Series comparison

-[PULL 00/21] target-arm queue
+[PULL 00/72] target-arm queue
-The following changes since commit f003dd8d81f7d88f4b1f8802309eaa76f6eb223a:
+First arm pullreq of the cycle; this is mostly my softfloat NaN
 handling series. (Lots more in my to-review queue, but I don't
 like pullreqs growing too close to a hundred patches at a time :-))
-  Merge tag 'pull-tcg-20230305' of https://gitlab.com/rth7680/qemu into staging (2023-03-06 10:20:04 +0000)
+thanks
 -- PMM
 The following changes since commit 97f2796a3736ed37a1b85dc1c76a6c45b829dd17:
   Open 10.0 development tree (2024-12-10 17:41:17 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230306
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20241211
-for you to fetch changes up to 2ddc45954f97cd1d7ee5cbca0def05e980d1da9f:
+for you to fetch changes up to 1abe28d519239eea5cf9620bb13149423e5665f8:
-  hw: arm: allwinner-h3: Fix and complete H3 i2c devices (2023-03-06 15:31:24 +0000)
+  MAINTAINERS: Add correct email address for Vikram Garhwal (2024-12-11 15:31:09 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * allwinner-h3: Fix I2C controller model for Sun6i SoCs
+ * hw/net/lan9118: Extract PHY model, reuse with imx_fec, fix bugs
- * allwinner-h3: Add missing i2c controllers
+ * fpu: Make muladd NaN handling runtime-selected, not compile-time
- * Expose M-profile system registers to gdbstub
+ * fpu: Make default NaN pattern runtime-selected, not compile-time
- * Expose pauth information to gdbstub
+ * fpu: Minor NaN-related cleanups
- * Support direct boot for Linux/arm64 EFI zboot images
+ * MAINTAINERS: email address updates
  * Fix incorrect stage 2 MMU setup validation
 ----------------------------------------------------------------
-Ard Biesheuvel (1):
+Bernhard Beschow (5):
-      hw: arm: Support direct boot for Linux/arm64 EFI zboot images
+      hw/net/lan9118: Extract lan9118_phy
       hw/net/lan9118_phy: Reuse in imx_fec and consolidate implementations
       hw/net/lan9118_phy: Fix off-by-one error in MII_ANLPAR register
       hw/net/lan9118_phy: Reuse MII constants
       hw/net/lan9118_phy: Add missing 100 mbps full duplex advertisement
-David Reiss (2):
+Leif Lindholm (1):
-      target/arm: Export arm_v7m_mrs_control
+      MAINTAINERS: update email address for Leif Lindholm
       target/arm: Export arm_v7m_get_sp_ptr
-Richard Henderson (16):
+Peter Maydell (54):
-      target/arm: Normalize aarch64 gdbstub get/set function names
+      fpu: handle raising Invalid for infzero in pick_nan_muladd
-      target/arm: Unexport arm_gen_dynamic_sysreg_xml
+      fpu: Check for default_nan_mode before calling pickNaNMulAdd
-      target/arm: Move arm_gen_dynamic_svereg_xml to gdbstub64.c
+      softfloat: Allow runtime choice of inf * 0 + NaN result
-      target/arm: Split out output_vector_union_type
+      tests/fp: Explicitly set inf-zero-nan rule
-      target/arm: Simplify register counting in arm_gen_dynamic_svereg_xml
+      target/arm: Set FloatInfZeroNaNRule explicitly
-      target/arm: Hoist pred_width in arm_gen_dynamic_svereg_xml
+      target/s390: Set FloatInfZeroNaNRule explicitly
-      target/arm: Fix svep width in arm_gen_dynamic_svereg_xml
+      target/ppc: Set FloatInfZeroNaNRule explicitly
-      target/arm: Add name argument to output_vector_union_type
+      target/mips: Set FloatInfZeroNaNRule explicitly
-      target/arm: Simplify iteration over bit widths
+      target/sparc: Set FloatInfZeroNaNRule explicitly
-      target/arm: Create pauth_ptr_mask
+      target/xtensa: Set FloatInfZeroNaNRule explicitly
-      target/arm: Implement gdbstub pauth extension
+      target/x86: Set FloatInfZeroNaNRule explicitly
-      target/arm: Implement gdbstub m-profile systemreg and secext
+      target/loongarch: Set FloatInfZeroNaNRule explicitly
-      target/arm: Handle m-profile in arm_is_secure
+      target/hppa: Set FloatInfZeroNaNRule explicitly
-      target/arm: Stub arm_hcr_el2_eff for m-profile
+      softfloat: Pass have_snan to pickNaNMulAdd
-      target/arm: Diagnose incorrect usage of arm_is_secure subroutines
+      softfloat: Allow runtime choice of NaN propagation for muladd
-      target/arm: Rewrite check_s2_mmu_setup
+      tests/fp: Explicitly set 3-NaN propagation rule
       target/arm: Set Float3NaNPropRule explicitly
       target/loongarch: Set Float3NaNPropRule explicitly
       target/ppc: Set Float3NaNPropRule explicitly
       target/s390x: Set Float3NaNPropRule explicitly
       target/sparc: Set Float3NaNPropRule explicitly
       target/mips: Set Float3NaNPropRule explicitly
       target/xtensa: Set Float3NaNPropRule explicitly
       target/i386: Set Float3NaNPropRule explicitly
       target/hppa: Set Float3NaNPropRule explicitly
       fpu: Remove use_first_nan field from float_status
       target/m68k: Don't pass NULL float_status to floatx80_default_nan()
       softfloat: Create floatx80 default NaN from parts64_default_nan
       target/loongarch: Use normal float_status in fclass_s and fclass_d helpers
       target/m68k: In frem helper, initialize local float_status from env->fp_status
       target/m68k: Init local float_status from env fp_status in gdb get/set reg
       target/sparc: Initialize local scratch float_status from env->fp_status
       target/ppc: Use env->fp_status in helper_compute_fprf functions
       fpu: Allow runtime choice of default NaN value
       tests/fp: Set default NaN pattern explicitly
       target/microblaze: Set default NaN pattern explicitly
       target/i386: Set default NaN pattern explicitly
       target/hppa: Set default NaN pattern explicitly
       target/alpha: Set default NaN pattern explicitly
       target/arm: Set default NaN pattern explicitly
       target/loongarch: Set default NaN pattern explicitly
       target/m68k: Set default NaN pattern explicitly
       target/mips: Set default NaN pattern explicitly
       target/openrisc: Set default NaN pattern explicitly
       target/ppc: Set default NaN pattern explicitly
       target/sh4: Set default NaN pattern explicitly
       target/rx: Set default NaN pattern explicitly
       target/s390x: Set default NaN pattern explicitly
       target/sparc: Set default NaN pattern explicitly
       target/xtensa: Set default NaN pattern explicitly
       target/hexagon: Set default NaN pattern explicitly
       target/riscv: Set default NaN pattern explicitly
       target/tricore: Set default NaN pattern explicitly
       fpu: Remove default handling for dnan_pattern
-qianfan Zhao (2):
+Richard Henderson (11):
-      hw: allwinner-i2c: Fix TWI_CNTR_INT_FLAG on SUN6i SoCs
+      target/arm: Copy entire float_status in is_ebf
-      hw: arm: allwinner-h3: Fix and complete H3 i2c devices
+      softfloat: Inline pickNaNMulAdd
       softfloat: Use goto for default nan case in pick_nan_muladd
       softfloat: Remove which from parts_pick_nan_muladd
       softfloat: Pad array size in pick_nan_muladd
       softfloat: Move propagateFloatx80NaN to softfloat.c
       softfloat: Use parts_pick_nan in propagateFloatx80NaN
       softfloat: Inline pickNaN
       softfloat: Share code between parts_pick_nan cases
       softfloat: Sink frac_cmp in parts_pick_nan until needed
       softfloat: Replace WHICH with RET in parts_pick_nan
- configs/targets/aarch64-linux-user.mak    |   2 +-
+Vikram Garhwal (1):
- configs/targets/aarch64-softmmu.mak       |   2 +-
+      MAINTAINERS: Add correct email address for Vikram Garhwal
- configs/targets/aarch64_be-linux-user.mak |   2 +-
- include/hw/arm/allwinner-h3.h             |   6 +
+ MAINTAINERS                       |   4 +-
- include/hw/i2c/allwinner-i2c.h            |   6 +
+ include/fpu/softfloat-helpers.h   |  38 +++-
- include/hw/loader.h                       |  19 ++
+ include/fpu/softfloat-types.h     |  89 +++++++-
- target/arm/cpu.h                          |  17 +-
+ include/hw/net/imx_fec.h          |   9 +-
- target/arm/internals.h                    |  34 +++-
+ include/hw/net/lan9118_phy.h      |  37 ++++
- hw/arm/allwinner-h3.c                     |  29 +++-
+ include/hw/net/mii.h              |   6 +
- hw/arm/boot.c                             |   6 +
+ target/mips/fpu_helper.h          |  20 ++
- hw/core/loader.c                          |  91 ++++++++++
+ target/sparc/helper.h             |   4 +-
- hw/i2c/allwinner-i2c.c                    |  26 ++-
+ fpu/softfloat.c                   |  19 ++
- target/arm/gdbstub.c                      | 278 ++++++++++++++++++------------
+ hw/net/imx_fec.c                  | 146 ++------------
- target/arm/gdbstub64.c                    | 175 ++++++++++++++++++-
+ hw/net/lan9118.c                  | 137 ++-----------
- target/arm/helper.c                       |   3 +
+ hw/net/lan9118_phy.c              | 222 ++++++++++++++++++++
- target/arm/ptw.c                          | 173 +++++++++++--------
+ linux-user/arm/nwfpe/fpa11.c      |   5 +
- target/arm/tcg/m_helper.c                 |  90 +++++-----
+ target/alpha/cpu.c                |   2 +
- target/arm/tcg/pauth_helper.c             |  26 ++-
+ target/arm/cpu.c                  |  10 +
- gdb-xml/aarch64-pauth.xml                 |  15 ++
+ target/arm/tcg/vec_helper.c       |  20 +-
-files changed, 742 insertions(+), 258 deletions(-)
+ target/hexagon/cpu.c              |   2 +
- create mode 100644 gdb-xml/aarch64-pauth.xml
+ target/hppa/fpu_helper.c          |  12 ++
  target/i386/tcg/fpu_helper.c      |  12 ++
  target/loongarch/tcg/fpu_helper.c |  14 +-
  target/m68k/cpu.c                 |  14 +-
  target/m68k/fpu_helper.c          |   6 +-
  target/m68k/helper.c              |   6 +-
  target/microblaze/cpu.c           |   2 +
  target/mips/msa.c                 |  10 +
  target/openrisc/cpu.c             |   2 +
  target/ppc/cpu_init.c             |  19 ++
  target/ppc/fpu_helper.c           |   3 +-
  target/riscv/cpu.c                |   2 +
  target/rx/cpu.c                   |   2 +
  target/s390x/cpu.c                |   5 +
  target/sh4/cpu.c                  |   2 +
  target/sparc/cpu.c                |   6 +
  target/sparc/fop_helper.c         |   8 +-
  target/sparc/translate.c          |   4 +-
  target/tricore/helper.c           |   2 +
  target/xtensa/cpu.c               |   4 +
  target/xtensa/fpu_helper.c        |   3 +-
  tests/fp/fp-bench.c               |   7 +
  tests/fp/fp-test-log2.c           |   1 +
  tests/fp/fp-test.c                |   7 +
  fpu/softfloat-parts.c.inc         | 152 +++++++++++---
  fpu/softfloat-specialize.c.inc    | 412 ++------------------------------------
  .mailmap                          |   5 +-
  hw/net/Kconfig                    |   5 +
  hw/net/meson.build                |   1 +
  hw/net/trace-events               |  10 +-
 files changed, 778 insertions(+), 730 deletions(-)
  create mode 100644 include/hw/net/lan9118_phy.h
  create mode 100644 hw/net/lan9118_phy.c

-[PULL 11/21] target/arm: Implement gdbstub pauth extension
+[PULL 01/72] hw/net/lan9118: Extract lan9118_phy
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Bernhard Beschow <shentey@gmail.com>
-The extension is primarily defined by the Linux kernel NT_ARM_PAC_MASK
+A very similar implementation of the same device exists in imx_fec. Prepare for
-ptrace register set.
+a common implementation by extracting a device model into its own files.
-The original gdb feature consists of two masks, data and code, which are
+Some migration state has been moved into the new device model which breaks
-used to mask out the authentication code within a pointer.  Following
+migration compatibility for the following machines:
-discussion with Luis Machado, add two more masks in order to support
+* smdkc210
-pointers within the high half of the address space (i.e. TTBR1 vs TTBR0).
+* realview-*
 * vexpress-*
 * kzm
 * mps2-*
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1105
+While breaking migration ABI, fix the size of the MII registers to be 16 bit,
 as defined by IEEE 802.3u.
 Signed-off-by: Bernhard Beschow <shentey@gmail.com>
 Tested-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241102125724.532843-2-shentey@gmail.com
 Message-id: 20230227213329.793795-12-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- configs/targets/aarch64-linux-user.mak    |  2 +-
+ include/hw/net/lan9118_phy.h |  37 ++++++++
- configs/targets/aarch64-softmmu.mak       |  2 +-
+ hw/net/lan9118.c             | 137 +++++-----------------------
- configs/targets/aarch64_be-linux-user.mak |  2 +-
+ hw/net/lan9118_phy.c         | 169 +++++++++++++++++++++++++++++++++++
- target/arm/internals.h                    |  2 ++
+ hw/net/Kconfig               |   4 +
- target/arm/gdbstub.c                      |  5 ++++
+ hw/net/meson.build           |   1 +
- target/arm/gdbstub64.c                    | 34 +++++++++++++++++++++++
+files changed, 233 insertions(+), 115 deletions(-)
- gdb-xml/aarch64-pauth.xml                 | 15 ++++++++++
+ create mode 100644 include/hw/net/lan9118_phy.h
-files changed, 59 insertions(+), 3 deletions(-)
+ create mode 100644 hw/net/lan9118_phy.c
  create mode 100644 gdb-xml/aarch64-pauth.xml
-diff --git a/configs/targets/aarch64-linux-user.mak b/configs/targets/aarch64-linux-user.mak
+diff --git a/include/hw/net/lan9118_phy.h b/include/hw/net/lan9118_phy.h
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/aarch64-linux-user.mak
 +++ b/configs/targets/aarch64-linux-user.mak
@@ -XXX,XX +XXX,XX @@
  TARGET_ARCH=aarch64
  TARGET_BASE_ARCH=arm
 -TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml
 +TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml
  TARGET_HAS_BFLT=y
  CONFIG_SEMIHOSTING=y
  CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 diff --git a/configs/targets/aarch64-softmmu.mak b/configs/targets/aarch64-softmmu.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/aarch64-softmmu.mak
 +++ b/configs/targets/aarch64-softmmu.mak
@@ -XXX,XX +XXX,XX @@
  TARGET_ARCH=aarch64
  TARGET_BASE_ARCH=arm
  TARGET_SUPPORTS_MTTCG=y
 -TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml
 +TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml gdb-xml/aarch64-pauth.xml
  TARGET_NEED_FDT=y
 diff --git a/configs/targets/aarch64_be-linux-user.mak b/configs/targets/aarch64_be-linux-user.mak
 index XXXXXXX..XXXXXXX 100644
 --- a/configs/targets/aarch64_be-linux-user.mak
 +++ b/configs/targets/aarch64_be-linux-user.mak
@@ -XXX,XX +XXX,XX @@
  TARGET_ARCH=aarch64
  TARGET_BASE_ARCH=arm
  TARGET_BIG_ENDIAN=y
 -TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml
 +TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml
  TARGET_HAS_BFLT=y
  CONFIG_SEMIHOSTING=y
  CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
  int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
  int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
  int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg);
 +int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg);
 +int aarch64_gdb_set_pauth_reg(CPUARMState *env, uint8_t *buf, int reg);
  void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
  void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
  void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
 diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub.c
 +++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                                       aarch64_gdb_set_fpu_reg,
 , "aarch64-fpu.xml", 0);
          }
 +        if (isar_feature_aa64_pauth(&cpu->isar)) {
 +            gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg,
 +                                     aarch64_gdb_set_pauth_reg,
 +                                     4, "aarch64-pauth.xml", 0);
 +        }
  #endif
      } else {
          if (arm_feature(env, ARM_FEATURE_NEON)) {
 diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub64.c
 +++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
      return 0;
  }
 +int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg)
 +{
 +    switch (reg) {
 +    case 0: /* pauth_dmask */
 +    case 1: /* pauth_cmask */
 +    case 2: /* pauth_dmask_high */
 +    case 3: /* pauth_cmask_high */
 +        /*
 +         * Note that older versions of this feature only contained
 +         * pauth_{d,c}mask, for use with Linux user processes, and
 +         * thus exclusively in the low half of the address space.
 +         *
 +         * To support system mode, and to debug kernels, two new regs
 +         * were added to cover the high half of the address space.
 +         * For the purpose of pauth_ptr_mask, we can use any well-formed
 +         * address within the address space half -- here, 0 and -1.
 +         */
 +        {
 +            bool is_data = !(reg & 1);
 +            bool is_high = reg & 2;
 +            uint64_t mask = pauth_ptr_mask(env, -is_high, is_data);
 +            return gdb_get_reg64(buf, mask);
 +        }
 +    default:
 +        return 0;
 +    }
 +}
 +
 +int aarch64_gdb_set_pauth_reg(CPUARMState *env, uint8_t *buf, int reg)
 +{
 +    /* All pseudo registers are read-only. */
 +    return 0;
 +}
 +
  static void output_vector_union_type(GString *s, int reg_width,
                                       const char *name)
  {
 diff --git a/gdb-xml/aarch64-pauth.xml b/gdb-xml/aarch64-pauth.xml
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/gdb-xml/aarch64-pauth.xml
++++ b/include/hw/net/lan9118_phy.h
 @@ -XXX,XX +XXX,XX @@
-+<?xml version="1.0"?>
++/*
-+<!-- Copyright (C) 2018-2022 Free Software Foundation, Inc.
++ * SMSC LAN9118 PHY emulation
-+
++ *
-+     Copying and distribution of this file, with or without modification,
++ * Copyright (c) 2009 CodeSourcery, LLC.
-+     are permitted in any medium without royalty provided the copyright
++ * Written by Paul Brook
-+     notice and this notice are preserved.  -->
++ *
-+
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
++ * See the COPYING file in the top-level directory.
-+<feature name="org.gnu.gdb.aarch64.pauth">
++ */
-+  <reg name="pauth_dmask" bitsize="64"/>
++
-+  <reg name="pauth_cmask" bitsize="64"/>
++#ifndef HW_NET_LAN9118_PHY_H
-+  <reg name="pauth_dmask_high" bitsize="64"/>
++#define HW_NET_LAN9118_PHY_H
-+  <reg name="pauth_cmask_high" bitsize="64"/>
++
-+</feature>
++#include "qom/object.h"
-+
++#include "hw/sysbus.h"
 +
 +#define TYPE_LAN9118_PHY "lan9118-phy"
 +OBJECT_DECLARE_SIMPLE_TYPE(Lan9118PhyState, LAN9118_PHY)
 +
 +typedef struct Lan9118PhyState {
 +    SysBusDevice parent_obj;
 +
 +    uint16_t status;
 +    uint16_t control;
 +    uint16_t advertise;
 +    uint16_t ints;
 +    uint16_t int_mask;
 +    qemu_irq irq;
 +    bool link_down;
 +} Lan9118PhyState;
 +
 +void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down);
 +void lan9118_phy_reset(Lan9118PhyState *s);
 +uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg);
 +void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val);
 +
 +#endif
 diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/lan9118.c
 +++ b/hw/net/lan9118.c
@@ -XXX,XX +XXX,XX @@
  #include "net/net.h"
  #include "net/eth.h"
  #include "hw/irq.h"
 +#include "hw/net/lan9118_phy.h"
  #include "hw/net/lan9118.h"
  #include "hw/ptimer.h"
  #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@ do { printf("lan9118: " fmt , ## __VA_ARGS__); } while (0)
  #define MAC_CR_RXEN     0x00000004
  #define MAC_CR_RESERVED 0x7f404213
 -#define PHY_INT_ENERGYON            0x80
 -#define PHY_INT_AUTONEG_COMPLETE    0x40
 -#define PHY_INT_FAULT               0x20
 -#define PHY_INT_DOWN                0x10
 -#define PHY_INT_AUTONEG_LP          0x08
 -#define PHY_INT_PARFAULT            0x04
 -#define PHY_INT_AUTONEG_PAGE        0x02
 -
  #define GPT_TIMER_EN    0x20000000
  /*
@@ -XXX,XX +XXX,XX @@ struct lan9118_state {
      uint32_t mac_mii_data;
      uint32_t mac_flow;
 -    uint32_t phy_status;
 -    uint32_t phy_control;
 -    uint32_t phy_advertise;
 -    uint32_t phy_int;
 -    uint32_t phy_int_mask;
 +    Lan9118PhyState mii;
 +    IRQState mii_irq;
      int32_t eeprom_writable;
      uint8_t eeprom[128];
@@ -XXX,XX +XXX,XX @@ struct lan9118_state {
  static const VMStateDescription vmstate_lan9118 = {
      .name = "lan9118",
 -    .version_id = 2,
 -    .minimum_version_id = 1,
 +    .version_id = 3,
 +    .minimum_version_id = 3,
      .fields = (const VMStateField[]) {
          VMSTATE_PTIMER(timer, lan9118_state),
          VMSTATE_UINT32(irq_cfg, lan9118_state),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_lan9118 = {
          VMSTATE_UINT32(mac_mii_acc, lan9118_state),
          VMSTATE_UINT32(mac_mii_data, lan9118_state),
          VMSTATE_UINT32(mac_flow, lan9118_state),
 -        VMSTATE_UINT32(phy_status, lan9118_state),
 -        VMSTATE_UINT32(phy_control, lan9118_state),
 -        VMSTATE_UINT32(phy_advertise, lan9118_state),
 -        VMSTATE_UINT32(phy_int, lan9118_state),
 -        VMSTATE_UINT32(phy_int_mask, lan9118_state),
          VMSTATE_INT32(eeprom_writable, lan9118_state),
          VMSTATE_UINT8_ARRAY(eeprom, lan9118_state, 128),
          VMSTATE_INT32(tx_fifo_size, lan9118_state),
@@ -XXX,XX +XXX,XX @@ static void lan9118_reload_eeprom(lan9118_state *s)
      lan9118_mac_changed(s);
  }
 -static void phy_update_irq(lan9118_state *s)
 +static void lan9118_update_irq(void *opaque, int n, int level)
  {
 -    if (s->phy_int & s->phy_int_mask) {
 +    lan9118_state *s = opaque;
 +
 +    if (level) {
          s->int_sts |= PHY_INT;
      } else {
          s->int_sts &= ~PHY_INT;
@@ -XXX,XX +XXX,XX @@ static void phy_update_irq(lan9118_state *s)
      lan9118_update(s);
  }
 -static void phy_update_link(lan9118_state *s)
 -{
 -    /* Autonegotiation status mirrors link status.  */
 -    if (qemu_get_queue(s->nic)->link_down) {
 -        s->phy_status &= ~0x0024;
 -        s->phy_int |= PHY_INT_DOWN;
 -    } else {
 -        s->phy_status |= 0x0024;
 -        s->phy_int |= PHY_INT_ENERGYON;
 -        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
 -    }
 -    phy_update_irq(s);
 -}
 -
  static void lan9118_set_link(NetClientState *nc)
  {
 -    phy_update_link(qemu_get_nic_opaque(nc));
 -}
 -
 -static void phy_reset(lan9118_state *s)
 -{
 -    s->phy_status = 0x7809;
 -    s->phy_control = 0x3000;
 -    s->phy_advertise = 0x01e1;
 -    s->phy_int_mask = 0;
 -    s->phy_int = 0;
 -    phy_update_link(s);
 +    lan9118_phy_update_link(&LAN9118(qemu_get_nic_opaque(nc))->mii,
 +                            nc->link_down);
  }
  static void lan9118_reset(DeviceState *d)
@@ -XXX,XX +XXX,XX @@ static void lan9118_reset(DeviceState *d)
      s->read_word_n = 0;
      s->write_word_n = 0;
 -    phy_reset(s);
 -
      s->eeprom_writable = 0;
      lan9118_reload_eeprom(s);
  }
@@ -XXX,XX +XXX,XX @@ static void do_tx_packet(lan9118_state *s)
      uint32_t status;
      /* FIXME: Honor TX disable, and allow queueing of packets.  */
 -    if (s->phy_control & 0x4000)  {
 +    if (s->mii.control & 0x4000) {
          /* This assumes the receive routine doesn't touch the VLANClient.  */
          qemu_receive_packet(qemu_get_queue(s->nic), s->txp->data, s->txp->len);
      } else {
@@ -XXX,XX +XXX,XX @@ static void tx_fifo_push(lan9118_state *s, uint32_t val)
      }
  }
 -static uint32_t do_phy_read(lan9118_state *s, int reg)
 -{
 -    uint32_t val;
 -
 -    switch (reg) {
 -    case 0: /* Basic Control */
 -        return s->phy_control;
 -    case 1: /* Basic Status */
 -        return s->phy_status;
 -    case 2: /* ID1 */
 -        return 0x0007;
 -    case 3: /* ID2 */
 -        return 0xc0d1;
 -    case 4: /* Auto-neg advertisement */
 -        return s->phy_advertise;
 -    case 5: /* Auto-neg Link Partner Ability */
 -        return 0x0f71;
 -    case 6: /* Auto-neg Expansion */
 -        return 1;
 -        /* TODO 17, 18, 27, 29, 30, 31 */
 -    case 29: /* Interrupt source.  */
 -        val = s->phy_int;
 -        s->phy_int = 0;
 -        phy_update_irq(s);
 -        return val;
 -    case 30: /* Interrupt mask */
 -        return s->phy_int_mask;
 -    default:
 -        qemu_log_mask(LOG_GUEST_ERROR,
 -                      "do_phy_read: PHY read reg %d\n", reg);
 -        return 0;
 -    }
 -}
 -
 -static void do_phy_write(lan9118_state *s, int reg, uint32_t val)
 -{
 -    switch (reg) {
 -    case 0: /* Basic Control */
 -        if (val & 0x8000) {
 -            phy_reset(s);
 -            break;
 -        }
 -        s->phy_control = val & 0x7980;
 -        /* Complete autonegotiation immediately.  */
 -        if (val & 0x1000) {
 -            s->phy_status |= 0x0020;
 -        }
 -        break;
 -    case 4: /* Auto-neg advertisement */
 -        s->phy_advertise = (val & 0x2d7f) | 0x80;
 -        break;
 -        /* TODO 17, 18, 27, 31 */
 -    case 30: /* Interrupt mask */
 -        s->phy_int_mask = val & 0xff;
 -        phy_update_irq(s);
 -        break;
 -    default:
 -        qemu_log_mask(LOG_GUEST_ERROR,
 -                      "do_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
 -    }
 -}
 -
  static void do_mac_write(lan9118_state *s, int reg, uint32_t val)
  {
      switch (reg) {
@@ -XXX,XX +XXX,XX @@ static void do_mac_write(lan9118_state *s, int reg, uint32_t val)
          if (val & 2) {
              DPRINTF("PHY write %d = 0x%04x\n",
                      (val >> 6) & 0x1f, s->mac_mii_data);
 -            do_phy_write(s, (val >> 6) & 0x1f, s->mac_mii_data);
 +            lan9118_phy_write(&s->mii, (val >> 6) & 0x1f, s->mac_mii_data);
          } else {
 -            s->mac_mii_data = do_phy_read(s, (val >> 6) & 0x1f);
 +            s->mac_mii_data = lan9118_phy_read(&s->mii, (val >> 6) & 0x1f);
              DPRINTF("PHY read %d = 0x%04x\n",
                      (val >> 6) & 0x1f, s->mac_mii_data);
          }
@@ -XXX,XX +XXX,XX @@ static void lan9118_writel(void *opaque, hwaddr offset,
          break;
      case CSR_PMT_CTRL:
          if (val & 0x400) {
 -            phy_reset(s);
 +            lan9118_phy_reset(&s->mii);
          }
          s->pmt_ctrl &= ~0x34e;
          s->pmt_ctrl |= (val & 0x34e);
@@ -XXX,XX +XXX,XX @@ static void lan9118_realize(DeviceState *dev, Error **errp)
      const MemoryRegionOps *mem_ops =
              s->mode_16bit ? &lan9118_16bit_mem_ops : &lan9118_mem_ops;
 +    qemu_init_irq(&s->mii_irq, lan9118_update_irq, s, 0);
 +    object_initialize_child(OBJECT(s), "mii", &s->mii, TYPE_LAN9118_PHY);
 +    if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(&s->mii), errp)) {
 +        return;
 +    }
 +    qdev_connect_gpio_out(DEVICE(&s->mii), 0, &s->mii_irq);
 +
      memory_region_init_io(&s->mmio, OBJECT(dev), mem_ops, s,
                            "lan9118-mmio", 0x100);
      sysbus_init_mmio(sbd, &s->mmio);
 diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * SMSC LAN9118 PHY emulation
 + *
 + * Copyright (c) 2009 CodeSourcery, LLC.
 + * Written by Paul Brook
 + *
 + * This code is licensed under the GNU GPL v2
 + *
 + * Contributions after 2012-01-13 are licensed under the terms of the
 + * GNU GPL, version 2 or (at your option) any later version.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "hw/net/lan9118_phy.h"
 +#include "hw/irq.h"
 +#include "hw/resettable.h"
 +#include "migration/vmstate.h"
 +#include "qemu/log.h"
 +
 +#define PHY_INT_ENERGYON            (1 << 7)
 +#define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
 +#define PHY_INT_FAULT               (1 << 5)
 +#define PHY_INT_DOWN                (1 << 4)
 +#define PHY_INT_AUTONEG_LP          (1 << 3)
 +#define PHY_INT_PARFAULT            (1 << 2)
 +#define PHY_INT_AUTONEG_PAGE        (1 << 1)
 +
 +static void lan9118_phy_update_irq(Lan9118PhyState *s)
 +{
 +    qemu_set_irq(s->irq, !!(s->ints & s->int_mask));
 +}
 +
 +uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
 +{
 +    uint16_t val;
 +
 +    switch (reg) {
 +    case 0: /* Basic Control */
 +        return s->control;
 +    case 1: /* Basic Status */
 +        return s->status;
 +    case 2: /* ID1 */
 +        return 0x0007;
 +    case 3: /* ID2 */
 +        return 0xc0d1;
 +    case 4: /* Auto-neg advertisement */
 +        return s->advertise;
 +    case 5: /* Auto-neg Link Partner Ability */
 +        return 0x0f71;
 +    case 6: /* Auto-neg Expansion */
 +        return 1;
 +        /* TODO 17, 18, 27, 29, 30, 31 */
 +    case 29: /* Interrupt source. */
 +        val = s->ints;
 +        s->ints = 0;
 +        lan9118_phy_update_irq(s);
 +        return val;
 +    case 30: /* Interrupt mask */
 +        return s->int_mask;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "lan9118_phy_read: PHY read reg %d\n", reg);
 +        return 0;
 +    }
 +}
 +
 +void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
 +{
 +    switch (reg) {
 +    case 0: /* Basic Control */
 +        if (val & 0x8000) {
 +            lan9118_phy_reset(s);
 +            break;
 +        }
 +        s->control = val & 0x7980;
 +        /* Complete autonegotiation immediately. */
 +        if (val & 0x1000) {
 +            s->status |= 0x0020;
 +        }
 +        break;
 +    case 4: /* Auto-neg advertisement */
 +        s->advertise = (val & 0x2d7f) | 0x80;
 +        break;
 +        /* TODO 17, 18, 27, 31 */
 +    case 30: /* Interrupt mask */
 +        s->int_mask = val & 0xff;
 +        lan9118_phy_update_irq(s);
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "lan9118_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
 +    }
 +}
 +
 +void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
 +{
 +    s->link_down = link_down;
 +
 +    /* Autonegotiation status mirrors link status. */
 +    if (link_down) {
 +        s->status &= ~0x0024;
 +        s->ints |= PHY_INT_DOWN;
 +    } else {
 +        s->status |= 0x0024;
 +        s->ints |= PHY_INT_ENERGYON;
 +        s->ints |= PHY_INT_AUTONEG_COMPLETE;
 +    }
 +    lan9118_phy_update_irq(s);
 +}
 +
 +void lan9118_phy_reset(Lan9118PhyState *s)
 +{
 +    s->control = 0x3000;
 +    s->status = 0x7809;
 +    s->advertise = 0x01e1;
 +    s->int_mask = 0;
 +    s->ints = 0;
 +    lan9118_phy_update_link(s, s->link_down);
 +}
 +
 +static void lan9118_phy_reset_hold(Object *obj, ResetType type)
 +{
 +    Lan9118PhyState *s = LAN9118_PHY(obj);
 +
 +    lan9118_phy_reset(s);
 +}
 +
 +static void lan9118_phy_init(Object *obj)
 +{
 +    Lan9118PhyState *s = LAN9118_PHY(obj);
 +
 +    qdev_init_gpio_out(DEVICE(s), &s->irq, 1);
 +}
 +
 +static const VMStateDescription vmstate_lan9118_phy = {
 +    .name = "lan9118-phy",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .fields = (const VMStateField[]) {
 +        VMSTATE_UINT16(control, Lan9118PhyState),
 +        VMSTATE_UINT16(status, Lan9118PhyState),
 +        VMSTATE_UINT16(advertise, Lan9118PhyState),
 +        VMSTATE_UINT16(ints, Lan9118PhyState),
 +        VMSTATE_UINT16(int_mask, Lan9118PhyState),
 +        VMSTATE_BOOL(link_down, Lan9118PhyState),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
 +static void lan9118_phy_class_init(ObjectClass *klass, void *data)
 +{
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    rc->phases.hold = lan9118_phy_reset_hold;
 +    dc->vmsd = &vmstate_lan9118_phy;
 +}
 +
 +static const TypeInfo types[] = {
 +    {
 +        .name          = TYPE_LAN9118_PHY,
 +        .parent        = TYPE_SYS_BUS_DEVICE,
 +        .instance_size = sizeof(Lan9118PhyState),
 +        .instance_init = lan9118_phy_init,
 +        .class_init    = lan9118_phy_class_init,
 +    }
 +};
 +
 +DEFINE_TYPES(types)
 diff --git a/hw/net/Kconfig b/hw/net/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/Kconfig
 +++ b/hw/net/Kconfig
@@ -XXX,XX +XXX,XX @@ config VMXNET3_PCI
  config SMC91C111
      bool
 +config LAN9118_PHY
 +    bool
 +
  config LAN9118
      bool
 +    select LAN9118_PHY
      select PTIMER
  config NE2000_ISA
 diff --git a/hw/net/meson.build b/hw/net/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/meson.build
 +++ b/hw/net/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VMXNET3_PCI', if_true: files('vmxnet3.c'))
  system_ss.add(when: 'CONFIG_SMC91C111', if_true: files('smc91c111.c'))
  system_ss.add(when: 'CONFIG_LAN9118', if_true: files('lan9118.c'))
 +system_ss.add(when: 'CONFIG_LAN9118_PHY', if_true: files('lan9118_phy.c'))
  system_ss.add(when: 'CONFIG_NE2000_ISA', if_true: files('ne2000-isa.c'))
  system_ss.add(when: 'CONFIG_OPENCORES_ETH', if_true: files('opencores_eth.c'))
  system_ss.add(when: 'CONFIG_XGMAC', if_true: files('xgmac.c'))
 --
 .34.1

