRL_REG, 0x60)
 +    FIELD(INDIRECT_READ_XFER_CTRL_REG, INDIR_RD_XFER_RESV_FLD, 8, 24)
 +    FIELD(INDIRECT_READ_XFER_CTRL_REG, NUM_IND_OPS_DONE_FLD, 6, 2)
 +    FIELD(INDIRECT_READ_XFER_CTRL_REG, IND_OPS_DONE_STATUS_FLD, 5, 1)
 +    FIELD(INDIRECT_READ_XFER_CTRL_REG, RD_QUEUED_FLD, 4, 1)
 +    FIELD(INDIRECT_READ_XFER_CTRL_REG, SRAM_FULL_FLD, 3, 1)
 +    FIELD(INDIRECT_READ_XFER_CTRL_REG, RD_STATUS_FLD, 2, 1)
 +    FIELD(INDIRECT_READ_XFER_CTRL_REG, CANCEL_FLD, 1, 1)
 +    FIELD(INDIRECT_READ_XFER_CTRL_REG, START_FLD, 0, 1)
 +REG32(INDIRECT_READ_XFER_WATERMARK_REG, 0x64)
 +REG32(INDIRECT_READ_XFER_START_REG, 0x68)
 +REG32(INDIRECT_READ_XFER_NUM_BYTES_REG, 0x6c)
 +REG32(INDIRECT_WRITE_XFER_CTRL_REG, 0x70)
 +    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, INDIR_WR_XFER_RESV2_FLD, 8, 24)
 +    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, NUM_IND_OPS_DONE_FLD, 6, 2)
 +    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, IND_OPS_DONE_STATUS_FLD, 5, 1)
 +    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, WR_QUEUED_FLD, 4, 1)
 +    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, INDIR_WR_XFER_RESV1_FLD, 3, 1)
 +    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, WR_STATUS_FLD, 2, 1)
 +    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, CANCEL_FLD, 1, 1)
 +    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, START_FLD, 0, 1)
 +REG32(INDIRECT_WRITE_XFER_WATERMARK_REG, 0x74)
 +REG32(INDIRECT_WRITE_XFER_START_REG, 0x78)
 +REG32(INDIRECT_WRITE_XFER_NUM_BYTES_REG, 0x7c)
 +REG32(INDIRECT_TRIGGER_ADDR_RANGE_REG, 0x80)
 +    FIELD(INDIRECT_TRIGGER_ADDR_RANGE_REG, IND_RANGE_RESV1_FLD, 4, 28)
 +    FIELD(INDIRECT_TRIGGER_ADDR_RANGE_REG, IND_RANGE_WIDTH_FLD, 0, 4)
 +REG32(FLASH_COMMAND_CTRL_MEM_REG, 0x8c)
 +    FIELD(FLASH_COMMAND_CTRL_MEM_REG, FLASH_COMMAND_CTRL_MEM_RESV1_FLD, 29, 3)
 +    FIELD(FLASH_COMMAND_CTRL_MEM_REG, MEM_BANK_ADDR_FLD, 20, 9)
 +    FIELD(FLASH_COMMAND_CTRL_MEM_REG, FLASH_COMMAND_CTRL_MEM_RESV2_FLD, 19, 1)
 +    FIELD(FLASH_COMMAND_CTRL_MEM_REG, NB_OF_STIG_READ_BYTES_FLD, 16, 3)
 +    FIELD(FLASH_COMMAND_CTRL_MEM_REG, MEM_BANK_READ_DATA_FLD, 8, 8)
 +    FIELD(FLASH_COMMAND_CTRL_MEM_REG, FLASH_COMMAND_CTRL_MEM_RESV3_FLD, 2, 6)
 +    FIELD(FLASH_COMMAND_CTRL_MEM_REG, MEM_BANK_REQ_IN_PROGRESS_FLD, 1, 1)
 +    FIELD(FLASH_COMMAND_CTRL_MEM_REG, TRIGGER_MEM_BANK_REQ_FLD, 0, 1)
 +REG32(FLASH_CMD_CTRL_REG, 0x90)
 +    FIELD(FLASH_CMD_CTRL_REG, CMD_OPCODE_FLD, 24, 8)
 +    FIELD(FLASH_CMD_CTRL_REG, ENB_READ_DATA_FLD, 23, 1)
 +    FIELD(FLASH_CMD_CTRL_REG, NUM_RD_DATA_BYTES_FLD, 20, 3)
 +    FIELD(FLASH_CMD_CTRL_REG, ENB_COMD_ADDR_FLD, 19, 1)
 +    FIELD(FLASH_CMD_CTRL_REG, ENB_MODE_BIT_FLD, 18, 1)
 +    FIELD(FLASH_CMD_CTRL_REG, NUM_ADDR_BYTES_FLD, 16, 2)
 +    FIELD(FLASH_CMD_CTRL_REG, ENB_WRITE_DATA_FLD, 15, 1)
 +    FIELD(FLASH_CMD_CTRL_REG, NUM_WR_DATA_BYTES_FLD, 12, 3)
 +    FIELD(FLASH_CMD_CTRL_REG, NUM_DUMMY_CYCLES_FLD, 7, 5)
 +    FIELD(FLASH_CMD_CTRL_REG, FLASH_CMD_CTRL_RESV1_FLD, 3, 4)
 +    FIELD(FLASH_CMD_CTRL_REG, STIG_MEM_BANK_EN_FLD, 2, 1)
 +    FIELD(FLASH_CMD_CTRL_REG, CMD_EXEC_STATUS_FLD, 1, 1)
 +    FIELD(FLASH_CMD_CTRL_REG, CMD_EXEC_FLD, 0, 1)
 +REG32(FLASH_CMD_ADDR_REG, 0x94)
 +REG32(FLASH_RD_DATA_LOWER_REG, 0xa0)
 +REG32(FLASH_RD_DATA_UPPER_REG, 0xa4)
 +REG32(FLASH_WR_DATA_LOWER_REG, 0xa8)
 +REG32(FLASH_WR_DATA_UPPER_REG, 0xac)
 +REG32(POLLING_FLASH_STATUS_REG, 0xb0)
 +    FIELD(POLLING_FLASH_STATUS_REG, DEVICE_STATUS_RSVD_FLD2, 21, 11)
 +    FIELD(POLLING_FLASH_STATUS_REG, DEVICE_STATUS_NB_DUMMY, 16, 5)
 +    FIELD(POLLING_FLASH_STATUS_REG, DEVICE_STATUS_RSVD_FLD1, 9, 7)
 +    FIELD(POLLING_FLASH_STATUS_REG, DEVICE_STATUS_VALID_FLD, 8, 1)
 +    FIELD(POLLING_FLASH_STATUS_REG, DEVICE_STATUS_FLD, 0, 8)
 +REG32(PHY_CONFIGURATION_REG, 0xb4)
 +    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RESYNC_FLD, 31, 1)
 +    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RESET_FLD, 30, 1)
 +    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RX_DLL_BYPASS_FLD, 29, 1)
 +    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RESV2_FLD, 23, 6)
 +    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_TX_DLL_DELAY_FLD, 16, 7)
 +    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RESV1_FLD, 7, 9)
 +    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RX_DLL_DELAY_FLD, 0, 7)
 +REG32(PHY_MASTER_CONTROL_REG, 0xb8)
 +    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_CONTROL_RESV3_FLD, 25, 7)
 +    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_LOCK_MODE_FLD, 24, 1)
 +    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_BYPASS_MODE_FLD, 23, 1)
 +    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_PHASE_DETECT_SELECTOR_FLD, 20, 3)
 +    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_CONTROL_RESV2_FLD, 19, 1)
 +    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_NB_INDICATIONS_FLD, 16, 3)
 +    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_CONTROL_RESV1_FLD, 7, 9)
 +    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_INITIAL_DELAY_FLD, 0, 7)
 +REG32(DLL_OBSERVABLE_LOWER_REG, 0xbc)
 +    FIELD(DLL_OBSERVABLE_LOWER_REG,
 +          DLL_OBSERVABLE_LOWER_DLL_LOCK_INC_FLD, 24, 8)
 +    FIELD(DLL_OBSERVABLE_LOWER_REG,
 +          DLL_OBSERVABLE_LOWER_DLL_LOCK_DEC_FLD, 16, 8)
 +    FIELD(DLL_OBSERVABLE_LOWER_REG,
 +          DLL_OBSERVABLE_LOWER_LOOPBACK_LOCK_FLD, 15, 1)
 +    FIELD(DLL_OBSERVABLE_LOWER_REG,
 +          DLL_OBSERVABLE_LOWER_LOCK_VALUE_FLD, 8, 7)
 +    FIELD(DLL_OBSERVABLE_LOWER_REG,
 +          DLL_OBSERVABLE_LOWER_UNLOCK_COUNTER_FLD, 3, 5)
 +    FIELD(DLL_OBSERVABLE_LOWER_REG,
 +          DLL_OBSERVABLE_LOWER_LOCK_MODE_FLD, 1, 2)
 +    FIELD(DLL_OBSERVABLE_LOWER_REG,
 +          DLL_OBSERVABLE_LOWER_DLL_LOCK_FLD, 0, 1)
 +REG32(DLL_OBSERVABLE_UPPER_REG, 0xc0)
 +    FIELD(DLL_OBSERVABLE_UPPER_REG,
 +          DLL_OBSERVABLE_UPPER_RESV2_FLD, 23, 9)
 +    FIELD(DLL_OBSERVABLE_UPPER_REG,
 +          DLL_OBSERVABLE_UPPER_TX_DECODER_OUTPUT_FLD, 16, 7)
 +    FIELD(DLL_OBSERVABLE_UPPER_REG,
 +          DLL_OBSERVABLE_UPPER_RESV1_FLD, 7, 9)
 +    FIELD(DLL_OBSERVABLE_UPPER_REG,
 +          DLL_OBSERVABLE__UPPER_RX_DECODER_OUTPUT_FLD, 0, 7)
 +REG32(OPCODE_EXT_LOWER_REG, 0xe0)
 +    FIELD(OPCODE_EXT_LOWER_REG, EXT_READ_OPCODE_FLD, 24, 8)
 +    FIELD(OPCODE_EXT_LOWER_REG, EXT_WRITE_OPCODE_FLD, 16, 8)
 +    FIELD(OPCODE_EXT_LOWER_REG, EXT_POLL_OPCODE_FLD, 8, 8)
 +    FIELD(OPCODE_EXT_LOWER_REG, EXT_STIG_OPCODE_FLD, 0, 8)
 +REG32(OPCODE_EXT_UPPER_REG, 0xe4)
 +    FIELD(OPCODE_EXT_UPPER_REG, WEL_OPCODE_FLD, 24, 8)
 +    FIELD(OPCODE_EXT_UPPER_REG, EXT_WEL_OPCODE_FLD, 16, 8)
 +    FIELD(OPCODE_EXT_UPPER_REG, OPCODE_EXT_UPPER_RESV1_FLD, 0, 16)
 +REG32(MODULE_ID_REG, 0xfc)
 +    FIELD(MODULE_ID_REG, FIX_PATCH_FLD, 24, 8)
 +    FIELD(MODULE_ID_REG, MODULE_ID_FLD, 8, 16)
 +    FIELD(MODULE_ID_REG, MODULE_ID_RESV_FLD, 2, 6)
 +    FIELD(MODULE_ID_REG, CONF_FLD, 0, 2)
 +
 +#define RXFF_SZ 1024
 +#define TXFF_SZ 1024
 +
 +#define MAX_RX_DEC_OUT 8
 +
 +#define SZ_512MBIT (512 * 1024 * 1024)
 +#define SZ_1GBIT   (1024 * 1024 * 1024)
 +#define SZ_2GBIT   (2ULL * SZ_1GBIT)
 +#define SZ_4GBIT   (4ULL * SZ_1GBIT)
 +
 +#define IS_IND_DMA_START(op) (op->done_bytes == 0)
 +/*
 + * Bit field size of R_INDIRECT_WRITE_XFER_CTRL_REG_NUM_IND_OPS_DONE_FLD
 + * is 2 bits, which can record max of 3 indac operations.
 + */
 +#define IND_OPS_DONE_MAX 3
 +
 +typedef enum {
 +    WREN = 0x6,
 +} FlashCMD;
 +
 +static unsigned int ospi_stig_addr_len(XlnxVersalOspi *s)
 +{
 +    /* Num address bytes is NUM_ADDR_BYTES_FLD + 1 */
 +    return ARRAY_FIELD_EX32(s->regs,
 +                            FLASH_CMD_CTRL_REG, NUM_ADDR_BYTES_FLD) + 1;
 +}
 +
 +static unsigned int ospi_stig_wr_data_len(XlnxVersalOspi *s)
 +{
 +    /* Num write data bytes is NUM_WR_DATA_BYTES_FLD + 1 */
 +    return ARRAY_FIELD_EX32(s->regs,
 +                            FLASH_CMD_CTRL_REG, NUM_WR_DATA_BYTES_FLD) + 1;
 +}
 +
 +static unsigned int ospi_stig_rd_data_len(XlnxVersalOspi *s)
 +{
 +    /* Num read data bytes is NUM_RD_DATA_BYTES_FLD + 1 */
 +    return ARRAY_FIELD_EX32(s->regs,
 +                            FLASH_CMD_CTRL_REG, NUM_RD_DATA_BYTES_FLD) + 1;
 +}
 +
 +/*
 + * Status bits in R_IRQ_STATUS_REG are set when the event occurs and the
 + * interrupt is enabled in the mask register ([1] Section 2.3.17)
 + */
 +static void set_irq(XlnxVersalOspi *s, uint32_t set_mask)
 +{
 +    s->regs[R_IRQ_STATUS_REG] |= s->regs[R_IRQ_MASK_REG] & set_mask;
 +}
 +
 +static void ospi_update_irq_line(XlnxVersalOspi *s)
 +{
 +    qemu_set_irq(s->irq, !!(s->regs[R_IRQ_STATUS_REG] &
 +                            s->regs[R_IRQ_MASK_REG]));
 +}
 +
 +static uint8_t ospi_get_wr_opcode(XlnxVersalOspi *s)
 +{
 +    return ARRAY_FIELD_EX32(s->regs,
 +                            DEV_INSTR_WR_CONFIG_REG, WR_OPCODE_FLD);
 +}
 +
 +static uint8_t ospi_get_rd_opcode(XlnxVersalOspi *s)
 +{
 +    return ARRAY_FIELD_EX32(s->regs,
 +                            DEV_INSTR_RD_CONFIG_REG, RD_OPCODE_NON_XIP_FLD);
 +}
 +
 +static uint32_t ospi_get_num_addr_bytes(XlnxVersalOspi *s)
 +{
 +    /* Num address bytes is NUM_ADDR_BYTES_FLD + 1 */
 +    return ARRAY_FIELD_EX32(s->regs,
 +                            DEV_SIZE_CONFIG_REG, NUM_ADDR_BYTES_FLD) + 1;
 +}
 +
 +static void ospi_stig_membank_req(XlnxVersalOspi *s)
 +{
 +    int idx = ARRAY_FIELD_EX32(s->regs,
 +                               FLASH_COMMAND_CTRL_MEM_REG, MEM_BANK_ADDR_FLD);
 +
 +    ARRAY_FIELD_DP32(s->regs, FLASH_COMMAND_CTRL_MEM_REG,
 +                     MEM_BANK_READ_DATA_FLD, s->stig_membank[idx]);
 +}
 +
 +static int ospi_stig_membank_rd_bytes(XlnxVersalOspi *s)
 +{
 +    int rd_data_fld = ARRAY_FIELD_EX32(s->regs, FLASH_COMMAND_CTRL_MEM_REG,
 +                                       NB_OF_STIG_READ_BYTES_FLD);
 +    static const int sizes[6] = { 16, 32, 64, 128, 256, 512 };
 +    return (rd_data_fld < 6) ? sizes[rd_data_fld] : 0;
 +}
 +
 +static uint32_t ospi_get_page_sz(XlnxVersalOspi *s)
 +{
 +    return ARRAY_FIELD_EX32(s->regs,
 +                            DEV_SIZE_CONFIG_REG, BYTES_PER_DEVICE_PAGE_FLD);
 +}
 +
 +static bool ospi_ind_rd_watermark_enabled(XlnxVersalOspi *s)
 +{
 +    return s->regs[R_INDIRECT_READ_XFER_WATERMARK_REG];
 +}
 +
 +static void ind_op_advance(IndOp *op, unsigned int len)
 +{
 +    op->done_bytes += len;
 +    assert(op->done_bytes <= op->num_bytes);
 +    if (op->done_bytes == op->num_bytes) {
 +        op->completed = true;
 +    }
 +}
 +
 +static uint32_t ind_op_next_byte(IndOp *op)
 +{
 +    return op->flash_addr + op->done_bytes;
 +}
 +
 +static uint32_t ind_op_end_byte(IndOp *op)
 +{
 +    return op->flash_addr + op->num_bytes;
 +}
 +
 +static void ospi_ind_op_next(IndOp *op)
 +{
 +    op[0] = op[1];
 +    op[1].completed = true;
 +}
 +
 +static void ind_op_setup(IndOp *op, uint32_t flash_addr, uint32_t num_bytes)
 +{
 +    if (num_bytes & 0x3) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "OSPI indirect op num bytes not word aligned\n");
 +    }
 +    op->flash_addr = flash_addr;
 +    op->num_bytes = num_bytes;
 +    op->done_bytes = 0;
 +    op->completed = false;
 +}
 +
 +static bool ospi_ind_op_completed(IndOp *op)
 +{
 +    return op->completed;
 +}
 +
 +static bool ospi_ind_op_all_completed(XlnxVersalOspi *s)
 +{
 +    return s->rd_ind_op[0].completed && s->wr_ind_op[0].completed;
 +}
 +
 +static void ospi_ind_op_cancel(IndOp *op)
 +{
 +    op[0].completed = true;
 +    op[1].completed = true;
 +}
 +
 +static bool ospi_ind_op_add(IndOp *op, Fifo8 *fifo,
 +                            uint32_t flash_addr, uint32_t num_bytes)
 +{
 +    /* Check if first indirect op has been completed */
 +    if (op->completed) {
 +        fifo8_reset(fifo);
 +        ind_op_setup(op, flash_addr, num_bytes);
 +        return false;
 +    }
 +
 +    /* Check if second indirect op has been completed */
 +    op++;
 +    if (op->completed) {
 +        ind_op_setup(op, flash_addr, num_bytes);
 +        return false;
 +    }
 +    return true;
 +}
 +
 +static void ospi_ind_op_queue_up_rd(XlnxVersalOspi *s)
 +{
 +    uint32_t num_bytes = s->regs[R_INDIRECT_READ_XFER_NUM_BYTES_REG];
 +    uint32_t flash_addr = s->regs[R_INDIRECT_READ_XFER_START_REG];
 +    bool failed;
 +
 +    failed = ospi_ind_op_add(s->rd_ind_op, &s->rx_sram, flash_addr, num_bytes);
 +    /* If two already queued set rd reject interrupt */
 +    if (failed) {
 +        set_irq(s, R_IRQ_STATUS_REG_INDIRECT_TRANSFER_REJECT_FLD_MASK);
 +    }
 +}
 +
 +static void ospi_ind_op_queue_up_wr(XlnxVersalOspi *s)
 +{
 +    uint32_t num_bytes = s->regs[R_INDIRECT_WRITE_XFER_NUM_BYTES_REG];
 +    uint32_t flash_addr = s->regs[R_INDIRECT_WRITE_XFER_START_REG];
 +    bool failed;
 +
 +    failed = ospi_ind_op_add(s->wr_ind_op, &s->tx_sram, flash_addr, num_bytes);
 +    /* If two already queued set rd reject interrupt */
 +    if (failed) {
 +        set_irq(s, R_IRQ_STATUS_REG_INDIRECT_TRANSFER_REJECT_FLD_MASK);
 +    }
 +}
 +
 +static uint64_t flash_sz(XlnxVersalOspi *s, unsigned int cs)
 +{
 +    /* Flash sizes in MB */
 +    static const uint64_t sizes[4] = { SZ_512MBIT / 8, SZ_1GBIT / 8,
 +                                       SZ_2GBIT / 8, SZ_4GBIT / 8 };
 +    uint32_t v = s->regs[R_DEV_SIZE_CONFIG_REG];
 +
 +    v >>= cs * R_DEV_SIZE_CONFIG_REG_MEM_SIZE_ON_CS0_FLD_LENGTH;
 +    return sizes[FIELD_EX32(v, DEV_SIZE_CONFIG_REG, MEM_SIZE_ON_CS0_FLD)];
 +}
 +
 +static unsigned int ospi_get_block_sz(XlnxVersalOspi *s)
 +{
 +    unsigned int block_fld = ARRAY_FIELD_EX32(s->regs,
 +                                              DEV_SIZE_CONFIG_REG,
 +                                              BYTES_PER_SUBSECTOR_FLD);
 +    return 1 << block_fld;
 +}
 +
 +static unsigned int flash_blocks(XlnxVersalOspi *s, unsigned int cs)
 +{
 +    unsigned int b_sz = ospi_get_block_sz(s);
 +    unsigned int f_sz = flash_sz(s, cs);
 +
 +    return f_sz / b_sz;
 +}
 +
 +static int ospi_ahb_decoder_cs(XlnxVersalOspi *s, hwaddr addr)
 +{
 +    uint64_t end_addr = 0;
 +    int cs;
 +
 +    for (cs = 0; cs < s->num_cs; cs++) {
 +        end_addr += flash_sz(s, cs);
 +        if (addr < end_addr) {
 +            break;
 +        }
 +    }
++    do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, negx, negf, desc,
+              get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
+ }
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
+ }
+ static void do_fmlal_idx(float32 *d, void *vn, void *vm, float_status *fpst,
+-                         uint32_t desc, bool fz16)
++                         uint64_t negx, int negf, uint32_t desc, bool fz16)
+ {
+     intptr_t i, oprsz = simd_oprsz(desc);
+-    int is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
+     int is_2 = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+     int index = extract32(desc, SIMD_DATA_SHIFT + 2, 3);
+     int is_q = oprsz == 16;
+     uint64_t n_4;
+     float32 m_1;
+-    /* Pre-load all of the f16 data, avoiding overlap issues.  */
+-    n_4 = load4_f16(vn, is_q, is_2);
+-
+-    /* Negate all inputs for FMLSL at once.  */
+-    if (is_s) {
+-        n_4 ^= 0x8000800080008000ull;
+-    }
+-
++    /*
++     * Pre-load all of the f16 data, avoiding overlap issues.
++     * Negate all inputs for AH=0 FMLSL at once.
++     */
++    n_4 = load4_f16(vn, is_q, is_2) ^ negx;
+     m_1 = float16_to_float32_by_bits(((float16 *)vm)[H2(index)], fz16);
+     for (i = 0; i < oprsz / 4; i++) {
+         float32 n_1 = float16_to_float32_by_bits(n_4 >> (i * 16), fz16);
+-        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], 0, fpst);
++        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], negf, fpst);
+     }
+     clear_tail(d, oprsz, simd_maxsz(desc));
+ }
+@@ -XXX,XX +XXX,XX @@ static void do_fmlal_idx(float32 *d, void *vn, void *vm, float_status *fpst,
+ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
+                                 CPUARMState *env, uint32_t desc)
+ {
+-    do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, desc,
++    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
++    uint64_t negx = is_s ? 0x8000800080008000ull : 0;
 +
-+    if (cs == s->num_cs) {
++    do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, negx, 0, desc,
-+        /* Address is out of range */
+                  get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
-+        qemu_log_mask(LOG_GUEST_ERROR,
+ }
-+                      "OSPI flash address does not fit in configuration\n");
-+        return -1;
+ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
-+    }
+                                 CPUARMState *env, uint32_t desc)
-+    return cs;
+ {
-+}
+-    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
 +    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
 +    uint64_t negx = 0;
 +    int negf = 0;
 +
-+static void ospi_ahb_decoder_enable_cs(XlnxVersalOspi *s, hwaddr addr)
++    if (is_s) {
-+{
++        if (env->vfp.fpcr & FPCR_AH) {
-+    int cs = ospi_ahb_decoder_cs(s, addr);
++            negf = float_muladd_negate_product;
-+
++        } else {
-+    if (cs >= 0) {
++            negx = 0x8000800080008000ull;
 +        for (int i = 0; i < s->num_cs; i++) {
 +            qemu_set_irq(s->cs_lines[i], cs != i);
 +        }
 +    }
-+}
++    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, negx, negf, desc,
-+
+                  get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
-+static unsigned int single_cs(XlnxVersalOspi *s)
+ }
-+{
 +    unsigned int field = ARRAY_FIELD_EX32(s->regs,
 +                                          CONFIG_REG, PERIPH_CS_LINES_FLD);
 +
 +    /*
 +     * Below one liner is a trick that finds the rightmost zero and makes sure
 +     * all other bits are turned to 1. It is a variant of the 'Isolate the
 +     * rightmost 0-bit' trick found below at the time of writing:
 +     *
 +     * https://emre.me/computer-science/bit-manipulation-tricks/
 +     *
 +     * 4'bXXX0 -> 4'b1110
 +     * 4'bXX01 -> 4'b1101
 +     * 4'bX011 -> 4'b1011
 +     * 4'b0111 -> 4'b0111
 +     * 4'b1111 -> 4'b1111
 +     */
 +    return (field | ~(field + 1)) & 0xf;
 +}
 +
 +static void ospi_update_cs_lines(XlnxVersalOspi *s)
 +{
 +    unsigned int all_cs;
 +    int i;
 +
 +    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, PERIPH_SEL_DEC_FLD)) {
 +        all_cs = ARRAY_FIELD_EX32(s->regs, CONFIG_REG, PERIPH_CS_LINES_FLD);
 +    } else {
 +        all_cs = single_cs(s);
 +    }
 +
 +    for (i = 0; i < s->num_cs; i++) {
 +        bool cs = (all_cs >> i) & 1;
 +
 +        qemu_set_irq(s->cs_lines[i], cs);
 +    }
 +}
 +
 +static void ospi_dac_cs(XlnxVersalOspi *s, hwaddr addr)
 +{
 +    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENABLE_AHB_DECODER_FLD)) {
 +        ospi_ahb_decoder_enable_cs(s, addr);
 +    } else {
 +        ospi_update_cs_lines(s);
 +    }
 +}
 +
 +static void ospi_disable_cs(XlnxVersalOspi *s)
 +{
 +    int i;
 +
 +    for (i = 0; i < s->num_cs; i++) {
 +        qemu_set_irq(s->cs_lines[i], 1);
 +    }
 +}
 +
 +static void ospi_flush_txfifo(XlnxVersalOspi *s)
 +{
 +    while (!fifo8_is_empty(&s->tx_fifo)) {
 +        uint32_t tx_rx = fifo8_pop(&s->tx_fifo);
 +
 +        tx_rx = ssi_transfer(s->spi, tx_rx);
 +        fifo8_push(&s->rx_fifo, tx_rx);
 +    }
 +}
 +
 +static void ospi_tx_fifo_push_address_raw(XlnxVersalOspi *s,
 +                                          uint32_t flash_addr,
 +                                          unsigned int addr_bytes)
 +{
 +    /* Push write address */
 +    if (addr_bytes == 4) {
 +        fifo8_push(&s->tx_fifo, flash_addr >> 24);
 +    }
 +    if (addr_bytes >= 3) {
 +        fifo8_push(&s->tx_fifo, flash_addr >> 16);
 +    }
 +    if (addr_bytes >= 2) {
 +        fifo8_push(&s->tx_fifo, flash_addr >> 8);
 +    }
 +    fifo8_push(&s->tx_fifo, flash_addr);
 +}
 +
 +static void ospi_tx_fifo_push_address(XlnxVersalOspi *s, uint32_t flash_addr)
 +{
 +    /* Push write address */
 +    int addr_bytes = ospi_get_num_addr_bytes(s);
 +
 +    ospi_tx_fifo_push_address_raw(s, flash_addr, addr_bytes);
 +}
 +
 +static void ospi_tx_fifo_push_stig_addr(XlnxVersalOspi *s)
 +{
 +    uint32_t flash_addr = s->regs[R_FLASH_CMD_ADDR_REG];
 +    unsigned int addr_bytes = ospi_stig_addr_len(s);
 +
 +    ospi_tx_fifo_push_address_raw(s, flash_addr, addr_bytes);
 +}
 +
 +static void ospi_tx_fifo_push_rd_op_addr(XlnxVersalOspi *s, uint32_t flash_addr)
 +{
 +    uint8_t inst_code = ospi_get_rd_opcode(s);
 +
 +    fifo8_reset(&s->tx_fifo);
 +
 +    /* Push read opcode */
 +    fifo8_push(&s->tx_fifo, inst_code);
 +
 +    /* Push read address */
 +    ospi_tx_fifo_push_address(s, flash_addr);
 +}
 +
 +static void ospi_tx_fifo_push_stig_wr_data(XlnxVersalOspi *s)
 +{
 +    uint64_t data = s->regs[R_FLASH_WR_DATA_LOWER_REG];
 +    int wr_data_len = ospi_stig_wr_data_len(s);
 +    int i;
 +
 +    data |= (uint64_t) s->regs[R_FLASH_WR_DATA_UPPER_REG] << 32;
 +    for (i = 0; i < wr_data_len; i++) {
 +        int shift = i * 8;
 +        fifo8_push(&s->tx_fifo, data >> shift);
 +    }
 +}
 +
 +static void ospi_tx_fifo_push_stig_rd_data(XlnxVersalOspi *s)
 +{
 +    int rd_data_len;
 +    int i;
 +
 +    if (ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, STIG_MEM_BANK_EN_FLD)) {
 +        rd_data_len = ospi_stig_membank_rd_bytes(s);
 +    } else {
 +        rd_data_len = ospi_stig_rd_data_len(s);
 +    }
 +
 +    /* transmit second part (data) */
 +    for (i = 0; i < rd_data_len; ++i) {
 +        fifo8_push(&s->tx_fifo, 0);
 +    }
 +}
 +
 +static void ospi_rx_fifo_pop_stig_rd_data(XlnxVersalOspi *s)
 +{
 +    int size = ospi_stig_rd_data_len(s);
 +    uint8_t bytes[8] = {};
 +    int i;
 +
 +    size = MIN(fifo8_num_used(&s->rx_fifo), size);
 +
 +    assert(size <= 8);
 +
 +    for (i = 0; i < size; i++) {
 +        bytes[i] = fifo8_pop(&s->rx_fifo);
 +    }
 +
 +    s->regs[R_FLASH_RD_DATA_LOWER_REG] = ldl_le_p(bytes);
 +    s->regs[R_FLASH_RD_DATA_UPPER_REG] = ldl_le_p(bytes + 4);
 +}
 +
 +static void ospi_ind_read(XlnxVersalOspi *s, uint32_t flash_addr, uint32_t len)
 +{
 +    int i;
 +
 +    /* Create first section of read cmd */
 +    ospi_tx_fifo_push_rd_op_addr(s, flash_addr);
 +
 +    /* transmit first part */
 +    ospi_update_cs_lines(s);
 +    ospi_flush_txfifo(s);
 +
 +    fifo8_reset(&s->rx_fifo);
 +
 +    /* transmit second part (data) */
 +    for (i = 0; i < len; ++i) {
 +        fifo8_push(&s->tx_fifo, 0);
 +    }
 +    ospi_flush_txfifo(s);
 +
 +    for (i = 0; i < len; ++i) {
 +        fifo8_push(&s->rx_sram, fifo8_pop(&s->rx_fifo));
 +    }
 +
 +    /* done */
 +    ospi_disable_cs(s);
 +}
 +
 +static unsigned int ospi_dma_burst_size(XlnxVersalOspi *s)
 +{
 +    return 1 << ARRAY_FIELD_EX32(s->regs,
 +                                 DMA_PERIPH_CONFIG_REG,
 +                                 NUM_BURST_REQ_BYTES_FLD);
 +}
 +
 +static unsigned int ospi_dma_single_size(XlnxVersalOspi *s)
 +{
 +    return 1 << ARRAY_FIELD_EX32(s->regs,
 +                                 DMA_PERIPH_CONFIG_REG,
 +                                 NUM_SINGLE_REQ_BYTES_FLD);
 +}
 +
 +static void ind_rd_inc_num_done(XlnxVersalOspi *s)
 +{
 +    unsigned int done = ARRAY_FIELD_EX32(s->regs,
 +                                         INDIRECT_READ_XFER_CTRL_REG,
 +                                         NUM_IND_OPS_DONE_FLD);
 +    if (done < IND_OPS_DONE_MAX) {
 +        done++;
 +    }
 +    done &= 0x3;
 +    ARRAY_FIELD_DP32(s->regs, INDIRECT_READ_XFER_CTRL_REG,
 +                     NUM_IND_OPS_DONE_FLD, done);
 +}
 +
 +static void ospi_ind_rd_completed(XlnxVersalOspi *s)
 +{
 +    ARRAY_FIELD_DP32(s->regs, INDIRECT_READ_XFER_CTRL_REG,
 +                     IND_OPS_DONE_STATUS_FLD, 1);
 +
 +    ind_rd_inc_num_done(s);
 +    ospi_ind_op_next(s->rd_ind_op);
 +    if (ospi_ind_op_all_completed(s)) {
 +        set_irq(s, R_IRQ_STATUS_REG_INDIRECT_OP_DONE_FLD_MASK);
 +    }
 +}
 +
 +static void ospi_dma_read(XlnxVersalOspi *s)
 +{
 +    IndOp *op = s->rd_ind_op;
 +    uint32_t dma_len = op->num_bytes;
 +    uint32_t burst_sz = ospi_dma_burst_size(s);
 +    uint32_t single_sz = ospi_dma_single_size(s);
 +    uint32_t ind_trig_range;
 +    uint32_t remainder;
 +    XlnxCSUDMAClass *xcdc = XLNX_CSU_DMA_GET_CLASS(s->dma_src);
 +
 +    ind_trig_range = (1 << ARRAY_FIELD_EX32(s->regs,
 +                                            INDIRECT_TRIGGER_ADDR_RANGE_REG,
 +                                            IND_RANGE_WIDTH_FLD));
 +    remainder = dma_len % burst_sz;
 +    remainder = remainder % single_sz;
 +    if (burst_sz > ind_trig_range || single_sz > ind_trig_range ||
 +        remainder != 0) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "OSPI DMA burst size / single size config error\n");
 +    }
 +
 +    s->src_dma_inprog = true;
 +    if (xcdc->read(s->dma_src, 0, dma_len) != MEMTX_OK) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "OSPI DMA configuration error\n");
 +    }
 +    s->src_dma_inprog = false;
 +}
 +
 +static void ospi_do_ind_read(XlnxVersalOspi *s)
 +{
 +    IndOp *op = s->rd_ind_op;
 +    uint32_t next_b;
 +    uint32_t end_b;
 +    uint32_t len;
 +    bool start_dma = IS_IND_DMA_START(op) && !s->src_dma_inprog;
 +
 +    /* Continue to read flash until we run out of space in sram */
 +    while (!ospi_ind_op_completed(op) &&
 +           !fifo8_is_full(&s->rx_sram)) {
 +        /* Read reqested number of bytes, max bytes limited to size of sram */
 +        next_b = ind_op_next_byte(op);
 +        end_b = next_b + fifo8_num_free(&s->rx_sram);
 +        end_b = MIN(end_b, ind_op_end_byte(op));
 +
 +        len = end_b - next_b;
 +        ospi_ind_read(s, next_b, len);
 +        ind_op_advance(op, len);
 +
 +        if (ospi_ind_rd_watermark_enabled(s)) {
 +            ARRAY_FIELD_DP32(s->regs, IRQ_STATUS_REG,
 +                             INDIRECT_XFER_LEVEL_BREACH_FLD, 1);
 +            set_irq(s,
 +                    R_IRQ_STATUS_REG_INDIRECT_XFER_LEVEL_BREACH_FLD_MASK);
 +        }
 +
 +        if (!s->src_dma_inprog &&
 +            ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_DMA_IF_FLD)) {
 +            ospi_dma_read(s);
 +        }
 +    }
 +
 +    /* Set sram full */
 +    if (fifo8_num_used(&s->rx_sram) == RXFF_SZ) {
 +        ARRAY_FIELD_DP32(s->regs,
 +                         INDIRECT_READ_XFER_CTRL_REG, SRAM_FULL_FLD, 1);
 +        set_irq(s, R_IRQ_STATUS_REG_INDRD_SRAM_FULL_FLD_MASK);
 +    }
 +
 +    /* Signal completion if done, unless inside recursion via ospi_dma_read */
 +    if (!ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_DMA_IF_FLD) || start_dma) {
 +        if (ospi_ind_op_completed(op)) {
 +            ospi_ind_rd_completed(s);
 +        }
 +    }
 +}
 +
 +/* Transmit write enable instruction */
 +static void ospi_transmit_wel(XlnxVersalOspi *s, bool ahb_decoder_cs,
 +                              hwaddr addr)
 +{
 +    fifo8_reset(&s->tx_fifo);
 +    fifo8_push(&s->tx_fifo, WREN);
 +
 +    if (ahb_decoder_cs) {
 +        ospi_ahb_decoder_enable_cs(s, addr);
 +    } else {
 +        ospi_update_cs_lines(s);
 +    }
 +
 +    ospi_flush_txfifo(s);
 +    ospi_disable_cs(s);
 +
 +    fifo8_reset(&s->rx_fifo);
 +}
 +
 +static void ospi_ind_write(XlnxVersalOspi *s, uint32_t flash_addr, uint32_t len)
 +{
 +    bool ahb_decoder_cs = false;
 +    uint8_t inst_code;
 +    int i;
 +
 +    assert(fifo8_num_used(&s->tx_sram) >= len);
 +
 +    if (!ARRAY_FIELD_EX32(s->regs, DEV_INSTR_WR_CONFIG_REG, WEL_DIS_FLD)) {
 +        ospi_transmit_wel(s, ahb_decoder_cs, 0);
 +    }
 +
 +    /* reset fifos */
 +    fifo8_reset(&s->tx_fifo);
 +    fifo8_reset(&s->rx_fifo);
 +
 +    /* Push write opcode */
 +    inst_code = ospi_get_wr_opcode(s);
 +    fifo8_push(&s->tx_fifo, inst_code);
 +
 +    /* Push write address */
 +    ospi_tx_fifo_push_address(s, flash_addr);
 +
 +    /* data */
 +    for (i = 0; i < len; i++) {
 +        fifo8_push(&s->tx_fifo, fifo8_pop(&s->tx_sram));
 +    }
 +
 +    /* transmit */
 +    ospi_update_cs_lines(s);
 +    ospi_flush_txfifo(s);
 +
 +    /* done */
 +    ospi_disable_cs(s);
 +    fifo8_reset(&s->rx_fifo);
 +}
 +
 +static void ind_wr_inc_num_done(XlnxVersalOspi *s)
 +{
 +    unsigned int done = ARRAY_FIELD_EX32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG,
 +                                         NUM_IND_OPS_DONE_FLD);
 +    if (done < IND_OPS_DONE_MAX) {
 +        done++;
 +    }
 +    done &= 0x3;
 +    ARRAY_FIELD_DP32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG,
 +                     NUM_IND_OPS_DONE_FLD, done);
 +}
 +
 +static void ospi_ind_wr_completed(XlnxVersalOspi *s)
 +{
 +    ARRAY_FIELD_DP32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG,
 +                     IND_OPS_DONE_STATUS_FLD, 1);
 +    ind_wr_inc_num_done(s);
 +    ospi_ind_op_next(s->wr_ind_op);
 +    /* Set indirect op done interrupt if enabled */
 +    if (ospi_ind_op_all_completed(s)) {
 +        set_irq(s, R_IRQ_STATUS_REG_INDIRECT_OP_DONE_FLD_MASK);
 +    }
 +}
 +
 +static void ospi_do_indirect_write(XlnxVersalOspi *s)
 +{
 +    uint32_t write_watermark = s->regs[R_INDIRECT_WRITE_XFER_WATERMARK_REG];
 +    uint32_t pagesz = ospi_get_page_sz(s);
 +    uint32_t page_mask = ~(pagesz - 1);
 +    IndOp *op = s->wr_ind_op;
 +    uint32_t next_b;
 +    uint32_t end_b;
 +    uint32_t len;
 +
 +    /* Write out tx_fifo in maximum page sz chunks */
 +    while (!ospi_ind_op_completed(op) && fifo8_num_used(&s->tx_sram) > 0) {
 +        next_b = ind_op_next_byte(op);
 +        end_b = next_b +  MIN(fifo8_num_used(&s->tx_sram), pagesz);
 +
 +        /* Dont cross page boundary */
 +        if ((end_b & page_mask) > next_b) {
 +            end_b &= page_mask;
 +        }
 +
 +        len = end_b - next_b;
 +        len = MIN(len, op->num_bytes - op->done_bytes);
 +        ospi_ind_write(s, next_b, len);
 +        ind_op_advance(op, len);
 +    }
 +
 +    /*
 +     * Always set indirect transfer level breached interrupt if enabled
 +     * (write watermark > 0) since the tx_sram always will be emptied
 +     */
 +    if (write_watermark > 0) {
 +        set_irq(s, R_IRQ_STATUS_REG_INDIRECT_XFER_LEVEL_BREACH_FLD_MASK);
 +    }
 +
 +    /* Signal completions if done */
 +    if (ospi_ind_op_completed(op)) {
 +        ospi_ind_wr_completed(s);
 +    }
 +}
 +
 +static void ospi_stig_fill_membank(XlnxVersalOspi *s)
 +{
 +    int num_rd_bytes = ospi_stig_membank_rd_bytes(s);
 +    int idx = num_rd_bytes - 8; /* first of last 8 */
 +    int i;
 +
 +    for (i = 0; i < num_rd_bytes; i++) {
 +        s->stig_membank[i] = fifo8_pop(&s->rx_fifo);
 +    }
 +
 +    g_assert((idx + 4) < ARRAY_SIZE(s->stig_membank));
 +
 +    /* Fill in lower upper regs */
 +    s->regs[R_FLASH_RD_DATA_LOWER_REG] = ldl_le_p(&s->stig_membank[idx]);
 +    s->regs[R_FLASH_RD_DATA_UPPER_REG] = ldl_le_p(&s->stig_membank[idx + 4]);
 +}
 +
 +static void ospi_stig_cmd_exec(XlnxVersalOspi *s)
 +{
 +    uint8_t inst_code;
 +
 +    /* Reset fifos */
 +    fifo8_reset(&s->tx_fifo);
 +    fifo8_reset(&s->rx_fifo);
 +
 +    /* Push write opcode */
 +    inst_code = ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, CMD_OPCODE_FLD);
 +    fifo8_push(&s->tx_fifo, inst_code);
 +
 +    /* Push address if enabled */
 +    if (ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, ENB_COMD_ADDR_FLD)) {
 +        ospi_tx_fifo_push_stig_addr(s);
 +    }
 +
 +    /* Enable cs */
 +    ospi_update_cs_lines(s);
 +
 +    /* Data */
 +    if (ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, ENB_WRITE_DATA_FLD)) {
 +        ospi_tx_fifo_push_stig_wr_data(s);
 +    } else if (ARRAY_FIELD_EX32(s->regs,
 +                                FLASH_CMD_CTRL_REG, ENB_READ_DATA_FLD)) {
 +        /* transmit first part */
 +        ospi_flush_txfifo(s);
 +        fifo8_reset(&s->rx_fifo);
 +        ospi_tx_fifo_push_stig_rd_data(s);
 +    }
 +
 +    /* Transmit */
 +    ospi_flush_txfifo(s);
 +    ospi_disable_cs(s);
 +
 +    if (ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, ENB_READ_DATA_FLD)) {
 +        if (ARRAY_FIELD_EX32(s->regs,
 +                             FLASH_CMD_CTRL_REG, STIG_MEM_BANK_EN_FLD)) {
 +            ospi_stig_fill_membank(s);
 +        } else {
 +            ospi_rx_fifo_pop_stig_rd_data(s);
 +        }
 +    }
 +}
 +
 +static uint32_t ospi_block_address(XlnxVersalOspi *s, unsigned int block)
 +{
 +    unsigned int block_sz = ospi_get_block_sz(s);
 +    unsigned int cs = 0;
 +    uint32_t addr = 0;
 +
 +    while (cs < s->num_cs && block >= flash_blocks(s, cs)) {
 +        block -= flash_blocks(s, 0);
 +        addr += flash_sz(s, cs);
 +    }
 +    addr += block * block_sz;
 +    return addr;
 +}
 +
 +static uint32_t ospi_get_wr_prot_addr_low(XlnxVersalOspi *s)
 +{
 +    unsigned int block = s->regs[R_LOWER_WR_PROT_REG];
 +
 +    return ospi_block_address(s, block);
 +}
 +
 +static uint32_t ospi_get_wr_prot_addr_upper(XlnxVersalOspi *s)
 +{
 +    unsigned int block = s->regs[R_UPPER_WR_PROT_REG];
 +
 +    /* Get address of first block out of defined range */
 +    return ospi_block_address(s, block + 1);
 +}
 +
 +static bool ospi_is_write_protected(XlnxVersalOspi *s, hwaddr addr)
 +{
 +    uint32_t wr_prot_addr_upper = ospi_get_wr_prot_addr_upper(s);
 +    uint32_t wr_prot_addr_low = ospi_get_wr_prot_addr_low(s);
 +    bool in_range = false;
 +
 +    if (addr >= wr_prot_addr_low && addr < wr_prot_addr_upper) {
 +        in_range = true;
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, WR_PROT_CTRL_REG, INV_FLD)) {
 +        in_range = !in_range;
 +    }
 +    return in_range;
 +}
 +
 +static uint64_t ospi_rx_sram_read(XlnxVersalOspi *s, unsigned int size)
 +{
 +    uint8_t bytes[8] = {};
 +    int i;
 +
 +    if (size < 4 && fifo8_num_used(&s->rx_sram) >= 4) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "OSPI only last read of internal "
 +                      "sram is allowed to be < 32 bits\n");
 +    }
 +
 +    size = MIN(fifo8_num_used(&s->rx_sram), size);
 +
 +    assert(size <= 8);
 +
 +    for (i = 0; i < size; i++) {
 +        bytes[i] = fifo8_pop(&s->rx_sram);
 +    }
 +
 +    return ldq_le_p(bytes);
 +}
 +
 +static void ospi_tx_sram_write(XlnxVersalOspi *s, uint64_t value,
 +                               unsigned int size)
 +{
 +    int i;
 +    for (i = 0; i < size && !fifo8_is_full(&s->tx_sram); i++) {
 +        fifo8_push(&s->tx_sram, value >> 8 * i);
 +    }
 +}
 +
 +static uint64_t ospi_do_dac_read(void *opaque, hwaddr addr, unsigned int size)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
 +    uint8_t bytes[8] = {};
 +    int i;
 +
 +    /* Create first section of read cmd */
 +    ospi_tx_fifo_push_rd_op_addr(s, (uint32_t) addr);
 +
 +    /* Enable cs and transmit first part */
 +    ospi_dac_cs(s, addr);
 +    ospi_flush_txfifo(s);
 +
 +    fifo8_reset(&s->rx_fifo);
 +
 +    /* transmit second part (data) */
 +    for (i = 0; i < size; ++i) {
 +        fifo8_push(&s->tx_fifo, 0);
 +    }
 +    ospi_flush_txfifo(s);
 +
 +    /* fill in result */
 +    size = MIN(fifo8_num_used(&s->rx_fifo), size);
 +
 +    assert(size <= 8);
 +
 +    for (i = 0; i < size; i++) {
 +        bytes[i] = fifo8_pop(&s->rx_fifo);
 +    }
 +
 +    /* done */
 +    ospi_disable_cs(s);
 +
 +    return ldq_le_p(bytes);
 +}
 +
 +static void ospi_do_dac_write(void *opaque,
 +                              hwaddr addr,
 +                              uint64_t value,
 +                              unsigned int size)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
 +    bool ahb_decoder_cs = ARRAY_FIELD_EX32(s->regs, CONFIG_REG,
 +                                           ENABLE_AHB_DECODER_FLD);
 +    uint8_t inst_code;
 +    unsigned int i;
 +
 +    if (!ARRAY_FIELD_EX32(s->regs, DEV_INSTR_WR_CONFIG_REG, WEL_DIS_FLD)) {
 +        ospi_transmit_wel(s, ahb_decoder_cs, addr);
 +    }
 +
 +    /* reset fifos */
 +    fifo8_reset(&s->tx_fifo);
 +    fifo8_reset(&s->rx_fifo);
 +
 +    /* Push write opcode */
 +    inst_code = ospi_get_wr_opcode(s);
 +    fifo8_push(&s->tx_fifo, inst_code);
 +
 +    /* Push write address */
 +    ospi_tx_fifo_push_address(s, addr);
 +
 +    /* data */
 +    for (i = 0; i < size; i++) {
 +        fifo8_push(&s->tx_fifo, value >> 8 * i);
 +    }
 +
 +    /* Enable cs and transmit */
 +    ospi_dac_cs(s, addr);
 +    ospi_flush_txfifo(s);
 +    ospi_disable_cs(s);
 +
 +    fifo8_reset(&s->rx_fifo);
 +}
 +
 +static void flash_cmd_ctrl_mem_reg_post_write(RegisterInfo *reg,
 +                                              uint64_t val)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
 +    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_SPI_FLD)) {
 +        if (ARRAY_FIELD_EX32(s->regs,
 +                             FLASH_COMMAND_CTRL_MEM_REG,
 +                             TRIGGER_MEM_BANK_REQ_FLD)) {
 +            ospi_stig_membank_req(s);
 +            ARRAY_FIELD_DP32(s->regs, FLASH_COMMAND_CTRL_MEM_REG,
 +                             TRIGGER_MEM_BANK_REQ_FLD, 0);
 +        }
 +    }
 +}
 +
 +static void flash_cmd_ctrl_reg_post_write(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
 +
 +    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_SPI_FLD) &&
 +        ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, CMD_EXEC_FLD)) {
 +        ospi_stig_cmd_exec(s);
 +        set_irq(s, R_IRQ_STATUS_REG_STIG_REQ_INT_FLD_MASK);
 +        ARRAY_FIELD_DP32(s->regs, FLASH_CMD_CTRL_REG, CMD_EXEC_FLD, 0);
 +    }
 +}
 +
 +static uint64_t ind_wr_dec_num_done(XlnxVersalOspi *s, uint64_t val)
 +{
 +    unsigned int done = ARRAY_FIELD_EX32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG,
 +                                         NUM_IND_OPS_DONE_FLD);
 +    done--;
 +    done &= 0x3;
 +    val = FIELD_DP32(val, INDIRECT_WRITE_XFER_CTRL_REG,
 +                     NUM_IND_OPS_DONE_FLD, done);
 +    return val;
 +}
 +
 +static bool ind_wr_clearing_op_done(XlnxVersalOspi *s, uint64_t new_val)
 +{
 +    bool set_in_reg = ARRAY_FIELD_EX32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG,
 +                                       IND_OPS_DONE_STATUS_FLD);
 +    bool set_in_new_val = FIELD_EX32(new_val, INDIRECT_WRITE_XFER_CTRL_REG,
 +                                     IND_OPS_DONE_STATUS_FLD);
 +    /* return true if clearing bit */
 +    return set_in_reg && !set_in_new_val;
 +}
 +
 +static uint64_t ind_wr_xfer_ctrl_reg_pre_write(RegisterInfo *reg,
 +                                               uint64_t val)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
 +
 +    if (ind_wr_clearing_op_done(s, val)) {
 +        val = ind_wr_dec_num_done(s, val);
 +    }
 +    return val;
 +}
 +
 +static void ind_wr_xfer_ctrl_reg_post_write(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
 +
 +    if (s->ind_write_disabled) {
 +        return;
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG, START_FLD)) {
 +        ospi_ind_op_queue_up_wr(s);
 +        ospi_do_indirect_write(s);
 +        ARRAY_FIELD_DP32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG, START_FLD, 0);
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG, CANCEL_FLD)) {
 +        ospi_ind_op_cancel(s->wr_ind_op);
 +        fifo8_reset(&s->tx_sram);
 +        ARRAY_FIELD_DP32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG, CANCEL_FLD, 0);
 +    }
 +}
 +
 +static uint64_t ind_wr_xfer_ctrl_reg_post_read(RegisterInfo *reg,
 +                                               uint64_t val)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
 +    IndOp *op = s->wr_ind_op;
 +
 +    /* Check if ind ops is ongoing */
 +    if (!ospi_ind_op_completed(&op[0])) {
 +        /* Check if two ind ops are queued */
 +        if (!ospi_ind_op_completed(&op[1])) {
 +            val = FIELD_DP32(val, INDIRECT_WRITE_XFER_CTRL_REG,
 +                             WR_QUEUED_FLD, 1);
 +        }
 +        val = FIELD_DP32(val, INDIRECT_WRITE_XFER_CTRL_REG, WR_STATUS_FLD, 1);
 +    }
 +    return val;
 +}
 +
 +static uint64_t ind_rd_dec_num_done(XlnxVersalOspi *s, uint64_t val)
 +{
 +    unsigned int done = ARRAY_FIELD_EX32(s->regs, INDIRECT_READ_XFER_CTRL_REG,
 +                                         NUM_IND_OPS_DONE_FLD);
 +    done--;
 +    done &= 0x3;
 +    val = FIELD_DP32(val, INDIRECT_READ_XFER_CTRL_REG,
 +                     NUM_IND_OPS_DONE_FLD, done);
 +    return val;
 +}
 +
 +static uint64_t ind_rd_xfer_ctrl_reg_pre_write(RegisterInfo *reg,
 +                                               uint64_t val)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
 +
 +    if (FIELD_EX32(val, INDIRECT_READ_XFER_CTRL_REG,
 +                   IND_OPS_DONE_STATUS_FLD)) {
 +        val = ind_rd_dec_num_done(s, val);
 +        val &= ~R_INDIRECT_READ_XFER_CTRL_REG_IND_OPS_DONE_STATUS_FLD_MASK;
 +    }
 +    return val;
 +}
 +
 +static void ind_rd_xfer_ctrl_reg_post_write(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
 +
 +    if (ARRAY_FIELD_EX32(s->regs, INDIRECT_READ_XFER_CTRL_REG, START_FLD)) {
 +        ospi_ind_op_queue_up_rd(s);
 +        ospi_do_ind_read(s);
 +        ARRAY_FIELD_DP32(s->regs, INDIRECT_READ_XFER_CTRL_REG, START_FLD, 0);
 +    }
 +
 +    if (ARRAY_FIELD_EX32(s->regs, INDIRECT_READ_XFER_CTRL_REG, CANCEL_FLD)) {
 +        ospi_ind_op_cancel(s->rd_ind_op);
 +        fifo8_reset(&s->rx_sram);
 +        ARRAY_FIELD_DP32(s->regs, INDIRECT_READ_XFER_CTRL_REG, CANCEL_FLD, 0);
 +    }
 +}
 +
 +static uint64_t ind_rd_xfer_ctrl_reg_post_read(RegisterInfo *reg,
 +                                               uint64_t val)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
 +    IndOp *op = s->rd_ind_op;
 +
 +    /* Check if ind ops is ongoing */
 +    if (!ospi_ind_op_completed(&op[0])) {
 +        /* Check if two ind ops are queued */
 +        if (!ospi_ind_op_completed(&op[1])) {
 +            val = FIELD_DP32(val, INDIRECT_READ_XFER_CTRL_REG,
 +                             RD_QUEUED_FLD, 1);
 +        }
 +        val = FIELD_DP32(val, INDIRECT_READ_XFER_CTRL_REG, RD_STATUS_FLD, 1);
 +    }
 +    return val;
 +}
 +
 +static uint64_t sram_fill_reg_post_read(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
 +    val = ((fifo8_num_used(&s->tx_sram) & 0xFFFF) << 16) |
 +          (fifo8_num_used(&s->rx_sram) & 0xFFFF);
 +    return val;
 +}
 +
 +static uint64_t dll_obs_upper_reg_post_read(RegisterInfo *reg, uint64_t val)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
 +    uint32_t rx_dec_out;
 +
 +    rx_dec_out = FIELD_EX32(val, DLL_OBSERVABLE_UPPER_REG,
 +                            DLL_OBSERVABLE__UPPER_RX_DECODER_OUTPUT_FLD);
 +
 +    if (rx_dec_out < MAX_RX_DEC_OUT) {
 +        ARRAY_FIELD_DP32(s->regs, DLL_OBSERVABLE_UPPER_REG,
 +                         DLL_OBSERVABLE__UPPER_RX_DECODER_OUTPUT_FLD,
 +                         rx_dec_out + 1);
 +    }
 +
 +    return val;
 +}
 +
 +
 +static void xlnx_versal_ospi_reset(DeviceState *dev)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(dev);
 +    unsigned int i;
 +
 +    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
 +        register_reset(&s->regs_info[i]);
 +    }
 +
 +    fifo8_reset(&s->rx_fifo);
 +    fifo8_reset(&s->tx_fifo);
 +    fifo8_reset(&s->rx_sram);
 +    fifo8_reset(&s->tx_sram);
 +
 +    s->rd_ind_op[0].completed = true;
 +    s->rd_ind_op[1].completed = true;
 +    s->wr_ind_op[0].completed = true;
 +    s->wr_ind_op[1].completed = true;
 +    ARRAY_FIELD_DP32(s->regs, DLL_OBSERVABLE_LOWER_REG,
 +                     DLL_OBSERVABLE_LOWER_DLL_LOCK_FLD, 1);
 +    ARRAY_FIELD_DP32(s->regs, DLL_OBSERVABLE_LOWER_REG,
 +                     DLL_OBSERVABLE_LOWER_LOOPBACK_LOCK_FLD, 1);
 +}
 +
 +static RegisterAccessInfo ospi_regs_info[] = {
 +    {   .name = "CONFIG_REG",
 +        .addr = A_CONFIG_REG,
 +        .reset = 0x80780081,
 +        .ro = 0x9c000000,
 +    },{ .name = "DEV_INSTR_RD_CONFIG_REG",
 +        .addr = A_DEV_INSTR_RD_CONFIG_REG,
 +        .reset = 0x3,
 +        .ro = 0xe0ecc800,
 +    },{ .name = "DEV_INSTR_WR_CONFIG_REG",
 +        .addr = A_DEV_INSTR_WR_CONFIG_REG,
 +        .reset = 0x2,
 +        .ro = 0xe0fcce00,
 +    },{ .name = "DEV_DELAY_REG",
 +        .addr = A_DEV_DELAY_REG,
 +    },{ .name = "RD_DATA_CAPTURE_REG",
 +        .addr = A_RD_DATA_CAPTURE_REG,
 +        .reset = 0x1,
 +        .ro = 0xfff0fec0,
 +    },{ .name = "DEV_SIZE_CONFIG_REG",
 +        .addr = A_DEV_SIZE_CONFIG_REG,
 +        .reset = 0x101002,
 +        .ro = 0xe0000000,
 +    },{ .name = "SRAM_PARTITION_CFG_REG",
 +        .addr = A_SRAM_PARTITION_CFG_REG,
 +        .reset = 0x80,
 +        .ro = 0xffffff00,
 +    },{ .name = "IND_AHB_ADDR_TRIGGER_REG",
 +        .addr = A_IND_AHB_ADDR_TRIGGER_REG,
 +    },{ .name = "DMA_PERIPH_CONFIG_REG",
 +        .addr = A_DMA_PERIPH_CONFIG_REG,
 +        .ro = 0xfffff0f0,
 +    },{ .name = "REMAP_ADDR_REG",
 +        .addr = A_REMAP_ADDR_REG,
 +    },{ .name = "MODE_BIT_CONFIG_REG",
 +        .addr = A_MODE_BIT_CONFIG_REG,
 +        .reset = 0x200,
 +        .ro = 0xffff7800,
 +    },{ .name = "SRAM_FILL_REG",
 +        .addr = A_SRAM_FILL_REG,
 +        .ro = 0xffffffff,
 +        .post_read = sram_fill_reg_post_read,
 +    },{ .name = "TX_THRESH_REG",
 +        .addr = A_TX_THRESH_REG,
 +        .reset = 0x1,
 +        .ro = 0xffffffe0,
 +    },{ .name = "RX_THRESH_REG",
 +        .addr = A_RX_THRESH_REG,
 +        .reset = 0x1,
 +        .ro = 0xffffffe0,
 +    },{ .name = "WRITE_COMPLETION_CTRL_REG",
 +        .addr = A_WRITE_COMPLETION_CTRL_REG,
 +        .reset = 0x10005,
 +        .ro = 0x1800,
 +    },{ .name = "NO_OF_POLLS_BEF_EXP_REG",
 +        .addr = A_NO_OF_POLLS_BEF_EXP_REG,
 +        .reset = 0xffffffff,
 +    },{ .name = "IRQ_STATUS_REG",
 +        .addr = A_IRQ_STATUS_REG,
 +        .ro = 0xfff08000,
 +        .w1c = 0xf7fff,
 +    },{ .name = "IRQ_MASK_REG",
 +        .addr = A_IRQ_MASK_REG,
 +        .ro = 0xfff08000,
 +    },{ .name = "LOWER_WR_PROT_REG",
 +        .addr = A_LOWER_WR_PROT_REG,
 +    },{ .name = "UPPER_WR_PROT_REG",
 +        .addr = A_UPPER_WR_PROT_REG,
 +    },{ .name = "WR_PROT_CTRL_REG",
 +        .addr = A_WR_PROT_CTRL_REG,
 +        .ro = 0xfffffffc,
 +    },{ .name = "INDIRECT_READ_XFER_CTRL_REG",
 +        .addr = A_INDIRECT_READ_XFER_CTRL_REG,
 +        .ro = 0xffffffd4,
 +        .w1c = 0x08,
 +        .pre_write = ind_rd_xfer_ctrl_reg_pre_write,
 +        .post_write = ind_rd_xfer_ctrl_reg_post_write,
 +        .post_read = ind_rd_xfer_ctrl_reg_post_read,
 +    },{ .name = "INDIRECT_READ_XFER_WATERMARK_REG",
 +        .addr = A_INDIRECT_READ_XFER_WATERMARK_REG,
 +    },{ .name = "INDIRECT_READ_XFER_START_REG",
 +        .addr = A_INDIRECT_READ_XFER_START_REG,
 +    },{ .name = "INDIRECT_READ_XFER_NUM_BYTES_REG",
 +        .addr = A_INDIRECT_READ_XFER_NUM_BYTES_REG,
 +    },{ .name = "INDIRECT_WRITE_XFER_CTRL_REG",
 +        .addr = A_INDIRECT_WRITE_XFER_CTRL_REG,
 +        .ro = 0xffffffdc,
 +        .w1c = 0x20,
 +        .pre_write = ind_wr_xfer_ctrl_reg_pre_write,
 +        .post_write = ind_wr_xfer_ctrl_reg_post_write,
 +        .post_read = ind_wr_xfer_ctrl_reg_post_read,
 +    },{ .name = "INDIRECT_WRITE_XFER_WATERMARK_REG",
 +        .addr = A_INDIRECT_WRITE_XFER_WATERMARK_REG,
 +        .reset = 0xffffffff,
 +    },{ .name = "INDIRECT_WRITE_XFER_START_REG",
 +        .addr = A_INDIRECT_WRITE_XFER_START_REG,
 +    },{ .name = "INDIRECT_WRITE_XFER_NUM_BYTES_REG",
 +        .addr = A_INDIRECT_WRITE_XFER_NUM_BYTES_REG,
 +    },{ .name = "INDIRECT_TRIGGER_ADDR_RANGE_REG",
 +        .addr = A_INDIRECT_TRIGGER_ADDR_RANGE_REG,
 +        .reset = 0x4,
 +        .ro = 0xfffffff0,
 +    },{ .name = "FLASH_COMMAND_CTRL_MEM_REG",
 +        .addr = A_FLASH_COMMAND_CTRL_MEM_REG,
 +        .ro = 0xe008fffe,
 +        .post_write = flash_cmd_ctrl_mem_reg_post_write,
 +    },{ .name = "FLASH_CMD_CTRL_REG",
 +        .addr = A_FLASH_CMD_CTRL_REG,
 +        .ro = 0x7a,
 +        .post_write = flash_cmd_ctrl_reg_post_write,
 +    },{ .name = "FLASH_CMD_ADDR_REG",
 +        .addr = A_FLASH_CMD_ADDR_REG,
 +    },{ .name = "FLASH_RD_DATA_LOWER_REG",
 +        .addr = A_FLASH_RD_DATA_LOWER_REG,
 +        .ro = 0xffffffff,
 +    },{ .name = "FLASH_RD_DATA_UPPER_REG",
 +        .addr = A_FLASH_RD_DATA_UPPER_REG,
 +        .ro = 0xffffffff,
 +    },{ .name = "FLASH_WR_DATA_LOWER_REG",
 +        .addr = A_FLASH_WR_DATA_LOWER_REG,
 +    },{ .name = "FLASH_WR_DATA_UPPER_REG",
 +        .addr = A_FLASH_WR_DATA_UPPER_REG,
 +    },{ .name = "POLLING_FLASH_STATUS_REG",
 +        .addr = A_POLLING_FLASH_STATUS_REG,
 +        .ro = 0xfff0ffff,
 +    },{ .name = "PHY_CONFIGURATION_REG",
 +        .addr = A_PHY_CONFIGURATION_REG,
 +        .reset = 0x40000000,
 +        .ro = 0x1f80ff80,
 +    },{ .name = "PHY_MASTER_CONTROL_REG",
 +        .addr = A_PHY_MASTER_CONTROL_REG,
 +        .reset = 0x800000,
 +        .ro = 0xfe08ff80,
 +    },{ .name = "DLL_OBSERVABLE_LOWER_REG",
 +        .addr = A_DLL_OBSERVABLE_LOWER_REG,
 +        .ro = 0xffffffff,
 +    },{ .name = "DLL_OBSERVABLE_UPPER_REG",
 +        .addr = A_DLL_OBSERVABLE_UPPER_REG,
 +        .ro = 0xffffffff,
 +        .post_read = dll_obs_upper_reg_post_read,
 +    },{ .name = "OPCODE_EXT_LOWER_REG",
 +        .addr = A_OPCODE_EXT_LOWER_REG,
 +        .reset = 0x13edfa00,
 +    },{ .name = "OPCODE_EXT_UPPER_REG",
 +        .addr = A_OPCODE_EXT_UPPER_REG,
 +        .reset = 0x6f90000,
 +        .ro = 0xffff,
 +    },{ .name = "MODULE_ID_REG",
 +        .addr = A_MODULE_ID_REG,
 +        .reset = 0x300,
 +        .ro = 0xffffffff,
 +    }
 +};
 +
 +/* Return dev-obj from reg-region created by register_init_block32 */
 +static XlnxVersalOspi *xilinx_ospi_of_mr(void *mr_accessor)
 +{
 +    RegisterInfoArray *reg_array = mr_accessor;
 +    Object *dev;
 +
 +    dev = reg_array->mem.owner;
 +    assert(dev);
 +
 +    return XILINX_VERSAL_OSPI(dev);
 +}
 +
 +static void ospi_write(void *opaque, hwaddr addr, uint64_t value,
 +        unsigned int size)
 +{
 +    XlnxVersalOspi *s = xilinx_ospi_of_mr(opaque);
 +
 +    register_write_memory(opaque, addr, value, size);
 +    ospi_update_irq_line(s);
 +}
 +
 +static const MemoryRegionOps ospi_ops = {
 +    .read = register_read_memory,
 +    .write = ospi_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +};
 +
 +static uint64_t ospi_indac_read(void *opaque, unsigned int size)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
 +    uint64_t ret = ospi_rx_sram_read(s, size);
 +
 +    if (!ospi_ind_op_completed(s->rd_ind_op)) {
 +        ospi_do_ind_read(s);
 +    }
 +    return ret;
 +}
 +
 +static void ospi_indac_write(void *opaque, uint64_t value, unsigned int size)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
 +
 +    g_assert(!s->ind_write_disabled);
 +
 +    if (!ospi_ind_op_completed(s->wr_ind_op)) {
 +        ospi_tx_sram_write(s, value, size);
 +        ospi_do_indirect_write(s);
 +    } else {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +            "OSPI wr into indac area while no ongoing indac wr\n");
 +    }
 +}
 +
 +static bool is_inside_indac_range(XlnxVersalOspi *s, hwaddr addr)
 +{
 +    uint32_t range_start;
 +    uint32_t range_end;
 +
 +    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_DMA_IF_FLD)) {
 +        return true;
 +    }
 +
 +    range_start = s->regs[R_IND_AHB_ADDR_TRIGGER_REG];
 +    range_end = range_start +
 +                (1 << ARRAY_FIELD_EX32(s->regs,
 +                                       INDIRECT_TRIGGER_ADDR_RANGE_REG,
 +                                       IND_RANGE_WIDTH_FLD));
 +
 +    addr += s->regs[R_IND_AHB_ADDR_TRIGGER_REG] & 0xF0000000;
 +
 +    return addr >= range_start && addr < range_end;
 +}
 +
 +static bool ospi_is_indac_active(XlnxVersalOspi *s)
 +{
 +    /*
 +     * When dac and indac cannot be active at the same time,
 +     * return true when dac is disabled.
 +     */
 +    return s->dac_with_indac || !s->dac_enable;
 +}
 +
 +static uint64_t ospi_dac_read(void *opaque, hwaddr addr, unsigned int size)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
 +
 +    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_SPI_FLD)) {
 +        if (ospi_is_indac_active(s) &&
 +            is_inside_indac_range(s, addr)) {
 +            return ospi_indac_read(s, size);
 +        }
 +        if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_DIR_ACC_CTLR_FLD)
 +            && s->dac_enable) {
 +            if (ARRAY_FIELD_EX32(s->regs,
 +                                 CONFIG_REG, ENB_AHB_ADDR_REMAP_FLD)) {
 +                addr += s->regs[R_REMAP_ADDR_REG];
 +            }
 +            return ospi_do_dac_read(opaque, addr, size);
 +        } else {
 +            qemu_log_mask(LOG_GUEST_ERROR, "OSPI AHB rd while DAC disabled\n");
 +        }
 +    } else {
 +        qemu_log_mask(LOG_GUEST_ERROR, "OSPI AHB rd while OSPI disabled\n");
 +    }
 +
 +    return 0;
 +}
 +
 +static void ospi_dac_write(void *opaque, hwaddr addr, uint64_t value,
 +                           unsigned int size)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
 +
 +    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_SPI_FLD)) {
 +        if (ospi_is_indac_active(s) &&
 +            !s->ind_write_disabled &&
 +            is_inside_indac_range(s, addr)) {
 +            return ospi_indac_write(s, value, size);
 +        }
 +        if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_DIR_ACC_CTLR_FLD) &&
 +            s->dac_enable) {
 +            if (ARRAY_FIELD_EX32(s->regs,
 +                                 CONFIG_REG, ENB_AHB_ADDR_REMAP_FLD)) {
 +                addr += s->regs[R_REMAP_ADDR_REG];
 +            }
 +            /* Check if addr is write protected */
 +            if (ARRAY_FIELD_EX32(s->regs, WR_PROT_CTRL_REG, ENB_FLD) &&
 +                ospi_is_write_protected(s, addr)) {
 +                set_irq(s, R_IRQ_STATUS_REG_PROT_WR_ATTEMPT_FLD_MASK);
 +                ospi_update_irq_line(s);
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "OSPI writing into write protected area\n");
 +                return;
 +            }
 +            ospi_do_dac_write(opaque, addr, value, size);
 +        } else {
 +            qemu_log_mask(LOG_GUEST_ERROR, "OSPI AHB wr while DAC disabled\n");
 +        }
 +    } else {
 +        qemu_log_mask(LOG_GUEST_ERROR, "OSPI AHB wr while OSPI disabled\n");
 +    }
 +}
 +
 +static const MemoryRegionOps ospi_dac_ops = {
 +    .read = ospi_dac_read,
 +    .write = ospi_dac_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +};
 +
 +static void ospi_update_dac_status(void *opaque, int n, int level)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
 +
 +    s->dac_enable = level;
 +}
 +
 +static void xlnx_versal_ospi_realize(DeviceState *dev, Error **errp)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(dev);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 +
 +    s->num_cs = 4;
 +    s->spi = ssi_create_bus(dev, "spi0");
 +    s->cs_lines = g_new0(qemu_irq, s->num_cs);
 +    for (int i = 0; i < s->num_cs; ++i) {
 +        sysbus_init_irq(sbd, &s->cs_lines[i]);
 +    }
 +
 +    fifo8_create(&s->rx_fifo, RXFF_SZ);
 +    fifo8_create(&s->tx_fifo, TXFF_SZ);
 +    fifo8_create(&s->rx_sram, RXFF_SZ);
 +    fifo8_create(&s->tx_sram, TXFF_SZ);
 +}
 +
 +static void xlnx_versal_ospi_init(Object *obj)
 +{
 +    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(obj);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
 +    DeviceState *dev = DEVICE(obj);
 +    RegisterInfoArray *reg_array;
 +
 +    memory_region_init(&s->iomem, obj, TYPE_XILINX_VERSAL_OSPI,
 +                       XILINX_VERSAL_OSPI_R_MAX * 4);
 +    reg_array =
 +        register_init_block32(DEVICE(obj), ospi_regs_info,
 +                              ARRAY_SIZE(ospi_regs_info),
 +                              s->regs_info, s->regs,
 +                              &ospi_ops,
 +                              XILINX_VERSAL_OSPI_ERR_DEBUG,
 +                              XILINX_VERSAL_OSPI_R_MAX * 4);
 +    memory_region_add_subregion(&s->iomem, 0x0, &reg_array->mem);
 +    sysbus_init_mmio(sbd, &s->iomem);
 +
 +    memory_region_init_io(&s->iomem_dac, obj, &ospi_dac_ops, s,
 +                          TYPE_XILINX_VERSAL_OSPI "-dac", 0x20000000);
 +    sysbus_init_mmio(sbd, &s->iomem_dac);
 +
 +    sysbus_init_irq(sbd, &s->irq);
 +
 +    object_property_add_link(obj, "dma-src", TYPE_XLNX_CSU_DMA,
 +                             (Object **)&s->dma_src,
 +                             object_property_allow_set_link,
 +                             OBJ_PROP_LINK_STRONG);
 +
 +    qdev_init_gpio_in_named(dev, ospi_update_dac_status, "ospi-mux-sel", 1);
 +}
 +
 +static const VMStateDescription vmstate_ind_op = {
 +    .name = "OSPIIndOp",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(flash_addr, IndOp),
 +        VMSTATE_UINT32(num_bytes, IndOp),
 +        VMSTATE_UINT32(done_bytes, IndOp),
 +        VMSTATE_BOOL(completed, IndOp),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static const VMStateDescription vmstate_xlnx_versal_ospi = {
 +    .name = TYPE_XILINX_VERSAL_OSPI,
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .minimum_version_id_old = 1,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_FIFO8(rx_fifo, XlnxVersalOspi),
 +        VMSTATE_FIFO8(tx_fifo, XlnxVersalOspi),
 +        VMSTATE_FIFO8(rx_sram, XlnxVersalOspi),
 +        VMSTATE_FIFO8(tx_sram, XlnxVersalOspi),
 +        VMSTATE_BOOL(ind_write_disabled, XlnxVersalOspi),
 +        VMSTATE_BOOL(dac_with_indac, XlnxVersalOspi),
 +        VMSTATE_BOOL(dac_enable, XlnxVersalOspi),
 +        VMSTATE_BOOL(src_dma_inprog, XlnxVersalOspi),
 +        VMSTATE_STRUCT_ARRAY(rd_ind_op, XlnxVersalOspi, 2, 1,
 +                             vmstate_ind_op, IndOp),
 +        VMSTATE_STRUCT_ARRAY(wr_ind_op, XlnxVersalOspi, 2, 1,
 +                             vmstate_ind_op, IndOp),
 +        VMSTATE_UINT32_ARRAY(regs, XlnxVersalOspi, XILINX_VERSAL_OSPI_R_MAX),
 +        VMSTATE_UINT8_ARRAY(stig_membank, XlnxVersalOspi, 512),
 +        VMSTATE_END_OF_LIST(),
 +    }
 +};
 +
 +static Property xlnx_versal_ospi_properties[] = {
 +    DEFINE_PROP_BOOL("dac-with-indac", XlnxVersalOspi, dac_with_indac, false),
 +    DEFINE_PROP_BOOL("indac-write-disabled", XlnxVersalOspi,
 +                     ind_write_disabled, false),
 +    DEFINE_PROP_END_OF_LIST(),
 +};
 +
 +static void xlnx_versal_ospi_class_init(ObjectClass *klass, void *data)
 +{
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->reset = xlnx_versal_ospi_reset;
 +    dc->realize = xlnx_versal_ospi_realize;
 +    dc->vmsd = &vmstate_xlnx_versal_ospi;
 +    device_class_set_props(dc, xlnx_versal_ospi_properties);
 +}
 +
 +static const TypeInfo xlnx_versal_ospi_info = {
 +    .name          = TYPE_XILINX_VERSAL_OSPI,
 +    .parent        = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(XlnxVersalOspi),
 +    .class_init    = xlnx_versal_ospi_class_init,
 +    .instance_init = xlnx_versal_ospi_init,
 +};
 +
 +static void xlnx_versal_ospi_register_types(void)
 +{
 +    type_register_static(&xlnx_versal_ospi_info);
 +}
 +
 +type_init(xlnx_versal_ospi_register_types)
 diff --git a/hw/ssi/meson.build b/hw/ssi/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/meson.build
 +++ b/hw/ssi/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_SSI', if_true: files('ssi.c'))
  softmmu_ss.add(when: 'CONFIG_STM32F2XX_SPI', if_true: files('stm32f2xx_spi.c'))
  softmmu_ss.add(when: 'CONFIG_XILINX_SPI', if_true: files('xilinx_spi.c'))
  softmmu_ss.add(when: 'CONFIG_XILINX_SPIPS', if_true: files('xilinx_spips.c'))
 +softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-ospi.c'))
  softmmu_ss.add(when: 'CONFIG_IMX', if_true: files('imx_spi.c'))
  softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_spi.c'))
 --
-.25.1
+.34.1

-New patch
+[PULL 49/68] target/arm: Handle FPCR.AH in SVE FMLSL (indexed)
+From: Richard Henderson <richard.henderson@linaro.org>
+Handle FPCR.AH's requirement to not negate the sign of a NaN in SVE
+FMLSL (indexed), using the usual trick of negating by XOR when AH=0
+and by muladd flags when AH=1.
+Since we have the CPUARMState* in the helper anyway, we can
+look directly at env->vfp.fpcr and don't need toa pass in the
+FPCR.AH value via the SIMD data word.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250129013857.135256-32-richard.henderson@linaro.org
+[PMM: commit message tweaked]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/tcg/vec_helper.c | 15 ++++++++++++---
+file changed, 12 insertions(+), 3 deletions(-)
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
+                                CPUARMState *env, uint32_t desc)
+ {
+     intptr_t i, j, oprsz = simd_oprsz(desc);
+-    uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
++    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
+     float_status *status = &env->vfp.fp_status_a64;
+     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
++    int negx = 0, negf = 0;
++
++    if (is_s) {
++        if (env->vfp.fpcr & FPCR_AH) {
++            negf = float_muladd_negate_product;
++        } else {
++            negx = 0x8000;
++        }
++    }
+     for (i = 0; i < oprsz; i += 16) {
+         float16 mm_16 = *(float16 *)(vm + i + idx);
+         float32 mm = float16_to_float32_by_bits(mm_16, fz16);
+         for (j = 0; j < 16; j += sizeof(float32)) {
+-            float16 nn_16 = *(float16 *)(vn + H1_2(i + j + sel)) ^ negn;
++            float16 nn_16 = *(float16 *)(vn + H1_2(i + j + sel)) ^ negx;
+             float32 nn = float16_to_float32_by_bits(nn_16, fz16);
+             float32 aa = *(float32 *)(va + H1_4(i + j));
+             *(float32 *)(vd + H1_4(i + j)) =
+-                float32_muladd(nn, mm, aa, 0, status);
++                float32_muladd(nn, mm, aa, negf, status);
+         }
+     }
+ }
+--
+.34.1

-New patch
+[PULL 50/68] target/arm: Handle FPCR.AH in SVE FMLSLB, FMLSLT (vectors)
+From: Richard Henderson <richard.henderson@linaro.org>
+Handle FPCR.AH's requirement to not negate the sign of a NaN in SVE
+FMLSL (indexed), using the usual trick of negating by XOR when AH=0
+and by muladd flags when AH=1.
+Since we have the CPUARMState* in the helper anyway, we can
+look directly at env->vfp.fpcr and don't need toa pass in the
+FPCR.AH value via the SIMD data word.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20250129013857.135256-33-richard.henderson@linaro.org
+[PMM: tweaked commit message]
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/tcg/vec_helper.c | 15 ++++++++++++---
+file changed, 12 insertions(+), 3 deletions(-)
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/vec_helper.c
++++ b/target/arm/tcg/vec_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
+                                CPUARMState *env, uint32_t desc)
+ {
+     intptr_t i, oprsz = simd_oprsz(desc);
+-    uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
++    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
+     float_status *status = &env->vfp.fp_status_a64;
+     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
++    int negx = 0, negf = 0;
++
++    if (is_s) {
++        if (env->vfp.fpcr & FPCR_AH) {
++            negf = float_muladd_negate_product;
++        } else {
++            negx = 0x8000;
++        }
++    }
+     for (i = 0; i < oprsz; i += sizeof(float32)) {
+-        float16 nn_16 = *(float16 *)(vn + H1_2(i + sel)) ^ negn;
++        float16 nn_16 = *(float16 *)(vn + H1_2(i + sel)) ^ negx;
+         float16 mm_16 = *(float16 *)(vm + H1_2(i + sel));
+         float32 nn = float16_to_float32_by_bits(nn_16, fz16);
+         float32 mm = float16_to_float32_by_bits(mm_16, fz16);
+         float32 aa = *(float32 *)(va + H1_4(i));
+-        *(float32 *)(vd + H1_4(i)) = float32_muladd(nn, mm, aa, 0, status);
++        *(float32 *)(vd + H1_4(i)) = float32_muladd(nn, mm, aa, negf, status);
+     }
+ }
+--
+.34.1

-[PULL 20/32] hw/intc/arm_gicv3_its: Don't clear GITS_CREADR when GITS_CTLR.ENABLED is set
+[PULL 51/68] target/arm: Enable FEAT_AFP for '-cpu max'
-The current ITS code clears GITS_CREADR when GITS_CTLR.ENABLED is set.
+Now that we have completed the handling for FPCR.{AH,FIZ,NEP}, we
-This is not correct -- guest code can validly clear ENABLED and then
+can enable FEAT_AFP for '-cpu max', and document that we support it.
 set it again and expect the ITS to continue processing where it left
 off. Remove the erroneous assignment.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-5-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_its.c | 1 -
+ docs/system/arm/emulation.rst | 1 +
-file changed, 1 deletion(-)
+ target/arm/tcg/cpu64.c        | 1 +
 files changed, 2 insertions(+)
-diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its.c
+--- a/docs/system/arm/emulation.rst
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
-             s->ctlr |= R_GITS_CTLR_ENABLED_MASK;
+ - FEAT_AA64EL3 (Support for AArch64 at EL3)
-             extract_table_params(s);
+ - FEAT_AdvSIMD (Advanced SIMD Extension)
-             extract_cmdq_params(s);
+ - FEAT_AES (AESD and AESE instructions)
--            s->creadr = 0;
++- FEAT_AFP (Alternate floating-point behavior)
-             process_cmdq(s);
+ - FEAT_Armv9_Crypto (Armv9 Cryptographic Extension)
-         } else {
+ - FEAT_ASID16 (16 bit ASID)
-             s->ctlr &= ~R_GITS_CTLR_ENABLED_MASK;
+ - FEAT_BBM at level 2 (Translation table break-before-make levels)
 diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/cpu64.c
 +++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
      t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1);      /* FEAT_XNX */
      t = FIELD_DP64(t, ID_AA64MMFR1, ETS, 2);      /* FEAT_ETS2 */
      t = FIELD_DP64(t, ID_AA64MMFR1, HCX, 1);      /* FEAT_HCX */
 +    t = FIELD_DP64(t, ID_AA64MMFR1, AFP, 1);      /* FEAT_AFP */
      t = FIELD_DP64(t, ID_AA64MMFR1, TIDCP1, 1);   /* FEAT_TIDCP1 */
      t = FIELD_DP64(t, ID_AA64MMFR1, CMOW, 1);     /* FEAT_CMOW */
      cpu->isar.id_aa64mmfr1 = t;
 --
-.25.1
+.34.1

-[PULL 18/32] hw/intc/arm_gicv3_its: Add tracepoints
+[PULL 52/68] target/arm: Plumb FEAT_RPRES frecpe and frsqrte through to new helper
-The ITS currently has no tracepoints; add a minimal set
+FEAT_RPRES implements an "increased precision" variant of the single
-that allows basic monitoring of guest register accesses and
+precision FRECPE and FRSQRTE instructions from an 8 bit to a 12
-reading of commands from the command queue.
+bit mantissa. This applies only when FPCR.AH == 1. Note that the
 halfprec and double versions of these insns retain the 8 bit
 precision regardless.
 In this commit we add all the plumbing to make these instructions
 call a new helper function when the increased-precision is in
 effect. In the following commit we will provide the actual change
 in behaviour in the helpers.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-3-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3_its.c | 11 +++++++++++
+ target/arm/cpu-features.h      |  5 +++++
- hw/intc/trace-events    |  8 ++++++++
+ target/arm/helper.h            |  4 ++++
-files changed, 19 insertions(+)
+ target/arm/tcg/translate-a64.c | 34 ++++++++++++++++++++++++++++++----
  target/arm/tcg/translate-sve.c | 16 ++++++++++++++--
  target/arm/tcg/vec_helper.c    |  2 ++
  target/arm/vfp_helper.c        | 32 ++++++++++++++++++++++++++++++--
 files changed, 85 insertions(+), 8 deletions(-)
-diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
+diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its.c
+--- a/target/arm/cpu-features.h
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/target/arm/cpu-features.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_mops(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, MOPS);
- #include "qemu/osdep.h"
+ }
- #include "qemu/log.h"
-+#include "trace.h"
++static inline bool isar_feature_aa64_rpres(const ARMISARegisters *id)
- #include "hw/qdev-properties.h"
++{
- #include "hw/intc/arm_gicv3_its_common.h"
++    return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, RPRES);
- #include "gicv3_internal.h"
++}
-@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
++
+ static inline bool isar_feature_aa64_fp_simd(const ARMISARegisters *id)
-         cmd = (data & CMD_MASK);
+ {
+     /* We always set the AdvSIMD and FP fields identically.  */
-+        trace_gicv3_its_process_command(rd_offset, cmd);
+diff --git a/target/arm/helper.h b/target/arm/helper.h
-+
+index XXXXXXX..XXXXXXX 100644
-         switch (cmd) {
+--- a/target/arm/helper.h
-         case GITS_CMD_INT:
++++ b/target/arm/helper.h
-             result = process_its_cmd(s, data, cq_offset, INTERRUPT);
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vfp_muladdh, f16, f16, f16, f16, fpst)
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
-     bool result = true;
+ DEF_HELPER_FLAGS_2(recpe_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
-     uint32_t devid = 0;
+ DEF_HELPER_FLAGS_2(recpe_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
++DEF_HELPER_FLAGS_2(recpe_rpres_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
-+    trace_gicv3_its_translation_write(offset, data, size, attrs.requester_id);
+ DEF_HELPER_FLAGS_2(recpe_f64, TCG_CALL_NO_RWG, f64, f64, fpst)
-+
+ DEF_HELPER_FLAGS_2(rsqrte_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
-     switch (offset) {
+ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
-     case GITS_TRANSLATER:
++DEF_HELPER_FLAGS_2(rsqrte_rpres_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
-         if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) {
+ DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, fpst)
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
+ DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
-         qemu_log_mask(LOG_GUEST_ERROR,
+ DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-                       "%s: invalid guest read at offset " TARGET_FMT_plx
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(gvec_vrintx_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-                       "size %u\n", __func__, offset, size);
-+        trace_gicv3_its_badread(offset, size);
+ DEF_HELPER_FLAGS_4(gvec_frecpe_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-         /*
+ DEF_HELPER_FLAGS_4(gvec_frecpe_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-          * The spec requires that reserved registers are RAZ/WI;
++DEF_HELPER_FLAGS_4(gvec_frecpe_rpres_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-          * so use false returns from leaf functions as a way to
+ DEF_HELPER_FLAGS_4(gvec_frecpe_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
-          * the caller, or we'll cause a spurious guest data abort.
+ DEF_HELPER_FLAGS_4(gvec_frsqrte_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-          */
+ DEF_HELPER_FLAGS_4(gvec_frsqrte_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-         *data = 0;
++DEF_HELPER_FLAGS_4(gvec_frsqrte_rpres_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-+    } else {
+ DEF_HELPER_FLAGS_4(gvec_frsqrte_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-+        trace_gicv3_its_read(offset, *data, size);
-     }
+ DEF_HELPER_FLAGS_4(gvec_fcgt0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
-     return MEMTX_OK;
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
- }
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data,
+--- a/target/arm/tcg/translate-a64.c
-         qemu_log_mask(LOG_GUEST_ERROR,
++++ b/target/arm/tcg/translate-a64.c
-                       "%s: invalid guest write at offset " TARGET_FMT_plx
+@@ -XXX,XX +XXX,XX @@ static const FPScalar1 f_scalar_frecpe = {
-                       "size %u\n", __func__, offset, size);
+     gen_helper_recpe_f32,
-+        trace_gicv3_its_badwrite(offset, data, size);
+     gen_helper_recpe_f64,
-         /*
+ };
-          * The spec requires that reserved registers are RAZ/WI;
+-TRANS(FRECPE_s, do_fp1_scalar_ah, a, &f_scalar_frecpe, -1)
-          * so use false returns from leaf functions as a way to
++static const FPScalar1 f_scalar_frecpe_rpres = {
-          * trigger the guest-error logging but don't return it to
++    gen_helper_recpe_f16,
-          * the caller, or we'll cause a spurious guest data abort.
++    gen_helper_recpe_rpres_f32,
-          */
++    gen_helper_recpe_f64,
-+    } else {
++};
-+        trace_gicv3_its_write(offset, data, size);
++TRANS(FRECPE_s, do_fp1_scalar_ah, a,
-     }
++      s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ?
-     return MEMTX_OK;
++      &f_scalar_frecpe_rpres : &f_scalar_frecpe, -1)
- }
-diff --git a/hw/intc/trace-events b/hw/intc/trace-events
+ static const FPScalar1 f_scalar_frecpx = {
-index XXXXXXX..XXXXXXX 100644
+     gen_helper_frecpx_f16,
---- a/hw/intc/trace-events
+@@ -XXX,XX +XXX,XX @@ static const FPScalar1 f_scalar_frsqrte = {
-+++ b/hw/intc/trace-events
+     gen_helper_rsqrte_f32,
-@@ -XXX,XX +XXX,XX @@ gicv3_redist_badwrite(uint32_t cpu, uint64_t offset, uint64_t data, unsigned siz
+     gen_helper_rsqrte_f64,
- gicv3_redist_set_irq(uint32_t cpu, int irq, int level) "GICv3 redistributor 0x%x interrupt %d level changed to %d"
+ };
- gicv3_redist_send_sgi(uint32_t cpu, int irq) "GICv3 redistributor 0x%x pending SGI %d"
+-TRANS(FRSQRTE_s, do_fp1_scalar_ah, a, &f_scalar_frsqrte, -1)
++static const FPScalar1 f_scalar_frsqrte_rpres = {
-+# arm_gicv3_its.c
++    gen_helper_rsqrte_f16,
-+gicv3_its_read(uint64_t offset, uint64_t data, unsigned size) "GICv3 ITS read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
++    gen_helper_rsqrte_rpres_f32,
-+gicv3_its_badread(uint64_t offset, unsigned size) "GICv3 ITS read: offset 0x%" PRIx64 " size %u: error"
++    gen_helper_rsqrte_f64,
-+gicv3_its_write(uint64_t offset, uint64_t data, unsigned size) "GICv3 ITS write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
++};
-+gicv3_its_badwrite(uint64_t offset, uint64_t data, unsigned size) "GICv3 ITS write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u: error"
++TRANS(FRSQRTE_s, do_fp1_scalar_ah, a,
-+gicv3_its_translation_write(uint64_t offset, uint64_t data, unsigned size, uint32_t requester_id) "GICv3 ITS TRANSLATER write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u requester_id 0x%x"
++      s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ?
-+gicv3_its_process_command(uint32_t rd_offset, uint8_t cmd) "GICv3 ITS: processing command at offset 0x%x: 0x%x"
++      &f_scalar_frsqrte_rpres : &f_scalar_frsqrte, -1)
-+
- # armv7m_nvic.c
+ static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
- nvic_recompute_state(int vectpending, int vectpending_prio, int exception_prio) "NVIC state recomputed: vectpending %d vectpending_prio %d exception_prio %d"
+ {
- nvic_recompute_state_secure(int vectpending, bool vectpending_is_s_banked, int vectpending_prio, int exception_prio) "NVIC state recomputed: vectpending %d is_s_banked %d vectpending_prio %d exception_prio %d"
+@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_2_ptr * const f_frecpe[] = {
      gen_helper_gvec_frecpe_s,
      gen_helper_gvec_frecpe_d,
  };
 -TRANS(FRECPE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frecpe)
 +static gen_helper_gvec_2_ptr * const f_frecpe_rpres[] = {
 +    gen_helper_gvec_frecpe_h,
 +    gen_helper_gvec_frecpe_rpres_s,
 +    gen_helper_gvec_frecpe_d,
 +};
 +TRANS(FRECPE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0,
 +      s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ? f_frecpe_rpres : f_frecpe)
  static gen_helper_gvec_2_ptr * const f_frsqrte[] = {
      gen_helper_gvec_frsqrte_h,
      gen_helper_gvec_frsqrte_s,
      gen_helper_gvec_frsqrte_d,
  };
 -TRANS(FRSQRTE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frsqrte)
 +static gen_helper_gvec_2_ptr * const f_frsqrte_rpres[] = {
 +    gen_helper_gvec_frsqrte_h,
 +    gen_helper_gvec_frsqrte_rpres_s,
 +    gen_helper_gvec_frsqrte_d,
 +};
 +TRANS(FRSQRTE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0,
 +      s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ? f_frsqrte_rpres : f_frsqrte)
  static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
  {
 diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/translate-sve.c
 +++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_2_ptr * const frecpe_fns[] = {
      NULL,                     gen_helper_gvec_frecpe_h,
      gen_helper_gvec_frecpe_s, gen_helper_gvec_frecpe_d,
  };
 -TRANS_FEAT(FRECPE, aa64_sve, gen_gvec_fpst_ah_arg_zz, frecpe_fns[a->esz], a, 0)
 +static gen_helper_gvec_2_ptr * const frecpe_rpres_fns[] = {
 +    NULL,                           gen_helper_gvec_frecpe_h,
 +    gen_helper_gvec_frecpe_rpres_s, gen_helper_gvec_frecpe_d,
 +};
 +TRANS_FEAT(FRECPE, aa64_sve, gen_gvec_fpst_ah_arg_zz,
 +           s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ?
 +           frecpe_rpres_fns[a->esz] : frecpe_fns[a->esz], a, 0)
  static gen_helper_gvec_2_ptr * const frsqrte_fns[] = {
      NULL,                      gen_helper_gvec_frsqrte_h,
      gen_helper_gvec_frsqrte_s, gen_helper_gvec_frsqrte_d,
  };
 -TRANS_FEAT(FRSQRTE, aa64_sve, gen_gvec_fpst_ah_arg_zz, frsqrte_fns[a->esz], a, 0)
 +static gen_helper_gvec_2_ptr * const frsqrte_rpres_fns[] = {
 +    NULL,                            gen_helper_gvec_frsqrte_h,
 +    gen_helper_gvec_frsqrte_rpres_s, gen_helper_gvec_frsqrte_d,
 +};
 +TRANS_FEAT(FRSQRTE, aa64_sve, gen_gvec_fpst_ah_arg_zz,
 +           s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ?
 +           frsqrte_rpres_fns[a->esz] : frsqrte_fns[a->esz], a, 0)
  /*
   *** SVE Floating Point Compare with Zero Group
 diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/vec_helper.c
 +++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *vn, float_status *stat, uint32_t desc)  \
  DO_2OP(gvec_frecpe_h, helper_recpe_f16, float16)
  DO_2OP(gvec_frecpe_s, helper_recpe_f32, float32)
 +DO_2OP(gvec_frecpe_rpres_s, helper_recpe_rpres_f32, float32)
  DO_2OP(gvec_frecpe_d, helper_recpe_f64, float64)
  DO_2OP(gvec_frsqrte_h, helper_rsqrte_f16, float16)
  DO_2OP(gvec_frsqrte_s, helper_rsqrte_f32, float32)
 +DO_2OP(gvec_frsqrte_rpres_s, helper_rsqrte_rpres_f32, float32)
  DO_2OP(gvec_frsqrte_d, helper_rsqrte_f64, float64)
  DO_2OP(gvec_vrintx_h, float16_round_to_int, float16)
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(recpe_f16)(uint32_t input, float_status *fpst)
      return make_float16(f16_val);
  }
 -float32 HELPER(recpe_f32)(float32 input, float_status *fpst)
 +/*
 + * FEAT_RPRES means the f32 FRECPE has an "increased precision" variant
 + * which is used when FPCR.AH == 1.
 + */
 +static float32 do_recpe_f32(float32 input, float_status *fpst, bool rpres)
  {
      float32 f32 = float32_squash_input_denormal(input, fpst);
      uint32_t f32_val = float32_val(f32);
@@ -XXX,XX +XXX,XX @@ float32 HELPER(recpe_f32)(float32 input, float_status *fpst)
      return make_float32(f32_val);
  }
 +float32 HELPER(recpe_f32)(float32 input, float_status *fpst)
 +{
 +    return do_recpe_f32(input, fpst, false);
 +}
 +
 +float32 HELPER(recpe_rpres_f32)(float32 input, float_status *fpst)
 +{
 +    return do_recpe_f32(input, fpst, true);
 +}
 +
  float64 HELPER(recpe_f64)(float64 input, float_status *fpst)
  {
      float64 f64 = float64_squash_input_denormal(input, fpst);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(rsqrte_f16)(uint32_t input, float_status *s)
      return make_float16(val);
  }
 -float32 HELPER(rsqrte_f32)(float32 input, float_status *s)
 +/*
 + * FEAT_RPRES means the f32 FRSQRTE has an "increased precision" variant
 + * which is used when FPCR.AH == 1.
 + */
 +static float32 do_rsqrte_f32(float32 input, float_status *s, bool rpres)
  {
      float32 f32 = float32_squash_input_denormal(input, s);
      uint32_t val = float32_val(f32);
@@ -XXX,XX +XXX,XX @@ float32 HELPER(rsqrte_f32)(float32 input, float_status *s)
      return make_float32(val);
  }
 +float32 HELPER(rsqrte_f32)(float32 input, float_status *s)
 +{
 +    return do_rsqrte_f32(input, s, false);
 +}
 +
 +float32 HELPER(rsqrte_rpres_f32)(float32 input, float_status *s)
 +{
 +    return do_rsqrte_f32(input, s, true);
 +}
 +
  float64 HELPER(rsqrte_f64)(float64 input, float_status *s)
  {
      float64 f64 = float64_squash_input_denormal(input, s);
 --
-.25.1
+.34.1