-[PULL 21/21] hw: arm: allwinner-h3: Fix and complete H3 i2c devices
+[PULL 02/72] hw/net/lan9118_phy: Reuse in imx_fec and consolidate implementations
-From: qianfan Zhao <qianfanguijin@163.com>
+From: Bernhard Beschow <shentey@gmail.com>
-Allwinner h3 has 4 twi(i2c) devices named twi0, twi1, twi2 and r_twi.
+imx_fec models the same PHY as lan9118_phy. The code is almost the same with
-The registers are compatible with TYPE_AW_I2C_SUN6I, write 1 to clear
+imx_fec having more logging and tracing. Merge these improvements into
-control register's INT_FLAG bit.
+lan9118_phy and reuse in imx_fec to fix the code duplication.
-Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
+Some migration state how resides in the new device model which breaks migration
-Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
+compatibility for the following machines:
 * imx25-pdk
 * sabrelite
 * mcimx7d-sabre
 * mcimx6ul-evk
 Signed-off-by: Bernhard Beschow <shentey@gmail.com>
 Tested-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20241102125724.532843-3-shentey@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/allwinner-h3.h |  6 ++++++
+ include/hw/net/imx_fec.h |   9 ++-
- hw/arm/allwinner-h3.c         | 29 +++++++++++++++++++++++++----
+ hw/net/imx_fec.c         | 146 ++++-----------------------------------
-files changed, 31 insertions(+), 4 deletions(-)
+ hw/net/lan9118_phy.c     |  82 ++++++++++++++++------
  hw/net/Kconfig           |   1 +
  hw/net/trace-events      |  10 +--
 files changed, 85 insertions(+), 163 deletions(-)
-diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
+diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/allwinner-h3.h
+--- a/include/hw/net/imx_fec.h
-+++ b/include/hw/arm/allwinner-h3.h
++++ b/include/hw/net/imx_fec.h
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(IMXFECState, IMX_FEC)
-     AW_H3_DEV_UART3,
+ #define TYPE_IMX_ENET "imx.enet"
-     AW_H3_DEV_EMAC,
-     AW_H3_DEV_TWI0,
+ #include "hw/sysbus.h"
-+    AW_H3_DEV_TWI1,
++#include "hw/net/lan9118_phy.h"
-+    AW_H3_DEV_TWI2,
++#include "hw/irq.h"
-     AW_H3_DEV_DRAMCOM,
+ #include "net/net.h"
-     AW_H3_DEV_DRAMCTL,
-     AW_H3_DEV_DRAMPHY,
+ #define ENET_EIR               1
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ struct IMXFECState {
-     AW_H3_DEV_GIC_VCPU,
+     uint32_t tx_descriptor[ENET_TX_RING_NUM];
-     AW_H3_DEV_RTC,
+     uint32_t tx_ring_num;
-     AW_H3_DEV_CPUCFG,
-+    AW_H3_DEV_R_TWI,
+-    uint32_t phy_status;
-     AW_H3_DEV_SDRAM
+-    uint32_t phy_control;
 -    uint32_t phy_advertise;
 -    uint32_t phy_int;
 -    uint32_t phy_int_mask;
 +    Lan9118PhyState mii;
 +    IRQState mii_irq;
      uint32_t phy_num;
      bool phy_connected;
      struct IMXFECState *phy_consumer;
 diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/imx_fec.c
 +++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_eth_txdescs = {
  static const VMStateDescription vmstate_imx_eth = {
      .name = TYPE_IMX_FEC,
 -    .version_id = 2,
 -    .minimum_version_id = 2,
 +    .version_id = 3,
 +    .minimum_version_id = 3,
      .fields = (const VMStateField[]) {
          VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX),
          VMSTATE_UINT32(rx_descriptor, IMXFECState),
          VMSTATE_UINT32(tx_descriptor[0], IMXFECState),
 -        VMSTATE_UINT32(phy_status, IMXFECState),
 -        VMSTATE_UINT32(phy_control, IMXFECState),
 -        VMSTATE_UINT32(phy_advertise, IMXFECState),
 -        VMSTATE_UINT32(phy_int, IMXFECState),
 -        VMSTATE_UINT32(phy_int_mask, IMXFECState),
          VMSTATE_END_OF_LIST()
      },
      .subsections = (const VMStateDescription * const []) {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_eth = {
      },
  };
-@@ -XXX,XX +XXX,XX @@ struct AwH3State {
+-#define PHY_INT_ENERGYON            (1 << 7)
-     AwSidState sid;
+-#define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
-     AwSdHostState mmc0;
+-#define PHY_INT_FAULT               (1 << 5)
-     AWI2CState i2c0;
+-#define PHY_INT_DOWN                (1 << 4)
-+    AWI2CState i2c1;
+-#define PHY_INT_AUTONEG_LP          (1 << 3)
-+    AWI2CState i2c2;
+-#define PHY_INT_PARFAULT            (1 << 2)
-+    AWI2CState r_twi;
+-#define PHY_INT_AUTONEG_PAGE        (1 << 1)
-     AwSun8iEmacState emac;
+-
-     AwRtcState rtc;
+ static void imx_eth_update(IMXFECState *s);
-     GICState gic;
-diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
+ /*
@@ -XXX,XX +XXX,XX @@ static void imx_eth_update(IMXFECState *s);
   * For now we don't handle any GPIO/interrupt line, so the OS will
   * have to poll for the PHY status.
   */
 -static void imx_phy_update_irq(IMXFECState *s)
 +static void imx_phy_update_irq(void *opaque, int n, int level)
  {
 -    imx_eth_update(s);
 -}
 -
 -static void imx_phy_update_link(IMXFECState *s)
 -{
 -    /* Autonegotiation status mirrors link status.  */
 -    if (qemu_get_queue(s->nic)->link_down) {
 -        trace_imx_phy_update_link("down");
 -        s->phy_status &= ~0x0024;
 -        s->phy_int |= PHY_INT_DOWN;
 -    } else {
 -        trace_imx_phy_update_link("up");
 -        s->phy_status |= 0x0024;
 -        s->phy_int |= PHY_INT_ENERGYON;
 -        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
 -    }
 -    imx_phy_update_irq(s);
 +    imx_eth_update(opaque);
  }
  static void imx_eth_set_link(NetClientState *nc)
  {
 -    imx_phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc)));
 -}
 -
 -static void imx_phy_reset(IMXFECState *s)
 -{
 -    trace_imx_phy_reset();
 -
 -    s->phy_status = 0x7809;
 -    s->phy_control = 0x3000;
 -    s->phy_advertise = 0x01e1;
 -    s->phy_int_mask = 0;
 -    s->phy_int = 0;
 -    imx_phy_update_link(s);
 +    lan9118_phy_update_link(&IMX_FEC(qemu_get_nic_opaque(nc))->mii,
 +                            nc->link_down);
  }
  static uint32_t imx_phy_read(IMXFECState *s, int reg)
  {
 -    uint32_t val;
      uint32_t phy = reg / 32;
      if (!s->phy_connected) {
@@ -XXX,XX +XXX,XX @@ static uint32_t imx_phy_read(IMXFECState *s, int reg)
      reg %= 32;
 -    switch (reg) {
 -    case 0:     /* Basic Control */
 -        val = s->phy_control;
 -        break;
 -    case 1:     /* Basic Status */
 -        val = s->phy_status;
 -        break;
 -    case 2:     /* ID1 */
 -        val = 0x0007;
 -        break;
 -    case 3:     /* ID2 */
 -        val = 0xc0d1;
 -        break;
 -    case 4:     /* Auto-neg advertisement */
 -        val = s->phy_advertise;
 -        break;
 -    case 5:     /* Auto-neg Link Partner Ability */
 -        val = 0x0f71;
 -        break;
 -    case 6:     /* Auto-neg Expansion */
 -        val = 1;
 -        break;
 -    case 29:    /* Interrupt source.  */
 -        val = s->phy_int;
 -        s->phy_int = 0;
 -        imx_phy_update_irq(s);
 -        break;
 -    case 30:    /* Interrupt mask */
 -        val = s->phy_int_mask;
 -        break;
 -    case 17:
 -    case 18:
 -    case 27:
 -    case 31:
 -        qemu_log_mask(LOG_UNIMP, "[%s.phy]%s: reg %d not implemented\n",
 -                      TYPE_IMX_FEC, __func__, reg);
 -        val = 0;
 -        break;
 -    default:
 -        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
 -                      TYPE_IMX_FEC, __func__, reg);
 -        val = 0;
 -        break;
 -    }
 -
 -    trace_imx_phy_read(val, phy, reg);
 -
 -    return val;
 +    return lan9118_phy_read(&s->mii, reg);
  }
  static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)
@@ -XXX,XX +XXX,XX @@ static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)
      reg %= 32;
 -    trace_imx_phy_write(val, phy, reg);
 -
 -    switch (reg) {
 -    case 0:     /* Basic Control */
 -        if (val & 0x8000) {
 -            imx_phy_reset(s);
 -        } else {
 -            s->phy_control = val & 0x7980;
 -            /* Complete autonegotiation immediately.  */
 -            if (val & 0x1000) {
 -                s->phy_status |= 0x0020;
 -            }
 -        }
 -        break;
 -    case 4:     /* Auto-neg advertisement */
 -        s->phy_advertise = (val & 0x2d7f) | 0x80;
 -        break;
 -    case 30:    /* Interrupt mask */
 -        s->phy_int_mask = val & 0xff;
 -        imx_phy_update_irq(s);
 -        break;
 -    case 17:
 -    case 18:
 -    case 27:
 -    case 31:
 -        qemu_log_mask(LOG_UNIMP, "[%s.phy)%s: reg %d not implemented\n",
 -                      TYPE_IMX_FEC, __func__, reg);
 -        break;
 -    default:
 -        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
 -                      TYPE_IMX_FEC, __func__, reg);
 -        break;
 -    }
 +    lan9118_phy_write(&s->mii, reg, val);
  }
  static void imx_fec_read_bd(IMXFECBufDesc *bd, dma_addr_t addr)
@@ -XXX,XX +XXX,XX @@ static void imx_eth_reset(DeviceState *d)
      s->rx_descriptor = 0;
      memset(s->tx_descriptor, 0, sizeof(s->tx_descriptor));
 -
 -    /* We also reset the PHY */
 -    imx_phy_reset(s);
  }
  static uint32_t imx_default_read(IMXFECState *s, uint32_t index)
@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)
      sysbus_init_irq(sbd, &s->irq[0]);
      sysbus_init_irq(sbd, &s->irq[1]);
 +    qemu_init_irq(&s->mii_irq, imx_phy_update_irq, s, 0);
 +    object_initialize_child(OBJECT(s), "mii", &s->mii, TYPE_LAN9118_PHY);
 +    if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(&s->mii), errp)) {
 +        return;
 +    }
 +    qdev_connect_gpio_out(DEVICE(&s->mii), 0, &s->mii_irq);
 +
      qemu_macaddr_default_if_unset(&s->conf.macaddr);
      s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf,
 diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/allwinner-h3.c
+--- a/hw/net/lan9118_phy.c
-+++ b/hw/arm/allwinner-h3.c
++++ b/hw/net/lan9118_phy.c
-@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
+@@ -XXX,XX +XXX,XX @@
-     [AW_H3_DEV_UART2]      = 0x01c28800,
+  * Copyright (c) 2009 CodeSourcery, LLC.
-     [AW_H3_DEV_UART3]      = 0x01c28c00,
+  * Written by Paul Brook
-     [AW_H3_DEV_TWI0]       = 0x01c2ac00,
+  *
-+    [AW_H3_DEV_TWI1]       = 0x01c2b000,
++ * Copyright (c) 2013 Jean-Christophe Dubois. <jcd@tribudubois.net>
-+    [AW_H3_DEV_TWI2]       = 0x01c2b400,
++ *
-     [AW_H3_DEV_EMAC]       = 0x01c30000,
+  * This code is licensed under the GNU GPL v2
-     [AW_H3_DEV_DRAMCOM]    = 0x01c62000,
+  *
-     [AW_H3_DEV_DRAMCTL]    = 0x01c63000,
+  * Contributions after 2012-01-13 are licensed under the terms of the
-@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
+@@ -XXX,XX +XXX,XX @@
-     [AW_H3_DEV_GIC_VCPU]   = 0x01c86000,
+ #include "hw/resettable.h"
-     [AW_H3_DEV_RTC]        = 0x01f00000,
+ #include "migration/vmstate.h"
-     [AW_H3_DEV_CPUCFG]     = 0x01f01c00,
+ #include "qemu/log.h"
-+    [AW_H3_DEV_R_TWI]      = 0x01f02400,
++#include "trace.h"
-     [AW_H3_DEV_SDRAM]      = 0x40000000
- };
+ #define PHY_INT_ENERGYON            (1 << 7)
+ #define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
-@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
+@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
-     { "uart1",     0x01c28400, 1 * KiB },
-     { "uart2",     0x01c28800, 1 * KiB },
+     switch (reg) {
-     { "uart3",     0x01c28c00, 1 * KiB },
+     case 0: /* Basic Control */
--    { "twi1",      0x01c2b000, 1 * KiB },
+-        return s->control;
--    { "twi2",      0x01c2b400, 1 * KiB },
++        val = s->control;
-     { "scr",       0x01c2c400, 1 * KiB },
++        break;
-     { "gpu",       0x01c40000, 64 * KiB },
+     case 1: /* Basic Status */
-     { "hstmr",     0x01c60000, 4 * KiB },
+-        return s->status;
-@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
++        val = s->status;
-     { "r_prcm",    0x01f01400, 1 * KiB },
++        break;
-     { "r_twd",     0x01f01800, 1 * KiB },
+     case 2: /* ID1 */
-     { "r_cir-rx",  0x01f02000, 1 * KiB },
+-        return 0x0007;
--    { "r_twi",     0x01f02400, 1 * KiB },
++        val = 0x0007;
-     { "r_uart",    0x01f02800, 1 * KiB },
++        break;
-     { "r_pio",     0x01f02c00, 1 * KiB },
+     case 3: /* ID2 */
-     { "r_pwm",     0x01f03800, 1 * KiB },
+-        return 0xc0d1;
-@@ -XXX,XX +XXX,XX @@ enum {
++        val = 0xc0d1;
-     AW_H3_GIC_SPI_UART2     =  2,
++        break;
-     AW_H3_GIC_SPI_UART3     =  3,
+     case 4: /* Auto-neg advertisement */
-     AW_H3_GIC_SPI_TWI0      =  6,
+-        return s->advertise;
-+    AW_H3_GIC_SPI_TWI1      =  7,
++        val = s->advertise;
-+    AW_H3_GIC_SPI_TWI2      =  8,
++        break;
-     AW_H3_GIC_SPI_TIMER0    = 18,
+     case 5: /* Auto-neg Link Partner Ability */
-     AW_H3_GIC_SPI_TIMER1    = 19,
+-        return 0x0f71;
-+    AW_H3_GIC_SPI_R_TWI     = 44,
++        val = 0x0f71;
-     AW_H3_GIC_SPI_MMC0      = 60,
++        break;
-     AW_H3_GIC_SPI_EHCI0     = 72,
+     case 6: /* Auto-neg Expansion */
-     AW_H3_GIC_SPI_OHCI0     = 73,
+-        return 1;
-@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
+-        /* TODO 17, 18, 27, 29, 30, 31 */
++        val = 1;
-     object_initialize_child(obj, "rtc", &s->rtc, TYPE_AW_RTC_SUN6I);
++        break;
+     case 29: /* Interrupt source. */
--    object_initialize_child(obj, "twi0", &s->i2c0, TYPE_AW_I2C);
+         val = s->ints;
-+    object_initialize_child(obj, "twi0",  &s->i2c0,  TYPE_AW_I2C_SUN6I);
+         s->ints = 0;
-+    object_initialize_child(obj, "twi1",  &s->i2c1,  TYPE_AW_I2C_SUN6I);
+         lan9118_phy_update_irq(s);
-+    object_initialize_child(obj, "twi2",  &s->i2c2,  TYPE_AW_I2C_SUN6I);
+-        return val;
-+    object_initialize_child(obj, "r_twi", &s->r_twi, TYPE_AW_I2C_SUN6I);
++        break;
- }
+     case 30: /* Interrupt mask */
+-        return s->int_mask;
- static void allwinner_h3_realize(DeviceState *dev, Error **errp)
++        val = s->int_mask;
-@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
++        break;
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c0), 0,
++    case 17:
-                        qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI0));
++    case 18:
++    case 27:
-+    sysbus_realize(SYS_BUS_DEVICE(&s->i2c1), &error_fatal);
++    case 31:
-+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c1), 0, s->memmap[AW_H3_DEV_TWI1]);
++        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
-+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c1), 0,
++                      __func__, reg);
-+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI1));
++        val = 0;
-+
++        break;
-+    sysbus_realize(SYS_BUS_DEVICE(&s->i2c2), &error_fatal);
+     default:
-+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c2), 0, s->memmap[AW_H3_DEV_TWI2]);
+-        qemu_log_mask(LOG_GUEST_ERROR,
-+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c2), 0,
+-                      "lan9118_phy_read: PHY read reg %d\n", reg);
-+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI2));
+-        return 0;
-+
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
-+    sysbus_realize(SYS_BUS_DEVICE(&s->r_twi), &error_fatal);
++                      __func__, reg);
-+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->r_twi), 0, s->memmap[AW_H3_DEV_R_TWI]);
++        val = 0;
-+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->r_twi), 0,
++        break;
-+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_R_TWI));
+     }
 +
-     /* Unimplemented devices */
++    trace_lan9118_phy_read(val, reg);
-     for (i = 0; i < ARRAY_SIZE(unimplemented); i++) {
++
-         create_unimplemented_device(unimplemented[i].device_name,
++    return val;
  }
  void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
  {
 +    trace_lan9118_phy_write(val, reg);
 +
      switch (reg) {
      case 0: /* Basic Control */
          if (val & 0x8000) {
              lan9118_phy_reset(s);
 -            break;
 -        }
 -        s->control = val & 0x7980;
 -        /* Complete autonegotiation immediately. */
 -        if (val & 0x1000) {
 -            s->status |= 0x0020;
 +        } else {
 +            s->control = val & 0x7980;
 +            /* Complete autonegotiation immediately. */
 +            if (val & 0x1000) {
 +                s->status |= 0x0020;
 +            }
          }
          break;
      case 4: /* Auto-neg advertisement */
          s->advertise = (val & 0x2d7f) | 0x80;
          break;
 -        /* TODO 17, 18, 27, 31 */
      case 30: /* Interrupt mask */
          s->int_mask = val & 0xff;
          lan9118_phy_update_irq(s);
          break;
 +    case 17:
 +    case 18:
 +    case 27:
 +    case 31:
 +        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
 +                      __func__, reg);
 +        break;
      default:
 -        qemu_log_mask(LOG_GUEST_ERROR,
 -                      "lan9118_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
 +                      __func__, reg);
 +        break;
      }
  }
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
      /* Autonegotiation status mirrors link status. */
      if (link_down) {
 +        trace_lan9118_phy_update_link("down");
          s->status &= ~0x0024;
          s->ints |= PHY_INT_DOWN;
      } else {
 +        trace_lan9118_phy_update_link("up");
          s->status |= 0x0024;
          s->ints |= PHY_INT_ENERGYON;
          s->ints |= PHY_INT_AUTONEG_COMPLETE;
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
  void lan9118_phy_reset(Lan9118PhyState *s)
  {
 +    trace_lan9118_phy_reset();
 +
      s->control = 0x3000;
      s->status = 0x7809;
      s->advertise = 0x01e1;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_lan9118_phy = {
      .version_id = 1,
      .minimum_version_id = 1,
      .fields = (const VMStateField[]) {
 -        VMSTATE_UINT16(control, Lan9118PhyState),
          VMSTATE_UINT16(status, Lan9118PhyState),
 +        VMSTATE_UINT16(control, Lan9118PhyState),
          VMSTATE_UINT16(advertise, Lan9118PhyState),
          VMSTATE_UINT16(ints, Lan9118PhyState),
          VMSTATE_UINT16(int_mask, Lan9118PhyState),
 diff --git a/hw/net/Kconfig b/hw/net/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/Kconfig
 +++ b/hw/net/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_SUN8I_EMAC
  config IMX_FEC
      bool
 +    select LAN9118_PHY
  config CADENCE
      bool
 diff --git a/hw/net/trace-events b/hw/net/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/trace-events
 +++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ allwinner_sun8i_emac_set_link(bool active) "Set link: active=%u"
  allwinner_sun8i_emac_read(uint64_t offset, uint64_t val) "MMIO read: offset=0x%" PRIx64 " value=0x%" PRIx64
  allwinner_sun8i_emac_write(uint64_t offset, uint64_t val) "MMIO write: offset=0x%" PRIx64 " value=0x%" PRIx64
 +# lan9118_phy.c
 +lan9118_phy_read(uint16_t val, int reg) "[0x%02x] -> 0x%04" PRIx16
 +lan9118_phy_write(uint16_t val, int reg) "[0x%02x] <- 0x%04" PRIx16
 +lan9118_phy_update_link(const char *s) "%s"
 +lan9118_phy_reset(void) ""
 +
  # lance.c
  lance_mem_readw(uint64_t addr, uint32_t ret) "addr=0x%"PRIx64"val=0x%04x"
  lance_mem_writew(uint64_t addr, uint32_t val) "addr=0x%"PRIx64"val=0x%04x"
@@ -XXX,XX +XXX,XX @@ i82596_set_multicast(uint16_t count) "Added %d multicast entries"
  i82596_channel_attention(void *s) "%p: Received CHANNEL ATTENTION"
  # imx_fec.c
 -imx_phy_read(uint32_t val, int phy, int reg) "0x%04"PRIx32" <= phy[%d].reg[%d]"
  imx_phy_read_num(int phy, int configured) "read request from unconfigured phy %d (configured %d)"
 -imx_phy_write(uint32_t val, int phy, int reg) "0x%04"PRIx32" => phy[%d].reg[%d]"
  imx_phy_write_num(int phy, int configured) "write request to unconfigured phy %d (configured %d)"
 -imx_phy_update_link(const char *s) "%s"
 -imx_phy_reset(void) ""
  imx_fec_read_bd(uint64_t addr, int flags, int len, int data) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x"
  imx_enet_read_bd(uint64_t addr, int flags, int len, int data, int options, int status) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x option 0x%04x status 0x%04x"
  imx_eth_tx_bd_busy(void) "tx_bd ran out of descriptors to transmit"
 --
 .34.1