-[PULL 04/32] rtc: Move RTC function prototypes to their own header
+[PULL 53/68] target/arm: Implement increased precision FRECPE
-softmmu/rtc.c defines two public functions: qemu_get_timedate() and
+Implement the increased precision variation of FRECPE.  In the
-qemu_timedate_diff().  Currently we keep the prototypes for these in
+pseudocode this corresponds to the handling of the
-qemu-common.h, but most files don't need them.  Move them to their
+"increasedprecision" boolean in the FPRecipEstimate() and
-own header, a new include/sysemu/rtc.h.
+RecipEstimate() functions.
 Since the C files using these two functions did not need to include
 qemu-common.h for any other reason, we can remove those include lines
 when we add the include of the new rtc.h.
 The license for the .h file follows that of the softmmu/rtc.c
 where both the functions are defined.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- include/qemu-common.h    |  3 ---
+ target/arm/vfp_helper.c | 54 +++++++++++++++++++++++++++++++++++------
- include/sysemu/rtc.h     | 58 ++++++++++++++++++++++++++++++++++++++++
+file changed, 46 insertions(+), 8 deletions(-)
  hw/arm/omap1.c           |  2 +-
  hw/arm/pxa2xx.c          |  2 +-
  hw/arm/strongarm.c       |  2 +-
  hw/misc/mac_via.c        |  2 +-
  hw/misc/macio/cuda.c     |  2 +-
  hw/misc/macio/pmu.c      |  2 +-
  hw/ppc/spapr_rtc.c       |  2 +-
  hw/rtc/allwinner-rtc.c   |  2 +-
  hw/rtc/aspeed_rtc.c      |  2 +-
  hw/rtc/ds1338.c          |  2 +-
  hw/rtc/exynos4210_rtc.c  |  2 +-
  hw/rtc/goldfish_rtc.c    |  2 +-
  hw/rtc/m41t80.c          |  2 +-
  hw/rtc/m48t59.c          |  2 +-
  hw/rtc/mc146818rtc.c     |  2 +-
  hw/rtc/pl031.c           |  2 +-
  hw/rtc/twl92230.c        |  2 +-
  hw/rtc/xlnx-zynqmp-rtc.c |  2 +-
  hw/s390x/tod-tcg.c       |  2 +-
  hw/scsi/megasas.c        |  2 +-
  net/dump.c               |  2 +-
  softmmu/rtc.c            |  2 +-
 files changed, 80 insertions(+), 25 deletions(-)
  create mode 100644 include/sysemu/rtc.h
-diff --git a/include/qemu-common.h b/include/qemu-common.h
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu-common.h
+--- a/target/arm/vfp_helper.c
-+++ b/include/qemu-common.h
++++ b/target/arm/vfp_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static int recip_estimate(int input)
- int qemu_main(int argc, char **argv, char **envp);
+     return r;
- #endif
+ }
 -void qemu_get_timedate(struct tm *tm, int offset);
 -int qemu_timedate_diff(struct tm *tm);
 -
  void *qemu_oom_check(void *ptr);
  ssize_t qemu_write_full(int fd, const void *buf, size_t count)
 diff --git a/include/sysemu/rtc.h b/include/sysemu/rtc.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/sysemu/rtc.h
@@ -XXX,XX +XXX,XX @@
 +/*
-+ * RTC configuration and clock read
++ * Increased precision version:
-+ *
++ * input is a 13 bit fixed point number
-+ * Copyright (c) 2003-2021 QEMU contributors
++ * input range 2048 .. 4095 for a number from 0.5 <= x < 1.0.
-+ *
++ * result range 4096 .. 8191 for a number from 1.0 to 2.0
 + * Permission is hereby granted, free of charge, to any person obtaining a copy
 + * of this software and associated documentation files (the "Software"), to deal
 + * in the Software without restriction, including without limitation the rights
 + * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 + * copies of the Software, and to permit persons to whom the Software is
 + * furnished to do so, subject to the following conditions:
 + *
 + * The above copyright notice and this permission notice shall be included in
 + * all copies or substantial portions of the Software.
 + *
 + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 + * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 + * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 + * THE SOFTWARE.
 + */
++static int recip_estimate_incprec(int input)
++{
++    int a, b, r;
++    assert(2048 <= input && input < 4096);
++    a = (input * 2) + 1;
++    /*
++     * The pseudocode expresses this as an operation on infinite
++     * precision reals where it calculates 2^25 / a and then looks
++     * at the error between that and the rounded-down-to-integer
++     * value to see if it should instead round up. We instead
++     * follow the same approach as the pseudocode for the 8-bit
++     * precision version, and calculate (2 * (2^25 / a)) as an
++     * integer so we can do the "add one and halve" to round it.
++     * So the 1 << 26 here is correct.
++     */
++    b = (1 << 26) / a;
++    r = (b + 1) >> 1;
++    assert(4096 <= r && r < 8192);
++    return r;
++}
 +
-+#ifndef SYSEMU_RTC_H
+ /*
-+#define SYSEMU_RTC_H
+  * Common wrapper to call recip_estimate
-+
+  *
-+/**
+@@ -XXX,XX +XXX,XX @@ static int recip_estimate(int input)
-+ * qemu_get_timedate: Get the current RTC time
+  * callee.
 + * @tm: struct tm to fill in with RTC time
 + * @offset: offset in seconds to adjust the RTC time by before
 + *          converting to struct tm format.
 + *
 + * This function fills in @tm with the current RTC time, as adjusted
 + * by @offset (for example, if @offset is 3600 then the returned time/date
 + * will be one hour further ahead than the current RTC time).
 + *
 + * The usual use is by RTC device models, which should call this function
 + * to find the time/date value that they should return to the guest
 + * when it reads the RTC registers.
 + *
 + * The behaviour of the clock whose value this function returns will
 + * depend on the -rtc command line option passed by the user.
 + */
 +void qemu_get_timedate(struct tm *tm, int offset);
 +
 +/**
 + * qemu_timedate_diff: Return difference between a struct tm and the RTC
 + * @tm: struct tm containing the date/time to compare against
 + *
 + * Returns the difference in seconds between the RTC clock time
 + * and the date/time specified in @tm. For example, if @tm specifies
 + * a timestamp one hour further ahead than the current RTC time
 + * then this function will return 3600.
 + */
 +int qemu_timedate_diff(struct tm *tm);
 +
 +#endif
 diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/omap1.c
 +++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/error-report.h"
  #include "qemu/main-loop.h"
  #include "qapi/error.h"
 -#include "qemu-common.h"
  #include "cpu.h"
  #include "exec/address-spaces.h"
  #include "hw/hw.h"
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/qtest.h"
  #include "sysemu/reset.h"
  #include "sysemu/runstate.h"
 +#include "sysemu/rtc.h"
  #include "qemu/range.h"
  #include "hw/sysbus.h"
  #include "qemu/cutils.h"
 diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/pxa2xx.c
 +++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@
   */
- #include "qemu/osdep.h"
+-static uint64_t call_recip_estimate(int *exp, int exp_off, uint64_t frac)
--#include "qemu-common.h"
++static uint64_t call_recip_estimate(int *exp, int exp_off, uint64_t frac,
- #include "qemu/error-report.h"
++                                    bool increasedprecision)
- #include "qemu/module.h"
+ {
- #include "qapi/error.h"
+     uint32_t scaled, estimate;
-@@ -XXX,XX +XXX,XX @@
+     uint64_t result_frac;
- #include "chardev/char-fe.h"
+@@ -XXX,XX +XXX,XX @@ static uint64_t call_recip_estimate(int *exp, int exp_off, uint64_t frac)
- #include "sysemu/blockdev.h"
+         }
- #include "sysemu/qtest.h"
+     }
-+#include "sysemu/rtc.h"
- #include "qemu/cutils.h"
+-    /* scaled = UInt('1':fraction<51:44>) */
- #include "qemu/log.h"
+-    scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8));
- #include "qom/object.h"
+-    estimate = recip_estimate(scaled);
-diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
++    if (increasedprecision) {
-index XXXXXXX..XXXXXXX 100644
++        /* scaled = UInt('1':fraction<51:41>) */
---- a/hw/arm/strongarm.c
++        scaled = deposit32(1 << 11, 0, 11, extract64(frac, 41, 11));
-+++ b/hw/arm/strongarm.c
++        estimate = recip_estimate_incprec(scaled);
-@@ -XXX,XX +XXX,XX @@
++    } else {
-  */
++        /* scaled = UInt('1':fraction<51:44>) */
++        scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8));
- #include "qemu/osdep.h"
++        estimate = recip_estimate(scaled);
--#include "qemu-common.h"
++    }
- #include "cpu.h"
- #include "hw/irq.h"
+     result_exp = exp_off - *exp;
- #include "hw/qdev-properties.h"
+-    result_frac = deposit64(0, 44, 8, estimate);
-@@ -XXX,XX +XXX,XX @@
++    if (increasedprecision) {
- #include "chardev/char-fe.h"
++        result_frac = deposit64(0, 40, 12, estimate);
- #include "chardev/char-serial.h"
++    } else {
- #include "sysemu/sysemu.h"
++        result_frac = deposit64(0, 44, 8, estimate);
-+#include "sysemu/rtc.h"
++    }
- #include "hw/ssi/ssi.h"
+     if (result_exp == 0) {
- #include "qapi/error.h"
+         result_frac = deposit64(result_frac >> 1, 51, 1, 1);
- #include "qemu/cutils.h"
+     } else if (result_exp == -1) {
-diff --git a/hw/misc/mac_via.c b/hw/misc/mac_via.c
+@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(recpe_f16)(uint32_t input, float_status *fpst)
-index XXXXXXX..XXXXXXX 100644
+     }
---- a/hw/misc/mac_via.c
-+++ b/hw/misc/mac_via.c
+     f64_frac = call_recip_estimate(&f16_exp, 29,
-@@ -XXX,XX +XXX,XX @@
+-                                   ((uint64_t) f16_frac) << (52 - 10));
-  */
++                                   ((uint64_t) f16_frac) << (52 - 10), false);
- #include "qemu/osdep.h"
+     /* result = sign : result_exp<4:0> : fraction<51:42> */
--#include "qemu-common.h"
+     f16_val = deposit32(0, 15, 1, f16_sign);
- #include "migration/vmstate.h"
+@@ -XXX,XX +XXX,XX @@ static float32 do_recpe_f32(float32 input, float_status *fpst, bool rpres)
- #include "hw/sysbus.h"
+     }
- #include "hw/irq.h"
-@@ -XXX,XX +XXX,XX @@
+     f64_frac = call_recip_estimate(&f32_exp, 253,
- #include "hw/qdev-properties.h"
+-                                   ((uint64_t) f32_frac) << (52 - 23));
- #include "hw/qdev-properties-system.h"
++                                   ((uint64_t) f32_frac) << (52 - 23), rpres);
- #include "sysemu/block-backend.h"
-+#include "sysemu/rtc.h"
+     /* result = sign : result_exp<7:0> : fraction<51:29> */
- #include "trace.h"
+     f32_val = deposit32(0, 31, 1, f32_sign);
- #include "qemu/log.h"
+@@ -XXX,XX +XXX,XX @@ float64 HELPER(recpe_f64)(float64 input, float_status *fpst)
+         return float64_set_sign(float64_zero, float64_is_neg(f64));
-diff --git a/hw/misc/macio/cuda.c b/hw/misc/macio/cuda.c
+     }
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/macio/cuda.c
+-    f64_frac = call_recip_estimate(&f64_exp, 2045, f64_frac);
-+++ b/hw/misc/macio/cuda.c
++    f64_frac = call_recip_estimate(&f64_exp, 2045, f64_frac, false);
-@@ -XXX,XX +XXX,XX @@
-  */
+     /* result = sign : result_exp<10:0> : fraction<51:0>; */
+     f64_val = deposit64(0, 63, 1, f64_sign);
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "hw/ppc/mac.h"
  #include "hw/qdev-properties.h"
  #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "qemu/timer.h"
  #include "sysemu/runstate.h"
 +#include "sysemu/rtc.h"
  #include "qapi/error.h"
  #include "qemu/cutils.h"
  #include "qemu/log.h"
 diff --git a/hw/misc/macio/pmu.c b/hw/misc/macio/pmu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/macio/pmu.c
 +++ b/hw/misc/macio/pmu.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "hw/ppc/mac.h"
  #include "hw/qdev-properties.h"
  #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include "qemu/timer.h"
  #include "sysemu/runstate.h"
 +#include "sysemu/rtc.h"
  #include "qapi/error.h"
  #include "qemu/cutils.h"
  #include "qemu/log.h"
 diff --git a/hw/ppc/spapr_rtc.c b/hw/ppc/spapr_rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ppc/spapr_rtc.c
 +++ b/hw/ppc/spapr_rtc.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "qemu/timer.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/rtc.h"
  #include "hw/ppc/spapr.h"
  #include "migration/vmstate.h"
  #include "qapi/error.h"
 diff --git a/hw/rtc/allwinner-rtc.c b/hw/rtc/allwinner-rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/allwinner-rtc.c
 +++ b/hw/rtc/allwinner-rtc.c
@@ -XXX,XX +XXX,XX @@
  #include "migration/vmstate.h"
  #include "qemu/log.h"
  #include "qemu/module.h"
 -#include "qemu-common.h"
  #include "hw/qdev-properties.h"
  #include "hw/rtc/allwinner-rtc.h"
 +#include "sysemu/rtc.h"
  #include "trace.h"
  /* RTC registers */
 diff --git a/hw/rtc/aspeed_rtc.c b/hw/rtc/aspeed_rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/aspeed_rtc.c
 +++ b/hw/rtc/aspeed_rtc.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "hw/rtc/aspeed_rtc.h"
  #include "migration/vmstate.h"
  #include "qemu/log.h"
  #include "qemu/timer.h"
 +#include "sysemu/rtc.h"
  #include "trace.h"
 diff --git a/hw/rtc/ds1338.c b/hw/rtc/ds1338.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/ds1338.c
 +++ b/hw/rtc/ds1338.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "hw/i2c/i2c.h"
  #include "migration/vmstate.h"
  #include "qemu/bcd.h"
  #include "qemu/module.h"
  #include "qom/object.h"
 +#include "sysemu/rtc.h"
  /* Size of NVRAM including both the user-accessible area and the
   * secondary register area.
 diff --git a/hw/rtc/exynos4210_rtc.c b/hw/rtc/exynos4210_rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/exynos4210_rtc.c
 +++ b/hw/rtc/exynos4210_rtc.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "qemu/log.h"
  #include "qemu/module.h"
  #include "hw/sysbus.h"
@@ -XXX,XX +XXX,XX @@
  #include "hw/arm/exynos4210.h"
  #include "qom/object.h"
 +#include "sysemu/rtc.h"
  #define DEBUG_RTC 0
 diff --git a/hw/rtc/goldfish_rtc.c b/hw/rtc/goldfish_rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/goldfish_rtc.c
 +++ b/hw/rtc/goldfish_rtc.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "hw/rtc/goldfish_rtc.h"
  #include "migration/vmstate.h"
  #include "hw/irq.h"
@@ -XXX,XX +XXX,XX @@
  #include "qemu/bitops.h"
  #include "qemu/timer.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/rtc.h"
  #include "qemu/cutils.h"
  #include "qemu/log.h"
 diff --git a/hw/rtc/m41t80.c b/hw/rtc/m41t80.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/m41t80.c
 +++ b/hw/rtc/m41t80.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "qemu/log.h"
  #include "qemu/module.h"
  #include "qemu/timer.h"
  #include "qemu/bcd.h"
  #include "hw/i2c/i2c.h"
  #include "qom/object.h"
 +#include "sysemu/rtc.h"
  #define TYPE_M41T80 "m41t80"
  OBJECT_DECLARE_SIMPLE_TYPE(M41t80State, M41T80)
 diff --git a/hw/rtc/m48t59.c b/hw/rtc/m48t59.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/m48t59.c
 +++ b/hw/rtc/m48t59.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "hw/irq.h"
  #include "hw/qdev-properties.h"
  #include "hw/rtc/m48t59.h"
  #include "qemu/timer.h"
  #include "sysemu/runstate.h"
 +#include "sysemu/rtc.h"
  #include "sysemu/sysemu.h"
  #include "hw/sysbus.h"
  #include "qapi/error.h"
 diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/mc146818rtc.c
 +++ b/hw/rtc/mc146818rtc.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "qemu/cutils.h"
  #include "qemu/module.h"
  #include "qemu/bcd.h"
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/replay.h"
  #include "sysemu/reset.h"
  #include "sysemu/runstate.h"
 +#include "sysemu/rtc.h"
  #include "hw/rtc/mc146818rtc.h"
  #include "hw/rtc/mc146818rtc_regs.h"
  #include "migration/vmstate.h"
 diff --git a/hw/rtc/pl031.c b/hw/rtc/pl031.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/pl031.c
 +++ b/hw/rtc/pl031.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "hw/rtc/pl031.h"
  #include "migration/vmstate.h"
  #include "hw/irq.h"
@@ -XXX,XX +XXX,XX @@
  #include "hw/sysbus.h"
  #include "qemu/timer.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/rtc.h"
  #include "qemu/cutils.h"
  #include "qemu/log.h"
  #include "qemu/module.h"
 diff --git a/hw/rtc/twl92230.c b/hw/rtc/twl92230.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/twl92230.c
 +++ b/hw/rtc/twl92230.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "qemu/timer.h"
  #include "hw/i2c/i2c.h"
  #include "hw/irq.h"
  #include "migration/qemu-file-types.h"
  #include "migration/vmstate.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/rtc.h"
  #include "qemu/bcd.h"
  #include "qemu/module.h"
  #include "qom/object.h"
 diff --git a/hw/rtc/xlnx-zynqmp-rtc.c b/hw/rtc/xlnx-zynqmp-rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/rtc/xlnx-zynqmp-rtc.c
 +++ b/hw/rtc/xlnx-zynqmp-rtc.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "hw/sysbus.h"
  #include "hw/register.h"
  #include "qemu/bitops.h"
@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "qemu/cutils.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/rtc.h"
  #include "trace.h"
  #include "hw/rtc/xlnx-zynqmp-rtc.h"
  #include "migration/vmstate.h"
 diff --git a/hw/s390x/tod-tcg.c b/hw/s390x/tod-tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/s390x/tod-tcg.c
 +++ b/hw/s390x/tod-tcg.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "qapi/error.h"
  #include "hw/s390x/tod.h"
  #include "qemu/timer.h"
@@ -XXX,XX +XXX,XX @@
  #include "qemu/module.h"
  #include "cpu.h"
  #include "tcg/tcg_s390x.h"
 +#include "sysemu/rtc.h"
  static void qemu_s390_tod_get(const S390TODState *td, S390TOD *tod,
                                Error **errp)
 diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/scsi/megasas.c
 +++ b/hw/scsi/megasas.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "hw/pci/pci.h"
  #include "hw/qdev-properties.h"
  #include "sysemu/dma.h"
  #include "sysemu/block-backend.h"
 +#include "sysemu/rtc.h"
  #include "hw/pci/msi.h"
  #include "hw/pci/msix.h"
  #include "qemu/iov.h"
 diff --git a/net/dump.c b/net/dump.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/dump.c
 +++ b/net/dump.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "clients.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@
  #include "qapi/visitor.h"
  #include "net/filter.h"
  #include "qom/object.h"
 +#include "sysemu/rtc.h"
  typedef struct DumpState {
      int64_t start_ts;
 diff --git a/softmmu/rtc.c b/softmmu/rtc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/rtc.c
 +++ b/softmmu/rtc.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "qemu/cutils.h"
  #include "qapi/error.h"
  #include "qapi/qmp/qerror.h"
@@ -XXX,XX +XXX,XX @@
  #include "qom/object.h"
  #include "sysemu/replay.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/rtc.h"
  static enum {
      RTC_BASE_UTC,
 --
-.25.1
+.34.1

-[PULL 22/32] hw/intc/arm_gicv3: Honour GICD_CTLR.EnableGrp1NS for LPIs
+[PULL 54/68] target/arm: Implement increased precision FRSQRTE
-The GICD_CTLR distributor register has enable bits which control
+Implement the increased precision variation of FRSQRTE.  In the
-whether the different interrupt groups (Group 0, Non-secure Group 1
+pseudocode this corresponds to the handling of the
-and Secure Group 1) are forwarded to the CPU.  We get this right for
+"increasedprecision" boolean in the FPRSqrtEstimate() and
-traditional interrupts, but forgot to account for it when adding
+RecipSqrtEstimate() functions.
 LPIs.  LPIs are always Group 1 NS and if the EnableGrp1NS bit is not
 set we must not forward them to the CPU.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-7-peter.maydell@linaro.org
 ---
- hw/intc/arm_gicv3.c | 1 +
+ target/arm/vfp_helper.c | 77 ++++++++++++++++++++++++++++++++++-------
-file changed, 1 insertion(+)
+file changed, 64 insertions(+), 13 deletions(-)
-diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3.c
+--- a/target/arm/vfp_helper.c
-+++ b/hw/intc/arm_gicv3.c
++++ b/target/arm/vfp_helper.c
-@@ -XXX,XX +XXX,XX @@ static void gicv3_redist_update_noirqset(GICv3CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static int do_recip_sqrt_estimate(int a)
      return estimate;
  }
 +static int do_recip_sqrt_estimate_incprec(int a)
 +{
 +    /*
 +     * The Arm ARM describes the 12-bit precision version of RecipSqrtEstimate
 +     * in terms of an infinite-precision floating point calculation of a
 +     * square root. We implement this using the same kind of pure integer
 +     * algorithm as the 8-bit mantissa, to get the same bit-for-bit result.
 +     */
 +    int64_t b, estimate;
 -static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac)
 +    assert(1024 <= a && a < 4096);
 +    if (a < 2048) {
 +        a = a * 2 + 1;
 +    } else {
 +        a = (a >> 1) << 1;
 +        a = (a + 1) * 2;
 +    }
 +    b = 8192;
 +    while (a * (b + 1) * (b + 1) < (1ULL << 39)) {
 +        b += 1;
 +    }
 +    estimate = (b + 1) / 2;
 +
 +    assert(4096 <= estimate && estimate < 8192);
 +
 +    return estimate;
 +}
 +
 +static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac,
 +                                    bool increasedprecision)
  {
      int estimate;
      uint32_t scaled;
@@ -XXX,XX +XXX,XX @@ static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac)
          frac = extract64(frac, 0, 51) << 1;
      }
-     if ((cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) && cs->gic->lpi_enable &&
+-    if (*exp & 1) {
-+        (cs->gic->gicd_ctlr & GICD_CTLR_EN_GRP1NS) &&
+-        /* scaled = UInt('01':fraction<51:45>) */
-         (cs->hpplpi.prio != 0xff)) {
+-        scaled = deposit32(1 << 7, 0, 7, extract64(frac, 45, 7));
-         if (irqbetter(cs, cs->hpplpi.irq, cs->hpplpi.prio)) {
++    if (increasedprecision) {
-             cs->hppi.irq = cs->hpplpi.irq;
++        if (*exp & 1) {
 +            /* scaled = UInt('01':fraction<51:42>) */
 +            scaled = deposit32(1 << 10, 0, 10, extract64(frac, 42, 10));
 +        } else {
 +            /* scaled = UInt('1':fraction<51:41>) */
 +            scaled = deposit32(1 << 11, 0, 11, extract64(frac, 41, 11));
 +        }
 +        estimate = do_recip_sqrt_estimate_incprec(scaled);
      } else {
 -        /* scaled = UInt('1':fraction<51:44>) */
 -        scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8));
 +        if (*exp & 1) {
 +            /* scaled = UInt('01':fraction<51:45>) */
 +            scaled = deposit32(1 << 7, 0, 7, extract64(frac, 45, 7));
 +        } else {
 +            /* scaled = UInt('1':fraction<51:44>) */
 +            scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8));
 +        }
 +        estimate = do_recip_sqrt_estimate(scaled);
      }
 -    estimate = do_recip_sqrt_estimate(scaled);
      *exp = (exp_off - *exp) / 2;
 -    return extract64(estimate, 0, 8) << 44;
 +    if (increasedprecision) {
 +        return extract64(estimate, 0, 12) << 40;
 +    } else {
 +        return extract64(estimate, 0, 8) << 44;
 +    }
  }
  uint32_t HELPER(rsqrte_f16)(uint32_t input, float_status *s)
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(rsqrte_f16)(uint32_t input, float_status *s)
      f64_frac = ((uint64_t) f16_frac) << (52 - 10);
 -    f64_frac = recip_sqrt_estimate(&f16_exp, 44, f64_frac);
 +    f64_frac = recip_sqrt_estimate(&f16_exp, 44, f64_frac, false);
      /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(2) */
      val = deposit32(0, 15, 1, f16_sign);
@@ -XXX,XX +XXX,XX @@ static float32 do_rsqrte_f32(float32 input, float_status *s, bool rpres)
      f64_frac = ((uint64_t) f32_frac) << 29;
 -    f64_frac = recip_sqrt_estimate(&f32_exp, 380, f64_frac);
 +    f64_frac = recip_sqrt_estimate(&f32_exp, 380, f64_frac, rpres);
 -    /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(15) */
 +    /*
 +     * result = sign : result_exp<7:0> : estimate<7:0> : Zeros(15)
 +     * or for increased precision
 +     * result = sign : result_exp<7:0> : estimate<11:0> : Zeros(11)
 +     */
      val = deposit32(0, 31, 1, f32_sign);
      val = deposit32(val, 23, 8, f32_exp);
 -    val = deposit32(val, 15, 8, extract64(f64_frac, 52 - 8, 8));
 +    if (rpres) {
 +        val = deposit32(val, 11, 12, extract64(f64_frac, 52 - 12, 12));
 +    } else {
 +        val = deposit32(val, 15, 8, extract64(f64_frac, 52 - 8, 8));
 +    }
      return make_float32(val);
  }
@@ -XXX,XX +XXX,XX @@ float64 HELPER(rsqrte_f64)(float64 input, float_status *s)
          return float64_zero;
      }
 -    f64_frac = recip_sqrt_estimate(&f64_exp, 3068, f64_frac);
 +    f64_frac = recip_sqrt_estimate(&f64_exp, 3068, f64_frac, false);
      /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(44) */
      val = deposit64(0, 61, 1, f64_sign);
 --
-.25.1
+.34.1

-[PULL 01/32] Update copyright dates to 2022
+[PULL 55/68] target/arm: Enable FEAT_RPRES for -cpu max
-It's a new year; update the copyright strings for our
+Now the emulation is complete, we can enable FEAT_RPRES for the 'max'
-help/version/about information and for our documentation.
+CPU type.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20220120124713.288303-1-peter.maydell@linaro.org
 ---
- docs/conf.py          | 2 +-
+ docs/system/arm/emulation.rst | 1 +
- include/qemu-common.h | 2 +-
+ target/arm/tcg/cpu64.c        | 1 +
-files changed, 2 insertions(+), 2 deletions(-)
+files changed, 2 insertions(+)
-diff --git a/docs/conf.py b/docs/conf.py
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/docs/conf.py
+--- a/docs/system/arm/emulation.rst
-+++ b/docs/conf.py
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
+ - FEAT_RDM (Advanced SIMD rounding double multiply accumulate instructions)
- # General information about the project.
+ - FEAT_RME (Realm Management Extension) (NB: support status in QEMU is experimental)
- project = u'QEMU'
+ - FEAT_RNG (Random number generator)
--copyright = u'2021, The QEMU Project Developers'
++- FEAT_RPRES (Increased precision of FRECPE and FRSQRTE)
-+copyright = u'2022, The QEMU Project Developers'
+ - FEAT_S2FWB (Stage 2 forced Write-Back)
- author = u'The QEMU Project Developers'
+ - FEAT_SB (Speculation Barrier)
+ - FEAT_SEL2 (Secure EL2)
- # The version info for the project you're documenting, acts as replacement for
+diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
 diff --git a/include/qemu-common.h b/include/qemu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/qemu-common.h
+--- a/target/arm/tcg/cpu64.c
-+++ b/include/qemu-common.h
++++ b/target/arm/tcg/cpu64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
- #define TFR(expr) do { if ((expr) != -1) break; } while (errno == EINTR)
+     cpu->isar.id_aa64isar1 = t;
- /* Copyright string for -version arguments, About dialogs, etc */
+     t = cpu->isar.id_aa64isar2;
--#define QEMU_COPYRIGHT "Copyright (c) 2003-2021 " \
++    t = FIELD_DP64(t, ID_AA64ISAR2, RPRES, 1);    /* FEAT_RPRES */
-+#define QEMU_COPYRIGHT "Copyright (c) 2003-2022 " \
+     t = FIELD_DP64(t, ID_AA64ISAR2, MOPS, 1);     /* FEAT_MOPS */
-     "Fabrice Bellard and the QEMU Project developers"
+     t = FIELD_DP64(t, ID_AA64ISAR2, BC, 1);       /* FEAT_HBC */
+     t = FIELD_DP64(t, ID_AA64ISAR2, WFXT, 2);     /* FEAT_WFxT */
  /* Bug reporting information for --help arguments, About dialogs, etc */
 --
-.25.1
+.34.1

-New patch
+[PULL 56/68] target/arm: Introduce CPUARMState.vfp.fp_status[]
+From: Richard Henderson <richard.henderson@linaro.org>
 Move ARMFPStatusFlavour to cpu.h with which to index
 this array.  For now, place the array in an anonymous
 union with the existing structures.  Adjust the order
 of the existing structures to match the enum.
 Simplify fpstatus_ptr() using the new array.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20250129013857.135256-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu.h           | 119 +++++++++++++++++++++----------------
  target/arm/tcg/translate.h |  64 +-------------------
 files changed, 70 insertions(+), 113 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
  typedef struct NVICState NVICState;
 +/*
 + * Enum for indexing vfp.fp_status[].
 + *
 + * FPST_A32: is the "normal" fp status for AArch32 insns
 + * FPST_A64: is the "normal" fp status for AArch64 insns
 + * FPST_A32_F16: used for AArch32 half-precision calculations
 + * FPST_A64_F16: used for AArch64 half-precision calculations
 + * FPST_STD: the ARM "Standard FPSCR Value"
 + * FPST_STD_F16: used for half-precision
 + *       calculations with the ARM "Standard FPSCR Value"
 + * FPST_AH: used for the A64 insns which change behaviour
 + *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
 + *       and the reciprocal and square root estimate/step insns)
 + * FPST_AH_F16: used for the A64 insns which change behaviour
 + *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
 + *       and the reciprocal and square root estimate/step insns);
 + *       for half-precision
 + *
 + * Half-precision operations are governed by a separate
 + * flush-to-zero control bit in FPSCR:FZ16. We pass a separate
 + * status structure to control this.
 + *
 + * The "Standard FPSCR", ie default-NaN, flush-to-zero,
 + * round-to-nearest and is used by any operations (generally
 + * Neon) which the architecture defines as controlled by the
 + * standard FPSCR value rather than the FPSCR.
 + *
 + * The "standard FPSCR but for fp16 ops" is needed because
 + * the "standard FPSCR" tracks the FPSCR.FZ16 bit rather than
 + * using a fixed value for it.
 + *
 + * The ah_fp_status is needed because some insns have different
 + * behaviour when FPCR.AH == 1: they don't update cumulative
 + * exception flags, they act like FPCR.{FZ,FIZ} = {1,1} and
 + * they ignore FPCR.RMode. But they don't ignore FPCR.FZ16,
 + * which means we need an ah_fp_status_f16 as well.
 + *
 + * To avoid having to transfer exception bits around, we simply
 + * say that the FPSCR cumulative exception flags are the logical
 + * OR of the flags in the four fp statuses. This relies on the
 + * only thing which needs to read the exception flags being
 + * an explicit FPSCR read.
 + */
 +typedef enum ARMFPStatusFlavour {
 +    FPST_A32,
 +    FPST_A64,
 +    FPST_A32_F16,
 +    FPST_A64_F16,
 +    FPST_AH,
 +    FPST_AH_F16,
 +    FPST_STD,
 +    FPST_STD_F16,
 +} ARMFPStatusFlavour;
 +#define FPST_COUNT  8
 +
  typedef struct CPUArchState {
      /* Regs for current mode.  */
      uint32_t regs[16];
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          /* Scratch space for aa32 neon expansion.  */
          uint32_t scratch[8];
 -        /* There are a number of distinct float control structures:
 -         *
 -         *  fp_status_a32: is the "normal" fp status for AArch32 insns
 -         *  fp_status_a64: is the "normal" fp status for AArch64 insns
 -         *  fp_status_fp16_a32: used for AArch32 half-precision calculations
 -         *  fp_status_fp16_a64: used for AArch64 half-precision calculations
 -         *  standard_fp_status : the ARM "Standard FPSCR Value"
 -         *  standard_fp_status_fp16 : used for half-precision
 -         *       calculations with the ARM "Standard FPSCR Value"
 -         *  ah_fp_status: used for the A64 insns which change behaviour
 -         *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
 -         *       and the reciprocal and square root estimate/step insns)
 -         *  ah_fp_status_f16: used for the A64 insns which change behaviour
 -         *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
 -         *       and the reciprocal and square root estimate/step insns);
 -         *       for half-precision
 -         *
 -         * Half-precision operations are governed by a separate
 -         * flush-to-zero control bit in FPSCR:FZ16. We pass a separate
 -         * status structure to control this.
 -         *
 -         * The "Standard FPSCR", ie default-NaN, flush-to-zero,
 -         * round-to-nearest and is used by any operations (generally
 -         * Neon) which the architecture defines as controlled by the
 -         * standard FPSCR value rather than the FPSCR.
 -         *
 -         * The "standard FPSCR but for fp16 ops" is needed because
 -         * the "standard FPSCR" tracks the FPSCR.FZ16 bit rather than
 -         * using a fixed value for it.
 -         *
 -         * The ah_fp_status is needed because some insns have different
 -         * behaviour when FPCR.AH == 1: they don't update cumulative
 -         * exception flags, they act like FPCR.{FZ,FIZ} = {1,1} and
 -         * they ignore FPCR.RMode. But they don't ignore FPCR.FZ16,
 -         * which means we need an ah_fp_status_f16 as well.
 -         *
 -         * To avoid having to transfer exception bits around, we simply
 -         * say that the FPSCR cumulative exception flags are the logical
 -         * OR of the flags in the four fp statuses. This relies on the
 -         * only thing which needs to read the exception flags being
 -         * an explicit FPSCR read.
 -         */
 -        float_status fp_status_a32;
 -        float_status fp_status_a64;
 -        float_status fp_status_f16_a32;
 -        float_status fp_status_f16_a64;
 -        float_status standard_fp_status;
 -        float_status standard_fp_status_f16;
 -        float_status ah_fp_status;
 -        float_status ah_fp_status_f16;
 +        /* There are a number of distinct float control structures. */
 +        union {
 +            float_status fp_status[FPST_COUNT];
 +            struct {
 +                float_status fp_status_a32;
 +                float_status fp_status_a64;
 +                float_status fp_status_f16_a32;
 +                float_status fp_status_f16_a64;
 +                float_status ah_fp_status;
 +                float_status ah_fp_status_f16;
 +                float_status standard_fp_status;
 +                float_status standard_fp_status_f16;
 +            };
 +        };
          uint64_t zcr_el[4];   /* ZCR_EL[1-3] */
          uint64_t smcr_el[4];  /* SMCR_EL[1-3] */
 diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/translate.h
 +++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
      return (CPUARMTBFlags){ tb->flags, tb->cs_base };
  }
 -/*
 - * Enum for argument to fpstatus_ptr().
 - */
 -typedef enum ARMFPStatusFlavour {
 -    FPST_A32,
 -    FPST_A64,
 -    FPST_A32_F16,
 -    FPST_A64_F16,
 -    FPST_AH,
 -    FPST_AH_F16,
 -    FPST_STD,
 -    FPST_STD_F16,
 -} ARMFPStatusFlavour;
 -
  /**
   * fpstatus_ptr: return TCGv_ptr to the specified fp_status field
   *
   * We have multiple softfloat float_status fields in the Arm CPU state struct
   * (see the comment in cpu.h for details). Return a TCGv_ptr which has
   * been set up to point to the requested field in the CPU state struct.
 - * The options are:
 - *
 - * FPST_A32
 - *   for AArch32 non-FP16 operations controlled by the FPCR
 - * FPST_A64
 - *   for AArch64 non-FP16 operations controlled by the FPCR
 - * FPST_A32_F16
 - *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
 - * FPST_A64_F16
 - *   for AArch64 operations controlled by the FPCR where FPCR.FZ16 is to be used
 - * FPST_AH:
 - *   for AArch64 operations which change behaviour when AH=1 (specifically,
 - *   bfloat16 conversions and multiplies, and the reciprocal and square root
 - *   estimate/step insns)
 - * FPST_AH_F16:
 - *   ditto, but for half-precision operations
 - * FPST_STD
 - *   for A32/T32 Neon operations using the "standard FPSCR value"
 - * FPST_STD_F16
 - *   as FPST_STD, but where FPCR.FZ16 is to be used
   */
  static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
  {
      TCGv_ptr statusptr = tcg_temp_new_ptr();
 -    int offset;
 +    int offset = offsetof(CPUARMState, vfp.fp_status[flavour]);
 -    switch (flavour) {
 -    case FPST_A32:
 -        offset = offsetof(CPUARMState, vfp.fp_status_a32);
 -        break;
 -    case FPST_A64:
 -        offset = offsetof(CPUARMState, vfp.fp_status_a64);
 -        break;
 -    case FPST_A32_F16:
 -        offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
 -        break;
 -    case FPST_A64_F16:
 -        offset = offsetof(CPUARMState, vfp.fp_status_f16_a64);
 -        break;
 -    case FPST_AH:
 -        offset = offsetof(CPUARMState, vfp.ah_fp_status);
 -        break;
 -    case FPST_AH_F16:
 -        offset = offsetof(CPUARMState, vfp.ah_fp_status_f16);
 -        break;
 -    case FPST_STD:
 -        offset = offsetof(CPUARMState, vfp.standard_fp_status);
 -        break;
 -    case FPST_STD_F16:
 -        offset = offsetof(CPUARMState, vfp.standard_fp_status_f16);
 -        break;
 -    default:
 -        g_assert_not_reached();
 -    }
      tcg_gen_addi_ptr(statusptr, tcg_env, offset);
      return statusptr;
  }
 --
 .34.1

-[PULL 31/32] hw/arm: ast2600: Fix address mapping of second SPI controller
+[PULL 57/68] target/arm: Remove standard_fp_status_f16
-From: Cédric Le Goater <clg@kaod.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-Address should be 0x1E631000 and not 0x1E641000 as initially introduced.
+Replace with fp_status[FPST_STD_F16].
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/838
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Fixes: f25c0ae1079d ("aspeed/soc: Add AST2600 support")
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Suggested-by: Troy Lee <troy_lee@aspeedtech.com>
+Message-id: 20250129013857.135256-8-richard.henderson@linaro.org
 Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20220126083520.4135713-1-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/aspeed_ast2600.c | 2 +-
+ target/arm/cpu.h            |  1 -
-file changed, 1 insertion(+), 1 deletion(-)
+ target/arm/cpu.c            |  4 ++--
  target/arm/tcg/mve_helper.c | 24 ++++++++++++------------
  target/arm/vfp_helper.c     |  8 ++++----
 files changed, 18 insertions(+), 19 deletions(-)
-diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/aspeed_ast2600.c
+--- a/target/arm/cpu.h
-+++ b/hw/arm/aspeed_ast2600.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-     [ASPEED_DEV_PWM]       = 0x1E610000,
+                 float_status ah_fp_status;
-     [ASPEED_DEV_FMC]       = 0x1E620000,
+                 float_status ah_fp_status_f16;
-     [ASPEED_DEV_SPI1]      = 0x1E630000,
+                 float_status standard_fp_status;
--    [ASPEED_DEV_SPI2]      = 0x1E641000,
+-                float_status standard_fp_status_f16;
-+    [ASPEED_DEV_SPI2]      = 0x1E631000,
+             };
-     [ASPEED_DEV_EHCI1]     = 0x1E6A1000,
+         };
-     [ASPEED_DEV_EHCI2]     = 0x1E6A3000,
-     [ASPEED_DEV_MII1]      = 0x1E650000,
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
      set_flush_to_zero(1, &env->vfp.standard_fp_status);
      set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
      set_default_nan_mode(1, &env->vfp.standard_fp_status);
 -    set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
 +    set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD_F16]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
      arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
 -    arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
 +    arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD_F16]);
      arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status);
      set_flush_to_zero(1, &env->vfp.ah_fp_status);
      set_flush_inputs_to_zero(1, &env->vfp.ah_fp_status);
 diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/mve_helper.c
 +++ b/target/arm/tcg/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_VMAXMINA(vminaw, 4, int32_t, uint32_t, DO_MIN)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
 +            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                  &env->vfp.standard_fp_status;                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ALL(vminnma, minnuma)
                  r[e] = 0;                                               \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
 +            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                  &env->vfp.standard_fp_status;                           \
              if (!(tm & 1)) {                                            \
                  /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_VCADD_FP(vfcadd270s, 4, float32, float32_add, float32_sub)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
 +            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                  &env->vfp.standard_fp_status;                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_VFMA(vfmss, 4, float32, true)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE * 2)) == 0) {          \
                  continue;                                               \
              }                                                           \
 -            fpst0 = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :   \
 +            fpst0 = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :  \
                  &env->vfp.standard_fp_status;                           \
              fpst1 = fpst0;                                              \
              if (!(mask & 1)) {                                          \
@@ -XXX,XX +XXX,XX @@ DO_VCMLA(vcmla270s, 4, float32, 3, DO_VCMLAS)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
 +            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                  &env->vfp.standard_fp_status;                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_SCALAR_ALL(vfmul_scalar, mul)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
 +            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                  &env->vfp.standard_fp_status;                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ACC_SCALAR(vfmas_scalars, 4, float32, DO_VFMAS_SCALARS)
          TYPE *m = vm;                                           \
          TYPE ra = (TYPE)ra_in;                                  \
          float_status *fpst = (ESIZE == 2) ?                     \
 -            &env->vfp.standard_fp_status_f16 :                  \
 +            &env->vfp.fp_status[FPST_STD_F16] :                 \
              &env->vfp.standard_fp_status;                       \
          for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {      \
              if (mask & 1) {                                     \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
              if ((mask & emask) == 0) {                                  \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
 +            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                  &env->vfp.standard_fp_status;                           \
              if (!(mask & (1 << (e * ESIZE)))) {                         \
                  /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
              if ((mask & emask) == 0) {                                  \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
 +            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                  &env->vfp.standard_fp_status;                           \
              if (!(mask & (1 << (e * ESIZE)))) {                         \
                  /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_VCMP_FP_BOTH(vfcmples, vfcmple_scalars, 4, float32, !DO_GT32)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
 +            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                  &env->vfp.standard_fp_status;                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_VCVT_FIXED(vcvt_fu, 4, uint32_t, helper_vfp_touls_round_to_zero)
          float_status *fpst;                                             \
          float_status scratch_fpst;                                      \
          float_status *base_fpst = (ESIZE == 2) ?                        \
 -            &env->vfp.standard_fp_status_f16 :                          \
 +            &env->vfp.fp_status[FPST_STD_F16] :                         \
              &env->vfp.standard_fp_status;                               \
          uint32_t prev_rmode = get_float_rounding_mode(base_fpst);       \
          set_float_rounding_mode(rmode, base_fpst);                      \
@@ -XXX,XX +XXX,XX @@ void HELPER(mve_vcvtt_hs)(CPUARMState *env, void *vd, void *vm)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
 +            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                  &env->vfp.standard_fp_status;                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
      /* FZ16 does not generate an input denormal exception.  */
      a32_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
            & ~float_flag_input_denormal_flushed);
 -    a32_flags |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
 +    a32_flags |= (get_float_exception_flags(&env->vfp.fp_status[FPST_STD_F16])
            & ~float_flag_input_denormal_flushed);
      a64_flags |= get_float_exception_flags(&env->vfp.fp_status_a64);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
      set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
      set_float_exception_flags(0, &env->vfp.standard_fp_status);
 -    set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
 +    set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD_F16]);
      set_float_exception_flags(0, &env->vfp.ah_fp_status);
      set_float_exception_flags(0, &env->vfp.ah_fp_status_f16);
  }
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          bool ftz_enabled = val & FPCR_FZ16;
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
 -        set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
 +        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
          set_flush_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
 -        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
 +        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
      }
      if (changed & FPCR_FZ) {
 --
-.25.1
+.34.1

-[PULL 16/32] scripts: Explain the difference between linux-headers and standard-headers
+[PULL 58/68] target/arm: Remove standard_fp_status
-If you don't know it, it's hard to figure out the difference between
+From: Richard Henderson <richard.henderson@linaro.org>
-the linux-headers folder and the include/standard-headers folder.
-So let's add a short explanation to clarify the difference.
+Replace with fp_status[FPST_STD].
-Suggested-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20250129013857.135256-9-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Cornelia Huck <cohuck@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
 ---
- scripts/update-linux-headers.sh | 16 ++++++++++++++++
+ target/arm/cpu.h            |  1 -
-file changed, 16 insertions(+)
+ target/arm/cpu.c            |  8 ++++----
+ target/arm/tcg/mve_helper.c | 28 ++++++++++++++--------------
-diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
+ target/arm/tcg/vec_helper.c |  4 ++--
-index XXXXXXX..XXXXXXX 100755
+ target/arm/vfp_helper.c     |  4 ++--
---- a/scripts/update-linux-headers.sh
+files changed, 22 insertions(+), 23 deletions(-)
-+++ b/scripts/update-linux-headers.sh
-@@ -XXX,XX +XXX,XX @@
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
- #
+index XXXXXXX..XXXXXXX 100644
- # This work is licensed under the terms of the GNU GPL version 2.
+--- a/target/arm/cpu.h
- # See the COPYING file in the top-level directory.
++++ b/target/arm/cpu.h
-+#
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-+# The script will copy the headers into two target folders:
+                 float_status fp_status_f16_a64;
-+#
+                 float_status ah_fp_status;
-+# - linux-headers/ for files that are required for compiling for a
+                 float_status ah_fp_status_f16;
-+#   Linux host.  Generally we have these so we can use kernel structs
+-                float_status standard_fp_status;
-+#   and defines that are more recent than the headers that might be
+             };
-+#   installed on the host system.  Usually this script can do simple
+         };
-+#   file copies for these headers.
-+#
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-+# - include/standard-headers/ for files that are used for guest
+index XXXXXXX..XXXXXXX 100644
-+#   device emulation and are required on all hosts.  For instance, we
+--- a/target/arm/cpu.c
-+#   get our definitions of the virtio structures from the Linux
++++ b/target/arm/cpu.c
-+#   kernel headers, but we need those definitions regardless of which
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
-+#   host OS we are building for.  This script has to be careful to
+         env->sau.ctrl = 0;
-+#   sanitize the headers to remove any use of Linux-specifics such as
+     }
-+#   types like "__u64".  This work is done in the cp_portable function.
+-    set_flush_to_zero(1, &env->vfp.standard_fp_status);
- tmpdir=$(mktemp -d)
+-    set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
- linux="$1"
+-    set_default_nan_mode(1, &env->vfp.standard_fp_status);
 +    set_flush_to_zero(1, &env->vfp.fp_status[FPST_STD]);
 +    set_flush_inputs_to_zero(1, &env->vfp.fp_status[FPST_STD]);
 +    set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD]);
      set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD_F16]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
 -    arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
 +    arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD_F16]);
 diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/mve_helper.c
 +++ b/target/arm/tcg/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_VMAXMINA(vminaw, 4, int32_t, uint32_t, DO_MIN)
                  continue;                                               \
              }                                                           \
              fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.standard_fp_status;                           \
 +                &env->vfp.fp_status[FPST_STD];                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ALL(vminnma, minnuma)
                  continue;                                               \
              }                                                           \
              fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.standard_fp_status;                           \
 +                &env->vfp.fp_status[FPST_STD];                           \
              if (!(tm & 1)) {                                            \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCADD_FP(vfcadd270s, 4, float32, float32_add, float32_sub)
                  continue;                                               \
              }                                                           \
              fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.standard_fp_status;                           \
 +                &env->vfp.fp_status[FPST_STD];                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VFMA(vfmss, 4, float32, true)
                  continue;                                               \
              }                                                           \
              fpst0 = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :  \
 -                &env->vfp.standard_fp_status;                           \
 +                &env->vfp.fp_status[FPST_STD];                           \
              fpst1 = fpst0;                                              \
              if (!(mask & 1)) {                                          \
                  scratch_fpst = *fpst0;                                  \
@@ -XXX,XX +XXX,XX @@ DO_VCMLA(vcmla270s, 4, float32, 3, DO_VCMLAS)
                  continue;                                               \
              }                                                           \
              fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.standard_fp_status;                           \
 +                &env->vfp.fp_status[FPST_STD];                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_SCALAR_ALL(vfmul_scalar, mul)
                  continue;                                               \
              }                                                           \
              fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.standard_fp_status;                           \
 +                &env->vfp.fp_status[FPST_STD];                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ACC_SCALAR(vfmas_scalars, 4, float32, DO_VFMAS_SCALARS)
          TYPE ra = (TYPE)ra_in;                                  \
          float_status *fpst = (ESIZE == 2) ?                     \
              &env->vfp.fp_status[FPST_STD_F16] :                 \
 -            &env->vfp.standard_fp_status;                       \
 +            &env->vfp.fp_status[FPST_STD];                       \
          for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {      \
              if (mask & 1) {                                     \
                  TYPE v = m[H##ESIZE(e)];                        \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
                  continue;                                               \
              }                                                           \
              fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.standard_fp_status;                           \
 +                &env->vfp.fp_status[FPST_STD];                           \
              if (!(mask & (1 << (e * ESIZE)))) {                         \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
                  continue;                                               \
              }                                                           \
              fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.standard_fp_status;                           \
 +                &env->vfp.fp_status[FPST_STD];                           \
              if (!(mask & (1 << (e * ESIZE)))) {                         \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCMP_FP_BOTH(vfcmples, vfcmple_scalars, 4, float32, !DO_GT32)
                  continue;                                               \
              }                                                           \
              fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.standard_fp_status;                           \
 +                &env->vfp.fp_status[FPST_STD];                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCVT_FIXED(vcvt_fu, 4, uint32_t, helper_vfp_touls_round_to_zero)
          float_status scratch_fpst;                                      \
          float_status *base_fpst = (ESIZE == 2) ?                        \
              &env->vfp.fp_status[FPST_STD_F16] :                         \
 -            &env->vfp.standard_fp_status;                               \
 +            &env->vfp.fp_status[FPST_STD];                               \
          uint32_t prev_rmode = get_float_rounding_mode(base_fpst);       \
          set_float_rounding_mode(rmode, base_fpst);                      \
          for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {              \
@@ -XXX,XX +XXX,XX @@ static void do_vcvt_sh(CPUARMState *env, void *vd, void *vm, int top)
      unsigned e;
      float_status *fpst;
      float_status scratch_fpst;
 -    float_status *base_fpst = &env->vfp.standard_fp_status;
 +    float_status *base_fpst = &env->vfp.fp_status[FPST_STD];
      bool old_fz = get_flush_to_zero(base_fpst);
      set_flush_to_zero(false, base_fpst);
      for (e = 0; e < 16 / 4; e++, mask >>= 4) {
@@ -XXX,XX +XXX,XX @@ static void do_vcvt_hs(CPUARMState *env, void *vd, void *vm, int top)
      unsigned e;
      float_status *fpst;
      float_status scratch_fpst;
 -    float_status *base_fpst = &env->vfp.standard_fp_status;
 +    float_status *base_fpst = &env->vfp.fp_status[FPST_STD];
      bool old_fiz = get_flush_inputs_to_zero(base_fpst);
      set_flush_inputs_to_zero(false, base_fpst);
      for (e = 0; e < 16 / 4; e++, mask >>= 4) {
@@ -XXX,XX +XXX,XX @@ void HELPER(mve_vcvtt_hs)(CPUARMState *env, void *vd, void *vm)
                  continue;                                               \
              }                                                           \
              fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.standard_fp_status;                           \
 +                &env->vfp.fp_status[FPST_STD];                           \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
 diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/vec_helper.c
 +++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
      bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
      uint64_t negx = is_s ? 0x8000800080008000ull : 0;
 -    do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, negx, 0, desc,
 +    do_fmlal(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
               get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
  }
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
      bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
      uint64_t negx = is_s ? 0x8000800080008000ull : 0;
 -    do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, negx, 0, desc,
 +    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
                   get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
  }
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
      uint32_t a32_flags = 0, a64_flags = 0;
      a32_flags |= get_float_exception_flags(&env->vfp.fp_status_a32);
 -    a32_flags |= get_float_exception_flags(&env->vfp.standard_fp_status);
 +    a32_flags |= get_float_exception_flags(&env->vfp.fp_status[FPST_STD]);
      /* FZ16 does not generate an input denormal exception.  */
      a32_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
            & ~float_flag_input_denormal_flushed);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      set_float_exception_flags(0, &env->vfp.fp_status_a64);
      set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
      set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
 -    set_float_exception_flags(0, &env->vfp.standard_fp_status);
 +    set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD_F16]);
      set_float_exception_flags(0, &env->vfp.ah_fp_status);
      set_float_exception_flags(0, &env->vfp.ah_fp_status_f16);
 --
-.25.1
+.34.1

-[PULL 15/32] MAINTAINERS: Remove myself (for raspi).
+[PULL 59/68] target/arm: Remove ah_fp_status_f16
-From: Andrew Baumann <Andrew.Baumann@microsoft.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Replace with fp_status[FPST_AH_F16].
-Message-id: MW4PR21MB1940E8BB52F4053C943B1FCD9E219@MW4PR21MB1940.namprd21.prod.outlook.com
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20250129013857.135256-10-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS | 1 -
+ target/arm/cpu.h        |  3 +--
-file changed, 1 deletion(-)
+ target/arm/cpu.c        |  2 +-
  target/arm/vfp_helper.c | 10 +++++-----
 files changed, 7 insertions(+), 8 deletions(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/target/arm/cpu.h
-+++ b/MAINTAINERS
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/palm.rst
+@@ -XXX,XX +XXX,XX @@ typedef struct NVICState NVICState;
+  * behaviour when FPCR.AH == 1: they don't update cumulative
- Raspberry Pi
+  * exception flags, they act like FPCR.{FZ,FIZ} = {1,1} and
- M: Peter Maydell <peter.maydell@linaro.org>
+  * they ignore FPCR.RMode. But they don't ignore FPCR.FZ16,
--R: Andrew Baumann <Andrew.Baumann@microsoft.com>
+- * which means we need an ah_fp_status_f16 as well.
- R: Philippe Mathieu-Daudé <f4bug@amsat.org>
++ * which means we need an FPST_AH_F16 as well.
- L: qemu-arm@nongnu.org
+  *
- S: Odd Fixes
+  * To avoid having to transfer exception bits around, we simply
   * say that the FPSCR cumulative exception flags are the logical
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
                  float_status fp_status_f16_a32;
                  float_status fp_status_f16_a64;
                  float_status ah_fp_status;
 -                float_status ah_fp_status_f16;
              };
          };
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
      arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status);
      set_flush_to_zero(1, &env->vfp.ah_fp_status);
      set_flush_inputs_to_zero(1, &env->vfp.ah_fp_status);
 -    arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status_f16);
 +    arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_AH_F16]);
  #ifndef CONFIG_USER_ONLY
      if (kvm_enabled()) {
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
      a64_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
            & ~(float_flag_input_denormal_flushed | float_flag_input_denormal_used));
      /*
 -     * We do not merge in flags from ah_fp_status or ah_fp_status_f16, because
 +     * We do not merge in flags from ah_fp_status or FPST_AH_F16, because
       * they are used for insns that must not set the cumulative exception bits.
       */
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD_F16]);
      set_float_exception_flags(0, &env->vfp.ah_fp_status);
 -    set_float_exception_flags(0, &env->vfp.ah_fp_status_f16);
 +    set_float_exception_flags(0, &env->vfp.fp_status[FPST_AH_F16]);
  }
  static void vfp_sync_and_clear_float_status_exc_flags(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
 -        set_flush_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
 +        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_AH_F16]);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
 -        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
 +        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_AH_F16]);
      }
      if (changed & FPCR_FZ) {
          bool ftz_enabled = val & FPCR_FZ;
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
          set_default_nan_mode(dnan_enabled, &env->vfp.ah_fp_status);
 -        set_default_nan_mode(dnan_enabled, &env->vfp.ah_fp_status_f16);
 +        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_AH_F16]);
      }
      if (changed & FPCR_AH) {
          bool ah_enabled = val & FPCR_AH;
 --
-.25.1
+.34.1

-[PULL 14/32] MAINTAINERS: Add an entry for Xilinx Versal OSPI
+[PULL 60/68] target/arm: Remove ah_fp_status
-From: Francisco Iglesias <francisco.iglesias@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-List myself as maintainer for the Xilinx Versal OSPI controller.
+Replace with fp_status[FPST_AH].
-Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250129013857.135256-11-richard.henderson@linaro.org
 Message-id: 20220121161141.14389-11-francisco.iglesias@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS | 6 ++++++
+ target/arm/cpu.h        | 3 +--
-file changed, 6 insertions(+)
+ target/arm/cpu.c        | 6 +++---
  target/arm/vfp_helper.c | 6 +++---
 files changed, 7 insertions(+), 8 deletions(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/target/arm/cpu.h
-+++ b/MAINTAINERS
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ F: hw/display/dpcd.c
+@@ -XXX,XX +XXX,XX @@ typedef struct NVICState NVICState;
- F: include/hw/display/dpcd.h
+  * the "standard FPSCR" tracks the FPSCR.FZ16 bit rather than
- F: docs/system/arm/xlnx-versal-virt.rst
+  * using a fixed value for it.
+  *
-+Xilinx Versal OSPI
+- * The ah_fp_status is needed because some insns have different
-+M: Francisco Iglesias <francisco.iglesias@xilinx.com>
++ * FPST_AH is needed because some insns have different
-+S: Maintained
+  * behaviour when FPCR.AH == 1: they don't update cumulative
-+F: hw/ssi/xlnx-versal-ospi.c
+  * exception flags, they act like FPCR.{FZ,FIZ} = {1,1} and
-+F: include/hw/ssi/xlnx-versal-ospi.h
+  * they ignore FPCR.RMode. But they don't ignore FPCR.FZ16,
-+
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
- ARM ACPI Subsystem
+                 float_status fp_status_a64;
- M: Shannon Zhao <shannon.zhaosl@gmail.com>
+                 float_status fp_status_f16_a32;
- L: qemu-arm@nongnu.org
+                 float_status fp_status_f16_a64;
 -                float_status ah_fp_status;
              };
          };
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
      arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD_F16]);
 -    arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status);
 -    set_flush_to_zero(1, &env->vfp.ah_fp_status);
 -    set_flush_inputs_to_zero(1, &env->vfp.ah_fp_status);
 +    arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_AH]);
 +    set_flush_to_zero(1, &env->vfp.fp_status[FPST_AH]);
 +    set_flush_inputs_to_zero(1, &env->vfp.fp_status[FPST_AH]);
      arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_AH_F16]);
  #ifndef CONFIG_USER_ONLY
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
      a64_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
            & ~(float_flag_input_denormal_flushed | float_flag_input_denormal_used));
      /*
 -     * We do not merge in flags from ah_fp_status or FPST_AH_F16, because
 +     * We do not merge in flags from FPST_AH or FPST_AH_F16, because
       * they are used for insns that must not set the cumulative exception bits.
       */
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD_F16]);
 -    set_float_exception_flags(0, &env->vfp.ah_fp_status);
 +    set_float_exception_flags(0, &env->vfp.fp_status[FPST_AH]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_AH_F16]);
  }
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
 -        set_default_nan_mode(dnan_enabled, &env->vfp.ah_fp_status);
 +        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_AH]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_AH_F16]);
      }
      if (changed & FPCR_AH) {
 --
-.25.1
+.34.1

-[PULL 13/32] hw/arm/xlnx-versal-virt: Connect mt35xu01g flashes to the OSPI
+[PULL 61/68] target/arm: Remove fp_status_f16_a64
-From: Francisco Iglesias <francisco.iglesias@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Connect Micron Xccela mt35xu01g flashes to the OSPI flash memory
+Replace with fp_status[FPST_A64_F16].
 controller.
-Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20250129013857.135256-12-richard.henderson@linaro.org
 Message-id: 20220121161141.14389-10-francisco.iglesias@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/xlnx-versal-virt.c | 23 +++++++++++++++++++++++
+ target/arm/cpu.h            |  1 -
-file changed, 23 insertions(+)
+ target/arm/cpu.c            |  2 +-
  target/arm/tcg/sme_helper.c |  2 +-
  target/arm/tcg/vec_helper.c |  9 ++++-----
  target/arm/vfp_helper.c     | 16 ++++++++--------
 files changed, 14 insertions(+), 16 deletions(-)
-diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-versal-virt.c
+--- a/target/arm/cpu.h
-+++ b/hw/arm/xlnx-versal-virt.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
- #define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("xlnx-versal-virt")
+                 float_status fp_status_a32;
- OBJECT_DECLARE_SIMPLE_TYPE(VersalVirt, XLNX_VERSAL_VIRT_MACHINE)
+                 float_status fp_status_a64;
+                 float_status fp_status_f16_a32;
-+#define XLNX_VERSAL_NUM_OSPI_FLASH 4
+-                float_status fp_status_f16_a64;
-+
+             };
- struct VersalVirt {
+         };
-     MachineState parent_obj;
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
+index XXXXXXX..XXXXXXX 100644
-             exit(EXIT_FAILURE);
+--- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
      arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
 -    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
 +    arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64_F16]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD_F16]);
      arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_AH]);
      set_flush_to_zero(1, &env->vfp.fp_status[FPST_AH]);
 diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/sme_helper.c
 +++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
       * produces default NaNs. We also need a second copy of fp_status with
       * round-to-odd -- see above.
       */
 -    fpst_f16 = env->vfp.fp_status_f16_a64;
 +    fpst_f16 = env->vfp.fp_status[FPST_A64_F16];
      fpst_std = env->vfp.fp_status_a64;
      set_default_nan_mode(true, &fpst_std);
      set_default_nan_mode(true, &fpst_f16);
 diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/vec_helper.c
 +++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
          }
      }
-+
+     do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, negx, negf, desc,
-+    for (i = 0; i < XLNX_VERSAL_NUM_OSPI_FLASH; i++) {
+-             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
-+        BusState *spi_bus;
++             get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]));
 +        DeviceState *flash_dev;
 +        qemu_irq cs_line;
 +        DriveInfo *dinfo = drive_get(IF_MTD, 0, i);
 +
 +        spi_bus = qdev_get_child_bus(DEVICE(&s->soc.pmc.iou.ospi), "spi0");
 +
 +        flash_dev = qdev_new("mt35xu01g");
 +        if (dinfo) {
 +            qdev_prop_set_drive_err(flash_dev, "drive",
 +                                    blk_by_legacy_dinfo(dinfo), &error_fatal);
 +        }
 +        qdev_realize_and_unref(flash_dev, spi_bus, &error_fatal);
 +
 +        cs_line = qdev_get_gpio_in_named(flash_dev, SSI_GPIO_CS, 0);
 +
 +        sysbus_connect_irq(SYS_BUS_DEVICE(&s->soc.pmc.iou.ospi),
 +                           i + 1, cs_line);
 +    }
  }
- static void versal_virt_machine_instance_init(Object *obj)
+ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
      bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
      intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
      float_status *status = &env->vfp.fp_status_a64;
 -    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
 +    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]);
      int negx = 0, negf = 0;
      if (is_s) {
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
          }
      }
      do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, negx, negf, desc,
 -                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
 +                 get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]));
  }
  void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
      intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
      intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
      float_status *status = &env->vfp.fp_status_a64;
 -    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
 +    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]);
      int negx = 0, negf = 0;
      if (is_s) {
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
              negx = 0x8000;
          }
      }
 -
      for (i = 0; i < oprsz; i += 16) {
          float16 mm_16 = *(float16 *)(vm + i + idx);
          float32 mm = float16_to_float32_by_bits(mm_16, fz16);
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
            & ~float_flag_input_denormal_flushed);
      a64_flags |= get_float_exception_flags(&env->vfp.fp_status_a64);
 -    a64_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
 +    a64_flags |= (get_float_exception_flags(&env->vfp.fp_status[FPST_A64_F16])
            & ~(float_flag_input_denormal_flushed | float_flag_input_denormal_used));
      /*
       * We do not merge in flags from FPST_AH or FPST_AH_F16, because
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      set_float_exception_flags(0, &env->vfp.fp_status_a32);
      set_float_exception_flags(0, &env->vfp.fp_status_a64);
      set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
 -    set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
 +    set_float_exception_flags(0, &env->vfp.fp_status[FPST_A64_F16]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD_F16]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_AH]);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          set_float_rounding_mode(i, &env->vfp.fp_status_a32);
          set_float_rounding_mode(i, &env->vfp.fp_status_a64);
          set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
 -        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a64);
 +        set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A64_F16]);
      }
      if (changed & FPCR_FZ16) {
          bool ftz_enabled = val & FPCR_FZ16;
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
 -        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
 +        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A64_F16]);
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_AH_F16]);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
 -        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
 +        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A64_F16]);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_AH_F16]);
      }
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
 -        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
 +        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A64_F16]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_AH]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_AH_F16]);
      }
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          if (ah_enabled) {
              /* Change behaviours for A64 FP operations */
              arm_set_ah_fp_behaviours(&env->vfp.fp_status_a64);
 -            arm_set_ah_fp_behaviours(&env->vfp.fp_status_f16_a64);
 +            arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_A64_F16]);
          } else {
              arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
 -            arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
 +            arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64_F16]);
          }
      }
      /*
 --
-.25.1
+.34.1

-[PULL 09/32] hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method
+[PULL 62/68] target/arm: Remove fp_status_f16_a32
-From: Francisco Iglesias <francisco.iglesias@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-An option on real hardware when embedding a DMA engine into a peripheral
+Replace with fp_status[FPST_A32_F16].
 is to make the peripheral control the engine through a custom DMA control
 (hardware) interface between the two. Software drivers in this scenario
 configure and trigger DMA operations through the controlling peripheral's
 register API (for example, writing a specific bit in a register could
 propagate down to a transfer start signal on the DMA control interface).
 At the same time the status, results and interrupts for the transfer might
 still be intended to be read and caught through the DMA engine's register
 API (and signals).
-This patch adds a class 'read' method for allowing to start read transfers
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-from peripherals embedding and controlling the Xilinx CSU DMA engine as in
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-above scenario.
+Message-id: 20250129013857.135256-13-richard.henderson@linaro.org
 Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
 Reviewed-by: Luc Michel <luc@lmichel.fr>
 Message-id: 20220121161141.14389-6-francisco.iglesias@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/dma/xlnx_csu_dma.h | 19 +++++++++++++++++--
+ target/arm/cpu.h            |  1 -
- hw/dma/xlnx_csu_dma.c         | 17 +++++++++++++++++
+ target/arm/cpu.c            |  2 +-
-files changed, 34 insertions(+), 2 deletions(-)
+ target/arm/tcg/vec_helper.c |  4 ++--
  target/arm/vfp_helper.c     | 14 +++++++-------
 files changed, 10 insertions(+), 11 deletions(-)
-diff --git a/include/hw/dma/xlnx_csu_dma.h b/include/hw/dma/xlnx_csu_dma.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/dma/xlnx_csu_dma.h
+--- a/target/arm/cpu.h
-+++ b/include/hw/dma/xlnx_csu_dma.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct XlnxCSUDMA {
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-     RegisterInfo regs_info[XLNX_CSU_DMA_R_MAX];
+             struct {
- } XlnxCSUDMA;
+                 float_status fp_status_a32;
+                 float_status fp_status_a64;
--#define XLNX_CSU_DMA(obj) \
+-                float_status fp_status_f16_a32;
--    OBJECT_CHECK(XlnxCSUDMA, (obj), TYPE_XLNX_CSU_DMA)
+             };
-+OBJECT_DECLARE_TYPE(XlnxCSUDMA, XlnxCSUDMAClass, XLNX_CSU_DMA)
+         };
-+
-+struct XlnxCSUDMAClass {
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 +    SysBusDeviceClass parent_class;
 +
 +    /*
 +     * read: Start a read transfer on a Xilinx CSU DMA engine
 +     *
 +     * @s: the Xilinx CSU DMA engine to start the transfer on
 +     * @addr: the address to read
 +     * @len: the number of bytes to read at 'addr'
 +     *
 +     * @return a MemTxResult indicating whether the operation succeeded ('len'
 +     * bytes were read) or failed.
 +     */
 +    MemTxResult (*read)(XlnxCSUDMA *s, hwaddr addr, uint32_t len);
 +};
  #endif
 diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xlnx_csu_dma.c
+--- a/target/arm/cpu.c
-+++ b/hw/dma/xlnx_csu_dma.c
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t addr_msb_pre_write(RegisterInfo *reg, uint64_t val)
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
-     return val & R_ADDR_MSB_ADDR_MSB_MASK;
+     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD]);
 -    arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
 +    arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A32_F16]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64_F16]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD_F16]);
      arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_AH]);
 diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/vec_helper.c
 +++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
      uint64_t negx = is_s ? 0x8000800080008000ull : 0;
      do_fmlal(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
 -             get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
 +             get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A32_F16]));
  }
-+static MemTxResult xlnx_csu_dma_class_read(XlnxCSUDMA *s, hwaddr addr,
+ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
-+                                           uint32_t len)
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
-+{
+     uint64_t negx = is_s ? 0x8000800080008000ull : 0;
-+    RegisterInfo *reg = &s->regs_info[R_SIZE];
-+    uint64_t we = MAKE_64BIT_MASK(0, 4 * 8);
+     do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
-+
+-                 get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
-+    s->regs[R_ADDR] = addr;
++                 get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A32_F16]));
 +    s->regs[R_ADDR_MSB] = (uint64_t)addr >> 32;
 +
 +    register_write(reg, len, we, object_get_typename(OBJECT(s)), false);
 +
 +    return (s->regs[R_SIZE] == 0) ? MEMTX_OK : MEMTX_ERROR;
 +}
 +
  static const RegisterAccessInfo *xlnx_csu_dma_regs_info[] = {
  #define DMACH_REGINFO(NAME, snd)                                              \
      (const RegisterAccessInfo []) {                                           \
@@ -XXX,XX +XXX,XX @@ static void xlnx_csu_dma_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
      StreamSinkClass *ssc = STREAM_SINK_CLASS(klass);
 +    XlnxCSUDMAClass *xcdc = XLNX_CSU_DMA_CLASS(klass);
      dc->reset = xlnx_csu_dma_reset;
      dc->realize = xlnx_csu_dma_realize;
@@ -XXX,XX +XXX,XX @@ static void xlnx_csu_dma_class_init(ObjectClass *klass, void *data)
      ssc->push = xlnx_csu_dma_stream_push;
      ssc->can_push = xlnx_csu_dma_stream_can_push;
 +
 +    xcdc->read = xlnx_csu_dma_class_read;
  }
- static void xlnx_csu_dma_init(Object *obj)
+ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
      a32_flags |= get_float_exception_flags(&env->vfp.fp_status_a32);
      a32_flags |= get_float_exception_flags(&env->vfp.fp_status[FPST_STD]);
      /* FZ16 does not generate an input denormal exception.  */
 -    a32_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
 +    a32_flags |= (get_float_exception_flags(&env->vfp.fp_status[FPST_A32_F16])
            & ~float_flag_input_denormal_flushed);
      a32_flags |= (get_float_exception_flags(&env->vfp.fp_status[FPST_STD_F16])
            & ~float_flag_input_denormal_flushed);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
       */
      set_float_exception_flags(0, &env->vfp.fp_status_a32);
      set_float_exception_flags(0, &env->vfp.fp_status_a64);
 -    set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
 +    set_float_exception_flags(0, &env->vfp.fp_status[FPST_A32_F16]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_A64_F16]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD_F16]);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          }
          set_float_rounding_mode(i, &env->vfp.fp_status_a32);
          set_float_rounding_mode(i, &env->vfp.fp_status_a64);
 -        set_float_rounding_mode(i, &env->vfp.fp_status_f16_a32);
 +        set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A32_F16]);
          set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A64_F16]);
      }
      if (changed & FPCR_FZ16) {
          bool ftz_enabled = val & FPCR_FZ16;
 -        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
 +        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A32_F16]);
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A64_F16]);
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_AH_F16]);
 -        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
 +        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A32_F16]);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A64_F16]);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_AH_F16]);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          bool dnan_enabled = val & FPCR_DN;
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
 -        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
 +        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A32_F16]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A64_F16]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_AH]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_AH_F16]);
@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
      softfloat_to_vfp_compare(env, \
          FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
  }
 -DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status_f16_a32)
 +DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status[FPST_A32_F16])
  DO_VFP_cmp(s, float32, float32, fp_status_a32)
  DO_VFP_cmp(d, float64, float64, fp_status_a32)
  #undef DO_VFP_cmp
 --
-.25.1
+.34.1

-[PULL 08/32] include/hw/dma/xlnx_csu_dma: Add in missing includes in the header
+[PULL 63/68] target/arm: Remove fp_status_a64
-From: Francisco Iglesias <francisco.iglesias@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add in the missing includes in the header for being able to build the DMA
+Replace with fp_status[FPST_A64].
 model when reusing it.
-Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Luc Michel <luc@lmichel.fr>
+Message-id: 20250129013857.135256-14-richard.henderson@linaro.org
 Message-id: 20220121161141.14389-5-francisco.iglesias@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/dma/xlnx_csu_dma.h | 5 +++++
+ target/arm/cpu.h            |  1 -
-file changed, 5 insertions(+)
+ target/arm/cpu.c            |  2 +-
  target/arm/tcg/sme_helper.c |  2 +-
  target/arm/tcg/vec_helper.c | 10 +++++-----
  target/arm/vfp_helper.c     | 16 ++++++++--------
 files changed, 15 insertions(+), 16 deletions(-)
-diff --git a/include/hw/dma/xlnx_csu_dma.h b/include/hw/dma/xlnx_csu_dma.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/dma/xlnx_csu_dma.h
+--- a/target/arm/cpu.h
-+++ b/include/hw/dma/xlnx_csu_dma.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
- #ifndef XLNX_CSU_DMA_H
+             float_status fp_status[FPST_COUNT];
- #define XLNX_CSU_DMA_H
+             struct {
+                 float_status fp_status_a32;
-+#include "hw/sysbus.h"
+-                float_status fp_status_a64;
-+#include "hw/register.h"
+             };
-+#include "hw/ptimer.h"
+         };
-+#include "hw/stream.h"
-+
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
- #define TYPE_XLNX_CSU_DMA "xlnx.csu_dma"
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
- #define XLNX_CSU_DMA_R_MAX (0x2c / 4)
++++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
      set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD]);
      set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD_F16]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
 -    arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
 +    arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A32_F16]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64_F16]);
 diff --git a/target/arm/tcg/sme_helper.c b/target/arm/tcg/sme_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/sme_helper.c
 +++ b/target/arm/tcg/sme_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sme_fmopa_h)(void *vza, void *vzn, void *vzm, void *vpn,
       * round-to-odd -- see above.
       */
      fpst_f16 = env->vfp.fp_status[FPST_A64_F16];
 -    fpst_std = env->vfp.fp_status_a64;
 +    fpst_std = env->vfp.fp_status[FPST_A64];
      set_default_nan_mode(true, &fpst_std);
      set_default_nan_mode(true, &fpst_f16);
      fpst_odd = fpst_std;
 diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/vec_helper.c
 +++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
              negx = 0x8000800080008000ull;
          }
      }
 -    do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, negx, negf, desc,
 +    do_fmlal(vd, vn, vm, &env->vfp.fp_status[FPST_A64], negx, negf, desc,
               get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]));
  }
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
      intptr_t i, oprsz = simd_oprsz(desc);
      bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
      intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
 -    float_status *status = &env->vfp.fp_status_a64;
 +    float_status *status = &env->vfp.fp_status[FPST_A64];
      bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]);
      int negx = 0, negf = 0;
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
              negx = 0x8000800080008000ull;
          }
      }
 -    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, negx, negf, desc,
 +    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status[FPST_A64], negx, negf, desc,
                   get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]));
  }
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
      bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
      intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
      intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
 -    float_status *status = &env->vfp.fp_status_a64;
 +    float_status *status = &env->vfp.fp_status[FPST_A64];
      bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]);
      int negx = 0, negf = 0;
@@ -XXX,XX +XXX,XX @@ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp)
       */
      bool ebf = is_a64(env) && env->vfp.fpcr & FPCR_EBF;
 -    *statusp = is_a64(env) ? env->vfp.fp_status_a64 : env->vfp.fp_status_a32;
 +    *statusp = is_a64(env) ? env->vfp.fp_status[FPST_A64] : env->vfp.fp_status_a32;
      set_default_nan_mode(true, statusp);
      if (ebf) {
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
      a32_flags |= (get_float_exception_flags(&env->vfp.fp_status[FPST_STD_F16])
            & ~float_flag_input_denormal_flushed);
 -    a64_flags |= get_float_exception_flags(&env->vfp.fp_status_a64);
 +    a64_flags |= get_float_exception_flags(&env->vfp.fp_status[FPST_A64]);
      a64_flags |= (get_float_exception_flags(&env->vfp.fp_status[FPST_A64_F16])
            & ~(float_flag_input_denormal_flushed | float_flag_input_denormal_used));
      /*
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
       * be the architecturally up-to-date exception flag information first.
       */
      set_float_exception_flags(0, &env->vfp.fp_status_a32);
 -    set_float_exception_flags(0, &env->vfp.fp_status_a64);
 +    set_float_exception_flags(0, &env->vfp.fp_status[FPST_A64]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_A32_F16]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_A64_F16]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD]);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
              break;
          }
          set_float_rounding_mode(i, &env->vfp.fp_status_a32);
 -        set_float_rounding_mode(i, &env->vfp.fp_status_a64);
 +        set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A64]);
          set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A32_F16]);
          set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A64_F16]);
      }
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
      if (changed & FPCR_FZ) {
          bool ftz_enabled = val & FPCR_FZ;
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
 -        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
 +        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A64]);
          /* FIZ is A64 only so FZ always makes A32 code flush inputs to zero */
          set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
      }
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
           */
          bool fitz_enabled = (val & FPCR_FIZ) ||
              (val & (FPCR_FZ | FPCR_AH)) == FPCR_FZ;
 -        set_flush_inputs_to_zero(fitz_enabled, &env->vfp.fp_status_a64);
 +        set_flush_inputs_to_zero(fitz_enabled, &env->vfp.fp_status[FPST_A64]);
      }
      if (changed & FPCR_DN) {
          bool dnan_enabled = val & FPCR_DN;
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
 -        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
 +        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A64]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A32_F16]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A64_F16]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_AH]);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
          if (ah_enabled) {
              /* Change behaviours for A64 FP operations */
 -            arm_set_ah_fp_behaviours(&env->vfp.fp_status_a64);
 +            arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_A64]);
              arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_A64_F16]);
          } else {
 -            arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
 +            arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64]);
              arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64_F16]);
          }
      }
 --
-.25.1
+.34.1

-[PULL 03/32] hw/char/exynos4210_uart: Fix crash on trying to load VM state
+[PULL 64/68] target/arm: Remove fp_status_a32
-The exynos4210_uart_post_load() function assumes that it is passed
+From: Richard Henderson <richard.henderson@linaro.org>
 the Exynos4210UartState, but it has been attached to the
 VMStateDescription for the Exynos4210UartFIFO type.  The result is a
 SIGSEGV when attempting to load VM state for any machine type
 including this device.
-Fix the bug by attaching the post-load function to the VMSD for the
+Replace with fp_status[FPST_A32].  As this was the last of the
-Exynos4210UartState.  This is the logical place for it, because the
+old structures, we can remove the anonymous union and struct.
 actions it does relate to the entire UART state, not just the FIFO.
-Thanks to the bug reporter @TrungNguyen1909 for the clear bug
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-description and the suggested fix.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20250129013857.135256-15-richard.henderson@linaro.org
 [PMM: tweak to account for change to is_ebf()]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu.h            |  7 +------
  target/arm/cpu.c            |  2 +-
  target/arm/tcg/vec_helper.c |  2 +-
  target/arm/vfp_helper.c     | 18 +++++++++---------
 files changed, 12 insertions(+), 17 deletions(-)
-Fixes: c9d3396d80fe7ece9b
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
    ("hw/char/exynos4210_uart: Implement post_load function")
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/638
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20220120151648.433736-1-peter.maydell@linaro.org
 ---
  hw/char/exynos4210_uart.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/exynos4210_uart.c
+--- a/target/arm/cpu.h
-+++ b/hw/char/exynos4210_uart.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_exynos4210_uart_fifo = {
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-     .name = "exynos4210.uart.fifo",
+         uint32_t scratch[8];
-     .version_id = 1,
-     .minimum_version_id = 1,
+         /* There are a number of distinct float control structures. */
--    .post_load = exynos4210_uart_post_load,
+-        union {
-     .fields = (VMStateField[]) {
+-            float_status fp_status[FPST_COUNT];
-         VMSTATE_UINT32(sp, Exynos4210UartFIFO),
+-            struct {
-         VMSTATE_UINT32(rp, Exynos4210UartFIFO),
+-                float_status fp_status_a32;
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_exynos4210_uart = {
+-            };
-     .name = "exynos4210.uart",
+-        };
-     .version_id = 1,
++        float_status fp_status[FPST_COUNT];
-     .minimum_version_id = 1,
-+    .post_load = exynos4210_uart_post_load,
+         uint64_t zcr_el[4];   /* ZCR_EL[1-3] */
-     .fields = (VMStateField[]) {
+         uint64_t smcr_el[4];  /* SMCR_EL[1-3] */
-         VMSTATE_STRUCT(rx, Exynos4210UartState, 1,
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-                        vmstate_exynos4210_uart_fifo, Exynos4210UartFIFO),
+index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
      set_flush_inputs_to_zero(1, &env->vfp.fp_status[FPST_STD]);
      set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD]);
      set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD_F16]);
 -    arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
 +    arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A32]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD]);
      arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A32_F16]);
 diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/vec_helper.c
 +++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp)
       */
      bool ebf = is_a64(env) && env->vfp.fpcr & FPCR_EBF;
 -    *statusp = is_a64(env) ? env->vfp.fp_status[FPST_A64] : env->vfp.fp_status_a32;
 +    *statusp = env->vfp.fp_status[is_a64(env) ? FPST_A64 : FPST_A32];
      set_default_nan_mode(true, statusp);
      if (ebf) {
 diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/vfp_helper.c
 +++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
  {
      uint32_t a32_flags = 0, a64_flags = 0;
 -    a32_flags |= get_float_exception_flags(&env->vfp.fp_status_a32);
 +    a32_flags |= get_float_exception_flags(&env->vfp.fp_status[FPST_A32]);
      a32_flags |= get_float_exception_flags(&env->vfp.fp_status[FPST_STD]);
      /* FZ16 does not generate an input denormal exception.  */
      a32_flags |= (get_float_exception_flags(&env->vfp.fp_status[FPST_A32_F16])
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
       * values. The caller should have arranged for env->vfp.fpsr to
       * be the architecturally up-to-date exception flag information first.
       */
 -    set_float_exception_flags(0, &env->vfp.fp_status_a32);
 +    set_float_exception_flags(0, &env->vfp.fp_status[FPST_A32]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_A64]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_A32_F16]);
      set_float_exception_flags(0, &env->vfp.fp_status[FPST_A64_F16]);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
              i = float_round_to_zero;
              break;
          }
 -        set_float_rounding_mode(i, &env->vfp.fp_status_a32);
 +        set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A32]);
          set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A64]);
          set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A32_F16]);
          set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A64_F16]);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
      }
      if (changed & FPCR_FZ) {
          bool ftz_enabled = val & FPCR_FZ;
 -        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
 +        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A32]);
          set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A64]);
          /* FIZ is A64 only so FZ always makes A32 code flush inputs to zero */
 -        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
 +        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A32]);
      }
      if (changed & (FPCR_FZ | FPCR_AH | FPCR_FIZ)) {
          /*
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
      }
      if (changed & FPCR_DN) {
          bool dnan_enabled = val & FPCR_DN;
 -        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
 +        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A32]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A64]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A32_F16]);
          set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A64_F16]);
@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
          FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
  }
  DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status[FPST_A32_F16])
 -DO_VFP_cmp(s, float32, float32, fp_status_a32)
 -DO_VFP_cmp(d, float64, float64, fp_status_a32)
 +DO_VFP_cmp(s, float32, float32, fp_status[FPST_A32])
 +DO_VFP_cmp(d, float64, float64, fp_status[FPST_A32])
  #undef DO_VFP_cmp
  /* Integer to float and float to integer conversions */
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(fjcvtzs)(float64 value, float_status *status)
  uint32_t HELPER(vjcvt)(float64 value, CPUARMState *env)
  {
 -    uint64_t pair = HELPER(fjcvtzs)(value, &env->vfp.fp_status_a32);
 +    uint64_t pair = HELPER(fjcvtzs)(value, &env->vfp.fp_status[FPST_A32]);
      uint32_t result = pair;
      uint32_t z = (pair >> 32) == 0;
 --
-.25.1
+.34.1