-New patch
+[PULL 03/72] hw/net/lan9118_phy: Fix off-by-one error in MII_ANLPAR register
+From: Bernhard Beschow <shentey@gmail.com>
+Turns 0x70 into 0xe0 (== 0x70 << 1) which adds the missing MII_ANLPAR_TX and
+fixes the MSB of selector field to be zero, as specified in the datasheet.
+Fixes: 2a424990170b "LAN9118 emulation"
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
+Tested-by: Guenter Roeck <linux@roeck-us.net>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20241102125724.532843-4-shentey@gmail.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/net/lan9118_phy.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/lan9118_phy.c
++++ b/hw/net/lan9118_phy.c
+@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
+         val = s->advertise;
+         break;
+     case 5: /* Auto-neg Link Partner Ability */
+-        val = 0x0f71;
++        val = 0x0fe1;
+         break;
+     case 6: /* Auto-neg Expansion */
+         val = 1;
+--
+.34.1

-[PULL 07/21] target/arm: Fix svep width in arm_gen_dynamic_svereg_xml
+[PULL 04/72] hw/net/lan9118_phy: Reuse MII constants
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Bernhard Beschow <shentey@gmail.com>
-Define svep based on the size of the predicates,
+Prefer named constants over magic values for better readability.
 not the primary vector registers.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
-Message-id: 20230227213329.793795-8-richard.henderson@linaro.org
+Tested-by: Guenter Roeck <linux@roeck-us.net>
 Message-id: 20241102125724.532843-5-shentey@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/gdbstub64.c | 2 +-
+ include/hw/net/mii.h |  6 +++++
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/net/lan9118_phy.c | 63 ++++++++++++++++++++++++++++----------------
 files changed, 46 insertions(+), 23 deletions(-)
-diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
+diff --git a/include/hw/net/mii.h b/include/hw/net/mii.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub64.c
+--- a/include/hw/net/mii.h
-+++ b/target/arm/gdbstub64.c
++++ b/include/hw/net/mii.h
-@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
+@@ -XXX,XX +XXX,XX @@
-     /* Create the predicate vector type. */
+ #define MII_BMSR_JABBER     (1 << 1)  /* Jabber detected */
-     g_string_append_printf(s,
+ #define MII_BMSR_EXTCAP     (1 << 0)  /* Ext-reg capability */
-                            "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
--                           reg_width / 8);
++#define MII_ANAR_RFAULT     (1 << 13) /* Say we can detect faults */
-+                           pred_width / 8);
+ #define MII_ANAR_PAUSE_ASYM (1 << 11) /* Try for asymmetric pause */
+ #define MII_ANAR_PAUSE      (1 << 10) /* Try for pause */
-     /* Define the vector registers. */
+ #define MII_ANAR_TXFD       (1 << 8)
-     for (i = 0; i < 32; i++) {
+@@ -XXX,XX +XXX,XX @@
  #define MII_ANAR_10FD       (1 << 6)
  #define MII_ANAR_10         (1 << 5)
  #define MII_ANAR_CSMACD     (1 << 0)
 +#define MII_ANAR_SELECT     (0x001f)  /* Selector bits */
  #define MII_ANLPAR_ACK      (1 << 14)
  #define MII_ANLPAR_PAUSEASY (1 << 11) /* can pause asymmetrically */
@@ -XXX,XX +XXX,XX @@
  #define RTL8201CP_PHYID1    0x0000
  #define RTL8201CP_PHYID2    0x8201
 +/* SMSC LAN9118 */
 +#define SMSCLAN9118_PHYID1  0x0007
 +#define SMSCLAN9118_PHYID2  0xc0d1
 +
  /* RealTek 8211E */
  #define RTL8211E_PHYID1     0x001c
  #define RTL8211E_PHYID2     0xc915
 diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/lan9118_phy.c
 +++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "hw/net/lan9118_phy.h"
 +#include "hw/net/mii.h"
  #include "hw/irq.h"
  #include "hw/resettable.h"
  #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
      uint16_t val;
      switch (reg) {
 -    case 0: /* Basic Control */
 +    case MII_BMCR:
          val = s->control;
          break;
 -    case 1: /* Basic Status */
 +    case MII_BMSR:
          val = s->status;
          break;
 -    case 2: /* ID1 */
 -        val = 0x0007;
 +    case MII_PHYID1:
 +        val = SMSCLAN9118_PHYID1;
          break;
 -    case 3: /* ID2 */
 -        val = 0xc0d1;
 +    case MII_PHYID2:
 +        val = SMSCLAN9118_PHYID2;
          break;
 -    case 4: /* Auto-neg advertisement */
 +    case MII_ANAR:
          val = s->advertise;
          break;
 -    case 5: /* Auto-neg Link Partner Ability */
 -        val = 0x0fe1;
 +    case MII_ANLPAR:
 +        val = MII_ANLPAR_PAUSEASY | MII_ANLPAR_PAUSE | MII_ANLPAR_T4 |
 +              MII_ANLPAR_TXFD | MII_ANLPAR_TX | MII_ANLPAR_10FD |
 +              MII_ANLPAR_10 | MII_ANLPAR_CSMACD;
          break;
 -    case 6: /* Auto-neg Expansion */
 -        val = 1;
 +    case MII_ANER:
 +        val = MII_ANER_NWAY;
          break;
      case 29: /* Interrupt source. */
          val = s->ints;
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
      trace_lan9118_phy_write(val, reg);
      switch (reg) {
 -    case 0: /* Basic Control */
 -        if (val & 0x8000) {
 +    case MII_BMCR:
 +        if (val & MII_BMCR_RESET) {
              lan9118_phy_reset(s);
          } else {
 -            s->control = val & 0x7980;
 +            s->control = val & (MII_BMCR_LOOPBACK | MII_BMCR_SPEED100 |
 +                                MII_BMCR_AUTOEN | MII_BMCR_PDOWN | MII_BMCR_FD |
 +                                MII_BMCR_CTST);
              /* Complete autonegotiation immediately. */
 -            if (val & 0x1000) {
 -                s->status |= 0x0020;
 +            if (val & MII_BMCR_AUTOEN) {
 +                s->status |= MII_BMSR_AN_COMP;
              }
          }
          break;
 -    case 4: /* Auto-neg advertisement */
 -        s->advertise = (val & 0x2d7f) | 0x80;
 +    case MII_ANAR:
 +        s->advertise = (val & (MII_ANAR_RFAULT | MII_ANAR_PAUSE_ASYM |
 +                               MII_ANAR_PAUSE | MII_ANAR_10FD | MII_ANAR_10 |
 +                               MII_ANAR_SELECT))
 +                     | MII_ANAR_TX;
          break;
      case 30: /* Interrupt mask */
          s->int_mask = val & 0xff;
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
      /* Autonegotiation status mirrors link status. */
      if (link_down) {
          trace_lan9118_phy_update_link("down");
 -        s->status &= ~0x0024;
 +        s->status &= ~(MII_BMSR_AN_COMP | MII_BMSR_LINK_ST);
          s->ints |= PHY_INT_DOWN;
      } else {
          trace_lan9118_phy_update_link("up");
 -        s->status |= 0x0024;
 +        s->status |= MII_BMSR_AN_COMP | MII_BMSR_LINK_ST;
          s->ints |= PHY_INT_ENERGYON;
          s->ints |= PHY_INT_AUTONEG_COMPLETE;
      }
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_reset(Lan9118PhyState *s)
  {
      trace_lan9118_phy_reset();
 -    s->control = 0x3000;
 -    s->status = 0x7809;
 -    s->advertise = 0x01e1;
 +    s->control = MII_BMCR_AUTOEN | MII_BMCR_SPEED100;
 +    s->status = MII_BMSR_100TX_FD
 +                | MII_BMSR_100TX_HD
 +                | MII_BMSR_10T_FD
 +                | MII_BMSR_10T_HD
 +                | MII_BMSR_AUTONEG
 +                | MII_BMSR_EXTCAP;
 +    s->advertise = MII_ANAR_TXFD
 +                   | MII_ANAR_TX
 +                   | MII_ANAR_10FD
 +                   | MII_ANAR_10
 +                   | MII_ANAR_CSMACD;
      s->int_mask = 0;
      s->ints = 0;
      lan9118_phy_update_link(s, s->link_down);
 --
 .34.1

-[PULL 09/21] target/arm: Simplify iteration over bit widths
+[PULL 05/72] hw/net/lan9118_phy: Add missing 100 mbps full duplex advertisement
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Bernhard Beschow <shentey@gmail.com>
-Order suf[] by the log8 of the width.
+The real device advertises this mode and the device model already advertises
-Use ARRAY_SIZE instead of hard-coding 128.
+mbps half duplex and 10 mbps full+half duplex. So advertise this mode to
+make the model more realistic.
 This changes the order of the union definitions,
 but retains the order of the union-of-union members.
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Bernhard Beschow <shentey@gmail.com>
-Message-id: 20230227213329.793795-10-richard.henderson@linaro.org
+Tested-by: Guenter Roeck <linux@roeck-us.net>
 Message-id: 20241102125724.532843-6-shentey@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/gdbstub64.c | 10 ++++++----
+ hw/net/lan9118_phy.c | 4 ++--
-file changed, 6 insertions(+), 4 deletions(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
+diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub64.c
+--- a/hw/net/lan9118_phy.c
-+++ b/target/arm/gdbstub64.c
++++ b/hw/net/lan9118_phy.c
-@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
+@@ -XXX,XX +XXX,XX @@ void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
-         { "int8", 8, 'b', 's' },
+         break;
-     };
+     case MII_ANAR:
+         s->advertise = (val & (MII_ANAR_RFAULT | MII_ANAR_PAUSE_ASYM |
--    static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
+-                               MII_ANAR_PAUSE | MII_ANAR_10FD | MII_ANAR_10 |
--    int i, j, bits;
+-                               MII_ANAR_SELECT))
-+    static const char suf[] = { 'b', 'h', 's', 'd', 'q' };
++                               MII_ANAR_PAUSE | MII_ANAR_TXFD | MII_ANAR_10FD |
-+    int i, j;
++                               MII_ANAR_10 | MII_ANAR_SELECT))
+                      | MII_ANAR_TX;
-     /* First define types and totals in a whole VL */
+         break;
-     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
+     case 30: /* Interrupt mask */
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
       * signed and potentially float versions of each size from 128 to
       * 8 bits.
       */
 -    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 +    for (i = 0; i < ARRAY_SIZE(suf); i++) {
 +        int bits = 8 << i;
 +
          g_string_append_printf(s, "<union id=\"%sn%c\">", name, suf[i]);
          for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
              if (vec_lanes[j].size == bits) {
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
      /* And now the final union of unions */
      g_string_append_printf(s, "<union id=\"%s\">", name);
 -    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 +    for (i = ARRAY_SIZE(suf) - 1; i >= 0; i--) {
          g_string_append_printf(s, "<field name=\"%c\" type=\"%sn%c\"/>",
                                 suf[i], name, suf[i]);
      }
 --
 .34.1

-New patch
+[PULL 06/72] fpu: handle raising Invalid for infzero in pick_nan_muladd
+For IEEE fused multiply-add, the (0 * inf) + NaN case should raise
+Invalid for the multiplication of 0 by infinity.  Currently we handle
+this in the per-architecture ifdef ladder in pickNaNMulAdd().
+However, since this isn't really architecture specific we can hoist
+it up to the generic code.
+For the cases where the infzero test in pickNaNMulAdd was
+returning 2, we can delete the check entirely and allow the
+code to fall into the normal pick-a-NaN handling, because this
+will return 2 anyway (input 'c' being the only NaN in this case).
+For the cases where infzero was returning 3 to indicate "return
+the default NaN", we must retain that "return 3".
+For Arm, this looks like it might be a behaviour change because we
+used to set float_flag_invalid | float_flag_invalid_imz only if C is
+a quiet NaN.  However, it is not, because Arm target code never looks
+at float_flag_invalid_imz, and for the (0 * inf) + SNaN case we
+already raised float_flag_invalid via the "abc_mask &
+float_cmask_snan" check in pick_nan_muladd.
+For any target architecture using the "default implementation" at the
+bottom of the ifdef, this is a behaviour change but will be fixing a
+bug (where we failed to raise the Invalid exception for (0 * inf +
+QNaN).  The architectures using the default case are:
+ * hppa
+ * i386
+ * sh4
+ * tricore
+The x86, Tricore and SH4 CPU architecture manuals are clear that this
+should have raised Invalid; HPPA is a bit vaguer but still seems
+clear enough.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-2-peter.maydell@linaro.org
+---
+ fpu/softfloat-parts.c.inc      | 13 +++++++------
+ fpu/softfloat-specialize.c.inc | 29 +----------------------------
+files changed, 8 insertions(+), 34 deletions(-)
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-parts.c.inc
++++ b/fpu/softfloat-parts.c.inc
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
+                                             int ab_mask, int abc_mask)
+ {
+     int which;
++    bool infzero = (ab_mask == float_cmask_infzero);
+     if (unlikely(abc_mask & float_cmask_snan)) {
+         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
+     }
+-    which = pickNaNMulAdd(a->cls, b->cls, c->cls,
+-                          ab_mask == float_cmask_infzero, s);
++    if (infzero) {
++        /* This is (0 * inf) + NaN or (inf * 0) + NaN */
++        float_raise(float_flag_invalid | float_flag_invalid_imz, s);
++    }
++
++    which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
+     if (s->default_nan_mode || which == 3) {
+-        /*
+-         * Note that this check is after pickNaNMulAdd so that function
+-         * has an opportunity to set the Invalid flag for infzero.
+-         */
+         parts_default_nan(a, s);
+         return a;
+     }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+      * the default NaN
+      */
+     if (infzero && is_qnan(c_cls)) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+         return 3;
+     }
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+          * case sets InvalidOp and returns the default NaN
+          */
+         if (infzero) {
+-            float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+             return 3;
+         }
+         /* Prefer sNaN over qNaN, in the a, b, c order. */
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+          * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
+          * case sets InvalidOp and returns the input value 'c'
+          */
+-        if (infzero) {
+-            float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-            return 2;
+-        }
+         /* Prefer sNaN over qNaN, in the c, a, b order. */
+         if (is_snan(c_cls)) {
+             return 2;
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+      * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+      * case sets InvalidOp and returns the input value 'c'
+      */
+-    if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-        return 2;
+-    }
++
+     /* Prefer sNaN over qNaN, in the c, a, b order. */
+     if (is_snan(c_cls)) {
+         return 2;
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+      * to return an input NaN if we have one (ie c) rather than generating
+      * a default NaN
+      */
+-    if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-        return 2;
+-    }
+     /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
+      * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         return 1;
+     }
+ #elif defined(TARGET_RISCV)
+-    /* For RISC-V, InvalidOp is set when multiplicands are Inf and zero */
+-    if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-    }
+     return 3; /* default NaN */
+ #elif defined(TARGET_S390X)
+     if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+         return 3;
+     }
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         return 2;
+     }
+ #elif defined(TARGET_SPARC)
+-    /* For (inf,0,nan) return c. */
+-    if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-        return 2;
+-    }
+     /* Prefer SNaN over QNaN, order C, B, A. */
+     if (is_snan(c_cls)) {
+         return 2;
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+      * For Xtensa, the (inf,zero,nan) case sets InvalidOp and returns
+      * an input NaN if we have one (ie c).
+      */
+-    if (infzero) {
+-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
+-        return 2;
+-    }
+     if (status->use_first_nan) {
+         if (is_nan(a_cls)) {
+             return 0;
+--
+.34.1

-New patch
+[PULL 07/72] fpu: Check for default_nan_mode before calling pickNaNMulAdd
+If the target sets default_nan_mode then we're always going to return
+the default NaN, and pickNaNMulAdd() no longer has any side effects.
+For consistency with pickNaN(), check for default_nan_mode before
+calling pickNaNMulAdd().
+When we convert pickNaNMulAdd() to allow runtime selection of the NaN
+propagation rule, this means we won't have to make the targets which
+use default_nan_mode also set a propagation rule.
+Since RiscV always uses default_nan_mode, this allows us to remove
+its ifdef case from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-3-peter.maydell@linaro.org
+---
+ fpu/softfloat-parts.c.inc      | 8 ++++++--
+ fpu/softfloat-specialize.c.inc | 9 +++++++--
+files changed, 13 insertions(+), 4 deletions(-)
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-parts.c.inc
++++ b/fpu/softfloat-parts.c.inc
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
+         float_raise(float_flag_invalid | float_flag_invalid_imz, s);
+     }
+-    which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
++    if (s->default_nan_mode) {
++        which = 3;
++    } else {
++        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
++    }
+-    if (s->default_nan_mode || which == 3) {
++    if (which == 3) {
+         parts_default_nan(a, s);
+         return a;
+     }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
+ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+                          bool infzero, float_status *status)
+ {
++    /*
++     * We guarantee not to require the target to tell us how to
++     * pick a NaN if we're always returning the default NaN.
++     * But if we're not in default-NaN mode then the target must
++     * specify.
++     */
++    assert(!status->default_nan_mode);
+ #if defined(TARGET_ARM)
+     /* For ARM, the (inf,zero,qnan) case sets InvalidOp and returns
+      * the default NaN
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+     } else {
+         return 1;
+     }
+-#elif defined(TARGET_RISCV)
+-    return 3; /* default NaN */
+ #elif defined(TARGET_S390X)
+     if (infzero) {
+         return 3;
+--
+.34.1

-New patch
+[PULL 08/72] softfloat: Allow runtime choice of inf * 0 + NaN result
+IEEE 758 does not define a fixed rule for what NaN to return in
 the case of a fused multiply-add of inf * 0 + NaN. Different
 architectures thus do different things:
  * some return the default NaN
  * some return the input NaN
  * Arm returns the default NaN if the input NaN is quiet,
    and the input NaN if it is signalling
 We want to make this logic be runtime selected rather than
 hardcoded into the binary, because:
  * this will let us have multiple targets in one QEMU binary
  * the Arm FEAT_AFP architectural feature includes letting
    the guest select a NaN propagation rule at runtime
 In this commit we add an enum for the propagation rule, the field in
 float_status, and the corresponding getters and setters.  We change
 pickNaNMulAdd to honour this, but because all targets still leave
 this field at its default 0 value, the fallback logic will pick the
 rule type with the old ifdef ladder.
 Note that four architectures both use the muladd softfloat functions
 and did not have a branch of the ifdef ladder to specify their
 behaviour (and so were ending up with the "default" case, probably
 wrongly): i386, HPPA, SH4 and Tricore.  SH4 and Tricore both set
 default_nan_mode, and so will never get into pickNaNMulAdd().  For
 HPPA and i386 we retain the same behaviour as the old default-case,
 which is to not ever return the default NaN.  This might not be
 correct but it is not a behaviour change.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20241202131347.498124-4-peter.maydell@linaro.org
 ---
  include/fpu/softfloat-helpers.h | 11 ++++
  include/fpu/softfloat-types.h   | 23 +++++++++
  fpu/softfloat-specialize.c.inc  | 91 ++++++++++++++++++++++-----------
 files changed, 95 insertions(+), 30 deletions(-)
 diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/fpu/softfloat-helpers.h
 +++ b/include/fpu/softfloat-helpers.h
@@ -XXX,XX +XXX,XX @@ static inline void set_float_2nan_prop_rule(Float2NaNPropRule rule,
      status->float_2nan_prop_rule = rule;
  }
 +static inline void set_float_infzeronan_rule(FloatInfZeroNaNRule rule,
 +                                             float_status *status)
 +{
 +    status->float_infzeronan_rule = rule;
 +}
 +
  static inline void set_flush_to_zero(bool val, float_status *status)
  {
      status->flush_to_zero = val;
@@ -XXX,XX +XXX,XX @@ static inline Float2NaNPropRule get_float_2nan_prop_rule(float_status *status)
      return status->float_2nan_prop_rule;
  }
 +static inline FloatInfZeroNaNRule get_float_infzeronan_rule(float_status *status)
 +{
 +    return status->float_infzeronan_rule;
 +}
 +
  static inline bool get_flush_to_zero(float_status *status)
  {
      return status->flush_to_zero;
 diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/fpu/softfloat-types.h
 +++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
      float_2nan_prop_x87,
  } Float2NaNPropRule;
 +/*
 + * Rule for result of fused multiply-add 0 * Inf + NaN.
 + * This must be a NaN, but implementations differ on whether this
 + * is the input NaN or the default NaN.
 + *
 + * You don't need to set this if default_nan_mode is enabled.
 + * When not in default-NaN mode, it is an error for the target
 + * not to set the rule in float_status if it uses muladd, and we
 + * will assert if we need to handle an input NaN and no rule was
 + * selected.
 + */
 +typedef enum __attribute__((__packed__)) {
 +    /* No propagation rule specified */
 +    float_infzeronan_none = 0,
 +    /* Result is never the default NaN (so always the input NaN) */
 +    float_infzeronan_dnan_never,
 +    /* Result is always the default NaN */
 +    float_infzeronan_dnan_always,
 +    /* Result is the default NaN if the input NaN is quiet */
 +    float_infzeronan_dnan_if_qnan,
 +} FloatInfZeroNaNRule;
 +
  /*
   * Floating Point Status. Individual architectures may maintain
   * several versions of float_status for different functions. The
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
      FloatRoundMode float_rounding_mode;
      FloatX80RoundPrec floatx80_rounding_precision;
      Float2NaNPropRule float_2nan_prop_rule;
 +    FloatInfZeroNaNRule float_infzeronan_rule;
      bool tininess_before_rounding;
      /* should denormalised results go to zero and set the inexact flag? */
      bool flush_to_zero;
 diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-specialize.c.inc
 +++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
  static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
                           bool infzero, float_status *status)
  {
 +    FloatInfZeroNaNRule rule = status->float_infzeronan_rule;
 +
      /*
       * We guarantee not to require the target to tell us how to
       * pick a NaN if we're always returning the default NaN.
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
       * specify.
       */
      assert(!status->default_nan_mode);
 +
 +    if (rule == float_infzeronan_none) {
 +        /*
 +         * Temporarily fall back to ifdef ladder
 +         */
  #if defined(TARGET_ARM)
 -    /* For ARM, the (inf,zero,qnan) case sets InvalidOp and returns
 -     * the default NaN
 -     */
 -    if (infzero && is_qnan(c_cls)) {
 -        return 3;
 +        /*
 +         * For ARM, the (inf,zero,qnan) case returns the default NaN,
 +         * but (inf,zero,snan) returns the input NaN.
 +         */
 +        rule = float_infzeronan_dnan_if_qnan;
 +#elif defined(TARGET_MIPS)
 +        if (snan_bit_is_one(status)) {
 +            /*
 +             * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
 +             * case sets InvalidOp and returns the default NaN
 +             */
 +            rule = float_infzeronan_dnan_always;
 +        } else {
 +            /*
 +             * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
 +             * case sets InvalidOp and returns the input value 'c'
 +             */
 +            rule = float_infzeronan_dnan_never;
 +        }
 +#elif defined(TARGET_PPC) || defined(TARGET_SPARC) || \
 +    defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
 +    defined(TARGET_I386) || defined(TARGET_LOONGARCH)
 +        /*
 +         * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
 +         * case sets InvalidOp and returns the input value 'c'
 +         */
 +        /*
 +         * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
 +         * to return an input NaN if we have one (ie c) rather than generating
 +         * a default NaN
 +         */
 +        rule = float_infzeronan_dnan_never;
 +#elif defined(TARGET_S390X)
 +        rule = float_infzeronan_dnan_always;
 +#endif
      }
 +    if (infzero) {
 +        /*
 +         * Inf * 0 + NaN -- some implementations return the default NaN here,
 +         * and some return the input NaN.
 +         */
 +        switch (rule) {
 +        case float_infzeronan_dnan_never:
 +            return 2;
 +        case float_infzeronan_dnan_always:
 +            return 3;
 +        case float_infzeronan_dnan_if_qnan:
 +            return is_qnan(c_cls) ? 3 : 2;
 +        default:
 +            g_assert_not_reached();
 +        }
 +    }
 +
 +#if defined(TARGET_ARM)
 +
      /* This looks different from the ARM ARM pseudocode, because the ARM ARM
       * puts the operands to a fused mac operation (a*b)+c in the order c,a,b.
       */
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      }
  #elif defined(TARGET_MIPS)
      if (snan_bit_is_one(status)) {
 -        /*
 -         * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
 -         * case sets InvalidOp and returns the default NaN
 -         */
 -        if (infzero) {
 -            return 3;
 -        }
          /* Prefer sNaN over qNaN, in the a, b, c order. */
          if (is_snan(a_cls)) {
              return 0;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
              return 2;
          }
      } else {
 -        /*
 -         * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
 -         * case sets InvalidOp and returns the input value 'c'
 -         */
          /* Prefer sNaN over qNaN, in the c, a, b order. */
          if (is_snan(c_cls)) {
              return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          }
      }
  #elif defined(TARGET_LOONGARCH64)
 -    /*
 -     * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
 -     * case sets InvalidOp and returns the input value 'c'
 -     */
 -
      /* Prefer sNaN over qNaN, in the c, a, b order. */
      if (is_snan(c_cls)) {
          return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          return 1;
      }
  #elif defined(TARGET_PPC)
 -    /* For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
 -     * to return an input NaN if we have one (ie c) rather than generating
 -     * a default NaN
 -     */
 -
      /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
       * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
       */
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          return 1;
      }
  #elif defined(TARGET_S390X)
 -    if (infzero) {
 -        return 3;
 -    }
 -
      if (is_snan(a_cls)) {
          return 0;
      } else if (is_snan(b_cls)) {
 --
 .34.1

-New patch
+[PULL 09/72] tests/fp: Explicitly set inf-zero-nan rule
+Explicitly set a rule in the softfloat tests for the inf-zero-nan
+muladd special case.  In meson.build we put -DTARGET_ARM in fpcflags,
+and so we should select here the Arm rule of
+float_infzeronan_dnan_if_qnan.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20241202131347.498124-5-peter.maydell@linaro.org
+---
+ tests/fp/fp-bench.c | 5 +++++
+ tests/fp/fp-test.c  | 5 +++++
+files changed, 10 insertions(+)
+diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-bench.c
++++ b/tests/fp/fp-bench.c
+@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
+ {
+     bench_func_t f;
++    /*
++     * These implementation-defined choices for various things IEEE
++     * doesn't specify match those used by the Arm architecture.
++     */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
++    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
+     f = bench_funcs[operation][precision];
+     g_assert(f);
+diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-test.c
++++ b/tests/fp/fp-test.c
+@@ -XXX,XX +XXX,XX @@ void run_test(void)
+ {
+     unsigned int i;
++    /*
++     * These implementation-defined choices for various things IEEE
++     * doesn't specify match those used by the Arm architecture.
++     */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
++    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
+     genCases_setLevel(test_level);
+     verCases_maxErrorCount = n_max_errors;
+--
+.34.1

-New patch
+[PULL 10/72] target/arm: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the Arm target,
+so we can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-6-peter.maydell@linaro.org
+---
+ target/arm/cpu.c               | 3 +++
+ fpu/softfloat-specialize.c.inc | 8 +-------
+files changed, 4 insertions(+), 7 deletions(-)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
+  *  * tininess-before-rounding
+  *  * 2-input NaN propagation prefers SNaN over QNaN, and then
+  *    operand A over operand B (see FPProcessNaNs() pseudocode)
++ *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
++ *    and the input NaN if it is signalling
+  */
+ static void arm_set_default_fp_behaviours(float_status *s)
+ {
+     set_float_detect_tininess(float_tininess_before_rounding, s);
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
++    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
+ }
+ static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         /*
+          * Temporarily fall back to ifdef ladder
+          */
+-#if defined(TARGET_ARM)
+-        /*
+-         * For ARM, the (inf,zero,qnan) case returns the default NaN,
+-         * but (inf,zero,snan) returns the input NaN.
+-         */
+-        rule = float_infzeronan_dnan_if_qnan;
+-#elif defined(TARGET_MIPS)
++#if defined(TARGET_MIPS)
+         if (snan_bit_is_one(status)) {
+             /*
+              * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
+--
+.34.1

-New patch
+[PULL 11/72] target/s390: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for s390, so we
+can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-7-peter.maydell@linaro.org
+---
+ target/s390x/cpu.c             | 2 ++
+ fpu/softfloat-specialize.c.inc | 2 --
+files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_hold(Object *obj, ResetType type)
+         set_float_detect_tininess(float_tininess_before_rounding,
+                                   &env->fpu_status);
+         set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fpu_status);
++        set_float_infzeronan_rule(float_infzeronan_dnan_always,
++                                  &env->fpu_status);
+        /* fall through */
+     case RESET_TYPE_S390_CPU_NORMAL:
+         env->psw.mask &= ~PSW_MASK_RI;
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+          * a default NaN
+          */
+         rule = float_infzeronan_dnan_never;
+-#elif defined(TARGET_S390X)
+-        rule = float_infzeronan_dnan_always;
+ #endif
+     }
+--
+.34.1

-New patch
+[PULL 12/72] target/ppc: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the PPC target,
+so we can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-8-peter.maydell@linaro.org
+---
+ target/ppc/cpu_init.c          | 7 +++++++
+ fpu/softfloat-specialize.c.inc | 7 +------
+files changed, 8 insertions(+), 6 deletions(-)
+diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/cpu_init.c
++++ b/target/ppc/cpu_init.c
+@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->vec_status);
++    /*
++     * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
++     * to return an input NaN if we have one (ie c) rather than generating
++     * a default NaN
++     */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->vec_status);
+     for (i = 0; i < ARRAY_SIZE(env->spr_cb); i++) {
+         ppc_spr_t *spr = &env->spr_cb[i];
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+              */
+             rule = float_infzeronan_dnan_never;
+         }
+-#elif defined(TARGET_PPC) || defined(TARGET_SPARC) || \
++#elif defined(TARGET_SPARC) || \
+     defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+         /*
+          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+          * case sets InvalidOp and returns the input value 'c'
+          */
+-        /*
+-         * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
+-         * to return an input NaN if we have one (ie c) rather than generating
+-         * a default NaN
+-         */
+         rule = float_infzeronan_dnan_never;
+ #endif
+     }
+--
+.34.1

-New patch
+[PULL 13/72] target/mips: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the MIPS target,
+so we can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-9-peter.maydell@linaro.org
+---
+ target/mips/fpu_helper.h       |  9 +++++++++
+ target/mips/msa.c              |  4 ++++
+ fpu/softfloat-specialize.c.inc | 16 +---------------
+files changed, 14 insertions(+), 15 deletions(-)
+diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/fpu_helper.h
++++ b/target/mips/fpu_helper.h
+@@ -XXX,XX +XXX,XX @@ static inline void restore_flush_mode(CPUMIPSState *env)
+ static inline void restore_snan_bit_mode(CPUMIPSState *env)
+ {
+     bool nan2008 = env->active_fpu.fcr31 & (1 << FCR31_NAN2008);
++    FloatInfZeroNaNRule izn_rule;
+     /*
+      * With nan2008, SNaNs are silenced in the usual way.
+@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
+      */
+     set_snan_bit_is_one(!nan2008, &env->active_fpu.fp_status);
+     set_default_nan_mode(!nan2008, &env->active_fpu.fp_status);
++    /*
++     * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
++     * case sets InvalidOp and returns the default NaN.
++     * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
++     * case sets InvalidOp and returns the input value 'c'.
++     */
++    izn_rule = nan2008 ? float_infzeronan_dnan_never : float_infzeronan_dnan_always;
++    set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
+ }
+ static inline void restore_fp_status(CPUMIPSState *env)
+diff --git a/target/mips/msa.c b/target/mips/msa.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/msa.c
++++ b/target/mips/msa.c
+@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
+     /* set proper signanling bit meaning ("1" means "quiet") */
+     set_snan_bit_is_one(0, &env->active_tc.msa_fp_status);
++
++    /* Inf * 0 + NaN returns the input NaN */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never,
++                              &env->active_tc.msa_fp_status);
+ }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         /*
+          * Temporarily fall back to ifdef ladder
+          */
+-#if defined(TARGET_MIPS)
+-        if (snan_bit_is_one(status)) {
+-            /*
+-             * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
+-             * case sets InvalidOp and returns the default NaN
+-             */
+-            rule = float_infzeronan_dnan_always;
+-        } else {
+-            /*
+-             * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
+-             * case sets InvalidOp and returns the input value 'c'
+-             */
+-            rule = float_infzeronan_dnan_never;
+-        }
+-#elif defined(TARGET_SPARC) || \
++#if defined(TARGET_SPARC) || \
+     defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+         /*
+--
+.34.1

-New patch
+[PULL 14/72] target/sparc: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the SPARC target,
+so we can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-10-peter.maydell@linaro.org
+---
+ target/sparc/cpu.c             | 2 ++
+ fpu/softfloat-specialize.c.inc | 3 +--
+files changed, 3 insertions(+), 2 deletions(-)
+diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sparc/cpu.c
++++ b/target/sparc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
+      * the CPU state struct so it won't get zeroed on reset.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &env->fp_status);
++    /* For inf * 0 + NaN, return the input NaN */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+     cpu_exec_realizefn(cs, &local_err);
+     if (local_err != NULL) {
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         /*
+          * Temporarily fall back to ifdef ladder
+          */
+-#if defined(TARGET_SPARC) || \
+-    defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
++#if defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+         /*
+          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+--
+.34.1

-New patch
+[PULL 15/72] target/xtensa: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the xtensa target,
+so we can remove the ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-11-peter.maydell@linaro.org
+---
+ target/xtensa/cpu.c            | 2 ++
+ fpu/softfloat-specialize.c.inc | 2 +-
+files changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/xtensa/cpu.c
++++ b/target/xtensa/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_reset_hold(Object *obj, ResetType type)
+     reset_mmu(env);
+     cs->halted = env->runstall;
+ #endif
++    /* For inf * 0 + NaN, return the input NaN */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+     set_no_signaling_nans(!dfpu, &env->fp_status);
+     xtensa_use_first_nan(env, !dfpu);
+ }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         /*
+          * Temporarily fall back to ifdef ladder
+          */
+-#if defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
++#if defined(TARGET_HPPA) || \
+     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+         /*
+          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+--
+.34.1

-New patch
+[PULL 16/72] target/x86: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the x86 target.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-12-peter.maydell@linaro.org
+---
+ target/i386/tcg/fpu_helper.c   | 7 +++++++
+ fpu/softfloat-specialize.c.inc | 2 +-
+files changed, 8 insertions(+), 1 deletion(-)
+diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/fpu_helper.c
++++ b/target/i386/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->mmx_status);
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->sse_status);
++    /*
++     * Only SSE has multiply-add instructions. In the SDM Section 14.5.2
++     * "Fused-Multiply-ADD (FMA) Numeric Behavior" the NaN handling is
++     * specified -- for 0 * inf + NaN the input NaN is selected, and if
++     * there are multiple input NaNs they are selected in the order a, b, c.
++     */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->sse_status);
+ }
+ static inline uint8_t save_exception_flags(CPUX86State *env)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+          * Temporarily fall back to ifdef ladder
+          */
+ #if defined(TARGET_HPPA) || \
+-    defined(TARGET_I386) || defined(TARGET_LOONGARCH)
++    defined(TARGET_LOONGARCH)
+         /*
+          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+          * case sets InvalidOp and returns the input value 'c'
+--
+.34.1

-New patch
+[PULL 17/72] target/loongarch: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the loongarch target.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-13-peter.maydell@linaro.org
+---
+ target/loongarch/tcg/fpu_helper.c | 5 +++++
+ fpu/softfloat-specialize.c.inc    | 7 +------
+files changed, 6 insertions(+), 6 deletions(-)
+diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/loongarch/tcg/fpu_helper.c
++++ b/target/loongarch/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void restore_fp_status(CPULoongArchState *env)
+                             &env->fp_status);
+     set_flush_to_zero(0, &env->fp_status);
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
++    /*
++     * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
++     * case sets InvalidOp and returns the input value 'c'
++     */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+ }
+ int ieee_ex_to_loongarch(int xcpt)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         /*
+          * Temporarily fall back to ifdef ladder
+          */
+-#if defined(TARGET_HPPA) || \
+-    defined(TARGET_LOONGARCH)
+-        /*
+-         * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+-         * case sets InvalidOp and returns the input value 'c'
+-         */
++#if defined(TARGET_HPPA)
+         rule = float_infzeronan_dnan_never;
+ #endif
+     }
+--
+.34.1

-New patch
+[PULL 18/72] target/hppa: Set FloatInfZeroNaNRule explicitly
+Set the FloatInfZeroNaNRule explicitly for the HPPA target,
+so we can remove the ifdef from pickNaNMulAdd().
+As this is the last target to be converted to explicitly setting
+the rule, we can remove the fallback code in pickNaNMulAdd()
+entirely.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-14-peter.maydell@linaro.org
+---
+ target/hppa/fpu_helper.c       |  2 ++
+ fpu/softfloat-specialize.c.inc | 13 +------------
+files changed, 3 insertions(+), 12 deletions(-)
+diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hppa/fpu_helper.c
++++ b/target/hppa/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
+      * HPPA does note implement a CPU reset method at all...
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
++    /* For inf * 0 + NaN, return the input NaN */
++    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+ }
+ void cpu_hppa_loaded_fr0(CPUHPPAState *env)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
+ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+                          bool infzero, float_status *status)
+ {
+-    FloatInfZeroNaNRule rule = status->float_infzeronan_rule;
+-
+     /*
+      * We guarantee not to require the target to tell us how to
+      * pick a NaN if we're always returning the default NaN.
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+      */
+     assert(!status->default_nan_mode);
+-    if (rule == float_infzeronan_none) {
+-        /*
+-         * Temporarily fall back to ifdef ladder
+-         */
+-#if defined(TARGET_HPPA)
+-        rule = float_infzeronan_dnan_never;
+-#endif
+-    }
+-
+     if (infzero) {
+         /*
+          * Inf * 0 + NaN -- some implementations return the default NaN here,
+          * and some return the input NaN.
+          */
+-        switch (rule) {
++        switch (status->float_infzeronan_rule) {
+         case float_infzeronan_dnan_never:
+             return 2;
+         case float_infzeronan_dnan_always:
+--
+.34.1

-New patch
+[PULL 19/72] softfloat: Pass have_snan to pickNaNMulAdd
+The new implementation of pickNaNMulAdd() will find it convenient
+to know whether at least one of the three arguments to the muladd
+was a signaling NaN. We already calculate that in the caller,
+so pass it in as a new bool have_snan.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-15-peter.maydell@linaro.org
+---
+ fpu/softfloat-parts.c.inc      | 5 +++--
+ fpu/softfloat-specialize.c.inc | 2 +-
+files changed, 4 insertions(+), 3 deletions(-)
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-parts.c.inc
++++ b/fpu/softfloat-parts.c.inc
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
+ {
+     int which;
+     bool infzero = (ab_mask == float_cmask_infzero);
++    bool have_snan = (abc_mask & float_cmask_snan);
+-    if (unlikely(abc_mask & float_cmask_snan)) {
++    if (unlikely(have_snan)) {
+         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
+     }
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
+     if (s->default_nan_mode) {
+         which = 3;
+     } else {
+-        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
++        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, have_snan, s);
+     }
+     if (which == 3) {
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
+ | Return values : 0 : a; 1 : b; 2 : c; 3 : default-NaN
+ *----------------------------------------------------------------------------*/
+ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+-                         bool infzero, float_status *status)
++                         bool infzero, bool have_snan, float_status *status)
+ {
+     /*
+      * We guarantee not to require the target to tell us how to
+--
+.34.1