-[PULL 02/32] hw/armv7m: Fix broken VMStateDescription
+[PULL 65/68] target/arm: Simplify fp_status indexing in mve_helper.c
-In commit d5093d961585f02 we added a VMStateDescription to
+From: Richard Henderson <richard.henderson@linaro.org>
 the TYPE_ARMV7M object, to handle migration of its Clocks.
 However a cut-and-paste error meant we used the wrong struct
 name in the VMSTATE_CLOCK() macro arguments. The result was
 that attempting a 'savevm' might result in an assertion
 failure.
-Cc: qemu-stable@nongnu.org
+Select on index instead of pointer.
-Buglink: https://gitlab.com/qemu-project/qemu/-/issues/803
+No functional change.
-Fixes: d5093d961585f02
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20250129013857.135256-16-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Ani Sinha <ani@anisinha.ca>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20220120151609.433555-1-peter.maydell@linaro.org
 ---
- hw/arm/armv7m.c | 4 ++--
+ target/arm/tcg/mve_helper.c | 40 +++++++++++++------------------------
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 14 insertions(+), 26 deletions(-)
-diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
+diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/armv7m.c
+--- a/target/arm/tcg/mve_helper.c
-+++ b/hw/arm/armv7m.c
++++ b/target/arm/tcg/mve_helper.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_armv7m = {
+@@ -XXX,XX +XXX,XX @@ DO_VMAXMINA(vminaw, 4, int32_t, uint32_t, DO_MIN)
-     .version_id = 1,
+             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
-     .minimum_version_id = 1,
+                 continue;                                               \
-     .fields = (VMStateField[]) {
+             }                                                           \
--        VMSTATE_CLOCK(refclk, SysTickState),
+-            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
--        VMSTATE_CLOCK(cpuclk, SysTickState),
+-                &env->vfp.fp_status[FPST_STD];                           \
-+        VMSTATE_CLOCK(refclk, ARMv7MState),
++            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
-+        VMSTATE_CLOCK(cpuclk, ARMv7MState),
+             if (!(mask & 1)) {                                          \
-         VMSTATE_END_OF_LIST()
+                 /* We need the result but without updating flags */     \
-     }
+                 scratch_fpst = *fpst;                                   \
- };
+@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ALL(vminnma, minnuma)
                  r[e] = 0;                                               \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.fp_status[FPST_STD];                           \
 +            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
              if (!(tm & 1)) {                                            \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCADD_FP(vfcadd270s, 4, float32, float32_add, float32_sub)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.fp_status[FPST_STD];                           \
 +            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VFMA(vfmss, 4, float32, true)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE * 2)) == 0) {          \
                  continue;                                               \
              }                                                           \
 -            fpst0 = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :  \
 -                &env->vfp.fp_status[FPST_STD];                           \
 +            fpst0 = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
              fpst1 = fpst0;                                              \
              if (!(mask & 1)) {                                          \
                  scratch_fpst = *fpst0;                                  \
@@ -XXX,XX +XXX,XX @@ DO_VCMLA(vcmla270s, 4, float32, 3, DO_VCMLAS)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.fp_status[FPST_STD];                           \
 +            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_SCALAR_ALL(vfmul_scalar, mul)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.fp_status[FPST_STD];                           \
 +            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ACC_SCALAR(vfmas_scalars, 4, float32, DO_VFMAS_SCALARS)
          unsigned e;                                             \
          TYPE *m = vm;                                           \
          TYPE ra = (TYPE)ra_in;                                  \
 -        float_status *fpst = (ESIZE == 2) ?                     \
 -            &env->vfp.fp_status[FPST_STD_F16] :                 \
 -            &env->vfp.fp_status[FPST_STD];                       \
 +        float_status *fpst =                                    \
 +            &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
          for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {      \
              if (mask & 1) {                                     \
                  TYPE v = m[H##ESIZE(e)];                        \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
              if ((mask & emask) == 0) {                                  \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.fp_status[FPST_STD];                           \
 +            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
              if (!(mask & (1 << (e * ESIZE)))) {                         \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
              if ((mask & emask) == 0) {                                  \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.fp_status[FPST_STD];                           \
 +            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
              if (!(mask & (1 << (e * ESIZE)))) {                         \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCMP_FP_BOTH(vfcmples, vfcmple_scalars, 4, float32, !DO_GT32)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.fp_status[FPST_STD];                           \
 +            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCVT_FIXED(vcvt_fu, 4, uint32_t, helper_vfp_touls_round_to_zero)
          unsigned e;                                                     \
          float_status *fpst;                                             \
          float_status scratch_fpst;                                      \
 -        float_status *base_fpst = (ESIZE == 2) ?                        \
 -            &env->vfp.fp_status[FPST_STD_F16] :                         \
 -            &env->vfp.fp_status[FPST_STD];                               \
 +        float_status *base_fpst =                                       \
 +            &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD];  \
          uint32_t prev_rmode = get_float_rounding_mode(base_fpst);       \
          set_float_rounding_mode(rmode, base_fpst);                      \
          for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {              \
@@ -XXX,XX +XXX,XX @@ void HELPER(mve_vcvtt_hs)(CPUARMState *env, void *vd, void *vm)
              if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                  continue;                                               \
              }                                                           \
 -            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
 -                &env->vfp.fp_status[FPST_STD];                           \
 +            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
              if (!(mask & 1)) {                                          \
                  /* We need the result but without updating flags */     \
                  scratch_fpst = *fpst;                                   \
 --
-.25.1
+.34.1

-[PULL 23/32] hw/intc/arm_gicv3_its: Sort ITS command list into numeric order
+[PULL 66/68] target/arm: Simplify DO_VFP_cmp in vfp_helper.c
-The list of #defines for the ITS command packet numbers is neither
+From: Richard Henderson <richard.henderson@linaro.org>
 in alphabetical nor numeric order. Sort it into numeric order.
+Pass ARMFPStatusFlavour index instead of fp_status[FOO].
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-id: 20250129013857.135256-17-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220122182444.724087-8-peter.maydell@linaro.org
 ---
- hw/intc/gicv3_internal.h | 10 +++++-----
+ target/arm/vfp_helper.c | 10 +++++-----
 file changed, 5 insertions(+), 5 deletions(-)
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
+diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/target/arm/vfp_helper.c
-+++ b/hw/intc/gicv3_internal.h
++++ b/target/arm/vfp_helper.c
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
+@@ -XXX,XX +XXX,XX @@ static void softfloat_to_vfp_compare(CPUARMState *env, FloatRelation cmp)
- #define CMD_MASK                  0xff
+ void VFP_HELPER(cmp, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env)  \
+ { \
- /* ITS Commands */
+     softfloat_to_vfp_compare(env, \
--#define GITS_CMD_CLEAR            0x04
+-        FLOATTYPE ## _compare_quiet(a, b, &env->vfp.FPST)); \
--#define GITS_CMD_DISCARD          0x0F
++        FLOATTYPE ## _compare_quiet(a, b, &env->vfp.fp_status[FPST])); \
- #define GITS_CMD_INT              0x03
+ } \
--#define GITS_CMD_MAPC             0x09
+ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
-+#define GITS_CMD_CLEAR            0x04
+ { \
-+#define GITS_CMD_SYNC             0x05
+     softfloat_to_vfp_compare(env, \
- #define GITS_CMD_MAPD             0x08
+-        FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
--#define GITS_CMD_MAPI             0x0B
++        FLOATTYPE ## _compare(a, b, &env->vfp.fp_status[FPST])); \
-+#define GITS_CMD_MAPC             0x09
+ }
- #define GITS_CMD_MAPTI            0x0A
+-DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status[FPST_A32_F16])
-+#define GITS_CMD_MAPI             0x0B
+-DO_VFP_cmp(s, float32, float32, fp_status[FPST_A32])
- #define GITS_CMD_INV              0x0C
+-DO_VFP_cmp(d, float64, float64, fp_status[FPST_A32])
- #define GITS_CMD_INVALL           0x0D
++DO_VFP_cmp(h, float16, dh_ctype_f16, FPST_A32_F16)
--#define GITS_CMD_SYNC             0x05
++DO_VFP_cmp(s, float32, float32, FPST_A32)
-+#define GITS_CMD_DISCARD          0x0F
++DO_VFP_cmp(d, float64, float64, FPST_A32)
+ #undef DO_VFP_cmp
- /* MAPC command fields */
- #define ICID_LENGTH                  16
+ /* Integer to float and float to integer conversions */
 --
-.25.1
+.34.1

-[PULL 07/32] hw/arm/xlnx-versal: Connect Versal's PMC SLCR
+[PULL 67/68] target/arm: Read fz16 from env->vfp.fpcr
-From: Francisco Iglesias <francisco.iglesias@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Connect Versal's PMC SLCR (system-level control registers) model.
+Read the bit from the source, rather than from the proxy via
 get_flush_inputs_to_zero.  This makes it clear that it does
 not matter which of the float_status structures is used.
-Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Luc Michel <luc@lmichel.fr>
+Message-id: 20250129013857.135256-34-richard.henderson@linaro.org
-Message-id: 20220121161141.14389-4-francisco.iglesias@xilinx.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/xlnx-versal.h |  5 +++
+ target/arm/tcg/vec_helper.c | 12 ++++++------
- hw/arm/xlnx-versal.c         | 71 +++++++++++++++++++++++++++++++++++-
+file changed, 6 insertions(+), 6 deletions(-)
 files changed, 75 insertions(+), 1 deletion(-)
-diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
+--- a/target/arm/tcg/vec_helper.c
-+++ b/include/hw/arm/xlnx-versal.h
++++ b/target/arm/tcg/vec_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
- #include "hw/misc/xlnx-versal-xramc.h"
+     uint64_t negx = is_s ? 0x8000800080008000ull : 0;
- #include "hw/nvram/xlnx-bbram.h"
- #include "hw/nvram/xlnx-versal-efuse.h"
+     do_fmlal(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
-+#include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
+-             get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A32_F16]));
++             env->vfp.fpcr & FPCR_FZ16);
  #define TYPE_XLNX_VERSAL "xlnx-versal"
  OBJECT_DECLARE_SIMPLE_TYPE(Versal, XLNX_VERSAL)
@@ -XXX,XX +XXX,XX @@ struct Versal {
      struct {
          struct {
              SDHCIState sd[XLNX_VERSAL_NR_SDS];
 +            XlnxVersalPmcIouSlcr slcr;
          } iou;
          XlnxZynqMPRTC rtc;
@@ -XXX,XX +XXX,XX @@ struct Versal {
  #define MM_FPD_FPD_APU              0xfd5c0000
  #define MM_FPD_FPD_APU_SIZE         0x100
 +#define MM_PMC_PMC_IOU_SLCR         0xf1060000
 +#define MM_PMC_PMC_IOU_SLCR_SIZE    0x10000
 +
  #define MM_PMC_SD0                  0xf1040000U
  #define MM_PMC_SD0_SIZE             0x10000
  #define MM_PMC_BBRAM_CTRL           0xf11f0000
 diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal.c
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
  #include "kvm_arm.h"
  #include "hw/misc/unimp.h"
  #include "hw/arm/xlnx-versal.h"
 +#include "qemu/log.h"
 +#include "hw/sysbus.h"
  #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
  #define GEM_REVISION        0x40070106
 -#define VERSAL_NUM_PMC_APB_IRQS 2
 +#define VERSAL_NUM_PMC_APB_IRQS 3
  static void versal_create_apu_cpus(Versal *s)
  {
@@ -XXX,XX +XXX,XX @@ static void versal_create_pmc_apb_irq_orgate(Versal *s, qemu_irq *pic)
       * models:
       *  - RTC
       *  - BBRAM
 +     *  - PMC SLCR
       */
      object_initialize_child(OBJECT(s), "pmc-apb-irq-orgate",
                              &s->pmc.apb_irq_orgate, TYPE_OR_IRQ);
@@ -XXX,XX +XXX,XX @@ static void versal_create_efuse(Versal *s, qemu_irq *pic)
      sysbus_connect_irq(SYS_BUS_DEVICE(ctrl), 0, pic[VERSAL_EFUSE_IRQ]);
  }
-+static void versal_create_pmc_iou_slcr(Versal *s, qemu_irq *pic)
+ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
-+{
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
-+    SysBusDevice *sbd;
+         }
-+
+     }
-+    object_initialize_child(OBJECT(s), "versal-pmc-iou-slcr", &s->pmc.iou.slcr,
+     do_fmlal(vd, vn, vm, &env->vfp.fp_status[FPST_A64], negx, negf, desc,
-+                            TYPE_XILINX_VERSAL_PMC_IOU_SLCR);
+-             get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]));
-+
++             env->vfp.fpcr & FPCR_FZ16);
 +    sbd = SYS_BUS_DEVICE(&s->pmc.iou.slcr);
 +    sysbus_realize(sbd, &error_fatal);
 +
 +    memory_region_add_subregion(&s->mr_ps, MM_PMC_PMC_IOU_SLCR,
 +                                sysbus_mmio_get_region(sbd, 0));
 +
 +    sysbus_connect_irq(sbd, 0,
 +                       qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 2));
 +}
 +
  /* This takes the board allocated linear DDR memory and creates aliases
   * for each split DDR range/aperture on the Versal address map.
   */
@@ -XXX,XX +XXX,XX @@ static void versal_unimp_area(Versal *s, const char *name,
      memory_region_add_subregion(mr, base, mr_dev);
  }
-+static void versal_unimp_sd_emmc_sel(void *opaque, int n, int level)
+ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
-+{
+@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
-+    qemu_log_mask(LOG_UNIMP,
+     bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
-+                  "Selecting between enabling SD mode or eMMC mode on "
+     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
-+                  "controller %d is not yet implemented\n", n);
+     float_status *status = &env->vfp.fp_status[FPST_A64];
-+}
+-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]);
-+
++    bool fz16 = env->vfp.fpcr & FPCR_FZ16;
-+static void versal_unimp_qspi_ospi_mux_sel(void *opaque, int n, int level)
+     int negx = 0, negf = 0;
-+{
-+    qemu_log_mask(LOG_UNIMP,
+     if (is_s) {
-+                  "Selecting between enabling the QSPI or OSPI linear address "
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
-+                  "region is not yet implemented\n");
+     uint64_t negx = is_s ? 0x8000800080008000ull : 0;
-+}
-+
+     do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
-+static void versal_unimp_irq_parity_imr(void *opaque, int n, int level)
+-                 get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A32_F16]));
-+{
++                 env->vfp.fpcr & FPCR_FZ16);
 +    qemu_log_mask(LOG_UNIMP,
 +                  "PMC SLCR parity interrupt behaviour "
 +                  "is not yet implemented\n");
 +}
 +
  static void versal_unimp(Versal *s)
  {
 +    qemu_irq gpio_in;
 +
      versal_unimp_area(s, "psm", &s->mr_ps,
                          MM_PSM_START, MM_PSM_END - MM_PSM_START);
      versal_unimp_area(s, "crl", &s->mr_ps,
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
                          MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
      versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
                          MM_IOU_SCNTRS, MM_IOU_SCNTRS_SIZE);
 +
 +    qdev_init_gpio_in_named(DEVICE(s), versal_unimp_sd_emmc_sel,
 +                            "sd-emmc-sel-dummy", 2);
 +    qdev_init_gpio_in_named(DEVICE(s), versal_unimp_qspi_ospi_mux_sel,
 +                            "qspi-ospi-mux-sel-dummy", 1);
 +    qdev_init_gpio_in_named(DEVICE(s), versal_unimp_irq_parity_imr,
 +                            "irq-parity-imr-dummy", 1);
 +
 +    gpio_in = qdev_get_gpio_in_named(DEVICE(s), "sd-emmc-sel-dummy", 0);
 +    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr), "sd-emmc-sel", 0,
 +                                gpio_in);
 +
 +    gpio_in = qdev_get_gpio_in_named(DEVICE(s), "sd-emmc-sel-dummy", 1);
 +    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr), "sd-emmc-sel", 1,
 +                                gpio_in);
 +
 +    gpio_in = qdev_get_gpio_in_named(DEVICE(s), "qspi-ospi-mux-sel-dummy", 0);
 +    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr),
 +                                "qspi-ospi-mux-sel", 0,
 +                                gpio_in);
 +
 +    gpio_in = qdev_get_gpio_in_named(DEVICE(s), "irq-parity-imr-dummy", 0);
 +    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr),
 +                                SYSBUS_DEVICE_GPIO_IRQ, 0,
 +                                gpio_in);
  }
- static void versal_realize(DeviceState *dev, Error **errp)
+ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
-@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
-     versal_create_xrams(s, pic);
+         }
-     versal_create_bbram(s, pic);
+     }
-     versal_create_efuse(s, pic);
+     do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status[FPST_A64], negx, negf, desc,
-+    versal_create_pmc_iou_slcr(s, pic);
+-                 get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]));
-     versal_map_ddr(s);
++                 env->vfp.fpcr & FPCR_FZ16);
-     versal_unimp(s);
+ }
  void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
      intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
      intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
      float_status *status = &env->vfp.fp_status[FPST_A64];
 -    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]);
 +    bool fz16 = env->vfp.fpcr & FPCR_FZ16;
      int negx = 0, negf = 0;
      if (is_s) {
 --
-.25.1
+.34.1

-[PULL 06/32] hw/arm/xlnx-versal: 'Or' the interrupts from the BBRAM and RTC models
+[PULL 68/68] target/arm: Sink fp_status and fpcr access into do_fmlal*
-From: Francisco Iglesias <francisco.iglesias@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add an orgate and 'or' the interrupts from the BBRAM and RTC models.
+Sink common code from the callers into do_fmlal
 and do_fmlal_idx.  Reorder the arguments to minimize
 the re-sorting from the caller's arguments.
-Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20250129013857.135256-35-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Luc Michel <luc@lmichel.fr>
-Message-id: 20220121161141.14389-3-francisco.iglesias@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/xlnx-versal.h |  5 +++--
+ target/arm/tcg/vec_helper.c | 28 ++++++++++++++++------------
- hw/arm/xlnx-versal-virt.c    |  2 +-
+file changed, 16 insertions(+), 12 deletions(-)
  hw/arm/xlnx-versal.c         | 28 ++++++++++++++++++++++++++--
 files changed, 30 insertions(+), 5 deletions(-)
-diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
+--- a/target/arm/tcg/vec_helper.c
-+++ b/include/hw/arm/xlnx-versal.h
++++ b/target/arm/tcg/vec_helper.c
-@@ -XXX,XX +XXX,XX @@ struct Versal {
+@@ -XXX,XX +XXX,XX @@ static uint64_t load4_f16(uint64_t *ptr, int is_q, int is_2)
-         XlnxEFuse efuse;
+  * as there is not yet SVE versions that might use blocking.
-         XlnxVersalEFuseCtrl efuse_ctrl;
+  */
-         XlnxVersalEFuseCache efuse_cache;
-+
+-static void do_fmlal(float32 *d, void *vn, void *vm, float_status *fpst,
-+        qemu_or_irq apb_irq_orgate;
+-                     uint64_t negx, int negf, uint32_t desc, bool fz16)
-     } pmc;
++static void do_fmlal(float32 *d, void *vn, void *vm,
++                     CPUARMState *env, uint32_t desc,
-     struct {
++                     ARMFPStatusFlavour fpst_idx,
-@@ -XXX,XX +XXX,XX @@ struct Versal {
++                     uint64_t negx, int negf)
  #define VERSAL_GEM1_WAKE_IRQ_0     59
  #define VERSAL_ADMA_IRQ_0          60
  #define VERSAL_XRAM_IRQ_0          79
 -#define VERSAL_BBRAM_APB_IRQ_0     121
 -#define VERSAL_RTC_APB_ERR_IRQ     121
 +#define VERSAL_PMC_APB_IRQ         121
  #define VERSAL_SD0_IRQ_0           126
  #define VERSAL_EFUSE_IRQ           139
  #define VERSAL_RTC_ALARM_IRQ       142
 diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal-virt.c
 +++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@ static void fdt_add_bbram_node(VersalVirt *s)
      qemu_fdt_add_subnode(s->fdt, name);
      qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
 -                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_BBRAM_APB_IRQ_0,
 +                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_PMC_APB_IRQ,
                             GIC_FDT_IRQ_FLAGS_LEVEL_HI);
      qemu_fdt_setprop(s->fdt, name, "interrupt-names",
                       interrupt_names, sizeof(interrupt_names));
 diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal.c
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
  #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
  #define GEM_REVISION        0x40070106
 +#define VERSAL_NUM_PMC_APB_IRQS 2
 +
  static void versal_create_apu_cpus(Versal *s)
  {
-     int i;
++    float_status *fpst = &env->vfp.fp_status[fpst_idx];
-@@ -XXX,XX +XXX,XX @@ static void versal_create_sds(Versal *s, qemu_irq *pic)
++    bool fz16 = env->vfp.fpcr & FPCR_FZ16;
      intptr_t i, oprsz = simd_oprsz(desc);
      int is_2 = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
      int is_q = oprsz == 16;
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
      bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
      uint64_t negx = is_s ? 0x8000800080008000ull : 0;
 -    do_fmlal(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
 -             env->vfp.fpcr & FPCR_FZ16);
 +    do_fmlal(vd, vn, vm, env, desc, FPST_STD, negx, 0);
  }
  void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
              negx = 0x8000800080008000ull;
          }
      }
 -    do_fmlal(vd, vn, vm, &env->vfp.fp_status[FPST_A64], negx, negf, desc,
 -             env->vfp.fpcr & FPCR_FZ16);
 +    do_fmlal(vd, vn, vm, env, desc, FPST_A64, negx, negf);
  }
  void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
      }
  }
-+static void versal_create_pmc_apb_irq_orgate(Versal *s, qemu_irq *pic)
+-static void do_fmlal_idx(float32 *d, void *vn, void *vm, float_status *fpst,
-+{
+-                         uint64_t negx, int negf, uint32_t desc, bool fz16)
-+    DeviceState *orgate;
++static void do_fmlal_idx(float32 *d, void *vn, void *vm,
-+
++                         CPUARMState *env, uint32_t desc,
-+    /*
++                         ARMFPStatusFlavour fpst_idx,
-+     * The VERSAL_PMC_APB_IRQ is an 'or' of the interrupts from the following
++                         uint64_t negx, int negf)
 +     * models:
 +     *  - RTC
 +     *  - BBRAM
 +     */
 +    object_initialize_child(OBJECT(s), "pmc-apb-irq-orgate",
 +                            &s->pmc.apb_irq_orgate, TYPE_OR_IRQ);
 +    orgate = DEVICE(&s->pmc.apb_irq_orgate);
 +    object_property_set_int(OBJECT(orgate),
 +                            "num-lines", VERSAL_NUM_PMC_APB_IRQS, &error_fatal);
 +    qdev_realize(orgate, NULL, &error_fatal);
 +    qdev_connect_gpio_out(orgate, 0, pic[VERSAL_PMC_APB_IRQ]);
 +}
 +
  static void versal_create_rtc(Versal *s, qemu_irq *pic)
  {
-     SysBusDevice *sbd;
++    float_status *fpst = &env->vfp.fp_status[fpst_idx];
-@@ -XXX,XX +XXX,XX @@ static void versal_create_rtc(Versal *s, qemu_irq *pic)
++    bool fz16 = env->vfp.fpcr & FPCR_FZ16;
-      * TODO: Connect the ALARM and SECONDS interrupts once our RTC model
+     intptr_t i, oprsz = simd_oprsz(desc);
-      * supports them.
+     int is_2 = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
-      */
+     int index = extract32(desc, SIMD_DATA_SHIFT + 2, 3);
--    sysbus_connect_irq(sbd, 1, pic[VERSAL_RTC_APB_ERR_IRQ]);
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
-+    sysbus_connect_irq(sbd, 1,
+     bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
-+                       qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 0));
+     uint64_t negx = is_s ? 0x8000800080008000ull : 0;
 -    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
 -                 env->vfp.fpcr & FPCR_FZ16);
 +    do_fmlal_idx(vd, vn, vm, env, desc, FPST_STD, negx, 0);
  }
- static void versal_create_xrams(Versal *s, qemu_irq *pic)
+ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
-@@ -XXX,XX +XXX,XX @@ static void versal_create_bbram(Versal *s, qemu_irq *pic)
+@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
-     sysbus_realize(sbd, &error_fatal);
+             negx = 0x8000800080008000ull;
-     memory_region_add_subregion(&s->mr_ps, MM_PMC_BBRAM_CTRL,
+         }
-                                 sysbus_mmio_get_region(sbd, 0));
+     }
--    sysbus_connect_irq(sbd, 0, pic[VERSAL_BBRAM_APB_IRQ_0]);
+-    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status[FPST_A64], negx, negf, desc,
-+    sysbus_connect_irq(sbd, 0,
+-                 env->vfp.fpcr & FPCR_FZ16);
-+                       qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 1));
++    do_fmlal_idx(vd, vn, vm, env, desc, FPST_A64, negx, negf);
  }
- static void versal_realize_efuse_part(Versal *s, Object *dev, hwaddr base)
+ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
      versal_create_gems(s, pic);
      versal_create_admas(s, pic);
      versal_create_sds(s, pic);
 +    versal_create_pmc_apb_irq_orgate(s, pic);
      versal_create_rtc(s, pic);
      versal_create_xrams(s, pic);
      versal_create_bbram(s, pic);
 --
-.25.1
+.34.1

The following changes since commit b367db48126d4ee14579af6cf5cdbffeb9496627:

Merge remote-tracking branch 'remotes/aperard/tags/pull-xen-20220127' into staging (2022-01-28 11:05:29 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220128

for you to fetch changes up to 2c023d3675a3ffb54fc30504dcd715bc6f6e234f:

target/arm: Use correct entrypoint for SVC taken from Hyp to Hyp (2022-01-28 14:30:36 +0000)

----------------------------------------------------------------
target-arm queue:
 * Update copyright dates to 2022
 * hw/armv7m: Fix broken VMStateDescription
 * hw/char/exynos4210_uart: Fix crash on trying to load VM state
 * rtc: Move RTC function prototypes to their own header
 * xlnx-versal-virt: Support PMC SLCR
 * xlnx-versal-virt: Support OSPI flash memory controller
 * scripts: Explain the difference between linux-headers and standard-headers
 * target/arm: Log CPU index in 'Taking exception' log
 * arm_gicv3_its: Various bugfixes and cleanups
 * arm_gicv3_its: Implement the missing MOVI and MOVALL commands
 * ast2600: Fix address mapping of second SPI controller
 * target/arm: Use correct entrypoint for SVC taken from Hyp to Hyp

----------------------------------------------------------------
Andrew Baumann (1):
      MAINTAINERS: Remove myself (for raspi).

Cédric Le Goater (1):
      hw/arm: ast2600: Fix address mapping of second SPI controller

Francisco Iglesias (10):
      hw/misc: Add a model of Versal's PMC SLCR
      hw/arm/xlnx-versal: 'Or' the interrupts from the BBRAM and RTC models
      hw/arm/xlnx-versal: Connect Versal's PMC SLCR
      include/hw/dma/xlnx_csu_dma: Add in missing includes in the header
      hw/dma/xlnx_csu_dma: Support starting a read transfer through a class method
      hw/ssi: Add a model of Xilinx Versal's OSPI flash memory controller
      hw/arm/xlnx-versal: Connect the OSPI flash memory controller model
      hw/block/m25p80: Add support for Micron Xccela flash mt35xu01g
      hw/arm/xlnx-versal-virt: Connect mt35xu01g flashes to the OSPI
      MAINTAINERS: Add an entry for Xilinx Versal OSPI

Peter Maydell (20):
      Update copyright dates to 2022
      hw/armv7m: Fix broken VMStateDescription
      hw/char/exynos4210_uart: Fix crash on trying to load VM state
      rtc: Move RTC function prototypes to their own header
      scripts: Explain the difference between linux-headers and standard-headers
      target/arm: Log CPU index in 'Taking exception' log
      hw/intc/arm_gicv3_its: Add tracepoints
      hw/intc/arm_gicv3: Initialise dma_as in GIC, not ITS
      hw/intc/arm_gicv3_its: Don't clear GITS_CREADR when GITS_CTLR.ENABLED is set
      hw/intc/arm_gicv3_its: Don't clear GITS_CWRITER on writes to GITS_CBASER
      hw/intc/arm_gicv3: Honour GICD_CTLR.EnableGrp1NS for LPIs
      hw/intc/arm_gicv3_its: Sort ITS command list into numeric order
      hw/intc/arm_gicv3_redist: Remove unnecessary zero checks
      hw/intc/arm_gicv3: Set GICR_CTLR.CES if LPIs are supported
      hw/intc/arm_gicv3_its: Provide read accessor for translation_ops
      hw/intc/arm_gicv3_its: Make GITS_BASER<n> RAZ/WI for unimplemented registers
      hw/intc/arm_gicv3_its: Check table bounds against correct limit
      hw/intc/arm_gicv3_its: Implement MOVALL
      hw/intc/arm_gicv3_its: Implement MOVI
      target/arm: Use correct entrypoint for SVC taken from Hyp to Hyp

It's a new year; update the copyright strings for our
help/version/about information and for our documentation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220120124713.288303-1-peter.maydell@linaro.org
---
 docs/conf.py          | 2 +-
 include/qemu-common.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@
 
 # General information about the project.
 project = u'QEMU'
-copyright = u'2021, The QEMU Project Developers'
+copyright = u'2022, The QEMU Project Developers'
 author = u'The QEMU Project Developers'
 
 # The version info for the project you're documenting, acts as replacement for
diff --git a/include/qemu-common.h b/include/qemu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu-common.h
+++ b/include/qemu-common.h
@@ -XXX,XX +XXX,XX @@
 #define TFR(expr) do { if ((expr) != -1) break; } while (errno == EINTR)
 
 /* Copyright string for -version arguments, About dialogs, etc */
-#define QEMU_COPYRIGHT "Copyright (c) 2003-2021 " \
+#define QEMU_COPYRIGHT "Copyright (c) 2003-2022 " \
     "Fabrice Bellard and the QEMU Project developers"
 
 /* Bug reporting information for --help arguments, About dialogs, etc */
-- 
2.25.1

In commit d5093d961585f02 we added a VMStateDescription to
the TYPE_ARMV7M object, to handle migration of its Clocks.
However a cut-and-paste error meant we used the wrong struct
name in the VMSTATE_CLOCK() macro arguments. The result was
that attempting a 'savevm' might result in an assertion
failure.

Cc: qemu-stable@nongnu.org
Buglink: https://gitlab.com/qemu-project/qemu/-/issues/803
Fixes: d5093d961585f02
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Ani Sinha <ani@anisinha.ca>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220120151609.433555-1-peter.maydell@linaro.org
---
 hw/arm/armv7m.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/armv7m.c b/hw/arm/armv7m.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armv7m.c
+++ b/hw/arm/armv7m.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_armv7m = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
-        VMSTATE_CLOCK(refclk, SysTickState),
-        VMSTATE_CLOCK(cpuclk, SysTickState),
+        VMSTATE_CLOCK(refclk, ARMv7MState),
+        VMSTATE_CLOCK(cpuclk, ARMv7MState),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.25.1

The exynos4210_uart_post_load() function assumes that it is passed
the Exynos4210UartState, but it has been attached to the
VMStateDescription for the Exynos4210UartFIFO type.  The result is a
SIGSEGV when attempting to load VM state for any machine type
including this device.

Fix the bug by attaching the post-load function to the VMSD for the
Exynos4210UartState.  This is the logical place for it, because the
actions it does relate to the entire UART state, not just the FIFO.

Thanks to the bug reporter @TrungNguyen1909 for the clear bug
description and the suggested fix.

Fixes: c9d3396d80fe7ece9b
   ("hw/char/exynos4210_uart: Implement post_load function")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/638
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220120151648.433736-1-peter.maydell@linaro.org
---
 hw/char/exynos4210_uart.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/char/exynos4210_uart.c b/hw/char/exynos4210_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/exynos4210_uart.c
+++ b/hw/char/exynos4210_uart.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_exynos4210_uart_fifo = {
     .name = "exynos4210.uart.fifo",
     .version_id = 1,
     .minimum_version_id = 1,
-    .post_load = exynos4210_uart_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32(sp, Exynos4210UartFIFO),
         VMSTATE_UINT32(rp, Exynos4210UartFIFO),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_exynos4210_uart = {
     .name = "exynos4210.uart",
     .version_id = 1,
     .minimum_version_id = 1,
+    .post_load = exynos4210_uart_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_STRUCT(rx, Exynos4210UartState, 1,
                        vmstate_exynos4210_uart_fifo, Exynos4210UartFIFO),
-- 
2.25.1

softmmu/rtc.c defines two public functions: qemu_get_timedate() and
qemu_timedate_diff().  Currently we keep the prototypes for these in
qemu-common.h, but most files don't need them.  Move them to their
own header, a new include/sysemu/rtc.h.

Since the C files using these two functions did not need to include
qemu-common.h for any other reason, we can remove those include lines
when we add the include of the new rtc.h.

The license for the .h file follows that of the softmmu/rtc.c
where both the functions are defined.

diff --git a/include/qemu-common.h b/include/qemu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu-common.h
+++ b/include/qemu-common.h
@@ -XXX,XX +XXX,XX @@
 int qemu_main(int argc, char **argv, char **envp);
 #endif
 
-void qemu_get_timedate(struct tm *tm, int offset);
-int qemu_timedate_diff(struct tm *tm);
-
 void *qemu_oom_check(void *ptr);
 
 ssize_t qemu_write_full(int fd, const void *buf, size_t count)
diff --git a/include/sysemu/rtc.h b/include/sysemu/rtc.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/sysemu/rtc.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * RTC configuration and clock read
+ *
+ * Copyright (c) 2003-2021 QEMU contributors
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#ifndef SYSEMU_RTC_H
+#define SYSEMU_RTC_H
+
+/**
+ * qemu_get_timedate: Get the current RTC time
+ * @tm: struct tm to fill in with RTC time
+ * @offset: offset in seconds to adjust the RTC time by before
+ *          converting to struct tm format.
+ *
+ * This function fills in @tm with the current RTC time, as adjusted
+ * by @offset (for example, if @offset is 3600 then the returned time/date
+ * will be one hour further ahead than the current RTC time).
+ *
+ * The usual use is by RTC device models, which should call this function
+ * to find the time/date value that they should return to the guest
+ * when it reads the RTC registers.
+ *
+ * The behaviour of the clock whose value this function returns will
+ * depend on the -rtc command line option passed by the user.
+ */
+void qemu_get_timedate(struct tm *tm, int offset);
+
+/**
+ * qemu_timedate_diff: Return difference between a struct tm and the RTC
+ * @tm: struct tm containing the date/time to compare against
+ *
+ * Returns the difference in seconds between the RTC clock time
+ * and the date/time specified in @tm. For example, if @tm specifies
+ * a timestamp one hour further ahead than the current RTC time
+ * then this function will return 3600.
+ */
+int qemu_timedate_diff(struct tm *tm);
+
+#endif
diff --git a/hw/arm/omap1.c b/hw/arm/omap1.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/omap1.c
+++ b/hw/arm/omap1.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/error-report.h"
 #include "qemu/main-loop.h"
 #include "qapi/error.h"
-#include "qemu-common.h"
 #include "cpu.h"
 #include "exec/address-spaces.h"
 #include "hw/hw.h"
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/qtest.h"
 #include "sysemu/reset.h"
 #include "sysemu/runstate.h"
+#include "sysemu/rtc.h"
 #include "qemu/range.h"
 #include "hw/sysbus.h"
 #include "qemu/cutils.h"
diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/pxa2xx.c
+++ b/hw/arm/pxa2xx.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/error-report.h"
 #include "qemu/module.h"
 #include "qapi/error.h"
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "sysemu/blockdev.h"
 #include "sysemu/qtest.h"
+#include "sysemu/rtc.h"
 #include "qemu/cutils.h"
 #include "qemu/log.h"
 #include "qom/object.h"
diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/strongarm.c
+++ b/hw/arm/strongarm.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "cpu.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "chardev/char-serial.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/rtc.h"
 #include "hw/ssi/ssi.h"
 #include "qapi/error.h"
 #include "qemu/cutils.h"
diff --git a/hw/misc/mac_via.c b/hw/misc/mac_via.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/mac_via.c
+++ b/hw/misc/mac_via.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "migration/vmstate.h"
 #include "hw/sysbus.h"
 #include "hw/irq.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-properties.h"
 #include "hw/qdev-properties-system.h"
 #include "sysemu/block-backend.h"
+#include "sysemu/rtc.h"
 #include "trace.h"
 #include "qemu/log.h"
 
diff --git a/hw/misc/macio/cuda.c b/hw/misc/macio/cuda.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/macio/cuda.c
+++ b/hw/misc/macio/cuda.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "hw/ppc/mac.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/timer.h"
 #include "sysemu/runstate.h"
+#include "sysemu/rtc.h"
 #include "qapi/error.h"
 #include "qemu/cutils.h"
 #include "qemu/log.h"
diff --git a/hw/misc/macio/pmu.c b/hw/misc/macio/pmu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/macio/pmu.c
+++ b/hw/misc/macio/pmu.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "hw/ppc/mac.h"
 #include "hw/qdev-properties.h"
 #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/timer.h"
 #include "sysemu/runstate.h"
+#include "sysemu/rtc.h"
 #include "qapi/error.h"
 #include "qemu/cutils.h"
 #include "qemu/log.h"
diff --git a/hw/ppc/spapr_rtc.c b/hw/ppc/spapr_rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/spapr_rtc.c
+++ b/hw/ppc/spapr_rtc.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/timer.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/rtc.h"
 #include "hw/ppc/spapr.h"
 #include "migration/vmstate.h"
 #include "qapi/error.h"
diff --git a/hw/rtc/allwinner-rtc.c b/hw/rtc/allwinner-rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/allwinner-rtc.c
+++ b/hw/rtc/allwinner-rtc.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
-#include "qemu-common.h"
 #include "hw/qdev-properties.h"
 #include "hw/rtc/allwinner-rtc.h"
+#include "sysemu/rtc.h"
 #include "trace.h"
 
 /* RTC registers */
diff --git a/hw/rtc/aspeed_rtc.c b/hw/rtc/aspeed_rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/aspeed_rtc.c
+++ b/hw/rtc/aspeed_rtc.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "hw/rtc/aspeed_rtc.h"
 #include "migration/vmstate.h"
 #include "qemu/log.h"
 #include "qemu/timer.h"
+#include "sysemu/rtc.h"
 
 #include "trace.h"
 
diff --git a/hw/rtc/ds1338.c b/hw/rtc/ds1338.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/ds1338.c
+++ b/hw/rtc/ds1338.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "hw/i2c/i2c.h"
 #include "migration/vmstate.h"
 #include "qemu/bcd.h"
 #include "qemu/module.h"
 #include "qom/object.h"
+#include "sysemu/rtc.h"
 
 /* Size of NVRAM including both the user-accessible area and the
  * secondary register area.
diff --git a/hw/rtc/exynos4210_rtc.c b/hw/rtc/exynos4210_rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/exynos4210_rtc.c
+++ b/hw/rtc/exynos4210_rtc.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "hw/sysbus.h"
@@ -XXX,XX +XXX,XX @@
 
 #include "hw/arm/exynos4210.h"
 #include "qom/object.h"
+#include "sysemu/rtc.h"
 
 #define DEBUG_RTC 0
 
diff --git a/hw/rtc/goldfish_rtc.c b/hw/rtc/goldfish_rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/goldfish_rtc.c
+++ b/hw/rtc/goldfish_rtc.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "hw/rtc/goldfish_rtc.h"
 #include "migration/vmstate.h"
 #include "hw/irq.h"
@@ -XXX,XX +XXX,XX @@
 #include "qemu/bitops.h"
 #include "qemu/timer.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/rtc.h"
 #include "qemu/cutils.h"
 #include "qemu/log.h"
 
diff --git a/hw/rtc/m41t80.c b/hw/rtc/m41t80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/m41t80.c
+++ b/hw/rtc/m41t80.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
 #include "qemu/timer.h"
 #include "qemu/bcd.h"
 #include "hw/i2c/i2c.h"
 #include "qom/object.h"
+#include "sysemu/rtc.h"
 
 #define TYPE_M41T80 "m41t80"
 OBJECT_DECLARE_SIMPLE_TYPE(M41t80State, M41T80)
diff --git a/hw/rtc/m48t59.c b/hw/rtc/m48t59.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/m48t59.c
+++ b/hw/rtc/m48t59.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "hw/irq.h"
 #include "hw/qdev-properties.h"
 #include "hw/rtc/m48t59.h"
 #include "qemu/timer.h"
 #include "sysemu/runstate.h"
+#include "sysemu/rtc.h"
 #include "sysemu/sysemu.h"
 #include "hw/sysbus.h"
 #include "qapi/error.h"
diff --git a/hw/rtc/mc146818rtc.c b/hw/rtc/mc146818rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/mc146818rtc.c
+++ b/hw/rtc/mc146818rtc.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/cutils.h"
 #include "qemu/module.h"
 #include "qemu/bcd.h"
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/replay.h"
 #include "sysemu/reset.h"
 #include "sysemu/runstate.h"
+#include "sysemu/rtc.h"
 #include "hw/rtc/mc146818rtc.h"
 #include "hw/rtc/mc146818rtc_regs.h"
 #include "migration/vmstate.h"
diff --git a/hw/rtc/pl031.c b/hw/rtc/pl031.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/pl031.c
+++ b/hw/rtc/pl031.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "hw/rtc/pl031.h"
 #include "migration/vmstate.h"
 #include "hw/irq.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/sysbus.h"
 #include "qemu/timer.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/rtc.h"
 #include "qemu/cutils.h"
 #include "qemu/log.h"
 #include "qemu/module.h"
diff --git a/hw/rtc/twl92230.c b/hw/rtc/twl92230.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/twl92230.c
+++ b/hw/rtc/twl92230.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/timer.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
 #include "migration/qemu-file-types.h"
 #include "migration/vmstate.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/rtc.h"
 #include "qemu/bcd.h"
 #include "qemu/module.h"
 #include "qom/object.h"
diff --git a/hw/rtc/xlnx-zynqmp-rtc.c b/hw/rtc/xlnx-zynqmp-rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rtc/xlnx-zynqmp-rtc.c
+++ b/hw/rtc/xlnx-zynqmp-rtc.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "hw/sysbus.h"
 #include "hw/register.h"
 #include "qemu/bitops.h"
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "qemu/cutils.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/rtc.h"
 #include "trace.h"
 #include "hw/rtc/xlnx-zynqmp-rtc.h"
 #include "migration/vmstate.h"
diff --git a/hw/s390x/tod-tcg.c b/hw/s390x/tod-tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/s390x/tod-tcg.c
+++ b/hw/s390x/tod-tcg.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qapi/error.h"
 #include "hw/s390x/tod.h"
 #include "qemu/timer.h"
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "cpu.h"
 #include "tcg/tcg_s390x.h"
+#include "sysemu/rtc.h"
 
 static void qemu_s390_tod_get(const S390TODState *td, S390TOD *tod,
                               Error **errp)
diff --git a/hw/scsi/megasas.c b/hw/scsi/megasas.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/megasas.c
+++ b/hw/scsi/megasas.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "hw/pci/pci.h"
 #include "hw/qdev-properties.h"
 #include "sysemu/dma.h"
 #include "sysemu/block-backend.h"
+#include "sysemu/rtc.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
 #include "qemu/iov.h"
diff --git a/net/dump.c b/net/dump.c
index XXXXXXX..XXXXXXX 100644
--- a/net/dump.c
+++ b/net/dump.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "clients.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@
 #include "qapi/visitor.h"
 #include "net/filter.h"
 #include "qom/object.h"
+#include "sysemu/rtc.h"
 
 typedef struct DumpState {
     int64_t start_ts;
diff --git a/softmmu/rtc.c b/softmmu/rtc.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/rtc.c
+++ b/softmmu/rtc.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/cutils.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
@@ -XXX,XX +XXX,XX @@
 #include "qom/object.h"
 #include "sysemu/replay.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/rtc.h"
 
 static enum {
     RTC_BASE_UTC,
-- 
2.25.1

From: Francisco Iglesias <francisco.iglesias@xilinx.com>

Add a model of Versal's PMC SLCR (system-level control registers).

Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20220121161141.14389-2-francisco.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/xlnx-versal-pmc-iou-slcr.h |   78 ++
 hw/misc/xlnx-versal-pmc-iou-slcr.c         | 1446 ++++++++++++++++++++
 hw/misc/meson.build                        |    5 +-
 3 files changed, 1528 insertions(+), 1 deletion(-)
 create mode 100644 include/hw/misc/xlnx-versal-pmc-iou-slcr.h
 create mode 100644 hw/misc/xlnx-versal-pmc-iou-slcr.c

diff --git a/include/hw/misc/xlnx-versal-pmc-iou-slcr.h b/include/hw/misc/xlnx-versal-pmc-iou-slcr.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/misc/xlnx-versal-pmc-iou-slcr.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Header file for the Xilinx Versal's PMC IOU SLCR
+ *
+ * Copyright (C) 2021 Xilinx Inc
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+/*
+ * This is a model of Xilinx Versal's PMC I/O Peripheral Control and Status
+ * module documented in Versal's Technical Reference manual [1] and the Versal
+ * ACAP Register reference [2].
+ *
+ * References:
+ *
+ * [1] Versal ACAP Technical Reference Manual,
+ *     https://www.xilinx.com/support/documentation/architecture-manuals/am011-versal-acap-trm.pdf
+ *
+ * [2] Versal ACAP Register Reference,
+ *     https://www.xilinx.com/html_docs/registers/am012/am012-versal-register-reference.html#mod___pmc_iop_slcr.html
+ *
+ * QEMU interface:
+ * + sysbus MMIO region 0: MemoryRegion for the device's registers
+ * + sysbus IRQ 0: PMC (AXI and APB) parity error interrupt detected by the PMC
+ *   I/O peripherals.
+ * + sysbus IRQ 1: Device interrupt.
+ * + Named GPIO output "sd-emmc-sel[0]": Enables 0: SD mode or 1: eMMC mode on
+ *   SD/eMMC controller 0.
+ * + Named GPIO output "sd-emmc-sel[1]": Enables 0: SD mode or 1: eMMC mode on
+ *   SD/eMMC controller 1.
+ * + Named GPIO output "qspi-ospi-mux-sel": Selects 0: QSPI linear region or 1:
+ *   OSPI linear region.
+ * + Named GPIO output "ospi-mux-sel": Selects 0: OSPI Indirect access mode or
+ *   1: OSPI direct access mode.
+ */
+
+#ifndef XILINX_VERSAL_PMC_IOU_SLCR_H
+#define XILINX_VERSAL_PMC_IOU_SLCR_H
+
+#include "hw/register.h"
+
+#define TYPE_XILINX_VERSAL_PMC_IOU_SLCR "xlnx.versal-pmc-iou-slcr"
+
+OBJECT_DECLARE_SIMPLE_TYPE(XlnxVersalPmcIouSlcr, XILINX_VERSAL_PMC_IOU_SLCR)
+
+#define XILINX_VERSAL_PMC_IOU_SLCR_R_MAX (0x828 / 4 + 1)
+
+struct XlnxVersalPmcIouSlcr {
+    SysBusDevice parent_obj;
+    MemoryRegion iomem;
+    qemu_irq irq_parity_imr;
+    qemu_irq irq_imr;
+    qemu_irq sd_emmc_sel[2];
+    qemu_irq qspi_ospi_mux_sel;
+    qemu_irq ospi_mux_sel;
+
+    uint32_t regs[XILINX_VERSAL_PMC_IOU_SLCR_R_MAX];
+    RegisterInfo regs_info[XILINX_VERSAL_PMC_IOU_SLCR_R_MAX];
+};
+
+#endif /* XILINX_VERSAL_PMC_IOU_SLCR_H */
diff --git a/hw/misc/xlnx-versal-pmc-iou-slcr.c b/hw/misc/xlnx-versal-pmc-iou-slcr.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/xlnx-versal-pmc-iou-slcr.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of Versal's PMC IOU SLCR (system level control registers)
+ *
+ * Copyright (c) 2021 Xilinx Inc.
+ * Written by Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "hw/register.h"
+#include "hw/irq.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
+#include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
+
+#ifndef XILINX_VERSAL_PMC_IOU_SLCR_ERR_DEBUG
+#define XILINX_VERSAL_PMC_IOU_SLCR_ERR_DEBUG 0
+#endif
+
+REG32(MIO_PIN_0, 0x0)
+    FIELD(MIO_PIN_0, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_0, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_0, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_0, L0_SEL, 1, 2)
+REG32(MIO_PIN_1, 0x4)
+    FIELD(MIO_PIN_1, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_1, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_1, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_1, L0_SEL, 1, 2)
+REG32(MIO_PIN_2, 0x8)
+    FIELD(MIO_PIN_2, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_2, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_2, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_2, L0_SEL, 1, 2)
+REG32(MIO_PIN_3, 0xc)
+    FIELD(MIO_PIN_3, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_3, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_3, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_3, L0_SEL, 1, 2)
+REG32(MIO_PIN_4, 0x10)
+    FIELD(MIO_PIN_4, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_4, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_4, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_4, L0_SEL, 1, 2)
+REG32(MIO_PIN_5, 0x14)
+    FIELD(MIO_PIN_5, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_5, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_5, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_5, L0_SEL, 1, 2)
+REG32(MIO_PIN_6, 0x18)
+    FIELD(MIO_PIN_6, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_6, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_6, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_6, L0_SEL, 1, 2)
+REG32(MIO_PIN_7, 0x1c)
+    FIELD(MIO_PIN_7, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_7, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_7, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_7, L0_SEL, 1, 2)
+REG32(MIO_PIN_8, 0x20)
+    FIELD(MIO_PIN_8, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_8, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_8, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_8, L0_SEL, 1, 2)
+REG32(MIO_PIN_9, 0x24)
+    FIELD(MIO_PIN_9, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_9, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_9, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_9, L0_SEL, 1, 2)
+REG32(MIO_PIN_10, 0x28)
+    FIELD(MIO_PIN_10, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_10, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_10, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_10, L0_SEL, 1, 2)
+REG32(MIO_PIN_11, 0x2c)
+    FIELD(MIO_PIN_11, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_11, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_11, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_11, L0_SEL, 1, 2)
+REG32(MIO_PIN_12, 0x30)
+    FIELD(MIO_PIN_12, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_12, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_12, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_12, L0_SEL, 1, 2)
+REG32(MIO_PIN_13, 0x34)
+    FIELD(MIO_PIN_13, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_13, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_13, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_13, L0_SEL, 1, 2)
+REG32(MIO_PIN_14, 0x38)
+    FIELD(MIO_PIN_14, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_14, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_14, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_14, L0_SEL, 1, 2)
+REG32(MIO_PIN_15, 0x3c)
+    FIELD(MIO_PIN_15, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_15, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_15, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_15, L0_SEL, 1, 2)
+REG32(MIO_PIN_16, 0x40)
+    FIELD(MIO_PIN_16, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_16, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_16, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_16, L0_SEL, 1, 2)
+REG32(MIO_PIN_17, 0x44)
+    FIELD(MIO_PIN_17, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_17, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_17, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_17, L0_SEL, 1, 2)
+REG32(MIO_PIN_18, 0x48)
+    FIELD(MIO_PIN_18, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_18, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_18, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_18, L0_SEL, 1, 2)
+REG32(MIO_PIN_19, 0x4c)
+    FIELD(MIO_PIN_19, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_19, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_19, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_19, L0_SEL, 1, 2)
+REG32(MIO_PIN_20, 0x50)
+    FIELD(MIO_PIN_20, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_20, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_20, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_20, L0_SEL, 1, 2)
+REG32(MIO_PIN_21, 0x54)
+    FIELD(MIO_PIN_21, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_21, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_21, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_21, L0_SEL, 1, 2)
+REG32(MIO_PIN_22, 0x58)
+    FIELD(MIO_PIN_22, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_22, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_22, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_22, L0_SEL, 1, 2)
+REG32(MIO_PIN_23, 0x5c)
+    FIELD(MIO_PIN_23, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_23, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_23, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_23, L0_SEL, 1, 2)
+REG32(MIO_PIN_24, 0x60)
+    FIELD(MIO_PIN_24, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_24, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_24, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_24, L0_SEL, 1, 2)
+REG32(MIO_PIN_25, 0x64)
+    FIELD(MIO_PIN_25, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_25, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_25, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_25, L0_SEL, 1, 2)
+REG32(MIO_PIN_26, 0x68)
+    FIELD(MIO_PIN_26, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_26, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_26, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_26, L0_SEL, 1, 2)
+REG32(MIO_PIN_27, 0x6c)
+    FIELD(MIO_PIN_27, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_27, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_27, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_27, L0_SEL, 1, 2)
+REG32(MIO_PIN_28, 0x70)
+    FIELD(MIO_PIN_28, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_28, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_28, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_28, L0_SEL, 1, 2)
+REG32(MIO_PIN_29, 0x74)
+    FIELD(MIO_PIN_29, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_29, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_29, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_29, L0_SEL, 1, 2)
+REG32(MIO_PIN_30, 0x78)
+    FIELD(MIO_PIN_30, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_30, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_30, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_30, L0_SEL, 1, 2)
+REG32(MIO_PIN_31, 0x7c)
+    FIELD(MIO_PIN_31, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_31, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_31, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_31, L0_SEL, 1, 2)
+REG32(MIO_PIN_32, 0x80)
+    FIELD(MIO_PIN_32, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_32, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_32, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_32, L0_SEL, 1, 2)
+REG32(MIO_PIN_33, 0x84)
+    FIELD(MIO_PIN_33, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_33, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_33, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_33, L0_SEL, 1, 2)
+REG32(MIO_PIN_34, 0x88)
+    FIELD(MIO_PIN_34, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_34, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_34, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_34, L0_SEL, 1, 2)
+REG32(MIO_PIN_35, 0x8c)
+    FIELD(MIO_PIN_35, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_35, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_35, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_35, L0_SEL, 1, 2)
+REG32(MIO_PIN_36, 0x90)
+    FIELD(MIO_PIN_36, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_36, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_36, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_36, L0_SEL, 1, 2)
+REG32(MIO_PIN_37, 0x94)
+    FIELD(MIO_PIN_37, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_37, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_37, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_37, L0_SEL, 1, 2)
+REG32(MIO_PIN_38, 0x98)
+    FIELD(MIO_PIN_38, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_38, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_38, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_38, L0_SEL, 1, 2)
+REG32(MIO_PIN_39, 0x9c)
+    FIELD(MIO_PIN_39, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_39, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_39, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_39, L0_SEL, 1, 2)
+REG32(MIO_PIN_40, 0xa0)
+    FIELD(MIO_PIN_40, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_40, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_40, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_40, L0_SEL, 1, 2)
+REG32(MIO_PIN_41, 0xa4)
+    FIELD(MIO_PIN_41, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_41, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_41, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_41, L0_SEL, 1, 2)
+REG32(MIO_PIN_42, 0xa8)
+    FIELD(MIO_PIN_42, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_42, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_42, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_42, L0_SEL, 1, 2)
+REG32(MIO_PIN_43, 0xac)
+    FIELD(MIO_PIN_43, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_43, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_43, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_43, L0_SEL, 1, 2)
+REG32(MIO_PIN_44, 0xb0)
+    FIELD(MIO_PIN_44, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_44, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_44, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_44, L0_SEL, 1, 2)
+REG32(MIO_PIN_45, 0xb4)
+    FIELD(MIO_PIN_45, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_45, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_45, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_45, L0_SEL, 1, 2)
+REG32(MIO_PIN_46, 0xb8)
+    FIELD(MIO_PIN_46, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_46, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_46, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_46, L0_SEL, 1, 2)
+REG32(MIO_PIN_47, 0xbc)
+    FIELD(MIO_PIN_47, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_47, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_47, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_47, L0_SEL, 1, 2)
+REG32(MIO_PIN_48, 0xc0)
+    FIELD(MIO_PIN_48, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_48, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_48, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_48, L0_SEL, 1, 2)
+REG32(MIO_PIN_49, 0xc4)
+    FIELD(MIO_PIN_49, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_49, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_49, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_49, L0_SEL, 1, 2)
+REG32(MIO_PIN_50, 0xc8)
+    FIELD(MIO_PIN_50, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_50, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_50, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_50, L0_SEL, 1, 2)
+REG32(MIO_PIN_51, 0xcc)
+    FIELD(MIO_PIN_51, L3_SEL, 7, 3)
+    FIELD(MIO_PIN_51, L2_SEL, 5, 2)
+    FIELD(MIO_PIN_51, L1_SEL, 3, 2)
+    FIELD(MIO_PIN_51, L0_SEL, 1, 2)
+REG32(BNK0_EN_RX, 0x100)
+    FIELD(BNK0_EN_RX, BNK0_EN_RX, 0, 26)
+REG32(BNK0_SEL_RX0, 0x104)
+REG32(BNK0_SEL_RX1, 0x108)
+    FIELD(BNK0_SEL_RX1, BNK0_SEL_RX, 0, 20)
+REG32(BNK0_EN_RX_SCHMITT_HYST, 0x10c)
+    FIELD(BNK0_EN_RX_SCHMITT_HYST, BNK0_EN_RX_SCHMITT_HYST, 0, 26)
+REG32(BNK0_EN_WK_PD, 0x110)
+    FIELD(BNK0_EN_WK_PD, BNK0_EN_WK_PD, 0, 26)
+REG32(BNK0_EN_WK_PU, 0x114)
+    FIELD(BNK0_EN_WK_PU, BNK0_EN_WK_PU, 0, 26)
+REG32(BNK0_SEL_DRV0, 0x118)
+REG32(BNK0_SEL_DRV1, 0x11c)
+    FIELD(BNK0_SEL_DRV1, BNK0_SEL_DRV, 0, 20)
+REG32(BNK0_SEL_SLEW, 0x120)
+    FIELD(BNK0_SEL_SLEW, BNK0_SEL_SLEW, 0, 26)
+REG32(BNK0_EN_DFT_OPT_INV, 0x124)
+    FIELD(BNK0_EN_DFT_OPT_INV, BNK0_EN_DFT_OPT_INV, 0, 26)
+REG32(BNK0_EN_PAD2PAD_LOOPBACK, 0x128)
+    FIELD(BNK0_EN_PAD2PAD_LOOPBACK, BNK0_EN_PAD2PAD_LOOPBACK, 0, 13)
+REG32(BNK0_RX_SPARE0, 0x12c)
+REG32(BNK0_RX_SPARE1, 0x130)
+    FIELD(BNK0_RX_SPARE1, BNK0_RX_SPARE, 0, 20)
+REG32(BNK0_TX_SPARE0, 0x134)
+REG32(BNK0_TX_SPARE1, 0x138)
+    FIELD(BNK0_TX_SPARE1, BNK0_TX_SPARE, 0, 20)
+REG32(BNK0_SEL_EN1P8, 0x13c)
+    FIELD(BNK0_SEL_EN1P8, BNK0_SEL_EN1P8, 0, 1)
+REG32(BNK0_EN_B_POR_DETECT, 0x140)
+    FIELD(BNK0_EN_B_POR_DETECT, BNK0_EN_B_POR_DETECT, 0, 1)
+REG32(BNK0_LPF_BYP_POR_DETECT, 0x144)
+    FIELD(BNK0_LPF_BYP_POR_DETECT, BNK0_LPF_BYP_POR_DETECT, 0, 1)
+REG32(BNK0_EN_LATCH, 0x148)
+    FIELD(BNK0_EN_LATCH, BNK0_EN_LATCH, 0, 1)
+REG32(BNK0_VBG_LPF_BYP_B, 0x14c)
+    FIELD(BNK0_VBG_LPF_BYP_B, BNK0_VBG_LPF_BYP_B, 0, 1)
+REG32(BNK0_EN_AMP_B, 0x150)
+    FIELD(BNK0_EN_AMP_B, BNK0_EN_AMP_B, 0, 2)
+REG32(BNK0_SPARE_BIAS, 0x154)
+    FIELD(BNK0_SPARE_BIAS, BNK0_SPARE_BIAS, 0, 4)
+REG32(BNK0_DRIVER_BIAS, 0x158)
+    FIELD(BNK0_DRIVER_BIAS, BNK0_DRIVER_BIAS, 0, 15)
+REG32(BNK0_VMODE, 0x15c)
+    FIELD(BNK0_VMODE, BNK0_VMODE, 0, 1)
+REG32(BNK0_SEL_AUX_IO_RX, 0x160)
+    FIELD(BNK0_SEL_AUX_IO_RX, BNK0_SEL_AUX_IO_RX, 0, 26)
+REG32(BNK0_EN_TX_HS_MODE, 0x164)
+    FIELD(BNK0_EN_TX_HS_MODE, BNK0_EN_TX_HS_MODE, 0, 26)
+REG32(MIO_MST_TRI0, 0x200)
+    FIELD(MIO_MST_TRI0, PIN_25_TRI, 25, 1)
+    FIELD(MIO_MST_TRI0, PIN_24_TRI, 24, 1)
+    FIELD(MIO_MST_TRI0, PIN_23_TRI, 23, 1)
+    FIELD(MIO_MST_TRI0, PIN_22_TRI, 22, 1)
+    FIELD(MIO_MST_TRI0, PIN_21_TRI, 21, 1)
+    FIELD(MIO_MST_TRI0, PIN_20_TRI, 20, 1)
+    FIELD(MIO_MST_TRI0, PIN_19_TRI, 19, 1)
+    FIELD(MIO_MST_TRI0, PIN_18_TRI, 18, 1)
+    FIELD(MIO_MST_TRI0, PIN_17_TRI, 17, 1)
+    FIELD(MIO_MST_TRI0, PIN_16_TRI, 16, 1)
+    FIELD(MIO_MST_TRI0, PIN_15_TRI, 15, 1)
+    FIELD(MIO_MST_TRI0, PIN_14_TRI, 14, 1)
+    FIELD(MIO_MST_TRI0, PIN_13_TRI, 13, 1)
+    FIELD(MIO_MST_TRI0, PIN_12_TRI, 12, 1)
+    FIELD(MIO_MST_TRI0, PIN_11_TRI, 11, 1)
+    FIELD(MIO_MST_TRI0, PIN_10_TRI, 10, 1)
+    FIELD(MIO_MST_TRI0, PIN_09_TRI, 9, 1)
+    FIELD(MIO_MST_TRI0, PIN_08_TRI, 8, 1)
+    FIELD(MIO_MST_TRI0, PIN_07_TRI, 7, 1)
+    FIELD(MIO_MST_TRI0, PIN_06_TRI, 6, 1)
+    FIELD(MIO_MST_TRI0, PIN_05_TRI, 5, 1)
+    FIELD(MIO_MST_TRI0, PIN_04_TRI, 4, 1)
+    FIELD(MIO_MST_TRI0, PIN_03_TRI, 3, 1)
+    FIELD(MIO_MST_TRI0, PIN_02_TRI, 2, 1)
+    FIELD(MIO_MST_TRI0, PIN_01_TRI, 1, 1)
+    FIELD(MIO_MST_TRI0, PIN_00_TRI, 0, 1)
+REG32(MIO_MST_TRI1, 0x204)
+    FIELD(MIO_MST_TRI1, PIN_51_TRI, 25, 1)
+    FIELD(MIO_MST_TRI1, PIN_50_TRI, 24, 1)
+    FIELD(MIO_MST_TRI1, PIN_49_TRI, 23, 1)
+    FIELD(MIO_MST_TRI1, PIN_48_TRI, 22, 1)
+    FIELD(MIO_MST_TRI1, PIN_47_TRI, 21, 1)
+    FIELD(MIO_MST_TRI1, PIN_46_TRI, 20, 1)
+    FIELD(MIO_MST_TRI1, PIN_45_TRI, 19, 1)
+    FIELD(MIO_MST_TRI1, PIN_44_TRI, 18, 1)
+    FIELD(MIO_MST_TRI1, PIN_43_TRI, 17, 1)
+    FIELD(MIO_MST_TRI1, PIN_42_TRI, 16, 1)
+    FIELD(MIO_MST_TRI1, PIN_41_TRI, 15, 1)
+    FIELD(MIO_MST_TRI1, PIN_40_TRI, 14, 1)
+    FIELD(MIO_MST_TRI1, PIN_39_TRI, 13, 1)
+    FIELD(MIO_MST_TRI1, PIN_38_TRI, 12, 1)
+    FIELD(MIO_MST_TRI1, PIN_37_TRI, 11, 1)
+    FIELD(MIO_MST_TRI1, PIN_36_TRI, 10, 1)
+    FIELD(MIO_MST_TRI1, PIN_35_TRI, 9, 1)
+    FIELD(MIO_MST_TRI1, PIN_34_TRI, 8, 1)
+    FIELD(MIO_MST_TRI1, PIN_33_TRI, 7, 1)
+    FIELD(MIO_MST_TRI1, PIN_32_TRI, 6, 1)
+    FIELD(MIO_MST_TRI1, PIN_31_TRI, 5, 1)
+    FIELD(MIO_MST_TRI1, PIN_30_TRI, 4, 1)
+    FIELD(MIO_MST_TRI1, PIN_29_TRI, 3, 1)
+    FIELD(MIO_MST_TRI1, PIN_28_TRI, 2, 1)
+    FIELD(MIO_MST_TRI1, PIN_27_TRI, 1, 1)
+    FIELD(MIO_MST_TRI1, PIN_26_TRI, 0, 1)
+REG32(BNK1_EN_RX, 0x300)
+    FIELD(BNK1_EN_RX, BNK1_EN_RX, 0, 26)
+REG32(BNK1_SEL_RX0, 0x304)
+REG32(BNK1_SEL_RX1, 0x308)
+    FIELD(BNK1_SEL_RX1, BNK1_SEL_RX, 0, 20)
+REG32(BNK1_EN_RX_SCHMITT_HYST, 0x30c)
+    FIELD(BNK1_EN_RX_SCHMITT_HYST, BNK1_EN_RX_SCHMITT_HYST, 0, 26)
+REG32(BNK1_EN_WK_PD, 0x310)
+    FIELD(BNK1_EN_WK_PD, BNK1_EN_WK_PD, 0, 26)
+REG32(BNK1_EN_WK_PU, 0x314)
+    FIELD(BNK1_EN_WK_PU, BNK1_EN_WK_PU, 0, 26)
+REG32(BNK1_SEL_DRV0, 0x318)
+REG32(BNK1_SEL_DRV1, 0x31c)
+    FIELD(BNK1_SEL_DRV1, BNK1_SEL_DRV, 0, 20)
+REG32(BNK1_SEL_SLEW, 0x320)
+    FIELD(BNK1_SEL_SLEW, BNK1_SEL_SLEW, 0, 26)
+REG32(BNK1_EN_DFT_OPT_INV, 0x324)
+    FIELD(BNK1_EN_DFT_OPT_INV, BNK1_EN_DFT_OPT_INV, 0, 26)
+REG32(BNK1_EN_PAD2PAD_LOOPBACK, 0x328)
+    FIELD(BNK1_EN_PAD2PAD_LOOPBACK, BNK1_EN_PAD2PAD_LOOPBACK, 0, 13)
+REG32(BNK1_RX_SPARE0, 0x32c)
+REG32(BNK1_RX_SPARE1, 0x330)
+    FIELD(BNK1_RX_SPARE1, BNK1_RX_SPARE, 0, 20)
+REG32(BNK1_TX_SPARE0, 0x334)
+REG32(BNK1_TX_SPARE1, 0x338)
+    FIELD(BNK1_TX_SPARE1, BNK1_TX_SPARE, 0, 20)
+REG32(BNK1_SEL_EN1P8, 0x33c)
+    FIELD(BNK1_SEL_EN1P8, BNK1_SEL_EN1P8, 0, 1)
+REG32(BNK1_EN_B_POR_DETECT, 0x340)
+    FIELD(BNK1_EN_B_POR_DETECT, BNK1_EN_B_POR_DETECT, 0, 1)
+REG32(BNK1_LPF_BYP_POR_DETECT, 0x344)
+    FIELD(BNK1_LPF_BYP_POR_DETECT, BNK1_LPF_BYP_POR_DETECT, 0, 1)
+REG32(BNK1_EN_LATCH, 0x348)
+    FIELD(BNK1_EN_LATCH, BNK1_EN_LATCH, 0, 1)
+REG32(BNK1_VBG_LPF_BYP_B, 0x34c)
+    FIELD(BNK1_VBG_LPF_BYP_B, BNK1_VBG_LPF_BYP_B, 0, 1)
+REG32(BNK1_EN_AMP_B, 0x350)
+    FIELD(BNK1_EN_AMP_B, BNK1_EN_AMP_B, 0, 2)
+REG32(BNK1_SPARE_BIAS, 0x354)
+    FIELD(BNK1_SPARE_BIAS, BNK1_SPARE_BIAS, 0, 4)
+REG32(BNK1_DRIVER_BIAS, 0x358)
+    FIELD(BNK1_DRIVER_BIAS, BNK1_DRIVER_BIAS, 0, 15)
+REG32(BNK1_VMODE, 0x35c)
+    FIELD(BNK1_VMODE, BNK1_VMODE, 0, 1)
+REG32(BNK1_SEL_AUX_IO_RX, 0x360)
+    FIELD(BNK1_SEL_AUX_IO_RX, BNK1_SEL_AUX_IO_RX, 0, 26)
+REG32(BNK1_EN_TX_HS_MODE, 0x364)
+    FIELD(BNK1_EN_TX_HS_MODE, BNK1_EN_TX_HS_MODE, 0, 26)
+REG32(SD0_CLK_CTRL, 0x400)
+    FIELD(SD0_CLK_CTRL, SDIO0_FBCLK_SEL, 2, 1)
+    FIELD(SD0_CLK_CTRL, SDIO0_RX_SRC_SEL, 0, 2)
+REG32(SD0_CTRL_REG, 0x404)
+    FIELD(SD0_CTRL_REG, SD0_EMMC_SEL, 0, 1)
+REG32(SD0_CONFIG_REG1, 0x410)
+    FIELD(SD0_CONFIG_REG1, SD0_BASECLK, 7, 8)
+    FIELD(SD0_CONFIG_REG1, SD0_TUNIGCOUNT, 1, 6)
+    FIELD(SD0_CONFIG_REG1, SD0_ASYNCWKPENA, 0, 1)
+REG32(SD0_CONFIG_REG2, 0x414)
+    FIELD(SD0_CONFIG_REG2, SD0_SLOTTYPE, 12, 2)
+    FIELD(SD0_CONFIG_REG2, SD0_ASYCINTR, 11, 1)
+    FIELD(SD0_CONFIG_REG2, SD0_64BIT, 10, 1)
+    FIELD(SD0_CONFIG_REG2, SD0_1P8V, 9, 1)
+    FIELD(SD0_CONFIG_REG2, SD0_3P0V, 8, 1)
+    FIELD(SD0_CONFIG_REG2, SD0_3P3V, 7, 1)
+    FIELD(SD0_CONFIG_REG2, SD0_SUSPRES, 6, 1)
+    FIELD(SD0_CONFIG_REG2, SD0_SDMA, 5, 1)
+    FIELD(SD0_CONFIG_REG2, SD0_HIGHSPEED, 4, 1)
+    FIELD(SD0_CONFIG_REG2, SD0_ADMA2, 3, 1)
+    FIELD(SD0_CONFIG_REG2, SD0_8BIT, 2, 1)
+    FIELD(SD0_CONFIG_REG2, SD0_MAXBLK, 0, 2)
+REG32(SD0_CONFIG_REG3, 0x418)
+    FIELD(SD0_CONFIG_REG3, SD0_TUNINGSDR50, 10, 1)
+    FIELD(SD0_CONFIG_REG3, SD0_RETUNETMR, 6, 4)
+    FIELD(SD0_CONFIG_REG3, SD0_DDRIVER, 5, 1)
+    FIELD(SD0_CONFIG_REG3, SD0_CDRIVER, 4, 1)
+    FIELD(SD0_CONFIG_REG3, SD0_ADRIVER, 3, 1)
+    FIELD(SD0_CONFIG_REG3, SD0_DDR50, 2, 1)
+    FIELD(SD0_CONFIG_REG3, SD0_SDR104, 1, 1)
+    FIELD(SD0_CONFIG_REG3, SD0_SDR50, 0, 1)
+REG32(SD0_INITPRESET, 0x41c)
+    FIELD(SD0_INITPRESET, SD0_INITPRESET, 0, 13)
+REG32(SD0_DSPPRESET, 0x420)
+    FIELD(SD0_DSPPRESET, SD0_DSPPRESET, 0, 13)
+REG32(SD0_HSPDPRESET, 0x424)
+    FIELD(SD0_HSPDPRESET, SD0_HSPDPRESET, 0, 13)
+REG32(SD0_SDR12PRESET, 0x428)
+    FIELD(SD0_SDR12PRESET, SD0_SDR12PRESET, 0, 13)
+REG32(SD0_SDR25PRESET, 0x42c)
+    FIELD(SD0_SDR25PRESET, SD0_SDR25PRESET, 0, 13)
+REG32(SD0_SDR50PRSET, 0x430)
+    FIELD(SD0_SDR50PRSET, SD0_SDR50PRESET, 0, 13)
+REG32(SD0_SDR104PRST, 0x434)
+    FIELD(SD0_SDR104PRST, SD0_SDR104PRESET, 0, 13)
+REG32(SD0_DDR50PRESET, 0x438)
+    FIELD(SD0_DDR50PRESET, SD0_DDR50PRESET, 0, 13)
+REG32(SD0_MAXCUR1P8, 0x43c)
+    FIELD(SD0_MAXCUR1P8, SD0_MAXCUR1P8, 0, 8)
+REG32(SD0_MAXCUR3P0, 0x440)
+    FIELD(SD0_MAXCUR3P0, SD0_MAXCUR3P0, 0, 8)
+REG32(SD0_MAXCUR3P3, 0x444)
+    FIELD(SD0_MAXCUR3P3, SD0_MAXCUR3P3, 0, 8)
+REG32(SD0_DLL_CTRL, 0x448)
+    FIELD(SD0_DLL_CTRL, SD0_CLKSTABLE_CFG, 9, 1)
+    FIELD(SD0_DLL_CTRL, SD0_DLL_CFG, 5, 4)
+    FIELD(SD0_DLL_CTRL, SD0_DLL_PSDONE, 4, 1)
+    FIELD(SD0_DLL_CTRL, SD0_DLL_OVF, 3, 1)
+    FIELD(SD0_DLL_CTRL, SD0_DLL_RST, 2, 1)
+    FIELD(SD0_DLL_CTRL, SD0_DLL_TESTMODE, 1, 1)
+    FIELD(SD0_DLL_CTRL, SD0_DLL_LOCK, 0, 1)
+REG32(SD0_CDN_CTRL, 0x44c)
+    FIELD(SD0_CDN_CTRL, SD0_CDN_CTRL, 0, 1)
+REG32(SD0_DLL_TEST, 0x450)
+    FIELD(SD0_DLL_TEST, DLL_DIV, 16, 8)
+    FIELD(SD0_DLL_TEST, DLL_TX_SEL, 9, 7)
+    FIELD(SD0_DLL_TEST, DLL_RX_SEL, 0, 9)
+REG32(SD0_RX_TUNING_SEL, 0x454)
+    FIELD(SD0_RX_TUNING_SEL, SD0_RX_SEL, 0, 9)
+REG32(SD0_DLL_DIV_MAP0, 0x458)
+    FIELD(SD0_DLL_DIV_MAP0, DIV_3, 24, 8)
+    FIELD(SD0_DLL_DIV_MAP0, DIV_2, 16, 8)
+    FIELD(SD0_DLL_DIV_MAP0, DIV_1, 8, 8)
+    FIELD(SD0_DLL_DIV_MAP0, DIV_0, 0, 8)
+REG32(SD0_DLL_DIV_MAP1, 0x45c)
+    FIELD(SD0_DLL_DIV_MAP1, DIV_7, 24, 8)
+    FIELD(SD0_DLL_DIV_MAP1, DIV_6, 16, 8)
+    FIELD(SD0_DLL_DIV_MAP1, DIV_5, 8, 8)
+    FIELD(SD0_DLL_DIV_MAP1, DIV_4, 0, 8)
+REG32(SD0_IOU_COHERENT_CTRL, 0x460)
+    FIELD(SD0_IOU_COHERENT_CTRL, SD0_AXI_COH, 0, 4)
+REG32(SD0_IOU_INTERCONNECT_ROUTE, 0x464)
+    FIELD(SD0_IOU_INTERCONNECT_ROUTE, SD0, 0, 1)
+REG32(SD0_IOU_RAM, 0x468)
+    FIELD(SD0_IOU_RAM, EMASA0, 6, 1)
+    FIELD(SD0_IOU_RAM, EMAB0, 3, 3)
+    FIELD(SD0_IOU_RAM, EMAA0, 0, 3)
+REG32(SD0_IOU_INTERCONNECT_QOS, 0x46c)
+    FIELD(SD0_IOU_INTERCONNECT_QOS, SD0_QOS, 0, 4)
+REG32(SD1_CLK_CTRL, 0x480)
+    FIELD(SD1_CLK_CTRL, SDIO1_FBCLK_SEL, 1, 1)
+    FIELD(SD1_CLK_CTRL, SDIO1_RX_SRC_SEL, 0, 1)
+REG32(SD1_CTRL_REG, 0x484)
+    FIELD(SD1_CTRL_REG, SD1_EMMC_SEL, 0, 1)
+REG32(SD1_CONFIG_REG1, 0x490)
+    FIELD(SD1_CONFIG_REG1, SD1_BASECLK, 7, 8)
+    FIELD(SD1_CONFIG_REG1, SD1_TUNIGCOUNT, 1, 6)
+    FIELD(SD1_CONFIG_REG1, SD1_ASYNCWKPENA, 0, 1)
+REG32(SD1_CONFIG_REG2, 0x494)
+    FIELD(SD1_CONFIG_REG2, SD1_SLOTTYPE, 12, 2)
+    FIELD(SD1_CONFIG_REG2, SD1_ASYCINTR, 11, 1)
+    FIELD(SD1_CONFIG_REG2, SD1_64BIT, 10, 1)
+    FIELD(SD1_CONFIG_REG2, SD1_1P8V, 9, 1)
+    FIELD(SD1_CONFIG_REG2, SD1_3P0V, 8, 1)
+    FIELD(SD1_CONFIG_REG2, SD1_3P3V, 7, 1)
+    FIELD(SD1_CONFIG_REG2, SD1_SUSPRES, 6, 1)
+    FIELD(SD1_CONFIG_REG2, SD1_SDMA, 5, 1)
+    FIELD(SD1_CONFIG_REG2, SD1_HIGHSPEED, 4, 1)
+    FIELD(SD1_CONFIG_REG2, SD1_ADMA2, 3, 1)
+    FIELD(SD1_CONFIG_REG2, SD1_8BIT, 2, 1)
+    FIELD(SD1_CONFIG_REG2, SD1_MAXBLK, 0, 2)
+REG32(SD1_CONFIG_REG3, 0x498)
+    FIELD(SD1_CONFIG_REG3, SD1_TUNINGSDR50, 10, 1)
+    FIELD(SD1_CONFIG_REG3, SD1_RETUNETMR, 6, 4)
+    FIELD(SD1_CONFIG_REG3, SD1_DDRIVER, 5, 1)
+    FIELD(SD1_CONFIG_REG3, SD1_CDRIVER, 4, 1)
+    FIELD(SD1_CONFIG_REG3, SD1_ADRIVER, 3, 1)
+    FIELD(SD1_CONFIG_REG3, SD1_DDR50, 2, 1)
+    FIELD(SD1_CONFIG_REG3, SD1_SDR104, 1, 1)
+    FIELD(SD1_CONFIG_REG3, SD1_SDR50, 0, 1)
+REG32(SD1_INITPRESET, 0x49c)
+    FIELD(SD1_INITPRESET, SD1_INITPRESET, 0, 13)
+REG32(SD1_DSPPRESET, 0x4a0)
+    FIELD(SD1_DSPPRESET, SD1_DSPPRESET, 0, 13)
+REG32(SD1_HSPDPRESET, 0x4a4)
+    FIELD(SD1_HSPDPRESET, SD1_HSPDPRESET, 0, 13)
+REG32(SD1_SDR12PRESET, 0x4a8)
+    FIELD(SD1_SDR12PRESET, SD1_SDR12PRESET, 0, 13)
+REG32(SD1_SDR25PRESET, 0x4ac)
+    FIELD(SD1_SDR25PRESET, SD1_SDR25PRESET, 0, 13)
+REG32(SD1_SDR50PRSET, 0x4b0)
+    FIELD(SD1_SDR50PRSET, SD1_SDR50PRESET, 0, 13)
+REG32(SD1_SDR104PRST, 0x4b4)
+    FIELD(SD1_SDR104PRST, SD1_SDR104PRESET, 0, 13)
+REG32(SD1_DDR50PRESET, 0x4b8)
+    FIELD(SD1_DDR50PRESET, SD1_DDR50PRESET, 0, 13)
+REG32(SD1_MAXCUR1P8, 0x4bc)
+    FIELD(SD1_MAXCUR1P8, SD1_MAXCUR1P8, 0, 8)
+REG32(SD1_MAXCUR3P0, 0x4c0)
+    FIELD(SD1_MAXCUR3P0, SD1_MAXCUR3P0, 0, 8)
+REG32(SD1_MAXCUR3P3, 0x4c4)
+    FIELD(SD1_MAXCUR3P3, SD1_MAXCUR3P3, 0, 8)
+REG32(SD1_DLL_CTRL, 0x4c8)
+    FIELD(SD1_DLL_CTRL, SD1_CLKSTABLE_CFG, 9, 1)
+    FIELD(SD1_DLL_CTRL, SD1_DLL_CFG, 5, 4)
+    FIELD(SD1_DLL_CTRL, SD1_DLL_PSDONE, 4, 1)
+    FIELD(SD1_DLL_CTRL, SD1_DLL_OVF, 3, 1)
+    FIELD(SD1_DLL_CTRL, SD1_DLL_RST, 2, 1)
+    FIELD(SD1_DLL_CTRL, SD1_DLL_TESTMODE, 1, 1)
+    FIELD(SD1_DLL_CTRL, SD1_DLL_LOCK, 0, 1)
+REG32(SD1_CDN_CTRL, 0x4cc)
+    FIELD(SD1_CDN_CTRL, SD1_CDN_CTRL, 0, 1)
+REG32(SD1_DLL_TEST, 0x4d0)
+    FIELD(SD1_DLL_TEST, DLL_DIV, 16, 8)
+    FIELD(SD1_DLL_TEST, DLL_TX_SEL, 9, 7)
+    FIELD(SD1_DLL_TEST, DLL_RX_SEL, 0, 9)
+REG32(SD1_RX_TUNING_SEL, 0x4d4)
+    FIELD(SD1_RX_TUNING_SEL, SD1_RX_SEL, 0, 9)
+REG32(SD1_DLL_DIV_MAP0, 0x4d8)
+    FIELD(SD1_DLL_DIV_MAP0, DIV_3, 24, 8)
+    FIELD(SD1_DLL_DIV_MAP0, DIV_2, 16, 8)
+    FIELD(SD1_DLL_DIV_MAP0, DIV_1, 8, 8)
+    FIELD(SD1_DLL_DIV_MAP0, DIV_0, 0, 8)
+REG32(SD1_DLL_DIV_MAP1, 0x4dc)
+    FIELD(SD1_DLL_DIV_MAP1, DIV_7, 24, 8)
+    FIELD(SD1_DLL_DIV_MAP1, DIV_6, 16, 8)
+    FIELD(SD1_DLL_DIV_MAP1, DIV_5, 8, 8)
+    FIELD(SD1_DLL_DIV_MAP1, DIV_4, 0, 8)
+REG32(SD1_IOU_COHERENT_CTRL, 0x4e0)
+    FIELD(SD1_IOU_COHERENT_CTRL, SD1_AXI_COH, 0, 4)
+REG32(SD1_IOU_INTERCONNECT_ROUTE, 0x4e4)
+    FIELD(SD1_IOU_INTERCONNECT_ROUTE, SD1, 0, 1)
+REG32(SD1_IOU_RAM, 0x4e8)
+    FIELD(SD1_IOU_RAM, EMASA0, 6, 1)
+    FIELD(SD1_IOU_RAM, EMAB0, 3, 3)
+    FIELD(SD1_IOU_RAM, EMAA0, 0, 3)
+REG32(SD1_IOU_INTERCONNECT_QOS, 0x4ec)
+    FIELD(SD1_IOU_INTERCONNECT_QOS, SD1_QOS, 0, 4)
+REG32(OSPI_QSPI_IOU_AXI_MUX_SEL, 0x504)
+    FIELD(OSPI_QSPI_IOU_AXI_MUX_SEL, OSPI_MUX_SEL, 1, 1)
+    FIELD(OSPI_QSPI_IOU_AXI_MUX_SEL, QSPI_OSPI_MUX_SEL, 0, 1)
+REG32(QSPI_IOU_COHERENT_CTRL, 0x508)
+    FIELD(QSPI_IOU_COHERENT_CTRL, QSPI_AXI_COH, 0, 4)
+REG32(QSPI_IOU_INTERCONNECT_ROUTE, 0x50c)
+    FIELD(QSPI_IOU_INTERCONNECT_ROUTE, QSPI, 0, 1)
+REG32(QSPI_IOU_RAM, 0x510)
+    FIELD(QSPI_IOU_RAM, EMASA1, 13, 1)
+    FIELD(QSPI_IOU_RAM, EMAB1, 10, 3)
+    FIELD(QSPI_IOU_RAM, EMAA1, 7, 3)
+    FIELD(QSPI_IOU_RAM, EMASA0, 6, 1)
+    FIELD(QSPI_IOU_RAM, EMAB0, 3, 3)
+    FIELD(QSPI_IOU_RAM, EMAA0, 0, 3)
+REG32(QSPI_IOU_INTERCONNECT_QOS, 0x514)
+    FIELD(QSPI_IOU_INTERCONNECT_QOS, QSPI_QOS, 0, 4)
+REG32(OSPI_IOU_COHERENT_CTRL, 0x530)
+    FIELD(OSPI_IOU_COHERENT_CTRL, OSPI_AXI_COH, 0, 4)
+REG32(OSPI_IOU_INTERCONNECT_ROUTE, 0x534)
+    FIELD(OSPI_IOU_INTERCONNECT_ROUTE, OSPI, 0, 1)
+REG32(OSPI_IOU_RAM, 0x538)
+    FIELD(OSPI_IOU_RAM, EMAS0, 5, 1)
+    FIELD(OSPI_IOU_RAM, EMAW0, 3, 2)
+    FIELD(OSPI_IOU_RAM, EMA0, 0, 3)
+REG32(OSPI_IOU_INTERCONNECT_QOS, 0x53c)
+    FIELD(OSPI_IOU_INTERCONNECT_QOS, OSPI_QOS, 0, 4)
+REG32(OSPI_REFCLK_DLY_CTRL, 0x540)
+    FIELD(OSPI_REFCLK_DLY_CTRL, DLY1, 3, 2)
+    FIELD(OSPI_REFCLK_DLY_CTRL, DLY0, 0, 3)
+REG32(CUR_PWR_ST, 0x600)
+    FIELD(CUR_PWR_ST, U2PMU, 0, 2)
+REG32(CONNECT_ST, 0x604)
+    FIELD(CONNECT_ST, U2PMU, 0, 1)
+REG32(PW_STATE_REQ, 0x608)
+    FIELD(PW_STATE_REQ, BIT_1_0, 0, 2)
+REG32(HOST_U2_PORT_DISABLE, 0x60c)
+    FIELD(HOST_U2_PORT_DISABLE, BIT_0, 0, 1)
+REG32(DBG_U2PMU, 0x610)
+REG32(DBG_U2PMU_EXT1, 0x614)
+REG32(DBG_U2PMU_EXT2, 0x618)
+    FIELD(DBG_U2PMU_EXT2, BIT_67_64, 0, 4)
+REG32(PME_GEN_U2PMU, 0x61c)
+    FIELD(PME_GEN_U2PMU, BIT_0, 0, 1)
+REG32(PWR_CONFIG_USB2, 0x620)
+    FIELD(PWR_CONFIG_USB2, STRAP, 0, 30)
+REG32(PHY_HUB, 0x624)
+    FIELD(PHY_HUB, VBUS_CTRL, 1, 1)
+    FIELD(PHY_HUB, OVER_CURRENT, 0, 1)
+REG32(CTRL, 0x700)
+    FIELD(CTRL, SLVERR_ENABLE, 0, 1)
+REG32(ISR, 0x800)
+    FIELD(ISR, ADDR_DECODE_ERR, 0, 1)
+REG32(IMR, 0x804)
+    FIELD(IMR, ADDR_DECODE_ERR, 0, 1)
+REG32(IER, 0x808)
+    FIELD(IER, ADDR_DECODE_ERR, 0, 1)
+REG32(IDR, 0x80c)
+    FIELD(IDR, ADDR_DECODE_ERR, 0, 1)
+REG32(ITR, 0x810)
+    FIELD(ITR, ADDR_DECODE_ERR, 0, 1)
+REG32(PARITY_ISR, 0x814)
+    FIELD(PARITY_ISR, PERR_AXI_SD1_IOU, 12, 1)
+    FIELD(PARITY_ISR, PERR_AXI_SD0_IOU, 11, 1)
+    FIELD(PARITY_ISR, PERR_AXI_QSPI_IOU, 10, 1)
+    FIELD(PARITY_ISR, PERR_AXI_OSPI_IOU, 9, 1)
+    FIELD(PARITY_ISR, PERR_IOU_SD1, 8, 1)
+    FIELD(PARITY_ISR, PERR_IOU_SD0, 7, 1)
+    FIELD(PARITY_ISR, PERR_IOU_QSPI1, 6, 1)
+    FIELD(PARITY_ISR, PERR_IOUSLCR_SECURE_APB, 5, 1)
+    FIELD(PARITY_ISR, PERR_IOUSLCR_APB, 4, 1)
+    FIELD(PARITY_ISR, PERR_QSPI0_APB, 3, 1)
+    FIELD(PARITY_ISR, PERR_OSPI_APB, 2, 1)
+    FIELD(PARITY_ISR, PERR_I2C_APB, 1, 1)
+    FIELD(PARITY_ISR, PERR_GPIO_APB, 0, 1)
+REG32(PARITY_IMR, 0x818)
+    FIELD(PARITY_IMR, PERR_AXI_SD1_IOU, 12, 1)
+    FIELD(PARITY_IMR, PERR_AXI_SD0_IOU, 11, 1)
+    FIELD(PARITY_IMR, PERR_AXI_QSPI_IOU, 10, 1)
+    FIELD(PARITY_IMR, PERR_AXI_OSPI_IOU, 9, 1)
+    FIELD(PARITY_IMR, PERR_IOU_SD1, 8, 1)
+    FIELD(PARITY_IMR, PERR_IOU_SD0, 7, 1)
+    FIELD(PARITY_IMR, PERR_IOU_QSPI1, 6, 1)
+    FIELD(PARITY_IMR, PERR_IOUSLCR_SECURE_APB, 5, 1)
+    FIELD(PARITY_IMR, PERR_IOUSLCR_APB, 4, 1)
+    FIELD(PARITY_IMR, PERR_QSPI0_APB, 3, 1)
+    FIELD(PARITY_IMR, PERR_OSPI_APB, 2, 1)
+    FIELD(PARITY_IMR, PERR_I2C_APB, 1, 1)
+    FIELD(PARITY_IMR, PERR_GPIO_APB, 0, 1)
+REG32(PARITY_IER, 0x81c)
+    FIELD(PARITY_IER, PERR_AXI_SD1_IOU, 12, 1)
+    FIELD(PARITY_IER, PERR_AXI_SD0_IOU, 11, 1)
+    FIELD(PARITY_IER, PERR_AXI_QSPI_IOU, 10, 1)
+    FIELD(PARITY_IER, PERR_AXI_OSPI_IOU, 9, 1)
+    FIELD(PARITY_IER, PERR_IOU_SD1, 8, 1)
+    FIELD(PARITY_IER, PERR_IOU_SD0, 7, 1)
+    FIELD(PARITY_IER, PERR_IOU_QSPI1, 6, 1)
+    FIELD(PARITY_IER, PERR_IOUSLCR_SECURE_APB, 5, 1)
+    FIELD(PARITY_IER, PERR_IOUSLCR_APB, 4, 1)
+    FIELD(PARITY_IER, PERR_QSPI0_APB, 3, 1)
+    FIELD(PARITY_IER, PERR_OSPI_APB, 2, 1)
+    FIELD(PARITY_IER, PERR_I2C_APB, 1, 1)
+    FIELD(PARITY_IER, PERR_GPIO_APB, 0, 1)
+REG32(PARITY_IDR, 0x820)
+    FIELD(PARITY_IDR, PERR_AXI_SD1_IOU, 12, 1)
+    FIELD(PARITY_IDR, PERR_AXI_SD0_IOU, 11, 1)
+    FIELD(PARITY_IDR, PERR_AXI_QSPI_IOU, 10, 1)
+    FIELD(PARITY_IDR, PERR_AXI_OSPI_IOU, 9, 1)
+    FIELD(PARITY_IDR, PERR_IOU_SD1, 8, 1)
+    FIELD(PARITY_IDR, PERR_IOU_SD0, 7, 1)
+    FIELD(PARITY_IDR, PERR_IOU_QSPI1, 6, 1)
+    FIELD(PARITY_IDR, PERR_IOUSLCR_SECURE_APB, 5, 1)
+    FIELD(PARITY_IDR, PERR_IOUSLCR_APB, 4, 1)
+    FIELD(PARITY_IDR, PERR_QSPI0_APB, 3, 1)
+    FIELD(PARITY_IDR, PERR_OSPI_APB, 2, 1)
+    FIELD(PARITY_IDR, PERR_I2C_APB, 1, 1)
+    FIELD(PARITY_IDR, PERR_GPIO_APB, 0, 1)
+REG32(PARITY_ITR, 0x824)
+    FIELD(PARITY_ITR, PERR_AXI_SD1_IOU, 12, 1)
+    FIELD(PARITY_ITR, PERR_AXI_SD0_IOU, 11, 1)
+    FIELD(PARITY_ITR, PERR_AXI_QSPI_IOU, 10, 1)
+    FIELD(PARITY_ITR, PERR_AXI_OSPI_IOU, 9, 1)
+    FIELD(PARITY_ITR, PERR_IOU_SD1, 8, 1)
+    FIELD(PARITY_ITR, PERR_IOU_SD0, 7, 1)
+    FIELD(PARITY_ITR, PERR_IOU_QSPI1, 6, 1)
+    FIELD(PARITY_ITR, PERR_IOUSLCR_SECURE_APB, 5, 1)
+    FIELD(PARITY_ITR, PERR_IOUSLCR_APB, 4, 1)
+    FIELD(PARITY_ITR, PERR_QSPI0_APB, 3, 1)
+    FIELD(PARITY_ITR, PERR_OSPI_APB, 2, 1)
+    FIELD(PARITY_ITR, PERR_I2C_APB, 1, 1)
+    FIELD(PARITY_ITR, PERR_GPIO_APB, 0, 1)
+REG32(WPROT0, 0x828)
+    FIELD(WPROT0, ACTIVE, 0, 1)
+
+static void parity_imr_update_irq(XlnxVersalPmcIouSlcr *s)
+{
+    bool pending = s->regs[R_PARITY_ISR] & ~s->regs[R_PARITY_IMR];
+    qemu_set_irq(s->irq_parity_imr, pending);
+}
+
+static void parity_isr_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+    parity_imr_update_irq(s);
+}
+
+static uint64_t parity_ier_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_PARITY_IMR] &= ~val;
+    parity_imr_update_irq(s);
+    return 0;
+}
+
+static uint64_t parity_idr_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_PARITY_IMR] |= val;
+    parity_imr_update_irq(s);
+    return 0;
+}
+
+static uint64_t parity_itr_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_PARITY_ISR] |= val;
+    parity_imr_update_irq(s);
+    return 0;
+}
+
+static void imr_update_irq(XlnxVersalPmcIouSlcr *s)
+{
+    bool pending = s->regs[R_ISR] & ~s->regs[R_IMR];
+    qemu_set_irq(s->irq_imr, pending);
+}
+
+static void isr_postw(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+    imr_update_irq(s);
+}
+
+static uint64_t ier_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IMR] &= ~val;
+    imr_update_irq(s);
+    return 0;
+}
+
+static uint64_t idr_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_IMR] |= val;
+    imr_update_irq(s);
+    return 0;
+}
+
+static uint64_t itr_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+    uint32_t val = val64;
+
+    s->regs[R_ISR] |= val;
+    imr_update_irq(s);
+    return 0;
+}
+
+static uint64_t sd0_ctrl_reg_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+    uint32_t prev = ARRAY_FIELD_EX32(s->regs, SD0_CTRL_REG, SD0_EMMC_SEL);
+
+    if (prev != (val64 & R_SD0_CTRL_REG_SD0_EMMC_SEL_MASK)) {
+        qemu_set_irq(s->sd_emmc_sel[0], !!val64);
+    }
+
+    return val64;
+}
+
+static uint64_t sd1_ctrl_reg_prew(RegisterInfo *reg, uint64_t val64)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+    uint32_t prev = ARRAY_FIELD_EX32(s->regs, SD1_CTRL_REG, SD1_EMMC_SEL);
+
+    if (prev != (val64 & R_SD1_CTRL_REG_SD1_EMMC_SEL_MASK)) {
+        qemu_set_irq(s->sd_emmc_sel[1], !!val64);
+    }
+
+    return val64;
+}
+
+static uint64_t ospi_qspi_iou_axi_mux_sel_prew(RegisterInfo *reg,
+                                               uint64_t val64)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(reg->opaque);
+    uint32_t val32 = (uint32_t) val64;
+    uint8_t ospi_mux_sel = FIELD_EX32(val32, OSPI_QSPI_IOU_AXI_MUX_SEL,
+                                      OSPI_MUX_SEL);
+    uint8_t qspi_ospi_mux_sel = FIELD_EX32(val32, OSPI_QSPI_IOU_AXI_MUX_SEL,
+                                      QSPI_OSPI_MUX_SEL);
+
+    if (ospi_mux_sel !=
+        ARRAY_FIELD_EX32(s->regs, OSPI_QSPI_IOU_AXI_MUX_SEL, OSPI_MUX_SEL)) {
+        qemu_set_irq(s->ospi_mux_sel, !!ospi_mux_sel);
+    }
+
+    if (qspi_ospi_mux_sel !=
+        ARRAY_FIELD_EX32(s->regs, OSPI_QSPI_IOU_AXI_MUX_SEL,
+                         QSPI_OSPI_MUX_SEL)) {
+        qemu_set_irq(s->qspi_ospi_mux_sel, !!qspi_ospi_mux_sel);
+    }
+
+    return val64;
+}
+
+static RegisterAccessInfo pmc_iou_slcr_regs_info[] = {
+    {   .name = "MIO_PIN_0",  .addr = A_MIO_PIN_0,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_1",  .addr = A_MIO_PIN_1,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_2",  .addr = A_MIO_PIN_2,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_3",  .addr = A_MIO_PIN_3,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_4",  .addr = A_MIO_PIN_4,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_5",  .addr = A_MIO_PIN_5,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_6",  .addr = A_MIO_PIN_6,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_7",  .addr = A_MIO_PIN_7,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_8",  .addr = A_MIO_PIN_8,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_9",  .addr = A_MIO_PIN_9,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_10",  .addr = A_MIO_PIN_10,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_11",  .addr = A_MIO_PIN_11,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_12",  .addr = A_MIO_PIN_12,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_13",  .addr = A_MIO_PIN_13,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_14",  .addr = A_MIO_PIN_14,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_15",  .addr = A_MIO_PIN_15,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_16",  .addr = A_MIO_PIN_16,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_17",  .addr = A_MIO_PIN_17,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_18",  .addr = A_MIO_PIN_18,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_19",  .addr = A_MIO_PIN_19,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_20",  .addr = A_MIO_PIN_20,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_21",  .addr = A_MIO_PIN_21,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_22",  .addr = A_MIO_PIN_22,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_23",  .addr = A_MIO_PIN_23,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_24",  .addr = A_MIO_PIN_24,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_25",  .addr = A_MIO_PIN_25,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_26",  .addr = A_MIO_PIN_26,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_27",  .addr = A_MIO_PIN_27,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_28",  .addr = A_MIO_PIN_28,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_29",  .addr = A_MIO_PIN_29,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_30",  .addr = A_MIO_PIN_30,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_31",  .addr = A_MIO_PIN_31,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_32",  .addr = A_MIO_PIN_32,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_33",  .addr = A_MIO_PIN_33,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_34",  .addr = A_MIO_PIN_34,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_35",  .addr = A_MIO_PIN_35,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_36",  .addr = A_MIO_PIN_36,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_37",  .addr = A_MIO_PIN_37,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_38",  .addr = A_MIO_PIN_38,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_39",  .addr = A_MIO_PIN_39,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_40",  .addr = A_MIO_PIN_40,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_41",  .addr = A_MIO_PIN_41,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_42",  .addr = A_MIO_PIN_42,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_43",  .addr = A_MIO_PIN_43,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_44",  .addr = A_MIO_PIN_44,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_45",  .addr = A_MIO_PIN_45,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_46",  .addr = A_MIO_PIN_46,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_47",  .addr = A_MIO_PIN_47,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_48",  .addr = A_MIO_PIN_48,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_49",  .addr = A_MIO_PIN_49,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_50",  .addr = A_MIO_PIN_50,
+        .rsvd = 0xfffffc01,
+    },{ .name = "MIO_PIN_51",  .addr = A_MIO_PIN_51,
+        .rsvd = 0xfffffc01,
+    },{ .name = "BNK0_EN_RX",  .addr = A_BNK0_EN_RX,
+        .reset = 0x3ffffff,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK0_SEL_RX0",  .addr = A_BNK0_SEL_RX0,
+        .reset = 0xffffffff,
+    },{ .name = "BNK0_SEL_RX1",  .addr = A_BNK0_SEL_RX1,
+        .reset = 0xfffff,
+        .rsvd = 0xfff00000,
+    },{ .name = "BNK0_EN_RX_SCHMITT_HYST",  .addr = A_BNK0_EN_RX_SCHMITT_HYST,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK0_EN_WK_PD",  .addr = A_BNK0_EN_WK_PD,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK0_EN_WK_PU",  .addr = A_BNK0_EN_WK_PU,
+        .reset = 0x3ffffff,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK0_SEL_DRV0",  .addr = A_BNK0_SEL_DRV0,
+        .reset = 0xffffffff,
+    },{ .name = "BNK0_SEL_DRV1",  .addr = A_BNK0_SEL_DRV1,
+        .reset = 0xfffff,
+        .rsvd = 0xfff00000,
+    },{ .name = "BNK0_SEL_SLEW",  .addr = A_BNK0_SEL_SLEW,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK0_EN_DFT_OPT_INV",  .addr = A_BNK0_EN_DFT_OPT_INV,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK0_EN_PAD2PAD_LOOPBACK",
+        .addr = A_BNK0_EN_PAD2PAD_LOOPBACK,
+        .rsvd = 0xffffe000,
+    },{ .name = "BNK0_RX_SPARE0",  .addr = A_BNK0_RX_SPARE0,
+    },{ .name = "BNK0_RX_SPARE1",  .addr = A_BNK0_RX_SPARE1,
+        .rsvd = 0xfff00000,
+    },{ .name = "BNK0_TX_SPARE0",  .addr = A_BNK0_TX_SPARE0,
+    },{ .name = "BNK0_TX_SPARE1",  .addr = A_BNK0_TX_SPARE1,
+        .rsvd = 0xfff00000,
+    },{ .name = "BNK0_SEL_EN1P8",  .addr = A_BNK0_SEL_EN1P8,
+        .rsvd = 0xfffffffe,
+    },{ .name = "BNK0_EN_B_POR_DETECT",  .addr = A_BNK0_EN_B_POR_DETECT,
+        .rsvd = 0xfffffffe,
+    },{ .name = "BNK0_LPF_BYP_POR_DETECT",  .addr = A_BNK0_LPF_BYP_POR_DETECT,
+        .reset = 0x1,
+        .rsvd = 0xfffffffe,
+    },{ .name = "BNK0_EN_LATCH",  .addr = A_BNK0_EN_LATCH,
+        .rsvd = 0xfffffffe,
+    },{ .name = "BNK0_VBG_LPF_BYP_B",  .addr = A_BNK0_VBG_LPF_BYP_B,
+        .reset = 0x1,
+        .rsvd = 0xfffffffe,
+    },{ .name = "BNK0_EN_AMP_B",  .addr = A_BNK0_EN_AMP_B,
+        .rsvd = 0xfffffffc,
+    },{ .name = "BNK0_SPARE_BIAS",  .addr = A_BNK0_SPARE_BIAS,
+        .rsvd = 0xfffffff0,
+    },{ .name = "BNK0_DRIVER_BIAS",  .addr = A_BNK0_DRIVER_BIAS,
+        .rsvd = 0xffff8000,
+    },{ .name = "BNK0_VMODE",  .addr = A_BNK0_VMODE,
+        .rsvd = 0xfffffffe,
+        .ro = 0x1,
+    },{ .name = "BNK0_SEL_AUX_IO_RX",  .addr = A_BNK0_SEL_AUX_IO_RX,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK0_EN_TX_HS_MODE",  .addr = A_BNK0_EN_TX_HS_MODE,
+        .rsvd = 0xfc000000,
+    },{ .name = "MIO_MST_TRI0",  .addr = A_MIO_MST_TRI0,
+        .reset = 0x3ffffff,
+        .rsvd = 0xfc000000,
+    },{ .name = "MIO_MST_TRI1",  .addr = A_MIO_MST_TRI1,
+        .reset = 0x3ffffff,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK1_EN_RX",  .addr = A_BNK1_EN_RX,
+        .reset = 0x3ffffff,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK1_SEL_RX0",  .addr = A_BNK1_SEL_RX0,
+        .reset = 0xffffffff,
+    },{ .name = "BNK1_SEL_RX1",  .addr = A_BNK1_SEL_RX1,
+        .reset = 0xfffff,
+        .rsvd = 0xfff00000,
+    },{ .name = "BNK1_EN_RX_SCHMITT_HYST",  .addr = A_BNK1_EN_RX_SCHMITT_HYST,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK1_EN_WK_PD",  .addr = A_BNK1_EN_WK_PD,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK1_EN_WK_PU",  .addr = A_BNK1_EN_WK_PU,
+        .reset = 0x3ffffff,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK1_SEL_DRV0",  .addr = A_BNK1_SEL_DRV0,
+        .reset = 0xffffffff,
+    },{ .name = "BNK1_SEL_DRV1",  .addr = A_BNK1_SEL_DRV1,
+        .reset = 0xfffff,
+        .rsvd = 0xfff00000,
+    },{ .name = "BNK1_SEL_SLEW",  .addr = A_BNK1_SEL_SLEW,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK1_EN_DFT_OPT_INV",  .addr = A_BNK1_EN_DFT_OPT_INV,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK1_EN_PAD2PAD_LOOPBACK",
+        .addr = A_BNK1_EN_PAD2PAD_LOOPBACK,
+        .rsvd = 0xffffe000,
+    },{ .name = "BNK1_RX_SPARE0",  .addr = A_BNK1_RX_SPARE0,
+    },{ .name = "BNK1_RX_SPARE1",  .addr = A_BNK1_RX_SPARE1,
+        .rsvd = 0xfff00000,
+    },{ .name = "BNK1_TX_SPARE0",  .addr = A_BNK1_TX_SPARE0,
+    },{ .name = "BNK1_TX_SPARE1",  .addr = A_BNK1_TX_SPARE1,
+        .rsvd = 0xfff00000,
+    },{ .name = "BNK1_SEL_EN1P8",  .addr = A_BNK1_SEL_EN1P8,
+        .rsvd = 0xfffffffe,
+    },{ .name = "BNK1_EN_B_POR_DETECT",  .addr = A_BNK1_EN_B_POR_DETECT,
+        .rsvd = 0xfffffffe,
+    },{ .name = "BNK1_LPF_BYP_POR_DETECT",  .addr = A_BNK1_LPF_BYP_POR_DETECT,
+        .reset = 0x1,
+        .rsvd = 0xfffffffe,
+    },{ .name = "BNK1_EN_LATCH",  .addr = A_BNK1_EN_LATCH,
+        .rsvd = 0xfffffffe,
+    },{ .name = "BNK1_VBG_LPF_BYP_B",  .addr = A_BNK1_VBG_LPF_BYP_B,
+        .reset = 0x1,
+        .rsvd = 0xfffffffe,
+    },{ .name = "BNK1_EN_AMP_B",  .addr = A_BNK1_EN_AMP_B,
+        .rsvd = 0xfffffffc,
+    },{ .name = "BNK1_SPARE_BIAS",  .addr = A_BNK1_SPARE_BIAS,
+        .rsvd = 0xfffffff0,
+    },{ .name = "BNK1_DRIVER_BIAS",  .addr = A_BNK1_DRIVER_BIAS,
+        .rsvd = 0xffff8000,
+    },{ .name = "BNK1_VMODE",  .addr = A_BNK1_VMODE,
+        .rsvd = 0xfffffffe,
+        .ro = 0x1,
+    },{ .name = "BNK1_SEL_AUX_IO_RX",  .addr = A_BNK1_SEL_AUX_IO_RX,
+        .rsvd = 0xfc000000,
+    },{ .name = "BNK1_EN_TX_HS_MODE",  .addr = A_BNK1_EN_TX_HS_MODE,
+        .rsvd = 0xfc000000,
+    },{ .name = "SD0_CLK_CTRL",  .addr = A_SD0_CLK_CTRL,
+        .rsvd = 0xfffffff8,
+    },{ .name = "SD0_CTRL_REG",  .addr = A_SD0_CTRL_REG,
+        .rsvd = 0xfffffffe,
+        .pre_write = sd0_ctrl_reg_prew,
+    },{ .name = "SD0_CONFIG_REG1",  .addr = A_SD0_CONFIG_REG1,
+        .reset = 0x3250,
+        .rsvd = 0xffff8000,
+    },{ .name = "SD0_CONFIG_REG2",  .addr = A_SD0_CONFIG_REG2,
+        .reset = 0xffc,
+        .rsvd = 0xffffc000,
+    },{ .name = "SD0_CONFIG_REG3",  .addr = A_SD0_CONFIG_REG3,
+        .reset = 0x407,
+        .rsvd = 0xfffff800,
+    },{ .name = "SD0_INITPRESET",  .addr = A_SD0_INITPRESET,
+        .reset = 0x100,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD0_DSPPRESET",  .addr = A_SD0_DSPPRESET,
+        .reset = 0x4,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD0_HSPDPRESET",  .addr = A_SD0_HSPDPRESET,
+        .reset = 0x2,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD0_SDR12PRESET",  .addr = A_SD0_SDR12PRESET,
+        .reset = 0x4,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD0_SDR25PRESET",  .addr = A_SD0_SDR25PRESET,
+        .reset = 0x2,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD0_SDR50PRSET",  .addr = A_SD0_SDR50PRSET,
+        .reset = 0x1,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD0_SDR104PRST",  .addr = A_SD0_SDR104PRST,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD0_DDR50PRESET",  .addr = A_SD0_DDR50PRESET,
+        .reset = 0x2,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD0_MAXCUR1P8",  .addr = A_SD0_MAXCUR1P8,
+        .rsvd = 0xffffff00,
+    },{ .name = "SD0_MAXCUR3P0",  .addr = A_SD0_MAXCUR3P0,
+        .rsvd = 0xffffff00,
+    },{ .name = "SD0_MAXCUR3P3",  .addr = A_SD0_MAXCUR3P3,
+        .rsvd = 0xffffff00,
+    },{ .name = "SD0_DLL_CTRL",  .addr = A_SD0_DLL_CTRL,
+        .reset = 0x1,
+        .rsvd = 0xfffffc00,
+        .ro = 0x19,
+    },{ .name = "SD0_CDN_CTRL",  .addr = A_SD0_CDN_CTRL,
+        .rsvd = 0xfffffffe,
+    },{ .name = "SD0_DLL_TEST",  .addr = A_SD0_DLL_TEST,
+        .rsvd = 0xff000000,
+    },{ .name = "SD0_RX_TUNING_SEL",  .addr = A_SD0_RX_TUNING_SEL,
+        .rsvd = 0xfffffe00,
+        .ro = 0x1ff,
+    },{ .name = "SD0_DLL_DIV_MAP0",  .addr = A_SD0_DLL_DIV_MAP0,
+        .reset = 0x50505050,
+    },{ .name = "SD0_DLL_DIV_MAP1",  .addr = A_SD0_DLL_DIV_MAP1,
+        .reset = 0x50505050,
+    },{ .name = "SD0_IOU_COHERENT_CTRL",  .addr = A_SD0_IOU_COHERENT_CTRL,
+        .rsvd = 0xfffffff0,
+    },{ .name = "SD0_IOU_INTERCONNECT_ROUTE",
+        .addr = A_SD0_IOU_INTERCONNECT_ROUTE,
+        .rsvd = 0xfffffffe,
+    },{ .name = "SD0_IOU_RAM",  .addr = A_SD0_IOU_RAM,
+        .reset = 0x24,
+        .rsvd = 0xffffff80,
+    },{ .name = "SD0_IOU_INTERCONNECT_QOS",
+        .addr = A_SD0_IOU_INTERCONNECT_QOS,
+        .rsvd = 0xfffffff0,
+    },{ .name = "SD1_CLK_CTRL",  .addr = A_SD1_CLK_CTRL,
+        .rsvd = 0xfffffffc,
+    },{ .name = "SD1_CTRL_REG",  .addr = A_SD1_CTRL_REG,
+        .rsvd = 0xfffffffe,
+        .pre_write = sd1_ctrl_reg_prew,
+    },{ .name = "SD1_CONFIG_REG1",  .addr = A_SD1_CONFIG_REG1,
+        .reset = 0x3250,
+        .rsvd = 0xffff8000,
+    },{ .name = "SD1_CONFIG_REG2",  .addr = A_SD1_CONFIG_REG2,
+        .reset = 0xffc,
+        .rsvd = 0xffffc000,
+    },{ .name = "SD1_CONFIG_REG3",  .addr = A_SD1_CONFIG_REG3,
+        .reset = 0x407,
+        .rsvd = 0xfffff800,
+    },{ .name = "SD1_INITPRESET",  .addr = A_SD1_INITPRESET,
+        .reset = 0x100,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD1_DSPPRESET",  .addr = A_SD1_DSPPRESET,
+        .reset = 0x4,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD1_HSPDPRESET",  .addr = A_SD1_HSPDPRESET,
+        .reset = 0x2,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD1_SDR12PRESET",  .addr = A_SD1_SDR12PRESET,
+        .reset = 0x4,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD1_SDR25PRESET",  .addr = A_SD1_SDR25PRESET,
+        .reset = 0x2,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD1_SDR50PRSET",  .addr = A_SD1_SDR50PRSET,
+        .reset = 0x1,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD1_SDR104PRST",  .addr = A_SD1_SDR104PRST,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD1_DDR50PRESET",  .addr = A_SD1_DDR50PRESET,
+        .reset = 0x2,
+        .rsvd = 0xffffe000,
+    },{ .name = "SD1_MAXCUR1P8",  .addr = A_SD1_MAXCUR1P8,
+        .rsvd = 0xffffff00,
+    },{ .name = "SD1_MAXCUR3P0",  .addr = A_SD1_MAXCUR3P0,
+        .rsvd = 0xffffff00,
+    },{ .name = "SD1_MAXCUR3P3",  .addr = A_SD1_MAXCUR3P3,
+        .rsvd = 0xffffff00,
+    },{ .name = "SD1_DLL_CTRL",  .addr = A_SD1_DLL_CTRL,
+        .reset = 0x1,
+        .rsvd = 0xfffffc00,
+        .ro = 0x19,
+    },{ .name = "SD1_CDN_CTRL",  .addr = A_SD1_CDN_CTRL,
+        .rsvd = 0xfffffffe,
+    },{ .name = "SD1_DLL_TEST",  .addr = A_SD1_DLL_TEST,
+        .rsvd = 0xff000000,
+    },{ .name = "SD1_RX_TUNING_SEL",  .addr = A_SD1_RX_TUNING_SEL,
+        .rsvd = 0xfffffe00,
+        .ro = 0x1ff,
+    },{ .name = "SD1_DLL_DIV_MAP0",  .addr = A_SD1_DLL_DIV_MAP0,
+        .reset = 0x50505050,
+    },{ .name = "SD1_DLL_DIV_MAP1",  .addr = A_SD1_DLL_DIV_MAP1,
+        .reset = 0x50505050,
+    },{ .name = "SD1_IOU_COHERENT_CTRL",  .addr = A_SD1_IOU_COHERENT_CTRL,
+        .rsvd = 0xfffffff0,
+    },{ .name = "SD1_IOU_INTERCONNECT_ROUTE",
+        .addr = A_SD1_IOU_INTERCONNECT_ROUTE,
+        .rsvd = 0xfffffffe,
+    },{ .name = "SD1_IOU_RAM",  .addr = A_SD1_IOU_RAM,
+        .reset = 0x24,
+        .rsvd = 0xffffff80,
+    },{ .name = "SD1_IOU_INTERCONNECT_QOS",
+        .addr = A_SD1_IOU_INTERCONNECT_QOS,
+        .rsvd = 0xfffffff0,
+    },{ .name = "OSPI_QSPI_IOU_AXI_MUX_SEL",
+        .addr = A_OSPI_QSPI_IOU_AXI_MUX_SEL,
+        .reset = 0x1,
+        .rsvd = 0xfffffffc,
+        .pre_write = ospi_qspi_iou_axi_mux_sel_prew,
+    },{ .name = "QSPI_IOU_COHERENT_CTRL",  .addr = A_QSPI_IOU_COHERENT_CTRL,
+        .rsvd = 0xfffffff0,
+    },{ .name = "QSPI_IOU_INTERCONNECT_ROUTE",
+        .addr = A_QSPI_IOU_INTERCONNECT_ROUTE,
+        .rsvd = 0xfffffffe,
+    },{ .name = "QSPI_IOU_RAM",  .addr = A_QSPI_IOU_RAM,
+        .reset = 0x1224,
+        .rsvd = 0xffffc000,
+    },{ .name = "QSPI_IOU_INTERCONNECT_QOS",
+        .addr = A_QSPI_IOU_INTERCONNECT_QOS,
+        .rsvd = 0xfffffff0,
+    },{ .name = "OSPI_IOU_COHERENT_CTRL",  .addr = A_OSPI_IOU_COHERENT_CTRL,
+        .rsvd = 0xfffffff0,
+    },{ .name = "OSPI_IOU_INTERCONNECT_ROUTE",
+        .addr = A_OSPI_IOU_INTERCONNECT_ROUTE,
+        .rsvd = 0xfffffffe,
+    },{ .name = "OSPI_IOU_RAM",  .addr = A_OSPI_IOU_RAM,
+        .reset = 0xa,
+        .rsvd = 0xffffffc0,
+    },{ .name = "OSPI_IOU_INTERCONNECT_QOS",
+        .addr = A_OSPI_IOU_INTERCONNECT_QOS,
+        .rsvd = 0xfffffff0,
+    },{ .name = "OSPI_REFCLK_DLY_CTRL",  .addr = A_OSPI_REFCLK_DLY_CTRL,
+        .reset = 0x13,
+        .rsvd = 0xffffffe0,
+    },{ .name = "CUR_PWR_ST",  .addr = A_CUR_PWR_ST,
+        .rsvd = 0xfffffffc,
+        .ro = 0x3,
+    },{ .name = "CONNECT_ST",  .addr = A_CONNECT_ST,
+        .rsvd = 0xfffffffe,
+        .ro = 0x1,
+    },{ .name = "PW_STATE_REQ",  .addr = A_PW_STATE_REQ,
+        .rsvd = 0xfffffffc,
+    },{ .name = "HOST_U2_PORT_DISABLE",  .addr = A_HOST_U2_PORT_DISABLE,
+        .rsvd = 0xfffffffe,
+    },{ .name = "DBG_U2PMU",  .addr = A_DBG_U2PMU,
+        .ro = 0xffffffff,
+    },{ .name = "DBG_U2PMU_EXT1",  .addr = A_DBG_U2PMU_EXT1,
+        .ro = 0xffffffff,
+    },{ .name = "DBG_U2PMU_EXT2",  .addr = A_DBG_U2PMU_EXT2,
+        .rsvd = 0xfffffff0,
+        .ro = 0xf,
+    },{ .name = "PME_GEN_U2PMU",  .addr = A_PME_GEN_U2PMU,
+        .rsvd = 0xfffffffe,
+        .ro = 0x1,
+    },{ .name = "PWR_CONFIG_USB2",  .addr = A_PWR_CONFIG_USB2,
+        .rsvd = 0xc0000000,
+    },{ .name = "PHY_HUB",  .addr = A_PHY_HUB,
+        .rsvd = 0xfffffffc,
+        .ro = 0x2,
+    },{ .name = "CTRL",  .addr = A_CTRL,
+    },{ .name = "ISR",  .addr = A_ISR,
+        .w1c = 0x1,
+        .post_write = isr_postw,
+    },{ .name = "IMR",  .addr = A_IMR,
+        .reset = 0x1,
+        .ro = 0x1,
+    },{ .name = "IER",  .addr = A_IER,
+        .pre_write = ier_prew,
+    },{ .name = "IDR",  .addr = A_IDR,
+        .pre_write = idr_prew,
+    },{ .name = "ITR",  .addr = A_ITR,
+        .pre_write = itr_prew,
+    },{ .name = "PARITY_ISR",  .addr = A_PARITY_ISR,
+        .w1c = 0x1fff,
+        .post_write = parity_isr_postw,
+    },{ .name = "PARITY_IMR",  .addr = A_PARITY_IMR,
+        .reset = 0x1fff,
+        .ro = 0x1fff,
+    },{ .name = "PARITY_IER",  .addr = A_PARITY_IER,
+        .pre_write = parity_ier_prew,
+    },{ .name = "PARITY_IDR",  .addr = A_PARITY_IDR,
+        .pre_write = parity_idr_prew,
+    },{ .name = "PARITY_ITR",  .addr = A_PARITY_ITR,
+        .pre_write = parity_itr_prew,
+    },{ .name = "WPROT0",  .addr = A_WPROT0,
+        .reset = 0x1,
+    }
+};
+
+static void xlnx_versal_pmc_iou_slcr_reset_init(Object *obj, ResetType type)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(obj);
+    unsigned int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+}
+
+static void xlnx_versal_pmc_iou_slcr_reset_hold(Object *obj)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(obj);
+
+    parity_imr_update_irq(s);
+    imr_update_irq(s);
+
+    /*
+     * Setup OSPI_QSPI mux
+     * By default axi slave interface is enabled for ospi-dma
+     */
+    qemu_set_irq(s->ospi_mux_sel, 0);
+    qemu_set_irq(s->qspi_ospi_mux_sel, 1);
+}
+
+static const MemoryRegionOps pmc_iou_slcr_ops = {
+    .read = register_read_memory,
+    .write = register_write_memory,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void xlnx_versal_pmc_iou_slcr_realize(DeviceState *dev, Error **errp)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(dev);
+
+    qdev_init_gpio_out_named(dev, s->sd_emmc_sel, "sd-emmc-sel", 2);
+    qdev_init_gpio_out_named(dev, &s->qspi_ospi_mux_sel,
+                             "qspi-ospi-mux-sel", 1);
+    qdev_init_gpio_out_named(dev, &s->ospi_mux_sel, "ospi-mux-sel", 1);
+}
+
+static void xlnx_versal_pmc_iou_slcr_init(Object *obj)
+{
+    XlnxVersalPmcIouSlcr *s = XILINX_VERSAL_PMC_IOU_SLCR(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    RegisterInfoArray *reg_array;
+
+    memory_region_init(&s->iomem, obj, TYPE_XILINX_VERSAL_PMC_IOU_SLCR,
+                       XILINX_VERSAL_PMC_IOU_SLCR_R_MAX * 4);
+    reg_array =
+        register_init_block32(DEVICE(obj), pmc_iou_slcr_regs_info,
+                              ARRAY_SIZE(pmc_iou_slcr_regs_info),
+                              s->regs_info, s->regs,
+                              &pmc_iou_slcr_ops,
+                              XILINX_VERSAL_PMC_IOU_SLCR_ERR_DEBUG,
+                              XILINX_VERSAL_PMC_IOU_SLCR_R_MAX * 4);
+    memory_region_add_subregion(&s->iomem,
+                                0x0,
+                                &reg_array->mem);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq_parity_imr);
+    sysbus_init_irq(sbd, &s->irq_imr);
+}
+
+static const VMStateDescription vmstate_pmc_iou_slcr = {
+    .name = TYPE_XILINX_VERSAL_PMC_IOU_SLCR,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, XlnxVersalPmcIouSlcr,
+                             XILINX_VERSAL_PMC_IOU_SLCR_R_MAX),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static void xlnx_versal_pmc_iou_slcr_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+
+    dc->realize = xlnx_versal_pmc_iou_slcr_realize;
+    dc->vmsd = &vmstate_pmc_iou_slcr;
+    rc->phases.enter = xlnx_versal_pmc_iou_slcr_reset_init;
+    rc->phases.hold  = xlnx_versal_pmc_iou_slcr_reset_hold;
+}
+
+static const TypeInfo xlnx_versal_pmc_iou_slcr_info = {
+    .name          = TYPE_XILINX_VERSAL_PMC_IOU_SLCR,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(XlnxVersalPmcIouSlcr),
+    .class_init    = xlnx_versal_pmc_iou_slcr_class_init,
+    .instance_init = xlnx_versal_pmc_iou_slcr_init,
+};
+
+static void xlnx_versal_pmc_iou_slcr_register_types(void)
+{
+    type_register_static(&xlnx_versal_pmc_iou_slcr_info);
+}
+
+type_init(xlnx_versal_pmc_iou_slcr_register_types)
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_RASPI', if_true: files(
 ))
 softmmu_ss.add(when: 'CONFIG_SLAVIO', if_true: files('slavio_misc.c'))
 softmmu_ss.add(when: 'CONFIG_ZYNQ', if_true: files('zynq_slcr.c'))
-softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-xramc.c'))
+softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files(
+  'xlnx-versal-xramc.c',
+  'xlnx-versal-pmc-iou-slcr.c',
+))
 softmmu_ss.add(when: 'CONFIG_STM32F2XX_SYSCFG', if_true: files('stm32f2xx_syscfg.c'))
 softmmu_ss.add(when: 'CONFIG_STM32F4XX_SYSCFG', if_true: files('stm32f4xx_syscfg.c'))
 softmmu_ss.add(when: 'CONFIG_STM32F4XX_EXTI', if_true: files('stm32f4xx_exti.c'))
-- 
2.25.1