-[PULL 19/21] hw: arm: Support direct boot for Linux/arm64 EFI zboot images
+[PULL 20/72] softfloat: Allow runtime choice of NaN propagation for muladd
-From: Ard Biesheuvel <ardb@kernel.org>
+IEEE 758 does not define a fixed rule for which NaN to pick as the
+result if both operands of a 3-operand fused multiply-add operation
-Fedora 39 will ship its arm64 kernels in the new generic EFI zboot
+are NaNs.  As a result different architectures have ended up with
-format, using gzip compression for the payload.
+different rules for propagating NaNs.
-For doing EFI boot in QEMU, this is completely transparent, as the
+QEMU currently hardcodes the NaN propagation logic into the binary
-firmware or bootloader will take care of this. However, for direct
+because pickNaNMulAdd() has an ifdef ladder for different targets.
-kernel boot without firmware, we will lose the ability to boot such
+We want to make the propagation rule instead be selectable at
-distro kernels unless we deal with the new format directly.
+runtime, because:
+ * this will let us have multiple targets in one QEMU binary
-EFI zboot images contain metadata in the header regarding the placement
+ * the Arm FEAT_AFP architectural feature includes letting
-of the compressed payload inside the image, and the type of compression
+   the guest select a NaN propagation rule at runtime
-used. This means we can wire up the existing gzip support without too
-much hassle, by parsing the header and grabbing the payload from inside
+In this commit we add an enum for the propagation rule, the field in
-the loaded zboot image.
+float_status, and the corresponding getters and setters.  We change
+pickNaNMulAdd to honour this, but because all targets still leave
-Cc: Peter Maydell <peter.maydell@linaro.org>
+this field at its default 0 value, the fallback logic will pick the
-Cc: Alex Bennée <alex.bennee@linaro.org>
+rule type with the old ifdef ladder.
-Cc: Richard Henderson <richard.henderson@linaro.org>
-Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
+It's valid not to set a propagation rule if default_nan_mode is
-Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
+enabled, because in that case there's no need to pick a NaN; all the
-Message-id: 20230303160109.3626966-1-ardb@kernel.org
+callers of pickNaNMulAdd() catch this case and skip calling it.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 [PMM: tweaked comment formatting, fixed checkpatch nits]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-16-peter.maydell@linaro.org
 ---
- include/hw/loader.h | 19 ++++++++++
+ include/fpu/softfloat-helpers.h |  11 +++
- hw/arm/boot.c       |  6 +++
+ include/fpu/softfloat-types.h   |  55 +++++++++++
- hw/core/loader.c    | 91 +++++++++++++++++++++++++++++++++++++++++++++
+ fpu/softfloat-specialize.c.inc  | 167 ++++++++------------------------
-files changed, 116 insertions(+)
+files changed, 107 insertions(+), 126 deletions(-)
-diff --git a/include/hw/loader.h b/include/hw/loader.h
+diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/loader.h
+--- a/include/fpu/softfloat-helpers.h
-+++ b/include/hw/loader.h
++++ b/include/fpu/softfloat-helpers.h
-@@ -XXX,XX +XXX,XX @@ ssize_t load_image_gzipped_buffer(const char *filename, uint64_t max_sz,
+@@ -XXX,XX +XXX,XX @@ static inline void set_float_2nan_prop_rule(Float2NaNPropRule rule,
-                                   uint8_t **buffer);
+     status->float_2nan_prop_rule = rule;
- ssize_t load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz);
+ }
-+/**
++static inline void set_float_3nan_prop_rule(Float3NaNPropRule rule,
-+ * unpack_efi_zboot_image:
++                                            float_status *status)
-+ * @buffer: pointer to a variable holding the address of a buffer containing the
++{
-+ *          image
++    status->float_3nan_prop_rule = rule;
-+ * @size: pointer to a variable holding the size of the buffer
++}
 +
  static inline void set_float_infzeronan_rule(FloatInfZeroNaNRule rule,
                                               float_status *status)
  {
@@ -XXX,XX +XXX,XX @@ static inline Float2NaNPropRule get_float_2nan_prop_rule(float_status *status)
      return status->float_2nan_prop_rule;
  }
 +static inline Float3NaNPropRule get_float_3nan_prop_rule(float_status *status)
 +{
 +    return status->float_3nan_prop_rule;
 +}
 +
  static inline FloatInfZeroNaNRule get_float_infzeronan_rule(float_status *status)
  {
      return status->float_infzeronan_rule;
 diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/fpu/softfloat-types.h
 +++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ this code that are retained.
  #ifndef SOFTFLOAT_TYPES_H
  #define SOFTFLOAT_TYPES_H
 +#include "hw/registerfields.h"
 +
  /*
   * Software IEC/IEEE floating-point types.
   */
@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
      float_2nan_prop_x87,
  } Float2NaNPropRule;
 +/*
 + * 3-input NaN propagation rule, for fused multiply-add. Individual
 + * architectures have different rules for which input NaN is
 + * propagated to the output when there is more than one NaN on the
 + * input.
 + *
-+ * Check whether the buffer contains a EFI zboot image, and if it does, extract
++ * If default_nan_mode is enabled then it is valid not to set a NaN
-+ * the compressed payload and decompress it into a new buffer. If successful,
++ * propagation rule, because the softfloat code guarantees not to try
-+ * the old buffer is freed, and the *buffer and size variables pointed to by the
++ * to pick a NaN to propagate in default NaN mode.  When not in
-+ * function arguments are updated to refer to the newly populated buffer.
++ * default-NaN mode, it is an error for the target not to set the rule
 + * in float_status if it uses a muladd, and we will assert if we need
 + * to handle an input NaN and no rule was selected.
 + *
-+ * Returns 0 if the image could not be identified as a EFI zboot image.
++ * The naming scheme for Float3NaNPropRule values is:
-+ * Returns -1 if the buffer contents were identified as a EFI zboot image, but
++ *  float_3nan_prop_s_abc:
-+ * unpacking failed for any reason.
++ *    = "Prefer SNaN over QNaN, then operand A over B over C"
-+ * Returns the size of the decompressed payload if decompression was performed
++ *  float_3nan_prop_abc:
-+ * successfully.
++ *    = "Prefer A over B over C regardless of SNaN vs QNAN"
 + *
 + * For QEMU, the multiply-add operation is A * B + C.
 + */
-+ssize_t unpack_efi_zboot_image(uint8_t **buffer, int *size);
++
-+
++/*
- #define ELF_LOAD_FAILED       -1
++ * We set the Float3NaNPropRule enum values up so we can select the
- #define ELF_LOAD_NOT_ELF      -2
++ * right value in pickNaNMulAdd in a data driven way.
- #define ELF_LOAD_WRONG_ARCH   -3
++ */
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
++FIELD(3NAN, 1ST, 0, 2)   /* which operand is most preferred ? */
 +FIELD(3NAN, 2ND, 2, 2)   /* which operand is next most preferred ? */
 +FIELD(3NAN, 3RD, 4, 2)   /* which operand is least preferred ? */
 +FIELD(3NAN, SNAN, 6, 1)  /* do we prefer SNaN over QNaN ? */
 +
 +#define PROPRULE(X, Y, Z) \
 +    ((X << R_3NAN_1ST_SHIFT) | (Y << R_3NAN_2ND_SHIFT) | (Z << R_3NAN_3RD_SHIFT))
 +
 +typedef enum __attribute__((__packed__)) {
 +    float_3nan_prop_none = 0,     /* No propagation rule specified */
 +    float_3nan_prop_abc = PROPRULE(0, 1, 2),
 +    float_3nan_prop_acb = PROPRULE(0, 2, 1),
 +    float_3nan_prop_bac = PROPRULE(1, 0, 2),
 +    float_3nan_prop_bca = PROPRULE(1, 2, 0),
 +    float_3nan_prop_cab = PROPRULE(2, 0, 1),
 +    float_3nan_prop_cba = PROPRULE(2, 1, 0),
 +    float_3nan_prop_s_abc = float_3nan_prop_abc | R_3NAN_SNAN_MASK,
 +    float_3nan_prop_s_acb = float_3nan_prop_acb | R_3NAN_SNAN_MASK,
 +    float_3nan_prop_s_bac = float_3nan_prop_bac | R_3NAN_SNAN_MASK,
 +    float_3nan_prop_s_bca = float_3nan_prop_bca | R_3NAN_SNAN_MASK,
 +    float_3nan_prop_s_cab = float_3nan_prop_cab | R_3NAN_SNAN_MASK,
 +    float_3nan_prop_s_cba = float_3nan_prop_cba | R_3NAN_SNAN_MASK,
 +} Float3NaNPropRule;
 +
 +#undef PROPRULE
 +
  /*
   * Rule for result of fused multiply-add 0 * Inf + NaN.
   * This must be a NaN, but implementations differ on whether this
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
      FloatRoundMode float_rounding_mode;
      FloatX80RoundPrec floatx80_rounding_precision;
      Float2NaNPropRule float_2nan_prop_rule;
 +    Float3NaNPropRule float_3nan_prop_rule;
      FloatInfZeroNaNRule float_infzeronan_rule;
      bool tininess_before_rounding;
      /* should denormalised results go to zero and set the inexact flag? */
 diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/fpu/softfloat-specialize.c.inc
-+++ b/hw/arm/boot.c
++++ b/fpu/softfloat-specialize.c.inc
-@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
+@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
-             return -1;
+ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
                           bool infzero, bool have_snan, float_status *status)
  {
 +    FloatClass cls[3] = { a_cls, b_cls, c_cls };
 +    Float3NaNPropRule rule = status->float_3nan_prop_rule;
 +    int which;
 +
      /*
       * We guarantee not to require the target to tell us how to
       * pick a NaN if we're always returning the default NaN.
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          }
-         size = len;
-+
-+        /* Unpack the image if it is a EFI zboot image */
-+        if (unpack_efi_zboot_image(&buffer, &size) < 0) {
-+            g_free(buffer);
-+            return -1;
-+        }
      }
-     /* check the arm64 magic header value -- very old kernels may not have it */
++    if (rule == float_3nan_prop_none) {
-diff --git a/hw/core/loader.c b/hw/core/loader.c
+ #if defined(TARGET_ARM)
-index XXXXXXX..XXXXXXX 100644
+-
---- a/hw/core/loader.c
+-    /* This looks different from the ARM ARM pseudocode, because the ARM ARM
-+++ b/hw/core/loader.c
+-     * puts the operands to a fused mac operation (a*b)+c in the order c,a,b.
-@@ -XXX,XX +XXX,XX @@ ssize_t load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz)
+-     */
-     return bytes;
+-    if (is_snan(c_cls)) {
 -        return 2;
 -    } else if (is_snan(a_cls)) {
 -        return 0;
 -    } else if (is_snan(b_cls)) {
 -        return 1;
 -    } else if (is_qnan(c_cls)) {
 -        return 2;
 -    } else if (is_qnan(a_cls)) {
 -        return 0;
 -    } else {
 -        return 1;
 -    }
 +        /*
 +         * This looks different from the ARM ARM pseudocode, because the ARM ARM
 +         * puts the operands to a fused mac operation (a*b)+c in the order c,a,b
 +         */
 +        rule = float_3nan_prop_s_cab;
  #elif defined(TARGET_MIPS)
 -    if (snan_bit_is_one(status)) {
 -        /* Prefer sNaN over qNaN, in the a, b, c order. */
 -        if (is_snan(a_cls)) {
 -            return 0;
 -        } else if (is_snan(b_cls)) {
 -            return 1;
 -        } else if (is_snan(c_cls)) {
 -            return 2;
 -        } else if (is_qnan(a_cls)) {
 -            return 0;
 -        } else if (is_qnan(b_cls)) {
 -            return 1;
 +        if (snan_bit_is_one(status)) {
 +            rule = float_3nan_prop_s_abc;
          } else {
 -            return 2;
 +            rule = float_3nan_prop_s_cab;
          }
 -    } else {
 -        /* Prefer sNaN over qNaN, in the c, a, b order. */
 -        if (is_snan(c_cls)) {
 -            return 2;
 -        } else if (is_snan(a_cls)) {
 -            return 0;
 -        } else if (is_snan(b_cls)) {
 -            return 1;
 -        } else if (is_qnan(c_cls)) {
 -            return 2;
 -        } else if (is_qnan(a_cls)) {
 -            return 0;
 -        } else {
 -            return 1;
 -        }
 -    }
  #elif defined(TARGET_LOONGARCH64)
 -    /* Prefer sNaN over qNaN, in the c, a, b order. */
 -    if (is_snan(c_cls)) {
 -        return 2;
 -    } else if (is_snan(a_cls)) {
 -        return 0;
 -    } else if (is_snan(b_cls)) {
 -        return 1;
 -    } else if (is_qnan(c_cls)) {
 -        return 2;
 -    } else if (is_qnan(a_cls)) {
 -        return 0;
 -    } else {
 -        return 1;
 -    }
 +        rule = float_3nan_prop_s_cab;
  #elif defined(TARGET_PPC)
 -    /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
 -     * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
 -     */
 -    if (is_nan(a_cls)) {
 -        return 0;
 -    } else if (is_nan(c_cls)) {
 -        return 2;
 -    } else {
 -        return 1;
 -    }
 +        /*
 +         * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
 +         * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
 +         */
 +        rule = float_3nan_prop_acb;
  #elif defined(TARGET_S390X)
 -    if (is_snan(a_cls)) {
 -        return 0;
 -    } else if (is_snan(b_cls)) {
 -        return 1;
 -    } else if (is_snan(c_cls)) {
 -        return 2;
 -    } else if (is_qnan(a_cls)) {
 -        return 0;
 -    } else if (is_qnan(b_cls)) {
 -        return 1;
 -    } else {
 -        return 2;
 -    }
 +        rule = float_3nan_prop_s_abc;
  #elif defined(TARGET_SPARC)
 -    /* Prefer SNaN over QNaN, order C, B, A. */
 -    if (is_snan(c_cls)) {
 -        return 2;
 -    } else if (is_snan(b_cls)) {
 -        return 1;
 -    } else if (is_snan(a_cls)) {
 -        return 0;
 -    } else if (is_qnan(c_cls)) {
 -        return 2;
 -    } else if (is_qnan(b_cls)) {
 -        return 1;
 -    } else {
 -        return 0;
 -    }
 +        rule = float_3nan_prop_s_cba;
  #elif defined(TARGET_XTENSA)
 -    /*
 -     * For Xtensa, the (inf,zero,nan) case sets InvalidOp and returns
 -     * an input NaN if we have one (ie c).
 -     */
 -    if (status->use_first_nan) {
 -        if (is_nan(a_cls)) {
 -            return 0;
 -        } else if (is_nan(b_cls)) {
 -            return 1;
 +        if (status->use_first_nan) {
 +            rule = float_3nan_prop_abc;
          } else {
 -            return 2;
 +            rule = float_3nan_prop_cba;
          }
 -    } else {
 -        if (is_nan(c_cls)) {
 -            return 2;
 -        } else if (is_nan(b_cls)) {
 -            return 1;
 -        } else {
 -            return 0;
 -        }
 -    }
  #else
 -    /* A default implementation: prefer a to b to c.
 -     * This is unlikely to actually match any real implementation.
 -     */
 -    if (is_nan(a_cls)) {
 -        return 0;
 -    } else if (is_nan(b_cls)) {
 -        return 1;
 -    } else {
 -        return 2;
 -    }
 +        rule = float_3nan_prop_abc;
  #endif
 +    }
 +
 +    assert(rule != float_3nan_prop_none);
 +    if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
 +        /* We have at least one SNaN input and should prefer it */
 +        do {
 +            which = rule & R_3NAN_1ST_MASK;
 +            rule >>= R_3NAN_1ST_LENGTH;
 +        } while (!is_snan(cls[which]));
 +    } else {
 +        do {
 +            which = rule & R_3NAN_1ST_MASK;
 +            rule >>= R_3NAN_1ST_LENGTH;
 +        } while (!is_nan(cls[which]));
 +    }
 +    return which;
  }
-+/* The PE/COFF MS-DOS stub magic number */
+ /*----------------------------------------------------------------------------
 +#define EFI_PE_MSDOS_MAGIC        "MZ"
 +
 +/*
 + * The Linux header magic number for a EFI PE/COFF
 + * image targetting an unspecified architecture.
 + */
 +#define EFI_PE_LINUX_MAGIC        "\xcd\x23\x82\x81"
 +
 +/*
 + * Bootable Linux kernel images may be packaged as EFI zboot images, which are
 + * self-decompressing executables when loaded via EFI. The compressed payload
 + * can also be extracted from the image and decompressed by a non-EFI loader.
 + *
 + * The de facto specification for this format is at the following URL:
 + *
 + * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/firmware/efi/libstub/zboot-header.S
 + *
 + * This definition is based on Linux upstream commit 29636a5ce87beba.
 + */
 +struct linux_efi_zboot_header {
 +    uint8_t     msdos_magic[2];         /* PE/COFF 'MZ' magic number */
 +    uint8_t     reserved0[2];
 +    uint8_t     zimg[4];                /* "zimg" for Linux EFI zboot images */
 +    uint32_t    payload_offset;         /* LE offset to compressed payload */
 +    uint32_t    payload_size;           /* LE size of the compressed payload */
 +    uint8_t     reserved1[8];
 +    char        compression_type[32];   /* Compression type, NUL terminated */
 +    uint8_t     linux_magic[4];         /* Linux header magic */
 +    uint32_t    pe_header_offset;       /* LE offset to the PE header */
 +};
 +
 +/*
 + * Check whether *buffer points to a Linux EFI zboot image in memory.
 + *
 + * If it does, attempt to decompress it to a new buffer, and free the old one.
 + * If any of this fails, return an error to the caller.
 + *
 + * If the image is not a Linux EFI zboot image, do nothing and return success.
 + */
 +ssize_t unpack_efi_zboot_image(uint8_t **buffer, int *size)
 +{
 +    const struct linux_efi_zboot_header *header;
 +    uint8_t *data = NULL;
 +    int ploff, plsize;
 +    ssize_t bytes;
 +
 +    /* ignore if this is too small to be a EFI zboot image */
 +    if (*size < sizeof(*header)) {
 +        return 0;
 +    }
 +
 +    header = (struct linux_efi_zboot_header *)*buffer;
 +
 +    /* ignore if this is not a Linux EFI zboot image */
 +    if (memcmp(&header->msdos_magic, EFI_PE_MSDOS_MAGIC, 2) != 0 ||
 +        memcmp(&header->zimg, "zimg", 4) != 0 ||
 +        memcmp(&header->linux_magic, EFI_PE_LINUX_MAGIC, 4) != 0) {
 +        return 0;
 +    }
 +
 +    if (strcmp(header->compression_type, "gzip") != 0) {
 +        fprintf(stderr,
 +                "unable to handle EFI zboot image with \"%.*s\" compression\n",
 +                (int)sizeof(header->compression_type) - 1,
 +                header->compression_type);
 +        return -1;
 +    }
 +
 +    ploff = ldl_le_p(&header->payload_offset);
 +    plsize = ldl_le_p(&header->payload_size);
 +
 +    if (ploff < 0 || plsize < 0 || ploff + plsize > *size) {
 +        fprintf(stderr, "unable to handle corrupt EFI zboot image\n");
 +        return -1;
 +    }
 +
 +    data = g_malloc(LOAD_IMAGE_MAX_GUNZIP_BYTES);
 +    bytes = gunzip(data, LOAD_IMAGE_MAX_GUNZIP_BYTES, *buffer + ploff, plsize);
 +    if (bytes < 0) {
 +        fprintf(stderr, "failed to decompress EFI zboot image\n");
 +        g_free(data);
 +        return -1;
 +    }
 +
 +    g_free(*buffer);
 +    *buffer = g_realloc(data, bytes);
 +    *size = bytes;
 +    return bytes;
 +}
 +
  /*
   * Functions for reboot-persistent memory regions.
   *  - used for vga bios and option roms.
 --
 .34.1

-New patch
+[PULL 21/72] tests/fp: Explicitly set 3-NaN propagation rule
+Explicitly set a rule in the softfloat tests for propagating NaNs in
+the muladd case.  In meson.build we put -DTARGET_ARM in fpcflags, and
+so we should select here the Arm rule of float_3nan_prop_s_cab.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-17-peter.maydell@linaro.org
+---
+ tests/fp/fp-bench.c | 1 +
+ tests/fp/fp-test.c  | 1 +
+files changed, 2 insertions(+)
+diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-bench.c
++++ b/tests/fp/fp-bench.c
+@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
+      * doesn't specify match those used by the Arm architecture.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
++    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &soft_status);
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
+     f = bench_funcs[operation][precision];
+diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-test.c
++++ b/tests/fp/fp-test.c
+@@ -XXX,XX +XXX,XX @@ void run_test(void)
+      * doesn't specify match those used by the Arm architecture.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
++    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &qsf);
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
+     genCases_setLevel(test_level);
+--
+.34.1

-New patch
+[PULL 22/72] target/arm: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for Arm, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-18-peter.maydell@linaro.org
+---
+ target/arm/cpu.c               | 5 +++++
+ fpu/softfloat-specialize.c.inc | 8 +-------
+files changed, 6 insertions(+), 7 deletions(-)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
+  *  * tininess-before-rounding
+  *  * 2-input NaN propagation prefers SNaN over QNaN, and then
+  *    operand A over operand B (see FPProcessNaNs() pseudocode)
++ *  * 3-input NaN propagation prefers SNaN over QNaN, and then
++ *    operand C over A over B (see FPProcessNaNs3() pseudocode,
++ *    but note that for QEMU muladd is a * b + c, whereas for
++ *    the pseudocode function the arguments are in the order c, a, b.
+  *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
+  *    and the input NaN if it is signalling
+  */
+@@ -XXX,XX +XXX,XX @@ static void arm_set_default_fp_behaviours(float_status *s)
+ {
+     set_float_detect_tininess(float_tininess_before_rounding, s);
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
++    set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
+ }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+     }
+     if (rule == float_3nan_prop_none) {
+-#if defined(TARGET_ARM)
+-        /*
+-         * This looks different from the ARM ARM pseudocode, because the ARM ARM
+-         * puts the operands to a fused mac operation (a*b)+c in the order c,a,b
+-         */
+-        rule = float_3nan_prop_s_cab;
+-#elif defined(TARGET_MIPS)
++#if defined(TARGET_MIPS)
+         if (snan_bit_is_one(status)) {
+             rule = float_3nan_prop_s_abc;
+         } else {
+--
+.34.1

-New patch
+[PULL 23/72] target/loongarch: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for loongarch, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-19-peter.maydell@linaro.org
+---
+ target/loongarch/tcg/fpu_helper.c | 1 +
+ fpu/softfloat-specialize.c.inc    | 2 --
+files changed, 1 insertion(+), 2 deletions(-)
+diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/loongarch/tcg/fpu_helper.c
++++ b/target/loongarch/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void restore_fp_status(CPULoongArchState *env)
+      * case sets InvalidOp and returns the input value 'c'
+      */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
++    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &env->fp_status);
+ }
+ int ieee_ex_to_loongarch(int xcpt)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         } else {
+             rule = float_3nan_prop_s_cab;
+         }
+-#elif defined(TARGET_LOONGARCH64)
+-        rule = float_3nan_prop_s_cab;
+ #elif defined(TARGET_PPC)
+         /*
+          * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
+--
+.34.1

-New patch
+[PULL 24/72] target/ppc: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for PPC, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-20-peter.maydell@linaro.org
+---
+ target/ppc/cpu_init.c          | 8 ++++++++
+ fpu/softfloat-specialize.c.inc | 6 ------
+files changed, 8 insertions(+), 6 deletions(-)
+diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/cpu_init.c
++++ b/target/ppc/cpu_init.c
+@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->vec_status);
++    /*
++     * NaN propagation for fused multiply-add:
++     * if fRA is a NaN return it; otherwise if fRB is a NaN return it;
++     * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
++     * whereas QEMU labels the operands as (a * b) + c.
++     */
++    set_float_3nan_prop_rule(float_3nan_prop_acb, &env->fp_status);
++    set_float_3nan_prop_rule(float_3nan_prop_acb, &env->vec_status);
+     /*
+      * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
+      * to return an input NaN if we have one (ie c) rather than generating
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         } else {
+             rule = float_3nan_prop_s_cab;
+         }
+-#elif defined(TARGET_PPC)
+-        /*
+-         * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
+-         * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
+-         */
+-        rule = float_3nan_prop_acb;
+ #elif defined(TARGET_S390X)
+         rule = float_3nan_prop_s_abc;
+ #elif defined(TARGET_SPARC)
+--
+.34.1

-New patch
+[PULL 25/72] target/s390x: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for s390x, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-21-peter.maydell@linaro.org
+---
+ target/s390x/cpu.c             | 1 +
+ fpu/softfloat-specialize.c.inc | 2 --
+files changed, 1 insertion(+), 2 deletions(-)
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_hold(Object *obj, ResetType type)
+         set_float_detect_tininess(float_tininess_before_rounding,
+                                   &env->fpu_status);
+         set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fpu_status);
++        set_float_3nan_prop_rule(float_3nan_prop_s_abc, &env->fpu_status);
+         set_float_infzeronan_rule(float_infzeronan_dnan_always,
+                                   &env->fpu_status);
+        /* fall through */
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         } else {
+             rule = float_3nan_prop_s_cab;
+         }
+-#elif defined(TARGET_S390X)
+-        rule = float_3nan_prop_s_abc;
+ #elif defined(TARGET_SPARC)
+         rule = float_3nan_prop_s_cba;
+ #elif defined(TARGET_XTENSA)
+--
+.34.1

-New patch
+[PULL 26/72] target/sparc: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for SPARC, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-22-peter.maydell@linaro.org
+---
+ target/sparc/cpu.c             | 2 ++
+ fpu/softfloat-specialize.c.inc | 2 --
+files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sparc/cpu.c
++++ b/target/sparc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
+      * the CPU state struct so it won't get zeroed on reset.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &env->fp_status);
++    /* For fused-multiply add, prefer SNaN over QNaN, then C->B->A */
++    set_float_3nan_prop_rule(float_3nan_prop_s_cba, &env->fp_status);
+     /* For inf * 0 + NaN, return the input NaN */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         } else {
+             rule = float_3nan_prop_s_cab;
+         }
+-#elif defined(TARGET_SPARC)
+-        rule = float_3nan_prop_s_cba;
+ #elif defined(TARGET_XTENSA)
+         if (status->use_first_nan) {
+             rule = float_3nan_prop_abc;
+--
+.34.1

-New patch
+[PULL 27/72] target/mips: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for Arm, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-23-peter.maydell@linaro.org
+---
+ target/mips/fpu_helper.h       | 4 ++++
+ target/mips/msa.c              | 3 +++
+ fpu/softfloat-specialize.c.inc | 8 +-------
+files changed, 8 insertions(+), 7 deletions(-)
+diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/fpu_helper.h
++++ b/target/mips/fpu_helper.h
+@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
+ {
+     bool nan2008 = env->active_fpu.fcr31 & (1 << FCR31_NAN2008);
+     FloatInfZeroNaNRule izn_rule;
++    Float3NaNPropRule nan3_rule;
+     /*
+      * With nan2008, SNaNs are silenced in the usual way.
+@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
+      */
+     izn_rule = nan2008 ? float_infzeronan_dnan_never : float_infzeronan_dnan_always;
+     set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
++    nan3_rule = nan2008 ? float_3nan_prop_s_cab : float_3nan_prop_s_abc;
++    set_float_3nan_prop_rule(nan3_rule, &env->active_fpu.fp_status);
++
+ }
+ static inline void restore_fp_status(CPUMIPSState *env)
+diff --git a/target/mips/msa.c b/target/mips/msa.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/msa.c
++++ b/target/mips/msa.c
+@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab,
+                              &env->active_tc.msa_fp_status);
++    set_float_3nan_prop_rule(float_3nan_prop_s_cab,
++                             &env->active_tc.msa_fp_status);
++
+     /* clear float_status exception flags */
+     set_float_exception_flags(0, &env->active_tc.msa_fp_status);
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+     }
+     if (rule == float_3nan_prop_none) {
+-#if defined(TARGET_MIPS)
+-        if (snan_bit_is_one(status)) {
+-            rule = float_3nan_prop_s_abc;
+-        } else {
+-            rule = float_3nan_prop_s_cab;
+-        }
+-#elif defined(TARGET_XTENSA)
++#if defined(TARGET_XTENSA)
+         if (status->use_first_nan) {
+             rule = float_3nan_prop_abc;
+         } else {
+--
+.34.1

-New patch
+[PULL 28/72] target/xtensa: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for xtensa, and remove the
+ifdef from pickNaNMulAdd().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-24-peter.maydell@linaro.org
+---
+ target/xtensa/fpu_helper.c     | 2 ++
+ fpu/softfloat-specialize.c.inc | 8 --------
+files changed, 2 insertions(+), 8 deletions(-)
+diff --git a/target/xtensa/fpu_helper.c b/target/xtensa/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/xtensa/fpu_helper.c
++++ b/target/xtensa/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void xtensa_use_first_nan(CPUXtensaState *env, bool use_first)
+     set_use_first_nan(use_first, &env->fp_status);
+     set_float_2nan_prop_rule(use_first ? float_2nan_prop_ab : float_2nan_prop_ba,
+                              &env->fp_status);
++    set_float_3nan_prop_rule(use_first ? float_3nan_prop_abc : float_3nan_prop_cba,
++                             &env->fp_status);
+ }
+ void HELPER(wur_fpu2k_fcr)(CPUXtensaState *env, uint32_t v)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+     }
+     if (rule == float_3nan_prop_none) {
+-#if defined(TARGET_XTENSA)
+-        if (status->use_first_nan) {
+-            rule = float_3nan_prop_abc;
+-        } else {
+-            rule = float_3nan_prop_cba;
+-        }
+-#else
+         rule = float_3nan_prop_abc;
+-#endif
+     }
+     assert(rule != float_3nan_prop_none);
+--
+.34.1

-New patch
+[PULL 29/72] target/i386: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for i386.  We had no
+i386-specific behaviour in the old ifdef ladder, so we were using the
+default "prefer a then b then c" fallback; this is actually the
+correct per-the-spec handling for i386.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-25-peter.maydell@linaro.org
+---
+ target/i386/tcg/fpu_helper.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/fpu_helper.c
++++ b/target/i386/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
+      * there are multiple input NaNs they are selected in the order a, b, c.
+      */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->sse_status);
++    set_float_3nan_prop_rule(float_3nan_prop_abc, &env->sse_status);
+ }
+ static inline uint8_t save_exception_flags(CPUX86State *env)
+--
+.34.1

-New patch
+[PULL 30/72] target/hppa: Set Float3NaNPropRule explicitly
+Set the Float3NaNPropRule explicitly for HPPA, and remove the
+ifdef from pickNaNMulAdd().
+HPPA is the only target that was using the default branch of the
+ifdef ladder (other targets either do not use muladd or set
+default_nan_mode), so we can remove the ifdef fallback entirely now
+(allowing the "rule not set" case to fall into the default of the
+switch statement and assert).
+We add a TODO note that the HPPA rule is probably wrong; this is
+not a behavioural change for this refactoring.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-26-peter.maydell@linaro.org
+---
+ target/hppa/fpu_helper.c       | 8 ++++++++
+ fpu/softfloat-specialize.c.inc | 4 ----
+files changed, 8 insertions(+), 4 deletions(-)
+diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hppa/fpu_helper.c
++++ b/target/hppa/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
+      * HPPA does note implement a CPU reset method at all...
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
++    /*
++     * TODO: The HPPA architecture reference only documents its NaN
++     * propagation rule for 2-operand operations. Testing on real hardware
++     * might be necessary to confirm whether this order for muladd is correct.
++     * Not preferring the SNaN is almost certainly incorrect as it diverges
++     * from the documented rules for 2-operand operations.
++     */
++    set_float_3nan_prop_rule(float_3nan_prop_abc, &env->fp_status);
+     /* For inf * 0 + NaN, return the input NaN */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+ }
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
+         }
+     }
+-    if (rule == float_3nan_prop_none) {
+-        rule = float_3nan_prop_abc;
+-    }
+-
+     assert(rule != float_3nan_prop_none);
+     if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
+         /* We have at least one SNaN input and should prefer it */
+--
+.34.1

-New patch
+[PULL 31/72] fpu: Remove use_first_nan field from float_status
+The use_first_nan field in float_status was an xtensa-specific way to
+select at runtime from two different NaN propagation rules.  Now that
+xtensa is using the target-agnostic NaN propagation rule selection
+that we've just added, we can remove use_first_nan, because there is
+no longer any code that reads it.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-27-peter.maydell@linaro.org
+---
+ include/fpu/softfloat-helpers.h | 5 -----
+ include/fpu/softfloat-types.h   | 1 -
+ target/xtensa/fpu_helper.c      | 1 -
+files changed, 7 deletions(-)
+diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/fpu/softfloat-helpers.h
++++ b/include/fpu/softfloat-helpers.h
+@@ -XXX,XX +XXX,XX @@ static inline void set_snan_bit_is_one(bool val, float_status *status)
+     status->snan_bit_is_one = val;
+ }
+-static inline void set_use_first_nan(bool val, float_status *status)
+-{
+-    status->use_first_nan = val;
+-}
+-
+ static inline void set_no_signaling_nans(bool val, float_status *status)
+ {
+     status->no_signaling_nans = val;
+diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/fpu/softfloat-types.h
++++ b/include/fpu/softfloat-types.h
+@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
+      * softfloat-specialize.inc.c)
+      */
+     bool snan_bit_is_one;
+-    bool use_first_nan;
+     bool no_signaling_nans;
+     /* should overflowed results subtract re_bias to its exponent? */
+     bool rebias_overflow;
+diff --git a/target/xtensa/fpu_helper.c b/target/xtensa/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/xtensa/fpu_helper.c
++++ b/target/xtensa/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ static const struct {
+ void xtensa_use_first_nan(CPUXtensaState *env, bool use_first)
+ {
+-    set_use_first_nan(use_first, &env->fp_status);
+     set_float_2nan_prop_rule(use_first ? float_2nan_prop_ab : float_2nan_prop_ba,
+                              &env->fp_status);
+     set_float_3nan_prop_rule(use_first ? float_3nan_prop_abc : float_3nan_prop_cba,
+--
+.34.1

-New patch
+[PULL 32/72] target/m68k: Don't pass NULL float_status to floatx80_default_nan()
+Currently m68k_cpu_reset_hold() calls floatx80_default_nan(NULL)
+to get the NaN bit pattern to reset the FPU registers. This
+works because it happens that our implementation of
+floatx80_default_nan() doesn't actually look at the float_status
+pointer except for TARGET_MIPS. However, this isn't guaranteed,
+and to be able to remove the ifdef in floatx80_default_nan()
+we're going to need a real float_status here.
+Rearrange m68k_cpu_reset_hold() so that we initialize env->fp_status
+earlier, and thus can pass it to floatx80_default_nan().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-28-peter.maydell@linaro.org
+---
+ target/m68k/cpu.c | 12 +++++++-----
+file changed, 7 insertions(+), 5 deletions(-)
+diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/cpu.c
++++ b/target/m68k/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
+     CPUState *cs = CPU(obj);
+     M68kCPUClass *mcc = M68K_CPU_GET_CLASS(obj);
+     CPUM68KState *env = cpu_env(cs);
+-    floatx80 nan = floatx80_default_nan(NULL);
++    floatx80 nan;
+     int i;
+     if (mcc->parent_phases.hold) {
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
+ #else
+     cpu_m68k_set_sr(env, SR_S | SR_I);
+ #endif
+-    for (i = 0; i < 8; i++) {
+-        env->fregs[i].d = nan;
+-    }
+-    cpu_m68k_set_fpcr(env, 0);
+     /*
+      * M68000 FAMILY PROGRAMMER'S REFERENCE MANUAL
+      * 3.4 FLOATING-POINT INSTRUCTION DETAILS
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
+      * preceding paragraph for nonsignaling NaNs.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
++
++    nan = floatx80_default_nan(&env->fp_status);
++    for (i = 0; i < 8; i++) {
++        env->fregs[i].d = nan;
++    }
++    cpu_m68k_set_fpcr(env, 0);
+     env->fpsr = 0;
+     /* TODO: We should set PC from the interrupt vector.  */
+--
+.34.1

-New patch
+[PULL 33/72] softfloat: Create floatx80 default NaN from parts64_default_nan
+We create our 128-bit default NaN by calling parts64_default_nan()
+and then adjusting the result.  We can do the same trick for creating
+the floatx80 default NaN, which lets us drop a target ifdef.
+floatx80 is used only by:
+ i386
+ m68k
+ arm nwfpe old floating-point emulation emulation support
+    (which is essentially dead, especially the parts involving floatx80)
+ PPC (only in the xsrqpxp instruction, which just rounds an input
+    value by converting to floatx80 and back, so will never generate
+    the default NaN)
+The floatx80 default NaN as currently implemented is:
+ m68k: sign = 0, exp = 1...1, int = 1, frac = 1....1
+ i386: sign = 1, exp = 1...1, int = 1, frac = 10...0
+These are the same as the parts64_default_nan for these architectures.
+This is technically a possible behaviour change for arm linux-user
+nwfpe emulation emulation, because the default NaN will now have the
+sign bit clear.  But we were already generating a different floatx80
+default NaN from the real kernel emulation we are supposedly
+following, which appears to use an all-bits-1 value:
+ https://elixir.bootlin.com/linux/v6.12/source/arch/arm/nwfpe/softfloat-specialize#L267
+This won't affect the only "real" use of the nwfpe emulation, which
+is ancient binaries that used it as part of the old floating point
+calling convention; that only uses loads and stores of 32 and 64 bit
+floats, not any of the floatx80 behaviour the original hardware had.
+We also get the nwfpe float64 default NaN value wrong:
+ https://elixir.bootlin.com/linux/v6.12/source/arch/arm/nwfpe/softfloat-specialize#L166
+so if we ever cared about this obscure corner the right fix would be
+to correct that so nwfpe used its own default-NaN setting rather
+than the Arm VFP one.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-29-peter.maydell@linaro.org
+---
+ fpu/softfloat-specialize.c.inc | 20 ++++++++++----------
+file changed, 10 insertions(+), 10 deletions(-)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts128_silence_nan(FloatParts128 *p, float_status *status)
+ floatx80 floatx80_default_nan(float_status *status)
+ {
+     floatx80 r;
++    /*
++     * Extrapolate from the choices made by parts64_default_nan to fill
++     * in the floatx80 format. We assume that floatx80's explicit
++     * integer bit is always set (this is true for i386 and m68k,
++     * which are the only real users of this format).
++     */
++    FloatParts64 p64;
++    parts64_default_nan(&p64, status);
+-    /* None of the targets that have snan_bit_is_one use floatx80.  */
+-    assert(!snan_bit_is_one(status));
+-#if defined(TARGET_M68K)
+-    r.low = UINT64_C(0xFFFFFFFFFFFFFFFF);
+-    r.high = 0x7FFF;
+-#else
+-    /* X86 */
+-    r.low = UINT64_C(0xC000000000000000);
+-    r.high = 0xFFFF;
+-#endif
++    r.high = 0x7FFF | (p64.sign << 15);
++    r.low = (1ULL << DECOMPOSED_BINARY_POINT) | p64.frac;
+     return r;
+ }
+--
+.34.1

-New patch
+[PULL 34/72] target/loongarch: Use normal float_status in fclass_s and fclass_d helpers
+In target/loongarch's helper_fclass_s() and helper_fclass_d() we pass
+a zero-initialized float_status struct to float32_is_quiet_nan() and
+float64_is_quiet_nan(), with the cryptic comment "for
+snan_bit_is_one".
+This pattern appears to have been copied from target/riscv, where it
+is used because the functions there do not have ready access to the
+CPU state struct. The comment presumably refers to the fact that the
+main reason the is_quiet_nan() functions want the float_state is
+because they want to know about the snan_bit_is_one config.
+In the loongarch helpers, though, we have the CPU state struct
+to hand. Use the usual env->fp_status here. This avoids our needing
+to track that we need to update the initializer of the local
+float_status structs when the core softfloat code adds new
+options for targets to configure their behaviour.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-30-peter.maydell@linaro.org
+---
+ target/loongarch/tcg/fpu_helper.c | 6 ++----
+file changed, 2 insertions(+), 4 deletions(-)
+diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/loongarch/tcg/fpu_helper.c
++++ b/target/loongarch/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ uint64_t helper_fclass_s(CPULoongArchState *env, uint64_t fj)
+     } else if (float32_is_zero_or_denormal(f)) {
+         return sign ? 1 << 4 : 1 << 8;
+     } else if (float32_is_any_nan(f)) {
+-        float_status s = { }; /* for snan_bit_is_one */
+-        return float32_is_quiet_nan(f, &s) ? 1 << 1 : 1 << 0;
++        return float32_is_quiet_nan(f, &env->fp_status) ? 1 << 1 : 1 << 0;
+     } else {
+         return sign ? 1 << 3 : 1 << 7;
+     }
+@@ -XXX,XX +XXX,XX @@ uint64_t helper_fclass_d(CPULoongArchState *env, uint64_t fj)
+     } else if (float64_is_zero_or_denormal(f)) {
+         return sign ? 1 << 4 : 1 << 8;
+     } else if (float64_is_any_nan(f)) {
+-        float_status s = { }; /* for snan_bit_is_one */
+-        return float64_is_quiet_nan(f, &s) ? 1 << 1 : 1 << 0;
++        return float64_is_quiet_nan(f, &env->fp_status) ? 1 << 1 : 1 << 0;
+     } else {
+         return sign ? 1 << 3 : 1 << 7;
+     }
+--
+.34.1

-New patch
+[PULL 35/72] target/m68k: In frem helper, initialize local float_status from env->fp_status
+In the frem helper, we have a local float_status because we want to
+execute the floatx80_div() with a custom rounding mode.  Instead of
+zero-initializing the local float_status and then having to set it up
+with the m68k standard behaviour (including the NaN propagation rule
+and copying the rounding precision from env->fp_status), initialize
+it as a complete copy of env->fp_status. This will avoid our having
+to add new code in this function for every new config knob we add
+to fp_status.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-31-peter.maydell@linaro.org
+---
+ target/m68k/fpu_helper.c | 6 ++----
+file changed, 2 insertions(+), 4 deletions(-)
+diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/fpu_helper.c
++++ b/target/m68k/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(frem)(CPUM68KState *env, FPReg *res, FPReg *val0, FPReg *val1)
+     fp_rem = floatx80_rem(val1->d, val0->d, &env->fp_status);
+     if (!floatx80_is_any_nan(fp_rem)) {
+-        float_status fp_status = { };
++        /* Use local temporary fp_status to set different rounding mode */
++        float_status fp_status = env->fp_status;
+         uint32_t quotient;
+         int sign;
+         /* Calculate quotient directly using round to nearest mode */
+-        set_float_2nan_prop_rule(float_2nan_prop_ab, &fp_status);
+         set_float_rounding_mode(float_round_nearest_even, &fp_status);
+-        set_floatx80_rounding_precision(
+-            get_floatx80_rounding_precision(&env->fp_status), &fp_status);
+         fp_quot.d = floatx80_div(val1->d, val0->d, &fp_status);
+         sign = extractFloatx80Sign(fp_quot.d);
+--
+.34.1

-New patch
+[PULL 36/72] target/m68k: Init local float_status from env fp_status in gdb get/set reg
+In cf_fpu_gdb_get_reg() and cf_fpu_gdb_set_reg() we do the conversion
+from float64 to floatx80 using a scratch float_status, because we
+don't want the conversion to affect the CPU's floating point exception
+status. Currently we use a zero-initialized float_status. This will
+get steadily more awkward as we add config knobs to float_status
+that the target must initialize. Avoid having to add any of that
+configuration here by instead initializing our local float_status
+from the env->fp_status.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-32-peter.maydell@linaro.org
+---
+ target/m68k/helper.c | 6 ++++--
+file changed, 4 insertions(+), 2 deletions(-)
+diff --git a/target/m68k/helper.c b/target/m68k/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/helper.c
++++ b/target/m68k/helper.c
+@@ -XXX,XX +XXX,XX @@ static int cf_fpu_gdb_get_reg(CPUState *cs, GByteArray *mem_buf, int n)
+     CPUM68KState *env = &cpu->env;
+     if (n < 8) {
+-        float_status s = {};
++        /* Use scratch float_status so any exceptions don't change CPU state */
++        float_status s = env->fp_status;
+         return gdb_get_reg64(mem_buf, floatx80_to_float64(env->fregs[n].d, &s));
+     }
+     switch (n) {
+@@ -XXX,XX +XXX,XX @@ static int cf_fpu_gdb_set_reg(CPUState *cs, uint8_t *mem_buf, int n)
+     CPUM68KState *env = &cpu->env;
+     if (n < 8) {
+-        float_status s = {};
++        /* Use scratch float_status so any exceptions don't change CPU state */
++        float_status s = env->fp_status;
+         env->fregs[n].d = float64_to_floatx80(ldq_be_p(mem_buf), &s);
+         return 8;
+     }
+--
+.34.1

-[PULL 01/21] target/arm: Normalize aarch64 gdbstub get/set function names
+[PULL 37/72] target/sparc: Initialize local scratch float_status from env->fp_status
-From: Richard Henderson <richard.henderson@linaro.org>
+In the helper functions flcmps and flcmpd we use a scratch float_status
 so that we don't change the CPU state if the comparison raises any
 floating point exception flags. Instead of zero-initializing this
 scratch float_status, initialize it as a copy of env->fp_status. This
 avoids the need to explicitly initialize settings like the NaN
 propagation rule or others we might add to softfloat in future.
-Make the form of the function names between fp and sve the same:
+To do this we need to pass the CPU env pointer in to the helper.
   - arm_gdb_*_svereg -> aarch64_gdb_*_sve_reg.
   - aarch64_fpu_gdb_*_reg -> aarch64_gdb_*_fpu_reg.
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230227213329.793795-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-33-peter.maydell@linaro.org
 ---
- target/arm/internals.h | 8 ++++----
+ target/sparc/helper.h     | 4 ++--
- target/arm/gdbstub.c   | 9 +++++----
+ target/sparc/fop_helper.c | 8 ++++----
- target/arm/gdbstub64.c | 8 ++++----
+ target/sparc/translate.c  | 4 ++--
-files changed, 13 insertions(+), 12 deletions(-)
+files changed, 8 insertions(+), 8 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/target/sparc/helper.h b/target/sparc/helper.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/target/sparc/helper.h
-+++ b/target/arm/internals.h
++++ b/target/sparc/helper.h
-@@ -XXX,XX +XXX,XX @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fcmpd, TCG_CALL_NO_WG, i32, env, f64, f64)
  DEF_HELPER_FLAGS_3(fcmped, TCG_CALL_NO_WG, i32, env, f64, f64)
  DEF_HELPER_FLAGS_3(fcmpq, TCG_CALL_NO_WG, i32, env, i128, i128)
  DEF_HELPER_FLAGS_3(fcmpeq, TCG_CALL_NO_WG, i32, env, i128, i128)
 -DEF_HELPER_FLAGS_2(flcmps, TCG_CALL_NO_RWG_SE, i32, f32, f32)
 -DEF_HELPER_FLAGS_2(flcmpd, TCG_CALL_NO_RWG_SE, i32, f64, f64)
 +DEF_HELPER_FLAGS_3(flcmps, TCG_CALL_NO_RWG_SE, i32, env, f32, f32)
 +DEF_HELPER_FLAGS_3(flcmpd, TCG_CALL_NO_RWG_SE, i32, env, f64, f64)
  DEF_HELPER_2(raise_exception, noreturn, env, int)
  DEF_HELPER_FLAGS_3(faddd, TCG_CALL_NO_WG, f64, env, f64, f64)
 diff --git a/target/sparc/fop_helper.c b/target/sparc/fop_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/sparc/fop_helper.c
 +++ b/target/sparc/fop_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t helper_fcmpeq(CPUSPARCState *env, Int128 src1, Int128 src2)
      return finish_fcmp(env, r, GETPC());
  }
- #ifdef TARGET_AARCH64
+-uint32_t helper_flcmps(float32 src1, float32 src2)
--int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg);
++uint32_t helper_flcmps(CPUSPARCState *env, float32 src1, float32 src2)
--int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
+ {
--int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
+     /*
--int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
+      * FLCMP never raises an exception nor modifies any FSR fields.
-+int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
+      * Perform the comparison with a dummy fp environment.
-+int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
+      */
-+int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
+-    float_status discard = { };
-+int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg);
++    float_status discard = env->fp_status;
- void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
+     FloatRelation r;
- void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
- void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
+     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &discard);
-diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
+@@ -XXX,XX +XXX,XX @@ uint32_t helper_flcmps(float32 src1, float32 src2)
      g_assert_not_reached();
  }
 -uint32_t helper_flcmpd(float64 src1, float64 src2)
 +uint32_t helper_flcmpd(CPUSPARCState *env, float64 src1, float64 src2)
  {
 -    float_status discard = { };
 +    float_status discard = env->fp_status;
      FloatRelation r;
      set_float_2nan_prop_rule(float_2nan_prop_s_ba, &discard);
 diff --git a/target/sparc/translate.c b/target/sparc/translate.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub.c
+--- a/target/sparc/translate.c
-+++ b/target/arm/gdbstub.c
++++ b/target/sparc/translate.c
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static bool trans_FLCMPs(DisasContext *dc, arg_FLCMPs *a)
-          */
- #ifdef TARGET_AARCH64
+     src1 = gen_load_fpr_F(dc, a->rs1);
-         if (isar_feature_aa64_sve(&cpu->isar)) {
+     src2 = gen_load_fpr_F(dc, a->rs2);
--            gdb_register_coprocessor(cs, arm_gdb_get_svereg, arm_gdb_set_svereg,
+-    gen_helper_flcmps(cpu_fcc[a->cc], src1, src2);
--                                     arm_gen_dynamic_svereg_xml(cs, cs->gdb_num_regs),
++    gen_helper_flcmps(cpu_fcc[a->cc], tcg_env, src1, src2);
-+            int nreg = arm_gen_dynamic_svereg_xml(cs, cs->gdb_num_regs);
+     return advance_pc(dc);
 +            gdb_register_coprocessor(cs, aarch64_gdb_get_sve_reg,
 +                                     aarch64_gdb_set_sve_reg, nreg,
                                       "sve-registers.xml", 0);
          } else {
 -            gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
 -                                     aarch64_fpu_gdb_set_reg,
 +            gdb_register_coprocessor(cs, aarch64_gdb_get_fpu_reg,
 +                                     aarch64_gdb_set_fpu_reg,
 , "aarch64-fpu.xml", 0);
          }
  #endif
 diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub64.c
 +++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
      return 0;
  }
--int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg)
+@@ -XXX,XX +XXX,XX @@ static bool trans_FLCMPd(DisasContext *dc, arg_FLCMPd *a)
-+int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg)
- {
+     src1 = gen_load_fpr_D(dc, a->rs1);
-     switch (reg) {
+     src2 = gen_load_fpr_D(dc, a->rs2);
-     case 0 ... 31:
+-    gen_helper_flcmpd(cpu_fcc[a->cc], src1, src2);
-@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg)
++    gen_helper_flcmpd(cpu_fcc[a->cc], tcg_env, src1, src2);
-     }
+     return advance_pc(dc);
  }
--int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
-+int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg)
- {
-     switch (reg) {
-     case 0 ... 31:
-@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
-     }
- }
--int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg)
-+int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg)
- {
-     ARMCPU *cpu = env_archcpu(env);
-@@ -XXX,XX +XXX,XX @@ int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg)
-     return 0;
- }
--int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg)
-+int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
- {
-     ARMCPU *cpu = env_archcpu(env);
 --
 .34.1

-New patch
+[PULL 38/72] target/ppc: Use env->fp_status in helper_compute_fprf functions
+In the helper_compute_fprf functions, we pass a dummy float_status
+in to the is_signaling_nan() function. This is unnecessary, because
+we have convenient access to the CPU env pointer here and that
+is already set up with the correct values for the snan_bit_is_one
+and no_signaling_nans config settings. is_signaling_nan() doesn't
+ever update the fp_status with any exception flags, so there is
+no reason not to use env->fp_status here.
+Use env->fp_status instead of the dummy fp_status.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-34-peter.maydell@linaro.org
+---
+ target/ppc/fpu_helper.c | 3 +--
+file changed, 1 insertion(+), 2 deletions(-)
+diff --git a/target/ppc/fpu_helper.c b/target/ppc/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/fpu_helper.c
++++ b/target/ppc/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void helper_compute_fprf_##tp(CPUPPCState *env, tp arg)           \
+     } else if (tp##_is_infinity(arg)) {                           \
+         fprf = neg ? 0x09 << FPSCR_FPRF : 0x05 << FPSCR_FPRF;     \
+     } else {                                                      \
+-        float_status dummy = { };  /* snan_bit_is_one = 0 */      \
+-        if (tp##_is_signaling_nan(arg, &dummy)) {                 \
++        if (tp##_is_signaling_nan(arg, &env->fp_status)) {        \
+             fprf = 0x00 << FPSCR_FPRF;                            \
+         } else {                                                  \
+             fprf = 0x11 << FPSCR_FPRF;                            \
+--
+.34.1