From: Francisco Iglesias <francisco.iglesias@xilinx.com>

Add an orgate and 'or' the interrupts from the BBRAM and RTC models.

Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20220121161141.14389-3-francisco.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h |  5 +++--
 hw/arm/xlnx-versal-virt.c    |  2 +-
 hw/arm/xlnx-versal.c         | 28 ++++++++++++++++++++++++++--
 3 files changed, 30 insertions(+), 5 deletions(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ struct Versal {
         XlnxEFuse efuse;
         XlnxVersalEFuseCtrl efuse_ctrl;
         XlnxVersalEFuseCache efuse_cache;
+
+        qemu_or_irq apb_irq_orgate;
     } pmc;
 
     struct {
@@ -XXX,XX +XXX,XX @@ struct Versal {
 #define VERSAL_GEM1_WAKE_IRQ_0     59
 #define VERSAL_ADMA_IRQ_0          60
 #define VERSAL_XRAM_IRQ_0          79
-#define VERSAL_BBRAM_APB_IRQ_0     121
-#define VERSAL_RTC_APB_ERR_IRQ     121
+#define VERSAL_PMC_APB_IRQ         121
 #define VERSAL_SD0_IRQ_0           126
 #define VERSAL_EFUSE_IRQ           139
 #define VERSAL_RTC_ALARM_IRQ       142
diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@ static void fdt_add_bbram_node(VersalVirt *s)
     qemu_fdt_add_subnode(s->fdt, name);
 
     qemu_fdt_setprop_cells(s->fdt, name, "interrupts",
-                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_BBRAM_APB_IRQ_0,
+                           GIC_FDT_IRQ_TYPE_SPI, VERSAL_PMC_APB_IRQ,
                            GIC_FDT_IRQ_FLAGS_LEVEL_HI);
     qemu_fdt_setprop(s->fdt, name, "interrupt-names",
                      interrupt_names, sizeof(interrupt_names));
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define GEM_REVISION        0x40070106
 
+#define VERSAL_NUM_PMC_APB_IRQS 2
+
 static void versal_create_apu_cpus(Versal *s)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void versal_create_sds(Versal *s, qemu_irq *pic)
     }
 }
 
+static void versal_create_pmc_apb_irq_orgate(Versal *s, qemu_irq *pic)
+{
+    DeviceState *orgate;
+
+    /*
+     * The VERSAL_PMC_APB_IRQ is an 'or' of the interrupts from the following
+     * models:
+     *  - RTC
+     *  - BBRAM
+     */
+    object_initialize_child(OBJECT(s), "pmc-apb-irq-orgate",
+                            &s->pmc.apb_irq_orgate, TYPE_OR_IRQ);
+    orgate = DEVICE(&s->pmc.apb_irq_orgate);
+    object_property_set_int(OBJECT(orgate),
+                            "num-lines", VERSAL_NUM_PMC_APB_IRQS, &error_fatal);
+    qdev_realize(orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(orgate, 0, pic[VERSAL_PMC_APB_IRQ]);
+}
+
 static void versal_create_rtc(Versal *s, qemu_irq *pic)
 {
     SysBusDevice *sbd;
@@ -XXX,XX +XXX,XX @@ static void versal_create_rtc(Versal *s, qemu_irq *pic)
      * TODO: Connect the ALARM and SECONDS interrupts once our RTC model
      * supports them.
      */
-    sysbus_connect_irq(sbd, 1, pic[VERSAL_RTC_APB_ERR_IRQ]);
+    sysbus_connect_irq(sbd, 1,
+                       qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 0));
 }
 
 static void versal_create_xrams(Versal *s, qemu_irq *pic)
@@ -XXX,XX +XXX,XX @@ static void versal_create_bbram(Versal *s, qemu_irq *pic)
     sysbus_realize(sbd, &error_fatal);
     memory_region_add_subregion(&s->mr_ps, MM_PMC_BBRAM_CTRL,
                                 sysbus_mmio_get_region(sbd, 0));
-    sysbus_connect_irq(sbd, 0, pic[VERSAL_BBRAM_APB_IRQ_0]);
+    sysbus_connect_irq(sbd, 0,
+                       qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 1));
 }
 
 static void versal_realize_efuse_part(Versal *s, Object *dev, hwaddr base)
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_gems(s, pic);
     versal_create_admas(s, pic);
     versal_create_sds(s, pic);
+    versal_create_pmc_apb_irq_orgate(s, pic);
     versal_create_rtc(s, pic);
     versal_create_xrams(s, pic);
     versal_create_bbram(s, pic);
-- 
2.25.1

From: Francisco Iglesias <francisco.iglesias@xilinx.com>

Connect Versal's PMC SLCR (system-level control registers) model.

Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20220121161141.14389-4-francisco.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h |  5 +++
 hw/arm/xlnx-versal.c         | 71 +++++++++++++++++++++++++++++++++++-
 2 files changed, 75 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/xlnx-versal-xramc.h"
 #include "hw/nvram/xlnx-bbram.h"
 #include "hw/nvram/xlnx-versal-efuse.h"
+#include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
 OBJECT_DECLARE_SIMPLE_TYPE(Versal, XLNX_VERSAL)
@@ -XXX,XX +XXX,XX @@ struct Versal {
     struct {
         struct {
             SDHCIState sd[XLNX_VERSAL_NR_SDS];
+            XlnxVersalPmcIouSlcr slcr;
         } iou;
 
         XlnxZynqMPRTC rtc;
@@ -XXX,XX +XXX,XX @@ struct Versal {
 #define MM_FPD_FPD_APU              0xfd5c0000
 #define MM_FPD_FPD_APU_SIZE         0x100
 
+#define MM_PMC_PMC_IOU_SLCR         0xf1060000
+#define MM_PMC_PMC_IOU_SLCR_SIZE    0x10000
+
 #define MM_PMC_SD0                  0xf1040000U
 #define MM_PMC_SD0_SIZE             0x10000
 #define MM_PMC_BBRAM_CTRL           0xf11f0000
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #include "kvm_arm.h"
 #include "hw/misc/unimp.h"
 #include "hw/arm/xlnx-versal.h"
+#include "qemu/log.h"
+#include "hw/sysbus.h"
 
 #define XLNX_VERSAL_ACPU_TYPE ARM_CPU_TYPE_NAME("cortex-a72")
 #define GEM_REVISION        0x40070106
 
-#define VERSAL_NUM_PMC_APB_IRQS 2
+#define VERSAL_NUM_PMC_APB_IRQS 3
 
 static void versal_create_apu_cpus(Versal *s)
 {
@@ -XXX,XX +XXX,XX @@ static void versal_create_pmc_apb_irq_orgate(Versal *s, qemu_irq *pic)
      * models:
      *  - RTC
      *  - BBRAM
+     *  - PMC SLCR
      */
     object_initialize_child(OBJECT(s), "pmc-apb-irq-orgate",
                             &s->pmc.apb_irq_orgate, TYPE_OR_IRQ);
@@ -XXX,XX +XXX,XX @@ static void versal_create_efuse(Versal *s, qemu_irq *pic)
     sysbus_connect_irq(SYS_BUS_DEVICE(ctrl), 0, pic[VERSAL_EFUSE_IRQ]);
 }
 
+static void versal_create_pmc_iou_slcr(Versal *s, qemu_irq *pic)
+{
+    SysBusDevice *sbd;
+
+    object_initialize_child(OBJECT(s), "versal-pmc-iou-slcr", &s->pmc.iou.slcr,
+                            TYPE_XILINX_VERSAL_PMC_IOU_SLCR);
+
+    sbd = SYS_BUS_DEVICE(&s->pmc.iou.slcr);
+    sysbus_realize(sbd, &error_fatal);
+
+    memory_region_add_subregion(&s->mr_ps, MM_PMC_PMC_IOU_SLCR,
+                                sysbus_mmio_get_region(sbd, 0));
+
+    sysbus_connect_irq(sbd, 0,
+                       qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 2));
+}
+
 /* This takes the board allocated linear DDR memory and creates aliases
  * for each split DDR range/aperture on the Versal address map.
  */
@@ -XXX,XX +XXX,XX @@ static void versal_unimp_area(Versal *s, const char *name,
     memory_region_add_subregion(mr, base, mr_dev);
 }
 
+static void versal_unimp_sd_emmc_sel(void *opaque, int n, int level)
+{
+    qemu_log_mask(LOG_UNIMP,
+                  "Selecting between enabling SD mode or eMMC mode on "
+                  "controller %d is not yet implemented\n", n);
+}
+
+static void versal_unimp_qspi_ospi_mux_sel(void *opaque, int n, int level)
+{
+    qemu_log_mask(LOG_UNIMP,
+                  "Selecting between enabling the QSPI or OSPI linear address "
+                  "region is not yet implemented\n");
+}
+
+static void versal_unimp_irq_parity_imr(void *opaque, int n, int level)
+{
+    qemu_log_mask(LOG_UNIMP,
+                  "PMC SLCR parity interrupt behaviour "
+                  "is not yet implemented\n");
+}
+
 static void versal_unimp(Versal *s)
 {
+    qemu_irq gpio_in;
+
     versal_unimp_area(s, "psm", &s->mr_ps,
                         MM_PSM_START, MM_PSM_END - MM_PSM_START);
     versal_unimp_area(s, "crl", &s->mr_ps,
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
                         MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
     versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
                         MM_IOU_SCNTRS, MM_IOU_SCNTRS_SIZE);
+
+    qdev_init_gpio_in_named(DEVICE(s), versal_unimp_sd_emmc_sel,
+                            "sd-emmc-sel-dummy", 2);
+    qdev_init_gpio_in_named(DEVICE(s), versal_unimp_qspi_ospi_mux_sel,
+                            "qspi-ospi-mux-sel-dummy", 1);
+    qdev_init_gpio_in_named(DEVICE(s), versal_unimp_irq_parity_imr,
+                            "irq-parity-imr-dummy", 1);
+
+    gpio_in = qdev_get_gpio_in_named(DEVICE(s), "sd-emmc-sel-dummy", 0);
+    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr), "sd-emmc-sel", 0,
+                                gpio_in);
+
+    gpio_in = qdev_get_gpio_in_named(DEVICE(s), "sd-emmc-sel-dummy", 1);
+    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr), "sd-emmc-sel", 1,
+                                gpio_in);
+
+    gpio_in = qdev_get_gpio_in_named(DEVICE(s), "qspi-ospi-mux-sel-dummy", 0);
+    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr),
+                                "qspi-ospi-mux-sel", 0,
+                                gpio_in);
+
+    gpio_in = qdev_get_gpio_in_named(DEVICE(s), "irq-parity-imr-dummy", 0);
+    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr),
+                                SYSBUS_DEVICE_GPIO_IRQ, 0,
+                                gpio_in);
 }
 
 static void versal_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_xrams(s, pic);
     versal_create_bbram(s, pic);
     versal_create_efuse(s, pic);
+    versal_create_pmc_iou_slcr(s, pic);
     versal_map_ddr(s);
     versal_unimp(s);
 
-- 
2.25.1

From: Francisco Iglesias <francisco.iglesias@xilinx.com>

An option on real hardware when embedding a DMA engine into a peripheral
is to make the peripheral control the engine through a custom DMA control
(hardware) interface between the two. Software drivers in this scenario
configure and trigger DMA operations through the controlling peripheral's
register API (for example, writing a specific bit in a register could
propagate down to a transfer start signal on the DMA control interface).
At the same time the status, results and interrupts for the transfer might
still be intended to be read and caught through the DMA engine's register
API (and signals).

This patch adds a class 'read' method for allowing to start read transfers
from peripherals embedding and controlling the Xilinx CSU DMA engine as in
above scenario.

Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20220121161141.14389-6-francisco.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/dma/xlnx_csu_dma.h | 19 +++++++++++++++++--
 hw/dma/xlnx_csu_dma.c         | 17 +++++++++++++++++
 2 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/include/hw/dma/xlnx_csu_dma.h b/include/hw/dma/xlnx_csu_dma.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/dma/xlnx_csu_dma.h
+++ b/include/hw/dma/xlnx_csu_dma.h
@@ -XXX,XX +XXX,XX @@ typedef struct XlnxCSUDMA {
     RegisterInfo regs_info[XLNX_CSU_DMA_R_MAX];
 } XlnxCSUDMA;
 
-#define XLNX_CSU_DMA(obj) \
-    OBJECT_CHECK(XlnxCSUDMA, (obj), TYPE_XLNX_CSU_DMA)
+OBJECT_DECLARE_TYPE(XlnxCSUDMA, XlnxCSUDMAClass, XLNX_CSU_DMA)
+
+struct XlnxCSUDMAClass {
+    SysBusDeviceClass parent_class;
+
+    /*
+     * read: Start a read transfer on a Xilinx CSU DMA engine
+     *
+     * @s: the Xilinx CSU DMA engine to start the transfer on
+     * @addr: the address to read
+     * @len: the number of bytes to read at 'addr'
+     *
+     * @return a MemTxResult indicating whether the operation succeeded ('len'
+     * bytes were read) or failed.
+     */
+    MemTxResult (*read)(XlnxCSUDMA *s, hwaddr addr, uint32_t len);
+};
 
 #endif
diff --git a/hw/dma/xlnx_csu_dma.c b/hw/dma/xlnx_csu_dma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xlnx_csu_dma.c
+++ b/hw/dma/xlnx_csu_dma.c
@@ -XXX,XX +XXX,XX @@ static uint64_t addr_msb_pre_write(RegisterInfo *reg, uint64_t val)
     return val & R_ADDR_MSB_ADDR_MSB_MASK;
 }
 
+static MemTxResult xlnx_csu_dma_class_read(XlnxCSUDMA *s, hwaddr addr,
+                                           uint32_t len)
+{
+    RegisterInfo *reg = &s->regs_info[R_SIZE];
+    uint64_t we = MAKE_64BIT_MASK(0, 4 * 8);
+
+    s->regs[R_ADDR] = addr;
+    s->regs[R_ADDR_MSB] = (uint64_t)addr >> 32;
+
+    register_write(reg, len, we, object_get_typename(OBJECT(s)), false);
+
+    return (s->regs[R_SIZE] == 0) ? MEMTX_OK : MEMTX_ERROR;
+}
+
 static const RegisterAccessInfo *xlnx_csu_dma_regs_info[] = {
 #define DMACH_REGINFO(NAME, snd)                                              \
     (const RegisterAccessInfo []) {                                           \
@@ -XXX,XX +XXX,XX @@ static void xlnx_csu_dma_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     StreamSinkClass *ssc = STREAM_SINK_CLASS(klass);
+    XlnxCSUDMAClass *xcdc = XLNX_CSU_DMA_CLASS(klass);
 
     dc->reset = xlnx_csu_dma_reset;
     dc->realize = xlnx_csu_dma_realize;
@@ -XXX,XX +XXX,XX @@ static void xlnx_csu_dma_class_init(ObjectClass *klass, void *data)
 
     ssc->push = xlnx_csu_dma_stream_push;
     ssc->can_push = xlnx_csu_dma_stream_can_push;
+
+    xcdc->read = xlnx_csu_dma_class_read;
 }
 
 static void xlnx_csu_dma_init(Object *obj)
-- 
2.25.1

From: Francisco Iglesias <francisco.iglesias@xilinx.com>

Add a model of Xilinx Versal's OSPI flash memory controller.

Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Luc Michel <luc@lmichel.fr>
Message-id: 20220121161141.14389-7-francisco.iglesias@xilinx.com
[PMM: fixed indent]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/ssi/xlnx-versal-ospi.h |  111 ++
 hw/ssi/xlnx-versal-ospi.c         | 1853 +++++++++++++++++++++++++++++
 hw/ssi/meson.build                |    1 +
 3 files changed, 1965 insertions(+)
 create mode 100644 include/hw/ssi/xlnx-versal-ospi.h
 create mode 100644 hw/ssi/xlnx-versal-ospi.c

diff --git a/include/hw/ssi/xlnx-versal-ospi.h b/include/hw/ssi/xlnx-versal-ospi.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/ssi/xlnx-versal-ospi.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Header file for the Xilinx Versal's OSPI controller
+ *
+ * Copyright (C) 2021 Xilinx Inc
+ * Written by Francisco Iglesias <francisco.iglesias@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+/*
+ * This is a model of Xilinx Versal's Octal SPI flash memory controller
+ * documented in Versal's Technical Reference manual [1] and the Versal ACAP
+ * Register reference [2].
+ *
+ * References:
+ *
+ * [1] Versal ACAP Technical Reference Manual,
+ *     https://www.xilinx.com/support/documentation/architecture-manuals/am011-versal-acap-trm.pdf
+ *
+ * [2] Versal ACAP Register Reference,
+ *     https://www.xilinx.com/html_docs/registers/am012/am012-versal-register-reference.html#mod___ospi.html
+ *
+ *
+ * QEMU interface:
+ * + sysbus MMIO region 0: MemoryRegion for the device's registers
+ * + sysbus MMIO region 1: MemoryRegion for flash memory linear address space
+ *   (data transfer).
+ * + sysbus IRQ 0: Device interrupt.
+ * + Named GPIO input "ospi-mux-sel": 0: enables indirect access mode
+ *   and 1: enables direct access mode.
+ * + Property "dac-with-indac": Allow both direct accesses and indirect
+ *   accesses simultaneously.
+ * + Property "indac-write-disabled": Disable indirect access writes.
+ */
+
+#ifndef XILINX_VERSAL_OSPI_H
+#define XILINX_VERSAL_OSPI_H
+
+#include "hw/register.h"
+#include "hw/ssi/ssi.h"
+#include "qemu/fifo8.h"
+#include "hw/dma/xlnx_csu_dma.h"
+
+#define TYPE_XILINX_VERSAL_OSPI "xlnx.versal-ospi"
+
+OBJECT_DECLARE_SIMPLE_TYPE(XlnxVersalOspi, XILINX_VERSAL_OSPI)
+
+#define XILINX_VERSAL_OSPI_R_MAX (0xfc / 4 + 1)
+
+/*
+ * Indirect operations
+ */
+typedef struct IndOp {
+    uint32_t flash_addr;
+    uint32_t num_bytes;
+    uint32_t done_bytes;
+    bool completed;
+} IndOp;
+
+struct XlnxVersalOspi {
+    SysBusDevice parent_obj;
+
+    MemoryRegion iomem;
+    MemoryRegion iomem_dac;
+
+    uint8_t num_cs;
+    qemu_irq *cs_lines;
+
+    SSIBus *spi;
+
+    Fifo8 rx_fifo;
+    Fifo8 tx_fifo;
+
+    Fifo8 rx_sram;
+    Fifo8 tx_sram;
+
+    qemu_irq irq;
+
+    XlnxCSUDMA *dma_src;
+    bool ind_write_disabled;
+    bool dac_with_indac;
+    bool dac_enable;
+    bool src_dma_inprog;
+
+    IndOp rd_ind_op[2];
+    IndOp wr_ind_op[2];
+
+    uint32_t regs[XILINX_VERSAL_OSPI_R_MAX];
+    RegisterInfo regs_info[XILINX_VERSAL_OSPI_R_MAX];
+
+    /* Maximum inferred membank size is 512 bytes */
+    uint8_t stig_membank[512];
+};
+
+#endif /* XILINX_VERSAL_OSPI_H */
diff --git a/hw/ssi/xlnx-versal-ospi.c b/hw/ssi/xlnx-versal-ospi.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/ssi/xlnx-versal-ospi.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU model of Xilinx Versal's OSPI controller.
+ *
+ * Copyright (c) 2021 Xilinx Inc.
+ * Written by Francisco Iglesias <francisco.iglesias@xilinx.com>
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+#include "qemu/osdep.h"
+#include "hw/sysbus.h"
+#include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
+#include "qemu/bitops.h"
+#include "qemu/log.h"
+#include "hw/irq.h"
+#include "hw/ssi/xlnx-versal-ospi.h"
+
+#ifndef XILINX_VERSAL_OSPI_ERR_DEBUG
+#define XILINX_VERSAL_OSPI_ERR_DEBUG 0
+#endif
+
+REG32(CONFIG_REG, 0x0)
+    FIELD(CONFIG_REG, IDLE_FLD, 31, 1)
+    FIELD(CONFIG_REG, DUAL_BYTE_OPCODE_EN_FLD, 30, 1)
+    FIELD(CONFIG_REG, CRC_ENABLE_FLD, 29, 1)
+    FIELD(CONFIG_REG, CONFIG_RESV2_FLD, 26, 3)
+    FIELD(CONFIG_REG, PIPELINE_PHY_FLD, 25, 1)
+    FIELD(CONFIG_REG, ENABLE_DTR_PROTOCOL_FLD, 24, 1)
+    FIELD(CONFIG_REG, ENABLE_AHB_DECODER_FLD, 23, 1)
+    FIELD(CONFIG_REG, MSTR_BAUD_DIV_FLD, 19, 4)
+    FIELD(CONFIG_REG, ENTER_XIP_MODE_IMM_FLD, 18, 1)
+    FIELD(CONFIG_REG, ENTER_XIP_MODE_FLD, 17, 1)
+    FIELD(CONFIG_REG, ENB_AHB_ADDR_REMAP_FLD, 16, 1)
+    FIELD(CONFIG_REG, ENB_DMA_IF_FLD, 15, 1)
+    FIELD(CONFIG_REG, WR_PROT_FLASH_FLD, 14, 1)
+    FIELD(CONFIG_REG, PERIPH_CS_LINES_FLD, 10, 4)
+    FIELD(CONFIG_REG, PERIPH_SEL_DEC_FLD, 9, 1)
+    FIELD(CONFIG_REG, ENB_LEGACY_IP_MODE_FLD, 8, 1)
+    FIELD(CONFIG_REG, ENB_DIR_ACC_CTLR_FLD, 7, 1)
+    FIELD(CONFIG_REG, RESET_CFG_FLD, 6, 1)
+    FIELD(CONFIG_REG, RESET_PIN_FLD, 5, 1)
+    FIELD(CONFIG_REG, HOLD_PIN_FLD, 4, 1)
+    FIELD(CONFIG_REG, PHY_MODE_ENABLE_FLD, 3, 1)
+    FIELD(CONFIG_REG, SEL_CLK_PHASE_FLD, 2, 1)
+    FIELD(CONFIG_REG, SEL_CLK_POL_FLD, 1, 1)
+    FIELD(CONFIG_REG, ENB_SPI_FLD, 0, 1)
+REG32(DEV_INSTR_RD_CONFIG_REG, 0x4)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, RD_INSTR_RESV5_FLD, 29, 3)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, DUMMY_RD_CLK_CYCLES_FLD, 24, 5)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, RD_INSTR_RESV4_FLD, 21, 3)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, MODE_BIT_ENABLE_FLD, 20, 1)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, RD_INSTR_RESV3_FLD, 18, 2)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, DATA_XFER_TYPE_EXT_MODE_FLD, 16, 2)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, RD_INSTR_RESV2_FLD, 14, 2)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, ADDR_XFER_TYPE_STD_MODE_FLD, 12, 2)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, PRED_DIS_FLD, 11, 1)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, DDR_EN_FLD, 10, 1)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, INSTR_TYPE_FLD, 8, 2)
+    FIELD(DEV_INSTR_RD_CONFIG_REG, RD_OPCODE_NON_XIP_FLD, 0, 8)
+REG32(DEV_INSTR_WR_CONFIG_REG, 0x8)
+    FIELD(DEV_INSTR_WR_CONFIG_REG, WR_INSTR_RESV4_FLD, 29, 3)
+    FIELD(DEV_INSTR_WR_CONFIG_REG, DUMMY_WR_CLK_CYCLES_FLD, 24, 5)
+    FIELD(DEV_INSTR_WR_CONFIG_REG, WR_INSTR_RESV3_FLD, 18, 6)
+    FIELD(DEV_INSTR_WR_CONFIG_REG, DATA_XFER_TYPE_EXT_MODE_FLD, 16, 2)
+    FIELD(DEV_INSTR_WR_CONFIG_REG, WR_INSTR_RESV2_FLD, 14, 2)
+    FIELD(DEV_INSTR_WR_CONFIG_REG, ADDR_XFER_TYPE_STD_MODE_FLD, 12, 2)
+    FIELD(DEV_INSTR_WR_CONFIG_REG, WR_INSTR_RESV1_FLD, 9, 3)
+    FIELD(DEV_INSTR_WR_CONFIG_REG, WEL_DIS_FLD, 8, 1)
+    FIELD(DEV_INSTR_WR_CONFIG_REG, WR_OPCODE_FLD, 0, 8)
+REG32(DEV_DELAY_REG, 0xc)
+    FIELD(DEV_DELAY_REG, D_NSS_FLD, 24, 8)
+    FIELD(DEV_DELAY_REG, D_BTWN_FLD, 16, 8)
+    FIELD(DEV_DELAY_REG, D_AFTER_FLD, 8, 8)
+    FIELD(DEV_DELAY_REG, D_INIT_FLD, 0, 8)
+REG32(RD_DATA_CAPTURE_REG, 0x10)
+    FIELD(RD_DATA_CAPTURE_REG, RD_DATA_RESV3_FLD, 20, 12)
+    FIELD(RD_DATA_CAPTURE_REG, DDR_READ_DELAY_FLD, 16, 4)
+    FIELD(RD_DATA_CAPTURE_REG, RD_DATA_RESV2_FLD, 9, 7)
+    FIELD(RD_DATA_CAPTURE_REG, DQS_ENABLE_FLD, 8, 1)
+    FIELD(RD_DATA_CAPTURE_REG, RD_DATA_RESV1_FLD, 6, 2)
+    FIELD(RD_DATA_CAPTURE_REG, SAMPLE_EDGE_SEL_FLD, 5, 1)
+    FIELD(RD_DATA_CAPTURE_REG, DELAY_FLD, 1, 4)
+    FIELD(RD_DATA_CAPTURE_REG, BYPASS_FLD, 0, 1)
+REG32(DEV_SIZE_CONFIG_REG, 0x14)
+    FIELD(DEV_SIZE_CONFIG_REG, DEV_SIZE_RESV_FLD, 29, 3)
+    FIELD(DEV_SIZE_CONFIG_REG, MEM_SIZE_ON_CS3_FLD, 27, 2)
+    FIELD(DEV_SIZE_CONFIG_REG, MEM_SIZE_ON_CS2_FLD, 25, 2)
+    FIELD(DEV_SIZE_CONFIG_REG, MEM_SIZE_ON_CS1_FLD, 23, 2)
+    FIELD(DEV_SIZE_CONFIG_REG, MEM_SIZE_ON_CS0_FLD, 21, 2)
+    FIELD(DEV_SIZE_CONFIG_REG, BYTES_PER_SUBSECTOR_FLD, 16, 5)
+    FIELD(DEV_SIZE_CONFIG_REG, BYTES_PER_DEVICE_PAGE_FLD, 4, 12)
+    FIELD(DEV_SIZE_CONFIG_REG, NUM_ADDR_BYTES_FLD, 0, 4)
+REG32(SRAM_PARTITION_CFG_REG, 0x18)
+    FIELD(SRAM_PARTITION_CFG_REG, SRAM_PARTITION_RESV_FLD, 8, 24)
+    FIELD(SRAM_PARTITION_CFG_REG, ADDR_FLD, 0, 8)
+REG32(IND_AHB_ADDR_TRIGGER_REG, 0x1c)
+REG32(DMA_PERIPH_CONFIG_REG, 0x20)
+    FIELD(DMA_PERIPH_CONFIG_REG, DMA_PERIPH_RESV2_FLD, 12, 20)
+    FIELD(DMA_PERIPH_CONFIG_REG, NUM_BURST_REQ_BYTES_FLD, 8, 4)
+    FIELD(DMA_PERIPH_CONFIG_REG, DMA_PERIPH_RESV1_FLD, 4, 4)
+    FIELD(DMA_PERIPH_CONFIG_REG, NUM_SINGLE_REQ_BYTES_FLD, 0, 4)
+REG32(REMAP_ADDR_REG, 0x24)
+REG32(MODE_BIT_CONFIG_REG, 0x28)
+    FIELD(MODE_BIT_CONFIG_REG, RX_CRC_DATA_LOW_FLD, 24, 8)
+    FIELD(MODE_BIT_CONFIG_REG, RX_CRC_DATA_UP_FLD, 16, 8)
+    FIELD(MODE_BIT_CONFIG_REG, CRC_OUT_ENABLE_FLD, 15, 1)
+    FIELD(MODE_BIT_CONFIG_REG, MODE_BIT_RESV1_FLD, 11, 4)
+    FIELD(MODE_BIT_CONFIG_REG, CHUNK_SIZE_FLD, 8, 3)
+    FIELD(MODE_BIT_CONFIG_REG, MODE_FLD, 0, 8)
+REG32(SRAM_FILL_REG, 0x2c)
+    FIELD(SRAM_FILL_REG, SRAM_FILL_INDAC_WRITE_FLD, 16, 16)
+    FIELD(SRAM_FILL_REG, SRAM_FILL_INDAC_READ_FLD, 0, 16)
+REG32(TX_THRESH_REG, 0x30)
+    FIELD(TX_THRESH_REG, TX_THRESH_RESV_FLD, 5, 27)
+    FIELD(TX_THRESH_REG, LEVEL_FLD, 0, 5)
+REG32(RX_THRESH_REG, 0x34)
+    FIELD(RX_THRESH_REG, RX_THRESH_RESV_FLD, 5, 27)
+    FIELD(RX_THRESH_REG, LEVEL_FLD, 0, 5)
+REG32(WRITE_COMPLETION_CTRL_REG, 0x38)
+    FIELD(WRITE_COMPLETION_CTRL_REG, POLL_REP_DELAY_FLD, 24, 8)
+    FIELD(WRITE_COMPLETION_CTRL_REG, POLL_COUNT_FLD, 16, 8)
+    FIELD(WRITE_COMPLETION_CTRL_REG, ENABLE_POLLING_EXP_FLD, 15, 1)
+    FIELD(WRITE_COMPLETION_CTRL_REG, DISABLE_POLLING_FLD, 14, 1)
+    FIELD(WRITE_COMPLETION_CTRL_REG, POLLING_POLARITY_FLD, 13, 1)
+    FIELD(WRITE_COMPLETION_CTRL_REG, WR_COMP_CTRL_RESV1_FLD, 12, 1)
+    FIELD(WRITE_COMPLETION_CTRL_REG, POLLING_ADDR_EN_FLD, 11, 1)
+    FIELD(WRITE_COMPLETION_CTRL_REG, POLLING_BIT_INDEX_FLD, 8, 3)
+    FIELD(WRITE_COMPLETION_CTRL_REG, OPCODE_FLD, 0, 8)
+REG32(NO_OF_POLLS_BEF_EXP_REG, 0x3c)
+REG32(IRQ_STATUS_REG, 0x40)
+    FIELD(IRQ_STATUS_REG, IRQ_STAT_RESV_FLD, 20, 12)
+    FIELD(IRQ_STATUS_REG, ECC_FAIL_FLD, 19, 1)
+    FIELD(IRQ_STATUS_REG, TX_CRC_CHUNK_BRK_FLD, 18, 1)
+    FIELD(IRQ_STATUS_REG, RX_CRC_DATA_VAL_FLD, 17, 1)
+    FIELD(IRQ_STATUS_REG, RX_CRC_DATA_ERR_FLD, 16, 1)
+    FIELD(IRQ_STATUS_REG, IRQ_STAT_RESV1_FLD, 15, 1)
+    FIELD(IRQ_STATUS_REG, STIG_REQ_INT_FLD, 14, 1)
+    FIELD(IRQ_STATUS_REG, POLL_EXP_INT_FLD, 13, 1)
+    FIELD(IRQ_STATUS_REG, INDRD_SRAM_FULL_FLD, 12, 1)
+    FIELD(IRQ_STATUS_REG, RX_FIFO_FULL_FLD, 11, 1)
+    FIELD(IRQ_STATUS_REG, RX_FIFO_NOT_EMPTY_FLD, 10, 1)
+    FIELD(IRQ_STATUS_REG, TX_FIFO_FULL_FLD, 9, 1)
+    FIELD(IRQ_STATUS_REG, TX_FIFO_NOT_FULL_FLD, 8, 1)
+    FIELD(IRQ_STATUS_REG, RECV_OVERFLOW_FLD, 7, 1)
+    FIELD(IRQ_STATUS_REG, INDIRECT_XFER_LEVEL_BREACH_FLD, 6, 1)
+    FIELD(IRQ_STATUS_REG, ILLEGAL_ACCESS_DET_FLD, 5, 1)
+    FIELD(IRQ_STATUS_REG, PROT_WR_ATTEMPT_FLD, 4, 1)
+    FIELD(IRQ_STATUS_REG, INDIRECT_TRANSFER_REJECT_FLD, 3, 1)
+    FIELD(IRQ_STATUS_REG, INDIRECT_OP_DONE_FLD, 2, 1)
+    FIELD(IRQ_STATUS_REG, UNDERFLOW_DET_FLD, 1, 1)
+    FIELD(IRQ_STATUS_REG, MODE_M_FAIL_FLD, 0, 1)
+REG32(IRQ_MASK_REG, 0x44)
+    FIELD(IRQ_MASK_REG, IRQ_MASK_RESV_FLD, 20, 12)
+    FIELD(IRQ_MASK_REG, ECC_FAIL_MASK_FLD, 19, 1)
+    FIELD(IRQ_MASK_REG, TX_CRC_CHUNK_BRK_MASK_FLD, 18, 1)
+    FIELD(IRQ_MASK_REG, RX_CRC_DATA_VAL_MASK_FLD, 17, 1)
+    FIELD(IRQ_MASK_REG, RX_CRC_DATA_ERR_MASK_FLD, 16, 1)
+    FIELD(IRQ_MASK_REG, IRQ_MASK_RESV1_FLD, 15, 1)
+    FIELD(IRQ_MASK_REG, STIG_REQ_MASK_FLD, 14, 1)
+    FIELD(IRQ_MASK_REG, POLL_EXP_INT_MASK_FLD, 13, 1)
+    FIELD(IRQ_MASK_REG, INDRD_SRAM_FULL_MASK_FLD, 12, 1)
+    FIELD(IRQ_MASK_REG, RX_FIFO_FULL_MASK_FLD, 11, 1)
+    FIELD(IRQ_MASK_REG, RX_FIFO_NOT_EMPTY_MASK_FLD, 10, 1)
+    FIELD(IRQ_MASK_REG, TX_FIFO_FULL_MASK_FLD, 9, 1)
+    FIELD(IRQ_MASK_REG, TX_FIFO_NOT_FULL_MASK_FLD, 8, 1)
+    FIELD(IRQ_MASK_REG, RECV_OVERFLOW_MASK_FLD, 7, 1)
+    FIELD(IRQ_MASK_REG, INDIRECT_XFER_LEVEL_BREACH_MASK_FLD, 6, 1)
+    FIELD(IRQ_MASK_REG, ILLEGAL_ACCESS_DET_MASK_FLD, 5, 1)
+    FIELD(IRQ_MASK_REG, PROT_WR_ATTEMPT_MASK_FLD, 4, 1)
+    FIELD(IRQ_MASK_REG, INDIRECT_TRANSFER_REJECT_MASK_FLD, 3, 1)
+    FIELD(IRQ_MASK_REG, INDIRECT_OP_DONE_MASK_FLD, 2, 1)
+    FIELD(IRQ_MASK_REG, UNDERFLOW_DET_MASK_FLD, 1, 1)
+    FIELD(IRQ_MASK_REG, MODE_M_FAIL_MASK_FLD, 0, 1)
+REG32(LOWER_WR_PROT_REG, 0x50)
+REG32(UPPER_WR_PROT_REG, 0x54)
+REG32(WR_PROT_CTRL_REG, 0x58)
+    FIELD(WR_PROT_CTRL_REG, WR_PROT_CTRL_RESV_FLD, 2, 30)
+    FIELD(WR_PROT_CTRL_REG, ENB_FLD, 1, 1)
+    FIELD(WR_PROT_CTRL_REG, INV_FLD, 0, 1)
+REG32(INDIRECT_READ_XFER_CTRL_REG, 0x60)
+    FIELD(INDIRECT_READ_XFER_CTRL_REG, INDIR_RD_XFER_RESV_FLD, 8, 24)
+    FIELD(INDIRECT_READ_XFER_CTRL_REG, NUM_IND_OPS_DONE_FLD, 6, 2)
+    FIELD(INDIRECT_READ_XFER_CTRL_REG, IND_OPS_DONE_STATUS_FLD, 5, 1)
+    FIELD(INDIRECT_READ_XFER_CTRL_REG, RD_QUEUED_FLD, 4, 1)
+    FIELD(INDIRECT_READ_XFER_CTRL_REG, SRAM_FULL_FLD, 3, 1)
+    FIELD(INDIRECT_READ_XFER_CTRL_REG, RD_STATUS_FLD, 2, 1)
+    FIELD(INDIRECT_READ_XFER_CTRL_REG, CANCEL_FLD, 1, 1)
+    FIELD(INDIRECT_READ_XFER_CTRL_REG, START_FLD, 0, 1)
+REG32(INDIRECT_READ_XFER_WATERMARK_REG, 0x64)
+REG32(INDIRECT_READ_XFER_START_REG, 0x68)
+REG32(INDIRECT_READ_XFER_NUM_BYTES_REG, 0x6c)
+REG32(INDIRECT_WRITE_XFER_CTRL_REG, 0x70)
+    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, INDIR_WR_XFER_RESV2_FLD, 8, 24)
+    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, NUM_IND_OPS_DONE_FLD, 6, 2)
+    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, IND_OPS_DONE_STATUS_FLD, 5, 1)
+    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, WR_QUEUED_FLD, 4, 1)
+    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, INDIR_WR_XFER_RESV1_FLD, 3, 1)
+    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, WR_STATUS_FLD, 2, 1)
+    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, CANCEL_FLD, 1, 1)
+    FIELD(INDIRECT_WRITE_XFER_CTRL_REG, START_FLD, 0, 1)
+REG32(INDIRECT_WRITE_XFER_WATERMARK_REG, 0x74)
+REG32(INDIRECT_WRITE_XFER_START_REG, 0x78)
+REG32(INDIRECT_WRITE_XFER_NUM_BYTES_REG, 0x7c)
+REG32(INDIRECT_TRIGGER_ADDR_RANGE_REG, 0x80)
+    FIELD(INDIRECT_TRIGGER_ADDR_RANGE_REG, IND_RANGE_RESV1_FLD, 4, 28)
+    FIELD(INDIRECT_TRIGGER_ADDR_RANGE_REG, IND_RANGE_WIDTH_FLD, 0, 4)
+REG32(FLASH_COMMAND_CTRL_MEM_REG, 0x8c)
+    FIELD(FLASH_COMMAND_CTRL_MEM_REG, FLASH_COMMAND_CTRL_MEM_RESV1_FLD, 29, 3)
+    FIELD(FLASH_COMMAND_CTRL_MEM_REG, MEM_BANK_ADDR_FLD, 20, 9)
+    FIELD(FLASH_COMMAND_CTRL_MEM_REG, FLASH_COMMAND_CTRL_MEM_RESV2_FLD, 19, 1)
+    FIELD(FLASH_COMMAND_CTRL_MEM_REG, NB_OF_STIG_READ_BYTES_FLD, 16, 3)
+    FIELD(FLASH_COMMAND_CTRL_MEM_REG, MEM_BANK_READ_DATA_FLD, 8, 8)
+    FIELD(FLASH_COMMAND_CTRL_MEM_REG, FLASH_COMMAND_CTRL_MEM_RESV3_FLD, 2, 6)
+    FIELD(FLASH_COMMAND_CTRL_MEM_REG, MEM_BANK_REQ_IN_PROGRESS_FLD, 1, 1)
+    FIELD(FLASH_COMMAND_CTRL_MEM_REG, TRIGGER_MEM_BANK_REQ_FLD, 0, 1)
+REG32(FLASH_CMD_CTRL_REG, 0x90)
+    FIELD(FLASH_CMD_CTRL_REG, CMD_OPCODE_FLD, 24, 8)
+    FIELD(FLASH_CMD_CTRL_REG, ENB_READ_DATA_FLD, 23, 1)
+    FIELD(FLASH_CMD_CTRL_REG, NUM_RD_DATA_BYTES_FLD, 20, 3)
+    FIELD(FLASH_CMD_CTRL_REG, ENB_COMD_ADDR_FLD, 19, 1)
+    FIELD(FLASH_CMD_CTRL_REG, ENB_MODE_BIT_FLD, 18, 1)
+    FIELD(FLASH_CMD_CTRL_REG, NUM_ADDR_BYTES_FLD, 16, 2)
+    FIELD(FLASH_CMD_CTRL_REG, ENB_WRITE_DATA_FLD, 15, 1)
+    FIELD(FLASH_CMD_CTRL_REG, NUM_WR_DATA_BYTES_FLD, 12, 3)
+    FIELD(FLASH_CMD_CTRL_REG, NUM_DUMMY_CYCLES_FLD, 7, 5)
+    FIELD(FLASH_CMD_CTRL_REG, FLASH_CMD_CTRL_RESV1_FLD, 3, 4)
+    FIELD(FLASH_CMD_CTRL_REG, STIG_MEM_BANK_EN_FLD, 2, 1)
+    FIELD(FLASH_CMD_CTRL_REG, CMD_EXEC_STATUS_FLD, 1, 1)
+    FIELD(FLASH_CMD_CTRL_REG, CMD_EXEC_FLD, 0, 1)
+REG32(FLASH_CMD_ADDR_REG, 0x94)
+REG32(FLASH_RD_DATA_LOWER_REG, 0xa0)
+REG32(FLASH_RD_DATA_UPPER_REG, 0xa4)
+REG32(FLASH_WR_DATA_LOWER_REG, 0xa8)
+REG32(FLASH_WR_DATA_UPPER_REG, 0xac)
+REG32(POLLING_FLASH_STATUS_REG, 0xb0)
+    FIELD(POLLING_FLASH_STATUS_REG, DEVICE_STATUS_RSVD_FLD2, 21, 11)
+    FIELD(POLLING_FLASH_STATUS_REG, DEVICE_STATUS_NB_DUMMY, 16, 5)
+    FIELD(POLLING_FLASH_STATUS_REG, DEVICE_STATUS_RSVD_FLD1, 9, 7)
+    FIELD(POLLING_FLASH_STATUS_REG, DEVICE_STATUS_VALID_FLD, 8, 1)
+    FIELD(POLLING_FLASH_STATUS_REG, DEVICE_STATUS_FLD, 0, 8)
+REG32(PHY_CONFIGURATION_REG, 0xb4)
+    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RESYNC_FLD, 31, 1)
+    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RESET_FLD, 30, 1)
+    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RX_DLL_BYPASS_FLD, 29, 1)
+    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RESV2_FLD, 23, 6)
+    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_TX_DLL_DELAY_FLD, 16, 7)
+    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RESV1_FLD, 7, 9)
+    FIELD(PHY_CONFIGURATION_REG, PHY_CONFIG_RX_DLL_DELAY_FLD, 0, 7)
+REG32(PHY_MASTER_CONTROL_REG, 0xb8)
+    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_CONTROL_RESV3_FLD, 25, 7)
+    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_LOCK_MODE_FLD, 24, 1)
+    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_BYPASS_MODE_FLD, 23, 1)
+    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_PHASE_DETECT_SELECTOR_FLD, 20, 3)
+    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_CONTROL_RESV2_FLD, 19, 1)
+    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_NB_INDICATIONS_FLD, 16, 3)
+    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_CONTROL_RESV1_FLD, 7, 9)
+    FIELD(PHY_MASTER_CONTROL_REG, PHY_MASTER_INITIAL_DELAY_FLD, 0, 7)
+REG32(DLL_OBSERVABLE_LOWER_REG, 0xbc)
+    FIELD(DLL_OBSERVABLE_LOWER_REG,
+          DLL_OBSERVABLE_LOWER_DLL_LOCK_INC_FLD, 24, 8)
+    FIELD(DLL_OBSERVABLE_LOWER_REG,
+          DLL_OBSERVABLE_LOWER_DLL_LOCK_DEC_FLD, 16, 8)
+    FIELD(DLL_OBSERVABLE_LOWER_REG,
+          DLL_OBSERVABLE_LOWER_LOOPBACK_LOCK_FLD, 15, 1)
+    FIELD(DLL_OBSERVABLE_LOWER_REG,
+          DLL_OBSERVABLE_LOWER_LOCK_VALUE_FLD, 8, 7)
+    FIELD(DLL_OBSERVABLE_LOWER_REG,
+          DLL_OBSERVABLE_LOWER_UNLOCK_COUNTER_FLD, 3, 5)
+    FIELD(DLL_OBSERVABLE_LOWER_REG,
+          DLL_OBSERVABLE_LOWER_LOCK_MODE_FLD, 1, 2)
+    FIELD(DLL_OBSERVABLE_LOWER_REG,
+          DLL_OBSERVABLE_LOWER_DLL_LOCK_FLD, 0, 1)
+REG32(DLL_OBSERVABLE_UPPER_REG, 0xc0)
+    FIELD(DLL_OBSERVABLE_UPPER_REG,
+          DLL_OBSERVABLE_UPPER_RESV2_FLD, 23, 9)
+    FIELD(DLL_OBSERVABLE_UPPER_REG,
+          DLL_OBSERVABLE_UPPER_TX_DECODER_OUTPUT_FLD, 16, 7)
+    FIELD(DLL_OBSERVABLE_UPPER_REG,
+          DLL_OBSERVABLE_UPPER_RESV1_FLD, 7, 9)
+    FIELD(DLL_OBSERVABLE_UPPER_REG,
+          DLL_OBSERVABLE__UPPER_RX_DECODER_OUTPUT_FLD, 0, 7)
+REG32(OPCODE_EXT_LOWER_REG, 0xe0)
+    FIELD(OPCODE_EXT_LOWER_REG, EXT_READ_OPCODE_FLD, 24, 8)
+    FIELD(OPCODE_EXT_LOWER_REG, EXT_WRITE_OPCODE_FLD, 16, 8)
+    FIELD(OPCODE_EXT_LOWER_REG, EXT_POLL_OPCODE_FLD, 8, 8)
+    FIELD(OPCODE_EXT_LOWER_REG, EXT_STIG_OPCODE_FLD, 0, 8)
+REG32(OPCODE_EXT_UPPER_REG, 0xe4)
+    FIELD(OPCODE_EXT_UPPER_REG, WEL_OPCODE_FLD, 24, 8)
+    FIELD(OPCODE_EXT_UPPER_REG, EXT_WEL_OPCODE_FLD, 16, 8)
+    FIELD(OPCODE_EXT_UPPER_REG, OPCODE_EXT_UPPER_RESV1_FLD, 0, 16)
+REG32(MODULE_ID_REG, 0xfc)
+    FIELD(MODULE_ID_REG, FIX_PATCH_FLD, 24, 8)
+    FIELD(MODULE_ID_REG, MODULE_ID_FLD, 8, 16)
+    FIELD(MODULE_ID_REG, MODULE_ID_RESV_FLD, 2, 6)
+    FIELD(MODULE_ID_REG, CONF_FLD, 0, 2)
+
+#define RXFF_SZ 1024
+#define TXFF_SZ 1024
+
+#define MAX_RX_DEC_OUT 8
+
+#define SZ_512MBIT (512 * 1024 * 1024)
+#define SZ_1GBIT   (1024 * 1024 * 1024)
+#define SZ_2GBIT   (2ULL * SZ_1GBIT)
+#define SZ_4GBIT   (4ULL * SZ_1GBIT)
+
+#define IS_IND_DMA_START(op) (op->done_bytes == 0)
+/*
+ * Bit field size of R_INDIRECT_WRITE_XFER_CTRL_REG_NUM_IND_OPS_DONE_FLD
+ * is 2 bits, which can record max of 3 indac operations.
+ */
+#define IND_OPS_DONE_MAX 3
+
+typedef enum {
+    WREN = 0x6,
+} FlashCMD;
+
+static unsigned int ospi_stig_addr_len(XlnxVersalOspi *s)
+{
+    /* Num address bytes is NUM_ADDR_BYTES_FLD + 1 */
+    return ARRAY_FIELD_EX32(s->regs,
+                            FLASH_CMD_CTRL_REG, NUM_ADDR_BYTES_FLD) + 1;
+}
+
+static unsigned int ospi_stig_wr_data_len(XlnxVersalOspi *s)
+{
+    /* Num write data bytes is NUM_WR_DATA_BYTES_FLD + 1 */
+    return ARRAY_FIELD_EX32(s->regs,
+                            FLASH_CMD_CTRL_REG, NUM_WR_DATA_BYTES_FLD) + 1;
+}
+
+static unsigned int ospi_stig_rd_data_len(XlnxVersalOspi *s)
+{
+    /* Num read data bytes is NUM_RD_DATA_BYTES_FLD + 1 */
+    return ARRAY_FIELD_EX32(s->regs,
+                            FLASH_CMD_CTRL_REG, NUM_RD_DATA_BYTES_FLD) + 1;
+}
+
+/*
+ * Status bits in R_IRQ_STATUS_REG are set when the event occurs and the
+ * interrupt is enabled in the mask register ([1] Section 2.3.17)
+ */
+static void set_irq(XlnxVersalOspi *s, uint32_t set_mask)
+{
+    s->regs[R_IRQ_STATUS_REG] |= s->regs[R_IRQ_MASK_REG] & set_mask;
+}
+
+static void ospi_update_irq_line(XlnxVersalOspi *s)
+{
+    qemu_set_irq(s->irq, !!(s->regs[R_IRQ_STATUS_REG] &
+                            s->regs[R_IRQ_MASK_REG]));
+}
+
+static uint8_t ospi_get_wr_opcode(XlnxVersalOspi *s)
+{
+    return ARRAY_FIELD_EX32(s->regs,
+                            DEV_INSTR_WR_CONFIG_REG, WR_OPCODE_FLD);
+}
+
+static uint8_t ospi_get_rd_opcode(XlnxVersalOspi *s)
+{
+    return ARRAY_FIELD_EX32(s->regs,
+                            DEV_INSTR_RD_CONFIG_REG, RD_OPCODE_NON_XIP_FLD);
+}
+
+static uint32_t ospi_get_num_addr_bytes(XlnxVersalOspi *s)
+{
+    /* Num address bytes is NUM_ADDR_BYTES_FLD + 1 */
+    return ARRAY_FIELD_EX32(s->regs,
+                            DEV_SIZE_CONFIG_REG, NUM_ADDR_BYTES_FLD) + 1;
+}
+
+static void ospi_stig_membank_req(XlnxVersalOspi *s)
+{
+    int idx = ARRAY_FIELD_EX32(s->regs,
+                               FLASH_COMMAND_CTRL_MEM_REG, MEM_BANK_ADDR_FLD);
+
+    ARRAY_FIELD_DP32(s->regs, FLASH_COMMAND_CTRL_MEM_REG,
+                     MEM_BANK_READ_DATA_FLD, s->stig_membank[idx]);
+}
+
+static int ospi_stig_membank_rd_bytes(XlnxVersalOspi *s)
+{
+    int rd_data_fld = ARRAY_FIELD_EX32(s->regs, FLASH_COMMAND_CTRL_MEM_REG,
+                                       NB_OF_STIG_READ_BYTES_FLD);
+    static const int sizes[6] = { 16, 32, 64, 128, 256, 512 };
+    return (rd_data_fld < 6) ? sizes[rd_data_fld] : 0;
+}
+
+static uint32_t ospi_get_page_sz(XlnxVersalOspi *s)
+{
+    return ARRAY_FIELD_EX32(s->regs,
+                            DEV_SIZE_CONFIG_REG, BYTES_PER_DEVICE_PAGE_FLD);
+}
+
+static bool ospi_ind_rd_watermark_enabled(XlnxVersalOspi *s)
+{
+    return s->regs[R_INDIRECT_READ_XFER_WATERMARK_REG];
+}
+
+static void ind_op_advance(IndOp *op, unsigned int len)
+{
+    op->done_bytes += len;
+    assert(op->done_bytes <= op->num_bytes);
+    if (op->done_bytes == op->num_bytes) {
+        op->completed = true;
+    }
+}
+
+static uint32_t ind_op_next_byte(IndOp *op)
+{
+    return op->flash_addr + op->done_bytes;
+}
+
+static uint32_t ind_op_end_byte(IndOp *op)
+{
+    return op->flash_addr + op->num_bytes;
+}
+
+static void ospi_ind_op_next(IndOp *op)
+{
+    op[0] = op[1];
+    op[1].completed = true;
+}
+
+static void ind_op_setup(IndOp *op, uint32_t flash_addr, uint32_t num_bytes)
+{
+    if (num_bytes & 0x3) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "OSPI indirect op num bytes not word aligned\n");
+    }
+    op->flash_addr = flash_addr;
+    op->num_bytes = num_bytes;
+    op->done_bytes = 0;
+    op->completed = false;
+}
+
+static bool ospi_ind_op_completed(IndOp *op)
+{
+    return op->completed;
+}
+
+static bool ospi_ind_op_all_completed(XlnxVersalOspi *s)
+{
+    return s->rd_ind_op[0].completed && s->wr_ind_op[0].completed;
+}
+
+static void ospi_ind_op_cancel(IndOp *op)
+{
+    op[0].completed = true;
+    op[1].completed = true;
+}
+
+static bool ospi_ind_op_add(IndOp *op, Fifo8 *fifo,
+                            uint32_t flash_addr, uint32_t num_bytes)
+{
+    /* Check if first indirect op has been completed */
+    if (op->completed) {
+        fifo8_reset(fifo);
+        ind_op_setup(op, flash_addr, num_bytes);
+        return false;
+    }
+
+    /* Check if second indirect op has been completed */
+    op++;
+    if (op->completed) {
+        ind_op_setup(op, flash_addr, num_bytes);
+        return false;
+    }
+    return true;
+}
+
+static void ospi_ind_op_queue_up_rd(XlnxVersalOspi *s)
+{
+    uint32_t num_bytes = s->regs[R_INDIRECT_READ_XFER_NUM_BYTES_REG];
+    uint32_t flash_addr = s->regs[R_INDIRECT_READ_XFER_START_REG];
+    bool failed;
+
+    failed = ospi_ind_op_add(s->rd_ind_op, &s->rx_sram, flash_addr, num_bytes);
+    /* If two already queued set rd reject interrupt */
+    if (failed) {
+        set_irq(s, R_IRQ_STATUS_REG_INDIRECT_TRANSFER_REJECT_FLD_MASK);
+    }
+}
+
+static void ospi_ind_op_queue_up_wr(XlnxVersalOspi *s)
+{
+    uint32_t num_bytes = s->regs[R_INDIRECT_WRITE_XFER_NUM_BYTES_REG];
+    uint32_t flash_addr = s->regs[R_INDIRECT_WRITE_XFER_START_REG];
+    bool failed;
+
+    failed = ospi_ind_op_add(s->wr_ind_op, &s->tx_sram, flash_addr, num_bytes);
+    /* If two already queued set rd reject interrupt */
+    if (failed) {
+        set_irq(s, R_IRQ_STATUS_REG_INDIRECT_TRANSFER_REJECT_FLD_MASK);
+    }
+}
+
+static uint64_t flash_sz(XlnxVersalOspi *s, unsigned int cs)
+{
+    /* Flash sizes in MB */
+    static const uint64_t sizes[4] = { SZ_512MBIT / 8, SZ_1GBIT / 8,
+                                       SZ_2GBIT / 8, SZ_4GBIT / 8 };
+    uint32_t v = s->regs[R_DEV_SIZE_CONFIG_REG];
+
+    v >>= cs * R_DEV_SIZE_CONFIG_REG_MEM_SIZE_ON_CS0_FLD_LENGTH;
+    return sizes[FIELD_EX32(v, DEV_SIZE_CONFIG_REG, MEM_SIZE_ON_CS0_FLD)];
+}
+
+static unsigned int ospi_get_block_sz(XlnxVersalOspi *s)
+{
+    unsigned int block_fld = ARRAY_FIELD_EX32(s->regs,
+                                              DEV_SIZE_CONFIG_REG,
+                                              BYTES_PER_SUBSECTOR_FLD);
+    return 1 << block_fld;
+}
+
+static unsigned int flash_blocks(XlnxVersalOspi *s, unsigned int cs)
+{
+    unsigned int b_sz = ospi_get_block_sz(s);
+    unsigned int f_sz = flash_sz(s, cs);
+
+    return f_sz / b_sz;
+}
+
+static int ospi_ahb_decoder_cs(XlnxVersalOspi *s, hwaddr addr)
+{
+    uint64_t end_addr = 0;
+    int cs;
+
+    for (cs = 0; cs < s->num_cs; cs++) {
+        end_addr += flash_sz(s, cs);
+        if (addr < end_addr) {
+            break;
+        }
+    }
+
+    if (cs == s->num_cs) {
+        /* Address is out of range */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "OSPI flash address does not fit in configuration\n");
+        return -1;
+    }
+    return cs;
+}
+
+static void ospi_ahb_decoder_enable_cs(XlnxVersalOspi *s, hwaddr addr)
+{
+    int cs = ospi_ahb_decoder_cs(s, addr);
+
+    if (cs >= 0) {
+        for (int i = 0; i < s->num_cs; i++) {
+            qemu_set_irq(s->cs_lines[i], cs != i);
+        }
+    }
+}
+
+static unsigned int single_cs(XlnxVersalOspi *s)
+{
+    unsigned int field = ARRAY_FIELD_EX32(s->regs,
+                                          CONFIG_REG, PERIPH_CS_LINES_FLD);
+
+    /*
+     * Below one liner is a trick that finds the rightmost zero and makes sure
+     * all other bits are turned to 1. It is a variant of the 'Isolate the
+     * rightmost 0-bit' trick found below at the time of writing:
+     *
+     * https://emre.me/computer-science/bit-manipulation-tricks/
+     *
+     * 4'bXXX0 -> 4'b1110
+     * 4'bXX01 -> 4'b1101
+     * 4'bX011 -> 4'b1011
+     * 4'b0111 -> 4'b0111
+     * 4'b1111 -> 4'b1111
+     */
+    return (field | ~(field + 1)) & 0xf;
+}
+
+static void ospi_update_cs_lines(XlnxVersalOspi *s)
+{
+    unsigned int all_cs;
+    int i;
+
+    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, PERIPH_SEL_DEC_FLD)) {
+        all_cs = ARRAY_FIELD_EX32(s->regs, CONFIG_REG, PERIPH_CS_LINES_FLD);
+    } else {
+        all_cs = single_cs(s);
+    }
+
+    for (i = 0; i < s->num_cs; i++) {
+        bool cs = (all_cs >> i) & 1;
+
+        qemu_set_irq(s->cs_lines[i], cs);
+    }
+}
+
+static void ospi_dac_cs(XlnxVersalOspi *s, hwaddr addr)
+{
+    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENABLE_AHB_DECODER_FLD)) {
+        ospi_ahb_decoder_enable_cs(s, addr);
+    } else {
+        ospi_update_cs_lines(s);
+    }
+}
+
+static void ospi_disable_cs(XlnxVersalOspi *s)
+{
+    int i;
+
+    for (i = 0; i < s->num_cs; i++) {
+        qemu_set_irq(s->cs_lines[i], 1);
+    }
+}
+
+static void ospi_flush_txfifo(XlnxVersalOspi *s)
+{
+    while (!fifo8_is_empty(&s->tx_fifo)) {
+        uint32_t tx_rx = fifo8_pop(&s->tx_fifo);
+
+        tx_rx = ssi_transfer(s->spi, tx_rx);
+        fifo8_push(&s->rx_fifo, tx_rx);
+    }
+}
+
+static void ospi_tx_fifo_push_address_raw(XlnxVersalOspi *s,
+                                          uint32_t flash_addr,
+                                          unsigned int addr_bytes)
+{
+    /* Push write address */
+    if (addr_bytes == 4) {
+        fifo8_push(&s->tx_fifo, flash_addr >> 24);
+    }
+    if (addr_bytes >= 3) {
+        fifo8_push(&s->tx_fifo, flash_addr >> 16);
+    }
+    if (addr_bytes >= 2) {
+        fifo8_push(&s->tx_fifo, flash_addr >> 8);
+    }
+    fifo8_push(&s->tx_fifo, flash_addr);
+}
+
+static void ospi_tx_fifo_push_address(XlnxVersalOspi *s, uint32_t flash_addr)
+{
+    /* Push write address */
+    int addr_bytes = ospi_get_num_addr_bytes(s);
+
+    ospi_tx_fifo_push_address_raw(s, flash_addr, addr_bytes);
+}
+
+static void ospi_tx_fifo_push_stig_addr(XlnxVersalOspi *s)
+{
+    uint32_t flash_addr = s->regs[R_FLASH_CMD_ADDR_REG];
+    unsigned int addr_bytes = ospi_stig_addr_len(s);
+
+    ospi_tx_fifo_push_address_raw(s, flash_addr, addr_bytes);
+}
+
+static void ospi_tx_fifo_push_rd_op_addr(XlnxVersalOspi *s, uint32_t flash_addr)
+{
+    uint8_t inst_code = ospi_get_rd_opcode(s);
+
+    fifo8_reset(&s->tx_fifo);
+
+    /* Push read opcode */
+    fifo8_push(&s->tx_fifo, inst_code);
+
+    /* Push read address */
+    ospi_tx_fifo_push_address(s, flash_addr);
+}
+
+static void ospi_tx_fifo_push_stig_wr_data(XlnxVersalOspi *s)
+{
+    uint64_t data = s->regs[R_FLASH_WR_DATA_LOWER_REG];
+    int wr_data_len = ospi_stig_wr_data_len(s);
+    int i;
+
+    data |= (uint64_t) s->regs[R_FLASH_WR_DATA_UPPER_REG] << 32;
+    for (i = 0; i < wr_data_len; i++) {
+        int shift = i * 8;
+        fifo8_push(&s->tx_fifo, data >> shift);
+    }
+}
+
+static void ospi_tx_fifo_push_stig_rd_data(XlnxVersalOspi *s)
+{
+    int rd_data_len;
+    int i;
+
+    if (ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, STIG_MEM_BANK_EN_FLD)) {
+        rd_data_len = ospi_stig_membank_rd_bytes(s);
+    } else {
+        rd_data_len = ospi_stig_rd_data_len(s);
+    }
+
+    /* transmit second part (data) */
+    for (i = 0; i < rd_data_len; ++i) {
+        fifo8_push(&s->tx_fifo, 0);
+    }
+}
+
+static void ospi_rx_fifo_pop_stig_rd_data(XlnxVersalOspi *s)
+{
+    int size = ospi_stig_rd_data_len(s);
+    uint8_t bytes[8] = {};
+    int i;
+
+    size = MIN(fifo8_num_used(&s->rx_fifo), size);
+
+    assert(size <= 8);
+
+    for (i = 0; i < size; i++) {
+        bytes[i] = fifo8_pop(&s->rx_fifo);
+    }
+
+    s->regs[R_FLASH_RD_DATA_LOWER_REG] = ldl_le_p(bytes);
+    s->regs[R_FLASH_RD_DATA_UPPER_REG] = ldl_le_p(bytes + 4);
+}
+
+static void ospi_ind_read(XlnxVersalOspi *s, uint32_t flash_addr, uint32_t len)
+{
+    int i;
+
+    /* Create first section of read cmd */
+    ospi_tx_fifo_push_rd_op_addr(s, flash_addr);
+
+    /* transmit first part */
+    ospi_update_cs_lines(s);
+    ospi_flush_txfifo(s);
+
+    fifo8_reset(&s->rx_fifo);
+
+    /* transmit second part (data) */
+    for (i = 0; i < len; ++i) {
+        fifo8_push(&s->tx_fifo, 0);
+    }
+    ospi_flush_txfifo(s);
+
+    for (i = 0; i < len; ++i) {
+        fifo8_push(&s->rx_sram, fifo8_pop(&s->rx_fifo));
+    }
+
+    /* done */
+    ospi_disable_cs(s);
+}
+
+static unsigned int ospi_dma_burst_size(XlnxVersalOspi *s)
+{
+    return 1 << ARRAY_FIELD_EX32(s->regs,
+                                 DMA_PERIPH_CONFIG_REG,
+                                 NUM_BURST_REQ_BYTES_FLD);
+}
+
+static unsigned int ospi_dma_single_size(XlnxVersalOspi *s)
+{
+    return 1 << ARRAY_FIELD_EX32(s->regs,
+                                 DMA_PERIPH_CONFIG_REG,
+                                 NUM_SINGLE_REQ_BYTES_FLD);
+}
+
+static void ind_rd_inc_num_done(XlnxVersalOspi *s)
+{
+    unsigned int done = ARRAY_FIELD_EX32(s->regs,
+                                         INDIRECT_READ_XFER_CTRL_REG,
+                                         NUM_IND_OPS_DONE_FLD);
+    if (done < IND_OPS_DONE_MAX) {
+        done++;
+    }
+    done &= 0x3;
+    ARRAY_FIELD_DP32(s->regs, INDIRECT_READ_XFER_CTRL_REG,
+                     NUM_IND_OPS_DONE_FLD, done);
+}
+
+static void ospi_ind_rd_completed(XlnxVersalOspi *s)
+{
+    ARRAY_FIELD_DP32(s->regs, INDIRECT_READ_XFER_CTRL_REG,
+                     IND_OPS_DONE_STATUS_FLD, 1);
+
+    ind_rd_inc_num_done(s);
+    ospi_ind_op_next(s->rd_ind_op);
+    if (ospi_ind_op_all_completed(s)) {
+        set_irq(s, R_IRQ_STATUS_REG_INDIRECT_OP_DONE_FLD_MASK);
+    }
+}
+
+static void ospi_dma_read(XlnxVersalOspi *s)
+{
+    IndOp *op = s->rd_ind_op;
+    uint32_t dma_len = op->num_bytes;
+    uint32_t burst_sz = ospi_dma_burst_size(s);
+    uint32_t single_sz = ospi_dma_single_size(s);
+    uint32_t ind_trig_range;
+    uint32_t remainder;
+    XlnxCSUDMAClass *xcdc = XLNX_CSU_DMA_GET_CLASS(s->dma_src);
+
+    ind_trig_range = (1 << ARRAY_FIELD_EX32(s->regs,
+                                            INDIRECT_TRIGGER_ADDR_RANGE_REG,
+                                            IND_RANGE_WIDTH_FLD));
+    remainder = dma_len % burst_sz;
+    remainder = remainder % single_sz;
+    if (burst_sz > ind_trig_range || single_sz > ind_trig_range ||
+        remainder != 0) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "OSPI DMA burst size / single size config error\n");
+    }
+
+    s->src_dma_inprog = true;
+    if (xcdc->read(s->dma_src, 0, dma_len) != MEMTX_OK) {
+        qemu_log_mask(LOG_GUEST_ERROR, "OSPI DMA configuration error\n");
+    }
+    s->src_dma_inprog = false;
+}
+
+static void ospi_do_ind_read(XlnxVersalOspi *s)
+{
+    IndOp *op = s->rd_ind_op;
+    uint32_t next_b;
+    uint32_t end_b;
+    uint32_t len;
+    bool start_dma = IS_IND_DMA_START(op) && !s->src_dma_inprog;
+
+    /* Continue to read flash until we run out of space in sram */
+    while (!ospi_ind_op_completed(op) &&
+           !fifo8_is_full(&s->rx_sram)) {
+        /* Read reqested number of bytes, max bytes limited to size of sram */
+        next_b = ind_op_next_byte(op);
+        end_b = next_b + fifo8_num_free(&s->rx_sram);
+        end_b = MIN(end_b, ind_op_end_byte(op));
+
+        len = end_b - next_b;
+        ospi_ind_read(s, next_b, len);
+        ind_op_advance(op, len);
+
+        if (ospi_ind_rd_watermark_enabled(s)) {
+            ARRAY_FIELD_DP32(s->regs, IRQ_STATUS_REG,
+                             INDIRECT_XFER_LEVEL_BREACH_FLD, 1);
+            set_irq(s,
+                    R_IRQ_STATUS_REG_INDIRECT_XFER_LEVEL_BREACH_FLD_MASK);
+        }
+
+        if (!s->src_dma_inprog &&
+            ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_DMA_IF_FLD)) {
+            ospi_dma_read(s);
+        }
+    }
+
+    /* Set sram full */
+    if (fifo8_num_used(&s->rx_sram) == RXFF_SZ) {
+        ARRAY_FIELD_DP32(s->regs,
+                         INDIRECT_READ_XFER_CTRL_REG, SRAM_FULL_FLD, 1);
+        set_irq(s, R_IRQ_STATUS_REG_INDRD_SRAM_FULL_FLD_MASK);
+    }
+
+    /* Signal completion if done, unless inside recursion via ospi_dma_read */
+    if (!ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_DMA_IF_FLD) || start_dma) {
+        if (ospi_ind_op_completed(op)) {
+            ospi_ind_rd_completed(s);
+        }
+    }
+}
+
+/* Transmit write enable instruction */
+static void ospi_transmit_wel(XlnxVersalOspi *s, bool ahb_decoder_cs,
+                              hwaddr addr)
+{
+    fifo8_reset(&s->tx_fifo);
+    fifo8_push(&s->tx_fifo, WREN);
+
+    if (ahb_decoder_cs) {
+        ospi_ahb_decoder_enable_cs(s, addr);
+    } else {
+        ospi_update_cs_lines(s);
+    }
+
+    ospi_flush_txfifo(s);
+    ospi_disable_cs(s);
+
+    fifo8_reset(&s->rx_fifo);
+}
+
+static void ospi_ind_write(XlnxVersalOspi *s, uint32_t flash_addr, uint32_t len)
+{
+    bool ahb_decoder_cs = false;
+    uint8_t inst_code;
+    int i;
+
+    assert(fifo8_num_used(&s->tx_sram) >= len);
+
+    if (!ARRAY_FIELD_EX32(s->regs, DEV_INSTR_WR_CONFIG_REG, WEL_DIS_FLD)) {
+        ospi_transmit_wel(s, ahb_decoder_cs, 0);
+    }
+
+    /* reset fifos */
+    fifo8_reset(&s->tx_fifo);
+    fifo8_reset(&s->rx_fifo);
+
+    /* Push write opcode */
+    inst_code = ospi_get_wr_opcode(s);
+    fifo8_push(&s->tx_fifo, inst_code);
+
+    /* Push write address */
+    ospi_tx_fifo_push_address(s, flash_addr);
+
+    /* data */
+    for (i = 0; i < len; i++) {
+        fifo8_push(&s->tx_fifo, fifo8_pop(&s->tx_sram));
+    }
+
+    /* transmit */
+    ospi_update_cs_lines(s);
+    ospi_flush_txfifo(s);
+
+    /* done */
+    ospi_disable_cs(s);
+    fifo8_reset(&s->rx_fifo);
+}
+
+static void ind_wr_inc_num_done(XlnxVersalOspi *s)
+{
+    unsigned int done = ARRAY_FIELD_EX32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG,
+                                         NUM_IND_OPS_DONE_FLD);
+    if (done < IND_OPS_DONE_MAX) {
+        done++;
+    }
+    done &= 0x3;
+    ARRAY_FIELD_DP32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG,
+                     NUM_IND_OPS_DONE_FLD, done);
+}
+
+static void ospi_ind_wr_completed(XlnxVersalOspi *s)
+{
+    ARRAY_FIELD_DP32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG,
+                     IND_OPS_DONE_STATUS_FLD, 1);
+    ind_wr_inc_num_done(s);
+    ospi_ind_op_next(s->wr_ind_op);
+    /* Set indirect op done interrupt if enabled */
+    if (ospi_ind_op_all_completed(s)) {
+        set_irq(s, R_IRQ_STATUS_REG_INDIRECT_OP_DONE_FLD_MASK);
+    }
+}
+
+static void ospi_do_indirect_write(XlnxVersalOspi *s)
+{
+    uint32_t write_watermark = s->regs[R_INDIRECT_WRITE_XFER_WATERMARK_REG];
+    uint32_t pagesz = ospi_get_page_sz(s);
+    uint32_t page_mask = ~(pagesz - 1);
+    IndOp *op = s->wr_ind_op;
+    uint32_t next_b;
+    uint32_t end_b;
+    uint32_t len;
+
+    /* Write out tx_fifo in maximum page sz chunks */
+    while (!ospi_ind_op_completed(op) && fifo8_num_used(&s->tx_sram) > 0) {
+        next_b = ind_op_next_byte(op);
+        end_b = next_b +  MIN(fifo8_num_used(&s->tx_sram), pagesz);
+
+        /* Dont cross page boundary */
+        if ((end_b & page_mask) > next_b) {
+            end_b &= page_mask;
+        }
+
+        len = end_b - next_b;
+        len = MIN(len, op->num_bytes - op->done_bytes);
+        ospi_ind_write(s, next_b, len);
+        ind_op_advance(op, len);
+    }
+
+    /*
+     * Always set indirect transfer level breached interrupt if enabled
+     * (write watermark > 0) since the tx_sram always will be emptied
+     */
+    if (write_watermark > 0) {
+        set_irq(s, R_IRQ_STATUS_REG_INDIRECT_XFER_LEVEL_BREACH_FLD_MASK);
+    }
+
+    /* Signal completions if done */
+    if (ospi_ind_op_completed(op)) {
+        ospi_ind_wr_completed(s);
+    }
+}
+
+static void ospi_stig_fill_membank(XlnxVersalOspi *s)
+{
+    int num_rd_bytes = ospi_stig_membank_rd_bytes(s);
+    int idx = num_rd_bytes - 8; /* first of last 8 */
+    int i;
+
+    for (i = 0; i < num_rd_bytes; i++) {
+        s->stig_membank[i] = fifo8_pop(&s->rx_fifo);
+    }
+
+    g_assert((idx + 4) < ARRAY_SIZE(s->stig_membank));
+
+    /* Fill in lower upper regs */
+    s->regs[R_FLASH_RD_DATA_LOWER_REG] = ldl_le_p(&s->stig_membank[idx]);
+    s->regs[R_FLASH_RD_DATA_UPPER_REG] = ldl_le_p(&s->stig_membank[idx + 4]);
+}
+
+static void ospi_stig_cmd_exec(XlnxVersalOspi *s)
+{
+    uint8_t inst_code;
+
+    /* Reset fifos */
+    fifo8_reset(&s->tx_fifo);
+    fifo8_reset(&s->rx_fifo);
+
+    /* Push write opcode */
+    inst_code = ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, CMD_OPCODE_FLD);
+    fifo8_push(&s->tx_fifo, inst_code);
+
+    /* Push address if enabled */
+    if (ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, ENB_COMD_ADDR_FLD)) {
+        ospi_tx_fifo_push_stig_addr(s);
+    }
+
+    /* Enable cs */
+    ospi_update_cs_lines(s);
+
+    /* Data */
+    if (ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, ENB_WRITE_DATA_FLD)) {
+        ospi_tx_fifo_push_stig_wr_data(s);
+    } else if (ARRAY_FIELD_EX32(s->regs,
+                                FLASH_CMD_CTRL_REG, ENB_READ_DATA_FLD)) {
+        /* transmit first part */
+        ospi_flush_txfifo(s);
+        fifo8_reset(&s->rx_fifo);
+        ospi_tx_fifo_push_stig_rd_data(s);
+    }
+
+    /* Transmit */
+    ospi_flush_txfifo(s);
+    ospi_disable_cs(s);
+
+    if (ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, ENB_READ_DATA_FLD)) {
+        if (ARRAY_FIELD_EX32(s->regs,
+                             FLASH_CMD_CTRL_REG, STIG_MEM_BANK_EN_FLD)) {
+            ospi_stig_fill_membank(s);
+        } else {
+            ospi_rx_fifo_pop_stig_rd_data(s);
+        }
+    }
+}
+
+static uint32_t ospi_block_address(XlnxVersalOspi *s, unsigned int block)
+{
+    unsigned int block_sz = ospi_get_block_sz(s);
+    unsigned int cs = 0;
+    uint32_t addr = 0;
+
+    while (cs < s->num_cs && block >= flash_blocks(s, cs)) {
+        block -= flash_blocks(s, 0);
+        addr += flash_sz(s, cs);
+    }
+    addr += block * block_sz;
+    return addr;
+}
+
+static uint32_t ospi_get_wr_prot_addr_low(XlnxVersalOspi *s)
+{
+    unsigned int block = s->regs[R_LOWER_WR_PROT_REG];
+
+    return ospi_block_address(s, block);
+}
+
+static uint32_t ospi_get_wr_prot_addr_upper(XlnxVersalOspi *s)
+{
+    unsigned int block = s->regs[R_UPPER_WR_PROT_REG];
+
+    /* Get address of first block out of defined range */
+    return ospi_block_address(s, block + 1);
+}
+
+static bool ospi_is_write_protected(XlnxVersalOspi *s, hwaddr addr)
+{
+    uint32_t wr_prot_addr_upper = ospi_get_wr_prot_addr_upper(s);
+    uint32_t wr_prot_addr_low = ospi_get_wr_prot_addr_low(s);
+    bool in_range = false;
+
+    if (addr >= wr_prot_addr_low && addr < wr_prot_addr_upper) {
+        in_range = true;
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, WR_PROT_CTRL_REG, INV_FLD)) {
+        in_range = !in_range;
+    }
+    return in_range;
+}
+
+static uint64_t ospi_rx_sram_read(XlnxVersalOspi *s, unsigned int size)
+{
+    uint8_t bytes[8] = {};
+    int i;
+
+    if (size < 4 && fifo8_num_used(&s->rx_sram) >= 4) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "OSPI only last read of internal "
+                      "sram is allowed to be < 32 bits\n");
+    }
+
+    size = MIN(fifo8_num_used(&s->rx_sram), size);
+
+    assert(size <= 8);
+
+    for (i = 0; i < size; i++) {
+        bytes[i] = fifo8_pop(&s->rx_sram);
+    }
+
+    return ldq_le_p(bytes);
+}
+
+static void ospi_tx_sram_write(XlnxVersalOspi *s, uint64_t value,
+                               unsigned int size)
+{
+    int i;
+    for (i = 0; i < size && !fifo8_is_full(&s->tx_sram); i++) {
+        fifo8_push(&s->tx_sram, value >> 8 * i);
+    }
+}
+
+static uint64_t ospi_do_dac_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
+    uint8_t bytes[8] = {};
+    int i;
+
+    /* Create first section of read cmd */
+    ospi_tx_fifo_push_rd_op_addr(s, (uint32_t) addr);
+
+    /* Enable cs and transmit first part */
+    ospi_dac_cs(s, addr);
+    ospi_flush_txfifo(s);
+
+    fifo8_reset(&s->rx_fifo);
+
+    /* transmit second part (data) */
+    for (i = 0; i < size; ++i) {
+        fifo8_push(&s->tx_fifo, 0);
+    }
+    ospi_flush_txfifo(s);
+
+    /* fill in result */
+    size = MIN(fifo8_num_used(&s->rx_fifo), size);
+
+    assert(size <= 8);
+
+    for (i = 0; i < size; i++) {
+        bytes[i] = fifo8_pop(&s->rx_fifo);
+    }
+
+    /* done */
+    ospi_disable_cs(s);
+
+    return ldq_le_p(bytes);
+}
+
+static void ospi_do_dac_write(void *opaque,
+                              hwaddr addr,
+                              uint64_t value,
+                              unsigned int size)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
+    bool ahb_decoder_cs = ARRAY_FIELD_EX32(s->regs, CONFIG_REG,
+                                           ENABLE_AHB_DECODER_FLD);
+    uint8_t inst_code;
+    unsigned int i;
+
+    if (!ARRAY_FIELD_EX32(s->regs, DEV_INSTR_WR_CONFIG_REG, WEL_DIS_FLD)) {
+        ospi_transmit_wel(s, ahb_decoder_cs, addr);
+    }
+
+    /* reset fifos */
+    fifo8_reset(&s->tx_fifo);
+    fifo8_reset(&s->rx_fifo);
+
+    /* Push write opcode */
+    inst_code = ospi_get_wr_opcode(s);
+    fifo8_push(&s->tx_fifo, inst_code);
+
+    /* Push write address */
+    ospi_tx_fifo_push_address(s, addr);
+
+    /* data */
+    for (i = 0; i < size; i++) {
+        fifo8_push(&s->tx_fifo, value >> 8 * i);
+    }
+
+    /* Enable cs and transmit */
+    ospi_dac_cs(s, addr);
+    ospi_flush_txfifo(s);
+    ospi_disable_cs(s);
+
+    fifo8_reset(&s->rx_fifo);
+}
+
+static void flash_cmd_ctrl_mem_reg_post_write(RegisterInfo *reg,
+                                              uint64_t val)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
+    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_SPI_FLD)) {
+        if (ARRAY_FIELD_EX32(s->regs,
+                             FLASH_COMMAND_CTRL_MEM_REG,
+                             TRIGGER_MEM_BANK_REQ_FLD)) {
+            ospi_stig_membank_req(s);
+            ARRAY_FIELD_DP32(s->regs, FLASH_COMMAND_CTRL_MEM_REG,
+                             TRIGGER_MEM_BANK_REQ_FLD, 0);
+        }
+    }
+}
+
+static void flash_cmd_ctrl_reg_post_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
+
+    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_SPI_FLD) &&
+        ARRAY_FIELD_EX32(s->regs, FLASH_CMD_CTRL_REG, CMD_EXEC_FLD)) {
+        ospi_stig_cmd_exec(s);
+        set_irq(s, R_IRQ_STATUS_REG_STIG_REQ_INT_FLD_MASK);
+        ARRAY_FIELD_DP32(s->regs, FLASH_CMD_CTRL_REG, CMD_EXEC_FLD, 0);
+    }
+}
+
+static uint64_t ind_wr_dec_num_done(XlnxVersalOspi *s, uint64_t val)
+{
+    unsigned int done = ARRAY_FIELD_EX32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG,
+                                         NUM_IND_OPS_DONE_FLD);
+    done--;
+    done &= 0x3;
+    val = FIELD_DP32(val, INDIRECT_WRITE_XFER_CTRL_REG,
+                     NUM_IND_OPS_DONE_FLD, done);
+    return val;
+}
+
+static bool ind_wr_clearing_op_done(XlnxVersalOspi *s, uint64_t new_val)
+{
+    bool set_in_reg = ARRAY_FIELD_EX32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG,
+                                       IND_OPS_DONE_STATUS_FLD);
+    bool set_in_new_val = FIELD_EX32(new_val, INDIRECT_WRITE_XFER_CTRL_REG,
+                                     IND_OPS_DONE_STATUS_FLD);
+    /* return true if clearing bit */
+    return set_in_reg && !set_in_new_val;
+}
+
+static uint64_t ind_wr_xfer_ctrl_reg_pre_write(RegisterInfo *reg,
+                                               uint64_t val)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
+
+    if (ind_wr_clearing_op_done(s, val)) {
+        val = ind_wr_dec_num_done(s, val);
+    }
+    return val;
+}
+
+static void ind_wr_xfer_ctrl_reg_post_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
+
+    if (s->ind_write_disabled) {
+        return;
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG, START_FLD)) {
+        ospi_ind_op_queue_up_wr(s);
+        ospi_do_indirect_write(s);
+        ARRAY_FIELD_DP32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG, START_FLD, 0);
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG, CANCEL_FLD)) {
+        ospi_ind_op_cancel(s->wr_ind_op);
+        fifo8_reset(&s->tx_sram);
+        ARRAY_FIELD_DP32(s->regs, INDIRECT_WRITE_XFER_CTRL_REG, CANCEL_FLD, 0);
+    }
+}
+
+static uint64_t ind_wr_xfer_ctrl_reg_post_read(RegisterInfo *reg,
+                                               uint64_t val)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
+    IndOp *op = s->wr_ind_op;
+
+    /* Check if ind ops is ongoing */
+    if (!ospi_ind_op_completed(&op[0])) {
+        /* Check if two ind ops are queued */
+        if (!ospi_ind_op_completed(&op[1])) {
+            val = FIELD_DP32(val, INDIRECT_WRITE_XFER_CTRL_REG,
+                             WR_QUEUED_FLD, 1);
+        }
+        val = FIELD_DP32(val, INDIRECT_WRITE_XFER_CTRL_REG, WR_STATUS_FLD, 1);
+    }
+    return val;
+}
+
+static uint64_t ind_rd_dec_num_done(XlnxVersalOspi *s, uint64_t val)
+{
+    unsigned int done = ARRAY_FIELD_EX32(s->regs, INDIRECT_READ_XFER_CTRL_REG,
+                                         NUM_IND_OPS_DONE_FLD);
+    done--;
+    done &= 0x3;
+    val = FIELD_DP32(val, INDIRECT_READ_XFER_CTRL_REG,
+                     NUM_IND_OPS_DONE_FLD, done);
+    return val;
+}
+
+static uint64_t ind_rd_xfer_ctrl_reg_pre_write(RegisterInfo *reg,
+                                               uint64_t val)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
+
+    if (FIELD_EX32(val, INDIRECT_READ_XFER_CTRL_REG,
+                   IND_OPS_DONE_STATUS_FLD)) {
+        val = ind_rd_dec_num_done(s, val);
+        val &= ~R_INDIRECT_READ_XFER_CTRL_REG_IND_OPS_DONE_STATUS_FLD_MASK;
+    }
+    return val;
+}
+
+static void ind_rd_xfer_ctrl_reg_post_write(RegisterInfo *reg, uint64_t val)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
+
+    if (ARRAY_FIELD_EX32(s->regs, INDIRECT_READ_XFER_CTRL_REG, START_FLD)) {
+        ospi_ind_op_queue_up_rd(s);
+        ospi_do_ind_read(s);
+        ARRAY_FIELD_DP32(s->regs, INDIRECT_READ_XFER_CTRL_REG, START_FLD, 0);
+    }
+
+    if (ARRAY_FIELD_EX32(s->regs, INDIRECT_READ_XFER_CTRL_REG, CANCEL_FLD)) {
+        ospi_ind_op_cancel(s->rd_ind_op);
+        fifo8_reset(&s->rx_sram);
+        ARRAY_FIELD_DP32(s->regs, INDIRECT_READ_XFER_CTRL_REG, CANCEL_FLD, 0);
+    }
+}
+
+static uint64_t ind_rd_xfer_ctrl_reg_post_read(RegisterInfo *reg,
+                                               uint64_t val)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
+    IndOp *op = s->rd_ind_op;
+
+    /* Check if ind ops is ongoing */
+    if (!ospi_ind_op_completed(&op[0])) {
+        /* Check if two ind ops are queued */
+        if (!ospi_ind_op_completed(&op[1])) {
+            val = FIELD_DP32(val, INDIRECT_READ_XFER_CTRL_REG,
+                             RD_QUEUED_FLD, 1);
+        }
+        val = FIELD_DP32(val, INDIRECT_READ_XFER_CTRL_REG, RD_STATUS_FLD, 1);
+    }
+    return val;
+}
+
+static uint64_t sram_fill_reg_post_read(RegisterInfo *reg, uint64_t val)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
+    val = ((fifo8_num_used(&s->tx_sram) & 0xFFFF) << 16) |
+          (fifo8_num_used(&s->rx_sram) & 0xFFFF);
+    return val;
+}
+
+static uint64_t dll_obs_upper_reg_post_read(RegisterInfo *reg, uint64_t val)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(reg->opaque);
+    uint32_t rx_dec_out;
+
+    rx_dec_out = FIELD_EX32(val, DLL_OBSERVABLE_UPPER_REG,
+                            DLL_OBSERVABLE__UPPER_RX_DECODER_OUTPUT_FLD);
+
+    if (rx_dec_out < MAX_RX_DEC_OUT) {
+        ARRAY_FIELD_DP32(s->regs, DLL_OBSERVABLE_UPPER_REG,
+                         DLL_OBSERVABLE__UPPER_RX_DECODER_OUTPUT_FLD,
+                         rx_dec_out + 1);
+    }
+
+    return val;
+}
+
+
+static void xlnx_versal_ospi_reset(DeviceState *dev)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(dev);
+    unsigned int i;
+
+    for (i = 0; i < ARRAY_SIZE(s->regs_info); ++i) {
+        register_reset(&s->regs_info[i]);
+    }
+
+    fifo8_reset(&s->rx_fifo);
+    fifo8_reset(&s->tx_fifo);
+    fifo8_reset(&s->rx_sram);
+    fifo8_reset(&s->tx_sram);
+
+    s->rd_ind_op[0].completed = true;
+    s->rd_ind_op[1].completed = true;
+    s->wr_ind_op[0].completed = true;
+    s->wr_ind_op[1].completed = true;
+    ARRAY_FIELD_DP32(s->regs, DLL_OBSERVABLE_LOWER_REG,
+                     DLL_OBSERVABLE_LOWER_DLL_LOCK_FLD, 1);
+    ARRAY_FIELD_DP32(s->regs, DLL_OBSERVABLE_LOWER_REG,
+                     DLL_OBSERVABLE_LOWER_LOOPBACK_LOCK_FLD, 1);
+}
+
+static RegisterAccessInfo ospi_regs_info[] = {
+    {   .name = "CONFIG_REG",
+        .addr = A_CONFIG_REG,
+        .reset = 0x80780081,
+        .ro = 0x9c000000,
+    },{ .name = "DEV_INSTR_RD_CONFIG_REG",
+        .addr = A_DEV_INSTR_RD_CONFIG_REG,
+        .reset = 0x3,
+        .ro = 0xe0ecc800,
+    },{ .name = "DEV_INSTR_WR_CONFIG_REG",
+        .addr = A_DEV_INSTR_WR_CONFIG_REG,
+        .reset = 0x2,
+        .ro = 0xe0fcce00,
+    },{ .name = "DEV_DELAY_REG",
+        .addr = A_DEV_DELAY_REG,
+    },{ .name = "RD_DATA_CAPTURE_REG",
+        .addr = A_RD_DATA_CAPTURE_REG,
+        .reset = 0x1,
+        .ro = 0xfff0fec0,
+    },{ .name = "DEV_SIZE_CONFIG_REG",
+        .addr = A_DEV_SIZE_CONFIG_REG,
+        .reset = 0x101002,
+        .ro = 0xe0000000,
+    },{ .name = "SRAM_PARTITION_CFG_REG",
+        .addr = A_SRAM_PARTITION_CFG_REG,
+        .reset = 0x80,
+        .ro = 0xffffff00,
+    },{ .name = "IND_AHB_ADDR_TRIGGER_REG",
+        .addr = A_IND_AHB_ADDR_TRIGGER_REG,
+    },{ .name = "DMA_PERIPH_CONFIG_REG",
+        .addr = A_DMA_PERIPH_CONFIG_REG,
+        .ro = 0xfffff0f0,
+    },{ .name = "REMAP_ADDR_REG",
+        .addr = A_REMAP_ADDR_REG,
+    },{ .name = "MODE_BIT_CONFIG_REG",
+        .addr = A_MODE_BIT_CONFIG_REG,
+        .reset = 0x200,
+        .ro = 0xffff7800,
+    },{ .name = "SRAM_FILL_REG",
+        .addr = A_SRAM_FILL_REG,
+        .ro = 0xffffffff,
+        .post_read = sram_fill_reg_post_read,
+    },{ .name = "TX_THRESH_REG",
+        .addr = A_TX_THRESH_REG,
+        .reset = 0x1,
+        .ro = 0xffffffe0,
+    },{ .name = "RX_THRESH_REG",
+        .addr = A_RX_THRESH_REG,
+        .reset = 0x1,
+        .ro = 0xffffffe0,
+    },{ .name = "WRITE_COMPLETION_CTRL_REG",
+        .addr = A_WRITE_COMPLETION_CTRL_REG,
+        .reset = 0x10005,
+        .ro = 0x1800,
+    },{ .name = "NO_OF_POLLS_BEF_EXP_REG",
+        .addr = A_NO_OF_POLLS_BEF_EXP_REG,
+        .reset = 0xffffffff,
+    },{ .name = "IRQ_STATUS_REG",
+        .addr = A_IRQ_STATUS_REG,
+        .ro = 0xfff08000,
+        .w1c = 0xf7fff,
+    },{ .name = "IRQ_MASK_REG",
+        .addr = A_IRQ_MASK_REG,
+        .ro = 0xfff08000,
+    },{ .name = "LOWER_WR_PROT_REG",
+        .addr = A_LOWER_WR_PROT_REG,
+    },{ .name = "UPPER_WR_PROT_REG",
+        .addr = A_UPPER_WR_PROT_REG,
+    },{ .name = "WR_PROT_CTRL_REG",
+        .addr = A_WR_PROT_CTRL_REG,
+        .ro = 0xfffffffc,
+    },{ .name = "INDIRECT_READ_XFER_CTRL_REG",
+        .addr = A_INDIRECT_READ_XFER_CTRL_REG,
+        .ro = 0xffffffd4,
+        .w1c = 0x08,
+        .pre_write = ind_rd_xfer_ctrl_reg_pre_write,
+        .post_write = ind_rd_xfer_ctrl_reg_post_write,
+        .post_read = ind_rd_xfer_ctrl_reg_post_read,
+    },{ .name = "INDIRECT_READ_XFER_WATERMARK_REG",
+        .addr = A_INDIRECT_READ_XFER_WATERMARK_REG,
+    },{ .name = "INDIRECT_READ_XFER_START_REG",
+        .addr = A_INDIRECT_READ_XFER_START_REG,
+    },{ .name = "INDIRECT_READ_XFER_NUM_BYTES_REG",
+        .addr = A_INDIRECT_READ_XFER_NUM_BYTES_REG,
+    },{ .name = "INDIRECT_WRITE_XFER_CTRL_REG",
+        .addr = A_INDIRECT_WRITE_XFER_CTRL_REG,
+        .ro = 0xffffffdc,
+        .w1c = 0x20,
+        .pre_write = ind_wr_xfer_ctrl_reg_pre_write,
+        .post_write = ind_wr_xfer_ctrl_reg_post_write,
+        .post_read = ind_wr_xfer_ctrl_reg_post_read,
+    },{ .name = "INDIRECT_WRITE_XFER_WATERMARK_REG",
+        .addr = A_INDIRECT_WRITE_XFER_WATERMARK_REG,
+        .reset = 0xffffffff,
+    },{ .name = "INDIRECT_WRITE_XFER_START_REG",
+        .addr = A_INDIRECT_WRITE_XFER_START_REG,
+    },{ .name = "INDIRECT_WRITE_XFER_NUM_BYTES_REG",
+        .addr = A_INDIRECT_WRITE_XFER_NUM_BYTES_REG,
+    },{ .name = "INDIRECT_TRIGGER_ADDR_RANGE_REG",
+        .addr = A_INDIRECT_TRIGGER_ADDR_RANGE_REG,
+        .reset = 0x4,
+        .ro = 0xfffffff0,
+    },{ .name = "FLASH_COMMAND_CTRL_MEM_REG",
+        .addr = A_FLASH_COMMAND_CTRL_MEM_REG,
+        .ro = 0xe008fffe,
+        .post_write = flash_cmd_ctrl_mem_reg_post_write,
+    },{ .name = "FLASH_CMD_CTRL_REG",
+        .addr = A_FLASH_CMD_CTRL_REG,
+        .ro = 0x7a,
+        .post_write = flash_cmd_ctrl_reg_post_write,
+    },{ .name = "FLASH_CMD_ADDR_REG",
+        .addr = A_FLASH_CMD_ADDR_REG,
+    },{ .name = "FLASH_RD_DATA_LOWER_REG",
+        .addr = A_FLASH_RD_DATA_LOWER_REG,
+        .ro = 0xffffffff,
+    },{ .name = "FLASH_RD_DATA_UPPER_REG",
+        .addr = A_FLASH_RD_DATA_UPPER_REG,
+        .ro = 0xffffffff,
+    },{ .name = "FLASH_WR_DATA_LOWER_REG",
+        .addr = A_FLASH_WR_DATA_LOWER_REG,
+    },{ .name = "FLASH_WR_DATA_UPPER_REG",
+        .addr = A_FLASH_WR_DATA_UPPER_REG,
+    },{ .name = "POLLING_FLASH_STATUS_REG",
+        .addr = A_POLLING_FLASH_STATUS_REG,
+        .ro = 0xfff0ffff,
+    },{ .name = "PHY_CONFIGURATION_REG",
+        .addr = A_PHY_CONFIGURATION_REG,
+        .reset = 0x40000000,
+        .ro = 0x1f80ff80,
+    },{ .name = "PHY_MASTER_CONTROL_REG",
+        .addr = A_PHY_MASTER_CONTROL_REG,
+        .reset = 0x800000,
+        .ro = 0xfe08ff80,
+    },{ .name = "DLL_OBSERVABLE_LOWER_REG",
+        .addr = A_DLL_OBSERVABLE_LOWER_REG,
+        .ro = 0xffffffff,
+    },{ .name = "DLL_OBSERVABLE_UPPER_REG",
+        .addr = A_DLL_OBSERVABLE_UPPER_REG,
+        .ro = 0xffffffff,
+        .post_read = dll_obs_upper_reg_post_read,
+    },{ .name = "OPCODE_EXT_LOWER_REG",
+        .addr = A_OPCODE_EXT_LOWER_REG,
+        .reset = 0x13edfa00,
+    },{ .name = "OPCODE_EXT_UPPER_REG",
+        .addr = A_OPCODE_EXT_UPPER_REG,
+        .reset = 0x6f90000,
+        .ro = 0xffff,
+    },{ .name = "MODULE_ID_REG",
+        .addr = A_MODULE_ID_REG,
+        .reset = 0x300,
+        .ro = 0xffffffff,
+    }
+};
+
+/* Return dev-obj from reg-region created by register_init_block32 */
+static XlnxVersalOspi *xilinx_ospi_of_mr(void *mr_accessor)
+{
+    RegisterInfoArray *reg_array = mr_accessor;
+    Object *dev;
+
+    dev = reg_array->mem.owner;
+    assert(dev);
+
+    return XILINX_VERSAL_OSPI(dev);
+}
+
+static void ospi_write(void *opaque, hwaddr addr, uint64_t value,
+        unsigned int size)
+{
+    XlnxVersalOspi *s = xilinx_ospi_of_mr(opaque);
+
+    register_write_memory(opaque, addr, value, size);
+    ospi_update_irq_line(s);
+}
+
+static const MemoryRegionOps ospi_ops = {
+    .read = register_read_memory,
+    .write = ospi_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static uint64_t ospi_indac_read(void *opaque, unsigned int size)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
+    uint64_t ret = ospi_rx_sram_read(s, size);
+
+    if (!ospi_ind_op_completed(s->rd_ind_op)) {
+        ospi_do_ind_read(s);
+    }
+    return ret;
+}
+
+static void ospi_indac_write(void *opaque, uint64_t value, unsigned int size)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
+
+    g_assert(!s->ind_write_disabled);
+
+    if (!ospi_ind_op_completed(s->wr_ind_op)) {
+        ospi_tx_sram_write(s, value, size);
+        ospi_do_indirect_write(s);
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR,
+            "OSPI wr into indac area while no ongoing indac wr\n");
+    }
+}
+
+static bool is_inside_indac_range(XlnxVersalOspi *s, hwaddr addr)
+{
+    uint32_t range_start;
+    uint32_t range_end;
+
+    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_DMA_IF_FLD)) {
+        return true;
+    }
+
+    range_start = s->regs[R_IND_AHB_ADDR_TRIGGER_REG];
+    range_end = range_start +
+                (1 << ARRAY_FIELD_EX32(s->regs,
+                                       INDIRECT_TRIGGER_ADDR_RANGE_REG,
+                                       IND_RANGE_WIDTH_FLD));
+
+    addr += s->regs[R_IND_AHB_ADDR_TRIGGER_REG] & 0xF0000000;
+
+    return addr >= range_start && addr < range_end;
+}
+
+static bool ospi_is_indac_active(XlnxVersalOspi *s)
+{
+    /*
+     * When dac and indac cannot be active at the same time,
+     * return true when dac is disabled.
+     */
+    return s->dac_with_indac || !s->dac_enable;
+}
+
+static uint64_t ospi_dac_read(void *opaque, hwaddr addr, unsigned int size)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
+
+    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_SPI_FLD)) {
+        if (ospi_is_indac_active(s) &&
+            is_inside_indac_range(s, addr)) {
+            return ospi_indac_read(s, size);
+        }
+        if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_DIR_ACC_CTLR_FLD)
+            && s->dac_enable) {
+            if (ARRAY_FIELD_EX32(s->regs,
+                                 CONFIG_REG, ENB_AHB_ADDR_REMAP_FLD)) {
+                addr += s->regs[R_REMAP_ADDR_REG];
+            }
+            return ospi_do_dac_read(opaque, addr, size);
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR, "OSPI AHB rd while DAC disabled\n");
+        }
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR, "OSPI AHB rd while OSPI disabled\n");
+    }
+
+    return 0;
+}
+
+static void ospi_dac_write(void *opaque, hwaddr addr, uint64_t value,
+                           unsigned int size)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
+
+    if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_SPI_FLD)) {
+        if (ospi_is_indac_active(s) &&
+            !s->ind_write_disabled &&
+            is_inside_indac_range(s, addr)) {
+            return ospi_indac_write(s, value, size);
+        }
+        if (ARRAY_FIELD_EX32(s->regs, CONFIG_REG, ENB_DIR_ACC_CTLR_FLD) &&
+            s->dac_enable) {
+            if (ARRAY_FIELD_EX32(s->regs,
+                                 CONFIG_REG, ENB_AHB_ADDR_REMAP_FLD)) {
+                addr += s->regs[R_REMAP_ADDR_REG];
+            }
+            /* Check if addr is write protected */
+            if (ARRAY_FIELD_EX32(s->regs, WR_PROT_CTRL_REG, ENB_FLD) &&
+                ospi_is_write_protected(s, addr)) {
+                set_irq(s, R_IRQ_STATUS_REG_PROT_WR_ATTEMPT_FLD_MASK);
+                ospi_update_irq_line(s);
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "OSPI writing into write protected area\n");
+                return;
+            }
+            ospi_do_dac_write(opaque, addr, value, size);
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR, "OSPI AHB wr while DAC disabled\n");
+        }
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR, "OSPI AHB wr while OSPI disabled\n");
+    }
+}
+
+static const MemoryRegionOps ospi_dac_ops = {
+    .read = ospi_dac_read,
+    .write = ospi_dac_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void ospi_update_dac_status(void *opaque, int n, int level)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(opaque);
+
+    s->dac_enable = level;
+}
+
+static void xlnx_versal_ospi_realize(DeviceState *dev, Error **errp)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+
+    s->num_cs = 4;
+    s->spi = ssi_create_bus(dev, "spi0");
+    s->cs_lines = g_new0(qemu_irq, s->num_cs);
+    for (int i = 0; i < s->num_cs; ++i) {
+        sysbus_init_irq(sbd, &s->cs_lines[i]);
+    }
+
+    fifo8_create(&s->rx_fifo, RXFF_SZ);
+    fifo8_create(&s->tx_fifo, TXFF_SZ);
+    fifo8_create(&s->rx_sram, RXFF_SZ);
+    fifo8_create(&s->tx_sram, TXFF_SZ);
+}
+
+static void xlnx_versal_ospi_init(Object *obj)
+{
+    XlnxVersalOspi *s = XILINX_VERSAL_OSPI(obj);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(obj);
+    DeviceState *dev = DEVICE(obj);
+    RegisterInfoArray *reg_array;
+
+    memory_region_init(&s->iomem, obj, TYPE_XILINX_VERSAL_OSPI,
+                       XILINX_VERSAL_OSPI_R_MAX * 4);
+    reg_array =
+        register_init_block32(DEVICE(obj), ospi_regs_info,
+                              ARRAY_SIZE(ospi_regs_info),
+                              s->regs_info, s->regs,
+                              &ospi_ops,
+                              XILINX_VERSAL_OSPI_ERR_DEBUG,
+                              XILINX_VERSAL_OSPI_R_MAX * 4);
+    memory_region_add_subregion(&s->iomem, 0x0, &reg_array->mem);
+    sysbus_init_mmio(sbd, &s->iomem);
+
+    memory_region_init_io(&s->iomem_dac, obj, &ospi_dac_ops, s,
+                          TYPE_XILINX_VERSAL_OSPI "-dac", 0x20000000);
+    sysbus_init_mmio(sbd, &s->iomem_dac);
+
+    sysbus_init_irq(sbd, &s->irq);
+
+    object_property_add_link(obj, "dma-src", TYPE_XLNX_CSU_DMA,
+                             (Object **)&s->dma_src,
+                             object_property_allow_set_link,
+                             OBJ_PROP_LINK_STRONG);
+
+    qdev_init_gpio_in_named(dev, ospi_update_dac_status, "ospi-mux-sel", 1);
+}
+
+static const VMStateDescription vmstate_ind_op = {
+    .name = "OSPIIndOp",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(flash_addr, IndOp),
+        VMSTATE_UINT32(num_bytes, IndOp),
+        VMSTATE_UINT32(done_bytes, IndOp),
+        VMSTATE_BOOL(completed, IndOp),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static const VMStateDescription vmstate_xlnx_versal_ospi = {
+    .name = TYPE_XILINX_VERSAL_OSPI,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_FIFO8(rx_fifo, XlnxVersalOspi),
+        VMSTATE_FIFO8(tx_fifo, XlnxVersalOspi),
+        VMSTATE_FIFO8(rx_sram, XlnxVersalOspi),
+        VMSTATE_FIFO8(tx_sram, XlnxVersalOspi),
+        VMSTATE_BOOL(ind_write_disabled, XlnxVersalOspi),
+        VMSTATE_BOOL(dac_with_indac, XlnxVersalOspi),
+        VMSTATE_BOOL(dac_enable, XlnxVersalOspi),
+        VMSTATE_BOOL(src_dma_inprog, XlnxVersalOspi),
+        VMSTATE_STRUCT_ARRAY(rd_ind_op, XlnxVersalOspi, 2, 1,
+                             vmstate_ind_op, IndOp),
+        VMSTATE_STRUCT_ARRAY(wr_ind_op, XlnxVersalOspi, 2, 1,
+                             vmstate_ind_op, IndOp),
+        VMSTATE_UINT32_ARRAY(regs, XlnxVersalOspi, XILINX_VERSAL_OSPI_R_MAX),
+        VMSTATE_UINT8_ARRAY(stig_membank, XlnxVersalOspi, 512),
+        VMSTATE_END_OF_LIST(),
+    }
+};
+
+static Property xlnx_versal_ospi_properties[] = {
+    DEFINE_PROP_BOOL("dac-with-indac", XlnxVersalOspi, dac_with_indac, false),
+    DEFINE_PROP_BOOL("indac-write-disabled", XlnxVersalOspi,
+                     ind_write_disabled, false),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void xlnx_versal_ospi_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->reset = xlnx_versal_ospi_reset;
+    dc->realize = xlnx_versal_ospi_realize;
+    dc->vmsd = &vmstate_xlnx_versal_ospi;
+    device_class_set_props(dc, xlnx_versal_ospi_properties);
+}
+
+static const TypeInfo xlnx_versal_ospi_info = {
+    .name          = TYPE_XILINX_VERSAL_OSPI,
+    .parent        = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(XlnxVersalOspi),
+    .class_init    = xlnx_versal_ospi_class_init,
+    .instance_init = xlnx_versal_ospi_init,
+};
+
+static void xlnx_versal_ospi_register_types(void)
+{
+    type_register_static(&xlnx_versal_ospi_info);
+}
+
+type_init(xlnx_versal_ospi_register_types)
diff --git a/hw/ssi/meson.build b/hw/ssi/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/meson.build
+++ b/hw/ssi/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_SSI', if_true: files('ssi.c'))
 softmmu_ss.add(when: 'CONFIG_STM32F2XX_SPI', if_true: files('stm32f2xx_spi.c'))
 softmmu_ss.add(when: 'CONFIG_XILINX_SPI', if_true: files('xilinx_spi.c'))
 softmmu_ss.add(when: 'CONFIG_XILINX_SPIPS', if_true: files('xilinx_spips.c'))
+softmmu_ss.add(when: 'CONFIG_XLNX_VERSAL', if_true: files('xlnx-versal-ospi.c'))
 softmmu_ss.add(when: 'CONFIG_IMX', if_true: files('imx_spi.c'))
 softmmu_ss.add(when: 'CONFIG_OMAP', if_true: files('omap_spi.c'))
-- 
2.25.1

From: Francisco Iglesias <francisco.iglesias@xilinx.com>

Connect the OSPI flash memory controller model (including the source and
destination DMA).

Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220121161141.14389-8-francisco.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 20 ++++++++
 hw/arm/xlnx-versal.c         | 93 ++++++++++++++++++++++++++++++++++++
 2 files changed, 113 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/xlnx-versal-xramc.h"
 #include "hw/nvram/xlnx-bbram.h"
 #include "hw/nvram/xlnx-versal-efuse.h"
+#include "hw/ssi/xlnx-versal-ospi.h"
+#include "hw/dma/xlnx_csu_dma.h"
 #include "hw/misc/xlnx-versal-pmc-iou-slcr.h"
 
 #define TYPE_XLNX_VERSAL "xlnx-versal"
@@ -XXX,XX +XXX,XX @@ struct Versal {
         struct {
             SDHCIState sd[XLNX_VERSAL_NR_SDS];
             XlnxVersalPmcIouSlcr slcr;
+
+            struct {
+                XlnxVersalOspi ospi;
+                XlnxCSUDMA dma_src;
+                XlnxCSUDMA dma_dst;
+                MemoryRegion linear_mr;
+                qemu_or_irq irq_orgate;
+            } ospi;
         } iou;
 
         XlnxZynqMPRTC rtc;
@@ -XXX,XX +XXX,XX @@ struct Versal {
 #define VERSAL_ADMA_IRQ_0          60
 #define VERSAL_XRAM_IRQ_0          79
 #define VERSAL_PMC_APB_IRQ         121
+#define VERSAL_OSPI_IRQ            124
 #define VERSAL_SD0_IRQ_0           126
 #define VERSAL_EFUSE_IRQ           139
 #define VERSAL_RTC_ALARM_IRQ       142
@@ -XXX,XX +XXX,XX @@ struct Versal {
 #define MM_PMC_PMC_IOU_SLCR         0xf1060000
 #define MM_PMC_PMC_IOU_SLCR_SIZE    0x10000
 
+#define MM_PMC_OSPI                 0xf1010000
+#define MM_PMC_OSPI_SIZE            0x10000
+
+#define MM_PMC_OSPI_DAC             0xc0000000
+#define MM_PMC_OSPI_DAC_SIZE        0x20000000
+
+#define MM_PMC_OSPI_DMA_DST         0xf1011800
+#define MM_PMC_OSPI_DMA_SRC         0xf1011000
+
 #define MM_PMC_SD0                  0xf1040000U
 #define MM_PMC_SD0_SIZE             0x10000
 #define MM_PMC_BBRAM_CTRL           0xf11f0000
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@
 #define GEM_REVISION        0x40070106
 
 #define VERSAL_NUM_PMC_APB_IRQS 3
+#define NUM_OSPI_IRQ_LINES 3
 
 static void versal_create_apu_cpus(Versal *s)
 {
@@ -XXX,XX +XXX,XX @@ static void versal_create_pmc_iou_slcr(Versal *s, qemu_irq *pic)
                        qdev_get_gpio_in(DEVICE(&s->pmc.apb_irq_orgate), 2));
 }
 
+static void versal_create_ospi(Versal *s, qemu_irq *pic)
+{
+    SysBusDevice *sbd;
+    MemoryRegion *mr_dac;
+    qemu_irq ospi_mux_sel;
+    DeviceState *orgate;
+
+    memory_region_init(&s->pmc.iou.ospi.linear_mr, OBJECT(s),
+                       "versal-ospi-linear-mr" , MM_PMC_OSPI_DAC_SIZE);
+
+    object_initialize_child(OBJECT(s), "versal-ospi", &s->pmc.iou.ospi.ospi,
+                            TYPE_XILINX_VERSAL_OSPI);
+
+    mr_dac = sysbus_mmio_get_region(SYS_BUS_DEVICE(&s->pmc.iou.ospi.ospi), 1);
+    memory_region_add_subregion(&s->pmc.iou.ospi.linear_mr, 0x0, mr_dac);
+
+    /* Create the OSPI destination DMA */
+    object_initialize_child(OBJECT(s), "versal-ospi-dma-dst",
+                            &s->pmc.iou.ospi.dma_dst,
+                            TYPE_XLNX_CSU_DMA);
+
+    object_property_set_link(OBJECT(&s->pmc.iou.ospi.dma_dst),
+                            "dma", OBJECT(get_system_memory()),
+                             &error_abort);
+
+    sbd = SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_dst);
+    sysbus_realize(sbd, &error_fatal);
+
+    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI_DMA_DST,
+                                sysbus_mmio_get_region(sbd, 0));
+
+    /* Create the OSPI source DMA */
+    object_initialize_child(OBJECT(s), "versal-ospi-dma-src",
+                            &s->pmc.iou.ospi.dma_src,
+                            TYPE_XLNX_CSU_DMA);
+
+    object_property_set_bool(OBJECT(&s->pmc.iou.ospi.dma_src), "is-dst",
+                             false, &error_abort);
+
+    object_property_set_link(OBJECT(&s->pmc.iou.ospi.dma_src),
+                            "dma", OBJECT(mr_dac), &error_abort);
+
+    object_property_set_link(OBJECT(&s->pmc.iou.ospi.dma_src),
+                            "stream-connected-dma",
+                             OBJECT(&s->pmc.iou.ospi.dma_dst),
+                             &error_abort);
+
+    sbd = SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_src);
+    sysbus_realize(sbd, &error_fatal);
+
+    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI_DMA_SRC,
+                                sysbus_mmio_get_region(sbd, 0));
+
+    /* Realize the OSPI */
+    object_property_set_link(OBJECT(&s->pmc.iou.ospi.ospi), "dma-src",
+                             OBJECT(&s->pmc.iou.ospi.dma_src), &error_abort);
+
+    sbd = SYS_BUS_DEVICE(&s->pmc.iou.ospi.ospi);
+    sysbus_realize(sbd, &error_fatal);
+
+    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI,
+                                sysbus_mmio_get_region(sbd, 0));
+
+    memory_region_add_subregion(&s->mr_ps, MM_PMC_OSPI_DAC,
+                                &s->pmc.iou.ospi.linear_mr);
+
+    /* ospi_mux_sel */
+    ospi_mux_sel = qdev_get_gpio_in_named(DEVICE(&s->pmc.iou.ospi.ospi),
+                                          "ospi-mux-sel", 0);
+    qdev_connect_gpio_out_named(DEVICE(&s->pmc.iou.slcr), "ospi-mux-sel", 0,
+                                ospi_mux_sel);
+
+    /* OSPI irq */
+    object_initialize_child(OBJECT(s), "ospi-irq-orgate",
+                            &s->pmc.iou.ospi.irq_orgate, TYPE_OR_IRQ);
+    object_property_set_int(OBJECT(&s->pmc.iou.ospi.irq_orgate),
+                            "num-lines", NUM_OSPI_IRQ_LINES, &error_fatal);
+
+    orgate = DEVICE(&s->pmc.iou.ospi.irq_orgate);
+    qdev_realize(orgate, NULL, &error_fatal);
+
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pmc.iou.ospi.ospi), 0,
+                       qdev_get_gpio_in(orgate, 0));
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_src), 0,
+                       qdev_get_gpio_in(orgate, 1));
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->pmc.iou.ospi.dma_dst), 0,
+                       qdev_get_gpio_in(orgate, 2));
+
+    qdev_connect_gpio_out(orgate, 0, pic[VERSAL_OSPI_IRQ]);
+}
+
 /* This takes the board allocated linear DDR memory and creates aliases
  * for each split DDR range/aperture on the Versal address map.
  */
@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)
     versal_create_bbram(s, pic);
     versal_create_efuse(s, pic);
     versal_create_pmc_iou_slcr(s, pic);
+    versal_create_ospi(s, pic);
     versal_map_ddr(s);
     versal_unimp(s);
 
-- 
2.25.1

From: Francisco Iglesias <francisco.iglesias@xilinx.com>

Add support for Micron Xccela flash mt35xu01g.

Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20220121161141.14389-9-francisco.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/block/m25p80.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/block/m25p80.c b/hw/block/m25p80.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/m25p80.c
+++ b/hw/block/m25p80.c
@@ -XXX,XX +XXX,XX @@ static const FlashPartInfo known_devices[] = {
     { INFO("n25q512a",    0x20ba20,      0,  64 << 10, 1024, ER_4K) },
     { INFO("n25q512ax3",  0x20ba20,  0x1000,  64 << 10, 1024, ER_4K) },
     { INFO("mt25ql512ab", 0x20ba20, 0x1044, 64 << 10, 1024, ER_4K | ER_32K) },
+    { INFO_STACKED("mt35xu01g", 0x2c5b1b, 0x104100, 128 << 10, 1024,
+                   ER_4K | ER_32K, 2) },
     { INFO_STACKED("n25q00",    0x20ba21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
     { INFO_STACKED("n25q00a",   0x20bb21, 0x1000, 64 << 10, 2048, ER_4K, 4) },
     { INFO_STACKED("mt25ql01g", 0x20ba21, 0x1040, 64 << 10, 2048, ER_4K, 2) },
-- 
2.25.1

From: Francisco Iglesias <francisco.iglesias@xilinx.com>

Connect Micron Xccela mt35xu01g flashes to the OSPI flash memory
controller.

Signed-off-by: Francisco Iglesias <francisco.iglesias@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220121161141.14389-10-francisco.iglesias@xilinx.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-versal-virt.c | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal-virt.c
+++ b/hw/arm/xlnx-versal-virt.c
@@ -XXX,XX +XXX,XX @@
 #define TYPE_XLNX_VERSAL_VIRT_MACHINE MACHINE_TYPE_NAME("xlnx-versal-virt")
 OBJECT_DECLARE_SIMPLE_TYPE(VersalVirt, XLNX_VERSAL_VIRT_MACHINE)
 
+#define XLNX_VERSAL_NUM_OSPI_FLASH 4
+
 struct VersalVirt {
     MachineState parent_obj;
 
@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)
             exit(EXIT_FAILURE);
         }
     }
+
+    for (i = 0; i < XLNX_VERSAL_NUM_OSPI_FLASH; i++) {
+        BusState *spi_bus;
+        DeviceState *flash_dev;
+        qemu_irq cs_line;
+        DriveInfo *dinfo = drive_get(IF_MTD, 0, i);
+
+        spi_bus = qdev_get_child_bus(DEVICE(&s->soc.pmc.iou.ospi), "spi0");
+
+        flash_dev = qdev_new("mt35xu01g");
+        if (dinfo) {
+            qdev_prop_set_drive_err(flash_dev, "drive",
+                                    blk_by_legacy_dinfo(dinfo), &error_fatal);
+        }
+        qdev_realize_and_unref(flash_dev, spi_bus, &error_fatal);
+
+        cs_line = qdev_get_gpio_in_named(flash_dev, SSI_GPIO_CS, 0);
+
+        sysbus_connect_irq(SYS_BUS_DEVICE(&s->soc.pmc.iou.ospi),
+                           i + 1, cs_line);
+    }
 }
 
 static void versal_virt_machine_instance_init(Object *obj)
-- 
2.25.1

If you don't know it, it's hard to figure out the difference between
the linux-headers folder and the include/standard-headers folder.
So let's add a short explanation to clarify the difference.

Suggested-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
---
 scripts/update-linux-headers.sh | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
index XXXXXXX..XXXXXXX 100755
--- a/scripts/update-linux-headers.sh
+++ b/scripts/update-linux-headers.sh
@@ -XXX,XX +XXX,XX @@
 #
 # This work is licensed under the terms of the GNU GPL version 2.
 # See the COPYING file in the top-level directory.
+#
+# The script will copy the headers into two target folders:
+#
+# - linux-headers/ for files that are required for compiling for a
+#   Linux host.  Generally we have these so we can use kernel structs
+#   and defines that are more recent than the headers that might be
+#   installed on the host system.  Usually this script can do simple
+#   file copies for these headers.
+#
+# - include/standard-headers/ for files that are used for guest
+#   device emulation and are required on all hosts.  For instance, we
+#   get our definitions of the virtio structures from the Linux
+#   kernel headers, but we need those definitions regardless of which
+#   host OS we are building for.  This script has to be careful to
+#   sanitize the headers to remove any use of Linux-specifics such as
+#   types like "__u64".  This work is done in the cp_portable function.
 
 tmpdir=$(mktemp -d)
 linux="$1"
-- 
2.25.1

In an SMP system it can be unclear which CPU is taking an exception;
add the CPU index (which is the same value used in the TCG 'Trace
%d:' logging) to the "Taking exception" log line to clarify it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-2-peter.maydell@linaro.org
---
 target/arm/internals.h | 2 +-
 target/arm/helper.c    | 9 ++++++---
 target/arm/m_helper.c  | 2 +-
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                    ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
     __attribute__((nonnull));
 
-void arm_log_exception(int idx);
+void arm_log_exception(CPUState *cs);
 
 #endif /* !CONFIG_USER_ONLY */
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
     return target_el;
 }
 
-void arm_log_exception(int idx)
+void arm_log_exception(CPUState *cs)
 {
+    int idx = cs->exception_index;
+
     if (qemu_loglevel_mask(CPU_LOG_INT)) {
         const char *exc = NULL;
         static const char * const excnames[] = {
@@ -XXX,XX +XXX,XX @@ void arm_log_exception(int idx)
         if (!exc) {
             exc = "unknown";
         }
-        qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s]\n", idx, exc);
+        qemu_log_mask(CPU_LOG_INT, "Taking exception %d [%s] on CPU %d\n",
+                      idx, exc, cs->cpu_index);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
 
     assert(!arm_feature(env, ARM_FEATURE_M));
 
-    arm_log_exception(cs->exception_index);
+    arm_log_exception(cs);
     qemu_log_mask(CPU_LOG_INT, "...from EL%d to EL%d\n", arm_current_el(env),
                   new_el);
     if (qemu_loglevel_mask(CPU_LOG_INT)
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
     uint32_t lr;
     bool ignore_stackfaults;
 
-    arm_log_exception(cs->exception_index);
+    arm_log_exception(cs);
 
     /*
      * For exceptions we just mark as pending on the NVIC, and let that
-- 
2.25.1

The ITS currently has no tracepoints; add a minimal set
that allows basic monitoring of guest register accesses and
reading of commands from the command queue.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-3-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_its.c | 11 +++++++++++
 hw/intc/trace-events    |  8 ++++++++
 2 files changed, 19 insertions(+)

diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qemu/log.h"
+#include "trace.h"
 #include "hw/qdev-properties.h"
 #include "hw/intc/arm_gicv3_its_common.h"
 #include "gicv3_internal.h"
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
 
         cmd = (data & CMD_MASK);
 
+        trace_gicv3_its_process_command(rd_offset, cmd);
+
         switch (cmd) {
         case GITS_CMD_INT:
             result = process_its_cmd(s, data, cq_offset, INTERRUPT);
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
     bool result = true;
     uint32_t devid = 0;
 
+    trace_gicv3_its_translation_write(offset, data, size, attrs.requester_id);
+
     switch (offset) {
     case GITS_TRANSLATER:
         if (s->ctlr & R_GITS_CTLR_ENABLED_MASK) {
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid guest read at offset " TARGET_FMT_plx
                       "size %u\n", __func__, offset, size);
+        trace_gicv3_its_badread(offset, size);
         /*
          * The spec requires that reserved registers are RAZ/WI;
          * so use false returns from leaf functions as a way to
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
          * the caller, or we'll cause a spurious guest data abort.
          */
         *data = 0;
+    } else {
+        trace_gicv3_its_read(offset, *data, size);
     }
     return MEMTX_OK;
 }
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data,
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid guest write at offset " TARGET_FMT_plx
                       "size %u\n", __func__, offset, size);
+        trace_gicv3_its_badwrite(offset, data, size);
         /*
          * The spec requires that reserved registers are RAZ/WI;
          * so use false returns from leaf functions as a way to
          * trigger the guest-error logging but don't return it to
          * the caller, or we'll cause a spurious guest data abort.
          */
+    } else {
+        trace_gicv3_its_write(offset, data, size);
     }
     return MEMTX_OK;
 }
diff --git a/hw/intc/trace-events b/hw/intc/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/trace-events
+++ b/hw/intc/trace-events
@@ -XXX,XX +XXX,XX @@ gicv3_redist_badwrite(uint32_t cpu, uint64_t offset, uint64_t data, unsigned siz
 gicv3_redist_set_irq(uint32_t cpu, int irq, int level) "GICv3 redistributor 0x%x interrupt %d level changed to %d"
 gicv3_redist_send_sgi(uint32_t cpu, int irq) "GICv3 redistributor 0x%x pending SGI %d"
 
+# arm_gicv3_its.c
+gicv3_its_read(uint64_t offset, uint64_t data, unsigned size) "GICv3 ITS read: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+gicv3_its_badread(uint64_t offset, unsigned size) "GICv3 ITS read: offset 0x%" PRIx64 " size %u: error"
+gicv3_its_write(uint64_t offset, uint64_t data, unsigned size) "GICv3 ITS write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u"
+gicv3_its_badwrite(uint64_t offset, uint64_t data, unsigned size) "GICv3 ITS write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u: error"
+gicv3_its_translation_write(uint64_t offset, uint64_t data, unsigned size, uint32_t requester_id) "GICv3 ITS TRANSLATER write: offset 0x%" PRIx64 " data 0x%" PRIx64 " size %u requester_id 0x%x"
+gicv3_its_process_command(uint32_t rd_offset, uint8_t cmd) "GICv3 ITS: processing command at offset 0x%x: 0x%x"
+
 # armv7m_nvic.c
 nvic_recompute_state(int vectpending, int vectpending_prio, int exception_prio) "NVIC state recomputed: vectpending %d vectpending_prio %d exception_prio %d"
 nvic_recompute_state_secure(int vectpending, bool vectpending_is_s_banked, int vectpending_prio, int exception_prio) "NVIC state recomputed: vectpending %d is_s_banked %d vectpending_prio %d exception_prio %d"
-- 
2.25.1

In our implementation, all ITSes connected to a GIC share a single
AddressSpace, which we keep in the GICv3State::dma_as field and
initialized based on the GIC's 'sysmem' property. The right place
to set it up by calling address_space_init() is therefore in the
GIC's realize method, not the ITS's realize.

This fixes a theoretical bug where QEMU hangs on startup if the board
model creates two ITSes connected to the same GIC -- we would call
address_space_init() twice on the same AddressSpace*, which creates
an infinite loop in the QTAILQ that softmmu/memory.c uses to store
its list of AddressSpaces and causes any subsequent attempt to
iterate through that list to loop forever.  There aren't any board
models like that in the tree at the moment, though.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-4-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_common.c | 5 +++++
 hw/intc/arm_gicv3_its.c    | 3 ---
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (s->lpi_enable) {
+        address_space_init(&s->dma_as, s->dma,
+                           "gicv3-its-sysmem");
+    }
+
     s->cpu = g_new0(GICv3CPUState, s->num_cpu);
 
     for (i = 0; i < s->num_cpu; i++) {
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
 
     gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
 
-    address_space_init(&s->gicv3->dma_as, s->gicv3->dma,
-                       "gicv3-its-sysmem");
-
     /* set the ITS default features supported */
     s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL, 1);
     s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE,
-- 
2.25.1

The ITS specification says that when the guest writes to GITS_CBASER
this causes GITS_CREADR to be cleared.  However it does not have an
equivalent clause for GITS_CWRITER.  (This is because GITS_CREADR is
read-only, but GITS_CWRITER is writable and the guest can initialize
it.) Remove the code that clears GITS_CWRITER on GITS_CBASER writes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-6-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_its.c | 3 ---
 1 file changed, 3 deletions(-)

diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
             s->cbaser = deposit64(s->cbaser, 0, 32, value);
             s->creadr = 0;
-            s->cwriter = s->creadr;
         }
         break;
     case GITS_CBASER + 4:
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
             s->cbaser = deposit64(s->cbaser, 32, 32, value);
             s->creadr = 0;
-            s->cwriter = s->creadr;
         }
         break;
     case GITS_CWRITER:
@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
             s->cbaser = value;
             s->creadr = 0;
-            s->cwriter = s->creadr;
         }
         break;
     case GITS_CWRITER:
-- 
2.25.1

The GICD_CTLR distributor register has enable bits which control
whether the different interrupt groups (Group 0, Non-secure Group 1
and Secure Group 1) are forwarded to the CPU.  We get this right for
traditional interrupts, but forgot to account for it when adding
LPIs.  LPIs are always Group 1 NS and if the EnableGrp1NS bit is not
set we must not forward them to the CPU.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-7-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3.c
+++ b/hw/intc/arm_gicv3.c
@@ -XXX,XX +XXX,XX @@ static void gicv3_redist_update_noirqset(GICv3CPUState *cs)
     }
 
     if ((cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) && cs->gic->lpi_enable &&
+        (cs->gic->gicd_ctlr & GICD_CTLR_EN_GRP1NS) &&
         (cs->hpplpi.prio != 0xff)) {
         if (irqbetter(cs, cs->hpplpi.irq, cs->hpplpi.prio)) {
             cs->hppi.irq = cs->hpplpi.irq;
-- 
2.25.1

The list of #defines for the ITS command packet numbers is neither
in alphabetical nor numeric order. Sort it into numeric order.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-8-peter.maydell@linaro.org
---
 hw/intc/gicv3_internal.h | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

The ITS-related parts of the redistributor code make some checks for
whether registers like GICR_PROPBASER and GICR_PENDBASER are zero.
There is no requirement in the specification for treating zeroes in
these address registers specially -- they contain guest physical
addresses and it is entirely valid (if unusual) for the guest to
choose to put the tables they address at guest physical address zero.
We use these values only to calculate guest addresses, and attempts
by the guest to use a bad address will be handled by the
address_space_* functions which we use to do the loads and stores.

Remove the unnecessary checks.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-9-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_redist.c | 8 +++-----
 1 file changed, 3 insertions(+), 5 deletions(-)

diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ void gicv3_redist_update_lpi_only(GICv3CPUState *cs)
     idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
                  GICD_TYPER_IDBITS);
 
-    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
-        !cs->gicr_pendbaser) {
+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS)) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level)
     idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
                  GICD_TYPER_IDBITS);
 
-    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
-         !cs->gicr_pendbaser || (irq > (1ULL << (idbits + 1)) - 1) ||
-         irq < GICV3_LPI_INTID_START) {
+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) ||
+        (irq > (1ULL << (idbits + 1)) - 1) || irq < GICV3_LPI_INTID_START) {
         return;
     }
 
-- 
2.25.1

The GICR_CTLR.CES bit is a read-only bit which is set to 1 to indicate
that the GICR_CTLR.EnableLPIs bit can be written to 0 to disable
LPIs (as opposed to allowing LPIs to be enabled but not subsequently
disabled). Our implementation permits this, so advertise it
by setting CES to 1.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-10-peter.maydell@linaro.org
---
 hw/intc/gicv3_internal.h   | 1 +
 hw/intc/arm_gicv3_common.c | 4 ++++
 2 files changed, 5 insertions(+)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@
 #define GICR_NSACR            (GICR_SGI_OFFSET + 0x0E00)
 
 #define GICR_CTLR_ENABLE_LPIS        (1U << 0)
+#define GICR_CTLR_CES                (1U << 1)
 #define GICR_CTLR_RWP                (1U << 3)
 #define GICR_CTLR_DPG0               (1U << 24)
 #define GICR_CTLR_DPG1NS             (1U << 25)
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_reset(DeviceState *dev)
 
         cs->level = 0;
         cs->gicr_ctlr = 0;
+        if (s->lpi_enable) {
+            /* Our implementation supports clearing GICR_CTLR.EnableLPIs */
+            cs->gicr_ctlr |= GICR_CTLR_CES;
+        }
         cs->gicr_statusr[GICV3_S] = 0;
         cs->gicr_statusr[GICV3_NS] = 0;
         cs->gicr_waker = GICR_WAKER_ProcessorSleep | GICR_WAKER_ChildrenAsleep;
-- 
2.25.1

The MemoryRegionOps gicv3_its_translation_ops currently provides only
a .write_with_attrs function, because the only register in this
region is the write-only GITS_TRANSLATER.  However, if you don't
provide a read function and the guest tries reading from this memory
region, QEMU will crash because
memory_region_read_with_attrs_accessor() calls a NULL pointer.

Add a read function which always returns 0, to cover both bogus
attempts to read GITS_TRANSLATER and also reads from the rest of the
region, which is documented to be reserved, RES0.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-11-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_its.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static void extract_cmdq_params(GICv3ITSState *s)
     }
 }
 
+static MemTxResult gicv3_its_translation_read(void *opaque, hwaddr offset,
+                                              uint64_t *data, unsigned size,
+                                              MemTxAttrs attrs)
+{
+    /*
+     * GITS_TRANSLATER is write-only, and all other addresses
+     * in the interrupt translation space frame are RES0.
+     */
+    *data = 0;
+    return MEMTX_OK;
+}
+
 static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
                                                uint64_t data, unsigned size,
                                                MemTxAttrs attrs)
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps gicv3_its_control_ops = {
 };
 
 static const MemoryRegionOps gicv3_its_translation_ops = {
+    .read_with_attrs = gicv3_its_translation_read,
     .write_with_attrs = gicv3_its_translation_write,
     .valid.min_access_size = 2,
     .valid.max_access_size = 4,
-- 
2.25.1

The ITS has a bank of 8 GITS_BASER<n> registers, which allow the
guest to specify the base address of various data tables.  Each
register has a read-only type field indicating which table it is for
and a read-write field where the guest can write in the base address
(among other things).  We currently allow the guest to write the
writeable fields for all eight registers, even if the type field is 0
indicating "Unimplemented".  This means the guest can provoke QEMU
into asserting by writing an address into one of these unimplemented
base registers, which bypasses the "if (!value) continue" check in
extract_table_params() and lets us hit the assertion that the type
field is one of the permitted table types.

Prevent the assertion by not allowing the guest to write to the
unimplemented base registers. This means their value will remain 0
and extract_table_params() will ignore them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-12-peter.maydell@linaro.org
---
 hw/intc/arm_gicv3_its.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
             index = (offset - GITS_BASER) / 8;
 
+            if (s->baser[index] == 0) {
+                /* Unimplemented GITS_BASERn: RAZ/WI */
+                break;
+            }
             if (offset & 7) {
                 value <<= 32;
                 value &= ~GITS_BASER_RO_MASK;
@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
          */
         if (!(s->ctlr & R_GITS_CTLR_ENABLED_MASK)) {
             index = (offset - GITS_BASER) / 8;
+            if (s->baser[index] == 0) {
+                /* Unimplemented GITS_BASERn: RAZ/WI */
+                break;
+            }
             s->baser[index] &= GITS_BASER_RO_MASK;
             s->baser[index] |= (value & ~GITS_BASER_RO_MASK);
         }
-- 
2.25.1

Currently when we fill in a TableDesc based on the value the guest
has written to the GITS_BASER<n> register, we calculate both:
 * num_entries : the number of entries in the table, constrained
   by the amount of memory the guest has given it
 * num_ids : the number of IDs we support for this table,
   constrained by the implementation choices and the architecture
   (eg DeviceIDs are 16 bits, so num_ids is 1 << 16)

When validating ITS commands, however, we check only num_ids,
thus allowing a broken guest to specify table entries that
index off the end of it. This will only corrupt guest memory,
but the ITS is supposed to reject such commands as invalid.

Instead of calculating both num_entries and num_ids, set
num_entries to the minimum of the two limits, and check that.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-13-peter.maydell@linaro.org
---
 include/hw/intc/arm_gicv3_its_common.h |  1 -
 hw/intc/arm_gicv3_its.c                | 18 +++++++++---------
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint16_t entry_sz;
     uint32_t page_sz;
     uint32_t num_entries;
-    uint32_t num_ids;
     uint64_t base_addr;
 } TableDesc;
 
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value,
 
     eventid = (value & EVENTID_MASK);
 
-    if (devid >= s->dt.num_ids) {
+    if (devid >= s->dt.num_entries) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid command attributes: devid %d>=%d",
-                      __func__, devid, s->dt.num_ids);
+                      __func__, devid, s->dt.num_entries);
         return CMD_CONTINUE;
     }
 
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_its_cmd(GICv3ITSState *s, uint64_t value,
         return CMD_CONTINUE;
     }
 
-    if (icid >= s->ct.num_ids) {
+    if (icid >= s->ct.num_entries) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid ICID 0x%x in ITE (table corrupted?)\n",
                       __func__, icid);
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_mapti(GICv3ITSState *s, uint64_t value,
 
     icid = value & ICID_MASK;
 
-    if (devid >= s->dt.num_ids) {
+    if (devid >= s->dt.num_entries) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: invalid command attributes: devid %d>=%d",
-                      __func__, devid, s->dt.num_ids);
+                      __func__, devid, s->dt.num_entries);
         return CMD_CONTINUE;
     }
 
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_mapti(GICv3ITSState *s, uint64_t value,
     num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
     num_intids = 1ULL << (GICD_TYPER_IDBITS + 1);
 
-    if ((icid >= s->ct.num_ids)
+    if ((icid >= s->ct.num_entries)
             || !dte_valid || (eventid >= num_eventids) ||
             (((pIntid < GICV3_LPI_INTID_START) || (pIntid >= num_intids)) &&
              (pIntid != INTID_SPURIOUS))) {
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_mapc(GICv3ITSState *s, uint32_t offset)
 
     valid = (value & CMD_FIELD_VALID_MASK);
 
-    if ((icid >= s->ct.num_ids) || (rdbase >= s->gicv3->num_cpu)) {
+    if ((icid >= s->ct.num_entries) || (rdbase >= s->gicv3->num_cpu)) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "ITS MAPC: invalid collection table attributes "
                       "icid %d rdbase %" PRIu64 "\n",  icid, rdbase);
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_mapd(GICv3ITSState *s, uint64_t value,
 
     valid = (value & CMD_FIELD_VALID_MASK);
 
-    if ((devid >= s->dt.num_ids) ||
+    if ((devid >= s->dt.num_entries) ||
         (size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS))) {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "ITS MAPD: invalid device table attributes "
@@ -XXX,XX +XXX,XX @@ static void extract_table_params(GICv3ITSState *s)
                                   L1TABLE_ENTRY_SIZE) *
                                  (page_sz / td->entry_sz));
         }
-        td->num_ids = 1ULL << idbits;
+        td->num_entries = MIN(td->num_entries, 1ULL << idbits);
     }
 }
 
-- 
2.25.1

Implement the ITS MOVALL command, which takes all the pending
interrupts on a source redistributor and makes the not-pending on
that source redistributor and pending on a destination redistributor.

This is a GICv3 ITS command which we forgot to implement. (It is
not used by Linux guests.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-14-peter.maydell@linaro.org
---
 hw/intc/gicv3_internal.h   | 16 +++++++++++
 hw/intc/arm_gicv3_its.c    | 55 ++++++++++++++++++++++++++++++++++++++
 hw/intc/arm_gicv3_redist.c | 54 +++++++++++++++++++++++++++++++++++++
 3 files changed, 125 insertions(+)

Implement the ITS MOVI command. This command specifies a (physical) LPI
by DeviceID and EventID and provides a new ICID for it. The ITS must
find the interrupt translation table entry for the LPI, which will
tell it the old ICID. It then moves the pending state of the LPI from
the old redistributor to the new one and updates the ICID field in
the translation table entry.

This is another GICv3 ITS command that we forgot to implement.  Linux
does use this one, but only if the guest powers off one of its CPUs.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220122182444.724087-15-peter.maydell@linaro.org
---
 hw/intc/gicv3_internal.h   |  16 ++++
 hw/intc/arm_gicv3_its.c    | 146 +++++++++++++++++++++++++++++++++++++
 hw/intc/arm_gicv3_redist.c |  53 ++++++++++++++
 3 files changed, 215 insertions(+)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
 #define CMD_MASK                  0xff
 
 /* ITS Commands */
+#define GITS_CMD_MOVI             0x01
 #define GITS_CMD_INT              0x03
 #define GITS_CMD_CLEAR            0x04
 #define GITS_CMD_SYNC             0x05
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
 FIELD(MOVALL_2, RDBASE1, 16, 36)
 FIELD(MOVALL_3, RDBASE2, 16, 36)
 
+/* MOVI command fields */
+FIELD(MOVI_0, DEVICEID, 32, 32)
+FIELD(MOVI_1, EVENTID, 0, 32)
+FIELD(MOVI_2, ICID, 0, 16)
+
 /*
  * 12 bytes Interrupt translation Table Entry size
  * as per Table 5.3 in GICv3 spec
@@ -XXX,XX +XXX,XX @@ void gicv3_redist_update_lpi(GICv3CPUState *cs);
  * an incoming migration has loaded new state.
  */
 void gicv3_redist_update_lpi_only(GICv3CPUState *cs);
+/**
+ * gicv3_redist_mov_lpi:
+ * @src: source redistributor
+ * @dest: destination redistributor
+ * @irq: LPI to update
+ *
+ * Move the pending state of the specified LPI from @src to @dest,
+ * as required by the ITS MOVI command.
+ */
+void gicv3_redist_mov_lpi(GICv3CPUState *src, GICv3CPUState *dest, int irq);
 /**
  * gicv3_redist_movall_lpis:
  * @src: source redistributor
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static ItsCmdResult process_movall(GICv3ITSState *s, uint64_t value,
     return CMD_CONTINUE;
 }
 
+static ItsCmdResult process_movi(GICv3ITSState *s, uint64_t value,
+                                 uint32_t offset)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    MemTxResult res = MEMTX_OK;
+    uint32_t devid, eventid, intid;
+    uint16_t old_icid, new_icid;
+    uint64_t old_cte, new_cte;
+    uint64_t old_rdbase, new_rdbase;
+    uint64_t dte;
+    bool dte_valid, ite_valid, cte_valid;
+    uint64_t num_eventids;
+    IteEntry ite = {};
+
+    devid = FIELD_EX64(value, MOVI_0, DEVICEID);
+
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+    if (res != MEMTX_OK) {
+        return CMD_STALL;
+    }
+    eventid = FIELD_EX64(value, MOVI_1, EVENTID);
+
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+    if (res != MEMTX_OK) {
+        return CMD_STALL;
+    }
+    new_icid = FIELD_EX64(value, MOVI_2, ICID);
+
+    if (devid >= s->dt.num_entries) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes: devid %d>=%d",
+                      __func__, devid, s->dt.num_entries);
+        return CMD_CONTINUE;
+    }
+    dte = get_dte(s, devid, &res);
+    if (res != MEMTX_OK) {
+        return CMD_STALL;
+    }
+
+    dte_valid = FIELD_EX64(dte, DTE, VALID);
+    if (!dte_valid) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes: "
+                      "invalid dte: %"PRIx64" for %d\n",
+                      __func__, dte, devid);
+        return CMD_CONTINUE;
+    }
+
+    num_eventids = 1ULL << (FIELD_EX64(dte, DTE, SIZE) + 1);
+    if (eventid >= num_eventids) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes: eventid %d >= %"
+                      PRId64 "\n",
+                      __func__, eventid, num_eventids);
+        return CMD_CONTINUE;
+    }
+
+    ite_valid = get_ite(s, eventid, dte, &old_icid, &intid, &res);
+    if (res != MEMTX_OK) {
+        return CMD_STALL;
+    }
+
+    if (!ite_valid) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes: invalid ITE\n",
+                      __func__);
+        return CMD_CONTINUE;
+    }
+
+    if (old_icid >= s->ct.num_entries) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid ICID 0x%x in ITE (table corrupted?)\n",
+                      __func__, old_icid);
+        return CMD_CONTINUE;
+    }
+
+    if (new_icid >= s->ct.num_entries) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes: ICID 0x%x\n",
+                      __func__, new_icid);
+        return CMD_CONTINUE;
+    }
+
+    cte_valid = get_cte(s, old_icid, &old_cte, &res);
+    if (res != MEMTX_OK) {
+        return CMD_STALL;
+    }
+    if (!cte_valid) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes: "
+                      "invalid cte: %"PRIx64"\n",
+                      __func__, old_cte);
+        return CMD_CONTINUE;
+    }
+
+    cte_valid = get_cte(s, new_icid, &new_cte, &res);
+    if (res != MEMTX_OK) {
+        return CMD_STALL;
+    }
+    if (!cte_valid) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes: "
+                      "invalid cte: %"PRIx64"\n",
+                      __func__, new_cte);
+        return CMD_CONTINUE;
+    }
+
+    old_rdbase = FIELD_EX64(old_cte, CTE, RDBASE);
+    if (old_rdbase >= s->gicv3->num_cpu) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: CTE has invalid rdbase 0x%"PRIx64"\n",
+                      __func__, old_rdbase);
+        return CMD_CONTINUE;
+    }
+
+    new_rdbase = FIELD_EX64(new_cte, CTE, RDBASE);
+    if (new_rdbase >= s->gicv3->num_cpu) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: CTE has invalid rdbase 0x%"PRIx64"\n",
+                      __func__, new_rdbase);
+        return CMD_CONTINUE;
+    }
+
+    if (old_rdbase != new_rdbase) {
+        /* Move the LPI from the old redistributor to the new one */
+        gicv3_redist_mov_lpi(&s->gicv3->cpu[old_rdbase],
+                             &s->gicv3->cpu[new_rdbase],
+                             intid);
+    }
+
+    /* Update the ICID field in the interrupt translation table entry */
+    ite.itel = FIELD_DP64(ite.itel, ITE_L, VALID, 1);
+    ite.itel = FIELD_DP64(ite.itel, ITE_L, INTTYPE, ITE_INTTYPE_PHYSICAL);
+    ite.itel = FIELD_DP64(ite.itel, ITE_L, INTID, intid);
+    ite.itel = FIELD_DP64(ite.itel, ITE_L, DOORBELL, INTID_SPURIOUS);
+    ite.iteh = FIELD_DP32(ite.iteh, ITE_H, ICID, new_icid);
+    return update_ite(s, eventid, dte, ite) ? CMD_CONTINUE : CMD_STALL;
+}
+
 /*
  * Current implementation blocks until all
  * commands are processed
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
                 gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
             }
             break;
+        case GITS_CMD_MOVI:
+            result = process_movi(s, data, cq_offset);
+            break;
         case GITS_CMD_MOVALL:
             result = process_movall(s, data, cq_offset);
             break;
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level)
     gicv3_redist_lpi_pending(cs, irq, level);
 }
 
+void gicv3_redist_mov_lpi(GICv3CPUState *src, GICv3CPUState *dest, int irq)
+{
+    /*
+     * Move the specified LPI's pending state from the source redistributor
+     * to the destination.
+     *
+     * If LPIs are disabled on dest this is CONSTRAINED UNPREDICTABLE:
+     * we choose to NOP. If LPIs are disabled on source there's nothing
+     * to be transferred anyway.
+     */
+    AddressSpace *as = &src->gic->dma_as;
+    uint64_t idbits;
+    uint32_t pendt_size;
+    uint64_t src_baddr;
+    uint8_t src_pend;
+
+    if (!(src->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) ||
+        !(dest->gicr_ctlr & GICR_CTLR_ENABLE_LPIS)) {
+        return;
+    }
+
+    idbits = MIN(FIELD_EX64(src->gicr_propbaser, GICR_PROPBASER, IDBITS),
+                 GICD_TYPER_IDBITS);
+    idbits = MIN(FIELD_EX64(dest->gicr_propbaser, GICR_PROPBASER, IDBITS),
+                 idbits);
+
+    pendt_size = 1ULL << (idbits + 1);
+    if ((irq / 8) >= pendt_size) {
+        return;
+    }
+
+    src_baddr = src->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
+
+    address_space_read(as, src_baddr + (irq / 8),
+                       MEMTXATTRS_UNSPECIFIED, &src_pend, sizeof(src_pend));
+    if (!extract32(src_pend, irq % 8, 1)) {
+        /* Not pending on source, nothing to do */
+        return;
+    }
+    src_pend &= ~(1 << (irq % 8));
+    address_space_write(as, src_baddr + (irq / 8),
+                        MEMTXATTRS_UNSPECIFIED, &src_pend, sizeof(src_pend));
+    if (irq == src->hpplpi.irq) {
+        /*
+         * We just made this LPI not-pending so only need to update
+         * if it was previously the highest priority pending LPI
+         */
+        gicv3_redist_update_lpi(src);
+    }
+    /* Mark it pending on the destination */
+    gicv3_redist_lpi_pending(dest, irq, 1);
+}
+
 void gicv3_redist_movall_lpis(GICv3CPUState *src, GICv3CPUState *dest)
 {
     /*
-- 
2.25.1

From: Cédric Le Goater <clg@kaod.org>

Address should be 0x1E631000 and not 0x1E641000 as initially introduced.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/838
Fixes: f25c0ae1079d ("aspeed/soc: Add AST2600 support")
Suggested-by: Troy Lee <troy_lee@aspeedtech.com>
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220126083520.4135713-1-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed_ast2600.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static const hwaddr aspeed_soc_ast2600_memmap[] = {
     [ASPEED_DEV_PWM]       = 0x1E610000,
     [ASPEED_DEV_FMC]       = 0x1E620000,
     [ASPEED_DEV_SPI1]      = 0x1E630000,
-    [ASPEED_DEV_SPI2]      = 0x1E641000,
+    [ASPEED_DEV_SPI2]      = 0x1E631000,
     [ASPEED_DEV_EHCI1]     = 0x1E6A1000,
     [ASPEED_DEV_EHCI2]     = 0x1E6A3000,
     [ASPEED_DEV_MII1]      = 0x1E650000,
-- 
2.25.1

The exception caused by an SVC instruction may be taken to AArch32
Hyp mode for two reasons:
 * HCR.TGE indicates that exceptions from EL0 should trap to EL2
 * we were already in Hyp mode

The entrypoint in the vector table to be used differs in these two
cases: for an exception routed to Hyp mode from EL0, we enter at the
common 0x14 "hyp trap" entrypoint.  For SVC from Hyp mode to Hyp
mode, we enter at the 0x08 (svc/hvc trap) entrypoint.
In the v8A Arm ARM pseudocode this is done in AArch32.TakeSVCException.