-[PULL 08/21] target/arm: Add name argument to output_vector_union_type
+[PULL 39/72] target/arm: Copy entire float_status in is_ebf
 From: Richard Henderson <richard.henderson@linaro.org>
-This will make the function usable between SVE and SME.
+Now that float_status has a bunch of fp parameters,
 it is easier to copy an existing structure than create
 one from scratch.  Begin by copying the structure that
 corresponds to the FPSR and make only the adjustments
 required for BFloat16 semantics.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-id: 20241203203949.483774-2-richard.henderson@linaro.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230227213329.793795-9-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/gdbstub64.c | 28 ++++++++++++++--------------
+ target/arm/tcg/vec_helper.c | 20 +++++++-------------
-file changed, 14 insertions(+), 14 deletions(-)
+file changed, 7 insertions(+), 13 deletions(-)
-diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
+diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub64.c
+--- a/target/arm/tcg/vec_helper.c
-+++ b/target/arm/gdbstub64.c
++++ b/target/arm/tcg/vec_helper.c
-@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
+@@ -XXX,XX +XXX,XX @@ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp)
-     return 0;
+      * no effect on AArch32 instructions.
       */
      bool ebf = is_a64(env) && env->vfp.fpcr & FPCR_EBF;
 -    *statusp = (float_status){
 -        .tininess_before_rounding = float_tininess_before_rounding,
 -        .float_rounding_mode = float_round_to_odd_inf,
 -        .flush_to_zero = true,
 -        .flush_inputs_to_zero = true,
 -        .default_nan_mode = true,
 -    };
 +
 +    *statusp = env->vfp.fp_status;
 +    set_default_nan_mode(true, statusp);
      if (ebf) {
 -        float_status *fpst = &env->vfp.fp_status;
 -        set_flush_to_zero(get_flush_to_zero(fpst), statusp);
 -        set_flush_inputs_to_zero(get_flush_inputs_to_zero(fpst), statusp);
 -        set_float_rounding_mode(get_float_rounding_mode(fpst), statusp);
 -
          /* EBF=1 needs to do a step with round-to-odd semantics */
          *oddstatusp = *statusp;
          set_float_rounding_mode(float_round_to_odd, oddstatusp);
 +    } else {
 +        set_flush_to_zero(true, statusp);
 +        set_flush_inputs_to_zero(true, statusp);
 +        set_float_rounding_mode(float_round_to_odd_inf, statusp);
      }
 -
      return ebf;
  }
--static void output_vector_union_type(GString *s, int reg_width)
-+static void output_vector_union_type(GString *s, int reg_width,
-+                                     const char *name)
- {
-     struct TypeSize {
-         const char *gdb_type;
-@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width)
-     };
-     static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
--
--    g_autoptr(GString) ts = g_string_new("");
-     int i, j, bits;
-     /* First define types and totals in a whole VL */
-     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
--        int count = reg_width / vec_lanes[i].size;
--        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
-         g_string_append_printf(s,
--                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
--                               ts->str, vec_lanes[i].gdb_type, count);
-+                               "<vector id=\"%s%c%c\" type=\"%s\" count=\"%d\"/>",
-+                               name, vec_lanes[i].sz, vec_lanes[i].suffix,
-+                               vec_lanes[i].gdb_type, reg_width / vec_lanes[i].size);
-     }
-+
-     /*
-      * Now define a union for each size group containing unsigned and
-      * signed and potentially float versions of each size from 128 to
-      * 8 bits.
-      */
-     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
--        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
-+        g_string_append_printf(s, "<union id=\"%sn%c\">", name, suf[i]);
-         for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
-             if (vec_lanes[j].size == bits) {
--                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
--                                       vec_lanes[j].suffix,
-+                g_string_append_printf(s, "<field name=\"%c\" type=\"%s%c%c\"/>",
-+                                       vec_lanes[j].suffix, name,
-                                        vec_lanes[j].sz, vec_lanes[j].suffix);
-             }
-         }
-         g_string_append(s, "</union>");
-     }
-+
-     /* And now the final union of unions */
--    g_string_append(s, "<union id=\"svev\">");
-+    g_string_append_printf(s, "<union id=\"%s\">", name);
-     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
--        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
--                               suf[i], suf[i]);
-+        g_string_append_printf(s, "<field name=\"%c\" type=\"%sn%c\"/>",
-+                               suf[i], name, suf[i]);
-     }
-     g_string_append(s, "</union>");
- }
-@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
-     g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
-     /* Create the vector union type. */
--    output_vector_union_type(s, reg_width);
-+    output_vector_union_type(s, reg_width, "svev");
-     /* Create the predicate vector type. */
-     g_string_append_printf(s,
 --
 .34.1

-[PULL 14/21] target/arm: Implement gdbstub m-profile systemreg and secext
+[PULL 40/72] fpu: Allow runtime choice of default NaN value
-From: Richard Henderson <richard.henderson@linaro.org>
+Currently we hardcode the default NaN value in parts64_default_nan()
 using a compile-time ifdef ladder. This is awkward for two cases:
  * for single-QEMU-binary we can't hard-code target-specifics like this
  * for Arm FEAT_AFP the default NaN value depends on FPCR.AH
    (specifically the sign bit is different)
-The upstream gdb xml only implements {MSP,PSP}{,_NS,S}, but
+Add a field to float_status to specify the default NaN value; fall
-go ahead and implement the other system registers as well.
+back to the old ifdef behaviour if these are not set.
-Since there is significant overlap between the two, implement
+The default NaN value is specified by setting a uint8_t to a
-them with common code.  The only exception is the systemreg
+pattern corresponding to the sign and upper fraction parts of
-view of CONTROL, which merges the banked bits as per MRS.
+the NaN; the lower bits of the fraction are set from bit 0 of
 the pattern.
-Signed-off-by: David Reiss <dreiss@meta.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230227213329.793795-15-richard.henderson@linaro.org
-[rth: Substatial rewrite using enumerator and shared code.]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-35-peter.maydell@linaro.org
 ---
- target/arm/cpu.h     |   2 +
+ include/fpu/softfloat-helpers.h | 11 +++++++
- target/arm/gdbstub.c | 178 +++++++++++++++++++++++++++++++++++++++++++
+ include/fpu/softfloat-types.h   | 10 ++++++
-files changed, 180 insertions(+)
+ fpu/softfloat-specialize.c.inc  | 55 ++++++++++++++++++++-------------
 files changed, 54 insertions(+), 22 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/include/fpu/softfloat-helpers.h
-+++ b/target/arm/cpu.h
++++ b/include/fpu/softfloat-helpers.h
-@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
+@@ -XXX,XX +XXX,XX @@ static inline void set_float_infzeronan_rule(FloatInfZeroNaNRule rule,
+     status->float_infzeronan_rule = rule;
      DynamicGDBXMLInfo dyn_sysreg_xml;
      DynamicGDBXMLInfo dyn_svereg_xml;
 +    DynamicGDBXMLInfo dyn_m_systemreg_xml;
 +    DynamicGDBXMLInfo dyn_m_secextreg_xml;
      /* Timers used by the generic (architected) timer */
      QEMUTimer *gt_timer[NUM_GTIMERS];
 diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub.c
 +++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
      return cpu->dyn_sysreg_xml.num;
  }
-+typedef enum {
++static inline void set_float_default_nan_pattern(uint8_t dnan_pattern,
-+    M_SYSREG_MSP,
++                                                 float_status *status)
 +    M_SYSREG_PSP,
 +    M_SYSREG_PRIMASK,
 +    M_SYSREG_CONTROL,
 +    M_SYSREG_BASEPRI,
 +    M_SYSREG_FAULTMASK,
 +    M_SYSREG_MSPLIM,
 +    M_SYSREG_PSPLIM,
 +} MProfileSysreg;
 +
 +static const struct {
 +    const char *name;
 +    int feature;
 +} m_sysreg_def[] = {
 +    [M_SYSREG_MSP] = { "msp", ARM_FEATURE_M },
 +    [M_SYSREG_PSP] = { "psp", ARM_FEATURE_M },
 +    [M_SYSREG_PRIMASK] = { "primask", ARM_FEATURE_M },
 +    [M_SYSREG_CONTROL] = { "control", ARM_FEATURE_M },
 +    [M_SYSREG_BASEPRI] = { "basepri", ARM_FEATURE_M_MAIN },
 +    [M_SYSREG_FAULTMASK] = { "faultmask", ARM_FEATURE_M_MAIN },
 +    [M_SYSREG_MSPLIM] = { "msplim", ARM_FEATURE_V8 },
 +    [M_SYSREG_PSPLIM] = { "psplim", ARM_FEATURE_V8 },
 +};
 +
 +static uint32_t *m_sysreg_ptr(CPUARMState *env, MProfileSysreg reg, bool sec)
 +{
-+    uint32_t *ptr;
++    status->default_nan_pattern = dnan_pattern;
 +
 +    switch (reg) {
 +    case M_SYSREG_MSP:
 +        ptr = arm_v7m_get_sp_ptr(env, sec, false, true);
 +        break;
 +    case M_SYSREG_PSP:
 +        ptr = arm_v7m_get_sp_ptr(env, sec, true, true);
 +        break;
 +    case M_SYSREG_MSPLIM:
 +        ptr = &env->v7m.msplim[sec];
 +        break;
 +    case M_SYSREG_PSPLIM:
 +        ptr = &env->v7m.psplim[sec];
 +        break;
 +    case M_SYSREG_PRIMASK:
 +        ptr = &env->v7m.primask[sec];
 +        break;
 +    case M_SYSREG_BASEPRI:
 +        ptr = &env->v7m.basepri[sec];
 +        break;
 +    case M_SYSREG_FAULTMASK:
 +        ptr = &env->v7m.faultmask[sec];
 +        break;
 +    case M_SYSREG_CONTROL:
 +        ptr = &env->v7m.control[sec];
 +        break;
 +    default:
 +        return NULL;
 +    }
 +    return arm_feature(env, m_sysreg_def[reg].feature) ? ptr : NULL;
 +}
 +
-+static int m_sysreg_get(CPUARMState *env, GByteArray *buf,
+ static inline void set_flush_to_zero(bool val, float_status *status)
-+                        MProfileSysreg reg, bool secure)
+ {
      status->flush_to_zero = val;
@@ -XXX,XX +XXX,XX @@ static inline FloatInfZeroNaNRule get_float_infzeronan_rule(float_status *status
      return status->float_infzeronan_rule;
  }
 +static inline uint8_t get_float_default_nan_pattern(float_status *status)
 +{
-+    uint32_t *ptr = m_sysreg_ptr(env, reg, secure);
++    return status->default_nan_pattern;
 +
 +    if (ptr == NULL) {
 +        return 0;
 +    }
 +    return gdb_get_reg32(buf, *ptr);
 +}
 +
-+static int arm_gdb_get_m_systemreg(CPUARMState *env, GByteArray *buf, int reg)
+ static inline bool get_flush_to_zero(float_status *status)
-+{
+ {
      return status->flush_to_zero;
 diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/fpu/softfloat-types.h
 +++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
      /* should denormalised inputs go to zero and set the input_denormal flag? */
      bool flush_inputs_to_zero;
      bool default_nan_mode;
 +    /*
-+     * Here, we emulate MRS instruction, where CONTROL has a mix of
++     * The pattern to use for the default NaN. Here the high bit specifies
-+     * banked and non-banked bits.
++     * the default NaN's sign bit, and bits 6..0 specify the high bits of the
 +     * fractional part. The low bits of the fractional part are copies of bit 0.
 +     * The exponent of the default NaN is (as for any NaN) always all 1s.
 +     * Note that a value of 0 here is not a valid NaN. The target must set
 +     * this to the correct non-zero value, or we will assert when trying to
 +     * create a default NaN.
 +     */
-+    if (reg == M_SYSREG_CONTROL) {
++    uint8_t default_nan_pattern;
-+        return gdb_get_reg32(buf, arm_v7m_mrs_control(env, env->v7m.secure));
+     /*
       * The flags below are not used on all specializations and may
       * constant fold away (see snan_bit_is_one()/no_signalling_nans() in
 diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/fpu/softfloat-specialize.c.inc
 +++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
  {
      bool sign = 0;
      uint64_t frac;
 +    uint8_t dnan_pattern = status->default_nan_pattern;
 +    if (dnan_pattern == 0) {
  #if defined(TARGET_SPARC) || defined(TARGET_M68K)
 -    /* !snan_bit_is_one, set all bits */
 -    frac = (1ULL << DECOMPOSED_BINARY_POINT) - 1;
 -#elif defined(TARGET_I386) || defined(TARGET_X86_64) \
 +        /* Sign bit clear, all frac bits set */
 +        dnan_pattern = 0b01111111;
 +#elif defined(TARGET_I386) || defined(TARGET_X86_64)    \
      || defined(TARGET_MICROBLAZE)
 -    /* !snan_bit_is_one, set sign and msb */
 -    frac = 1ULL << (DECOMPOSED_BINARY_POINT - 1);
 -    sign = 1;
 +        /* Sign bit set, most significant frac bit set */
 +        dnan_pattern = 0b11000000;
  #elif defined(TARGET_HPPA)
 -    /* snan_bit_is_one, set msb-1.  */
 -    frac = 1ULL << (DECOMPOSED_BINARY_POINT - 2);
 +        /* Sign bit clear, msb-1 frac bit set */
 +        dnan_pattern = 0b00100000;
  #elif defined(TARGET_HEXAGON)
 -    sign = 1;
 -    frac = ~0ULL;
 +        /* Sign bit set, all frac bits set. */
 +        dnan_pattern = 0b11111111;
  #else
 -    /*
 -     * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
 -     * S390, SH4, TriCore, and Xtensa.  Our other supported targets
 -     * do not have floating-point.
 -     */
 -    if (snan_bit_is_one(status)) {
 -        /* set all bits other than msb */
 -        frac = (1ULL << (DECOMPOSED_BINARY_POINT - 1)) - 1;
 -    } else {
 -        /* set msb */
 -        frac = 1ULL << (DECOMPOSED_BINARY_POINT - 1);
 -    }
 +        /*
 +         * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
 +         * S390, SH4, TriCore, and Xtensa.  Our other supported targets
 +         * do not have floating-point.
 +         */
 +        if (snan_bit_is_one(status)) {
 +            /* sign bit clear, set all frac bits other than msb */
 +            dnan_pattern = 0b00111111;
 +        } else {
 +            /* sign bit clear, set frac msb */
 +            dnan_pattern = 0b01000000;
 +        }
  #endif
 +    }
-+    return m_sysreg_get(env, buf, reg, env->v7m.secure);
++    assert(dnan_pattern != 0);
 +}
 +
-+static int arm_gdb_set_m_systemreg(CPUARMState *env, uint8_t *buf, int reg)
++    sign = dnan_pattern >> 7;
-+{
++    /*
-+    return 0; /* TODO */
++     * Place default_nan_pattern [6:0] into bits [62:56],
-+}
++     * and replecate bit [0] down into [55:0]
-+
++     */
-+static int arm_gen_dynamic_m_systemreg_xml(CPUState *cs, int orig_base_reg)
++    frac = deposit64(0, DECOMPOSED_BINARY_POINT - 7, 7, dnan_pattern);
-+{
++    frac = deposit64(frac, 0, DECOMPOSED_BINARY_POINT - 7, -(dnan_pattern & 1));
-+    ARMCPU *cpu = ARM_CPU(cs);
-+    CPUARMState *env = &cpu->env;
+     *p = (FloatParts64) {
-+    GString *s = g_string_new(NULL);
+         .cls = float_class_qnan,
 +    int base_reg = orig_base_reg;
 +    int i;
 +
 +    g_string_printf(s, "<?xml version=\"1.0\"?>");
 +    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
 +    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.arm.m-system\">\n");
 +
 +    for (i = 0; i < ARRAY_SIZE(m_sysreg_def); i++) {
 +        if (arm_feature(env, m_sysreg_def[i].feature)) {
 +            g_string_append_printf(s,
 +                "<reg name=\"%s\" bitsize=\"32\" regnum=\"%d\"/>\n",
 +                m_sysreg_def[i].name, base_reg++);
 +        }
 +    }
 +
 +    g_string_append_printf(s, "</feature>");
 +    cpu->dyn_m_systemreg_xml.desc = g_string_free(s, false);
 +    cpu->dyn_m_systemreg_xml.num = base_reg - orig_base_reg;
 +
 +    return cpu->dyn_m_systemreg_xml.num;
 +}
 +
 +#ifndef CONFIG_USER_ONLY
 +/*
 + * For user-only, we see the non-secure registers via m_systemreg above.
 + * For secext, encode the non-secure view as even and secure view as odd.
 + */
 +static int arm_gdb_get_m_secextreg(CPUARMState *env, GByteArray *buf, int reg)
 +{
 +    return m_sysreg_get(env, buf, reg >> 1, reg & 1);
 +}
 +
 +static int arm_gdb_set_m_secextreg(CPUARMState *env, uint8_t *buf, int reg)
 +{
 +    return 0; /* TODO */
 +}
 +
 +static int arm_gen_dynamic_m_secextreg_xml(CPUState *cs, int orig_base_reg)
 +{
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    GString *s = g_string_new(NULL);
 +    int base_reg = orig_base_reg;
 +    int i;
 +
 +    g_string_printf(s, "<?xml version=\"1.0\"?>");
 +    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
 +    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.arm.secext\">\n");
 +
 +    for (i = 0; i < ARRAY_SIZE(m_sysreg_def); i++) {
 +        g_string_append_printf(s,
 +            "<reg name=\"%s_ns\" bitsize=\"32\" regnum=\"%d\"/>\n",
 +            m_sysreg_def[i].name, base_reg++);
 +        g_string_append_printf(s,
 +            "<reg name=\"%s_s\" bitsize=\"32\" regnum=\"%d\"/>\n",
 +            m_sysreg_def[i].name, base_reg++);
 +    }
 +
 +    g_string_append_printf(s, "</feature>");
 +    cpu->dyn_m_secextreg_xml.desc = g_string_free(s, false);
 +    cpu->dyn_m_secextreg_xml.num = base_reg - orig_base_reg;
 +
 +    return cpu->dyn_m_secextreg_xml.num;
 +}
 +#endif
 +
  const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
  {
      ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
          return cpu->dyn_sysreg_xml.desc;
      } else if (strcmp(xmlname, "sve-registers.xml") == 0) {
          return cpu->dyn_svereg_xml.desc;
 +    } else if (strcmp(xmlname, "arm-m-system.xml") == 0) {
 +        return cpu->dyn_m_systemreg_xml.desc;
 +#ifndef CONFIG_USER_ONLY
 +    } else if (strcmp(xmlname, "arm-m-secext.xml") == 0) {
 +        return cpu->dyn_m_secextreg_xml.desc;
 +#endif
      }
      return NULL;
  }
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                               arm_gen_dynamic_sysreg_xml(cs, cs->gdb_num_regs),
                               "system-registers.xml", 0);
 +    if (arm_feature(env, ARM_FEATURE_M)) {
 +        gdb_register_coprocessor(cs,
 +            arm_gdb_get_m_systemreg, arm_gdb_set_m_systemreg,
 +            arm_gen_dynamic_m_systemreg_xml(cs, cs->gdb_num_regs),
 +            "arm-m-system.xml", 0);
 +#ifndef CONFIG_USER_ONLY
 +        if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
 +            gdb_register_coprocessor(cs,
 +                arm_gdb_get_m_secextreg, arm_gdb_set_m_secextreg,
 +                arm_gen_dynamic_m_secextreg_xml(cs, cs->gdb_num_regs),
 +                "arm-m-secext.xml", 0);
 +        }
 +#endif
 +    }
  }
 --
 .34.1

-New patch
+[PULL 41/72] tests/fp: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for the tests/fp code.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-36-peter.maydell@linaro.org
+---
+ tests/fp/fp-bench.c     | 1 +
+ tests/fp/fp-test-log2.c | 1 +
+ tests/fp/fp-test.c      | 1 +
+files changed, 3 insertions(+)
+diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-bench.c
++++ b/tests/fp/fp-bench.c
+@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
+     set_float_3nan_prop_rule(float_3nan_prop_s_cab, &soft_status);
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
++    set_float_default_nan_pattern(0b01000000, &soft_status);
+     f = bench_funcs[operation][precision];
+     g_assert(f);
+diff --git a/tests/fp/fp-test-log2.c b/tests/fp/fp-test-log2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-test-log2.c
++++ b/tests/fp/fp-test-log2.c
+@@ -XXX,XX +XXX,XX @@ int main(int ac, char **av)
+     int i;
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
++    set_float_default_nan_pattern(0b01000000, &qsf);
+     set_float_rounding_mode(float_round_nearest_even, &qsf);
+     test.d = 0.0;
+diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/fp/fp-test.c
++++ b/tests/fp/fp-test.c
+@@ -XXX,XX +XXX,XX @@ void run_test(void)
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
+     set_float_3nan_prop_rule(float_3nan_prop_s_cab, &qsf);
++    set_float_default_nan_pattern(0b01000000, &qsf);
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
+     genCases_setLevel(test_level);
+--
+.34.1

-New patch
+[PULL 42/72] target/microblaze: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly, and remove the ifdef from
+parts64_default_nan().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-37-peter.maydell@linaro.org
+---
+ target/microblaze/cpu.c        | 2 ++
+ fpu/softfloat-specialize.c.inc | 3 +--
+files changed, 3 insertions(+), 2 deletions(-)
+diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/microblaze/cpu.c
++++ b/target/microblaze/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void mb_cpu_reset_hold(Object *obj, ResetType type)
+      * this architecture.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
++    /* Default NaN: sign bit set, most significant frac bit set */
++    set_float_default_nan_pattern(0b11000000, &env->fp_status);
+ #if defined(CONFIG_USER_ONLY)
+     /* start in user mode with interrupts enabled.  */
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+ #if defined(TARGET_SPARC) || defined(TARGET_M68K)
+         /* Sign bit clear, all frac bits set */
+         dnan_pattern = 0b01111111;
+-#elif defined(TARGET_I386) || defined(TARGET_X86_64)    \
+-    || defined(TARGET_MICROBLAZE)
++#elif defined(TARGET_I386) || defined(TARGET_X86_64)
+         /* Sign bit set, most significant frac bit set */
+         dnan_pattern = 0b11000000;
+ #elif defined(TARGET_HPPA)
+--
+.34.1

-New patch
+[PULL 43/72] target/i386: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly, and remove the ifdef from
+parts64_default_nan().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-38-peter.maydell@linaro.org
+---
+ target/i386/tcg/fpu_helper.c   | 4 ++++
+ fpu/softfloat-specialize.c.inc | 3 ---
+files changed, 4 insertions(+), 3 deletions(-)
+diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/tcg/fpu_helper.c
++++ b/target/i386/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
+      */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->sse_status);
+     set_float_3nan_prop_rule(float_3nan_prop_abc, &env->sse_status);
++    /* Default NaN: sign bit set, most significant frac bit set */
++    set_float_default_nan_pattern(0b11000000, &env->fp_status);
++    set_float_default_nan_pattern(0b11000000, &env->mmx_status);
++    set_float_default_nan_pattern(0b11000000, &env->sse_status);
+ }
+ static inline uint8_t save_exception_flags(CPUX86State *env)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+ #if defined(TARGET_SPARC) || defined(TARGET_M68K)
+         /* Sign bit clear, all frac bits set */
+         dnan_pattern = 0b01111111;
+-#elif defined(TARGET_I386) || defined(TARGET_X86_64)
+-        /* Sign bit set, most significant frac bit set */
+-        dnan_pattern = 0b11000000;
+ #elif defined(TARGET_HPPA)
+         /* Sign bit clear, msb-1 frac bit set */
+         dnan_pattern = 0b00100000;
+--
+.34.1

-New patch
+[PULL 44/72] target/hppa: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly, and remove the ifdef from
+parts64_default_nan().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-39-peter.maydell@linaro.org
+---
+ target/hppa/fpu_helper.c       | 2 ++
+ fpu/softfloat-specialize.c.inc | 3 ---
+files changed, 2 insertions(+), 3 deletions(-)
+diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hppa/fpu_helper.c
++++ b/target/hppa/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
+     set_float_3nan_prop_rule(float_3nan_prop_abc, &env->fp_status);
+     /* For inf * 0 + NaN, return the input NaN */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
++    /* Default NaN: sign bit clear, msb-1 frac bit set */
++    set_float_default_nan_pattern(0b00100000, &env->fp_status);
+ }
+ void cpu_hppa_loaded_fr0(CPUHPPAState *env)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+ #if defined(TARGET_SPARC) || defined(TARGET_M68K)
+         /* Sign bit clear, all frac bits set */
+         dnan_pattern = 0b01111111;
+-#elif defined(TARGET_HPPA)
+-        /* Sign bit clear, msb-1 frac bit set */
+-        dnan_pattern = 0b00100000;
+ #elif defined(TARGET_HEXAGON)
+         /* Sign bit set, all frac bits set. */
+         dnan_pattern = 0b11111111;
+--
+.34.1

-New patch
+[PULL 45/72] target/alpha: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for the alpha target.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-40-peter.maydell@linaro.org
+---
+ target/alpha/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/alpha/cpu.c b/target/alpha/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/alpha/cpu.c
++++ b/target/alpha/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void alpha_cpu_initfn(Object *obj)
+      * operand in Fa. That is float_2nan_prop_ba.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
++    /* Default NaN: sign bit clear, msb frac bit set */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
+ #if defined(CONFIG_USER_ONLY)
+     env->flags = ENV_FLAG_PS_USER | ENV_FLAG_FEN;
+     cpu_alpha_store_fpcr(env, (uint64_t)(FPCR_INVD | FPCR_DZED | FPCR_OVFD
+--
+.34.1