QEMU incorrectly routed both of these exceptions to the 0x14
entrypoint.  Correct the entrypoint for SVC from Hyp to Hyp by making
use of the existing logic which handles "normal entrypoint for
Hyp-to-Hyp, otherwise 0x14" for traps like UNDEF and data/prefetch
aborts (reproduced here since it's outside the visible context
in the diff for this commit):

if (arm_current_el(env) != 2 && addr < 0x14) {
        addr = 0x14;
    }

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220117131953.3936137-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
      * separately here.
      *
      * The vector table entry used is always the 0x14 Hyp mode entry point,
-     * unless this is an UNDEF/HVC/abort taken from Hyp to Hyp.
+     * unless this is an UNDEF/SVC/HVC/abort taken from Hyp to Hyp.
      * The offset applied to the preferred return address is always zero
      * (see DDI0487C.a section G1.12.3).
      * PSTATE A/I/F masks are set based only on the SCR.EA/IRQ/FIQ values.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch32_hyp(CPUState *cs)
         addr = 0x04;
         break;
     case EXCP_SWI:
-        addr = 0x14;
+        addr = 0x08;
         break;
     case EXCP_BKPT:
         /* Fall through to prefetch abort.  */
-- 
2.25.1

Hi; this pullreq contains only my FEAT_AFP/FEAT_RPRES patches
(plus a fix for a target/alpha latent bug that would otherwise
be revealed by the fpu changes), because 68 patches is already
longer than I prefer to send in at one time...

thanks
-- PMM

The following changes since commit ffaf7f0376f8040ce9068d71ae9ae8722505c42e:

Merge tag 'pull-10.0-testing-and-gdstub-updates-100225-1' of https://gitlab.com/stsquad/qemu into staging (2025-02-10 13:26:17 -0500)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250211

for you to fetch changes up to ca4c34e07d1388df8e396520b5e7d60883cd3690:

target/arm: Sink fp_status and fpcr access into do_fmlal* (2025-02-11 16:22:08 +0000)

----------------------------------------------------------------
target-arm queue:
 * target/alpha: Don't corrupt error_code with unknown softfloat flags
 * target/arm: Implement FEAT_AFP and FEAT_RPRES

----------------------------------------------------------------
Peter Maydell (49):
      target/alpha: Don't corrupt error_code with unknown softfloat flags
      fpu: Add float_class_denormal
      fpu: Implement float_flag_input_denormal_used
      fpu: allow flushing of output denormals to be after rounding
      target/arm: Define FPCR AH, FIZ, NEP bits
      target/arm: Implement FPCR.FIZ handling
      target/arm: Adjust FP behaviour for FPCR.AH = 1
      target/arm: Adjust exception flag handling for AH = 1
      target/arm: Add FPCR.AH to tbflags
      target/arm: Set up float_status to use for FPCR.AH=1 behaviour
      target/arm: Use FPST_FPCR_AH for FRECPE, FRECPS, FRECPX, FRSQRTE, FRSQRTS
      target/arm: Use FPST_FPCR_AH for BFCVT* insns
      target/arm: Use FPST_FPCR_AH for BFMLAL*, BFMLSL* insns
      target/arm: Add FPCR.NEP to TBFLAGS
      target/arm: Define and use new write_fp_*reg_merging() functions
      target/arm: Handle FPCR.NEP for 3-input scalar operations
      target/arm: Handle FPCR.NEP for BFCVT scalar
      target/arm: Handle FPCR.NEP for 1-input scalar operations
      target/arm: Handle FPCR.NEP in do_cvtf_scalar()
      target/arm: Handle FPCR.NEP for scalar FABS and FNEG
      target/arm: Handle FPCR.NEP for FCVTXN (scalar)
      target/arm: Handle FPCR.NEP for NEP for FMUL, FMULX scalar by element
      target/arm: Implement FPCR.AH semantics for scalar FMIN/FMAX
      target/arm: Implement FPCR.AH semantics for vector FMIN/FMAX
      target/arm: Implement FPCR.AH semantics for FMAXV and FMINV
      target/arm: Implement FPCR.AH semantics for FMINP and FMAXP
      target/arm: Implement FPCR.AH semantics for SVE FMAXV and FMINV
      target/arm: Implement FPCR.AH semantics for SVE FMIN/FMAX immediate
      target/arm: Implement FPCR.AH semantics for SVE FMIN/FMAX vector
      target/arm: Implement FPCR.AH handling of negation of NaN
      target/arm: Implement FPCR.AH handling for scalar FABS and FABD
      target/arm: Handle FPCR.AH in vector FABD
      target/arm: Handle FPCR.AH in SVE FNEG
      target/arm: Handle FPCR.AH in SVE FABS
      target/arm: Handle FPCR.AH in SVE FABD
      target/arm: Handle FPCR.AH in negation steps in SVE FCADD
      target/arm: Handle FPCR.AH in negation steps in FCADD
      target/arm: Handle FPCR.AH in FRECPS and FRSQRTS scalar insns
      target/arm: Handle FPCR.AH in FRECPS and FRSQRTS vector insns
      target/arm: Handle FPCR.AH in negation step in FMLS (indexed)
      target/arm: Handle FPCR.AH in negation in FMLS (vector)
      target/arm: Handle FPCR.AH in negation step in SVE FMLS (vector)
      target/arm: Handle FPCR.AH in SVE FTSSEL
      target/arm: Handle FPCR.AH in SVE FTMAD
      target/arm: Enable FEAT_AFP for '-cpu max'
      target/arm: Plumb FEAT_RPRES frecpe and frsqrte through to new helper
      target/arm: Implement increased precision FRECPE
      target/arm: Implement increased precision FRSQRTE
      target/arm: Enable FEAT_RPRES for -cpu max

Richard Henderson (19):
      target/arm: Handle FPCR.AH in vector FCMLA
      target/arm: Handle FPCR.AH in FCMLA by index
      target/arm: Handle FPCR.AH in SVE FCMLA
      target/arm: Handle FPCR.AH in FMLSL (by element and vector)
      target/arm: Handle FPCR.AH in SVE FMLSL (indexed)
      target/arm: Handle FPCR.AH in SVE FMLSLB, FMLSLT (vectors)
      target/arm: Introduce CPUARMState.vfp.fp_status[]
      target/arm: Remove standard_fp_status_f16
      target/arm: Remove standard_fp_status
      target/arm: Remove ah_fp_status_f16
      target/arm: Remove ah_fp_status
      target/arm: Remove fp_status_f16_a64
      target/arm: Remove fp_status_f16_a32
      target/arm: Remove fp_status_a64
      target/arm: Remove fp_status_a32
      target/arm: Simplify fp_status indexing in mve_helper.c
      target/arm: Simplify DO_VFP_cmp in vfp_helper.c
      target/arm: Read fz16 from env->vfp.fpcr
      target/arm: Sink fp_status and fpcr access into do_fmlal*

In do_cvttq() we set env->error_code with what is supposed to be a
set of FPCR exception bit values.  However, if the set of float
exception flags we get back from softfloat for the conversion
includes a flag which is not one of the three we expect here
(invalid_cvti, invalid, inexact) then we will fall through the
if-ladder and set env->error_code to the unconverted softfloat
exception_flag value.  This will then cause us to take a spurious
exception.

This is harmless now, but when we add new floating point exception
flags to softfloat it will cause problems.  Add an else clause to the
if-ladder to make it ignore any float exception flags it doesn't care
about.

Specifically, without this fix, 'make check-tcg' will fail for Alpha
when the commit adding float_flag_input_denormal_used lands.

Fixes: aa3bad5b59e7 ("target/alpha: Use float64_to_int64_modulo for CVTTQ")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
---
 target/alpha/fpu_helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/alpha/fpu_helper.c b/target/alpha/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/fpu_helper.c
+++ b/target/alpha/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_cvttq(CPUAlphaState *env, uint64_t a, int roundmode)
             exc = FPCR_INV;
         } else if (exc & float_flag_inexact) {
             exc = FPCR_INE;
+        } else {
+            exc = 0;
         }
     }
     env->error_code = exc;
-- 
2.34.1

Currently in softfloat we canonicalize input denormals and so the
code that implements floating point operations does not need to care
whether the input value was originally normal or denormal.  However,
both x86 and Arm FEAT_AFP require that an exception flag is set if:
 * an input is denormal
 * that input is not squashed to zero
 * that input is actually used in the calculation (e.g. we
   did not find the other input was a NaN)

So we need to track that the input was a non-squashed denormal.  To
do this we add a new value to the FloatClass enum.  In this commit we
add the value and adjust the code everywhere that looks at FloatClass
values so that the new float_class_denormal behaves identically to
float_class_normal.  We will add the code that does the "raise a new
float exception flag if an input was an unsquashed denormal and we
used it" in a subsequent commit.

There should be no behavioural change in this commit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 fpu/softfloat.c           | 32 ++++++++++++++++++++++++++++---
 fpu/softfloat-parts.c.inc | 40 ++++++++++++++++++++++++---------------
 2 files changed, 54 insertions(+), 18 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ float64_gen2(float64 xa, float64 xb, float_status *s,
 /*
  * Classify a floating point number. Everything above float_class_qnan
  * is a NaN so cls >= float_class_qnan is any NaN.
+ *
+ * Note that we canonicalize denormals, so most code should treat
+ * class_normal and class_denormal identically.
  */
 
 typedef enum __attribute__ ((__packed__)) {
     float_class_unclassified,
     float_class_zero,
     float_class_normal,
+    float_class_denormal, /* input was a non-squashed denormal */
     float_class_inf,
     float_class_qnan,  /* all NaNs from here */
     float_class_snan,
@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__ ((__packed__)) {
 enum {
     float_cmask_zero    = float_cmask(float_class_zero),
     float_cmask_normal  = float_cmask(float_class_normal),
+    float_cmask_denormal = float_cmask(float_class_denormal),
     float_cmask_inf     = float_cmask(float_class_inf),
     float_cmask_qnan    = float_cmask(float_class_qnan),
     float_cmask_snan    = float_cmask(float_class_snan),
 
     float_cmask_infzero = float_cmask_zero | float_cmask_inf,
     float_cmask_anynan  = float_cmask_qnan | float_cmask_snan,
+    float_cmask_anynorm = float_cmask_normal | float_cmask_denormal,
 };
 
 /* Flags for parts_minmax. */
@@ -XXX,XX +XXX,XX @@ static inline __attribute__((unused)) bool is_qnan(FloatClass c)
     return c == float_class_qnan;
 }
 
+/*
+ * Return true if the float_cmask has only normals in it
+ * (including input denormals that were canonicalized)
+ */
+static inline bool cmask_is_only_normals(int cmask)
+{
+    return !(cmask & ~float_cmask_anynorm);
+}
+
+static inline bool is_anynorm(FloatClass c)
+{
+    return float_cmask(c) & float_cmask_anynorm;
+}
+
 /*
  * Structure holding all of the decomposed parts of a float.
  * The exponent is unbiased and the fraction is normalized.
@@ -XXX,XX +XXX,XX @@ static float64 float64r32_round_pack_canonical(FloatParts64 *p,
      */
     switch (p->cls) {
     case float_class_normal:
+    case float_class_denormal:
         if (unlikely(p->exp == 0)) {
             /*
              * The result is denormal for float32, but can be represented
@@ -XXX,XX +XXX,XX @@ static floatx80 floatx80_round_pack_canonical(FloatParts128 *p,
 
     switch (p->cls) {
     case float_class_normal:
+    case float_class_denormal:
         if (s->floatx80_rounding_precision == floatx80_precision_x) {
             parts_uncanon_normal(p, s, fmt);
             frac = p->frac_hi;
@@ -XXX,XX +XXX,XX @@ static void parts_float_to_ahp(FloatParts64 *a, float_status *s)
         break;
 
     case float_class_normal:
+    case float_class_denormal:
     case float_class_zero:
         break;
 
@@ -XXX,XX +XXX,XX @@ static void parts_float_to_float_narrow(FloatParts64 *a, FloatParts128 *b,
     a->sign = b->sign;
     a->exp = b->exp;
 
-    if (a->cls == float_class_normal) {
+    if (is_anynorm(a->cls)) {
         frac_truncjam(a, b);
     } else if (is_nan(a->cls)) {
         /* Discard the low bits of the NaN. */
@@ -XXX,XX +XXX,XX @@ static Int128 float128_to_int128_scalbn(float128 a, FloatRoundMode rmode,
         return int128_zero();
 
     case float_class_normal:
+    case float_class_denormal:
         if (parts_round_to_int_normal(&p, rmode, scale, 128 - 2)) {
             flags = float_flag_inexact;
         }
@@ -XXX,XX +XXX,XX @@ static Int128 float128_to_uint128_scalbn(float128 a, FloatRoundMode rmode,
         return int128_zero();
 
     case float_class_normal:
+    case float_class_denormal:
         if (parts_round_to_int_normal(&p, rmode, scale, 128 - 2)) {
             flags = float_flag_inexact;
             if (p.cls == float_class_zero) {
@@ -XXX,XX +XXX,XX @@ float32 float32_exp2(float32 a, float_status *status)
     float32_unpack_canonical(&xp, a, status);
     if (unlikely(xp.cls != float_class_normal)) {
         switch (xp.cls) {
+        case float_class_denormal:
+            break;
         case float_class_snan:
         case float_class_qnan:
             parts_return_nan(&xp, status);
@@ -XXX,XX +XXX,XX @@ float32 float32_exp2(float32 a, float_status *status)
         case float_class_zero:
             return float32_one;
         default:
-            break;
+            g_assert_not_reached();
         }
-        g_assert_not_reached();
     }
 
     float_raise(float_flag_inexact, status);
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(canonicalize)(FloatPartsN *p, float_status *status,
             frac_clear(p);
         } else {
             int shift = frac_normalize(p);
-            p->cls = float_class_normal;
+            p->cls = float_class_denormal;
             p->exp = fmt->frac_shift - fmt->exp_bias
                    - shift + !fmt->m68k_denormal;
         }
@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
 static void partsN(uncanon)(FloatPartsN *p, float_status *s,
                             const FloatFmt *fmt)
 {
-    if (likely(p->cls == float_class_normal)) {
+    if (likely(is_anynorm(p->cls))) {
         parts_uncanon_normal(p, s, fmt);
     } else {
         switch (p->cls) {
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(addsub)(FloatPartsN *a, FloatPartsN *b,
 
     if (a->sign != b_sign) {
         /* Subtraction */
-        if (likely(ab_mask == float_cmask_normal)) {
+        if (likely(cmask_is_only_normals(ab_mask))) {
             if (parts_sub_normal(a, b)) {
                 return a;
             }
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(addsub)(FloatPartsN *a, FloatPartsN *b,
         }
     } else {
         /* Addition */
-        if (likely(ab_mask == float_cmask_normal)) {
+        if (likely(cmask_is_only_normals(ab_mask))) {
             parts_add_normal(a, b);
             return a;
         }
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(addsub)(FloatPartsN *a, FloatPartsN *b,
     }
 
     if (b->cls == float_class_zero) {
-        g_assert(a->cls == float_class_normal);
+        g_assert(is_anynorm(a->cls));
         return a;
     }
 
     g_assert(a->cls == float_class_zero);
-    g_assert(b->cls == float_class_normal);
+    g_assert(is_anynorm(b->cls));
  return_b:
     b->sign = b_sign;
     return b;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(mul)(FloatPartsN *a, FloatPartsN *b,
     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
     bool sign = a->sign ^ b->sign;
 
-    if (likely(ab_mask == float_cmask_normal)) {
+    if (likely(cmask_is_only_normals(ab_mask))) {
         FloatPartsW tmp;
 
         frac_mulw(&tmp, a, b);
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
         a->sign ^= 1;
     }
 
-    if (unlikely(ab_mask != float_cmask_normal)) {
+    if (unlikely(!cmask_is_only_normals(ab_mask))) {
         if (unlikely(ab_mask == float_cmask_infzero)) {
             float_raise(float_flag_invalid | float_flag_invalid_imz, s);
             goto d_nan;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
         }
 
         g_assert(ab_mask & float_cmask_zero);
-        if (c->cls == float_class_normal) {
+        if (is_anynorm(c->cls)) {
             *a = *c;
             goto return_normal;
         }
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(div)(FloatPartsN *a, FloatPartsN *b,
     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
     bool sign = a->sign ^ b->sign;
 
-    if (likely(ab_mask == float_cmask_normal)) {
+    if (likely(cmask_is_only_normals(ab_mask))) {
         a->sign = sign;
         a->exp -= b->exp + frac_div(a, b);
         return a;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(modrem)(FloatPartsN *a, FloatPartsN *b,
 {
     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
 
-    if (likely(ab_mask == float_cmask_normal)) {
+    if (likely(cmask_is_only_normals(ab_mask))) {
         frac_modrem(a, b, mod_quot);
         return a;
     }
@@ -XXX,XX +XXX,XX @@ static void partsN(sqrt)(FloatPartsN *a, float_status *status,
 
     if (unlikely(a->cls != float_class_normal)) {
         switch (a->cls) {
+        case float_class_denormal:
+            break;
         case float_class_snan:
         case float_class_qnan:
             parts_return_nan(a, status);
@@ -XXX,XX +XXX,XX @@ static void partsN(round_to_int)(FloatPartsN *a, FloatRoundMode rmode,
     case float_class_inf:
         break;
     case float_class_normal:
+    case float_class_denormal:
         if (parts_round_to_int_normal(a, rmode, scale, fmt->frac_size)) {
             float_raise(float_flag_inexact, s);
         }
@@ -XXX,XX +XXX,XX @@ static int64_t partsN(float_to_sint)(FloatPartsN *p, FloatRoundMode rmode,
         return 0;
 
     case float_class_normal:
+    case float_class_denormal:
         /* TODO: N - 2 is frac_size for rounding; could use input fmt. */
         if (parts_round_to_int_normal(p, rmode, scale, N - 2)) {
             flags = float_flag_inexact;
@@ -XXX,XX +XXX,XX @@ static uint64_t partsN(float_to_uint)(FloatPartsN *p, FloatRoundMode rmode,
         return 0;
 
     case float_class_normal:
+    case float_class_denormal:
         /* TODO: N - 2 is frac_size for rounding; could use input fmt. */
         if (parts_round_to_int_normal(p, rmode, scale, N - 2)) {
             flags = float_flag_inexact;
@@ -XXX,XX +XXX,XX @@ static int64_t partsN(float_to_sint_modulo)(FloatPartsN *p,
         return 0;
 
     case float_class_normal:
+    case float_class_denormal:
         /* TODO: N - 2 is frac_size for rounding; could use input fmt. */
         if (parts_round_to_int_normal(p, rmode, 0, N - 2)) {
             flags = float_flag_inexact;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(minmax)(FloatPartsN *a, FloatPartsN *b,
     a_exp = a->exp;
     b_exp = b->exp;
 
-    if (unlikely(ab_mask != float_cmask_normal)) {
+    if (unlikely(!cmask_is_only_normals(ab_mask))) {
         switch (a->cls) {
         case float_class_normal:
+        case float_class_denormal:
             break;
         case float_class_inf:
             a_exp = INT16_MAX;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(minmax)(FloatPartsN *a, FloatPartsN *b,
         }
         switch (b->cls) {
         case float_class_normal:
+        case float_class_denormal:
             break;
         case float_class_inf:
             b_exp = INT16_MAX;
@@ -XXX,XX +XXX,XX @@ static FloatRelation partsN(compare)(FloatPartsN *a, FloatPartsN *b,
 {
     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
 
-    if (likely(ab_mask == float_cmask_normal)) {
+    if (likely(cmask_is_only_normals(ab_mask))) {
         FloatRelation cmp;
 
         if (a->sign != b->sign) {
@@ -XXX,XX +XXX,XX @@ static void partsN(scalbn)(FloatPartsN *a, int n, float_status *s)
     case float_class_inf:
         break;
     case float_class_normal:
+    case float_class_denormal:
         a->exp += MIN(MAX(n, -0x10000), 0x10000);
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static void partsN(log2)(FloatPartsN *a, float_status *s, const FloatFmt *fmt)
 
     if (unlikely(a->cls != float_class_normal)) {
         switch (a->cls) {
+        case float_class_denormal:
+            break;
         case float_class_snan:
         case float_class_qnan:
             parts_return_nan(a, s);
@@ -XXX,XX +XXX,XX @@ static void partsN(log2)(FloatPartsN *a, float_status *s, const FloatFmt *fmt)
             }
             return;
         default:
-            break;
+            g_assert_not_reached();
         }
-        g_assert_not_reached();
     }
     if (unlikely(a->sign)) {
         goto d_nan;
-- 
2.34.1

For the x86 and the Arm FEAT_AFP semantics, we need to be able to
tell the target code that the FPU operation has used an input
denormal.  Implement this; when it happens we set the new
float_flag_denormal_input_used.

Note that we only set this when an input denormal is actually used by
the operation: if the operation results in Invalid Operation or
Divide By Zero or the result is a NaN because some other input was a
NaN then we never needed to look at the input denormal and do not set
denormal_input_used.

We mostly do not need to adjust the hardfloat codepaths to deal with
this flag, because almost all hardfloat operations are already gated
on the input not being a denormal, and will fall back to softfloat
for a denormal input.  The only exception is the comparison
operations, where we need to add the check for input denormals, which
must now fall back to softfloat where they did not before.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/fpu/softfloat-types.h |  7 ++++
 fpu/softfloat.c               | 38 +++++++++++++++++---
 fpu/softfloat-parts.c.inc     | 68 ++++++++++++++++++++++++++++++++++-
 3 files changed, 107 insertions(+), 6 deletions(-)

diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ enum {
     float_flag_invalid_sqrt    = 0x0800,  /* sqrt(-x) */
     float_flag_invalid_cvti    = 0x1000,  /* non-nan to integer */
     float_flag_invalid_snan    = 0x2000,  /* any operand was snan */
+    /*
+     * An input was denormal and we used it (without flushing it to zero).
+     * Not set if we do not actually use the denormal input (e.g.
+     * because some other input was a NaN, or because the operation
+     * wasn't actually carried out (divide-by-zero; invalid))
+     */
+    float_flag_input_denormal_used = 0x4000,
 };
 
 /*
diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ static void parts_float_to_ahp(FloatParts64 *a, float_status *s)
                                   float16_params_ahp.frac_size + 1);
         break;
 
-    case float_class_normal:
     case float_class_denormal:
+        float_raise(float_flag_input_denormal_used, s);
+        break;
+    case float_class_normal:
     case float_class_zero:
         break;
 
@@ -XXX,XX +XXX,XX @@ static void parts64_float_to_float(FloatParts64 *a, float_status *s)
     if (is_nan(a->cls)) {
         parts_return_nan(a, s);
     }
+    if (a->cls == float_class_denormal) {
+        float_raise(float_flag_input_denormal_used, s);
+    }
 }
 
 static void parts128_float_to_float(FloatParts128 *a, float_status *s)
@@ -XXX,XX +XXX,XX @@ static void parts128_float_to_float(FloatParts128 *a, float_status *s)
     if (is_nan(a->cls)) {
         parts_return_nan(a, s);
     }
+    if (a->cls == float_class_denormal) {
+        float_raise(float_flag_input_denormal_used, s);
+    }
 }
 
 #define parts_float_to_float(P, S) \
@@ -XXX,XX +XXX,XX @@ static void parts_float_to_float_narrow(FloatParts64 *a, FloatParts128 *b,
     a->sign = b->sign;
     a->exp = b->exp;
 
-    if (is_anynorm(a->cls)) {
+    switch (a->cls) {
+    case float_class_denormal:
+        float_raise(float_flag_input_denormal_used, s);
+        /* fall through */
+    case float_class_normal:
         frac_truncjam(a, b);
-    } else if (is_nan(a->cls)) {
+        break;
+    case float_class_snan:
+    case float_class_qnan:
         /* Discard the low bits of the NaN. */
         a->frac = b->frac_hi;
         parts_return_nan(a, s);
+        break;
+    default:
+        break;
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void parts_float_to_float_widen(FloatParts128 *a, FloatParts64 *b,
     if (is_nan(a->cls)) {
         parts_return_nan(a, s);
     }
+    if (a->cls == float_class_denormal) {
+        float_raise(float_flag_input_denormal_used, s);
+    }
 }
 
 float32 float16_to_float32(float16 a, bool ieee, float_status *s)
@@ -XXX,XX +XXX,XX @@ float32_hs_compare(float32 xa, float32 xb, float_status *s, bool is_quiet)
         goto soft;
     }
 
-    float32_input_flush2(&ua.s, &ub.s, s);
+    if (unlikely(float32_is_denormal(ua.s) || float32_is_denormal(ub.s))) {
+        /* We may need to set the input_denormal_used flag */
+        goto soft;
+    }
+
     if (isgreaterequal(ua.h, ub.h)) {
         if (isgreater(ua.h, ub.h)) {
             return float_relation_greater;
@@ -XXX,XX +XXX,XX @@ float64_hs_compare(float64 xa, float64 xb, float_status *s, bool is_quiet)
         goto soft;
     }
 
-    float64_input_flush2(&ua.s, &ub.s, s);
+    if (unlikely(float64_is_denormal(ua.s) || float64_is_denormal(ub.s))) {
+        /* We may need to set the input_denormal_used flag */
+        goto soft;
+    }
+
     if (isgreaterequal(ua.h, ub.h)) {
         if (isgreater(ua.h, ub.h)) {
             return float_relation_greater;
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(addsub)(FloatPartsN *a, FloatPartsN *b,
     bool b_sign = b->sign ^ subtract;
     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
 
+    /*
+     * For addition and subtraction, we will consume an
+     * input denormal unless the other input is a NaN.
+     */
+    if ((ab_mask & (float_cmask_denormal | float_cmask_anynan)) ==
+        float_cmask_denormal) {
+        float_raise(float_flag_input_denormal_used, s);
+    }
+
     if (a->sign != b_sign) {
         /* Subtraction */
         if (likely(cmask_is_only_normals(ab_mask))) {
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(mul)(FloatPartsN *a, FloatPartsN *b,
     if (likely(cmask_is_only_normals(ab_mask))) {
         FloatPartsW tmp;
 
+        if (ab_mask & float_cmask_denormal) {
+            float_raise(float_flag_input_denormal_used, s);
+        }
+
         frac_mulw(&tmp, a, b);
         frac_truncjam(a, &tmp);
 
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(mul)(FloatPartsN *a, FloatPartsN *b,
     }
 
     /* Multiply by 0 or Inf */
+    if (ab_mask & float_cmask_denormal) {
+        float_raise(float_flag_input_denormal_used, s);
+    }
+
     if (ab_mask & float_cmask_inf) {
         a->cls = float_class_inf;
         a->sign = sign;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(muladd_scalbn)(FloatPartsN *a, FloatPartsN *b,
     if (flags & float_muladd_negate_result) {
         a->sign ^= 1;
     }
+
+    /*
+     * All result types except for "return the default NaN
+     * because this is an Invalid Operation" go through here;
+     * this matches the set of cases where we consumed a
+     * denormal input.
+     */
+    if (abc_mask & float_cmask_denormal) {
+        float_raise(float_flag_input_denormal_used, s);
+    }
     return a;
 
  return_sub_zero:
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(div)(FloatPartsN *a, FloatPartsN *b,
     bool sign = a->sign ^ b->sign;
 
     if (likely(cmask_is_only_normals(ab_mask))) {
+        if (ab_mask & float_cmask_denormal) {
+            float_raise(float_flag_input_denormal_used, s);
+        }
         a->sign = sign;
         a->exp -= b->exp + frac_div(a, b);
         return a;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(div)(FloatPartsN *a, FloatPartsN *b,
         return parts_pick_nan(a, b, s);
     }
 
+    if ((ab_mask & float_cmask_denormal) && b->cls != float_class_zero) {
+        float_raise(float_flag_input_denormal_used, s);
+    }
+
     a->sign = sign;
 
     /* Inf / X */
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(modrem)(FloatPartsN *a, FloatPartsN *b,
     int ab_mask = float_cmask(a->cls) | float_cmask(b->cls);
 
     if (likely(cmask_is_only_normals(ab_mask))) {
+        if (ab_mask & float_cmask_denormal) {
+            float_raise(float_flag_input_denormal_used, s);
+        }
         frac_modrem(a, b, mod_quot);
         return a;
     }
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(modrem)(FloatPartsN *a, FloatPartsN *b,
         return a;
     }
 
+    if (ab_mask & float_cmask_denormal) {
+        float_raise(float_flag_input_denormal_used, s);
+    }
+
     /* N % Inf; 0 % N */
     g_assert(b->cls == float_class_inf || a->cls == float_class_zero);
     return a;
@@ -XXX,XX +XXX,XX @@ static void partsN(sqrt)(FloatPartsN *a, float_status *status,
     if (unlikely(a->cls != float_class_normal)) {
         switch (a->cls) {
         case float_class_denormal:
+            if (!a->sign) {
+                /* -ve denormal will be InvalidOperation */
+                float_raise(float_flag_input_denormal_used, status);
+            }
             break;
         case float_class_snan:
         case float_class_qnan:
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(minmax)(FloatPartsN *a, FloatPartsN *b,
         if ((flags & (minmax_isnum | minmax_isnumber))
             && !(ab_mask & float_cmask_snan)
             && (ab_mask & ~float_cmask_qnan)) {
+            if (ab_mask & float_cmask_denormal) {
+                float_raise(float_flag_input_denormal_used, s);
+            }
             return is_nan(a->cls) ? b : a;
         }
 
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(minmax)(FloatPartsN *a, FloatPartsN *b,
         return parts_pick_nan(a, b, s);
     }
 
+    if (ab_mask & float_cmask_denormal) {
+        float_raise(float_flag_input_denormal_used, s);
+    }
+
     a_exp = a->exp;
     b_exp = b->exp;
 
@@ -XXX,XX +XXX,XX @@ static FloatRelation partsN(compare)(FloatPartsN *a, FloatPartsN *b,
     if (likely(cmask_is_only_normals(ab_mask))) {
         FloatRelation cmp;
 
+        if (ab_mask & float_cmask_denormal) {
+            float_raise(float_flag_input_denormal_used, s);
+        }
+
         if (a->sign != b->sign) {
             goto a_sign;
         }
@@ -XXX,XX +XXX,XX @@ static FloatRelation partsN(compare)(FloatPartsN *a, FloatPartsN *b,
         return float_relation_unordered;
     }
 
+    if (ab_mask & float_cmask_denormal) {
+        float_raise(float_flag_input_denormal_used, s);
+    }
+
     if (ab_mask & float_cmask_zero) {
         if (ab_mask == float_cmask_zero) {
             return float_relation_equal;
@@ -XXX,XX +XXX,XX @@ static void partsN(scalbn)(FloatPartsN *a, int n, float_status *s)
     case float_class_zero:
     case float_class_inf:
         break;
-    case float_class_normal:
     case float_class_denormal:
+        float_raise(float_flag_input_denormal_used, s);
+        /* fall through */
+    case float_class_normal:
         a->exp += MIN(MAX(n, -0x10000), 0x10000);
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static void partsN(log2)(FloatPartsN *a, float_status *s, const FloatFmt *fmt)
     if (unlikely(a->cls != float_class_normal)) {
         switch (a->cls) {
         case float_class_denormal:
+            if (!a->sign) {
+                /* -ve denormal will be InvalidOperation */
+                float_raise(float_flag_input_denormal_used, s);
+            }
             break;
         case float_class_snan:
         case float_class_qnan:
-- 
2.34.1

Currently we handle flushing of output denormals in uncanon_normal
always before we deal with rounding.  This works for architectures
that detect tininess before rounding, but is usually not the right
place when the architecture detects tininess after rounding.  For
example, for x86 the SDM states that the MXCSR FTZ control bit causes
outputs to be flushed to zero "when it detects a floating-point
underflow condition".  This means that we mustn't flush to zero if
the input is such that after rounding it is no longer tiny.

At least one of our guest architectures does underflow detection
after rounding but flushing of denormals before rounding (MIPS MSA);
this means we need to have a config knob for this that is separate
from our existing tininess_before_rounding setting.

Add an ftz_detection flag.  For consistency with
tininess_before_rounding, we make it default to "detect ftz after
rounding"; this means that we need to explicitly set the flag to
"detect ftz before rounding" on every existing architecture that sets
flush_to_zero, so that this commit has no behaviour change.
(This means more code change here but for the long term a less
confusing API.)

For several architectures the current behaviour is either
definitely or possibly wrong; annotate those with TODO comments.
These architectures are definitely wrong (and should detect
ftz after rounding):
 * x86
 * Alpha

For these architectures the spec is unclear:
 * MIPS (for non-MSA)
 * RX
 * SH4

PA-RISC makes ftz detection IMPDEF, but we aren't setting the
"tininess before rounding" setting that we ought to.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 include/fpu/softfloat-helpers.h | 11 +++++++++++
 include/fpu/softfloat-types.h   | 18 ++++++++++++++++++
 target/mips/fpu_helper.h        |  6 ++++++
 target/alpha/cpu.c              |  7 +++++++
 target/arm/cpu.c                |  1 +
 target/hppa/fpu_helper.c        | 11 +++++++++++
 target/i386/tcg/fpu_helper.c    |  8 ++++++++
 target/mips/msa.c               |  9 +++++++++
 target/ppc/cpu_init.c           |  3 +++
 target/rx/cpu.c                 |  8 ++++++++
 target/sh4/cpu.c                |  8 ++++++++
 target/tricore/helper.c         |  1 +
 tests/fp/fp-bench.c             |  1 +
 fpu/softfloat-parts.c.inc       | 21 +++++++++++++++------
 14 files changed, 107 insertions(+), 6 deletions(-)

diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-helpers.h
+++ b/include/fpu/softfloat-helpers.h
@@ -XXX,XX +XXX,XX @@ static inline void set_flush_inputs_to_zero(bool val, float_status *status)
     status->flush_inputs_to_zero = val;
 }
 
+static inline void set_float_ftz_detection(FloatFTZDetection d,
+                                           float_status *status)
+{
+    status->ftz_detection = d;
+}
+
 static inline void set_default_nan_mode(bool val, float_status *status)
 {
     status->default_nan_mode = val;
@@ -XXX,XX +XXX,XX @@ static inline bool get_default_nan_mode(const float_status *status)
     return status->default_nan_mode;
 }
 
+static inline FloatFTZDetection get_float_ftz_detection(const float_status *status)
+{
+    return status->ftz_detection;
+}
+
 #endif /* SOFTFLOAT_HELPERS_H */
diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
     float_infzeronan_suppress_invalid = (1 << 7),
 } FloatInfZeroNaNRule;
 
+/*
+ * When flush_to_zero is set, should we detect denormal results to
+ * be flushed before or after rounding? For most architectures this
+ * should be set to match the tininess_before_rounding setting,
+ * but a few architectures, e.g. MIPS MSA, detect FTZ before
+ * rounding but tininess after rounding.
+ *
+ * This enum is arranged so that the default if the target doesn't
+ * configure it matches the default for tininess_before_rounding
+ * (i.e. "after rounding").
+ */
+typedef enum __attribute__((__packed__)) {
+    float_ftz_after_rounding = 0,
+    float_ftz_before_rounding = 1,
+} FloatFTZDetection;
+
 /*
  * Floating Point Status. Individual architectures may maintain
  * several versions of float_status for different functions. The
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
     bool tininess_before_rounding;
     /* should denormalised results go to zero and set output_denormal_flushed? */
     bool flush_to_zero;
+    /* do we detect and flush denormal results before or after rounding? */
+    FloatFTZDetection ftz_detection;
     /* should denormalised inputs go to zero and set input_denormal_flushed? */
     bool flush_inputs_to_zero;
     bool default_nan_mode;
diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/fpu_helper.h
+++ b/target/mips/fpu_helper.h
@@ -XXX,XX +XXX,XX @@ static inline void fp_reset(CPUMIPSState *env)
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab,
                              &env->active_fpu.fp_status);
+    /*
+     * TODO: the spec does't say clearly whether FTZ happens before
+     * or after rounding for normal FPU operations.
+     */
+    set_float_ftz_detection(float_ftz_before_rounding,
+                            &env->active_fpu.fp_status);
 }
 
 /* MSA */
diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/alpha/cpu.c
+++ b/target/alpha/cpu.c
@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_initfn(Object *obj)
     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
     /* Default NaN: sign bit clear, msb frac bit set */
     set_float_default_nan_pattern(0b01000000, &env->fp_status);
+    /*
+     * TODO: this is incorrect. The Alpha Architecture Handbook version 4
+     * section 4.7.7.11 says that we flush to zero for underflow cases, so
+     * this should be float_ftz_after_rounding to match the
+     * tininess_after_rounding (which is specified in section 4.7.5).
+     */
+    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
 #if defined(CONFIG_USER_ONLY)
     env->flags = ENV_FLAG_PS_USER | ENV_FLAG_FEN;
     cpu_alpha_store_fpcr(env, (uint64_t)(FPCR_INVD | FPCR_DZED | FPCR_OVFD
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
 static void arm_set_default_fp_behaviours(float_status *s)
 {
     set_float_detect_tininess(float_tininess_before_rounding, s);
+    set_float_ftz_detection(float_ftz_before_rounding, s);
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
     set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/fpu_helper.c
+++ b/target/hppa/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
     /* Default NaN: sign bit clear, msb-1 frac bit set */
     set_float_default_nan_pattern(0b00100000, &env->fp_status);
+    /*
+     * "PA-RISC 2.0 Architecture" says it is IMPDEF whether the flushing
+     * enabled by FPSR.D happens before or after rounding. We pick "before"
+     * for consistency with tininess detection.
+     */
+    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
+    /*
+     * TODO: "PA-RISC 2.0 Architecture" chapter 10 says that we should
+     * detect tininess before rounding, but we don't set that here so we
+     * get the default tininess after rounding.
+     */
 }
 
 void cpu_hppa_loaded_fr0(CPUHPPAState *env)
diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
     set_float_default_nan_pattern(0b11000000, &env->fp_status);
     set_float_default_nan_pattern(0b11000000, &env->mmx_status);
     set_float_default_nan_pattern(0b11000000, &env->sse_status);
+    /*
+     * TODO: x86 does flush-to-zero detection after rounding (the SDM
+     * section 10.2.3.3 on the FTZ bit of MXCSR says that we flush
+     * when we detect underflow, which x86 does after rounding).
+     */
+    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
+    set_float_ftz_detection(float_ftz_before_rounding, &env->mmx_status);
+    set_float_ftz_detection(float_ftz_before_rounding, &env->sse_status);
 }
 
 static inline uint8_t save_exception_flags(CPUX86State *env)
diff --git a/target/mips/msa.c b/target/mips/msa.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/msa.c
+++ b/target/mips/msa.c
@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
     /* tininess detected after rounding.*/
     set_float_detect_tininess(float_tininess_after_rounding,
                               &env->active_tc.msa_fp_status);
+    /*
+     * MSACSR.FS detects tiny results to flush to zero before rounding
+     * (per "MIPS Architecture for Programmers Volume IV-j: The MIPS64 SIMD
+     * Architecture Module, Revision 1.1" section 3.5.4), even though it
+     * detects tininess after rounding for underflow purposes (section 3.4.2
+     * table 3.3).
+     */
+    set_float_ftz_detection(float_ftz_before_rounding,
+                            &env->active_tc.msa_fp_status);
 
     /*
      * According to MIPS specifications, if one of the two operands is
diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
     /* tininess for underflow is detected before rounding */
     set_float_detect_tininess(float_tininess_before_rounding,
                               &env->fp_status);
+    /* Similarly for flush-to-zero */
+    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
+
     /*
      * PowerPC propagation rules:
      *  1. A if it sNaN or qNaN
diff --git a/target/rx/cpu.c b/target/rx/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/rx/cpu.c
+++ b/target/rx/cpu.c
@@ -XXX,XX +XXX,XX @@ static void rx_cpu_reset_hold(Object *obj, ResetType type)
     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
     /* Default NaN value: sign bit clear, set frac msb */
     set_float_default_nan_pattern(0b01000000, &env->fp_status);
+    /*
+     * TODO: "RX Family RXv1 Instruction Set Architecture" is not 100% clear
+     * on whether flush-to-zero should happen before or after rounding, but
+     * section 1.3.2 says that it happens when underflow is detected, and
+     * implies that underflow is detected after rounding. So this may not
+     * be the correct setting.
+     */
+    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
 }
 
 static ObjectClass *rx_cpu_class_by_name(const char *cpu_model)
diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sh4/cpu.c
+++ b/target/sh4/cpu.c
@@ -XXX,XX +XXX,XX @@ static void superh_cpu_reset_hold(Object *obj, ResetType type)
     set_default_nan_mode(1, &env->fp_status);
     /* sign bit clear, set all frac bits other than msb */
     set_float_default_nan_pattern(0b00111111, &env->fp_status);
+    /*
+     * TODO: "SH-4 CPU Core Architecture ADCS 7182230F" doesn't say whether
+     * it detects tininess before or after rounding. Section 6.4 is clear
+     * that flush-to-zero happens when the result underflows, though, so
+     * either this should be "detect ftz after rounding" or else we should
+     * be setting "detect tininess before rounding".
+     */
+    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
 }
 
 static void superh_cpu_disas_set_info(CPUState *cpu, disassemble_info *info)
diff --git a/target/tricore/helper.c b/target/tricore/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/tricore/helper.c
+++ b/target/tricore/helper.c
@@ -XXX,XX +XXX,XX @@ void fpu_set_state(CPUTriCoreState *env)
     set_flush_inputs_to_zero(1, &env->fp_status);
     set_flush_to_zero(1, &env->fp_status);
     set_float_detect_tininess(float_tininess_before_rounding, &env->fp_status);
+    set_float_ftz_detection(float_ftz_before_rounding, &env->fp_status);
     set_default_nan_mode(1, &env->fp_status);
     /* Default NaN pattern: sign bit clear, frac msb set */
     set_float_default_nan_pattern(0b01000000, &env->fp_status);
diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-bench.c
+++ b/tests/fp/fp-bench.c
@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
     set_float_3nan_prop_rule(float_3nan_prop_s_cab, &soft_status);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
     set_float_default_nan_pattern(0b01000000, &soft_status);
+    set_float_ftz_detection(float_ftz_before_rounding, &soft_status);
 
     f = bench_funcs[operation][precision];
     g_assert(f);
diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
             p->frac_lo &= ~round_mask;
         }
         frac_shr(p, frac_shift);
-    } else if (s->flush_to_zero) {
+    } else if (s->flush_to_zero &&
+               s->ftz_detection == float_ftz_before_rounding) {
         flags |= float_flag_output_denormal_flushed;
         p->cls = float_class_zero;
         exp = 0;
@@ -XXX,XX +XXX,XX @@ static void partsN(uncanon_normal)(FloatPartsN *p, float_status *s,
         exp = (p->frac_hi & DECOMPOSED_IMPLICIT_BIT) && !fmt->m68k_denormal;
         frac_shr(p, frac_shift);
 
-        if (is_tiny && (flags & float_flag_inexact)) {
-            flags |= float_flag_underflow;
-        }
-        if (exp == 0 && frac_eqz(p)) {
-            p->cls = float_class_zero;
+        if (is_tiny) {
+            if (s->flush_to_zero) {
+                assert(s->ftz_detection == float_ftz_after_rounding);
+                flags |= float_flag_output_denormal_flushed;
+                p->cls = float_class_zero;
+                exp = 0;
+                frac_clear(p);
+            } else if (flags & float_flag_inexact) {
+                flags |= float_flag_underflow;
+            }
+            if (exp == 0 && frac_eqz(p)) {
+                p->cls = float_class_zero;
+            }
         }
     }
     p->exp = exp;
-- 
2.34.1

The Armv8.7 FEAT_AFP feature defines three new control bits in
the FPCR:
 * FPCR.AH: "alternate floating point mode"; this changes floating
   point behaviour in a variety of ways, including:
    - the sign of a default NaN is 1, not 0
    - if FPCR.FZ is also 1, denormals detected after rounding
      with an unbounded exponent has been applied are flushed to zero
    - FPCR.FZ does not cause denormalized inputs to be flushed to zero
    - miscellaneous other corner-case behaviour changes
 * FPCR.FIZ: flush denormalized numbers to zero on input for
   most instructions
 * FPCR.NEP: makes scalar SIMD operations merge the result with
   higher vector elements in one of the source registers, instead
   of zeroing the higher elements of the destination

This commit defines the new bits in the FPCR, and allows them to be
read or written when FEAT_AFP is implemented.  Actual behaviour
changes will be implemented in subsequent commits.

Note that these are the first FPCR bits which don't appear in the
AArch32 FPSCR view of the register, and which share bit positions
with FPSR bits.

Part of FEAT_AFP is the new control bit FPCR.FIZ.  This bit affects
flushing of single and double precision denormal inputs to zero for
AArch64 floating point instructions.  (For half-precision, the
existing FPCR.FZ16 control remains the only one.)

FPCR.FIZ differs from FPCR.FZ in that if we flush an input denormal
only because of FPCR.FIZ then we should *not* set the cumulative
exception bit FPSR.IDC.

FEAT_AFP also defines that in AArch64 the existing FPCR.FZ only
applies when FPCR.AH is 0.

We can implement this by setting the "flush inputs to zero" state
appropriately when FPCR is written, and by not reflecting the
float_flag_input_denormal status flag into FPSR reads when it is the
result only of FPSR.FIZ.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/vfp_helper.c | 60 ++++++++++++++++++++++++++++++++++-------
 1 file changed, 50 insertions(+), 10 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
 
 static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
 {
-    uint32_t i = 0;
+    uint32_t a32_flags = 0, a64_flags = 0;
 
-    i |= get_float_exception_flags(&env->vfp.fp_status_a32);
-    i |= get_float_exception_flags(&env->vfp.fp_status_a64);
-    i |= get_float_exception_flags(&env->vfp.standard_fp_status);
+    a32_flags |= get_float_exception_flags(&env->vfp.fp_status_a32);
+    a32_flags |= get_float_exception_flags(&env->vfp.standard_fp_status);
     /* FZ16 does not generate an input denormal exception.  */
-    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
+    a32_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
           & ~float_flag_input_denormal_flushed);
-    i |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
+    a32_flags |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
           & ~float_flag_input_denormal_flushed);
-    i |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
+
+    a64_flags |= get_float_exception_flags(&env->vfp.fp_status_a64);
+    a64_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
           & ~float_flag_input_denormal_flushed);
-    return vfp_exceptbits_from_host(i);
+    /*
+     * Flushing an input denormal *only* because FPCR.FIZ == 1 does
+     * not set FPSR.IDC; if FPCR.FZ is also set then this takes
+     * precedence and IDC is set (see the FPUnpackBase pseudocode).
+     * So squash it unless (FPCR.AH == 0 && FPCR.FZ == 1).
+     * We only do this for the a64 flags because FIZ has no effect
+     * on AArch32 even if it is set.
+     */
+    if ((env->vfp.fpcr & (FPCR_FZ | FPCR_AH)) != FPCR_FZ) {
+        a64_flags &= ~float_flag_input_denormal_flushed;
+    }
+    return vfp_exceptbits_from_host(a32_flags | a64_flags);
 }
 
 static void vfp_clear_float_status_exc_flags(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
 }
 
+static void vfp_sync_and_clear_float_status_exc_flags(CPUARMState *env)
+{
+    /*
+     * Synchronize any pending exception-flag information in the
+     * float_status values into env->vfp.fpsr, and then clear out
+     * the float_status data.
+     */
+    env->vfp.fpsr |= vfp_get_fpsr_from_host(env);
+    vfp_clear_float_status_exc_flags(env);
+}
+
 static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
 {
     uint64_t changed = env->vfp.fpcr;
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
     if (changed & FPCR_FZ) {
         bool ftz_enabled = val & FPCR_FZ;
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a64);
+        /* FIZ is A64 only so FZ always makes A32 code flush inputs to zero */
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+    }
+    if (changed & (FPCR_FZ | FPCR_AH | FPCR_FIZ)) {
+        /*
+         * A64: Flush denormalized inputs to zero if FPCR.FIZ = 1, or
+         * both FPCR.AH = 0 and FPCR.FZ = 1.
+         */
+        bool fitz_enabled = (val & FPCR_FIZ) ||
+            (val & (FPCR_FZ | FPCR_AH)) == FPCR_FZ;
+        set_flush_inputs_to_zero(fitz_enabled, &env->vfp.fp_status_a64);
     }
     if (changed & FPCR_DN) {
         bool dnan_enabled = val & FPCR_DN;
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
     }
+    /*
+     * If any bits changed that we look at in vfp_get_fpsr_from_host(),
+     * we must sync the float_status flags into vfp.fpsr now (under the
+     * old regime) before we update vfp.fpcr.
+     */
+    if (changed & (FPCR_FZ | FPCR_AH | FPCR_FIZ)) {
+        vfp_sync_and_clear_float_status_exc_flags(env);
+    }
 }
 
 #else
-- 
2.34.1

When FPCR.AH is set, various behaviours of AArch64 floating point
operations which are controlled by softfloat config settings change:
 * tininess and ftz detection before/after rounding
 * NaN propagation order
 * result of 0 * Inf + NaN
 * default NaN value

When the guest changes the value of the AH bit, switch these config
settings on the fp_status_a64 and fp_status_f16_a64 float_status
fields.

This requires us to make the arm_set_default_fp_behaviours() function
global, since we now need to call it from cpu.c and vfp_helper.c; we
move it to vfp_helper.c so it can be next to the new
arm_set_ah_fp_behaviours().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/internals.h  |  4 +++
 target/arm/cpu.c        | 23 ----------------
 target/arm/vfp_helper.c | 58 ++++++++++++++++++++++++++++++++++++++++-
 3 files changed, 61 insertions(+), 24 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ uint64_t gt_virt_cnt_offset(CPUARMState *env);
  * all EL1" scope; this covers stage 1 and stage 2.
  */
 int alle1_tlbmask(CPUARMState *env);
+
+/* Set the float_status behaviour to match the Arm defaults */
+void arm_set_default_fp_behaviours(float_status *s);
+
 #endif
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
     QLIST_INSERT_HEAD(&cpu->el_change_hooks, entry, node);
 }
 
-/*
- * Set the float_status behaviour to match the Arm defaults:
- *  * tininess-before-rounding
- *  * 2-input NaN propagation prefers SNaN over QNaN, and then
- *    operand A over operand B (see FPProcessNaNs() pseudocode)
- *  * 3-input NaN propagation prefers SNaN over QNaN, and then
- *    operand C over A over B (see FPProcessNaNs3() pseudocode,
- *    but note that for QEMU muladd is a * b + c, whereas for
- *    the pseudocode function the arguments are in the order c, a, b.
- *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
- *    and the input NaN if it is signalling
- *  * Default NaN has sign bit clear, msb frac bit set
- */
-static void arm_set_default_fp_behaviours(float_status *s)
-{
-    set_float_detect_tininess(float_tininess_before_rounding, s);
-    set_float_ftz_detection(float_ftz_before_rounding, s);
-    set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
-    set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
-    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
-    set_float_default_nan_pattern(0b01000000, s);
-}
-
 static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
 {
     /* Reset a single ARMCPRegInfo register */
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/helper-proto.h"
 #include "internals.h"
 #include "cpu-features.h"
+#include "fpu/softfloat.h"
 #ifdef CONFIG_TCG
 #include "qemu/log.h"
-#include "fpu/softfloat.h"
 #endif
 
 /* VFP support.  We follow the convention used for VFP instructions:
    Single precision routines have a "s" suffix, double precision a
    "d" suffix.  */
 
+/*
+ * Set the float_status behaviour to match the Arm defaults:
+ *  * tininess-before-rounding
+ *  * 2-input NaN propagation prefers SNaN over QNaN, and then
+ *    operand A over operand B (see FPProcessNaNs() pseudocode)
+ *  * 3-input NaN propagation prefers SNaN over QNaN, and then
+ *    operand C over A over B (see FPProcessNaNs3() pseudocode,
+ *    but note that for QEMU muladd is a * b + c, whereas for
+ *    the pseudocode function the arguments are in the order c, a, b.
+ *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
+ *    and the input NaN if it is signalling
+ *  * Default NaN has sign bit clear, msb frac bit set
+ */
+void arm_set_default_fp_behaviours(float_status *s)
+{
+    set_float_detect_tininess(float_tininess_before_rounding, s);
+    set_float_ftz_detection(float_ftz_before_rounding, s);
+    set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
+    set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
+    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
+    set_float_default_nan_pattern(0b01000000, s);
+}
+
+/*
+ * Set the float_status behaviour to match the FEAT_AFP
+ * FPCR.AH=1 requirements:
+ *  * tininess-after-rounding
+ *  * 2-input NaN propagation prefers the first NaN
+ *  * 3-input NaN propagation prefers a over b over c
+ *  * 0 * Inf + NaN always returns the input NaN and doesn't
+ *    set Invalid for a QNaN
+ *  * default NaN has sign bit set, msb frac bit set
+ */
+static void arm_set_ah_fp_behaviours(float_status *s)
+{
+    set_float_detect_tininess(float_tininess_after_rounding, s);
+    set_float_ftz_detection(float_ftz_after_rounding, s);
+    set_float_2nan_prop_rule(float_2nan_prop_ab, s);
+    set_float_3nan_prop_rule(float_3nan_prop_abc, s);
+    set_float_infzeronan_rule(float_infzeronan_dnan_never |
+                              float_infzeronan_suppress_invalid, s);
+    set_float_default_nan_pattern(0b11000000, s);
+}
+
 #ifdef CONFIG_TCG
 
 /* Convert host exception flags to vfp form.  */
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
     }
+    if (changed & FPCR_AH) {
+        bool ah_enabled = val & FPCR_AH;
+
+        if (ah_enabled) {
+            /* Change behaviours for A64 FP operations */
+            arm_set_ah_fp_behaviours(&env->vfp.fp_status_a64);
+            arm_set_ah_fp_behaviours(&env->vfp.fp_status_f16_a64);
+        } else {
+            arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
+            arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
+        }
+    }
     /*
      * If any bits changed that we look at in vfp_get_fpsr_from_host(),
      * we must sync the float_status flags into vfp.fpsr now (under the
-- 
2.34.1

When FPCR.AH = 1, some of the cumulative exception flags in the FPSR
behave slightly differently for A64 operations:
 * IDC is set when a denormal input is used without flushing
 * IXC (Inexact) is set when an output denormal is flushed to zero

Update vfp_get_fpsr_from_host() to do this.

Note that because half-precision operations never set IDC, we now
need to add float_flag_input_denormal_used to the set we mask out of
fp_status_f16_a64.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/vfp_helper.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static void arm_set_ah_fp_behaviours(float_status *s)
 #ifdef CONFIG_TCG
 
 /* Convert host exception flags to vfp form.  */
-static inline uint32_t vfp_exceptbits_from_host(int host_bits)
+static inline uint32_t vfp_exceptbits_from_host(int host_bits, bool ah)
 {
     uint32_t target_bits = 0;
 
@@ -XXX,XX +XXX,XX @@ static inline uint32_t vfp_exceptbits_from_host(int host_bits)
     if (host_bits & float_flag_input_denormal_flushed) {
         target_bits |= FPSR_IDC;
     }
+    /*
+     * With FPCR.AH, IDC is set when an input denormal is used,
+     * and flushing an output denormal to zero sets both IXC and UFC.
+     */
+    if (ah && (host_bits & float_flag_input_denormal_used)) {
+        target_bits |= FPSR_IDC;
+    }
+    if (ah && (host_bits & float_flag_output_denormal_flushed)) {
+        target_bits |= FPSR_IXC;
+    }
     return target_bits;
 }
 
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
 
     a64_flags |= get_float_exception_flags(&env->vfp.fp_status_a64);
     a64_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
-          & ~float_flag_input_denormal_flushed);
+          & ~(float_flag_input_denormal_flushed | float_flag_input_denormal_used));
     /*
      * Flushing an input denormal *only* because FPCR.FIZ == 1 does
      * not set FPSR.IDC; if FPCR.FZ is also set then this takes
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     if ((env->vfp.fpcr & (FPCR_FZ | FPCR_AH)) != FPCR_FZ) {
         a64_flags &= ~float_flag_input_denormal_flushed;
     }
-    return vfp_exceptbits_from_host(a32_flags | a64_flags);
+    return vfp_exceptbits_from_host(a64_flags, env->vfp.fpcr & FPCR_AH) |
+        vfp_exceptbits_from_host(a32_flags, false);
 }
 
 static void vfp_clear_float_status_exc_flags(CPUARMState *env)
-- 
2.34.1

We are going to need to generate different code in some cases when
FPCR.AH is 1.  For example:
 * Floating point neg and abs must not flip the sign bit of NaNs
 * some insns (FRECPE, FRECPS, FRECPX, FRSQRTE, FRSQRTS, and various
   BFCVT and BFM bfloat16 ops) need to use a different float_status
   to the usual one

Encode FPCR.AH into the A64 tbflags, so we can refer to it at
translate time.

Because we now have a bit in FPCR that affects codegen, we can't mark
the AArch64 FPCR register as being SUPPRESS_TB_END any more; writes
to it will now end the TB and trigger a regeneration of hflags.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h               | 1 +
 target/arm/tcg/translate.h     | 2 ++
 target/arm/helper.c            | 2 +-
 target/arm/tcg/hflags.c        | 4 ++++
 target/arm/tcg/translate-a64.c | 1 +
 5 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, NV2, 34, 1)
 FIELD(TBFLAG_A64, NV2_MEM_E20, 35, 1)
 /* Set if FEAT_NV2 RAM accesses are big-endian */
 FIELD(TBFLAG_A64, NV2_MEM_BE, 36, 1)
+FIELD(TBFLAG_A64, AH, 37, 1)   /* FPCR.AH */
 
 /*
  * Helpers for using the above. Note that only the A64 accessors use
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool nv2_mem_e20;
     /* True if NV2 enabled and NV2 RAM accesses are big-endian */
     bool nv2_mem_be;
+    /* True if FPCR.AH is 1 (alternate floating point handling) */
+    bool fpcr_ah;
     /*
      * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
      *  < 0, set by the current instruction.
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .writefn = aa64_daif_write, .resetfn = arm_cp_reset_ignore },
     { .name = "FPCR", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .opc2 = 0, .crn = 4, .crm = 4,
-      .access = PL0_RW, .type = ARM_CP_FPU | ARM_CP_SUPPRESS_TB_END,
+      .access = PL0_RW, .type = ARM_CP_FPU,
       .readfn = aa64_fpcr_read, .writefn = aa64_fpcr_write },
     { .name = "FPSR", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .opc2 = 1, .crn = 4, .crm = 4,
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
         DP_TBFLAG_A64(flags, TCMA, aa64_va_parameter_tcma(tcr, mmu_idx));
     }
 
+    if (env->vfp.fpcr & FPCR_AH) {
+        DP_TBFLAG_A64(flags, AH, 1);
+    }
+
     return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
 }
 
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->nv2 = EX_TBFLAG_A64(tb_flags, NV2);
     dc->nv2_mem_e20 = EX_TBFLAG_A64(tb_flags, NV2_MEM_E20);
     dc->nv2_mem_be = EX_TBFLAG_A64(tb_flags, NV2_MEM_BE);
+    dc->fpcr_ah = EX_TBFLAG_A64(tb_flags, AH);
     dc->vec_len = 0;
     dc->vec_stride = 0;
     dc->cp_regs = arm_cpu->cp_regs;
-- 
2.34.1

When FPCR.AH is 1, the behaviour of some instructions changes:
 * AdvSIMD BFCVT, BFCVTN, BFCVTN2, BFMLALB, BFMLALT
 * SVE BFCVT, BFCVTNT, BFMLALB, BFMLALT, BFMLSLB, BFMLSLT
 * SME BFCVT, BFCVTN, BFMLAL, BFMLSL (these are all in SME2 which
   QEMU does not yet implement)
 * FRECPE, FRECPS, FRECPX, FRSQRTE, FRSQRTS

The behaviour change is:
 * the instructions do not update the FPSR cumulative exception flags
 * trapped floating point exceptions are disabled (a no-op for QEMU,
   which doesn't implement FPCR.{IDE,IXE,UFE,OFE,DZE,IOE})
 * rounding is always round-to-nearest-even regardless of FPCR.RMode
 * denormalized inputs and outputs are always flushed to zero, as if
   FPCR.{FZ,FIZ} is {1,1}
 * FPCR.FZ16 is still honoured for half-precision inputs

(See the Arm ARM DDI0487L.a section A1.5.9.)

We can provide all these behaviours with another pair of float_status fields
which we use only for these insns, when FPCR.AH is 1. These float_status
fields will always have:
 * flush_to_zero and flush_inputs_to_zero set for the non-F16 field
 * rounding mode set to round-to-nearest-even
and so the only FPCR fields they need to honour are DN and FZ16.

In this commit we only define the new fp_status fields and give them
the required behaviour when FPSR is updated.  In subsequent commits
we will arrange to use this new fp_status field for the instructions
that should be affected by FPCR.AH in this way.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h           | 15 +++++++++++++++
 target/arm/internals.h     |  2 ++
 target/arm/tcg/translate.h | 14 ++++++++++++++
 target/arm/cpu.c           |  4 ++++
 target/arm/vfp_helper.c    | 13 ++++++++++++-
 5 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          *  standard_fp_status : the ARM "Standard FPSCR Value"
          *  standard_fp_status_fp16 : used for half-precision
          *       calculations with the ARM "Standard FPSCR Value"
+         *  ah_fp_status: used for the A64 insns which change behaviour
+         *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
+         *       and the reciprocal and square root estimate/step insns)
+         *  ah_fp_status_f16: used for the A64 insns which change behaviour
+         *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
+         *       and the reciprocal and square root estimate/step insns);
+         *       for half-precision
          *
          * Half-precision operations are governed by a separate
          * flush-to-zero control bit in FPSCR:FZ16. We pass a separate
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          * the "standard FPSCR" tracks the FPSCR.FZ16 bit rather than
          * using a fixed value for it.
          *
+         * The ah_fp_status is needed because some insns have different
+         * behaviour when FPCR.AH == 1: they don't update cumulative
+         * exception flags, they act like FPCR.{FZ,FIZ} = {1,1} and
+         * they ignore FPCR.RMode. But they don't ignore FPCR.FZ16,
+         * which means we need an ah_fp_status_f16 as well.
+         *
          * To avoid having to transfer exception bits around, we simply
          * say that the FPSCR cumulative exception flags are the logical
          * OR of the flags in the four fp statuses. This relies on the
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         float_status fp_status_f16_a64;
         float_status standard_fp_status;
         float_status standard_fp_status_f16;
+        float_status ah_fp_status;
+        float_status ah_fp_status_f16;
 
         uint64_t zcr_el[4];   /* ZCR_EL[1-3] */
         uint64_t smcr_el[4];  /* SMCR_EL[1-3] */
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int alle1_tlbmask(CPUARMState *env);
 
 /* Set the float_status behaviour to match the Arm defaults */
 void arm_set_default_fp_behaviours(float_status *s);
+/* Set the float_status behaviour to match Arm FPCR.AH=1 behaviour */
+void arm_set_ah_fp_behaviours(float_status *s);
 
 #endif
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
     FPST_A64,
     FPST_A32_F16,
     FPST_A64_F16,
+    FPST_AH,
+    FPST_AH_F16,
     FPST_STD,
     FPST_STD_F16,
 } ARMFPStatusFlavour;
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFPStatusFlavour {
  *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
  * FPST_A64_F16
  *   for AArch64 operations controlled by the FPCR where FPCR.FZ16 is to be used
+ * FPST_AH:
+ *   for AArch64 operations which change behaviour when AH=1 (specifically,
+ *   bfloat16 conversions and multiplies, and the reciprocal and square root
+ *   estimate/step insns)
+ * FPST_AH_F16:
+ *   ditto, but for half-precision operations
  * FPST_STD
  *   for A32/T32 Neon operations using the "standard FPSCR value"
  * FPST_STD_F16
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
     case FPST_A64_F16:
         offset = offsetof(CPUARMState, vfp.fp_status_f16_a64);
         break;
+    case FPST_AH:
+        offset = offsetof(CPUARMState, vfp.ah_fp_status);
+        break;
+    case FPST_AH_F16:
+        offset = offsetof(CPUARMState, vfp.ah_fp_status_f16);
+        break;
     case FPST_STD:
         offset = offsetof(CPUARMState, vfp.standard_fp_status);
         break;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
+    arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status);
+    set_flush_to_zero(1, &env->vfp.ah_fp_status);
+    set_flush_inputs_to_zero(1, &env->vfp.ah_fp_status);
+    arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status_f16);
 
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_set_default_fp_behaviours(float_status *s)
  *    set Invalid for a QNaN
  *  * default NaN has sign bit set, msb frac bit set
  */
-static void arm_set_ah_fp_behaviours(float_status *s)
+void arm_set_ah_fp_behaviours(float_status *s)
 {
     set_float_detect_tininess(float_tininess_after_rounding, s);
     set_float_ftz_detection(float_ftz_after_rounding, s);
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     a64_flags |= get_float_exception_flags(&env->vfp.fp_status_a64);
     a64_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
           & ~(float_flag_input_denormal_flushed | float_flag_input_denormal_used));
+    /*
+     * We do not merge in flags from ah_fp_status or ah_fp_status_f16, because
+     * they are used for insns that must not set the cumulative exception bits.
+     */
+
     /*
      * Flushing an input denormal *only* because FPCR.FIZ == 1 does
      * not set FPSR.IDC; if FPCR.FZ is also set then this takes
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
     set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
+    set_float_exception_flags(0, &env->vfp.ah_fp_status);
+    set_float_exception_flags(0, &env->vfp.ah_fp_status_f16);
 }
 
 static void vfp_sync_and_clear_float_status_exc_flags(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+        set_flush_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
     }
     if (changed & FPCR_FZ) {
         bool ftz_enabled = val & FPCR_FZ;
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
+        set_default_nan_mode(dnan_enabled, &env->vfp.ah_fp_status);
+        set_default_nan_mode(dnan_enabled, &env->vfp.ah_fp_status_f16);
     }
     if (changed & FPCR_AH) {
         bool ah_enabled = val & FPCR_AH;
-- 
2.34.1

For the instructions FRECPE, FRECPS, FRECPX, FRSQRTE, FRSQRTS, use
FPST_FPCR_AH or FPST_FPCR_AH_F16 when FPCR.AH is 1, so that they get
the required behaviour changes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.h |  13 ++++
 target/arm/tcg/translate-a64.c | 119 +++++++++++++++++++++++++--------
 target/arm/tcg/translate-sve.c |  30 ++++++---
 3 files changed, 127 insertions(+), 35 deletions(-)

diff --git a/target/arm/tcg/translate-a64.h b/target/arm/tcg/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.h
+++ b/target/arm/tcg/translate-a64.h
@@ -XXX,XX +XXX,XX @@ static inline TCGv_ptr pred_full_reg_ptr(DisasContext *s, int regno)
     return ret;
 }
 
+/*
+ * Return the ARMFPStatusFlavour to use based on element size and
+ * whether FPCR.AH is set.
+ */
+static inline ARMFPStatusFlavour select_ah_fpst(DisasContext *s, MemOp esz)
+{
+    if (s->fpcr_ah) {
+        return esz == MO_16 ? FPST_AH_F16 : FPST_AH;
+    } else {
+        return esz == MO_16 ? FPST_A64_F16 : FPST_A64;
+    }
+}
+
 bool disas_sve(DisasContext *, uint32_t);
 bool disas_sme(DisasContext *, uint32_t);
 
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op3_ool(DisasContext *s, bool is_q, int rd,
  * an out-of-line helper.
  */
 static void gen_gvec_op3_fpst(DisasContext *s, bool is_q, int rd, int rn,
-                              int rm, bool is_fp16, int data,
+                              int rm, ARMFPStatusFlavour fpsttype, int data,
                               gen_helper_gvec_3_ptr *fn)
 {
-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
+    TCGv_ptr fpst = fpstatus_ptr(fpsttype);
     tcg_gen_gvec_3_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn),
                        vec_full_reg_offset(s, rm), fpst,
@@ -XXX,XX +XXX,XX @@ typedef struct FPScalar {
     void (*gen_d)(TCGv_i64, TCGv_i64, TCGv_i64, TCGv_ptr);
 } FPScalar;
 
-static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
+                                        const FPScalar *f,
+                                        ARMFPStatusFlavour fpsttype)
 {
     switch (a->esz) {
     case MO_64:
         if (fp_access_check(s)) {
             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
             TCGv_i64 t1 = read_fp_dreg(s, a->rm);
-            f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
+            f->gen_d(t0, t0, t1, fpstatus_ptr(fpsttype));
             write_fp_dreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
         if (fp_access_check(s)) {
             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
             TCGv_i32 t1 = read_fp_sreg(s, a->rm);
-            f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
+            f->gen_s(t0, t0, t1, fpstatus_ptr(fpsttype));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
         if (fp_access_check(s)) {
             TCGv_i32 t0 = read_fp_hreg(s, a->rn);
             TCGv_i32 t1 = read_fp_hreg(s, a->rm);
-            f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
+            f->gen_h(t0, t0, t1, fpstatus_ptr(fpsttype));
             write_fp_sreg(s, a->rd, t0);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
     return true;
 }
 
+static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+{
+    return do_fp3_scalar_with_fpsttype(s, a, f,
+                                       a->esz == MO_16 ?
+                                       FPST_A64_F16 : FPST_A64);
+}
+
+static bool do_fp3_scalar_ah(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+{
+    return do_fp3_scalar_with_fpsttype(s, a, f, select_ah_fpst(s, a->esz));
+}
+
 static const FPScalar f_scalar_fadd = {
     gen_helper_vfp_addh,
     gen_helper_vfp_adds,
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_frecps = {
     gen_helper_recpsf_f32,
     gen_helper_recpsf_f64,
 };
-TRANS(FRECPS_s, do_fp3_scalar, a, &f_scalar_frecps)
+TRANS(FRECPS_s, do_fp3_scalar_ah, a, &f_scalar_frecps)
 
 static const FPScalar f_scalar_frsqrts = {
     gen_helper_rsqrtsf_f16,
     gen_helper_rsqrtsf_f32,
     gen_helper_rsqrtsf_f64,
 };
-TRANS(FRSQRTS_s, do_fp3_scalar, a, &f_scalar_frsqrts)
+TRANS(FRSQRTS_s, do_fp3_scalar_ah, a, &f_scalar_frsqrts)
 
 static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
                        const FPScalar *f, bool swap)
@@ -XXX,XX +XXX,XX @@ TRANS(CMHS_s, do_cmop_d, a, TCG_COND_GEU)
 TRANS(CMEQ_s, do_cmop_d, a, TCG_COND_EQ)
 TRANS(CMTST_s, do_cmop_d, a, TCG_COND_TSTNE)
 
-static bool do_fp3_vector(DisasContext *s, arg_qrrr_e *a, int data,
-                          gen_helper_gvec_3_ptr * const fns[3])
+static bool do_fp3_vector_with_fpsttype(DisasContext *s, arg_qrrr_e *a,
+                                        int data,
+                                        gen_helper_gvec_3_ptr * const fns[3],
+                                        ARMFPStatusFlavour fpsttype)
 {
     MemOp esz = a->esz;
     int check = fp_access_check_vector_hsd(s, a->q, esz);
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_vector(DisasContext *s, arg_qrrr_e *a, int data,
         return check == 0;
     }
 
-    gen_gvec_op3_fpst(s, a->q, a->rd, a->rn, a->rm,
-                      esz == MO_16, data, fns[esz - 1]);
+    gen_gvec_op3_fpst(s, a->q, a->rd, a->rn, a->rm, fpsttype,
+                      data, fns[esz - 1]);
     return true;
 }
 
+static bool do_fp3_vector(DisasContext *s, arg_qrrr_e *a, int data,
+                          gen_helper_gvec_3_ptr * const fns[3])
+{
+    return do_fp3_vector_with_fpsttype(s, a, data, fns,
+                                       a->esz == MO_16 ?
+                                       FPST_A64_F16 : FPST_A64);
+}
+
+static bool do_fp3_vector_ah(DisasContext *s, arg_qrrr_e *a, int data,
+                             gen_helper_gvec_3_ptr * const f[3])
+{
+    return do_fp3_vector_with_fpsttype(s, a, data, f,
+                                       select_ah_fpst(s, a->esz));
+}
+
 static gen_helper_gvec_3_ptr * const f_vector_fadd[3] = {
     gen_helper_gvec_fadd_h,
     gen_helper_gvec_fadd_s,
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const f_vector_frecps[3] = {
     gen_helper_gvec_recps_s,
     gen_helper_gvec_recps_d,
 };
-TRANS(FRECPS_v, do_fp3_vector, a, 0, f_vector_frecps)
+TRANS(FRECPS_v, do_fp3_vector_ah, a, 0, f_vector_frecps)
 
 static gen_helper_gvec_3_ptr * const f_vector_frsqrts[3] = {
     gen_helper_gvec_rsqrts_h,
     gen_helper_gvec_rsqrts_s,
     gen_helper_gvec_rsqrts_d,
 };
-TRANS(FRSQRTS_v, do_fp3_vector, a, 0, f_vector_frsqrts)
+TRANS(FRSQRTS_v, do_fp3_vector_ah, a, 0, f_vector_frsqrts)
 
 static gen_helper_gvec_3_ptr * const f_vector_faddp[3] = {
     gen_helper_gvec_faddp_h,
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_vector_idx(DisasContext *s, arg_qrrx_e *a,
     }
 
     gen_gvec_op3_fpst(s, a->q, a->rd, a->rn, a->rm,
-                      esz == MO_16, a->idx, fns[esz - 1]);
+                      esz == MO_16 ? FPST_A64_F16 : FPST_A64,
+                      a->idx, fns[esz - 1]);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ typedef struct FPScalar1 {
     void (*gen_d)(TCGv_i64, TCGv_i64, TCGv_ptr);
 } FPScalar1;
 
-static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
-                          const FPScalar1 *f, int rmode)
+static bool do_fp1_scalar_with_fpsttype(DisasContext *s, arg_rr_e *a,
+                                        const FPScalar1 *f, int rmode,
+                                        ARMFPStatusFlavour fpsttype)
 {
     TCGv_i32 tcg_rmode = NULL;
     TCGv_ptr fpst;
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
         return check == 0;
     }
 
-    fpst = fpstatus_ptr(a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+    fpst = fpstatus_ptr(fpsttype);
     if (rmode >= 0) {
         tcg_rmode = gen_set_rmode(rmode, fpst);
     }
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
     return true;
 }
 
+static bool do_fp1_scalar(DisasContext *s, arg_rr_e *a,
+                          const FPScalar1 *f, int rmode)
+{
+    return do_fp1_scalar_with_fpsttype(s, a, f, rmode,
+                                       a->esz == MO_16 ?
+                                       FPST_A64_F16 : FPST_A64);
+}
+
+static bool do_fp1_scalar_ah(DisasContext *s, arg_rr_e *a,
+                             const FPScalar1 *f, int rmode)
+{
+    return do_fp1_scalar_with_fpsttype(s, a, f, rmode, select_ah_fpst(s, a->esz));
+}
+
 static const FPScalar1 f_scalar_fsqrt = {
     gen_helper_vfp_sqrth,
     gen_helper_vfp_sqrts,
@@ -XXX,XX +XXX,XX @@ static const FPScalar1 f_scalar_frecpe = {
     gen_helper_recpe_f32,
     gen_helper_recpe_f64,
 };
-TRANS(FRECPE_s, do_fp1_scalar, a, &f_scalar_frecpe, -1)
+TRANS(FRECPE_s, do_fp1_scalar_ah, a, &f_scalar_frecpe, -1)
 
 static const FPScalar1 f_scalar_frecpx = {
     gen_helper_frecpx_f16,
     gen_helper_frecpx_f32,
     gen_helper_frecpx_f64,
 };
-TRANS(FRECPX_s, do_fp1_scalar, a, &f_scalar_frecpx, -1)
+TRANS(FRECPX_s, do_fp1_scalar_ah, a, &f_scalar_frecpx, -1)
 
 static const FPScalar1 f_scalar_frsqrte = {
     gen_helper_rsqrte_f16,
     gen_helper_rsqrte_f32,
     gen_helper_rsqrte_f64,
 };
-TRANS(FRSQRTE_s, do_fp1_scalar, a, &f_scalar_frsqrte, -1)
+TRANS(FRSQRTE_s, do_fp1_scalar_ah, a, &f_scalar_frsqrte, -1)
 
 static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
 {
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FRINT64Z_v, aa64_frint, do_fp1_vector, a,
            &f_scalar_frint64, FPROUNDING_ZERO)
 TRANS_FEAT(FRINT64X_v, aa64_frint, do_fp1_vector, a, &f_scalar_frint64, -1)
 
-static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
-                             int rd, int rn, int data,
-                             gen_helper_gvec_2_ptr * const fns[3])
+static bool do_gvec_op2_fpst_with_fpsttype(DisasContext *s, MemOp esz,
+                                           bool is_q, int rd, int rn, int data,
+                                           gen_helper_gvec_2_ptr * const fns[3],
+                                           ARMFPStatusFlavour fpsttype)
 {
     int check = fp_access_check_vector_hsd(s, is_q, esz);
     TCGv_ptr fpst;
@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
         return check == 0;
     }
 
-    fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+    fpst = fpstatus_ptr(fpsttype);
     tcg_gen_gvec_2_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn), fpst,
                        is_q ? 16 : 8, vec_full_reg_size(s),
@@ -XXX,XX +XXX,XX @@ static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
     return true;
 }
 
+static bool do_gvec_op2_fpst(DisasContext *s, MemOp esz, bool is_q,
+                             int rd, int rn, int data,
+                             gen_helper_gvec_2_ptr * const fns[3])
+{
+    return do_gvec_op2_fpst_with_fpsttype(s, esz, is_q, rd, rn, data, fns,
+                                          esz == MO_16 ? FPST_A64_F16 :
+                                          FPST_A64);
+}
+
+static bool do_gvec_op2_ah_fpst(DisasContext *s, MemOp esz, bool is_q,
+                                int rd, int rn, int data,
+                                gen_helper_gvec_2_ptr * const fns[3])
+{
+    return do_gvec_op2_fpst_with_fpsttype(s, esz, is_q, rd, rn, data,
+                                          fns, select_ah_fpst(s, esz));
+}
+
 static gen_helper_gvec_2_ptr * const f_scvtf_v[] = {
     gen_helper_gvec_vcvt_sh,
     gen_helper_gvec_vcvt_sf,
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_2_ptr * const f_frecpe[] = {
     gen_helper_gvec_frecpe_s,
     gen_helper_gvec_frecpe_d,
 };
-TRANS(FRECPE_v, do_gvec_op2_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frecpe)
+TRANS(FRECPE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frecpe)
 
 static gen_helper_gvec_2_ptr * const f_frsqrte[] = {
     gen_helper_gvec_frsqrte_h,
     gen_helper_gvec_frsqrte_s,
     gen_helper_gvec_frsqrte_d,
 };
-TRANS(FRSQRTE_v, do_gvec_op2_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frsqrte)
+TRANS(FRSQRTE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frsqrte)
 
 static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
 {
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
     return true;
 }
 
-static bool gen_gvec_fpst_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
-                                 arg_rr_esz *a, int data)
+static bool gen_gvec_fpst_ah_arg_zz(DisasContext *s, gen_helper_gvec_2_ptr *fn,
+                                    arg_rr_esz *a, int data)
 {
     return gen_gvec_fpst_zz(s, fn, a->rd, a->rn, data,
-                            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
+                            select_ah_fpst(s, a->esz));
 }
 
 /* Invoke an out-of-line helper on 3 Zregs. */
@@ -XXX,XX +XXX,XX @@ static bool gen_gvec_fpst_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
 }
 
+static bool gen_gvec_fpst_ah_arg_zzz(DisasContext *s, gen_helper_gvec_3_ptr *fn,
+                                     arg_rrr_esz *a, int data)
+{
+    return gen_gvec_fpst_zzz(s, fn, a->rd, a->rn, a->rm, data,
+                             select_ah_fpst(s, a->esz));
+}
+
 /* Invoke an out-of-line helper on 4 Zregs. */
 static bool gen_gvec_ool_zzzz(DisasContext *s, gen_helper_gvec_4 *fn,
                               int rd, int rn, int rm, int ra, int data)
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_2_ptr * const frecpe_fns[] = {
     NULL,                     gen_helper_gvec_frecpe_h,
     gen_helper_gvec_frecpe_s, gen_helper_gvec_frecpe_d,
 };
-TRANS_FEAT(FRECPE, aa64_sve, gen_gvec_fpst_arg_zz, frecpe_fns[a->esz], a, 0)
+TRANS_FEAT(FRECPE, aa64_sve, gen_gvec_fpst_ah_arg_zz, frecpe_fns[a->esz], a, 0)
 
 static gen_helper_gvec_2_ptr * const frsqrte_fns[] = {
     NULL,                      gen_helper_gvec_frsqrte_h,
     gen_helper_gvec_frsqrte_s, gen_helper_gvec_frsqrte_d,
 };
-TRANS_FEAT(FRSQRTE, aa64_sve, gen_gvec_fpst_arg_zz, frsqrte_fns[a->esz], a, 0)
+TRANS_FEAT(FRSQRTE, aa64_sve, gen_gvec_fpst_ah_arg_zz, frsqrte_fns[a->esz], a, 0)
 
 /*
  *** SVE Floating Point Compare with Zero Group
@@ -XXX,XX +XXX,XX @@ static bool trans_FADDA(DisasContext *s, arg_rprr_esz *a)
     };                                                              \
     TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_arg_zzz, name##_fns[a->esz], a, 0)
 
+#define DO_FP3_AH(NAME, name) \
+    static gen_helper_gvec_3_ptr * const name##_fns[4] = {          \
+        NULL, gen_helper_gvec_##name##_h,                           \
+        gen_helper_gvec_##name##_s, gen_helper_gvec_##name##_d      \
+    };                                                              \
+    TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_ah_arg_zzz, name##_fns[a->esz], a, 0)
+
 DO_FP3(FADD_zzz, fadd)
 DO_FP3(FSUB_zzz, fsub)
 DO_FP3(FMUL_zzz, fmul)
-DO_FP3(FRECPS, recps)
-DO_FP3(FRSQRTS, rsqrts)
+DO_FP3_AH(FRECPS, recps)
+DO_FP3_AH(FRSQRTS, rsqrts)
 
 #undef DO_FP3
 
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const frecpx_fns[] = {
     gen_helper_sve_frecpx_s, gen_helper_sve_frecpx_d,
 };
 TRANS_FEAT(FRECPX, aa64_sve, gen_gvec_fpst_arg_zpz, frecpx_fns[a->esz],
-           a, 0, a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
+           a, 0, select_ah_fpst(s, a->esz))
 
 static gen_helper_gvec_3_ptr * const fsqrt_fns[] = {
     NULL,                   gen_helper_sve_fsqrt_h,
-- 
2.34.1

When FPCR.AH is 1, use FPST_FPCR_AH for:
 * AdvSIMD BFCVT, BFCVTN, BFCVTN2
 * SVE BFCVT, BFCVTNT

so that they get the required behaviour changes.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 27 +++++++++++++++++++++------
 target/arm/tcg/translate-sve.c |  6 ++++--
 2 files changed, 25 insertions(+), 8 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ TRANS(FRINTX_s, do_fp1_scalar, a, &f_scalar_frintx, -1)
 static const FPScalar1 f_scalar_bfcvt = {
     .gen_s = gen_helper_bfcvt,
 };
-TRANS_FEAT(BFCVT_s, aa64_bf16, do_fp1_scalar, a, &f_scalar_bfcvt, -1)
+TRANS_FEAT(BFCVT_s, aa64_bf16, do_fp1_scalar_ah, a, &f_scalar_bfcvt, -1)
 
 static const FPScalar1 f_scalar_frint32 = {
     NULL,
@@ -XXX,XX +XXX,XX @@ static void gen_bfcvtn_hs(TCGv_i64 d, TCGv_i64 n)
     tcg_gen_extu_i32_i64(d, tmp);
 }
 
-static ArithOneOp * const f_vector_bfcvtn[] = {
-    NULL,
-    gen_bfcvtn_hs,
-    NULL,
+static void gen_bfcvtn_ah_hs(TCGv_i64 d, TCGv_i64 n)
+{
+    TCGv_ptr fpst = fpstatus_ptr(FPST_AH);
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    gen_helper_bfcvt_pair(tmp, n, fpst);
+    tcg_gen_extu_i32_i64(d, tmp);
+}
+
+static ArithOneOp * const f_vector_bfcvtn[2][3] = {
+    {
+        NULL,
+        gen_bfcvtn_hs,
+        NULL,
+    }, {
+        NULL,
+        gen_bfcvtn_ah_hs,
+        NULL,
+    }
 };
-TRANS_FEAT(BFCVTN_v, aa64_bf16, do_2misc_narrow_vector, a, f_vector_bfcvtn)
+TRANS_FEAT(BFCVTN_v, aa64_bf16, do_2misc_narrow_vector, a,
+           f_vector_bfcvtn[s->fpcr_ah])
 
 static bool trans_SHLL_v(DisasContext *s, arg_qrr_e *a)
 {
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVT_hs, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvt_hs, a, 0, FPST_A64_F16)
 
 TRANS_FEAT(BFCVT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_bfcvt, a, 0, FPST_A64)
+           gen_helper_sve_bfcvt, a, 0,
+           s->fpcr_ah ? FPST_AH : FPST_A64)
 
 TRANS_FEAT(FCVT_dh, aa64_sve, gen_gvec_fpst_arg_zpz,
            gen_helper_sve_fcvt_dh, a, 0, FPST_A64)
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCVTNT_ds, aa64_sve2, gen_gvec_fpst_arg_zpz,
            gen_helper_sve2_fcvtnt_ds, a, 0, FPST_A64)
 
 TRANS_FEAT(BFCVTNT, aa64_sve_bf16, gen_gvec_fpst_arg_zpz,
-           gen_helper_sve_bfcvtnt, a, 0, FPST_A64)
+           gen_helper_sve_bfcvtnt, a, 0,
+           s->fpcr_ah ? FPST_AH : FPST_A64)
 
 TRANS_FEAT(FCVTLT_hs, aa64_sve2, gen_gvec_fpst_arg_zpz,
            gen_helper_sve2_fcvtlt_hs, a, 0, FPST_A64)
-- 
2.34.1

When FPCR.AH is 1, use FPST_FPCR_AH for:
 * AdvSIMD BFMLALB, BFMLALT
 * SVE BFMLALB, BFMLALT, BFMLSLB, BFMLSLT

so that they get the required behaviour changes.

We do this by making gen_gvec_op4_fpst() take an ARMFPStatusFlavour
rather than a bool is_fp16; existing callsites now select
FPST_FPCR_F16_A64 vs FPST_FPCR_A64 themselves rather than passing in
the boolean.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 20 +++++++++++++-------
 target/arm/tcg/translate-sve.c |  6 ++++--
 2 files changed, 17 insertions(+), 9 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_env(DisasContext *s, bool is_q, int rd, int rn,
  * an out-of-line helper.
  */
 static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
-                              int rm, int ra, bool is_fp16, int data,
+                              int rm, int ra, ARMFPStatusFlavour fpsttype,
+                              int data,
                               gen_helper_gvec_4_ptr *fn)
 {
-    TCGv_ptr fpst = fpstatus_ptr(is_fp16 ? FPST_A64_F16 : FPST_A64);
+    TCGv_ptr fpst = fpstatus_ptr(fpsttype);
     tcg_gen_gvec_4_ptr(vec_full_reg_offset(s, rd),
                        vec_full_reg_offset(s, rn),
                        vec_full_reg_offset(s, rm),
@@ -XXX,XX +XXX,XX @@ static bool trans_BFMLAL_v(DisasContext *s, arg_qrrr_e *a)
     }
     if (fp_access_check(s)) {
         /* Q bit selects BFMLALB vs BFMLALT. */
-        gen_gvec_op4_fpst(s, true, a->rd, a->rn, a->rm, a->rd, false, a->q,
+        gen_gvec_op4_fpst(s, true, a->rd, a->rn, a->rm, a->rd,
+                          s->fpcr_ah ? FPST_AH : FPST_A64, a->q,
                           gen_helper_gvec_bfmlal);
     }
     return true;
@@ -XXX,XX +XXX,XX @@ static bool trans_FCMLA_v(DisasContext *s, arg_FCMLA_v *a)
     }
 
     gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
-                      a->esz == MO_16, a->rot, fn[a->esz]);
+                      a->esz == MO_16 ? FPST_A64_F16 : FPST_A64,
+                      a->rot, fn[a->esz]);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_vector_idx(DisasContext *s, arg_qrrx_e *a, bool neg)
     }
 
     gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
-                      esz == MO_16, (a->idx << 1) | neg,
+                      esz == MO_16 ? FPST_A64_F16 : FPST_A64,
+                      (a->idx << 1) | neg,
                       fns[esz - 1]);
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_BFMLAL_vi(DisasContext *s, arg_qrrx_e *a)
     }
     if (fp_access_check(s)) {
         /* Q bit selects BFMLALB vs BFMLALT. */
-        gen_gvec_op4_fpst(s, true, a->rd, a->rn, a->rm, a->rd, 0,
+        gen_gvec_op4_fpst(s, true, a->rd, a->rn, a->rm, a->rd,
+                          s->fpcr_ah ? FPST_AH : FPST_A64,
                           (a->idx << 1) | a->q,
                           gen_helper_gvec_bfmlal_idx);
     }
@@ -XXX,XX +XXX,XX @@ static bool trans_FCMLA_vi(DisasContext *s, arg_FCMLA_vi *a)
     }
     if (fp_access_check(s)) {
         gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
-                          a->esz == MO_16, (a->idx << 2) | a->rot, fn);
+                          a->esz == MO_16 ? FPST_A64_F16 : FPST_A64,
+                          (a->idx << 2) | a->rot, fn);
     }
     return true;
 }
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT_NONSTREAMING(BFMMLA, aa64_sve_bf16, gen_gvec_env_arg_zzzz,
 static bool do_BFMLAL_zzzw(DisasContext *s, arg_rrrr_esz *a, bool sel)
 {
     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal,
-                              a->rd, a->rn, a->rm, a->ra, sel, FPST_A64);
+                              a->rd, a->rn, a->rm, a->ra, sel,
+                              s->fpcr_ah ? FPST_AH : FPST_A64);
 }
 
 TRANS_FEAT(BFMLALB_zzzw, aa64_sve_bf16, do_BFMLAL_zzzw, a, false)
@@ -XXX,XX +XXX,XX @@ static bool do_BFMLAL_zzxw(DisasContext *s, arg_rrxr_esz *a, bool sel)
 {
     return gen_gvec_fpst_zzzz(s, gen_helper_gvec_bfmlal_idx,
                               a->rd, a->rn, a->rm, a->ra,
-                              (a->index << 1) | sel, FPST_A64);
+                              (a->index << 1) | sel,
+                              s->fpcr_ah ? FPST_AH : FPST_A64);
 }
 
 TRANS_FEAT(BFMLALB_zzxw, aa64_sve_bf16, do_BFMLAL_zzxw, a, false)
-- 
2.34.1

For FEAT_AFP, we want to emit different code when FPCR.NEP is set, so
that instead of zeroing the high elements of a vector register when
we write the output of a scalar operation to it, we instead merge in
those elements from one of the source registers.  Since this affects
the generated code, we need to put FPCR.NEP into the TBFLAGS.

FPCR.NEP is treated as 0 when in streaming SVE mode and FEAT_SME_FA64
is not implemented or not enabled; we can implement this logic in
rebuild_hflags_a64().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h               | 1 +
 target/arm/tcg/translate.h     | 2 ++
 target/arm/tcg/hflags.c        | 9 +++++++++
 target/arm/tcg/translate-a64.c | 1 +
 4 files changed, 13 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, NV2_MEM_E20, 35, 1)
 /* Set if FEAT_NV2 RAM accesses are big-endian */
 FIELD(TBFLAG_A64, NV2_MEM_BE, 36, 1)
 FIELD(TBFLAG_A64, AH, 37, 1)   /* FPCR.AH */
+FIELD(TBFLAG_A64, NEP, 38, 1)   /* FPCR.NEP */
 
 /*
  * Helpers for using the above. Note that only the A64 accessors use
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool nv2_mem_be;
     /* True if FPCR.AH is 1 (alternate floating point handling) */
     bool fpcr_ah;
+    /* True if FPCR.NEP is 1 (FEAT_AFP scalar upper-element result handling) */
+    bool fpcr_nep;
     /*
      * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
      *  < 0, set by the current instruction.
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
     if (env->vfp.fpcr & FPCR_AH) {
         DP_TBFLAG_A64(flags, AH, 1);
     }
+    if (env->vfp.fpcr & FPCR_NEP) {
+        /*
+         * In streaming-SVE without FA64, NEP behaves as if zero;
+         * compare pseudocode IsMerging()
+         */
+        if (!(EX_TBFLAG_A64(flags, PSTATE_SM) && !sme_fa64(env, el))) {
+            DP_TBFLAG_A64(flags, NEP, 1);
+        }
+    }
 
     return rebuild_hflags_common(env, fp_el, mmu_idx, flags);
 }
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->nv2_mem_e20 = EX_TBFLAG_A64(tb_flags, NV2_MEM_E20);
     dc->nv2_mem_be = EX_TBFLAG_A64(tb_flags, NV2_MEM_BE);
     dc->fpcr_ah = EX_TBFLAG_A64(tb_flags, AH);
+    dc->fpcr_nep = EX_TBFLAG_A64(tb_flags, NEP);
     dc->vec_len = 0;
     dc->vec_stride = 0;
     dc->cp_regs = arm_cpu->cp_regs;
-- 
2.34.1

For FEAT_AFP's FPCR.NEP bit, we need to programmatically change the
behaviour of the writeback of the result for most SIMD scalar
operations, so that instead of zeroing the upper part of the result
register it merges the upper elements from one of the input
registers.

Provide new functions write_fp_*reg_merging() which can be used
instead of the existing write_fp_*reg() functions when we want this
"merge the result with one of the input registers if FPCR.NEP is
enabled" handling, and use them in do_fp3_scalar_with_fpsttype().

Note that (as documented in the description of the FPCR.NEP bit)
which input register to use as the merge source varies by
instruction: for these 2-input scalar operations, the comparison
instructions take from Rm, not Rn.

We'll extend this to also provide the merging behaviour for
the remaining scalar insns in subsequent commits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 117 +++++++++++++++++++++++++--------
 1 file changed, 91 insertions(+), 26 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void write_fp_sreg(DisasContext *s, int reg, TCGv_i32 v)
     write_fp_dreg(s, reg, tmp);
 }
 
+/*
+ * Write a double result to 128 bit vector register reg, honouring FPCR.NEP:
+ * - if FPCR.NEP == 0, clear the high elements of reg
+ * - if FPCR.NEP == 1, set the high elements of reg from mergereg
+ *   (i.e. merge the result with those high elements)
+ * In either case, SVE register bits above 128 are zeroed (per R_WKYLB).
+ */
+static void write_fp_dreg_merging(DisasContext *s, int reg, int mergereg,
+                                  TCGv_i64 v)
+{
+    if (!s->fpcr_nep) {
+        write_fp_dreg(s, reg, v);
+        return;
+    }
+
+    /*
+     * Move from mergereg to reg; this sets the high elements and
+     * clears the bits above 128 as a side effect.
+     */
+    tcg_gen_gvec_mov(MO_64, vec_full_reg_offset(s, reg),
+                     vec_full_reg_offset(s, mergereg),
+                     16, vec_full_reg_size(s));
+    tcg_gen_st_i64(v, tcg_env, vec_full_reg_offset(s, reg));
+}
+
+/*
+ * Write a single-prec result, but only clear the higher elements
+ * of the destination register if FPCR.NEP is 0; otherwise preserve them.
+ */
+static void write_fp_sreg_merging(DisasContext *s, int reg, int mergereg,
+                                  TCGv_i32 v)
+{
+    if (!s->fpcr_nep) {
+        write_fp_sreg(s, reg, v);
+        return;
+    }
+
+    tcg_gen_gvec_mov(MO_64, vec_full_reg_offset(s, reg),
+                     vec_full_reg_offset(s, mergereg),
+                     16, vec_full_reg_size(s));
+    tcg_gen_st_i32(v, tcg_env, fp_reg_offset(s, reg, MO_32));
+}
+
+/*
+ * Write a half-prec result, but only clear the higher elements
+ * of the destination register if FPCR.NEP is 0; otherwise preserve them.
+ * The caller must ensure that the top 16 bits of v are zero.
+ */
+static void write_fp_hreg_merging(DisasContext *s, int reg, int mergereg,
+                                  TCGv_i32 v)
+{
+    if (!s->fpcr_nep) {
+        write_fp_sreg(s, reg, v);
+        return;
+    }
+
+    tcg_gen_gvec_mov(MO_64, vec_full_reg_offset(s, reg),
+                     vec_full_reg_offset(s, mergereg),
+                     16, vec_full_reg_size(s));
+    tcg_gen_st16_i32(v, tcg_env, fp_reg_offset(s, reg, MO_16));
+}
+
 /* Expand a 2-operand AdvSIMD vector operation using an expander function.  */
 static void gen_gvec_fn2(DisasContext *s, bool is_q, int rd, int rn,
                          GVecGen2Fn *gvec_fn, int vece)
@@ -XXX,XX +XXX,XX @@ typedef struct FPScalar {
 } FPScalar;
 
 static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
-                                        const FPScalar *f,
+                                        const FPScalar *f, int mergereg,
                                         ARMFPStatusFlavour fpsttype)
 {
     switch (a->esz) {
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
             TCGv_i64 t0 = read_fp_dreg(s, a->rn);
             TCGv_i64 t1 = read_fp_dreg(s, a->rm);
             f->gen_d(t0, t0, t1, fpstatus_ptr(fpsttype));
-            write_fp_dreg(s, a->rd, t0);
+            write_fp_dreg_merging(s, a->rd, mergereg, t0);
         }
         break;
     case MO_32:
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
             TCGv_i32 t0 = read_fp_sreg(s, a->rn);
             TCGv_i32 t1 = read_fp_sreg(s, a->rm);
             f->gen_s(t0, t0, t1, fpstatus_ptr(fpsttype));
-            write_fp_sreg(s, a->rd, t0);
+            write_fp_sreg_merging(s, a->rd, mergereg, t0);
         }
         break;
     case MO_16:
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
             TCGv_i32 t0 = read_fp_hreg(s, a->rn);
             TCGv_i32 t1 = read_fp_hreg(s, a->rm);
             f->gen_h(t0, t0, t1, fpstatus_ptr(fpsttype));
-            write_fp_sreg(s, a->rd, t0);
+            write_fp_hreg_merging(s, a->rd, mergereg, t0);
         }
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_with_fpsttype(DisasContext *s, arg_rrr_e *a,
     return true;
 }
 
-static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f,
+                          int mergereg)
 {
-    return do_fp3_scalar_with_fpsttype(s, a, f,
+    return do_fp3_scalar_with_fpsttype(s, a, f, mergereg,
                                        a->esz == MO_16 ?
                                        FPST_A64_F16 : FPST_A64);
 }
 
-static bool do_fp3_scalar_ah(DisasContext *s, arg_rrr_e *a, const FPScalar *f)
+static bool do_fp3_scalar_ah(DisasContext *s, arg_rrr_e *a, const FPScalar *f,
+                             int mergereg)
 {
-    return do_fp3_scalar_with_fpsttype(s, a, f, select_ah_fpst(s, a->esz));
+    return do_fp3_scalar_with_fpsttype(s, a, f, mergereg,
+                                       select_ah_fpst(s, a->esz));
 }
 
 static const FPScalar f_scalar_fadd = {
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fadd = {
     gen_helper_vfp_adds,
     gen_helper_vfp_addd,
 };
-TRANS(FADD_s, do_fp3_scalar, a, &f_scalar_fadd)
+TRANS(FADD_s, do_fp3_scalar, a, &f_scalar_fadd, a->rn)
 
 static const FPScalar f_scalar_fsub = {
     gen_helper_vfp_subh,
     gen_helper_vfp_subs,
     gen_helper_vfp_subd,
 };
-TRANS(FSUB_s, do_fp3_scalar, a, &f_scalar_fsub)
+TRANS(FSUB_s, do_fp3_scalar, a, &f_scalar_fsub, a->rn)
 
 static const FPScalar f_scalar_fdiv = {
     gen_helper_vfp_divh,
     gen_helper_vfp_divs,
     gen_helper_vfp_divd,
 };
-TRANS(FDIV_s, do_fp3_scalar, a, &f_scalar_fdiv)
+TRANS(FDIV_s, do_fp3_scalar, a, &f_scalar_fdiv, a->rn)
 
 static const FPScalar f_scalar_fmul = {
     gen_helper_vfp_mulh,
     gen_helper_vfp_muls,
     gen_helper_vfp_muld,
 };
-TRANS(FMUL_s, do_fp3_scalar, a, &f_scalar_fmul)
+TRANS(FMUL_s, do_fp3_scalar, a, &f_scalar_fmul, a->rn)
 
 static const FPScalar f_scalar_fmax = {
     gen_helper_vfp_maxh,
     gen_helper_vfp_maxs,
     gen_helper_vfp_maxd,
 };
-TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax)
+TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax, a->rn)
 
 static const FPScalar f_scalar_fmin = {
     gen_helper_vfp_minh,
     gen_helper_vfp_mins,
     gen_helper_vfp_mind,
 };
-TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin)
+TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin, a->rn)
 
 static const FPScalar f_scalar_fmaxnm = {
     gen_helper_vfp_maxnumh,
     gen_helper_vfp_maxnums,
     gen_helper_vfp_maxnumd,
 };
-TRANS(FMAXNM_s, do_fp3_scalar, a, &f_scalar_fmaxnm)
+TRANS(FMAXNM_s, do_fp3_scalar, a, &f_scalar_fmaxnm, a->rn)
 
 static const FPScalar f_scalar_fminnm = {
     gen_helper_vfp_minnumh,
     gen_helper_vfp_minnums,
     gen_helper_vfp_minnumd,
 };
-TRANS(FMINNM_s, do_fp3_scalar, a, &f_scalar_fminnm)
+TRANS(FMINNM_s, do_fp3_scalar, a, &f_scalar_fminnm, a->rn)
 
 static const FPScalar f_scalar_fmulx = {
     gen_helper_advsimd_mulxh,
     gen_helper_vfp_mulxs,
     gen_helper_vfp_mulxd,
 };
-TRANS(FMULX_s, do_fp3_scalar, a, &f_scalar_fmulx)
+TRANS(FMULX_s, do_fp3_scalar, a, &f_scalar_fmulx, a->rn)
 
 static void gen_fnmul_h(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
 {
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fnmul = {
     gen_fnmul_s,
     gen_fnmul_d,
 };
-TRANS(FNMUL_s, do_fp3_scalar, a, &f_scalar_fnmul)
+TRANS(FNMUL_s, do_fp3_scalar, a, &f_scalar_fnmul, a->rn)
 
 static const FPScalar f_scalar_fcmeq = {
     gen_helper_advsimd_ceq_f16,
     gen_helper_neon_ceq_f32,
     gen_helper_neon_ceq_f64,
 };
-TRANS(FCMEQ_s, do_fp3_scalar, a, &f_scalar_fcmeq)
+TRANS(FCMEQ_s, do_fp3_scalar, a, &f_scalar_fcmeq, a->rm)
 
 static const FPScalar f_scalar_fcmge = {
     gen_helper_advsimd_cge_f16,
     gen_helper_neon_cge_f32,
     gen_helper_neon_cge_f64,
 };
-TRANS(FCMGE_s, do_fp3_scalar, a, &f_scalar_fcmge)
+TRANS(FCMGE_s, do_fp3_scalar, a, &f_scalar_fcmge, a->rm)
 
 static const FPScalar f_scalar_fcmgt = {
     gen_helper_advsimd_cgt_f16,
     gen_helper_neon_cgt_f32,
     gen_helper_neon_cgt_f64,
 };
-TRANS(FCMGT_s, do_fp3_scalar, a, &f_scalar_fcmgt)
+TRANS(FCMGT_s, do_fp3_scalar, a, &f_scalar_fcmgt, a->rm)
 
 static const FPScalar f_scalar_facge = {
     gen_helper_advsimd_acge_f16,
     gen_helper_neon_acge_f32,
     gen_helper_neon_acge_f64,
 };
-TRANS(FACGE_s, do_fp3_scalar, a, &f_scalar_facge)
+TRANS(FACGE_s, do_fp3_scalar, a, &f_scalar_facge, a->rm)
 
 static const FPScalar f_scalar_facgt = {
     gen_helper_advsimd_acgt_f16,
     gen_helper_neon_acgt_f32,
     gen_helper_neon_acgt_f64,
 };
-TRANS(FACGT_s, do_fp3_scalar, a, &f_scalar_facgt)
+TRANS(FACGT_s, do_fp3_scalar, a, &f_scalar_facgt, a->rm)
 
 static void gen_fabd_h(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
 {
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fabd = {
     gen_fabd_s,
     gen_fabd_d,
 };
-TRANS(FABD_s, do_fp3_scalar, a, &f_scalar_fabd)
+TRANS(FABD_s, do_fp3_scalar, a, &f_scalar_fabd, a->rn)
 
 static const FPScalar f_scalar_frecps = {
     gen_helper_recpsf_f16,
     gen_helper_recpsf_f32,
     gen_helper_recpsf_f64,
 };
-TRANS(FRECPS_s, do_fp3_scalar_ah, a, &f_scalar_frecps)
+TRANS(FRECPS_s, do_fp3_scalar_ah, a, &f_scalar_frecps, a->rn)
 
 static const FPScalar f_scalar_frsqrts = {
     gen_helper_rsqrtsf_f16,
     gen_helper_rsqrtsf_f32,
     gen_helper_rsqrtsf_f64,
 };
-TRANS(FRSQRTS_s, do_fp3_scalar_ah, a, &f_scalar_frsqrts)
+TRANS(FRSQRTS_s, do_fp3_scalar_ah, a, &f_scalar_frsqrts, a->rn)
 
 static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
                        const FPScalar *f, bool swap)
-- 
2.34.1

Handle FPCR.NEP for the 3-input scalar operations which use
do_fmla_scalar_idx() and do_fmadd(), by making them call the
appropriate write_fp_*reg_merging() functions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
                 gen_vfp_negd(t1, t1);
             }
             gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
-            write_fp_dreg(s, a->rd, t0);
+            write_fp_dreg_merging(s, a->rd, a->rd, t0);
         }
         break;
     case MO_32:
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
                 gen_vfp_negs(t1, t1);
             }
             gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
-            write_fp_sreg(s, a->rd, t0);
+            write_fp_sreg_merging(s, a->rd, a->rd, t0);
         }
         break;
     case MO_16:
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
             }
             gen_helper_advsimd_muladdh(t0, t1, t2, t0,
                                        fpstatus_ptr(FPST_A64_F16));
-            write_fp_sreg(s, a->rd, t0);
+            write_fp_hreg_merging(s, a->rd, a->rd, t0);
         }
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             }
             fpst = fpstatus_ptr(FPST_A64);
             gen_helper_vfp_muladdd(ta, tn, tm, ta, fpst);
-            write_fp_dreg(s, a->rd, ta);
+            write_fp_dreg_merging(s, a->rd, a->ra, ta);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             }
             fpst = fpstatus_ptr(FPST_A64);
             gen_helper_vfp_muladds(ta, tn, tm, ta, fpst);
-            write_fp_sreg(s, a->rd, ta);
+            write_fp_sreg_merging(s, a->rd, a->ra, ta);
         }
         break;
 
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             }
             fpst = fpstatus_ptr(FPST_A64_F16);
             gen_helper_advsimd_muladdh(ta, tn, tm, ta, fpst);
-            write_fp_sreg(s, a->rd, ta);
+            write_fp_hreg_merging(s, a->rd, a->ra, ta);
         }
         break;
 
-- 
2.34.1

Currently we implement BFCVT scalar via do_fp1_scalar().  This works
even though BFCVT is a narrowing operation from 32 to 16 bits,
because we can use write_fp_sreg() for float16. However, FPCR.NEP
support requires that we use write_fp_hreg_merging() for float16
outputs, so we can't continue to borrow the non-narrowing
do_fp1_scalar() function for this. Split out trans_BFCVT_s()
into its own implementation that honours FPCR.NEP.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 25 +++++++++++++++++++++----
 1 file changed, 21 insertions(+), 4 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static const FPScalar1 f_scalar_frintx = {
 };
 TRANS(FRINTX_s, do_fp1_scalar, a, &f_scalar_frintx, -1)
 
-static const FPScalar1 f_scalar_bfcvt = {
-    .gen_s = gen_helper_bfcvt,
-};
-TRANS_FEAT(BFCVT_s, aa64_bf16, do_fp1_scalar_ah, a, &f_scalar_bfcvt, -1)
+static bool trans_BFCVT_s(DisasContext *s, arg_rr_e *a)
+{
+    ARMFPStatusFlavour fpsttype = s->fpcr_ah ? FPST_AH : FPST_A64;
+    TCGv_i32 t32;
+    int check;
+
+    if (!dc_isar_feature(aa64_bf16, s)) {
+        return false;
+    }
+
+    check = fp_access_check_scalar_hsd(s, a->esz);
+
+    if (check <= 0) {
+        return check == 0;
+    }
+
+    t32 = read_fp_sreg(s, a->rn);
+    gen_helper_bfcvt(t32, t32, fpstatus_ptr(fpsttype));
+    write_fp_hreg_merging(s, a->rd, a->rd, t32);
+    return true;
+}
 
 static const FPScalar1 f_scalar_frint32 = {
     NULL,
-- 
2.34.1

Handle FPCR.NEP for the 1-input scalar operations.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 26 ++++++++++++++------------
 1 file changed, 14 insertions(+), 12 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar_with_fpsttype(DisasContext *s, arg_rr_e *a,
     case MO_64:
         t64 = read_fp_dreg(s, a->rn);
         f->gen_d(t64, t64, fpst);
-        write_fp_dreg(s, a->rd, t64);
+        write_fp_dreg_merging(s, a->rd, a->rd, t64);
         break;
     case MO_32:
         t32 = read_fp_sreg(s, a->rn);
         f->gen_s(t32, t32, fpst);
-        write_fp_sreg(s, a->rd, t32);
+        write_fp_sreg_merging(s, a->rd, a->rd, t32);
         break;
     case MO_16:
         t32 = read_fp_hreg(s, a->rn);
         f->gen_h(t32, t32, fpst);
-        write_fp_sreg(s, a->rd, t32);
+        write_fp_hreg_merging(s, a->rd, a->rd, t32);
         break;
     default:
         g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
         TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvtds(tcg_rd, tcg_rn, fpst);
-        write_fp_dreg(s, a->rd, tcg_rd);
+        write_fp_dreg_merging(s, a->rd, a->rd, tcg_rd);
     }
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hs(DisasContext *s, arg_rr *a)
         TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvt_f32_to_f16(tmp, tmp, fpst, ahp);
-        /* write_fp_sreg is OK here because top half of result is zero */
-        write_fp_sreg(s, a->rd, tmp);
+        /* write_fp_hreg_merging is OK here because top half of result is zero */
+        write_fp_hreg_merging(s, a->rd, a->rd, tmp);
     }
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sd(DisasContext *s, arg_rr *a)
         TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvtsd(tcg_rd, tcg_rn, fpst);
-        write_fp_sreg(s, a->rd, tcg_rd);
+        write_fp_sreg_merging(s, a->rd, a->rd, tcg_rd);
     }
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_hd(DisasContext *s, arg_rr *a)
         TCGv_ptr fpst = fpstatus_ptr(FPST_A64);
 
         gen_helper_vfp_fcvt_f64_to_f16(tcg_rd, tcg_rn, fpst, ahp);
-        /* write_fp_sreg is OK here because top half of tcg_rd is zero */
-        write_fp_sreg(s, a->rd, tcg_rd);
+        /* write_fp_hreg_merging is OK here because top half of tcg_rd is zero */
+        write_fp_hreg_merging(s, a->rd, a->rd, tcg_rd);
     }
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_sh(DisasContext *s, arg_rr *a)
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f32(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
-        write_fp_sreg(s, a->rd, tcg_rd);
+        write_fp_sreg_merging(s, a->rd, a->rd, tcg_rd);
     }
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool trans_FCVT_s_dh(DisasContext *s, arg_rr *a)
         TCGv_i32 tcg_ahp = get_ahp_flag();
 
         gen_helper_vfp_fcvt_f16_to_f64(tcg_rd, tcg_rn, tcg_fpst, tcg_ahp);
-        write_fp_dreg(s, a->rd, tcg_rd);
+        write_fp_dreg_merging(s, a->rd, a->rd, tcg_rd);
     }
     return true;
 }
@@ -XXX,XX +XXX,XX @@ static bool do_fcvt_f(DisasContext *s, arg_fcvt *a,
     do_fcvt_scalar(s, a->esz | (is_signed ? MO_SIGN : 0),
                    a->esz, tcg_int, a->shift, a->rn, rmode);
 
-    clear_vec(s, a->rd);
+    if (!s->fpcr_nep) {
+        clear_vec(s, a->rd);
+    }
     write_vec_element(s, tcg_int, a->rd, 0, a->esz);
     return true;
 }
-- 
2.34.1

Handle FPCR.NEP in the operations handled by do_cvtf_scalar().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
         } else {
             gen_helper_vfp_uqtod(tcg_double, tcg_int, tcg_shift, tcg_fpstatus);
         }
-        write_fp_dreg(s, rd, tcg_double);
+        write_fp_dreg_merging(s, rd, rd, tcg_double);
         break;
 
     case MO_32:
@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
         } else {
             gen_helper_vfp_uqtos(tcg_single, tcg_int, tcg_shift, tcg_fpstatus);
         }
-        write_fp_sreg(s, rd, tcg_single);
+        write_fp_sreg_merging(s, rd, rd, tcg_single);
         break;
 
     case MO_16:
@@ -XXX,XX +XXX,XX @@ static bool do_cvtf_scalar(DisasContext *s, MemOp esz, int rd, int shift,
         } else {
             gen_helper_vfp_uqtoh(tcg_single, tcg_int, tcg_shift, tcg_fpstatus);
         }
-        write_fp_sreg(s, rd, tcg_single);
+        write_fp_hreg_merging(s, rd, rd, tcg_single);
         break;
 
     default:
-- 
2.34.1

Handle FPCR.NEP merging for scalar FABS and FNEG; this requires
an extra parameter to do_fp1_scalar_int(), since FMOV scalar
does not have the merging behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 27 ++++++++++++++++++++-------
 1 file changed, 20 insertions(+), 7 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ typedef struct FPScalar1Int {
 } FPScalar1Int;
 
 static bool do_fp1_scalar_int(DisasContext *s, arg_rr_e *a,
-                              const FPScalar1Int *f)
+                              const FPScalar1Int *f,
+                              bool merging)
 {
     switch (a->esz) {
     case MO_64:
         if (fp_access_check(s)) {
             TCGv_i64 t = read_fp_dreg(s, a->rn);
             f->gen_d(t, t);
-            write_fp_dreg(s, a->rd, t);
+            if (merging) {
+                write_fp_dreg_merging(s, a->rd, a->rd, t);
+            } else {
+                write_fp_dreg(s, a->rd, t);
+            }
         }
         break;
     case MO_32:
         if (fp_access_check(s)) {
             TCGv_i32 t = read_fp_sreg(s, a->rn);
             f->gen_s(t, t);
-            write_fp_sreg(s, a->rd, t);
+            if (merging) {
+                write_fp_sreg_merging(s, a->rd, a->rd, t);
+            } else {
+                write_fp_sreg(s, a->rd, t);
+            }
         }
         break;
     case MO_16:
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar_int(DisasContext *s, arg_rr_e *a,
         if (fp_access_check(s)) {
             TCGv_i32 t = read_fp_hreg(s, a->rn);
             f->gen_h(t, t);
-            write_fp_sreg(s, a->rd, t);
+            if (merging) {
+                write_fp_hreg_merging(s, a->rd, a->rd, t);
+            } else {
+                write_fp_sreg(s, a->rd, t);
+            }
         }
         break;
     default:
@@ -XXX,XX +XXX,XX @@ static const FPScalar1Int f_scalar_fmov = {
     tcg_gen_mov_i32,
     tcg_gen_mov_i64,
 };
-TRANS(FMOV_s, do_fp1_scalar_int, a, &f_scalar_fmov)
+TRANS(FMOV_s, do_fp1_scalar_int, a, &f_scalar_fmov, false)
 
 static const FPScalar1Int f_scalar_fabs = {
     gen_vfp_absh,
     gen_vfp_abss,
     gen_vfp_absd,
 };
-TRANS(FABS_s, do_fp1_scalar_int, a, &f_scalar_fabs)
+TRANS(FABS_s, do_fp1_scalar_int, a, &f_scalar_fabs, true)
 
 static const FPScalar1Int f_scalar_fneg = {
     gen_vfp_negh,
     gen_vfp_negs,
     gen_vfp_negd,
 };
-TRANS(FNEG_s, do_fp1_scalar_int, a, &f_scalar_fneg)
+TRANS(FNEG_s, do_fp1_scalar_int, a, &f_scalar_fneg, true)
 
 typedef struct FPScalar1 {
     void (*gen_h)(TCGv_i32, TCGv_i32, TCGv_ptr);
-- 
2.34.1

Unlike the other users of do_2misc_narrow_scalar(), FCVTXN (scalar)
is always double-to-single and must honour FPCR.NEP.  Implement this
directly in a trans function rather than using
do_2misc_narrow_scalar().

We still need gen_fcvtxn_sd() and the f_scalar_fcvtxn[] array for
the FCVTXN (vector) insn, so we move those down in the file to
where they are used.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 43 ++++++++++++++++++++++------------
 1 file changed, 28 insertions(+), 15 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static ArithOneOp * const f_scalar_uqxtn[] = {
 };
 TRANS(UQXTN_s, do_2misc_narrow_scalar, a, f_scalar_uqxtn)
 
-static void gen_fcvtxn_sd(TCGv_i64 d, TCGv_i64 n)
+static bool trans_FCVTXN_s(DisasContext *s, arg_rr_e *a)
 {
-    /*
-     * 64 bit to 32 bit float conversion
-     * with von Neumann rounding (round to odd)
-     */
-    TCGv_i32 tmp = tcg_temp_new_i32();
-    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_A64));
-    tcg_gen_extu_i32_i64(d, tmp);
+    if (fp_access_check(s)) {
+        /*
+         * 64 bit to 32 bit float conversion
+         * with von Neumann rounding (round to odd)
+         */
+        TCGv_i64 src = read_fp_dreg(s, a->rn);
+        TCGv_i32 dst = tcg_temp_new_i32();
+        gen_helper_fcvtx_f64_to_f32(dst, src, fpstatus_ptr(FPST_A64));
+        write_fp_sreg_merging(s, a->rd, a->rd, dst);
+    }
+    return true;
 }
 
-static ArithOneOp * const f_scalar_fcvtxn[] = {
-    NULL,
-    NULL,
-    gen_fcvtxn_sd,
-};
-TRANS(FCVTXN_s, do_2misc_narrow_scalar, a, f_scalar_fcvtxn)
-
 #undef WRAP_ENV
 
 static bool do_gvec_fn2(DisasContext *s, arg_qrr_e *a, GVecGen2Fn *fn)
@@ -XXX,XX +XXX,XX @@ static void gen_fcvtn_sd(TCGv_i64 d, TCGv_i64 n)
     tcg_gen_extu_i32_i64(d, tmp);
 }
 
+static void gen_fcvtxn_sd(TCGv_i64 d, TCGv_i64 n)
+{
+    /*
+     * 64 bit to 32 bit float conversion
+     * with von Neumann rounding (round to odd)
+     */
+    TCGv_i32 tmp = tcg_temp_new_i32();
+    gen_helper_fcvtx_f64_to_f32(tmp, n, fpstatus_ptr(FPST_A64));
+    tcg_gen_extu_i32_i64(d, tmp);
+}
+
 static ArithOneOp * const f_vector_fcvtn[] = {
     NULL,
     gen_fcvtn_hs,
     gen_fcvtn_sd,
 };
+static ArithOneOp * const f_scalar_fcvtxn[] = {
+    NULL,
+    NULL,
+    gen_fcvtxn_sd,
+};
 TRANS(FCVTN_v, do_2misc_narrow_vector, a, f_vector_fcvtn)
 TRANS(FCVTXN_v, do_2misc_narrow_vector, a, f_scalar_fcvtxn)
 
-- 
2.34.1

do_fp3_scalar_idx() is used only for the FMUL and FMULX scalar by
element instructions; these both need to merge the result with the Rn
register when FPCR.NEP is set.

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
 
             read_vec_element(s, t1, a->rm, a->idx, MO_64);
             f->gen_d(t0, t0, t1, fpstatus_ptr(FPST_A64));
-            write_fp_dreg(s, a->rd, t0);
+            write_fp_dreg_merging(s, a->rd, a->rn, t0);
         }
         break;
     case MO_32:
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
 
             read_vec_element_i32(s, t1, a->rm, a->idx, MO_32);
             f->gen_s(t0, t0, t1, fpstatus_ptr(FPST_A64));
-            write_fp_sreg(s, a->rd, t0);
+            write_fp_sreg_merging(s, a->rd, a->rn, t0);
         }
         break;
     case MO_16:
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_idx(DisasContext *s, arg_rrx_e *a, const FPScalar *f)
 
             read_vec_element_i32(s, t1, a->rm, a->idx, MO_16);
             f->gen_h(t0, t0, t1, fpstatus_ptr(FPST_A64_F16));
-            write_fp_sreg(s, a->rd, t0);
+            write_fp_hreg_merging(s, a->rd, a->rn, t0);
         }
         break;
     default:
-- 
2.34.1

When FPCR.AH == 1, floating point FMIN and FMAX have some odd special
cases:

* comparing two zeroes (even of different sign) or comparing a NaN
   with anything always returns the second argument (possibly
   squashed to zero)
 * denormal outputs are not squashed to zero regardless of FZ or FZ16

Implement these semantics in new helper functions and select them at
translate time if FPCR.AH is 1 for the scalar FMAX and FMIN insns.
(We will convert the other FMAX and FMIN insns in subsequent
commits.)

Note that FMINNM and FMAXNM are not affected.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-a64.h    |  7 +++++++
 target/arm/tcg/helper-a64.c    | 36 ++++++++++++++++++++++++++++++++++
 target/arm/tcg/translate-a64.c | 23 ++++++++++++++++++++--
 3 files changed, 64 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.h
+++ b/target/arm/tcg/helper-a64.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(advsimd_muladd2h, i32, i32, i32, i32, fpst)
 DEF_HELPER_2(advsimd_rinth_exact, f16, f16, fpst)
 DEF_HELPER_2(advsimd_rinth, f16, f16, fpst)
 
+DEF_HELPER_3(vfp_ah_minh, f16, f16, f16, fpst)
+DEF_HELPER_3(vfp_ah_mins, f32, f32, f32, fpst)
+DEF_HELPER_3(vfp_ah_mind, f64, f64, f64, fpst)
+DEF_HELPER_3(vfp_ah_maxh, f16, f16, f16, fpst)
+DEF_HELPER_3(vfp_ah_maxs, f32, f32, f32, fpst)
+DEF_HELPER_3(vfp_ah_maxd, f64, f64, f64, fpst)
+
 DEF_HELPER_2(exception_return, void, env, i64)
 DEF_HELPER_FLAGS_2(dc_zva, TCG_CALL_NO_WG, void, env, i64)
 
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ float32 HELPER(fcvtx_f64_to_f32)(float64 a, float_status *fpst)
     return r;
 }
 
+/*
+ * AH=1 min/max have some odd special cases:
+ * comparing two zeroes (regardless of sign), (NaN, anything),
+ * or (anything, NaN) should return the second argument (possibly
+ * squashed to zero).
+ * Also, denormal outputs are not squashed to zero regardless of FZ or FZ16.
+ */
+#define AH_MINMAX_HELPER(NAME, CTYPE, FLOATTYPE, MINMAX)                \
+    CTYPE HELPER(NAME)(CTYPE a, CTYPE b, float_status *fpst)            \
+    {                                                                   \
+        bool save;                                                      \
+        CTYPE r;                                                        \
+        a = FLOATTYPE ## _squash_input_denormal(a, fpst);               \
+        b = FLOATTYPE ## _squash_input_denormal(b, fpst);               \
+        if (FLOATTYPE ## _is_zero(a) && FLOATTYPE ## _is_zero(b)) {     \
+            return b;                                                   \
+        }                                                               \
+        if (FLOATTYPE ## _is_any_nan(a) ||                              \
+            FLOATTYPE ## _is_any_nan(b)) {                              \
+            float_raise(float_flag_invalid, fpst);                      \
+            return b;                                                   \
+        }                                                               \
+        save = get_flush_to_zero(fpst);                                 \
+        set_flush_to_zero(false, fpst);                                 \
+        r = FLOATTYPE ## _ ## MINMAX(a, b, fpst);                       \
+        set_flush_to_zero(save, fpst);                                  \
+        return r;                                                       \
+    }
+
+AH_MINMAX_HELPER(vfp_ah_minh, dh_ctype_f16, float16, min)
+AH_MINMAX_HELPER(vfp_ah_mins, float32, float32, min)
+AH_MINMAX_HELPER(vfp_ah_mind, float64, float64, min)
+AH_MINMAX_HELPER(vfp_ah_maxh, dh_ctype_f16, float16, max)
+AH_MINMAX_HELPER(vfp_ah_maxs, float32, float32, max)
+AH_MINMAX_HELPER(vfp_ah_maxd, float64, float64, max)
+
 /* 64-bit versions of the CRC helpers. Note that although the operation
  * (and the prototypes of crc32c() and crc32() mean that only the bottom
  * 32 bits of the accumulator and result are used, we pass and return
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar_ah(DisasContext *s, arg_rrr_e *a, const FPScalar *f,
                                        select_ah_fpst(s, a->esz));
 }
 
+/* Some insns need to call different helpers when FPCR.AH == 1 */
+static bool do_fp3_scalar_2fn(DisasContext *s, arg_rrr_e *a,
+                              const FPScalar *fnormal,
+                              const FPScalar *fah,
+                              int mergereg)
+{
+    return do_fp3_scalar(s, a, s->fpcr_ah ? fah : fnormal, mergereg);
+}
+
 static const FPScalar f_scalar_fadd = {
     gen_helper_vfp_addh,
     gen_helper_vfp_adds,
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_fmax = {
     gen_helper_vfp_maxs,
     gen_helper_vfp_maxd,
 };
-TRANS(FMAX_s, do_fp3_scalar, a, &f_scalar_fmax, a->rn)
+static const FPScalar f_scalar_fmax_ah = {
+    gen_helper_vfp_ah_maxh,
+    gen_helper_vfp_ah_maxs,
+    gen_helper_vfp_ah_maxd,
+};
+TRANS(FMAX_s, do_fp3_scalar_2fn, a, &f_scalar_fmax, &f_scalar_fmax_ah, a->rn)
 
 static const FPScalar f_scalar_fmin = {
     gen_helper_vfp_minh,
     gen_helper_vfp_mins,
     gen_helper_vfp_mind,
 };
-TRANS(FMIN_s, do_fp3_scalar, a, &f_scalar_fmin, a->rn)
+static const FPScalar f_scalar_fmin_ah = {
+    gen_helper_vfp_ah_minh,
+    gen_helper_vfp_ah_mins,
+    gen_helper_vfp_ah_mind,
+};
+TRANS(FMIN_s, do_fp3_scalar_2fn, a, &f_scalar_fmin, &f_scalar_fmin_ah, a->rn)
 
 static const FPScalar f_scalar_fmaxnm = {
     gen_helper_vfp_maxnumh,
-- 
2.34.1

Implement the FPCR.AH == 1 semantics for vector FMIN/FMAX, by
creating new _ah_ versions of the gvec helpers which invoke the
scalar fmin_ah and fmax_ah helpers on each element.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 14 ++++++++++++++
 target/arm/tcg/translate-a64.c | 21 +++++++++++++++++++--
 target/arm/tcg/vec_helper.c    |  8 ++++++++
 3 files changed, 41 insertions(+), 2 deletions(-)

Implement the FPCR.AH semantics for FMAXV and FMINV.  These are the
"recursively reduce all lanes of a vector to a scalar result" insns;
we just need to use the _ah_ helper for the reduction step when
FPCR.AH == 1.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static TCGv_i32 do_reduction_op(DisasContext *s, int rn, MemOp esz,
 }
 
 static bool do_fp_reduction(DisasContext *s, arg_qrr_e *a,
-                              NeonGenTwoSingleOpFn *fn)
+                            NeonGenTwoSingleOpFn *fnormal,
+                            NeonGenTwoSingleOpFn *fah)
 {
     if (fp_access_check(s)) {
         MemOp esz = a->esz;
         int elts = (a->q ? 16 : 8) >> esz;
         TCGv_ptr fpst = fpstatus_ptr(esz == MO_16 ? FPST_A64_F16 : FPST_A64);
-        TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst, fn);
+        TCGv_i32 res = do_reduction_op(s, a->rn, esz, 0, elts, fpst,
+                                       s->fpcr_ah ? fah : fnormal);
         write_fp_sreg(s, a->rd, res);
     }
     return true;
 }
 
-TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxnumh)
-TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minnumh)
-TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_maxh)
-TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a, gen_helper_vfp_minh)
+TRANS_FEAT(FMAXNMV_h, aa64_fp16, do_fp_reduction, a,
+           gen_helper_vfp_maxnumh, gen_helper_vfp_maxnumh)
+TRANS_FEAT(FMINNMV_h, aa64_fp16, do_fp_reduction, a,
+           gen_helper_vfp_minnumh, gen_helper_vfp_minnumh)
+TRANS_FEAT(FMAXV_h, aa64_fp16, do_fp_reduction, a,
+           gen_helper_vfp_maxh, gen_helper_vfp_ah_maxh)
+TRANS_FEAT(FMINV_h, aa64_fp16, do_fp_reduction, a,
+           gen_helper_vfp_minh, gen_helper_vfp_ah_minh)
 
-TRANS(FMAXNMV_s, do_fp_reduction, a, gen_helper_vfp_maxnums)
-TRANS(FMINNMV_s, do_fp_reduction, a, gen_helper_vfp_minnums)
-TRANS(FMAXV_s, do_fp_reduction, a, gen_helper_vfp_maxs)
-TRANS(FMINV_s, do_fp_reduction, a, gen_helper_vfp_mins)
+TRANS(FMAXNMV_s, do_fp_reduction, a,
+      gen_helper_vfp_maxnums, gen_helper_vfp_maxnums)
+TRANS(FMINNMV_s, do_fp_reduction, a,
+      gen_helper_vfp_minnums, gen_helper_vfp_minnums)
+TRANS(FMAXV_s, do_fp_reduction, a, gen_helper_vfp_maxs, gen_helper_vfp_ah_maxs)
+TRANS(FMINV_s, do_fp_reduction, a, gen_helper_vfp_mins, gen_helper_vfp_ah_mins)
 
 /*
  * Floating-point Immediate
-- 
2.34.1

Implement the FPCR.AH semantics for the pairwise floating
point minimum/maximum insns FMINP and FMAXP.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 14 ++++++++++++++
 target/arm/tcg/translate-a64.c | 25 +++++++++++++++++++++----
 target/arm/tcg/vec_helper.c    | 10 ++++++++++
 3 files changed, 45 insertions(+), 4 deletions(-)

Implement the FPCR.AH semantics for the SVE FMAXV and FMINV
vector-reduction-to-scalar max/min operations.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 14 +++++++++++
 target/arm/tcg/sve_helper.c    | 43 +++++++++++++++++++++-------------
 target/arm/tcg/translate-sve.c | 16 +++++++++++--
 3 files changed, 55 insertions(+), 18 deletions(-)

Implement the FPCR.AH semantics for the SVE FMAX and FMIN operations
that take an immediate as the second operand.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 14 ++++++++++++++
 target/arm/tcg/sve_helper.c    |  8 ++++++++
 target/arm/tcg/translate-sve.c | 25 +++++++++++++++++++++++--
 3 files changed, 45 insertions(+), 2 deletions(-)

Implement the FPCR.AH semantics for the SVE FMAX and FMIN
operations that take two vector operands.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 14 ++++++++++++++
 target/arm/tcg/sve_helper.c    |  8 ++++++++
 target/arm/tcg/translate-sve.c | 17 +++++++++++++++--
 3 files changed, 37 insertions(+), 2 deletions(-)

FPCR.AH == 1 mandates that negation of a NaN value should not flip
its sign bit.  This means we can no longer use gen_vfp_neg*()
everywhere but must instead generate slightly more complex code when
FPCR.AH is set.

Make this change for the scalar FNEG and for those places in
translate-a64.c which were previously directly calling
gen_vfp_neg*().

This change in semantics also affects any other instruction whose
pseudocode calls FPNeg(); in following commits we extend this
change to the other affected instructions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 125 ++++++++++++++++++++++++++++++---
 1 file changed, 114 insertions(+), 11 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_gvec_op4_fpst(DisasContext *s, bool is_q, int rd, int rn,
                        is_q ? 16 : 8, vec_full_reg_size(s), data, fn);
 }
 
+/*
+ * When FPCR.AH == 1, NEG and ABS do not flip the sign bit of a NaN.
+ * These functions implement
+ *   d = floatN_is_any_nan(s) ? s : floatN_chs(s)
+ * which for float32 is
+ *   d = (s & ~(1 << 31)) > 0x7f800000UL) ? s : (s ^ (1 << 31))
+ * and similarly for the other float sizes.
+ */
+static void gen_vfp_ah_negh(TCGv_i32 d, TCGv_i32 s)
+{
+    TCGv_i32 abs_s = tcg_temp_new_i32(), chs_s = tcg_temp_new_i32();
+
+    gen_vfp_negh(chs_s, s);
+    gen_vfp_absh(abs_s, s);
+    tcg_gen_movcond_i32(TCG_COND_GTU, d,
+                        abs_s, tcg_constant_i32(0x7c00),
+                        s, chs_s);
+}
+
+static void gen_vfp_ah_negs(TCGv_i32 d, TCGv_i32 s)
+{
+    TCGv_i32 abs_s = tcg_temp_new_i32(), chs_s = tcg_temp_new_i32();
+
+    gen_vfp_negs(chs_s, s);
+    gen_vfp_abss(abs_s, s);
+    tcg_gen_movcond_i32(TCG_COND_GTU, d,
+                        abs_s, tcg_constant_i32(0x7f800000UL),
+                        s, chs_s);
+}
+
+static void gen_vfp_ah_negd(TCGv_i64 d, TCGv_i64 s)
+{
+    TCGv_i64 abs_s = tcg_temp_new_i64(), chs_s = tcg_temp_new_i64();
+
+    gen_vfp_negd(chs_s, s);
+    gen_vfp_absd(abs_s, s);
+    tcg_gen_movcond_i64(TCG_COND_GTU, d,
+                        abs_s, tcg_constant_i64(0x7ff0000000000000ULL),
+                        s, chs_s);
+}
+
+static void gen_vfp_maybe_ah_negh(DisasContext *dc, TCGv_i32 d, TCGv_i32 s)
+{
+    if (dc->fpcr_ah) {
+        gen_vfp_ah_negh(d, s);
+    } else {
+        gen_vfp_negh(d, s);
+    }
+}
+
+static void gen_vfp_maybe_ah_negs(DisasContext *dc, TCGv_i32 d, TCGv_i32 s)
+{
+    if (dc->fpcr_ah) {
+        gen_vfp_ah_negs(d, s);
+    } else {
+        gen_vfp_negs(d, s);
+    }
+}
+
+static void gen_vfp_maybe_ah_negd(DisasContext *dc, TCGv_i64 d, TCGv_i64 s)
+{
+    if (dc->fpcr_ah) {
+        gen_vfp_ah_negd(d, s);
+    } else {
+        gen_vfp_negd(d, s);
+    }
+}
+
 /* Set ZF and NF based on a 64 bit result. This is alas fiddlier
  * than the 32 bit equivalent.
  */
@@ -XXX,XX +XXX,XX @@ static void gen_fnmul_d(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m, TCGv_ptr s)
     gen_vfp_negd(d, d);
 }
 
+static void gen_fnmul_ah_h(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
+{
+    gen_helper_vfp_mulh(d, n, m, s);
+    gen_vfp_ah_negh(d, d);
+}
+
+static void gen_fnmul_ah_s(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
+{
+    gen_helper_vfp_muls(d, n, m, s);
+    gen_vfp_ah_negs(d, d);
+}
+
+static void gen_fnmul_ah_d(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m, TCGv_ptr s)
+{
+    gen_helper_vfp_muld(d, n, m, s);
+    gen_vfp_ah_negd(d, d);
+}
+
 static const FPScalar f_scalar_fnmul = {
     gen_fnmul_h,
     gen_fnmul_s,
     gen_fnmul_d,
 };
-TRANS(FNMUL_s, do_fp3_scalar, a, &f_scalar_fnmul, a->rn)
+static const FPScalar f_scalar_ah_fnmul = {
+    gen_fnmul_ah_h,
+    gen_fnmul_ah_s,
+    gen_fnmul_ah_d,
+};
+TRANS(FNMUL_s, do_fp3_scalar_2fn, a, &f_scalar_fnmul, &f_scalar_ah_fnmul, a->rn)
 
 static const FPScalar f_scalar_fcmeq = {
     gen_helper_advsimd_ceq_f16,
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
 
             read_vec_element(s, t2, a->rm, a->idx, MO_64);
             if (neg) {
-                gen_vfp_negd(t1, t1);
+                gen_vfp_maybe_ah_negd(s, t1, t1);
             }
             gen_helper_vfp_muladdd(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
             write_fp_dreg_merging(s, a->rd, a->rd, t0);
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
 
             read_vec_element_i32(s, t2, a->rm, a->idx, MO_32);
             if (neg) {
-                gen_vfp_negs(t1, t1);
+                gen_vfp_maybe_ah_negs(s, t1, t1);
             }
             gen_helper_vfp_muladds(t0, t1, t2, t0, fpstatus_ptr(FPST_A64));
             write_fp_sreg_merging(s, a->rd, a->rd, t0);
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_scalar_idx(DisasContext *s, arg_rrx_e *a, bool neg)
 
             read_vec_element_i32(s, t2, a->rm, a->idx, MO_16);
             if (neg) {
-                gen_vfp_negh(t1, t1);
+                gen_vfp_maybe_ah_negh(s, t1, t1);
             }
             gen_helper_advsimd_muladdh(t0, t1, t2, t0,
                                        fpstatus_ptr(FPST_A64_F16));
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             TCGv_i64 ta = read_fp_dreg(s, a->ra);
 
             if (neg_a) {
-                gen_vfp_negd(ta, ta);
+                gen_vfp_maybe_ah_negd(s, ta, ta);
             }
             if (neg_n) {
-                gen_vfp_negd(tn, tn);
+                gen_vfp_maybe_ah_negd(s, tn, tn);
             }
             fpst = fpstatus_ptr(FPST_A64);
             gen_helper_vfp_muladdd(ta, tn, tm, ta, fpst);
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             TCGv_i32 ta = read_fp_sreg(s, a->ra);
 
             if (neg_a) {
-                gen_vfp_negs(ta, ta);
+                gen_vfp_maybe_ah_negs(s, ta, ta);
             }
             if (neg_n) {
-                gen_vfp_negs(tn, tn);
+                gen_vfp_maybe_ah_negs(s, tn, tn);
             }
             fpst = fpstatus_ptr(FPST_A64);
             gen_helper_vfp_muladds(ta, tn, tm, ta, fpst);
@@ -XXX,XX +XXX,XX @@ static bool do_fmadd(DisasContext *s, arg_rrrr_e *a, bool neg_a, bool neg_n)
             TCGv_i32 ta = read_fp_hreg(s, a->ra);
 
             if (neg_a) {
-                gen_vfp_negh(ta, ta);
+                gen_vfp_maybe_ah_negh(s, ta, ta);
             }
             if (neg_n) {
-                gen_vfp_negh(tn, tn);
+                gen_vfp_maybe_ah_negh(s, tn, tn);
             }
             fpst = fpstatus_ptr(FPST_A64_F16);
             gen_helper_advsimd_muladdh(ta, tn, tm, ta, fpst);
@@ -XXX,XX +XXX,XX @@ static bool do_fp1_scalar_int(DisasContext *s, arg_rr_e *a,
     return true;
 }
 
+static bool do_fp1_scalar_int_2fn(DisasContext *s, arg_rr_e *a,
+                                  const FPScalar1Int *fnormal,
+                                  const FPScalar1Int *fah)
+{
+    return do_fp1_scalar_int(s, a, s->fpcr_ah ? fah : fnormal, true);
+}
+
 static const FPScalar1Int f_scalar_fmov = {
     tcg_gen_mov_i32,
     tcg_gen_mov_i32,
@@ -XXX,XX +XXX,XX @@ static const FPScalar1Int f_scalar_fneg = {
     gen_vfp_negs,
     gen_vfp_negd,
 };
-TRANS(FNEG_s, do_fp1_scalar_int, a, &f_scalar_fneg, true)
+static const FPScalar1Int f_scalar_ah_fneg = {
+    gen_vfp_ah_negh,
+    gen_vfp_ah_negs,
+    gen_vfp_ah_negd,
+};
+TRANS(FNEG_s, do_fp1_scalar_int_2fn, a, &f_scalar_fneg, &f_scalar_ah_fneg)
 
 typedef struct FPScalar1 {
     void (*gen_h)(TCGv_i32, TCGv_i32, TCGv_ptr);
-- 
2.34.1

FPCR.AH == 1 mandates that taking the absolute value of a NaN should
not change its sign bit.  This means we can no longer use
gen_vfp_abs*() everywhere but must instead generate slightly more
complex code when FPCR.AH is set.

Implement these semantics for scalar FABS and FABD.  This change also
affects all other instructions whose psuedocode calls FPAbs(); we
will extend the change to those instructions in following commits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 69 +++++++++++++++++++++++++++++++++-
 1 file changed, 67 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_vfp_ah_negd(TCGv_i64 d, TCGv_i64 s)
                         s, chs_s);
 }
 
+/*
+ * These functions implement
+ *  d = floatN_is_any_nan(s) ? s : floatN_abs(s)
+ * which for float32 is
+ *  d = (s & ~(1 << 31)) > 0x7f800000UL) ? s : (s & ~(1 << 31))
+ * and similarly for the other float sizes.
+ */
+static void gen_vfp_ah_absh(TCGv_i32 d, TCGv_i32 s)
+{
+    TCGv_i32 abs_s = tcg_temp_new_i32();
+
+    gen_vfp_absh(abs_s, s);
+    tcg_gen_movcond_i32(TCG_COND_GTU, d,
+                        abs_s, tcg_constant_i32(0x7c00),
+                        s, abs_s);
+}
+
+static void gen_vfp_ah_abss(TCGv_i32 d, TCGv_i32 s)
+{
+    TCGv_i32 abs_s = tcg_temp_new_i32();
+
+    gen_vfp_abss(abs_s, s);
+    tcg_gen_movcond_i32(TCG_COND_GTU, d,
+                        abs_s, tcg_constant_i32(0x7f800000UL),
+                        s, abs_s);
+}
+
+static void gen_vfp_ah_absd(TCGv_i64 d, TCGv_i64 s)
+{
+    TCGv_i64 abs_s = tcg_temp_new_i64();
+
+    gen_vfp_absd(abs_s, s);
+    tcg_gen_movcond_i64(TCG_COND_GTU, d,
+                        abs_s, tcg_constant_i64(0x7ff0000000000000ULL),
+                        s, abs_s);
+}
+
 static void gen_vfp_maybe_ah_negh(DisasContext *dc, TCGv_i32 d, TCGv_i32 s)
 {
     if (dc->fpcr_ah) {
@@ -XXX,XX +XXX,XX @@ static void gen_fabd_d(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m, TCGv_ptr s)
     gen_vfp_absd(d, d);
 }
 
+static void gen_fabd_ah_h(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
+{
+    gen_helper_vfp_subh(d, n, m, s);
+    gen_vfp_ah_absh(d, d);
+}
+
+static void gen_fabd_ah_s(TCGv_i32 d, TCGv_i32 n, TCGv_i32 m, TCGv_ptr s)
+{
+    gen_helper_vfp_subs(d, n, m, s);
+    gen_vfp_ah_abss(d, d);
+}
+
+static void gen_fabd_ah_d(TCGv_i64 d, TCGv_i64 n, TCGv_i64 m, TCGv_ptr s)
+{
+    gen_helper_vfp_subd(d, n, m, s);
+    gen_vfp_ah_absd(d, d);
+}
+
 static const FPScalar f_scalar_fabd = {
     gen_fabd_h,
     gen_fabd_s,
     gen_fabd_d,
 };
-TRANS(FABD_s, do_fp3_scalar, a, &f_scalar_fabd, a->rn)
+static const FPScalar f_scalar_ah_fabd = {
+    gen_fabd_ah_h,
+    gen_fabd_ah_s,
+    gen_fabd_ah_d,
+};
+TRANS(FABD_s, do_fp3_scalar_2fn, a, &f_scalar_fabd, &f_scalar_ah_fabd, a->rn)
 
 static const FPScalar f_scalar_frecps = {
     gen_helper_recpsf_f16,
@@ -XXX,XX +XXX,XX @@ static const FPScalar1Int f_scalar_fabs = {
     gen_vfp_abss,
     gen_vfp_absd,
 };
-TRANS(FABS_s, do_fp1_scalar_int, a, &f_scalar_fabs, true)
+static const FPScalar1Int f_scalar_ah_fabs = {
+    gen_vfp_ah_absh,
+    gen_vfp_ah_abss,
+    gen_vfp_ah_absd,
+};
+TRANS(FABS_s, do_fp1_scalar_int_2fn, a, &f_scalar_fabs, &f_scalar_ah_fabs)
 
 static const FPScalar1Int f_scalar_fneg = {
     gen_vfp_negh,
-- 
2.34.1

Split the handling of vector FABD so that it calls a different set
of helpers when FPCR.AH is 1, which implement the "no negation of
the sign of a NaN" semantics.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.h            |  4 ++++
 target/arm/tcg/translate-a64.c |  7 ++++++-
 target/arm/tcg/vec_helper.c    | 23 +++++++++++++++++++++++
 3 files changed, 33 insertions(+), 1 deletion(-)

Make SVE FNEG honour the FPCR.AH "don't negate the sign of a NaN"
semantics.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 4 ++++
 target/arm/tcg/sve_helper.c    | 8 ++++++++
 target/arm/tcg/translate-sve.c | 7 ++++++-
 3 files changed, 18 insertions(+), 1 deletion(-)

Make SVE FABS honour the FPCR.AH "don't negate the sign of a NaN"
semantics.

Make the SVE FABD insn honour the FPCR.AH "don't negate the sign
of a NaN" semantics.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-sve.h    |  7 +++++++
 target/arm/tcg/sve_helper.c    | 22 ++++++++++++++++++++++
 target/arm/tcg/translate-sve.c |  2 +-
 3 files changed, 30 insertions(+), 1 deletion(-)

The negation steps in FCADD must honour FPCR.AH's "don't change the
sign of a NaN" semantics.  Implement this in the same way we did for
the base ASIMD FCADD, by encoding FPCR.AH into the SIMD data field
passed to the helper and using that to decide whether to negate the
values.

The construction of neg_imag and neg_real were done to make it easy
to apply both in parallel with two simple logical operations.  This
changed with FPCR.AH, which is more complex than that. Switch to
an approach that follows the pseudocode more closely, by extracting
the 'rot=1' parameter from the SIMD data field and changing the
sign of the appropriate input value.

Note that there was a naming issue with neg_imag and neg_real.
They were named backward, with neg_imag being non-zero for rot=1,
and vice versa.  This was combined with reversed usage within the
loop, so that the negation in the end turned out correct.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/vec_internal.h  | 17 ++++++++++++++
 target/arm/tcg/sve_helper.c    | 42 ++++++++++++++++++++++++----------
 target/arm/tcg/translate-sve.c |  2 +-
 3 files changed, 48 insertions(+), 13 deletions(-)

diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_internal.h
+++ b/target/arm/tcg/vec_internal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef TARGET_ARM_VEC_INTERNAL_H
 #define TARGET_ARM_VEC_INTERNAL_H
 
+#include "fpu/softfloat.h"
+
 /*
  * Note that vector data is stored in host-endian 64-bit chunks,
  * so addressing units smaller than that needs a host-endian fixup.
@@ -XXX,XX +XXX,XX @@ float32 bfdotadd_ebf(float32 sum, uint32_t e1, uint32_t e2,
  */
 bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp);
 
+static inline float16 float16_maybe_ah_chs(float16 a, bool fpcr_ah)
+{
+    return fpcr_ah && float16_is_any_nan(a) ? a : float16_chs(a);
+}
+
+static inline float32 float32_maybe_ah_chs(float32 a, bool fpcr_ah)
+{
+    return fpcr_ah && float32_is_any_nan(a) ? a : float32_chs(a);
+}
+
+static inline float64 float64_maybe_ah_chs(float64 a, bool fpcr_ah)
+{
+    return fpcr_ah && float64_is_any_nan(a) ? a : float64_chs(a);
+}
+
 #endif /* TARGET_ARM_VEC_INTERNAL_H */
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_h)(void *vd, void *vn, void *vm, void *vg,
 {
     intptr_t j, i = simd_oprsz(desc);
     uint64_t *g = vg;
-    float16 neg_imag = float16_set_sign(0, simd_data(desc));
-    float16 neg_real = float16_chs(neg_imag);
+    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
+    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
 
     do {
         uint64_t pg = g[(i - 1) >> 6];
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_h)(void *vd, void *vn, void *vm, void *vg,
             i -= 2 * sizeof(float16);
 
             e0 = *(float16 *)(vn + H1_2(i));
-            e1 = *(float16 *)(vm + H1_2(j)) ^ neg_real;
+            e1 = *(float16 *)(vm + H1_2(j));
             e2 = *(float16 *)(vn + H1_2(j));
-            e3 = *(float16 *)(vm + H1_2(i)) ^ neg_imag;
+            e3 = *(float16 *)(vm + H1_2(i));
+
+            if (rot) {
+                e3 = float16_maybe_ah_chs(e3, fpcr_ah);
+            } else {
+                e1 = float16_maybe_ah_chs(e1, fpcr_ah);
+            }
 
             if (likely((pg >> (i & 63)) & 1)) {
                 *(float16 *)(vd + H1_2(i)) = float16_add(e0, e1, s);
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_s)(void *vd, void *vn, void *vm, void *vg,
 {
     intptr_t j, i = simd_oprsz(desc);
     uint64_t *g = vg;
-    float32 neg_imag = float32_set_sign(0, simd_data(desc));
-    float32 neg_real = float32_chs(neg_imag);
+    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
+    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
 
     do {
         uint64_t pg = g[(i - 1) >> 6];
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_s)(void *vd, void *vn, void *vm, void *vg,
             i -= 2 * sizeof(float32);
 
             e0 = *(float32 *)(vn + H1_2(i));
-            e1 = *(float32 *)(vm + H1_2(j)) ^ neg_real;
+            e1 = *(float32 *)(vm + H1_2(j));
             e2 = *(float32 *)(vn + H1_2(j));
-            e3 = *(float32 *)(vm + H1_2(i)) ^ neg_imag;
+            e3 = *(float32 *)(vm + H1_2(i));
+
+            if (rot) {
+                e3 = float32_maybe_ah_chs(e3, fpcr_ah);
+            } else {
+                e1 = float32_maybe_ah_chs(e1, fpcr_ah);
+            }
 
             if (likely((pg >> (i & 63)) & 1)) {
                 *(float32 *)(vd + H1_2(i)) = float32_add(e0, e1, s);
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_d)(void *vd, void *vn, void *vm, void *vg,
 {
     intptr_t j, i = simd_oprsz(desc);
     uint64_t *g = vg;
-    float64 neg_imag = float64_set_sign(0, simd_data(desc));
-    float64 neg_real = float64_chs(neg_imag);
+    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
+    bool fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
 
     do {
         uint64_t pg = g[(i - 1) >> 6];
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcadd_d)(void *vd, void *vn, void *vm, void *vg,
             i -= 2 * sizeof(float64);
 
             e0 = *(float64 *)(vn + H1_2(i));
-            e1 = *(float64 *)(vm + H1_2(j)) ^ neg_real;
+            e1 = *(float64 *)(vm + H1_2(j));
             e2 = *(float64 *)(vn + H1_2(j));
-            e3 = *(float64 *)(vm + H1_2(i)) ^ neg_imag;
+            e3 = *(float64 *)(vm + H1_2(i));
+
+            if (rot) {
+                e3 = float64_maybe_ah_chs(e3, fpcr_ah);
+            } else {
+                e1 = float64_maybe_ah_chs(e1, fpcr_ah);
+            }
 
             if (likely((pg >> (i & 63)) & 1)) {
                 *(float64 *)(vd + H1_2(i)) = float64_add(e0, e1, s);
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_4_ptr * const fcadd_fns[] = {
     gen_helper_sve_fcadd_s, gen_helper_sve_fcadd_d,
 };
 TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
-           a->rd, a->rn, a->rm, a->pg, a->rot,
+           a->rd, a->rn, a->rm, a->pg, a->rot | (s->fpcr_ah << 1),
            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
 
 #define DO_FMLA(NAME, name) \
-- 
2.34.1

The negation steps in FCADD must honour FPCR.AH's "don't change the
sign of a NaN" semantics.  Implement this by encoding FPCR.AH into
the SIMD data field passed to the helper and using that to decide
whether to negate the values.

The construction of neg_imag and neg_real were done to make it easy
to apply both in parallel with two simple logical operations.  This
changed with FPCR.AH, which is more complex than that. Switch to
an approach closer to the pseudocode, where we extract the rot
parameter from the SIMD data word and negate the appropriate
input value.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/translate-a64.c | 10 +++++--
 target/arm/tcg/vec_helper.c    | 54 +++++++++++++++++++---------------
 2 files changed, 38 insertions(+), 26 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_3_ptr * const f_vector_fcadd[3] = {
     gen_helper_gvec_fcadds,
     gen_helper_gvec_fcaddd,
 };
-TRANS_FEAT(FCADD_90, aa64_fcma, do_fp3_vector, a, 0, f_vector_fcadd)
-TRANS_FEAT(FCADD_270, aa64_fcma, do_fp3_vector, a, 1, f_vector_fcadd)
+/*
+ * Encode FPCR.AH into the data so the helper knows whether the
+ * negations it does should avoid flipping the sign bit on a NaN
+ */
+TRANS_FEAT(FCADD_90, aa64_fcma, do_fp3_vector, a, 0 | (s->fpcr_ah << 1),
+           f_vector_fcadd)
+TRANS_FEAT(FCADD_270, aa64_fcma, do_fp3_vector, a, 1 | (s->fpcr_ah << 1),
+           f_vector_fcadd)
 
 static bool trans_FCMLA_v(DisasContext *s, arg_FCMLA_v *a)
 {
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcaddh)(void *vd, void *vn, void *vm,
     float16 *d = vd;
     float16 *n = vn;
     float16 *m = vm;
-    uint32_t neg_real = extract32(desc, SIMD_DATA_SHIFT, 1);
-    uint32_t neg_imag = neg_real ^ 1;
+    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
+    bool fpcr_ah = extract64(desc, SIMD_DATA_SHIFT + 1, 1);
     uintptr_t i;
 
-    /* Shift boolean to the sign bit so we can xor to negate.  */
-    neg_real <<= 15;
-    neg_imag <<= 15;
-
     for (i = 0; i < opr_sz / 2; i += 2) {
         float16 e0 = n[H2(i)];
-        float16 e1 = m[H2(i + 1)] ^ neg_imag;
+        float16 e1 = m[H2(i + 1)];
         float16 e2 = n[H2(i + 1)];
-        float16 e3 = m[H2(i)] ^ neg_real;
+        float16 e3 = m[H2(i)];
+
+        if (rot) {
+            e3 = float16_maybe_ah_chs(e3, fpcr_ah);
+        } else {
+            e1 = float16_maybe_ah_chs(e1, fpcr_ah);
+        }
 
         d[H2(i)] = float16_add(e0, e1, fpst);
         d[H2(i + 1)] = float16_add(e2, e3, fpst);
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcadds)(void *vd, void *vn, void *vm,
     float32 *d = vd;
     float32 *n = vn;
     float32 *m = vm;
-    uint32_t neg_real = extract32(desc, SIMD_DATA_SHIFT, 1);
-    uint32_t neg_imag = neg_real ^ 1;
+    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
+    bool fpcr_ah = extract64(desc, SIMD_DATA_SHIFT + 1, 1);
     uintptr_t i;
 
-    /* Shift boolean to the sign bit so we can xor to negate.  */
-    neg_real <<= 31;
-    neg_imag <<= 31;
-
     for (i = 0; i < opr_sz / 4; i += 2) {
         float32 e0 = n[H4(i)];
-        float32 e1 = m[H4(i + 1)] ^ neg_imag;
+        float32 e1 = m[H4(i + 1)];
         float32 e2 = n[H4(i + 1)];
-        float32 e3 = m[H4(i)] ^ neg_real;
+        float32 e3 = m[H4(i)];
+
+        if (rot) {
+            e3 = float32_maybe_ah_chs(e3, fpcr_ah);
+        } else {
+            e1 = float32_maybe_ah_chs(e1, fpcr_ah);
+        }
 
         d[H4(i)] = float32_add(e0, e1, fpst);
         d[H4(i + 1)] = float32_add(e2, e3, fpst);
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcaddd)(void *vd, void *vn, void *vm,
     float64 *d = vd;
     float64 *n = vn;
     float64 *m = vm;
-    uint64_t neg_real = extract64(desc, SIMD_DATA_SHIFT, 1);
-    uint64_t neg_imag = neg_real ^ 1;
+    bool rot = extract32(desc, SIMD_DATA_SHIFT, 1);
+    bool fpcr_ah = extract64(desc, SIMD_DATA_SHIFT + 1, 1);
     uintptr_t i;
 
-    /* Shift boolean to the sign bit so we can xor to negate.  */
-    neg_real <<= 63;
-    neg_imag <<= 63;
-
     for (i = 0; i < opr_sz / 8; i += 2) {
         float64 e0 = n[i];
-        float64 e1 = m[i + 1] ^ neg_imag;
+        float64 e1 = m[i + 1];
         float64 e2 = n[i + 1];
-        float64 e3 = m[i] ^ neg_real;
+        float64 e3 = m[i];
+
+        if (rot) {
+            e3 = float64_maybe_ah_chs(e3, fpcr_ah);
+        } else {
+            e1 = float64_maybe_ah_chs(e1, fpcr_ah);
+        }
 
         d[i] = float64_add(e0, e1, fpst);
         d[i + 1] = float64_add(e2, e3, fpst);
-- 
2.34.1

Handle the FPCR.AH semantics that we do not change the sign of an
input NaN in the FRECPS and FRSQRTS scalar insns, by providing
new helper functions that do the CHS part of the operation
differently.

Since the extra helper functions would be very repetitive if written
out longhand, we condense them and the existing non-AH helpers into
being emitted via macros.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-a64.h    |   6 ++
 target/arm/tcg/vec_internal.h  |  18 ++++++
 target/arm/tcg/helper-a64.c    | 115 ++++++++++++---------------------
 target/arm/tcg/translate-a64.c |  25 +++++--
 4 files changed, 83 insertions(+), 81 deletions(-)

diff --git a/target/arm/tcg/helper-a64.h b/target/arm/tcg/helper-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.h
+++ b/target/arm/tcg/helper-a64.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(neon_cgt_f64, TCG_CALL_NO_RWG, i64, i64, i64, fpst)
 DEF_HELPER_FLAGS_3(recpsf_f16, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
 DEF_HELPER_FLAGS_3(recpsf_f32, TCG_CALL_NO_RWG, f32, f32, f32, fpst)
 DEF_HELPER_FLAGS_3(recpsf_f64, TCG_CALL_NO_RWG, f64, f64, f64, fpst)
+DEF_HELPER_FLAGS_3(recpsf_ah_f16, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+DEF_HELPER_FLAGS_3(recpsf_ah_f32, TCG_CALL_NO_RWG, f32, f32, f32, fpst)
+DEF_HELPER_FLAGS_3(recpsf_ah_f64, TCG_CALL_NO_RWG, f64, f64, f64, fpst)
 DEF_HELPER_FLAGS_3(rsqrtsf_f16, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
 DEF_HELPER_FLAGS_3(rsqrtsf_f32, TCG_CALL_NO_RWG, f32, f32, f32, fpst)
 DEF_HELPER_FLAGS_3(rsqrtsf_f64, TCG_CALL_NO_RWG, f64, f64, f64, fpst)
+DEF_HELPER_FLAGS_3(rsqrtsf_ah_f16, TCG_CALL_NO_RWG, f16, f16, f16, fpst)
+DEF_HELPER_FLAGS_3(rsqrtsf_ah_f32, TCG_CALL_NO_RWG, f32, f32, f32, fpst)
+DEF_HELPER_FLAGS_3(rsqrtsf_ah_f64, TCG_CALL_NO_RWG, f64, f64, f64, fpst)
 DEF_HELPER_FLAGS_2(frecpx_f64, TCG_CALL_NO_RWG, f64, f64, fpst)
 DEF_HELPER_FLAGS_2(frecpx_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
 DEF_HELPER_FLAGS_2(frecpx_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
diff --git a/target/arm/tcg/vec_internal.h b/target/arm/tcg/vec_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_internal.h
+++ b/target/arm/tcg/vec_internal.h
@@ -XXX,XX +XXX,XX @@ float32 bfdotadd_ebf(float32 sum, uint32_t e1, uint32_t e2,
  */
 bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp);
 
+/*
+ * Negate as for FPCR.AH=1 -- do not negate NaNs.
+ */
+static inline float16 float16_ah_chs(float16 a)
+{
+    return float16_is_any_nan(a) ? a : float16_chs(a);
+}
+
+static inline float32 float32_ah_chs(float32 a)
+{
+    return float32_is_any_nan(a) ? a : float32_chs(a);
+}
+
+static inline float64 float64_ah_chs(float64 a)
+{
+    return float64_is_any_nan(a) ? a : float64_chs(a);
+}
+
 static inline float16 float16_maybe_ah_chs(float16 a, bool fpcr_ah)
 {
     return fpcr_ah && float16_is_any_nan(a) ? a : float16_chs(a);
diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@
 #ifdef CONFIG_USER_ONLY
 #include "user/page-protection.h"
 #endif
+#include "vec_internal.h"
 
 /* C2.4.7 Multiply and divide */
 /* special cases for 0 and LLONG_MIN are mandated by the standard */
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(neon_cgt_f64)(float64 a, float64 b, float_status *fpst)
     return -float64_lt(b, a, fpst);
 }
 
-/* Reciprocal step and sqrt step. Note that unlike the A32/T32
+/*
+ * Reciprocal step and sqrt step. Note that unlike the A32/T32
  * versions, these do a fully fused multiply-add or
  * multiply-add-and-halve.
+ * The FPCR.AH == 1 versions need to avoid flipping the sign of NaN.
  */
-
-uint32_t HELPER(recpsf_f16)(uint32_t a, uint32_t b, float_status *fpst)
-{
-    a = float16_squash_input_denormal(a, fpst);
-    b = float16_squash_input_denormal(b, fpst);
-
-    a = float16_chs(a);
-    if ((float16_is_infinity(a) && float16_is_zero(b)) ||
-        (float16_is_infinity(b) && float16_is_zero(a))) {
-        return float16_two;
+#define DO_RECPS(NAME, CTYPE, FLOATTYPE, CHSFN)                         \
+    CTYPE HELPER(NAME)(CTYPE a, CTYPE b, float_status *fpst)            \
+    {                                                                   \
+        a = FLOATTYPE ## _squash_input_denormal(a, fpst);               \
+        b = FLOATTYPE ## _squash_input_denormal(b, fpst);               \
+        a = FLOATTYPE ## _ ## CHSFN(a);                                 \
+        if ((FLOATTYPE ## _is_infinity(a) && FLOATTYPE ## _is_zero(b)) || \
+            (FLOATTYPE ## _is_infinity(b) && FLOATTYPE ## _is_zero(a))) { \
+            return FLOATTYPE ## _two;                                   \
+        }                                                               \
+        return FLOATTYPE ## _muladd(a, b, FLOATTYPE ## _two, 0, fpst);  \
     }
-    return float16_muladd(a, b, float16_two, 0, fpst);
-}
 
-float32 HELPER(recpsf_f32)(float32 a, float32 b, float_status *fpst)
-{
-    a = float32_squash_input_denormal(a, fpst);
-    b = float32_squash_input_denormal(b, fpst);
+DO_RECPS(recpsf_f16, uint32_t, float16, chs)
+DO_RECPS(recpsf_f32, float32, float32, chs)
+DO_RECPS(recpsf_f64, float64, float64, chs)
+DO_RECPS(recpsf_ah_f16, uint32_t, float16, ah_chs)
+DO_RECPS(recpsf_ah_f32, float32, float32, ah_chs)
+DO_RECPS(recpsf_ah_f64, float64, float64, ah_chs)
 
-    a = float32_chs(a);
-    if ((float32_is_infinity(a) && float32_is_zero(b)) ||
-        (float32_is_infinity(b) && float32_is_zero(a))) {
-        return float32_two;
-    }
-    return float32_muladd(a, b, float32_two, 0, fpst);
-}
+#define DO_RSQRTSF(NAME, CTYPE, FLOATTYPE, CHSFN)                       \
+    CTYPE HELPER(NAME)(CTYPE a, CTYPE b, float_status *fpst)            \
+    {                                                                   \
+        a = FLOATTYPE ## _squash_input_denormal(a, fpst);               \
+        b = FLOATTYPE ## _squash_input_denormal(b, fpst);               \
+        a = FLOATTYPE ## _ ## CHSFN(a);                                 \
+        if ((FLOATTYPE ## _is_infinity(a) && FLOATTYPE ## _is_zero(b)) || \
+            (FLOATTYPE ## _is_infinity(b) && FLOATTYPE ## _is_zero(a))) { \
+            return FLOATTYPE ## _one_point_five;                        \
+        }                                                               \
+        return FLOATTYPE ## _muladd_scalbn(a, b, FLOATTYPE ## _three,   \
+                                           -1, 0, fpst);                \
+    }                                                                   \
 
-float64 HELPER(recpsf_f64)(float64 a, float64 b, float_status *fpst)
-{
-    a = float64_squash_input_denormal(a, fpst);
-    b = float64_squash_input_denormal(b, fpst);
-
-    a = float64_chs(a);
-    if ((float64_is_infinity(a) && float64_is_zero(b)) ||
-        (float64_is_infinity(b) && float64_is_zero(a))) {
-        return float64_two;
-    }
-    return float64_muladd(a, b, float64_two, 0, fpst);
-}
-
-uint32_t HELPER(rsqrtsf_f16)(uint32_t a, uint32_t b, float_status *fpst)
-{
-    a = float16_squash_input_denormal(a, fpst);
-    b = float16_squash_input_denormal(b, fpst);
-
-    a = float16_chs(a);
-    if ((float16_is_infinity(a) && float16_is_zero(b)) ||
-        (float16_is_infinity(b) && float16_is_zero(a))) {
-        return float16_one_point_five;
-    }
-    return float16_muladd_scalbn(a, b, float16_three, -1, 0, fpst);
-}
-
-float32 HELPER(rsqrtsf_f32)(float32 a, float32 b, float_status *fpst)
-{
-    a = float32_squash_input_denormal(a, fpst);
-    b = float32_squash_input_denormal(b, fpst);
-
-    a = float32_chs(a);
-    if ((float32_is_infinity(a) && float32_is_zero(b)) ||
-        (float32_is_infinity(b) && float32_is_zero(a))) {
-        return float32_one_point_five;
-    }
-    return float32_muladd_scalbn(a, b, float32_three, -1, 0, fpst);
-}
-
-float64 HELPER(rsqrtsf_f64)(float64 a, float64 b, float_status *fpst)
-{
-    a = float64_squash_input_denormal(a, fpst);
-    b = float64_squash_input_denormal(b, fpst);
-
-    a = float64_chs(a);
-    if ((float64_is_infinity(a) && float64_is_zero(b)) ||
-        (float64_is_infinity(b) && float64_is_zero(a))) {
-        return float64_one_point_five;
-    }
-    return float64_muladd_scalbn(a, b, float64_three, -1, 0, fpst);
-}
+DO_RSQRTSF(rsqrtsf_f16, uint32_t, float16, chs)
+DO_RSQRTSF(rsqrtsf_f32, float32, float32, chs)
+DO_RSQRTSF(rsqrtsf_f64, float64, float64, chs)
+DO_RSQRTSF(rsqrtsf_ah_f16, uint32_t, float16, ah_chs)
+DO_RSQRTSF(rsqrtsf_ah_f32, float32, float32, ah_chs)
+DO_RSQRTSF(rsqrtsf_ah_f64, float64, float64, ah_chs)
 
 /* Floating-point reciprocal exponent - see FPRecpX in ARM ARM */
 uint32_t HELPER(frecpx_f16)(uint32_t a, float_status *fpst)
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool do_fp3_scalar(DisasContext *s, arg_rrr_e *a, const FPScalar *f,
                                        FPST_A64_F16 : FPST_A64);
 }
 
-static bool do_fp3_scalar_ah(DisasContext *s, arg_rrr_e *a, const FPScalar *f,
-                             int mergereg)
+static bool do_fp3_scalar_ah_2fn(DisasContext *s, arg_rrr_e *a,
+                                 const FPScalar *fnormal, const FPScalar *fah,
+                                 int mergereg)
 {
-    return do_fp3_scalar_with_fpsttype(s, a, f, mergereg,
-                                       select_ah_fpst(s, a->esz));
+    return do_fp3_scalar_with_fpsttype(s, a, s->fpcr_ah ? fah : fnormal,
+                                       mergereg, select_ah_fpst(s, a->esz));
 }
 
 /* Some insns need to call different helpers when FPCR.AH == 1 */
@@ -XXX,XX +XXX,XX @@ static const FPScalar f_scalar_frecps = {
     gen_helper_recpsf_f32,
     gen_helper_recpsf_f64,
 };
-TRANS(FRECPS_s, do_fp3_scalar_ah, a, &f_scalar_frecps, a->rn)
+static const FPScalar f_scalar_ah_frecps = {
+    gen_helper_recpsf_ah_f16,
+    gen_helper_recpsf_ah_f32,
+    gen_helper_recpsf_ah_f64,
+};
+TRANS(FRECPS_s, do_fp3_scalar_ah_2fn, a,
+      &f_scalar_frecps, &f_scalar_ah_frecps, a->rn)
 
 static const FPScalar f_scalar_frsqrts = {
     gen_helper_rsqrtsf_f16,
     gen_helper_rsqrtsf_f32,
     gen_helper_rsqrtsf_f64,
 };
-TRANS(FRSQRTS_s, do_fp3_scalar_ah, a, &f_scalar_frsqrts, a->rn)
+static const FPScalar f_scalar_ah_frsqrts = {
+    gen_helper_rsqrtsf_ah_f16,
+    gen_helper_rsqrtsf_ah_f32,
+    gen_helper_rsqrtsf_ah_f64,
+};
+TRANS(FRSQRTS_s, do_fp3_scalar_ah_2fn, a,
+      &f_scalar_frsqrts, &f_scalar_ah_frsqrts, a->rn)
 
 static bool do_fcmp0_s(DisasContext *s, arg_rr_e *a,
                        const FPScalar *f, bool swap)
-- 
2.34.1

Handle the FPCR.AH "don't negate the sign of a NaN" semantics
in the vector versions of FRECPS and FRSQRTS, by implementing
new vector wrappers that call the _ah_ scalar helpers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 14 ++++++++++++++
 target/arm/tcg/translate-a64.c | 21 ++++++++++++++++-----
 target/arm/tcg/translate-sve.c |  7 ++++++-
 target/arm/tcg/vec_helper.c    |  8 ++++++++
 4 files changed, 44 insertions(+), 6 deletions(-)

Handle the FPCR.AH "don't negate the sign of a NaN" semantics in FMLS
(indexed). We do this by creating 6 new helpers, which allow us to
do the negation either by XOR (for AH=0) or by muladd flags
(for AH=1).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: Mostly from RTH's patch; error in index order into fns[][]
 fixed]
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.h            | 14 ++++++++++++++
 target/arm/tcg/translate-a64.c | 17 +++++++++++------
 target/arm/tcg/translate-sve.c | 31 +++++++++++++++++--------------
 target/arm/tcg/vec_helper.c    | 24 +++++++++++++++---------
 4 files changed, 57 insertions(+), 29 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_6(gvec_fmla_idx_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_6(gvec_fmla_idx_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_6(gvec_fmls_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_fmls_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_fmls_idx_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_6(gvec_ah_fmls_idx_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, fpst, i32)
+
 DEF_HELPER_FLAGS_5(gvec_uqadd_b, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, i32)
 DEF_HELPER_FLAGS_5(gvec_uqadd_h, TCG_CALL_NO_RWG,
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ TRANS(FMULX_vi, do_fp3_vector_idx, a, f_vector_idx_fmulx)
 
 static bool do_fmla_vector_idx(DisasContext *s, arg_qrrx_e *a, bool neg)
 {
-    static gen_helper_gvec_4_ptr * const fns[3] = {
-        gen_helper_gvec_fmla_idx_h,
-        gen_helper_gvec_fmla_idx_s,
-        gen_helper_gvec_fmla_idx_d,
+    static gen_helper_gvec_4_ptr * const fns[3][3] = {
+        { gen_helper_gvec_fmla_idx_h,
+          gen_helper_gvec_fmla_idx_s,
+          gen_helper_gvec_fmla_idx_d },
+        { gen_helper_gvec_fmls_idx_h,
+          gen_helper_gvec_fmls_idx_s,
+          gen_helper_gvec_fmls_idx_d },
+        { gen_helper_gvec_ah_fmls_idx_h,
+          gen_helper_gvec_ah_fmls_idx_s,
+          gen_helper_gvec_ah_fmls_idx_d },
     };
     MemOp esz = a->esz;
     int check = fp_access_check_vector_hsd(s, a->q, esz);
@@ -XXX,XX +XXX,XX @@ static bool do_fmla_vector_idx(DisasContext *s, arg_qrrx_e *a, bool neg)
 
     gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
                       esz == MO_16 ? FPST_A64_F16 : FPST_A64,
-                      (a->idx << 1) | neg,
-                      fns[esz - 1]);
+                      a->idx, fns[neg ? 1 + s->fpcr_ah : 0][esz - 1]);
     return true;
 }
 
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ DO_SVE2_RRXR_ROT(CDOT_zzxw_d, gen_helper_sve2_cdot_idx_d)
  *** SVE Floating Point Multiply-Add Indexed Group
  */
 
-static bool do_FMLA_zzxz(DisasContext *s, arg_rrxr_esz *a, bool sub)
-{
-    static gen_helper_gvec_4_ptr * const fns[4] = {
-        NULL,
-        gen_helper_gvec_fmla_idx_h,
-        gen_helper_gvec_fmla_idx_s,
-        gen_helper_gvec_fmla_idx_d,
-    };
-    return gen_gvec_fpst_zzzz(s, fns[a->esz], a->rd, a->rn, a->rm, a->ra,
-                              (a->index << 1) | sub,
-                              a->esz == MO_16 ? FPST_A64_F16 : FPST_A64);
-}
+static gen_helper_gvec_4_ptr * const fmla_idx_fns[4] = {
+    NULL,                       gen_helper_gvec_fmla_idx_h,
+    gen_helper_gvec_fmla_idx_s, gen_helper_gvec_fmla_idx_d
+};
+TRANS_FEAT(FMLA_zzxz, aa64_sve, gen_gvec_fpst_zzzz,
+           fmla_idx_fns[a->esz], a->rd, a->rn, a->rm, a->ra, a->index,
+           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
 
-TRANS_FEAT(FMLA_zzxz, aa64_sve, do_FMLA_zzxz, a, false)
-TRANS_FEAT(FMLS_zzxz, aa64_sve, do_FMLA_zzxz, a, true)
+static gen_helper_gvec_4_ptr * const fmls_idx_fns[4][2] = {
+    { NULL, NULL },
+    { gen_helper_gvec_fmls_idx_h, gen_helper_gvec_ah_fmls_idx_h },
+    { gen_helper_gvec_fmls_idx_s, gen_helper_gvec_ah_fmls_idx_s },
+    { gen_helper_gvec_fmls_idx_d, gen_helper_gvec_ah_fmls_idx_d },
+};
+TRANS_FEAT(FMLS_zzxz, aa64_sve, gen_gvec_fpst_zzzz,
+           fmls_idx_fns[a->esz][s->fpcr_ah],
+           a->rd, a->rn, a->rm, a->ra, a->index,
+           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
 
 /*
  *** SVE Floating Point Multiply Indexed Group
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ DO_FMUL_IDX(gvec_fmls_nf_idx_s, float32_sub, float32_mul, float32, H4)
 
 #undef DO_FMUL_IDX
 
-#define DO_FMLA_IDX(NAME, TYPE, H)                                         \
+#define DO_FMLA_IDX(NAME, TYPE, H, NEGX, NEGF)                             \
 void HELPER(NAME)(void *vd, void *vn, void *vm, void *va,                  \
                   float_status *stat, uint32_t desc)                       \
 {                                                                          \
     intptr_t i, j, oprsz = simd_oprsz(desc);                               \
     intptr_t segment = MIN(16, oprsz) / sizeof(TYPE);                      \
-    TYPE op1_neg = extract32(desc, SIMD_DATA_SHIFT, 1);                    \
-    intptr_t idx = desc >> (SIMD_DATA_SHIFT + 1);                          \
+    intptr_t idx = simd_data(desc);                                        \
     TYPE *d = vd, *n = vn, *m = vm, *a = va;                               \
-    op1_neg <<= (8 * sizeof(TYPE) - 1);                                    \
     for (i = 0; i < oprsz / sizeof(TYPE); i += segment) {                  \
         TYPE mm = m[H(i + idx)];                                           \
         for (j = 0; j < segment; j++) {                                    \
-            d[i + j] = TYPE##_muladd(n[i + j] ^ op1_neg,                   \
-                                     mm, a[i + j], 0, stat);               \
+            d[i + j] = TYPE##_muladd(n[i + j] ^ NEGX, mm,                  \
+                                     a[i + j], NEGF, stat);                \
         }                                                                  \
     }                                                                      \
     clear_tail(d, oprsz, simd_maxsz(desc));                                \
 }
 
-DO_FMLA_IDX(gvec_fmla_idx_h, float16, H2)
-DO_FMLA_IDX(gvec_fmla_idx_s, float32, H4)
-DO_FMLA_IDX(gvec_fmla_idx_d, float64, H8)
+DO_FMLA_IDX(gvec_fmla_idx_h, float16, H2, 0, 0)
+DO_FMLA_IDX(gvec_fmla_idx_s, float32, H4, 0, 0)
+DO_FMLA_IDX(gvec_fmla_idx_d, float64, H8, 0, 0)
+
+DO_FMLA_IDX(gvec_fmls_idx_h, float16, H2, INT16_MIN, 0)
+DO_FMLA_IDX(gvec_fmls_idx_s, float32, H4, INT32_MIN, 0)
+DO_FMLA_IDX(gvec_fmls_idx_d, float64, H8, INT64_MIN, 0)
+
+DO_FMLA_IDX(gvec_ah_fmls_idx_h, float16, H2, 0, float_muladd_negate_product)
+DO_FMLA_IDX(gvec_ah_fmls_idx_s, float32, H4, 0, float_muladd_negate_product)
+DO_FMLA_IDX(gvec_ah_fmls_idx_d, float64, H8, 0, float_muladd_negate_product)
 
 #undef DO_FMLA_IDX
 
-- 
2.34.1

Handle the FPCR.AH "don't negate the sign of a NaN" semantics
in FMLS (vector), by implementing a new set of helpers for
the AH=1 case.

The float_muladd_negate_product flag produces the same result
as negating either of the multiplication operands, assuming
neither of the operands are NaNs.  But since FEAT_AFP does not
negate NaNs, this behaviour is exactly what we need.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.h            |  4 ++++
 target/arm/tcg/translate-a64.c |  7 ++++++-
 target/arm/tcg/vec_helper.c    | 22 ++++++++++++++++++++++
 3 files changed, 32 insertions(+), 1 deletion(-)

Handle the FPCR.AH "don't negate the sign of a NaN" semantics fro the
SVE FMLS (vector) insns, by providing new helpers for the AH=1 case
which end up passing fpcr_ah = true to the do_fmla_zpzzz_* functions
that do the work.

The float*_muladd functions have a flags argument that can
perform optional negation of various operand.  We don't use
that for "normal" arm fmla, because the muladd flags are not
applied when an input is a NaN.  But since FEAT_AFP does not
negate NaNs, this behaviour is exactly what we need.

The non-AH helpers pass in a zero flags argument and control the
negation via the neg1 and neg3 arguments; the AH helpers always pass
in neg1 and neg3 as zero and control the negation via the flags
argument.  This allows us to avoid conditional branches within the
inner loop.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-sve.h    | 21 ++++++++
 target/arm/tcg/sve_helper.c    | 99 +++++++++++++++++++++++++++-------
 target/arm/tcg/translate-sve.c | 18 ++++---
 3 files changed, 114 insertions(+), 24 deletions(-)

diff --git a/target/arm/tcg/helper-sve.h b/target/arm/tcg/helper-sve.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-sve.h
+++ b/target/arm/tcg/helper-sve.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_7(sve_fnmls_zpzzz_s, TCG_CALL_NO_RWG,
 DEF_HELPER_FLAGS_7(sve_fnmls_zpzzz_d, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 
+DEF_HELPER_FLAGS_7(sve_ah_fmls_zpzzz_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_7(sve_ah_fmls_zpzzz_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_7(sve_ah_fmls_zpzzz_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_7(sve_ah_fnmla_zpzzz_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_7(sve_ah_fnmla_zpzzz_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_7(sve_ah_fnmla_zpzzz_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+
+DEF_HELPER_FLAGS_7(sve_ah_fnmls_zpzzz_h, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_7(sve_ah_fnmls_zpzzz_s, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_7(sve_ah_fnmls_zpzzz_d, TCG_CALL_NO_RWG,
+                   void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
+
 DEF_HELPER_FLAGS_7(sve_fcmla_zpzzz_h, TCG_CALL_NO_RWG,
                    void, ptr, ptr, ptr, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_7(sve_fcmla_zpzzz_s, TCG_CALL_NO_RWG,
diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_ZPZ_FP(flogb_d, float64, H1_8, do_float64_logb_as_int)
 
 static void do_fmla_zpzzz_h(void *vd, void *vn, void *vm, void *va, void *vg,
                             float_status *status, uint32_t desc,
-                            uint16_t neg1, uint16_t neg3)
+                            uint16_t neg1, uint16_t neg3, int flags)
 {
     intptr_t i = simd_oprsz(desc);
     uint64_t *g = vg;
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_h(void *vd, void *vn, void *vm, void *va, void *vg,
                 e1 = *(uint16_t *)(vn + H1_2(i)) ^ neg1;
                 e2 = *(uint16_t *)(vm + H1_2(i));
                 e3 = *(uint16_t *)(va + H1_2(i)) ^ neg3;
-                r = float16_muladd(e1, e2, e3, 0, status);
+                r = float16_muladd(e1, e2, e3, flags, status);
                 *(uint16_t *)(vd + H1_2(i)) = r;
             }
         } while (i & 63);
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_h(void *vd, void *vn, void *vm, void *va, void *vg,
 void HELPER(sve_fmla_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
                               void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0);
+    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0, 0);
 }
 
 void HELPER(sve_fmls_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
                               void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0x8000, 0);
+    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0x8000, 0, 0);
 }
 
 void HELPER(sve_fnmla_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0x8000, 0x8000);
+    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0x8000, 0x8000, 0);
 }
 
 void HELPER(sve_fnmls_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0x8000);
+    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0x8000, 0);
+}
+
+void HELPER(sve_ah_fmls_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
+                              void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0,
+                    float_muladd_negate_product);
+}
+
+void HELPER(sve_ah_fnmla_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
+                               void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0,
+                    float_muladd_negate_product | float_muladd_negate_c);
+}
+
+void HELPER(sve_ah_fnmls_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
+                               void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_h(vd, vn, vm, va, vg, status, desc, 0, 0,
+                    float_muladd_negate_c);
 }
 
 static void do_fmla_zpzzz_s(void *vd, void *vn, void *vm, void *va, void *vg,
                             float_status *status, uint32_t desc,
-                            uint32_t neg1, uint32_t neg3)
+                            uint32_t neg1, uint32_t neg3, int flags)
 {
     intptr_t i = simd_oprsz(desc);
     uint64_t *g = vg;
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_s(void *vd, void *vn, void *vm, void *va, void *vg,
                 e1 = *(uint32_t *)(vn + H1_4(i)) ^ neg1;
                 e2 = *(uint32_t *)(vm + H1_4(i));
                 e3 = *(uint32_t *)(va + H1_4(i)) ^ neg3;
-                r = float32_muladd(e1, e2, e3, 0, status);
+                r = float32_muladd(e1, e2, e3, flags, status);
                 *(uint32_t *)(vd + H1_4(i)) = r;
             }
         } while (i & 63);
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_s(void *vd, void *vn, void *vm, void *va, void *vg,
 void HELPER(sve_fmla_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
                               void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0);
+    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0, 0);
 }
 
 void HELPER(sve_fmls_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
                               void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0x80000000, 0);
+    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0x80000000, 0, 0);
 }
 
 void HELPER(sve_fnmla_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0x80000000, 0x80000000);
+    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0x80000000, 0x80000000, 0);
 }
 
 void HELPER(sve_fnmls_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0x80000000);
+    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0x80000000, 0);
+}
+
+void HELPER(sve_ah_fmls_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
+                              void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0,
+                    float_muladd_negate_product);
+}
+
+void HELPER(sve_ah_fnmla_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
+                               void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0,
+                    float_muladd_negate_product | float_muladd_negate_c);
+}
+
+void HELPER(sve_ah_fnmls_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
+                               void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_s(vd, vn, vm, va, vg, status, desc, 0, 0,
+                    float_muladd_negate_c);
 }
 
 static void do_fmla_zpzzz_d(void *vd, void *vn, void *vm, void *va, void *vg,
                             float_status *status, uint32_t desc,
-                            uint64_t neg1, uint64_t neg3)
+                            uint64_t neg1, uint64_t neg3, int flags)
 {
     intptr_t i = simd_oprsz(desc);
     uint64_t *g = vg;
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_d(void *vd, void *vn, void *vm, void *va, void *vg,
                 e1 = *(uint64_t *)(vn + i) ^ neg1;
                 e2 = *(uint64_t *)(vm + i);
                 e3 = *(uint64_t *)(va + i) ^ neg3;
-                r = float64_muladd(e1, e2, e3, 0, status);
+                r = float64_muladd(e1, e2, e3, flags, status);
                 *(uint64_t *)(vd + i) = r;
             }
         } while (i & 63);
@@ -XXX,XX +XXX,XX @@ static void do_fmla_zpzzz_d(void *vd, void *vn, void *vm, void *va, void *vg,
 void HELPER(sve_fmla_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
                               void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, 0);
+    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, 0, 0);
 }
 
 void HELPER(sve_fmls_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
                               void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, INT64_MIN, 0);
+    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, INT64_MIN, 0, 0);
 }
 
 void HELPER(sve_fnmla_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, INT64_MIN, INT64_MIN);
+    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, INT64_MIN, INT64_MIN, 0);
 }
 
 void HELPER(sve_fnmls_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
 {
-    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, INT64_MIN);
+    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, INT64_MIN, 0);
+}
+
+void HELPER(sve_ah_fmls_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
+                              void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, 0,
+                    float_muladd_negate_product);
+}
+
+void HELPER(sve_ah_fnmla_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
+                               void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, 0,
+                    float_muladd_negate_product | float_muladd_negate_c);
+}
+
+void HELPER(sve_ah_fnmls_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
+                               void *vg, float_status *status, uint32_t desc)
+{
+    do_fmla_zpzzz_d(vd, vn, vm, va, vg, status, desc, 0, 0,
+                    float_muladd_negate_c);
 }
 
 /* Two operand floating-point comparison controlled by a predicate.
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ TRANS_FEAT(FCADD, aa64_sve, gen_gvec_fpst_zzzp, fcadd_fns[a->esz],
            a->rd, a->rn, a->rm, a->pg, a->rot | (s->fpcr_ah << 1),
            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
 
-#define DO_FMLA(NAME, name) \
+#define DO_FMLA(NAME, name, ah_name)                                    \
     static gen_helper_gvec_5_ptr * const name##_fns[4] = {              \
         NULL, gen_helper_sve_##name##_h,                                \
         gen_helper_sve_##name##_s, gen_helper_sve_##name##_d            \
     };                                                                  \
-    TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp, name##_fns[a->esz], \
+    static gen_helper_gvec_5_ptr * const name##_ah_fns[4] = {           \
+        NULL, gen_helper_sve_##ah_name##_h,                             \
+        gen_helper_sve_##ah_name##_s, gen_helper_sve_##ah_name##_d      \
+    };                                                                  \
+    TRANS_FEAT(NAME, aa64_sve, gen_gvec_fpst_zzzzp,                     \
+               s->fpcr_ah ? name##_ah_fns[a->esz] : name##_fns[a->esz], \
                a->rd, a->rn, a->rm, a->ra, a->pg, 0,                    \
                a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
 
-DO_FMLA(FMLA_zpzzz, fmla_zpzzz)
-DO_FMLA(FMLS_zpzzz, fmls_zpzzz)
-DO_FMLA(FNMLA_zpzzz, fnmla_zpzzz)
-DO_FMLA(FNMLS_zpzzz, fnmls_zpzzz)
+/* We don't need an ah_fmla_zpzzz because fmla doesn't negate anything */
+DO_FMLA(FMLA_zpzzz, fmla_zpzzz, fmla_zpzzz)
+DO_FMLA(FMLS_zpzzz, fmls_zpzzz, ah_fmls_zpzzz)
+DO_FMLA(FNMLA_zpzzz, fnmla_zpzzz, ah_fnmla_zpzzz)
+DO_FMLA(FNMLS_zpzzz, fnmls_zpzzz, ah_fnmls_zpzzz)
 
 #undef DO_FMLA
 
-- 
2.34.1

The negation step in the SVE FTSSEL insn mustn't negate a NaN when
FPCR.AH is set.  Pass FPCR.AH to the helper via the SIMD data field
and use that to determine whether to do the negation.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/sve_helper.c    | 18 +++++++++++++++---
 target/arm/tcg/translate-sve.c |  4 ++--
 2 files changed, 17 insertions(+), 5 deletions(-)

The negation step in the SVE FTMAD insn mustn't negate a NaN when
FPCR.AH is set.  Pass FPCR.AH to the helper via the SIMD data field,
so we can select the correct behaviour.

Because the operand is known to be negative, negating the operand
is the same as taking the absolute value.  Defer this to the muladd
operation via flags, so that it happens after NaN detection, which
is correct for FPCR.AH.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/sve_helper.c    | 42 ++++++++++++++++++++++++++--------
 target/arm/tcg/translate-sve.c |  3 ++-
 2 files changed, 35 insertions(+), 10 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

The negation step in FCMLA mustn't negate a NaN when FPCR.AH
is set. Handle this by passing FPCR.AH to the helper via the
SIMD data field, and use this to select whether to do the
negation via XOR or via the muladd negate_product flag.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250129013857.135256-26-richard.henderson@linaro.org
[PMM: Expanded commit message]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c |  2 +-
 target/arm/tcg/vec_helper.c    | 66 ++++++++++++++++++++--------------
 2 files changed, 40 insertions(+), 28 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool trans_FCMLA_v(DisasContext *s, arg_FCMLA_v *a)
 
     gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
                       a->esz == MO_16 ? FPST_A64_F16 : FPST_A64,
-                      a->rot, fn[a->esz]);
+                      a->rot | (s->fpcr_ah << 2), fn[a->esz]);
     return true;
 }
 
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcmlah)(void *vd, void *vn, void *vm, void *va,
     uintptr_t opr_sz = simd_oprsz(desc);
     float16 *d = vd, *n = vn, *m = vm, *a = va;
     intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
-    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
-    uint32_t neg_real = flip ^ neg_imag;
+    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
+    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t negf_real = flip ^ negf_imag;
+    float16 negx_imag, negx_real;
     uintptr_t i;
 
-    /* Shift boolean to the sign bit so we can xor to negate.  */
-    neg_real <<= 15;
-    neg_imag <<= 15;
+    /* With AH=0, use negx; with AH=1 use negf. */
+    negx_real = (negf_real & ~fpcr_ah) << 15;
+    negx_imag = (negf_imag & ~fpcr_ah) << 15;
+    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
+    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
 
     for (i = 0; i < opr_sz / 2; i += 2) {
         float16 e2 = n[H2(i + flip)];
-        float16 e1 = m[H2(i + flip)] ^ neg_real;
+        float16 e1 = m[H2(i + flip)] ^ negx_real;
         float16 e4 = e2;
-        float16 e3 = m[H2(i + 1 - flip)] ^ neg_imag;
+        float16 e3 = m[H2(i + 1 - flip)] ^ negx_imag;
 
-        d[H2(i)] = float16_muladd(e2, e1, a[H2(i)], 0, fpst);
-        d[H2(i + 1)] = float16_muladd(e4, e3, a[H2(i + 1)], 0, fpst);
+        d[H2(i)] = float16_muladd(e2, e1, a[H2(i)], negf_real, fpst);
+        d[H2(i + 1)] = float16_muladd(e4, e3, a[H2(i + 1)], negf_imag, fpst);
     }
     clear_tail(d, opr_sz, simd_maxsz(desc));
 }
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcmlas)(void *vd, void *vn, void *vm, void *va,
     uintptr_t opr_sz = simd_oprsz(desc);
     float32 *d = vd, *n = vn, *m = vm, *a = va;
     intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
-    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
-    uint32_t neg_real = flip ^ neg_imag;
+    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
+    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t negf_real = flip ^ negf_imag;
+    float32 negx_imag, negx_real;
     uintptr_t i;
 
-    /* Shift boolean to the sign bit so we can xor to negate.  */
-    neg_real <<= 31;
-    neg_imag <<= 31;
+    /* With AH=0, use negx; with AH=1 use negf. */
+    negx_real = (negf_real & ~fpcr_ah) << 31;
+    negx_imag = (negf_imag & ~fpcr_ah) << 31;
+    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
+    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
 
     for (i = 0; i < opr_sz / 4; i += 2) {
         float32 e2 = n[H4(i + flip)];
-        float32 e1 = m[H4(i + flip)] ^ neg_real;
+        float32 e1 = m[H4(i + flip)] ^ negx_real;
         float32 e4 = e2;
-        float32 e3 = m[H4(i + 1 - flip)] ^ neg_imag;
+        float32 e3 = m[H4(i + 1 - flip)] ^ negx_imag;
 
-        d[H4(i)] = float32_muladd(e2, e1, a[H4(i)], 0, fpst);
-        d[H4(i + 1)] = float32_muladd(e4, e3, a[H4(i + 1)], 0, fpst);
+        d[H4(i)] = float32_muladd(e2, e1, a[H4(i)], negf_real, fpst);
+        d[H4(i + 1)] = float32_muladd(e4, e3, a[H4(i + 1)], negf_imag, fpst);
     }
     clear_tail(d, opr_sz, simd_maxsz(desc));
 }
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcmlad)(void *vd, void *vn, void *vm, void *va,
     uintptr_t opr_sz = simd_oprsz(desc);
     float64 *d = vd, *n = vn, *m = vm, *a = va;
     intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
-    uint64_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
-    uint64_t neg_real = flip ^ neg_imag;
+    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
+    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t negf_real = flip ^ negf_imag;
+    float64 negx_real, negx_imag;
     uintptr_t i;
 
-    /* Shift boolean to the sign bit so we can xor to negate.  */
-    neg_real <<= 63;
-    neg_imag <<= 63;
+    /* With AH=0, use negx; with AH=1 use negf. */
+    negx_real = (uint64_t)(negf_real & ~fpcr_ah) << 63;
+    negx_imag = (uint64_t)(negf_imag & ~fpcr_ah) << 63;
+    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
+    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
 
     for (i = 0; i < opr_sz / 8; i += 2) {
         float64 e2 = n[i + flip];
-        float64 e1 = m[i + flip] ^ neg_real;
+        float64 e1 = m[i + flip] ^ negx_real;
         float64 e4 = e2;
-        float64 e3 = m[i + 1 - flip] ^ neg_imag;
+        float64 e3 = m[i + 1 - flip] ^ negx_imag;
 
-        d[i] = float64_muladd(e2, e1, a[i], 0, fpst);
-        d[i + 1] = float64_muladd(e4, e3, a[i + 1], 0, fpst);
+        d[i] = float64_muladd(e2, e1, a[i], negf_real, fpst);
+        d[i + 1] = float64_muladd(e4, e3, a[i + 1], negf_imag, fpst);
     }
     clear_tail(d, opr_sz, simd_maxsz(desc));
 }
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

The negation step in FCMLA by index mustn't negate a NaN when
FPCR.AH is set. Use the same approach as vector FCMLA of
passing in FPCR.AH and using it to select whether to negate
by XOR or by the muladd negate_product flag.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250129013857.135256-27-richard.henderson@linaro.org
[PMM: Expanded commit message]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c |  2 +-
 target/arm/tcg/vec_helper.c    | 44 ++++++++++++++++++++--------------
 2 files changed, 27 insertions(+), 19 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool trans_FCMLA_vi(DisasContext *s, arg_FCMLA_vi *a)
     if (fp_access_check(s)) {
         gen_gvec_op4_fpst(s, a->q, a->rd, a->rn, a->rm, a->rd,
                           a->esz == MO_16 ? FPST_A64_F16 : FPST_A64,
-                          (a->idx << 2) | a->rot, fn);
+                          (s->fpcr_ah << 4) | (a->idx << 2) | a->rot, fn);
     }
     return true;
 }
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcmlah_idx)(void *vd, void *vn, void *vm, void *va,
     uintptr_t opr_sz = simd_oprsz(desc);
     float16 *d = vd, *n = vn, *m = vm, *a = va;
     intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
-    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
     intptr_t index = extract32(desc, SIMD_DATA_SHIFT + 2, 2);
-    uint32_t neg_real = flip ^ neg_imag;
+    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 4, 1);
+    uint32_t negf_real = flip ^ negf_imag;
     intptr_t elements = opr_sz / sizeof(float16);
     intptr_t eltspersegment = MIN(16 / sizeof(float16), elements);
+    float16 negx_imag, negx_real;
     intptr_t i, j;
 
-    /* Shift boolean to the sign bit so we can xor to negate.  */
-    neg_real <<= 15;
-    neg_imag <<= 15;
+    /* With AH=0, use negx; with AH=1 use negf. */
+    negx_real = (negf_real & ~fpcr_ah) << 15;
+    negx_imag = (negf_imag & ~fpcr_ah) << 15;
+    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
+    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
 
     for (i = 0; i < elements; i += eltspersegment) {
         float16 mr = m[H2(i + 2 * index + 0)];
         float16 mi = m[H2(i + 2 * index + 1)];
-        float16 e1 = neg_real ^ (flip ? mi : mr);
-        float16 e3 = neg_imag ^ (flip ? mr : mi);
+        float16 e1 = negx_real ^ (flip ? mi : mr);
+        float16 e3 = negx_imag ^ (flip ? mr : mi);
 
         for (j = i; j < i + eltspersegment; j += 2) {
             float16 e2 = n[H2(j + flip)];
             float16 e4 = e2;
 
-            d[H2(j)] = float16_muladd(e2, e1, a[H2(j)], 0, fpst);
-            d[H2(j + 1)] = float16_muladd(e4, e3, a[H2(j + 1)], 0, fpst);
+            d[H2(j)] = float16_muladd(e2, e1, a[H2(j)], negf_real, fpst);
+            d[H2(j + 1)] = float16_muladd(e4, e3, a[H2(j + 1)], negf_imag, fpst);
         }
     }
     clear_tail(d, opr_sz, simd_maxsz(desc));
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fcmlas_idx)(void *vd, void *vn, void *vm, void *va,
     uintptr_t opr_sz = simd_oprsz(desc);
     float32 *d = vd, *n = vn, *m = vm, *a = va;
     intptr_t flip = extract32(desc, SIMD_DATA_SHIFT, 1);
-    uint32_t neg_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
     intptr_t index = extract32(desc, SIMD_DATA_SHIFT + 2, 2);
-    uint32_t neg_real = flip ^ neg_imag;
+    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 4, 1);
+    uint32_t negf_real = flip ^ negf_imag;
     intptr_t elements = opr_sz / sizeof(float32);
     intptr_t eltspersegment = MIN(16 / sizeof(float32), elements);
+    float32 negx_imag, negx_real;
     intptr_t i, j;
 
-    /* Shift boolean to the sign bit so we can xor to negate.  */
-    neg_real <<= 31;
-    neg_imag <<= 31;
+    /* With AH=0, use negx; with AH=1 use negf. */
+    negx_real = (negf_real & ~fpcr_ah) << 31;
+    negx_imag = (negf_imag & ~fpcr_ah) << 31;
+    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
+    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
 
     for (i = 0; i < elements; i += eltspersegment) {
         float32 mr = m[H4(i + 2 * index + 0)];
         float32 mi = m[H4(i + 2 * index + 1)];
-        float32 e1 = neg_real ^ (flip ? mi : mr);
-        float32 e3 = neg_imag ^ (flip ? mr : mi);
+        float32 e1 = negx_real ^ (flip ? mi : mr);
+        float32 e3 = negx_imag ^ (flip ? mr : mi);
 
         for (j = i; j < i + eltspersegment; j += 2) {
             float32 e2 = n[H4(j + flip)];
             float32 e4 = e2;
 
-            d[H4(j)] = float32_muladd(e2, e1, a[H4(j)], 0, fpst);
-            d[H4(j + 1)] = float32_muladd(e4, e3, a[H4(j + 1)], 0, fpst);
+            d[H4(j)] = float32_muladd(e2, e1, a[H4(j)], negf_real, fpst);
+            d[H4(j + 1)] = float32_muladd(e4, e3, a[H4(j + 1)], negf_imag, fpst);
         }
     }
     clear_tail(d, opr_sz, simd_maxsz(desc));
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

The negation step in SVE FCMLA mustn't negate a NaN when FPCR.AH is
set.  Use the same approach as we did for A64 FCMLA of passing in
FPCR.AH and using it to select whether to negate by XOR or by the
muladd negate_product flag.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250129013857.135256-28-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/sve_helper.c    | 69 +++++++++++++++++++++-------------
 target/arm/tcg/translate-sve.c |  2 +-
 2 files changed, 43 insertions(+), 28 deletions(-)

diff --git a/target/arm/tcg/sve_helper.c b/target/arm/tcg/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/sve_helper.c
+++ b/target/arm/tcg/sve_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
 {
     intptr_t j, i = simd_oprsz(desc);
-    unsigned rot = simd_data(desc);
-    bool flip = rot & 1;
-    float16 neg_imag, neg_real;
+    bool flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
+    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t negf_real = flip ^ negf_imag;
+    float16 negx_imag, negx_real;
     uint64_t *g = vg;
 
-    neg_imag = float16_set_sign(0, (rot & 2) != 0);
-    neg_real = float16_set_sign(0, rot == 1 || rot == 2);
+    /* With AH=0, use negx; with AH=1 use negf. */
+    negx_real = (negf_real & ~fpcr_ah) << 15;
+    negx_imag = (negf_imag & ~fpcr_ah) << 15;
+    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
+    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
 
     do {
         uint64_t pg = g[(i - 1) >> 6];
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_h)(void *vd, void *vn, void *vm, void *va,
             mi = *(float16 *)(vm + H1_2(j));
 
             e2 = (flip ? ni : nr);
-            e1 = (flip ? mi : mr) ^ neg_real;
+            e1 = (flip ? mi : mr) ^ negx_real;
             e4 = e2;
-            e3 = (flip ? mr : mi) ^ neg_imag;
+            e3 = (flip ? mr : mi) ^ negx_imag;
 
             if (likely((pg >> (i & 63)) & 1)) {
                 d = *(float16 *)(va + H1_2(i));
-                d = float16_muladd(e2, e1, d, 0, status);
+                d = float16_muladd(e2, e1, d, negf_real, status);
                 *(float16 *)(vd + H1_2(i)) = d;
             }
             if (likely((pg >> (j & 63)) & 1)) {
                 d = *(float16 *)(va + H1_2(j));
-                d = float16_muladd(e4, e3, d, 0, status);
+                d = float16_muladd(e4, e3, d, negf_imag, status);
                 *(float16 *)(vd + H1_2(j)) = d;
             }
         } while (i & 63);
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
 {
     intptr_t j, i = simd_oprsz(desc);
-    unsigned rot = simd_data(desc);
-    bool flip = rot & 1;
-    float32 neg_imag, neg_real;
+    bool flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
+    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t negf_real = flip ^ negf_imag;
+    float32 negx_imag, negx_real;
     uint64_t *g = vg;
 
-    neg_imag = float32_set_sign(0, (rot & 2) != 0);
-    neg_real = float32_set_sign(0, rot == 1 || rot == 2);
+    /* With AH=0, use negx; with AH=1 use negf. */
+    negx_real = (negf_real & ~fpcr_ah) << 31;
+    negx_imag = (negf_imag & ~fpcr_ah) << 31;
+    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
+    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
 
     do {
         uint64_t pg = g[(i - 1) >> 6];
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_s)(void *vd, void *vn, void *vm, void *va,
             mi = *(float32 *)(vm + H1_2(j));
 
             e2 = (flip ? ni : nr);
-            e1 = (flip ? mi : mr) ^ neg_real;
+            e1 = (flip ? mi : mr) ^ negx_real;
             e4 = e2;
-            e3 = (flip ? mr : mi) ^ neg_imag;
+            e3 = (flip ? mr : mi) ^ negx_imag;
 
             if (likely((pg >> (i & 63)) & 1)) {
                 d = *(float32 *)(va + H1_2(i));
-                d = float32_muladd(e2, e1, d, 0, status);
+                d = float32_muladd(e2, e1, d, negf_real, status);
                 *(float32 *)(vd + H1_2(i)) = d;
             }
             if (likely((pg >> (j & 63)) & 1)) {
                 d = *(float32 *)(va + H1_2(j));
-                d = float32_muladd(e4, e3, d, 0, status);
+                d = float32_muladd(e4, e3, d, negf_imag, status);
                 *(float32 *)(vd + H1_2(j)) = d;
             }
         } while (i & 63);
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
                                void *vg, float_status *status, uint32_t desc)
 {
     intptr_t j, i = simd_oprsz(desc);
-    unsigned rot = simd_data(desc);
-    bool flip = rot & 1;
-    float64 neg_imag, neg_real;
+    bool flip = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint32_t fpcr_ah = extract32(desc, SIMD_DATA_SHIFT + 2, 1);
+    uint32_t negf_imag = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
+    uint32_t negf_real = flip ^ negf_imag;
+    float64 negx_imag, negx_real;
     uint64_t *g = vg;
 
-    neg_imag = float64_set_sign(0, (rot & 2) != 0);
-    neg_real = float64_set_sign(0, rot == 1 || rot == 2);
+    /* With AH=0, use negx; with AH=1 use negf. */
+    negx_real = (uint64_t)(negf_real & ~fpcr_ah) << 63;
+    negx_imag = (uint64_t)(negf_imag & ~fpcr_ah) << 63;
+    negf_real = (negf_real & fpcr_ah ? float_muladd_negate_product : 0);
+    negf_imag = (negf_imag & fpcr_ah ? float_muladd_negate_product : 0);
 
     do {
         uint64_t pg = g[(i - 1) >> 6];
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_fcmla_zpzzz_d)(void *vd, void *vn, void *vm, void *va,
             mi = *(float64 *)(vm + H1_2(j));
 
             e2 = (flip ? ni : nr);
-            e1 = (flip ? mi : mr) ^ neg_real;
+            e1 = (flip ? mi : mr) ^ negx_real;
             e4 = e2;
-            e3 = (flip ? mr : mi) ^ neg_imag;
+            e3 = (flip ? mr : mi) ^ negx_imag;
 
             if (likely((pg >> (i & 63)) & 1)) {
                 d = *(float64 *)(va + H1_2(i));
-                d = float64_muladd(e2, e1, d, 0, status);
+                d = float64_muladd(e2, e1, d, negf_real, status);
                 *(float64 *)(vd + H1_2(i)) = d;
             }
             if (likely((pg >> (j & 63)) & 1)) {
                 d = *(float64 *)(va + H1_2(j));
-                d = float64_muladd(e4, e3, d, 0, status);
+                d = float64_muladd(e4, e3, d, negf_imag, status);
                 *(float64 *)(vd + H1_2(j)) = d;
             }
         } while (i & 63);
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_5_ptr * const fcmla_fns[4] = {
     gen_helper_sve_fcmla_zpzzz_s, gen_helper_sve_fcmla_zpzzz_d,
 };
 TRANS_FEAT(FCMLA_zpzzz, aa64_sve, gen_gvec_fpst_zzzzp, fcmla_fns[a->esz],
-           a->rd, a->rn, a->rm, a->ra, a->pg, a->rot,
+           a->rd, a->rn, a->rm, a->ra, a->pg, a->rot | (s->fpcr_ah << 2),
            a->esz == MO_16 ? FPST_A64_F16 : FPST_A64)
 
 static gen_helper_gvec_4_ptr * const fcmla_idx_fns[4] = {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Handle FPCR.AH's requirement to not negate the sign of a NaN
in FMLSL by element and vector, using the usual trick of
negating by XOR when AH=0 and by muladd flags when AH=1.

Since we have the CPUARMState* in the helper anyway, we can
look directly at env->vfp.fpcr and don't need toa pass in the
FPCR.AH value via the SIMD data word.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250129013857.135256-31-richard.henderson@linaro.org
[PMM: commit message tweaked]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/vec_helper.c | 71 ++++++++++++++++++++++++-------------
 1 file changed, 46 insertions(+), 25 deletions(-)

diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t load4_f16(uint64_t *ptr, int is_q, int is_2)
  */
 
 static void do_fmlal(float32 *d, void *vn, void *vm, float_status *fpst,
-                     uint32_t desc, bool fz16)
+                     uint64_t negx, int negf, uint32_t desc, bool fz16)
 {
     intptr_t i, oprsz = simd_oprsz(desc);
-    int is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
     int is_2 = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
     int is_q = oprsz == 16;
     uint64_t n_4, m_4;
 
-    /* Pre-load all of the f16 data, avoiding overlap issues.  */
-    n_4 = load4_f16(vn, is_q, is_2);
+    /*
+     * Pre-load all of the f16 data, avoiding overlap issues.
+     * Negate all inputs for AH=0 FMLSL at once.
+     */
+    n_4 = load4_f16(vn, is_q, is_2) ^ negx;
     m_4 = load4_f16(vm, is_q, is_2);
 
-    /* Negate all inputs for FMLSL at once.  */
-    if (is_s) {
-        n_4 ^= 0x8000800080008000ull;
-    }
-
     for (i = 0; i < oprsz / 4; i++) {
         float32 n_1 = float16_to_float32_by_bits(n_4 >> (i * 16), fz16);
         float32 m_1 = float16_to_float32_by_bits(m_4 >> (i * 16), fz16);
-        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], 0, fpst);
+        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], negf, fpst);
     }
     clear_tail(d, oprsz, simd_maxsz(desc));
 }
@@ -XXX,XX +XXX,XX @@ static void do_fmlal(float32 *d, void *vn, void *vm, float_status *fpst,
 void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
                             CPUARMState *env, uint32_t desc)
 {
-    do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, desc,
+    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint64_t negx = is_s ? 0x8000800080008000ull : 0;
+
+    do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, negx, 0, desc,
              get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
 }
 
 void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
                             CPUARMState *env, uint32_t desc)
 {
-    do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint64_t negx = 0;
+    int negf = 0;
+
+    if (is_s) {
+        if (env->vfp.fpcr & FPCR_AH) {
+            negf = float_muladd_negate_product;
+        } else {
+            negx = 0x8000800080008000ull;
+        }
+    }
+    do_fmlal(vd, vn, vm, &env->vfp.fp_status_a64, negx, negf, desc,
              get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
 }
 
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
 }
 
 static void do_fmlal_idx(float32 *d, void *vn, void *vm, float_status *fpst,
-                         uint32_t desc, bool fz16)
+                         uint64_t negx, int negf, uint32_t desc, bool fz16)
 {
     intptr_t i, oprsz = simd_oprsz(desc);
-    int is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
     int is_2 = extract32(desc, SIMD_DATA_SHIFT + 1, 1);
     int index = extract32(desc, SIMD_DATA_SHIFT + 2, 3);
     int is_q = oprsz == 16;
     uint64_t n_4;
     float32 m_1;
 
-    /* Pre-load all of the f16 data, avoiding overlap issues.  */
-    n_4 = load4_f16(vn, is_q, is_2);
-
-    /* Negate all inputs for FMLSL at once.  */
-    if (is_s) {
-        n_4 ^= 0x8000800080008000ull;
-    }
-
+    /*
+     * Pre-load all of the f16 data, avoiding overlap issues.
+     * Negate all inputs for AH=0 FMLSL at once.
+     */
+    n_4 = load4_f16(vn, is_q, is_2) ^ negx;
     m_1 = float16_to_float32_by_bits(((float16 *)vm)[H2(index)], fz16);
 
     for (i = 0; i < oprsz / 4; i++) {
         float32 n_1 = float16_to_float32_by_bits(n_4 >> (i * 16), fz16);
-        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], 0, fpst);
+        d[H4(i)] = float32_muladd(n_1, m_1, d[H4(i)], negf, fpst);
     }
     clear_tail(d, oprsz, simd_maxsz(desc));
 }
@@ -XXX,XX +XXX,XX @@ static void do_fmlal_idx(float32 *d, void *vn, void *vm, float_status *fpst,
 void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
                                 CPUARMState *env, uint32_t desc)
 {
-    do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, desc,
+    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint64_t negx = is_s ? 0x8000800080008000ull : 0;
+
+    do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, negx, 0, desc,
                  get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
 }
 
 void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
                                 CPUARMState *env, uint32_t desc)
 {
-    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, desc,
+    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
+    uint64_t negx = 0;
+    int negf = 0;
+
+    if (is_s) {
+        if (env->vfp.fpcr & FPCR_AH) {
+            negf = float_muladd_negate_product;
+        } else {
+            negx = 0x8000800080008000ull;
+        }
+    }
+    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status_a64, negx, negf, desc,
                  get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64));
 }
 
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Handle FPCR.AH's requirement to not negate the sign of a NaN in SVE
FMLSL (indexed), using the usual trick of negating by XOR when AH=0
and by muladd flags when AH=1.

Since we have the CPUARMState* in the helper anyway, we can
look directly at env->vfp.fpcr and don't need toa pass in the
FPCR.AH value via the SIMD data word.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250129013857.135256-32-richard.henderson@linaro.org
[PMM: commit message tweaked]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/vec_helper.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
                                CPUARMState *env, uint32_t desc)
 {
     intptr_t i, j, oprsz = simd_oprsz(desc);
-    uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
+    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
     float_status *status = &env->vfp.fp_status_a64;
     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
+    int negx = 0, negf = 0;
+
+    if (is_s) {
+        if (env->vfp.fpcr & FPCR_AH) {
+            negf = float_muladd_negate_product;
+        } else {
+            negx = 0x8000;
+        }
+    }
 
     for (i = 0; i < oprsz; i += 16) {
         float16 mm_16 = *(float16 *)(vm + i + idx);
         float32 mm = float16_to_float32_by_bits(mm_16, fz16);
 
         for (j = 0; j < 16; j += sizeof(float32)) {
-            float16 nn_16 = *(float16 *)(vn + H1_2(i + j + sel)) ^ negn;
+            float16 nn_16 = *(float16 *)(vn + H1_2(i + j + sel)) ^ negx;
             float32 nn = float16_to_float32_by_bits(nn_16, fz16);
             float32 aa = *(float32 *)(va + H1_4(i + j));
 
             *(float32 *)(vd + H1_4(i + j)) =
-                float32_muladd(nn, mm, aa, 0, status);
+                float32_muladd(nn, mm, aa, negf, status);
         }
     }
 }
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Handle FPCR.AH's requirement to not negate the sign of a NaN in SVE
FMLSL (indexed), using the usual trick of negating by XOR when AH=0
and by muladd flags when AH=1.

Since we have the CPUARMState* in the helper anyway, we can
look directly at env->vfp.fpcr and don't need toa pass in the
FPCR.AH value via the SIMD data word.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250129013857.135256-33-richard.henderson@linaro.org
[PMM: tweaked commit message]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/vec_helper.c | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
                                CPUARMState *env, uint32_t desc)
 {
     intptr_t i, oprsz = simd_oprsz(desc);
-    uint16_t negn = extract32(desc, SIMD_DATA_SHIFT, 1) << 15;
+    bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     float_status *status = &env->vfp.fp_status_a64;
     bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a64);
+    int negx = 0, negf = 0;
+
+    if (is_s) {
+        if (env->vfp.fpcr & FPCR_AH) {
+            negf = float_muladd_negate_product;
+        } else {
+            negx = 0x8000;
+        }
+    }
 
     for (i = 0; i < oprsz; i += sizeof(float32)) {
-        float16 nn_16 = *(float16 *)(vn + H1_2(i + sel)) ^ negn;
+        float16 nn_16 = *(float16 *)(vn + H1_2(i + sel)) ^ negx;
         float16 mm_16 = *(float16 *)(vm + H1_2(i + sel));
         float32 nn = float16_to_float32_by_bits(nn_16, fz16);
         float32 mm = float16_to_float32_by_bits(mm_16, fz16);
         float32 aa = *(float32 *)(va + H1_4(i));
 
-        *(float32 *)(vd + H1_4(i)) = float32_muladd(nn, mm, aa, 0, status);
+        *(float32 *)(vd + H1_4(i)) = float32_muladd(nn, mm, aa, negf, status);
     }
 }
 
-- 
2.34.1

Now that we have completed the handling for FPCR.{AH,FIZ,NEP}, we
can enable FEAT_AFP for '-cpu max', and document that we support it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/tcg/cpu64.c        | 1 +
 2 files changed, 2 insertions(+)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_AA64EL3 (Support for AArch64 at EL3)
 - FEAT_AdvSIMD (Advanced SIMD Extension)
 - FEAT_AES (AESD and AESE instructions)
+- FEAT_AFP (Alternate floating-point behavior)
 - FEAT_Armv9_Crypto (Armv9 Cryptographic Extension)
 - FEAT_ASID16 (16 bit ASID)
 - FEAT_BBM at level 2 (Translation table break-before-make levels)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1);      /* FEAT_XNX */
     t = FIELD_DP64(t, ID_AA64MMFR1, ETS, 2);      /* FEAT_ETS2 */
     t = FIELD_DP64(t, ID_AA64MMFR1, HCX, 1);      /* FEAT_HCX */
+    t = FIELD_DP64(t, ID_AA64MMFR1, AFP, 1);      /* FEAT_AFP */
     t = FIELD_DP64(t, ID_AA64MMFR1, TIDCP1, 1);   /* FEAT_TIDCP1 */
     t = FIELD_DP64(t, ID_AA64MMFR1, CMOW, 1);     /* FEAT_CMOW */
     cpu->isar.id_aa64mmfr1 = t;
-- 
2.34.1

FEAT_RPRES implements an "increased precision" variant of the single
precision FRECPE and FRSQRTE instructions from an 8 bit to a 12
bit mantissa. This applies only when FPCR.AH == 1. Note that the
halfprec and double versions of these insns retain the 8 bit
precision regardless.

In this commit we add all the plumbing to make these instructions
call a new helper function when the increased-precision is in
effect. In the following commit we will provide the actual change
in behaviour in the helpers.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu-features.h      |  5 +++++
 target/arm/helper.h            |  4 ++++
 target/arm/tcg/translate-a64.c | 34 ++++++++++++++++++++++++++++++----
 target/arm/tcg/translate-sve.c | 16 ++++++++++++++--
 target/arm/tcg/vec_helper.c    |  2 ++
 target/arm/vfp_helper.c        | 32 ++++++++++++++++++++++++++++++--
 6 files changed, 85 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_mops(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, MOPS);
 }
 
+static inline bool isar_feature_aa64_rpres(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64isar2, ID_AA64ISAR2, RPRES);
+}
+
 static inline bool isar_feature_aa64_fp_simd(const ARMISARegisters *id)
 {
     /* We always set the AdvSIMD and FP fields identically.  */
diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_4(vfp_muladdh, f16, f16, f16, f16, fpst)
 
 DEF_HELPER_FLAGS_2(recpe_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
 DEF_HELPER_FLAGS_2(recpe_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
+DEF_HELPER_FLAGS_2(recpe_rpres_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
 DEF_HELPER_FLAGS_2(recpe_f64, TCG_CALL_NO_RWG, f64, f64, fpst)
 DEF_HELPER_FLAGS_2(rsqrte_f16, TCG_CALL_NO_RWG, f16, f16, fpst)
 DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
+DEF_HELPER_FLAGS_2(rsqrte_rpres_f32, TCG_CALL_NO_RWG, f32, f32, fpst)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, fpst)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_4(gvec_vrintx_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_4(gvec_frecpe_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(gvec_frecpe_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_frecpe_rpres_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(gvec_frecpe_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_4(gvec_frsqrte_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(gvec_frsqrte_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
+DEF_HELPER_FLAGS_4(gvec_frsqrte_rpres_s, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 DEF_HELPER_FLAGS_4(gvec_frsqrte_d, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
 
 DEF_HELPER_FLAGS_4(gvec_fcgt0_h, TCG_CALL_NO_RWG, void, ptr, ptr, fpst, i32)
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static const FPScalar1 f_scalar_frecpe = {
     gen_helper_recpe_f32,
     gen_helper_recpe_f64,
 };
-TRANS(FRECPE_s, do_fp1_scalar_ah, a, &f_scalar_frecpe, -1)
+static const FPScalar1 f_scalar_frecpe_rpres = {
+    gen_helper_recpe_f16,
+    gen_helper_recpe_rpres_f32,
+    gen_helper_recpe_f64,
+};
+TRANS(FRECPE_s, do_fp1_scalar_ah, a,
+      s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ?
+      &f_scalar_frecpe_rpres : &f_scalar_frecpe, -1)
 
 static const FPScalar1 f_scalar_frecpx = {
     gen_helper_frecpx_f16,
@@ -XXX,XX +XXX,XX @@ static const FPScalar1 f_scalar_frsqrte = {
     gen_helper_rsqrte_f32,
     gen_helper_rsqrte_f64,
 };
-TRANS(FRSQRTE_s, do_fp1_scalar_ah, a, &f_scalar_frsqrte, -1)
+static const FPScalar1 f_scalar_frsqrte_rpres = {
+    gen_helper_rsqrte_f16,
+    gen_helper_rsqrte_rpres_f32,
+    gen_helper_rsqrte_f64,
+};
+TRANS(FRSQRTE_s, do_fp1_scalar_ah, a,
+      s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ?
+      &f_scalar_frsqrte_rpres : &f_scalar_frsqrte, -1)
 
 static bool trans_FCVT_s_ds(DisasContext *s, arg_rr *a)
 {
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_2_ptr * const f_frecpe[] = {
     gen_helper_gvec_frecpe_s,
     gen_helper_gvec_frecpe_d,
 };
-TRANS(FRECPE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frecpe)
+static gen_helper_gvec_2_ptr * const f_frecpe_rpres[] = {
+    gen_helper_gvec_frecpe_h,
+    gen_helper_gvec_frecpe_rpres_s,
+    gen_helper_gvec_frecpe_d,
+};
+TRANS(FRECPE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0,
+      s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ? f_frecpe_rpres : f_frecpe)
 
 static gen_helper_gvec_2_ptr * const f_frsqrte[] = {
     gen_helper_gvec_frsqrte_h,
     gen_helper_gvec_frsqrte_s,
     gen_helper_gvec_frsqrte_d,
 };
-TRANS(FRSQRTE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0, f_frsqrte)
+static gen_helper_gvec_2_ptr * const f_frsqrte_rpres[] = {
+    gen_helper_gvec_frsqrte_h,
+    gen_helper_gvec_frsqrte_rpres_s,
+    gen_helper_gvec_frsqrte_d,
+};
+TRANS(FRSQRTE_v, do_gvec_op2_ah_fpst, a->esz, a->q, a->rd, a->rn, 0,
+      s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ? f_frsqrte_rpres : f_frsqrte)
 
 static bool trans_FCVTL_v(DisasContext *s, arg_qrr_e *a)
 {
diff --git a/target/arm/tcg/translate-sve.c b/target/arm/tcg/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-sve.c
+++ b/target/arm/tcg/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static gen_helper_gvec_2_ptr * const frecpe_fns[] = {
     NULL,                     gen_helper_gvec_frecpe_h,
     gen_helper_gvec_frecpe_s, gen_helper_gvec_frecpe_d,
 };
-TRANS_FEAT(FRECPE, aa64_sve, gen_gvec_fpst_ah_arg_zz, frecpe_fns[a->esz], a, 0)
+static gen_helper_gvec_2_ptr * const frecpe_rpres_fns[] = {
+    NULL,                           gen_helper_gvec_frecpe_h,
+    gen_helper_gvec_frecpe_rpres_s, gen_helper_gvec_frecpe_d,
+};
+TRANS_FEAT(FRECPE, aa64_sve, gen_gvec_fpst_ah_arg_zz,
+           s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ?
+           frecpe_rpres_fns[a->esz] : frecpe_fns[a->esz], a, 0)
 
 static gen_helper_gvec_2_ptr * const frsqrte_fns[] = {
     NULL,                      gen_helper_gvec_frsqrte_h,
     gen_helper_gvec_frsqrte_s, gen_helper_gvec_frsqrte_d,
 };
-TRANS_FEAT(FRSQRTE, aa64_sve, gen_gvec_fpst_ah_arg_zz, frsqrte_fns[a->esz], a, 0)
+static gen_helper_gvec_2_ptr * const frsqrte_rpres_fns[] = {
+    NULL,                            gen_helper_gvec_frsqrte_h,
+    gen_helper_gvec_frsqrte_rpres_s, gen_helper_gvec_frsqrte_d,
+};
+TRANS_FEAT(FRSQRTE, aa64_sve, gen_gvec_fpst_ah_arg_zz,
+           s->fpcr_ah && dc_isar_feature(aa64_rpres, s) ?
+           frsqrte_rpres_fns[a->esz] : frsqrte_fns[a->esz], a, 0)
 
 /*
  *** SVE Floating Point Compare with Zero Group
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *vn, float_status *stat, uint32_t desc)  \
 
 DO_2OP(gvec_frecpe_h, helper_recpe_f16, float16)
 DO_2OP(gvec_frecpe_s, helper_recpe_f32, float32)
+DO_2OP(gvec_frecpe_rpres_s, helper_recpe_rpres_f32, float32)
 DO_2OP(gvec_frecpe_d, helper_recpe_f64, float64)
 
 DO_2OP(gvec_frsqrte_h, helper_rsqrte_f16, float16)
 DO_2OP(gvec_frsqrte_s, helper_rsqrte_f32, float32)
+DO_2OP(gvec_frsqrte_rpres_s, helper_rsqrte_rpres_f32, float32)
 DO_2OP(gvec_frsqrte_d, helper_rsqrte_f64, float64)
 
 DO_2OP(gvec_vrintx_h, float16_round_to_int, float16)
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(recpe_f16)(uint32_t input, float_status *fpst)
     return make_float16(f16_val);
 }
 
-float32 HELPER(recpe_f32)(float32 input, float_status *fpst)
+/*
+ * FEAT_RPRES means the f32 FRECPE has an "increased precision" variant
+ * which is used when FPCR.AH == 1.
+ */
+static float32 do_recpe_f32(float32 input, float_status *fpst, bool rpres)
 {
     float32 f32 = float32_squash_input_denormal(input, fpst);
     uint32_t f32_val = float32_val(f32);
@@ -XXX,XX +XXX,XX @@ float32 HELPER(recpe_f32)(float32 input, float_status *fpst)
     return make_float32(f32_val);
 }
 
+float32 HELPER(recpe_f32)(float32 input, float_status *fpst)
+{
+    return do_recpe_f32(input, fpst, false);
+}
+
+float32 HELPER(recpe_rpres_f32)(float32 input, float_status *fpst)
+{
+    return do_recpe_f32(input, fpst, true);
+}
+
 float64 HELPER(recpe_f64)(float64 input, float_status *fpst)
 {
     float64 f64 = float64_squash_input_denormal(input, fpst);
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(rsqrte_f16)(uint32_t input, float_status *s)
     return make_float16(val);
 }
 
-float32 HELPER(rsqrte_f32)(float32 input, float_status *s)
+/*
+ * FEAT_RPRES means the f32 FRSQRTE has an "increased precision" variant
+ * which is used when FPCR.AH == 1.
+ */
+static float32 do_rsqrte_f32(float32 input, float_status *s, bool rpres)
 {
     float32 f32 = float32_squash_input_denormal(input, s);
     uint32_t val = float32_val(f32);
@@ -XXX,XX +XXX,XX @@ float32 HELPER(rsqrte_f32)(float32 input, float_status *s)
     return make_float32(val);
 }
 
+float32 HELPER(rsqrte_f32)(float32 input, float_status *s)
+{
+    return do_rsqrte_f32(input, s, false);
+}
+
+float32 HELPER(rsqrte_rpres_f32)(float32 input, float_status *s)
+{
+    return do_rsqrte_f32(input, s, true);
+}
+
 float64 HELPER(rsqrte_f64)(float64 input, float_status *s)
 {
     float64 f64 = float64_squash_input_denormal(input, s);
-- 
2.34.1

Implement the increased precision variation of FRECPE.  In the
pseudocode this corresponds to the handling of the
"increasedprecision" boolean in the FPRecipEstimate() and
RecipEstimate() functions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/vfp_helper.c | 54 +++++++++++++++++++++++++++++++++++------
 1 file changed, 46 insertions(+), 8 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static int recip_estimate(int input)
     return r;
 }
 
+/*
+ * Increased precision version:
+ * input is a 13 bit fixed point number
+ * input range 2048 .. 4095 for a number from 0.5 <= x < 1.0.
+ * result range 4096 .. 8191 for a number from 1.0 to 2.0
+ */
+static int recip_estimate_incprec(int input)
+{
+    int a, b, r;
+    assert(2048 <= input && input < 4096);
+    a = (input * 2) + 1;
+    /*
+     * The pseudocode expresses this as an operation on infinite
+     * precision reals where it calculates 2^25 / a and then looks
+     * at the error between that and the rounded-down-to-integer
+     * value to see if it should instead round up. We instead
+     * follow the same approach as the pseudocode for the 8-bit
+     * precision version, and calculate (2 * (2^25 / a)) as an
+     * integer so we can do the "add one and halve" to round it.
+     * So the 1 << 26 here is correct.
+     */
+    b = (1 << 26) / a;
+    r = (b + 1) >> 1;
+    assert(4096 <= r && r < 8192);
+    return r;
+}
+
 /*
  * Common wrapper to call recip_estimate
  *
@@ -XXX,XX +XXX,XX @@ static int recip_estimate(int input)
  * callee.
  */
 
-static uint64_t call_recip_estimate(int *exp, int exp_off, uint64_t frac)
+static uint64_t call_recip_estimate(int *exp, int exp_off, uint64_t frac,
+                                    bool increasedprecision)
 {
     uint32_t scaled, estimate;
     uint64_t result_frac;
@@ -XXX,XX +XXX,XX @@ static uint64_t call_recip_estimate(int *exp, int exp_off, uint64_t frac)
         }
     }
 
-    /* scaled = UInt('1':fraction<51:44>) */
-    scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8));
-    estimate = recip_estimate(scaled);
+    if (increasedprecision) {
+        /* scaled = UInt('1':fraction<51:41>) */
+        scaled = deposit32(1 << 11, 0, 11, extract64(frac, 41, 11));
+        estimate = recip_estimate_incprec(scaled);
+    } else {
+        /* scaled = UInt('1':fraction<51:44>) */
+        scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8));
+        estimate = recip_estimate(scaled);
+    }
 
     result_exp = exp_off - *exp;
-    result_frac = deposit64(0, 44, 8, estimate);
+    if (increasedprecision) {
+        result_frac = deposit64(0, 40, 12, estimate);
+    } else {
+        result_frac = deposit64(0, 44, 8, estimate);
+    }
     if (result_exp == 0) {
         result_frac = deposit64(result_frac >> 1, 51, 1, 1);
     } else if (result_exp == -1) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(recpe_f16)(uint32_t input, float_status *fpst)
     }
 
     f64_frac = call_recip_estimate(&f16_exp, 29,
-                                   ((uint64_t) f16_frac) << (52 - 10));
+                                   ((uint64_t) f16_frac) << (52 - 10), false);
 
     /* result = sign : result_exp<4:0> : fraction<51:42> */
     f16_val = deposit32(0, 15, 1, f16_sign);
@@ -XXX,XX +XXX,XX @@ static float32 do_recpe_f32(float32 input, float_status *fpst, bool rpres)
     }
 
     f64_frac = call_recip_estimate(&f32_exp, 253,
-                                   ((uint64_t) f32_frac) << (52 - 23));
+                                   ((uint64_t) f32_frac) << (52 - 23), rpres);
 
     /* result = sign : result_exp<7:0> : fraction<51:29> */
     f32_val = deposit32(0, 31, 1, f32_sign);
@@ -XXX,XX +XXX,XX @@ float64 HELPER(recpe_f64)(float64 input, float_status *fpst)
         return float64_set_sign(float64_zero, float64_is_neg(f64));
     }
 
-    f64_frac = call_recip_estimate(&f64_exp, 2045, f64_frac);
+    f64_frac = call_recip_estimate(&f64_exp, 2045, f64_frac, false);
 
     /* result = sign : result_exp<10:0> : fraction<51:0>; */
     f64_val = deposit64(0, 63, 1, f64_sign);
-- 
2.34.1

Implement the increased precision variation of FRSQRTE.  In the
pseudocode this corresponds to the handling of the
"increasedprecision" boolean in the FPRSqrtEstimate() and
RecipSqrtEstimate() functions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/vfp_helper.c | 77 ++++++++++++++++++++++++++++++++++-------
 1 file changed, 64 insertions(+), 13 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static int do_recip_sqrt_estimate(int a)
     return estimate;
 }
 
+static int do_recip_sqrt_estimate_incprec(int a)
+{
+    /*
+     * The Arm ARM describes the 12-bit precision version of RecipSqrtEstimate
+     * in terms of an infinite-precision floating point calculation of a
+     * square root. We implement this using the same kind of pure integer
+     * algorithm as the 8-bit mantissa, to get the same bit-for-bit result.
+     */
+    int64_t b, estimate;
 
-static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac)
+    assert(1024 <= a && a < 4096);
+    if (a < 2048) {
+        a = a * 2 + 1;
+    } else {
+        a = (a >> 1) << 1;
+        a = (a + 1) * 2;
+    }
+    b = 8192;
+    while (a * (b + 1) * (b + 1) < (1ULL << 39)) {
+        b += 1;
+    }
+    estimate = (b + 1) / 2;
+
+    assert(4096 <= estimate && estimate < 8192);
+
+    return estimate;
+}
+
+static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac,
+                                    bool increasedprecision)
 {
     int estimate;
     uint32_t scaled;
@@ -XXX,XX +XXX,XX @@ static uint64_t recip_sqrt_estimate(int *exp , int exp_off, uint64_t frac)
         frac = extract64(frac, 0, 51) << 1;
     }
 
-    if (*exp & 1) {
-        /* scaled = UInt('01':fraction<51:45>) */
-        scaled = deposit32(1 << 7, 0, 7, extract64(frac, 45, 7));
+    if (increasedprecision) {
+        if (*exp & 1) {
+            /* scaled = UInt('01':fraction<51:42>) */
+            scaled = deposit32(1 << 10, 0, 10, extract64(frac, 42, 10));
+        } else {
+            /* scaled = UInt('1':fraction<51:41>) */
+            scaled = deposit32(1 << 11, 0, 11, extract64(frac, 41, 11));
+        }
+        estimate = do_recip_sqrt_estimate_incprec(scaled);
     } else {
-        /* scaled = UInt('1':fraction<51:44>) */
-        scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8));
+        if (*exp & 1) {
+            /* scaled = UInt('01':fraction<51:45>) */
+            scaled = deposit32(1 << 7, 0, 7, extract64(frac, 45, 7));
+        } else {
+            /* scaled = UInt('1':fraction<51:44>) */
+            scaled = deposit32(1 << 8, 0, 8, extract64(frac, 44, 8));
+        }
+        estimate = do_recip_sqrt_estimate(scaled);
     }
-    estimate = do_recip_sqrt_estimate(scaled);
 
     *exp = (exp_off - *exp) / 2;
-    return extract64(estimate, 0, 8) << 44;
+    if (increasedprecision) {
+        return extract64(estimate, 0, 12) << 40;
+    } else {
+        return extract64(estimate, 0, 8) << 44;
+    }
 }
 
 uint32_t HELPER(rsqrte_f16)(uint32_t input, float_status *s)
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(rsqrte_f16)(uint32_t input, float_status *s)
 
     f64_frac = ((uint64_t) f16_frac) << (52 - 10);
 
-    f64_frac = recip_sqrt_estimate(&f16_exp, 44, f64_frac);
+    f64_frac = recip_sqrt_estimate(&f16_exp, 44, f64_frac, false);
 
     /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(2) */
     val = deposit32(0, 15, 1, f16_sign);
@@ -XXX,XX +XXX,XX @@ static float32 do_rsqrte_f32(float32 input, float_status *s, bool rpres)
 
     f64_frac = ((uint64_t) f32_frac) << 29;
 
-    f64_frac = recip_sqrt_estimate(&f32_exp, 380, f64_frac);
+    f64_frac = recip_sqrt_estimate(&f32_exp, 380, f64_frac, rpres);
 
-    /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(15) */
+    /*
+     * result = sign : result_exp<7:0> : estimate<7:0> : Zeros(15)
+     * or for increased precision
+     * result = sign : result_exp<7:0> : estimate<11:0> : Zeros(11)
+     */
     val = deposit32(0, 31, 1, f32_sign);
     val = deposit32(val, 23, 8, f32_exp);
-    val = deposit32(val, 15, 8, extract64(f64_frac, 52 - 8, 8));
+    if (rpres) {
+        val = deposit32(val, 11, 12, extract64(f64_frac, 52 - 12, 12));
+    } else {
+        val = deposit32(val, 15, 8, extract64(f64_frac, 52 - 8, 8));
+    }
     return make_float32(val);
 }
 
@@ -XXX,XX +XXX,XX @@ float64 HELPER(rsqrte_f64)(float64 input, float_status *s)
         return float64_zero;
     }
 
-    f64_frac = recip_sqrt_estimate(&f64_exp, 3068, f64_frac);
+    f64_frac = recip_sqrt_estimate(&f64_exp, 3068, f64_frac, false);
 
     /* result = sign : result_exp<4:0> : estimate<7:0> : Zeros(44) */
     val = deposit64(0, 61, 1, f64_sign);
-- 
2.34.1

Now the emulation is complete, we can enable FEAT_RPRES for the 'max'
CPU type.

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_RDM (Advanced SIMD rounding double multiply accumulate instructions)
 - FEAT_RME (Realm Management Extension) (NB: support status in QEMU is experimental)
 - FEAT_RNG (Random number generator)
+- FEAT_RPRES (Increased precision of FRECPE and FRSQRTE)
 - FEAT_S2FWB (Stage 2 forced Write-Back)
 - FEAT_SB (Speculation Barrier)
 - FEAT_SEL2 (Secure EL2)
diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -XXX,XX +XXX,XX @@ void aarch64_max_tcg_initfn(Object *obj)
     cpu->isar.id_aa64isar1 = t;
 
     t = cpu->isar.id_aa64isar2;
+    t = FIELD_DP64(t, ID_AA64ISAR2, RPRES, 1);    /* FEAT_RPRES */
     t = FIELD_DP64(t, ID_AA64ISAR2, MOPS, 1);     /* FEAT_MOPS */
     t = FIELD_DP64(t, ID_AA64ISAR2, BC, 1);       /* FEAT_HBC */
     t = FIELD_DP64(t, ID_AA64ISAR2, WFXT, 2);     /* FEAT_WFxT */
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Move ARMFPStatusFlavour to cpu.h with which to index
this array.  For now, place the array in an anonymous
union with the existing structures.  Adjust the order
of the existing structures to match the enum.

Simplify fpstatus_ptr() using the new array.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250129013857.135256-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           | 119 +++++++++++++++++++++----------------
 target/arm/tcg/translate.h |  64 +-------------------
 2 files changed, 70 insertions(+), 113 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
 
 typedef struct NVICState NVICState;
 
+/*
+ * Enum for indexing vfp.fp_status[].
+ *
+ * FPST_A32: is the "normal" fp status for AArch32 insns
+ * FPST_A64: is the "normal" fp status for AArch64 insns
+ * FPST_A32_F16: used for AArch32 half-precision calculations
+ * FPST_A64_F16: used for AArch64 half-precision calculations
+ * FPST_STD: the ARM "Standard FPSCR Value"
+ * FPST_STD_F16: used for half-precision
+ *       calculations with the ARM "Standard FPSCR Value"
+ * FPST_AH: used for the A64 insns which change behaviour
+ *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
+ *       and the reciprocal and square root estimate/step insns)
+ * FPST_AH_F16: used for the A64 insns which change behaviour
+ *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
+ *       and the reciprocal and square root estimate/step insns);
+ *       for half-precision
+ *
+ * Half-precision operations are governed by a separate
+ * flush-to-zero control bit in FPSCR:FZ16. We pass a separate
+ * status structure to control this.
+ *
+ * The "Standard FPSCR", ie default-NaN, flush-to-zero,
+ * round-to-nearest and is used by any operations (generally
+ * Neon) which the architecture defines as controlled by the
+ * standard FPSCR value rather than the FPSCR.
+ *
+ * The "standard FPSCR but for fp16 ops" is needed because
+ * the "standard FPSCR" tracks the FPSCR.FZ16 bit rather than
+ * using a fixed value for it.
+ *
+ * The ah_fp_status is needed because some insns have different
+ * behaviour when FPCR.AH == 1: they don't update cumulative
+ * exception flags, they act like FPCR.{FZ,FIZ} = {1,1} and
+ * they ignore FPCR.RMode. But they don't ignore FPCR.FZ16,
+ * which means we need an ah_fp_status_f16 as well.
+ *
+ * To avoid having to transfer exception bits around, we simply
+ * say that the FPSCR cumulative exception flags are the logical
+ * OR of the flags in the four fp statuses. This relies on the
+ * only thing which needs to read the exception flags being
+ * an explicit FPSCR read.
+ */
+typedef enum ARMFPStatusFlavour {
+    FPST_A32,
+    FPST_A64,
+    FPST_A32_F16,
+    FPST_A64_F16,
+    FPST_AH,
+    FPST_AH_F16,
+    FPST_STD,
+    FPST_STD_F16,
+} ARMFPStatusFlavour;
+#define FPST_COUNT  8
+
 typedef struct CPUArchState {
     /* Regs for current mode.  */
     uint32_t regs[16];
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         /* Scratch space for aa32 neon expansion.  */
         uint32_t scratch[8];
 
-        /* There are a number of distinct float control structures:
-         *
-         *  fp_status_a32: is the "normal" fp status for AArch32 insns
-         *  fp_status_a64: is the "normal" fp status for AArch64 insns
-         *  fp_status_fp16_a32: used for AArch32 half-precision calculations
-         *  fp_status_fp16_a64: used for AArch64 half-precision calculations
-         *  standard_fp_status : the ARM "Standard FPSCR Value"
-         *  standard_fp_status_fp16 : used for half-precision
-         *       calculations with the ARM "Standard FPSCR Value"
-         *  ah_fp_status: used for the A64 insns which change behaviour
-         *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
-         *       and the reciprocal and square root estimate/step insns)
-         *  ah_fp_status_f16: used for the A64 insns which change behaviour
-         *       when FPCR.AH == 1 (bfloat16 conversions and multiplies,
-         *       and the reciprocal and square root estimate/step insns);
-         *       for half-precision
-         *
-         * Half-precision operations are governed by a separate
-         * flush-to-zero control bit in FPSCR:FZ16. We pass a separate
-         * status structure to control this.
-         *
-         * The "Standard FPSCR", ie default-NaN, flush-to-zero,
-         * round-to-nearest and is used by any operations (generally
-         * Neon) which the architecture defines as controlled by the
-         * standard FPSCR value rather than the FPSCR.
-         *
-         * The "standard FPSCR but for fp16 ops" is needed because
-         * the "standard FPSCR" tracks the FPSCR.FZ16 bit rather than
-         * using a fixed value for it.
-         *
-         * The ah_fp_status is needed because some insns have different
-         * behaviour when FPCR.AH == 1: they don't update cumulative
-         * exception flags, they act like FPCR.{FZ,FIZ} = {1,1} and
-         * they ignore FPCR.RMode. But they don't ignore FPCR.FZ16,
-         * which means we need an ah_fp_status_f16 as well.
-         *
-         * To avoid having to transfer exception bits around, we simply
-         * say that the FPSCR cumulative exception flags are the logical
-         * OR of the flags in the four fp statuses. This relies on the
-         * only thing which needs to read the exception flags being
-         * an explicit FPSCR read.
-         */
-        float_status fp_status_a32;
-        float_status fp_status_a64;
-        float_status fp_status_f16_a32;
-        float_status fp_status_f16_a64;
-        float_status standard_fp_status;
-        float_status standard_fp_status_f16;
-        float_status ah_fp_status;
-        float_status ah_fp_status_f16;
+        /* There are a number of distinct float control structures. */
+        union {
+            float_status fp_status[FPST_COUNT];
+            struct {
+                float_status fp_status_a32;
+                float_status fp_status_a64;
+                float_status fp_status_f16_a32;
+                float_status fp_status_f16_a64;
+                float_status ah_fp_status;
+                float_status ah_fp_status_f16;
+                float_status standard_fp_status;
+                float_status standard_fp_status_f16;
+            };
+        };
 
         uint64_t zcr_el[4];   /* ZCR_EL[1-3] */
         uint64_t smcr_el[4];  /* SMCR_EL[1-3] */
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ static inline CPUARMTBFlags arm_tbflags_from_tb(const TranslationBlock *tb)
     return (CPUARMTBFlags){ tb->flags, tb->cs_base };
 }
 
-/*
- * Enum for argument to fpstatus_ptr().
- */
-typedef enum ARMFPStatusFlavour {
-    FPST_A32,
-    FPST_A64,
-    FPST_A32_F16,
-    FPST_A64_F16,
-    FPST_AH,
-    FPST_AH_F16,
-    FPST_STD,
-    FPST_STD_F16,
-} ARMFPStatusFlavour;
-
 /**
  * fpstatus_ptr: return TCGv_ptr to the specified fp_status field
  *
  * We have multiple softfloat float_status fields in the Arm CPU state struct
  * (see the comment in cpu.h for details). Return a TCGv_ptr which has
  * been set up to point to the requested field in the CPU state struct.
- * The options are:
- *
- * FPST_A32
- *   for AArch32 non-FP16 operations controlled by the FPCR
- * FPST_A64
- *   for AArch64 non-FP16 operations controlled by the FPCR
- * FPST_A32_F16
- *   for AArch32 operations controlled by the FPCR where FPCR.FZ16 is to be used
- * FPST_A64_F16
- *   for AArch64 operations controlled by the FPCR where FPCR.FZ16 is to be used
- * FPST_AH:
- *   for AArch64 operations which change behaviour when AH=1 (specifically,
- *   bfloat16 conversions and multiplies, and the reciprocal and square root
- *   estimate/step insns)
- * FPST_AH_F16:
- *   ditto, but for half-precision operations
- * FPST_STD
- *   for A32/T32 Neon operations using the "standard FPSCR value"
- * FPST_STD_F16
- *   as FPST_STD, but where FPCR.FZ16 is to be used
  */
 static inline TCGv_ptr fpstatus_ptr(ARMFPStatusFlavour flavour)
 {
     TCGv_ptr statusptr = tcg_temp_new_ptr();
-    int offset;
+    int offset = offsetof(CPUARMState, vfp.fp_status[flavour]);
 
-    switch (flavour) {
-    case FPST_A32:
-        offset = offsetof(CPUARMState, vfp.fp_status_a32);
-        break;
-    case FPST_A64:
-        offset = offsetof(CPUARMState, vfp.fp_status_a64);
-        break;
-    case FPST_A32_F16:
-        offset = offsetof(CPUARMState, vfp.fp_status_f16_a32);
-        break;
-    case FPST_A64_F16:
-        offset = offsetof(CPUARMState, vfp.fp_status_f16_a64);
-        break;
-    case FPST_AH:
-        offset = offsetof(CPUARMState, vfp.ah_fp_status);
-        break;
-    case FPST_AH_F16:
-        offset = offsetof(CPUARMState, vfp.ah_fp_status_f16);
-        break;
-    case FPST_STD:
-        offset = offsetof(CPUARMState, vfp.standard_fp_status);
-        break;
-    case FPST_STD_F16:
-        offset = offsetof(CPUARMState, vfp.standard_fp_status_f16);
-        break;
-    default:
-        g_assert_not_reached();
-    }
     tcg_gen_addi_ptr(statusptr, tcg_env, offset);
     return statusptr;
 }
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Replace with fp_status[FPST_STD_F16].

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250129013857.135256-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h            |  1 -
 target/arm/cpu.c            |  4 ++--
 target/arm/tcg/mve_helper.c | 24 ++++++++++++------------
 target/arm/vfp_helper.c     |  8 ++++----
 4 files changed, 18 insertions(+), 19 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
                 float_status ah_fp_status;
                 float_status ah_fp_status_f16;
                 float_status standard_fp_status;
-                float_status standard_fp_status_f16;
             };
         };
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     set_flush_to_zero(1, &env->vfp.standard_fp_status);
     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status);
-    set_default_nan_mode(1, &env->vfp.standard_fp_status_f16);
+    set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD_F16]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
     arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
-    arm_set_default_fp_behaviours(&env->vfp.standard_fp_status_f16);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD_F16]);
     arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status);
     set_flush_to_zero(1, &env->vfp.ah_fp_status);
     set_flush_inputs_to_zero(1, &env->vfp.ah_fp_status);
diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_VMAXMINA(vminaw, 4, int32_t, uint32_t, DO_MIN)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
+            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                 &env->vfp.standard_fp_status;                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ALL(vminnma, minnuma)
                 r[e] = 0;                                               \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
+            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                 &env->vfp.standard_fp_status;                           \
             if (!(tm & 1)) {                                            \
                 /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_VCADD_FP(vfcadd270s, 4, float32, float32_add, float32_sub)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
+            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                 &env->vfp.standard_fp_status;                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_VFMA(vfmss, 4, float32, true)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE * 2)) == 0) {          \
                 continue;                                               \
             }                                                           \
-            fpst0 = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :   \
+            fpst0 = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :  \
                 &env->vfp.standard_fp_status;                           \
             fpst1 = fpst0;                                              \
             if (!(mask & 1)) {                                          \
@@ -XXX,XX +XXX,XX @@ DO_VCMLA(vcmla270s, 4, float32, 3, DO_VCMLAS)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
+            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                 &env->vfp.standard_fp_status;                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_SCALAR_ALL(vfmul_scalar, mul)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
+            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                 &env->vfp.standard_fp_status;                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ACC_SCALAR(vfmas_scalars, 4, float32, DO_VFMAS_SCALARS)
         TYPE *m = vm;                                           \
         TYPE ra = (TYPE)ra_in;                                  \
         float_status *fpst = (ESIZE == 2) ?                     \
-            &env->vfp.standard_fp_status_f16 :                  \
+            &env->vfp.fp_status[FPST_STD_F16] :                 \
             &env->vfp.standard_fp_status;                       \
         for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {      \
             if (mask & 1) {                                     \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
             if ((mask & emask) == 0) {                                  \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
+            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                 &env->vfp.standard_fp_status;                           \
             if (!(mask & (1 << (e * ESIZE)))) {                         \
                 /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
             if ((mask & emask) == 0) {                                  \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
+            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                 &env->vfp.standard_fp_status;                           \
             if (!(mask & (1 << (e * ESIZE)))) {                         \
                 /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_VCMP_FP_BOTH(vfcmples, vfcmple_scalars, 4, float32, !DO_GT32)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
+            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                 &env->vfp.standard_fp_status;                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
@@ -XXX,XX +XXX,XX @@ DO_VCVT_FIXED(vcvt_fu, 4, uint32_t, helper_vfp_touls_round_to_zero)
         float_status *fpst;                                             \
         float_status scratch_fpst;                                      \
         float_status *base_fpst = (ESIZE == 2) ?                        \
-            &env->vfp.standard_fp_status_f16 :                          \
+            &env->vfp.fp_status[FPST_STD_F16] :                         \
             &env->vfp.standard_fp_status;                               \
         uint32_t prev_rmode = get_float_rounding_mode(base_fpst);       \
         set_float_rounding_mode(rmode, base_fpst);                      \
@@ -XXX,XX +XXX,XX @@ void HELPER(mve_vcvtt_hs)(CPUARMState *env, void *vd, void *vm)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.standard_fp_status_f16 :    \
+            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
                 &env->vfp.standard_fp_status;                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     /* FZ16 does not generate an input denormal exception.  */
     a32_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
           & ~float_flag_input_denormal_flushed);
-    a32_flags |= (get_float_exception_flags(&env->vfp.standard_fp_status_f16)
+    a32_flags |= (get_float_exception_flags(&env->vfp.fp_status[FPST_STD_F16])
           & ~float_flag_input_denormal_flushed);
 
     a64_flags |= get_float_exception_flags(&env->vfp.fp_status_a64);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
     set_float_exception_flags(0, &env->vfp.standard_fp_status);
-    set_float_exception_flags(0, &env->vfp.standard_fp_status_f16);
+    set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD_F16]);
     set_float_exception_flags(0, &env->vfp.ah_fp_status);
     set_float_exception_flags(0, &env->vfp.ah_fp_status_f16);
 }
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         bool ftz_enabled = val & FPCR_FZ16;
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
-        set_flush_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
         set_flush_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.standard_fp_status_f16);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
     }
     if (changed & FPCR_FZ) {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Replace with fp_status[FPST_STD].

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250129013857.135256-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h            |  1 -
 target/arm/cpu.c            |  8 ++++----
 target/arm/tcg/mve_helper.c | 28 ++++++++++++++--------------
 target/arm/tcg/vec_helper.c |  4 ++--
 target/arm/vfp_helper.c     |  4 ++--
 5 files changed, 22 insertions(+), 23 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
                 float_status fp_status_f16_a64;
                 float_status ah_fp_status;
                 float_status ah_fp_status_f16;
-                float_status standard_fp_status;
             };
         };
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
         env->sau.ctrl = 0;
     }
 
-    set_flush_to_zero(1, &env->vfp.standard_fp_status);
-    set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
-    set_default_nan_mode(1, &env->vfp.standard_fp_status);
+    set_flush_to_zero(1, &env->vfp.fp_status[FPST_STD]);
+    set_flush_inputs_to_zero(1, &env->vfp.fp_status[FPST_STD]);
+    set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD]);
     set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD_F16]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_a64);
-    arm_set_default_fp_behaviours(&env->vfp.standard_fp_status);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD_F16]);
diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_VMAXMINA(vminaw, 4, int32_t, uint32_t, DO_MIN)
                 continue;                                               \
             }                                                           \
             fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.standard_fp_status;                           \
+                &env->vfp.fp_status[FPST_STD];                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ALL(vminnma, minnuma)
                 continue;                                               \
             }                                                           \
             fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.standard_fp_status;                           \
+                &env->vfp.fp_status[FPST_STD];                           \
             if (!(tm & 1)) {                                            \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCADD_FP(vfcadd270s, 4, float32, float32_add, float32_sub)
                 continue;                                               \
             }                                                           \
             fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.standard_fp_status;                           \
+                &env->vfp.fp_status[FPST_STD];                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VFMA(vfmss, 4, float32, true)
                 continue;                                               \
             }                                                           \
             fpst0 = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :  \
-                &env->vfp.standard_fp_status;                           \
+                &env->vfp.fp_status[FPST_STD];                           \
             fpst1 = fpst0;                                              \
             if (!(mask & 1)) {                                          \
                 scratch_fpst = *fpst0;                                  \
@@ -XXX,XX +XXX,XX @@ DO_VCMLA(vcmla270s, 4, float32, 3, DO_VCMLAS)
                 continue;                                               \
             }                                                           \
             fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.standard_fp_status;                           \
+                &env->vfp.fp_status[FPST_STD];                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_SCALAR_ALL(vfmul_scalar, mul)
                 continue;                                               \
             }                                                           \
             fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.standard_fp_status;                           \
+                &env->vfp.fp_status[FPST_STD];                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ACC_SCALAR(vfmas_scalars, 4, float32, DO_VFMAS_SCALARS)
         TYPE ra = (TYPE)ra_in;                                  \
         float_status *fpst = (ESIZE == 2) ?                     \
             &env->vfp.fp_status[FPST_STD_F16] :                 \
-            &env->vfp.standard_fp_status;                       \
+            &env->vfp.fp_status[FPST_STD];                       \
         for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {      \
             if (mask & 1) {                                     \
                 TYPE v = m[H##ESIZE(e)];                        \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
                 continue;                                               \
             }                                                           \
             fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.standard_fp_status;                           \
+                &env->vfp.fp_status[FPST_STD];                           \
             if (!(mask & (1 << (e * ESIZE)))) {                         \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
                 continue;                                               \
             }                                                           \
             fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.standard_fp_status;                           \
+                &env->vfp.fp_status[FPST_STD];                           \
             if (!(mask & (1 << (e * ESIZE)))) {                         \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCMP_FP_BOTH(vfcmples, vfcmple_scalars, 4, float32, !DO_GT32)
                 continue;                                               \
             }                                                           \
             fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.standard_fp_status;                           \
+                &env->vfp.fp_status[FPST_STD];                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCVT_FIXED(vcvt_fu, 4, uint32_t, helper_vfp_touls_round_to_zero)
         float_status scratch_fpst;                                      \
         float_status *base_fpst = (ESIZE == 2) ?                        \
             &env->vfp.fp_status[FPST_STD_F16] :                         \
-            &env->vfp.standard_fp_status;                               \
+            &env->vfp.fp_status[FPST_STD];                               \
         uint32_t prev_rmode = get_float_rounding_mode(base_fpst);       \
         set_float_rounding_mode(rmode, base_fpst);                      \
         for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {              \
@@ -XXX,XX +XXX,XX @@ static void do_vcvt_sh(CPUARMState *env, void *vd, void *vm, int top)
     unsigned e;
     float_status *fpst;
     float_status scratch_fpst;
-    float_status *base_fpst = &env->vfp.standard_fp_status;
+    float_status *base_fpst = &env->vfp.fp_status[FPST_STD];
     bool old_fz = get_flush_to_zero(base_fpst);
     set_flush_to_zero(false, base_fpst);
     for (e = 0; e < 16 / 4; e++, mask >>= 4) {
@@ -XXX,XX +XXX,XX @@ static void do_vcvt_hs(CPUARMState *env, void *vd, void *vm, int top)
     unsigned e;
     float_status *fpst;
     float_status scratch_fpst;
-    float_status *base_fpst = &env->vfp.standard_fp_status;
+    float_status *base_fpst = &env->vfp.fp_status[FPST_STD];
     bool old_fiz = get_flush_inputs_to_zero(base_fpst);
     set_flush_inputs_to_zero(false, base_fpst);
     for (e = 0; e < 16 / 4; e++, mask >>= 4) {
@@ -XXX,XX +XXX,XX @@ void HELPER(mve_vcvtt_hs)(CPUARMState *env, void *vd, void *vm)
                 continue;                                               \
             }                                                           \
             fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.standard_fp_status;                           \
+                &env->vfp.fp_status[FPST_STD];                           \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
     bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
     uint64_t negx = is_s ? 0x8000800080008000ull : 0;
 
-    do_fmlal(vd, vn, vm, &env->vfp.standard_fp_status, negx, 0, desc,
+    do_fmlal(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
              get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
 }
 
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
     bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
     uint64_t negx = is_s ? 0x8000800080008000ull : 0;
 
-    do_fmlal_idx(vd, vn, vm, &env->vfp.standard_fp_status, negx, 0, desc,
+    do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
                  get_flush_inputs_to_zero(&env->vfp.fp_status_f16_a32));
 }
 
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     uint32_t a32_flags = 0, a64_flags = 0;
 
     a32_flags |= get_float_exception_flags(&env->vfp.fp_status_a32);
-    a32_flags |= get_float_exception_flags(&env->vfp.standard_fp_status);
+    a32_flags |= get_float_exception_flags(&env->vfp.fp_status[FPST_STD]);
     /* FZ16 does not generate an input denormal exception.  */
     a32_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a32)
           & ~float_flag_input_denormal_flushed);
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
     set_float_exception_flags(0, &env->vfp.fp_status_a64);
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a32);
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
-    set_float_exception_flags(0, &env->vfp.standard_fp_status);
+    set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD]);
     set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD_F16]);
     set_float_exception_flags(0, &env->vfp.ah_fp_status);
     set_float_exception_flags(0, &env->vfp.ah_fp_status_f16);
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Replace with fp_status[FPST_AH_F16].

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250129013857.135256-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h        |  3 +--
 target/arm/cpu.c        |  2 +-
 target/arm/vfp_helper.c | 10 +++++-----
 3 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct NVICState NVICState;
  * behaviour when FPCR.AH == 1: they don't update cumulative
  * exception flags, they act like FPCR.{FZ,FIZ} = {1,1} and
  * they ignore FPCR.RMode. But they don't ignore FPCR.FZ16,
- * which means we need an ah_fp_status_f16 as well.
+ * which means we need an FPST_AH_F16 as well.
  *
  * To avoid having to transfer exception bits around, we simply
  * say that the FPSCR cumulative exception flags are the logical
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
                 float_status fp_status_f16_a32;
                 float_status fp_status_f16_a64;
                 float_status ah_fp_status;
-                float_status ah_fp_status_f16;
             };
         };
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status);
     set_flush_to_zero(1, &env->vfp.ah_fp_status);
     set_flush_inputs_to_zero(1, &env->vfp.ah_fp_status);
-    arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status_f16);
+    arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_AH_F16]);
 
 #ifndef CONFIG_USER_ONLY
     if (kvm_enabled()) {
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     a64_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
           & ~(float_flag_input_denormal_flushed | float_flag_input_denormal_used));
     /*
-     * We do not merge in flags from ah_fp_status or ah_fp_status_f16, because
+     * We do not merge in flags from ah_fp_status or FPST_AH_F16, because
      * they are used for insns that must not set the cumulative exception bits.
      */
 
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
     set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD]);
     set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD_F16]);
     set_float_exception_flags(0, &env->vfp.ah_fp_status);
-    set_float_exception_flags(0, &env->vfp.ah_fp_status_f16);
+    set_float_exception_flags(0, &env->vfp.fp_status[FPST_AH_F16]);
 }
 
 static void vfp_sync_and_clear_float_status_exc_flags(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
-        set_flush_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_AH_F16]);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a32);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_f16_a64);
         set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_STD_F16]);
-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.ah_fp_status_f16);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_AH_F16]);
     }
     if (changed & FPCR_FZ) {
         bool ftz_enabled = val & FPCR_FZ;
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.ah_fp_status);
-        set_default_nan_mode(dnan_enabled, &env->vfp.ah_fp_status_f16);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_AH_F16]);
     }
     if (changed & FPCR_AH) {
         bool ah_enabled = val & FPCR_AH;
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Replace with fp_status[FPST_AH].

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250129013857.135256-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h        | 3 +--
 target/arm/cpu.c        | 6 +++---
 target/arm/vfp_helper.c | 6 +++---
 3 files changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct NVICState NVICState;
  * the "standard FPSCR" tracks the FPSCR.FZ16 bit rather than
  * using a fixed value for it.
  *
- * The ah_fp_status is needed because some insns have different
+ * FPST_AH is needed because some insns have different
  * behaviour when FPCR.AH == 1: they don't update cumulative
  * exception flags, they act like FPCR.{FZ,FIZ} = {1,1} and
  * they ignore FPCR.RMode. But they don't ignore FPCR.FZ16,
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
                 float_status fp_status_a64;
                 float_status fp_status_f16_a32;
                 float_status fp_status_f16_a64;
-                float_status ah_fp_status;
             };
         };
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a32);
     arm_set_default_fp_behaviours(&env->vfp.fp_status_f16_a64);
     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD_F16]);
-    arm_set_ah_fp_behaviours(&env->vfp.ah_fp_status);
-    set_flush_to_zero(1, &env->vfp.ah_fp_status);
-    set_flush_inputs_to_zero(1, &env->vfp.ah_fp_status);
+    arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_AH]);
+    set_flush_to_zero(1, &env->vfp.fp_status[FPST_AH]);
+    set_flush_inputs_to_zero(1, &env->vfp.fp_status[FPST_AH]);
     arm_set_ah_fp_behaviours(&env->vfp.fp_status[FPST_AH_F16]);
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
     a64_flags |= (get_float_exception_flags(&env->vfp.fp_status_f16_a64)
           & ~(float_flag_input_denormal_flushed | float_flag_input_denormal_used));
     /*
-     * We do not merge in flags from ah_fp_status or FPST_AH_F16, because
+     * We do not merge in flags from FPST_AH or FPST_AH_F16, because
      * they are used for insns that must not set the cumulative exception bits.
      */
 
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
     set_float_exception_flags(0, &env->vfp.fp_status_f16_a64);
     set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD]);
     set_float_exception_flags(0, &env->vfp.fp_status[FPST_STD_F16]);
-    set_float_exception_flags(0, &env->vfp.ah_fp_status);
+    set_float_exception_flags(0, &env->vfp.fp_status[FPST_AH]);
     set_float_exception_flags(0, &env->vfp.fp_status[FPST_AH_F16]);
 }
 
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a64);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a32);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_f16_a64);
-        set_default_nan_mode(dnan_enabled, &env->vfp.ah_fp_status);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_AH]);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_AH_F16]);
     }
     if (changed & FPCR_AH) {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Replace with fp_status[FPST_A64_F16].

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250129013857.135256-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h            |  1 -
 target/arm/cpu.c            |  2 +-
 target/arm/tcg/sme_helper.c |  2 +-
 target/arm/tcg/vec_helper.c |  9 ++++-----
 target/arm/vfp_helper.c     | 16 ++++++++--------
 5 files changed, 14 insertions(+), 16 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Replace with fp_status[FPST_A32_F16].

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250129013857.135256-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h            |  1 -
 target/arm/cpu.c            |  2 +-
 target/arm/tcg/vec_helper.c |  4 ++--
 target/arm/vfp_helper.c     | 14 +++++++-------
 4 files changed, 10 insertions(+), 11 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Replace with fp_status[FPST_A64].

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250129013857.135256-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h            |  1 -
 target/arm/cpu.c            |  2 +-
 target/arm/tcg/sme_helper.c |  2 +-
 target/arm/tcg/vec_helper.c | 10 +++++-----
 target/arm/vfp_helper.c     | 16 ++++++++--------
 5 files changed, 15 insertions(+), 16 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Replace with fp_status[FPST_A32].  As this was the last of the
old structures, we can remove the anonymous union and struct.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250129013857.135256-15-richard.henderson@linaro.org
[PMM: tweak to account for change to is_ebf()]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h            |  7 +------
 target/arm/cpu.c            |  2 +-
 target/arm/tcg/vec_helper.c |  2 +-
 target/arm/vfp_helper.c     | 18 +++++++++---------
 4 files changed, 12 insertions(+), 17 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint32_t scratch[8];
 
         /* There are a number of distinct float control structures. */
-        union {
-            float_status fp_status[FPST_COUNT];
-            struct {
-                float_status fp_status_a32;
-            };
-        };
+        float_status fp_status[FPST_COUNT];
 
         uint64_t zcr_el[4];   /* ZCR_EL[1-3] */
         uint64_t smcr_el[4];  /* SMCR_EL[1-3] */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset_hold(Object *obj, ResetType type)
     set_flush_inputs_to_zero(1, &env->vfp.fp_status[FPST_STD]);
     set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD]);
     set_default_nan_mode(1, &env->vfp.fp_status[FPST_STD_F16]);
-    arm_set_default_fp_behaviours(&env->vfp.fp_status_a32);
+    arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A32]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A64]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_STD]);
     arm_set_default_fp_behaviours(&env->vfp.fp_status[FPST_A32_F16]);
diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp)
      */
     bool ebf = is_a64(env) && env->vfp.fpcr & FPCR_EBF;
 
-    *statusp = is_a64(env) ? env->vfp.fp_status[FPST_A64] : env->vfp.fp_status_a32;
+    *statusp = env->vfp.fp_status[is_a64(env) ? FPST_A64 : FPST_A32];
     set_default_nan_mode(true, statusp);
 
     if (ebf) {
diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t vfp_get_fpsr_from_host(CPUARMState *env)
 {
     uint32_t a32_flags = 0, a64_flags = 0;
 
-    a32_flags |= get_float_exception_flags(&env->vfp.fp_status_a32);
+    a32_flags |= get_float_exception_flags(&env->vfp.fp_status[FPST_A32]);
     a32_flags |= get_float_exception_flags(&env->vfp.fp_status[FPST_STD]);
     /* FZ16 does not generate an input denormal exception.  */
     a32_flags |= (get_float_exception_flags(&env->vfp.fp_status[FPST_A32_F16])
@@ -XXX,XX +XXX,XX @@ static void vfp_clear_float_status_exc_flags(CPUARMState *env)
      * values. The caller should have arranged for env->vfp.fpsr to
      * be the architecturally up-to-date exception flag information first.
      */
-    set_float_exception_flags(0, &env->vfp.fp_status_a32);
+    set_float_exception_flags(0, &env->vfp.fp_status[FPST_A32]);
     set_float_exception_flags(0, &env->vfp.fp_status[FPST_A64]);
     set_float_exception_flags(0, &env->vfp.fp_status[FPST_A32_F16]);
     set_float_exception_flags(0, &env->vfp.fp_status[FPST_A64_F16]);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
             i = float_round_to_zero;
             break;
         }
-        set_float_rounding_mode(i, &env->vfp.fp_status_a32);
+        set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A32]);
         set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A64]);
         set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A32_F16]);
         set_float_rounding_mode(i, &env->vfp.fp_status[FPST_A64_F16]);
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
     }
     if (changed & FPCR_FZ) {
         bool ftz_enabled = val & FPCR_FZ;
-        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+        set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A32]);
         set_flush_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A64]);
         /* FIZ is A64 only so FZ always makes A32 code flush inputs to zero */
-        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status_a32);
+        set_flush_inputs_to_zero(ftz_enabled, &env->vfp.fp_status[FPST_A32]);
     }
     if (changed & (FPCR_FZ | FPCR_AH | FPCR_FIZ)) {
         /*
@@ -XXX,XX +XXX,XX @@ static void vfp_set_fpcr_to_host(CPUARMState *env, uint32_t val, uint32_t mask)
     }
     if (changed & FPCR_DN) {
         bool dnan_enabled = val & FPCR_DN;
-        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status_a32);
+        set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A32]);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A64]);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A32_F16]);
         set_default_nan_mode(dnan_enabled, &env->vfp.fp_status[FPST_A64_F16]);
@@ -XXX,XX +XXX,XX @@ void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
         FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
 }
 DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status[FPST_A32_F16])
-DO_VFP_cmp(s, float32, float32, fp_status_a32)
-DO_VFP_cmp(d, float64, float64, fp_status_a32)
+DO_VFP_cmp(s, float32, float32, fp_status[FPST_A32])
+DO_VFP_cmp(d, float64, float64, fp_status[FPST_A32])
 #undef DO_VFP_cmp
 
 /* Integer to float and float to integer conversions */
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(fjcvtzs)(float64 value, float_status *status)
 
 uint32_t HELPER(vjcvt)(float64 value, CPUARMState *env)
 {
-    uint64_t pair = HELPER(fjcvtzs)(value, &env->vfp.fp_status_a32);
+    uint64_t pair = HELPER(fjcvtzs)(value, &env->vfp.fp_status[FPST_A32]);
     uint32_t result = pair;
     uint32_t z = (pair >> 32) == 0;
 
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Select on index instead of pointer.
No functional change.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250129013857.135256-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/mve_helper.c | 40 +++++++++++++------------------------
 1 file changed, 14 insertions(+), 26 deletions(-)

diff --git a/target/arm/tcg/mve_helper.c b/target/arm/tcg/mve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/mve_helper.c
+++ b/target/arm/tcg/mve_helper.c
@@ -XXX,XX +XXX,XX @@ DO_VMAXMINA(vminaw, 4, int32_t, uint32_t, DO_MIN)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.fp_status[FPST_STD];                           \
+            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ALL(vminnma, minnuma)
                 r[e] = 0;                                               \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.fp_status[FPST_STD];                           \
+            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
             if (!(tm & 1)) {                                            \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCADD_FP(vfcadd270s, 4, float32, float32_add, float32_sub)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.fp_status[FPST_STD];                           \
+            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VFMA(vfmss, 4, float32, true)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE * 2)) == 0) {          \
                 continue;                                               \
             }                                                           \
-            fpst0 = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :  \
-                &env->vfp.fp_status[FPST_STD];                           \
+            fpst0 = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
             fpst1 = fpst0;                                              \
             if (!(mask & 1)) {                                          \
                 scratch_fpst = *fpst0;                                  \
@@ -XXX,XX +XXX,XX @@ DO_VCMLA(vcmla270s, 4, float32, 3, DO_VCMLAS)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.fp_status[FPST_STD];                           \
+            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_SCALAR_ALL(vfmul_scalar, mul)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.fp_status[FPST_STD];                           \
+            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_2OP_FP_ACC_SCALAR(vfmas_scalars, 4, float32, DO_VFMAS_SCALARS)
         unsigned e;                                             \
         TYPE *m = vm;                                           \
         TYPE ra = (TYPE)ra_in;                                  \
-        float_status *fpst = (ESIZE == 2) ?                     \
-            &env->vfp.fp_status[FPST_STD_F16] :                 \
-            &env->vfp.fp_status[FPST_STD];                       \
+        float_status *fpst =                                    \
+            &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
         for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {      \
             if (mask & 1) {                                     \
                 TYPE v = m[H##ESIZE(e)];                        \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
             if ((mask & emask) == 0) {                                  \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.fp_status[FPST_STD];                           \
+            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
             if (!(mask & (1 << (e * ESIZE)))) {                         \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_FP_VMAXMINV(vminnmavs, 4, float32, true, float32_minnum)
             if ((mask & emask) == 0) {                                  \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.fp_status[FPST_STD];                           \
+            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
             if (!(mask & (1 << (e * ESIZE)))) {                         \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCMP_FP_BOTH(vfcmples, vfcmple_scalars, 4, float32, !DO_GT32)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.fp_status[FPST_STD];                           \
+            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
@@ -XXX,XX +XXX,XX @@ DO_VCVT_FIXED(vcvt_fu, 4, uint32_t, helper_vfp_touls_round_to_zero)
         unsigned e;                                                     \
         float_status *fpst;                                             \
         float_status scratch_fpst;                                      \
-        float_status *base_fpst = (ESIZE == 2) ?                        \
-            &env->vfp.fp_status[FPST_STD_F16] :                         \
-            &env->vfp.fp_status[FPST_STD];                               \
+        float_status *base_fpst =                                       \
+            &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD];  \
         uint32_t prev_rmode = get_float_rounding_mode(base_fpst);       \
         set_float_rounding_mode(rmode, base_fpst);                      \
         for (e = 0; e < 16 / ESIZE; e++, mask >>= ESIZE) {              \
@@ -XXX,XX +XXX,XX @@ void HELPER(mve_vcvtt_hs)(CPUARMState *env, void *vd, void *vm)
             if ((mask & MAKE_64BIT_MASK(0, ESIZE)) == 0) {              \
                 continue;                                               \
             }                                                           \
-            fpst = (ESIZE == 2) ? &env->vfp.fp_status[FPST_STD_F16] :   \
-                &env->vfp.fp_status[FPST_STD];                           \
+            fpst = &env->vfp.fp_status[ESIZE == 2 ? FPST_STD_F16 : FPST_STD]; \
             if (!(mask & 1)) {                                          \
                 /* We need the result but without updating flags */     \
                 scratch_fpst = *fpst;                                   \
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Pass ARMFPStatusFlavour index instead of fp_status[FOO].

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250129013857.135256-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/vfp_helper.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/arm/vfp_helper.c b/target/arm/vfp_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/vfp_helper.c
+++ b/target/arm/vfp_helper.c
@@ -XXX,XX +XXX,XX @@ static void softfloat_to_vfp_compare(CPUARMState *env, FloatRelation cmp)
 void VFP_HELPER(cmp, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env)  \
 { \
     softfloat_to_vfp_compare(env, \
-        FLOATTYPE ## _compare_quiet(a, b, &env->vfp.FPST)); \
+        FLOATTYPE ## _compare_quiet(a, b, &env->vfp.fp_status[FPST])); \
 } \
 void VFP_HELPER(cmpe, P)(ARGTYPE a, ARGTYPE b, CPUARMState *env) \
 { \
     softfloat_to_vfp_compare(env, \
-        FLOATTYPE ## _compare(a, b, &env->vfp.FPST)); \
+        FLOATTYPE ## _compare(a, b, &env->vfp.fp_status[FPST])); \
 }
-DO_VFP_cmp(h, float16, dh_ctype_f16, fp_status[FPST_A32_F16])
-DO_VFP_cmp(s, float32, float32, fp_status[FPST_A32])
-DO_VFP_cmp(d, float64, float64, fp_status[FPST_A32])
+DO_VFP_cmp(h, float16, dh_ctype_f16, FPST_A32_F16)
+DO_VFP_cmp(s, float32, float32, FPST_A32)
+DO_VFP_cmp(d, float64, float64, FPST_A32)
 #undef DO_VFP_cmp
 
 /* Integer to float and float to integer conversions */
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Read the bit from the source, rather than from the proxy via
get_flush_inputs_to_zero.  This makes it clear that it does
not matter which of the float_status structures is used.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250129013857.135256-34-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/vec_helper.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a32)(void *vd, void *vn, void *vm,
     uint64_t negx = is_s ? 0x8000800080008000ull : 0;
 
     do_fmlal(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
-             get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A32_F16]));
+             env->vfp.fpcr & FPCR_FZ16);
 }
 
 void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_a64)(void *vd, void *vn, void *vm,
         }
     }
     do_fmlal(vd, vn, vm, &env->vfp.fp_status[FPST_A64], negx, negf, desc,
-             get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]));
+             env->vfp.fpcr & FPCR_FZ16);
 }
 
 void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzzw_s)(void *vd, void *vn, void *vm, void *va,
     bool is_s = extract32(desc, SIMD_DATA_SHIFT, 1);
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     float_status *status = &env->vfp.fp_status[FPST_A64];
-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]);
+    bool fz16 = env->vfp.fpcr & FPCR_FZ16;
     int negx = 0, negf = 0;
 
     if (is_s) {
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a32)(void *vd, void *vn, void *vm,
     uint64_t negx = is_s ? 0x8000800080008000ull : 0;
 
     do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status[FPST_STD], negx, 0, desc,
-                 get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A32_F16]));
+                 env->vfp.fpcr & FPCR_FZ16);
 }
 
 void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
@@ -XXX,XX +XXX,XX @@ void HELPER(gvec_fmlal_idx_a64)(void *vd, void *vn, void *vm,
         }
     }
     do_fmlal_idx(vd, vn, vm, &env->vfp.fp_status[FPST_A64], negx, negf, desc,
-                 get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]));
+                 env->vfp.fpcr & FPCR_FZ16);
 }
 
 void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
@@ -XXX,XX +XXX,XX @@ void HELPER(sve2_fmlal_zzxw_s)(void *vd, void *vn, void *vm, void *va,
     intptr_t sel = extract32(desc, SIMD_DATA_SHIFT + 1, 1) * sizeof(float16);
     intptr_t idx = extract32(desc, SIMD_DATA_SHIFT + 2, 3) * sizeof(float16);
     float_status *status = &env->vfp.fp_status[FPST_A64];
-    bool fz16 = get_flush_inputs_to_zero(&env->vfp.fp_status[FPST_A64_F16]);
+    bool fz16 = env->vfp.fpcr & FPCR_FZ16;
     int negx = 0, negf = 0;
 
     if (is_s) {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Sink common code from the callers into do_fmlal
and do_fmlal_idx.  Reorder the arguments to minimize
the re-sorting from the caller's arguments.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250129013857.135256-35-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/vec_helper.c | 28 ++++++++++++++++------------
 1 file changed, 16 insertions(+), 12 deletions(-)