-New patch
+[PULL 46/72] target/arm: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for the arm target.
+This includes setting it for the old linux-user nwfpe emulation.
+For nwfpe, our default doesn't match the real kernel, but we
+avoid making a behaviour change in this commit.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-41-peter.maydell@linaro.org
+---
+ linux-user/arm/nwfpe/fpa11.c | 5 +++++
+ target/arm/cpu.c             | 2 ++
+files changed, 7 insertions(+)
+diff --git a/linux-user/arm/nwfpe/fpa11.c b/linux-user/arm/nwfpe/fpa11.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/arm/nwfpe/fpa11.c
++++ b/linux-user/arm/nwfpe/fpa11.c
+@@ -XXX,XX +XXX,XX @@ void resetFPA11(void)
+    * this late date.
+    */
+   set_float_2nan_prop_rule(float_2nan_prop_s_ab, &fpa11->fp_status);
++  /*
++   * Use the same default NaN value as Arm VFP. This doesn't match
++   * the Linux kernel's nwfpe emulation, which uses an all-1s value.
++   */
++  set_float_default_nan_pattern(0b01000000, &fpa11->fp_status);
+ }
+ void SetRoundingMode(const unsigned int opcode)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
+  *    the pseudocode function the arguments are in the order c, a, b.
+  *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
+  *    and the input NaN if it is signalling
++ *  * Default NaN has sign bit clear, msb frac bit set
+  */
+ static void arm_set_default_fp_behaviours(float_status *s)
+ {
+@@ -XXX,XX +XXX,XX @@ static void arm_set_default_fp_behaviours(float_status *s)
+     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
+     set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
+     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
++    set_float_default_nan_pattern(0b01000000, s);
+ }
+ static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
+--
+.34.1

-New patch
+[PULL 47/72] target/loongarch: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for loongarch.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-42-peter.maydell@linaro.org
+---
+ target/loongarch/tcg/fpu_helper.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/loongarch/tcg/fpu_helper.c
++++ b/target/loongarch/tcg/fpu_helper.c
+@@ -XXX,XX +XXX,XX @@ void restore_fp_status(CPULoongArchState *env)
+      */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+     set_float_3nan_prop_rule(float_3nan_prop_s_cab, &env->fp_status);
++    /* Default NaN: sign bit clear, msb frac bit set */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
+ }
+ int ieee_ex_to_loongarch(int xcpt)
+--
+.34.1

-New patch
+[PULL 48/72] target/m68k: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for m68k.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-43-peter.maydell@linaro.org
+---
+ target/m68k/cpu.c              | 2 ++
+ fpu/softfloat-specialize.c.inc | 2 +-
+files changed, 3 insertions(+), 1 deletion(-)
+diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/m68k/cpu.c
++++ b/target/m68k/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
+      * preceding paragraph for nonsignaling NaNs.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
++    /* Default NaN: sign bit clear, all frac bits set */
++    set_float_default_nan_pattern(0b01111111, &env->fp_status);
+     nan = floatx80_default_nan(&env->fp_status);
+     for (i = 0; i < 8; i++) {
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+     uint8_t dnan_pattern = status->default_nan_pattern;
+     if (dnan_pattern == 0) {
+-#if defined(TARGET_SPARC) || defined(TARGET_M68K)
++#if defined(TARGET_SPARC)
+         /* Sign bit clear, all frac bits set */
+         dnan_pattern = 0b01111111;
+ #elif defined(TARGET_HEXAGON)
+--
+.34.1

-New patch
+[PULL 49/72] target/mips: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for MIPS. Note that this
+is our only target which currently changes the default NaN
+at runtime (which it was previously doing indirectly when it
+changed the snan_bit_is_one setting).
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-44-peter.maydell@linaro.org
+---
+ target/mips/fpu_helper.h | 7 +++++++
+ target/mips/msa.c        | 3 +++
+files changed, 10 insertions(+)
+diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/fpu_helper.h
++++ b/target/mips/fpu_helper.h
+@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
+     set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
+     nan3_rule = nan2008 ? float_3nan_prop_s_cab : float_3nan_prop_s_abc;
+     set_float_3nan_prop_rule(nan3_rule, &env->active_fpu.fp_status);
++    /*
++     * With nan2008, the default NaN value has the sign bit clear and the
++     * frac msb set; with the older mode, the sign bit is clear, and all
++     * frac bits except the msb are set.
++     */
++    set_float_default_nan_pattern(nan2008 ? 0b01000000 : 0b00111111,
++                                  &env->active_fpu.fp_status);
+ }
+diff --git a/target/mips/msa.c b/target/mips/msa.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/mips/msa.c
++++ b/target/mips/msa.c
+@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
+     /* Inf * 0 + NaN returns the input NaN */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never,
+                               &env->active_tc.msa_fp_status);
++    /* Default NaN: sign bit clear, frac msb set */
++    set_float_default_nan_pattern(0b01000000,
++                                  &env->active_tc.msa_fp_status);
+ }
+--
+.34.1

-New patch
+[PULL 50/72] target/openrisc: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for openrisc.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-45-peter.maydell@linaro.org
+---
+ target/openrisc/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/openrisc/cpu.c b/target/openrisc/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/openrisc/cpu.c
++++ b/target/openrisc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void openrisc_cpu_reset_hold(Object *obj, ResetType type)
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &cpu->env.fp_status);
++    /* Default NaN: sign bit clear, frac msb set */
++    set_float_default_nan_pattern(0b01000000, &cpu->env.fp_status);
+ #ifndef CONFIG_USER_ONLY
+     cpu->env.picmr = 0x00000000;
+--
+.34.1

-New patch
+[PULL 51/72] target/ppc: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for ppc.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-46-peter.maydell@linaro.org
+---
+ target/ppc/cpu_init.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/ppc/cpu_init.c
++++ b/target/ppc/cpu_init.c
+@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->vec_status);
++    /* Default NaN: sign bit clear, set frac msb */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
++    set_float_default_nan_pattern(0b01000000, &env->vec_status);
++
+     for (i = 0; i < ARRAY_SIZE(env->spr_cb); i++) {
+         ppc_spr_t *spr = &env->spr_cb[i];
+--
+.34.1

-New patch
+[PULL 52/72] target/sh4: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for sh4. Note that sh4
+is one of the only three targets (the others being HPPA and
+sometimes MIPS) that has snan_bit_is_one set.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-47-peter.maydell@linaro.org
+---
+ target/sh4/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/sh4/cpu.c b/target/sh4/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sh4/cpu.c
++++ b/target/sh4/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void superh_cpu_reset_hold(Object *obj, ResetType type)
+     set_flush_to_zero(1, &env->fp_status);
+ #endif
+     set_default_nan_mode(1, &env->fp_status);
++    /* sign bit clear, set all frac bits other than msb */
++    set_float_default_nan_pattern(0b00111111, &env->fp_status);
+ }
+ static void superh_cpu_disas_set_info(CPUState *cpu, disassemble_info *info)
+--
+.34.1

-New patch
+[PULL 53/72] target/rx: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for rx.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-48-peter.maydell@linaro.org
+---
+ target/rx/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/rx/cpu.c b/target/rx/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/rx/cpu.c
++++ b/target/rx/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void rx_cpu_reset_hold(Object *obj, ResetType type)
+      * then prefer dest over source", which is float_2nan_prop_s_ab.
+      */
+     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
++    /* Default NaN value: sign bit clear, set frac msb */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
+ }
+ static ObjectClass *rx_cpu_class_by_name(const char *cpu_model)
+--
+.34.1

-New patch
+[PULL 54/72] target/s390x: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for s390x.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-49-peter.maydell@linaro.org
+---
+ target/s390x/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/s390x/cpu.c
++++ b/target/s390x/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_hold(Object *obj, ResetType type)
+         set_float_3nan_prop_rule(float_3nan_prop_s_abc, &env->fpu_status);
+         set_float_infzeronan_rule(float_infzeronan_dnan_always,
+                                   &env->fpu_status);
++        /* Default NaN value: sign bit clear, frac msb set */
++        set_float_default_nan_pattern(0b01000000, &env->fpu_status);
+        /* fall through */
+     case RESET_TYPE_S390_CPU_NORMAL:
+         env->psw.mask &= ~PSW_MASK_RI;
+--
+.34.1

-New patch
+[PULL 55/72] target/sparc: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for SPARC, and remove
+the ifdef from parts64_default_nan.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-50-peter.maydell@linaro.org
+---
+ target/sparc/cpu.c             | 2 ++
+ fpu/softfloat-specialize.c.inc | 5 +----
+files changed, 3 insertions(+), 4 deletions(-)
+diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/sparc/cpu.c
++++ b/target/sparc/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
+     set_float_3nan_prop_rule(float_3nan_prop_s_cba, &env->fp_status);
+     /* For inf * 0 + NaN, return the input NaN */
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
++    /* Default NaN value: sign bit clear, all frac bits set */
++    set_float_default_nan_pattern(0b01111111, &env->fp_status);
+     cpu_exec_realizefn(cs, &local_err);
+     if (local_err != NULL) {
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+     uint8_t dnan_pattern = status->default_nan_pattern;
+     if (dnan_pattern == 0) {
+-#if defined(TARGET_SPARC)
+-        /* Sign bit clear, all frac bits set */
+-        dnan_pattern = 0b01111111;
+-#elif defined(TARGET_HEXAGON)
++#if defined(TARGET_HEXAGON)
+         /* Sign bit set, all frac bits set. */
+         dnan_pattern = 0b11111111;
+ #else
+--
+.34.1

-[PULL 16/21] target/arm: Stub arm_hcr_el2_eff for m-profile
+[PULL 56/72] target/xtensa: Set default NaN pattern explicitly
-From: Richard Henderson <richard.henderson@linaro.org>
+Set the default NaN pattern explicitly for xtensa.
-M-profile doesn't have HCR_EL2.  While we could test features
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-before each call, zero is a generally safe return value to
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-disable the code in the caller.  This test is required to
+Message-id: 20241202131347.498124-51-peter.maydell@linaro.org
-avoid an assert in arm_is_secure_below_el3.
+---
  target/xtensa/cpu.c | 2 ++
 file changed, 2 insertions(+)
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230227225832.816605-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.c | 3 +++
 file changed, 3 insertions(+)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/xtensa/cpu.c
-+++ b/target/arm/helper.c
++++ b/target/xtensa/cpu.c
-@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure)
+@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_reset_hold(Object *obj, ResetType type)
+     /* For inf * 0 + NaN, return the input NaN */
- uint64_t arm_hcr_el2_eff(CPUARMState *env)
+     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
- {
+     set_no_signaling_nans(!dfpu, &env->fp_status);
-+    if (arm_feature(env, ARM_FEATURE_M)) {
++    /* Default NaN value: sign bit clear, set frac msb */
-+        return 0;
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
-+    }
+     xtensa_use_first_nan(env, !dfpu);
      return arm_hcr_el2_eff_secstate(env, arm_is_secure_below_el3(env));
  }
 --
 .34.1

-New patch
+[PULL 57/72] target/hexagon: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for hexagon.
+Remove the ifdef from parts64_default_nan(); the only
+remaining unconverted targets all use the default case.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-52-peter.maydell@linaro.org
+---
+ target/hexagon/cpu.c           | 2 ++
+ fpu/softfloat-specialize.c.inc | 5 -----
+files changed, 2 insertions(+), 5 deletions(-)
+diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/hexagon/cpu.c
++++ b/target/hexagon/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_reset_hold(Object *obj, ResetType type)
+     set_default_nan_mode(1, &env->fp_status);
+     set_float_detect_tininess(float_tininess_before_rounding, &env->fp_status);
++    /* Default NaN value: sign bit set, all frac bits set */
++    set_float_default_nan_pattern(0b11111111, &env->fp_status);
+ }
+ static void hexagon_cpu_disas_set_info(CPUState *s, disassemble_info *info)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+     uint8_t dnan_pattern = status->default_nan_pattern;
+     if (dnan_pattern == 0) {
+-#if defined(TARGET_HEXAGON)
+-        /* Sign bit set, all frac bits set. */
+-        dnan_pattern = 0b11111111;
+-#else
+         /*
+          * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
+          * S390, SH4, TriCore, and Xtensa.  Our other supported targets
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+             /* sign bit clear, set frac msb */
+             dnan_pattern = 0b01000000;
+         }
+-#endif
+     }
+     assert(dnan_pattern != 0);
+--
+.34.1

-New patch
+[PULL 58/72] target/riscv: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for riscv.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-53-peter.maydell@linaro.org
+---
+ target/riscv/cpu.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/riscv/cpu.c b/target/riscv/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/riscv/cpu.c
++++ b/target/riscv/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void riscv_cpu_reset_hold(Object *obj, ResetType type)
+     cs->exception_index = RISCV_EXCP_NONE;
+     env->load_res = -1;
+     set_default_nan_mode(1, &env->fp_status);
++    /* Default NaN value: sign bit clear, frac msb set */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
+     env->vill = true;
+ #ifndef CONFIG_USER_ONLY
+--
+.34.1

-New patch
+[PULL 59/72] target/tricore: Set default NaN pattern explicitly
+Set the default NaN pattern explicitly for tricore.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-54-peter.maydell@linaro.org
+---
+ target/tricore/helper.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/tricore/helper.c b/target/tricore/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/tricore/helper.c
++++ b/target/tricore/helper.c
+@@ -XXX,XX +XXX,XX @@ void fpu_set_state(CPUTriCoreState *env)
+     set_flush_to_zero(1, &env->fp_status);
+     set_float_detect_tininess(float_tininess_before_rounding, &env->fp_status);
+     set_default_nan_mode(1, &env->fp_status);
++    /* Default NaN pattern: sign bit clear, frac msb set */
++    set_float_default_nan_pattern(0b01000000, &env->fp_status);
+ }
+ uint32_t psw_read(CPUTriCoreState *env)
+--
+.34.1

-New patch
+[PULL 60/72] fpu: Remove default handling for dnan_pattern
+Now that all our targets have bene converted to explicitly specify
+their pattern for the default NaN value we can remove the remaining
+fallback code in parts64_default_nan().
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241202131347.498124-55-peter.maydell@linaro.org
+---
+ fpu/softfloat-specialize.c.inc | 14 --------------
+file changed, 14 deletions(-)
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
+index XXXXXXX..XXXXXXX 100644
+--- a/fpu/softfloat-specialize.c.inc
++++ b/fpu/softfloat-specialize.c.inc
+@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
+     uint64_t frac;
+     uint8_t dnan_pattern = status->default_nan_pattern;
+-    if (dnan_pattern == 0) {
+-        /*
+-         * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
+-         * S390, SH4, TriCore, and Xtensa.  Our other supported targets
+-         * do not have floating-point.
+-         */
+-        if (snan_bit_is_one(status)) {
+-            /* sign bit clear, set all frac bits other than msb */
+-            dnan_pattern = 0b00111111;
+-        } else {
+-            /* sign bit clear, set frac msb */
+-            dnan_pattern = 0b01000000;
+-        }
+-    }
+     assert(dnan_pattern != 0);
+     sign = dnan_pattern >> 7;
+--
+.34.1

-[PULL 02/21] target/arm: Unexport arm_gen_dynamic_sysreg_xml
+[PULL 61/72] softfloat: Inline pickNaNMulAdd
 From: Richard Henderson <richard.henderson@linaro.org>
-This function is not used outside gdbstub.c.
+Inline pickNaNMulAdd into its only caller.  This makes
 one assert redundant with the immediately preceding IF.
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241203203949.483774-3-richard.henderson@linaro.org
-Message-id: 20230227213329.793795-3-richard.henderson@linaro.org
+[PMM: keep comment from old code in new location]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h     | 1 -
+ fpu/softfloat-parts.c.inc      | 41 +++++++++++++++++++++++++-
- target/arm/gdbstub.c | 2 +-
+ fpu/softfloat-specialize.c.inc | 54 ----------------------------------
-files changed, 1 insertion(+), 2 deletions(-)
+files changed, 40 insertions(+), 55 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/fpu/softfloat-parts.c.inc
-+++ b/target/arm/cpu.h
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
-  * Helpers to dynamically generates XML descriptions of the sysregs
+     }
-  * and SVE registers. Returns the number of registers in each set.
-  */
+     if (s->default_nan_mode) {
--int arm_gen_dynamic_sysreg_xml(CPUState *cpu, int base_reg);
++        /*
- int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
++         * We guarantee not to require the target to tell us how to
++         * pick a NaN if we're always returning the default NaN.
- /* Returns the dynamically generated XML for the gdb stub.
++         * But if we're not in default-NaN mode then the target must
-diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
++         * specify.
 +         */
          which = 3;
 +    } else if (infzero) {
 +        /*
 +         * Inf * 0 + NaN -- some implementations return the
 +         * default NaN here, and some return the input NaN.
 +         */
 +        switch (s->float_infzeronan_rule) {
 +        case float_infzeronan_dnan_never:
 +            which = 2;
 +            break;
 +        case float_infzeronan_dnan_always:
 +            which = 3;
 +            break;
 +        case float_infzeronan_dnan_if_qnan:
 +            which = is_qnan(c->cls) ? 3 : 2;
 +            break;
 +        default:
 +            g_assert_not_reached();
 +        }
      } else {
 -        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, have_snan, s);
 +        FloatClass cls[3] = { a->cls, b->cls, c->cls };
 +        Float3NaNPropRule rule = s->float_3nan_prop_rule;
 +
 +        assert(rule != float_3nan_prop_none);
 +        if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
 +            /* We have at least one SNaN input and should prefer it */
 +            do {
 +                which = rule & R_3NAN_1ST_MASK;
 +                rule >>= R_3NAN_1ST_LENGTH;
 +            } while (!is_snan(cls[which]));
 +        } else {
 +            do {
 +                which = rule & R_3NAN_1ST_MASK;
 +                rule >>= R_3NAN_1ST_LENGTH;
 +            } while (!is_nan(cls[which]));
 +        }
      }
      if (which == 3) {
 diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub.c
+--- a/fpu/softfloat-specialize.c.inc
-+++ b/target/arm/gdbstub.c
++++ b/fpu/softfloat-specialize.c.inc
-@@ -XXX,XX +XXX,XX @@ static void arm_register_sysreg_for_xml(gpointer key, gpointer value,
+@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
      }
  }
--int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
+-/*----------------------------------------------------------------------------
-+static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
+-| Select which NaN to propagate for a three-input operation.
- {
+-| For the moment we assume that no CPU needs the 'larger significand'
-     ARMCPU *cpu = ARM_CPU(cs);
+-| information.
-     GString *s = g_string_new(NULL);
+-| Return values : 0 : a; 1 : b; 2 : c; 3 : default-NaN
 -*----------------------------------------------------------------------------*/
 -static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
 -                         bool infzero, bool have_snan, float_status *status)
 -{
 -    FloatClass cls[3] = { a_cls, b_cls, c_cls };
 -    Float3NaNPropRule rule = status->float_3nan_prop_rule;
 -    int which;
 -
 -    /*
 -     * We guarantee not to require the target to tell us how to
 -     * pick a NaN if we're always returning the default NaN.
 -     * But if we're not in default-NaN mode then the target must
 -     * specify.
 -     */
 -    assert(!status->default_nan_mode);
 -
 -    if (infzero) {
 -        /*
 -         * Inf * 0 + NaN -- some implementations return the default NaN here,
 -         * and some return the input NaN.
 -         */
 -        switch (status->float_infzeronan_rule) {
 -        case float_infzeronan_dnan_never:
 -            return 2;
 -        case float_infzeronan_dnan_always:
 -            return 3;
 -        case float_infzeronan_dnan_if_qnan:
 -            return is_qnan(c_cls) ? 3 : 2;
 -        default:
 -            g_assert_not_reached();
 -        }
 -    }
 -
 -    assert(rule != float_3nan_prop_none);
 -    if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
 -        /* We have at least one SNaN input and should prefer it */
 -        do {
 -            which = rule & R_3NAN_1ST_MASK;
 -            rule >>= R_3NAN_1ST_LENGTH;
 -        } while (!is_snan(cls[which]));
 -    } else {
 -        do {
 -            which = rule & R_3NAN_1ST_MASK;
 -            rule >>= R_3NAN_1ST_LENGTH;
 -        } while (!is_nan(cls[which]));
 -    }
 -    return which;
 -}
 -
  /*----------------------------------------------------------------------------
  | Returns 1 if the double-precision floating-point value `a' is a quiet
  | NaN; otherwise returns 0.
 --
 .34.1

-[PULL 05/21] target/arm: Simplify register counting in arm_gen_dynamic_svereg_xml
+[PULL 62/72] softfloat: Use goto for default nan case in pick_nan_muladd
 From: Richard Henderson <richard.henderson@linaro.org>
-Rather than increment base_reg and num, compute num from the change
+Remove "3" as a special case for which and simply
-to base_reg at the end.  Clean up some nearby comments.
+branch to return the desired value.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241203203949.483774-4-richard.henderson@linaro.org
 Message-id: 20230227213329.793795-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/gdbstub64.c | 27 ++++++++++++++++-----------
+ fpu/softfloat-parts.c.inc | 20 ++++++++++----------
-file changed, 16 insertions(+), 11 deletions(-)
+file changed, 10 insertions(+), 10 deletions(-)
-diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub64.c
+--- a/fpu/softfloat-parts.c.inc
-+++ b/target/arm/gdbstub64.c
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width)
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
-     g_string_append(s, "</union>");
+          * But if we're not in default-NaN mode then the target must
           * specify.
           */
 -        which = 3;
 +        goto default_nan;
      } else if (infzero) {
          /*
           * Inf * 0 + NaN -- some implementations return the
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
           */
          switch (s->float_infzeronan_rule) {
          case float_infzeronan_dnan_never:
 -            which = 2;
              break;
          case float_infzeronan_dnan_always:
 -            which = 3;
 -            break;
 +            goto default_nan;
          case float_infzeronan_dnan_if_qnan:
 -            which = is_qnan(c->cls) ? 3 : 2;
 +            if (is_qnan(c->cls)) {
 +                goto default_nan;
 +            }
              break;
          default:
              g_assert_not_reached();
          }
 +        which = 2;
      } else {
          FloatClass cls[3] = { a->cls, b->cls, c->cls };
          Float3NaNPropRule rule = s->float_3nan_prop_rule;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
          }
      }
 -    if (which == 3) {
 -        parts_default_nan(a, s);
 -        return a;
 -    }
 -
      switch (which) {
      case 0:
          break;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
          parts_silence_nan(a, s);
      }
      return a;
 +
 + default_nan:
 +    parts_default_nan(a, s);
 +    return a;
  }
--int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
+ /*
 +int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
  {
      ARMCPU *cpu = ARM_CPU(cs);
      GString *s = g_string_new(NULL);
      DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
 -    int i, reg_width = (cpu->sve_max_vq * 128);
 -    info->num = 0;
 +    int reg_width = cpu->sve_max_vq * 128;
 +    int base_reg = orig_base_reg;
 +    int i;
 +
      g_string_printf(s, "<?xml version=\"1.0\"?>");
      g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
      g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 +    /* Create the vector union type. */
      output_vector_union_type(s, reg_width);
 -    /* Finally the sve prefix type */
 +    /* Create the predicate vector type. */
      g_string_append_printf(s,
                             "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
                             reg_width / 8);
 -    /* Then define each register in parts for each vq */
 +    /* Define the vector registers. */
      for (i = 0; i < 32; i++) {
          g_string_append_printf(s,
                                 "<reg name=\"z%d\" bitsize=\"%d\""
                                 " regnum=\"%d\" type=\"svev\"/>",
                                 i, reg_width, base_reg++);
 -        info->num++;
      }
 +
      /* fpscr & status registers */
      g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
                             " regnum=\"%d\" group=\"float\""
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
      g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
                             " regnum=\"%d\" group=\"float\""
                             " type=\"int\"/>", base_reg++);
 -    info->num += 2;
 +    /* Define the predicate registers. */
      for (i = 0; i < 16; i++) {
          g_string_append_printf(s,
                                 "<reg name=\"p%d\" bitsize=\"%d\""
                                 " regnum=\"%d\" type=\"svep\"/>",
                                 i, cpu->sve_max_vq * 16, base_reg++);
 -        info->num++;
      }
      g_string_append_printf(s,
                             "<reg name=\"ffr\" bitsize=\"%d\""
                             " regnum=\"%d\" group=\"vector\""
                             " type=\"svep\"/>",
                             cpu->sve_max_vq * 16, base_reg++);
 +
 +    /* Define the vector length pseudo-register. */
      g_string_append_printf(s,
                             "<reg name=\"vg\" bitsize=\"64\""
                             " regnum=\"%d\" type=\"int\"/>",
                             base_reg++);
 -    info->num += 2;
 -    g_string_append_printf(s, "</feature>");
 -    info->desc = g_string_free(s, false);
 +    g_string_append_printf(s, "</feature>");
 +
 +    info->desc = g_string_free(s, false);
 +    info->num = base_reg - orig_base_reg;
      return info->num;
  }
 --
 .34.1

-[PULL 17/21] target/arm: Diagnose incorrect usage of arm_is_secure subroutines
+[PULL 63/72] softfloat: Remove which from parts_pick_nan_muladd
 From: Richard Henderson <richard.henderson@linaro.org>
-In several places we use arm_is_secure_below_el3 and
+Assign the pointer return value to 'a' directly,
-arm_is_el3_or_mon separately from arm_is_secure.
+rather than going through an intermediary index.
 These functions make no sense for m-profile, and
 would indicate prior incorrect feature testing.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241203203949.483774-5-richard.henderson@linaro.org
 Message-id: 20230227225832.816605-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h | 5 ++++-
+ fpu/softfloat-parts.c.inc | 32 ++++++++++----------------------
-file changed, 4 insertions(+), 1 deletion(-)
+file changed, 10 insertions(+), 22 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/fpu/softfloat-parts.c.inc
-+++ b/target/arm/cpu.h
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline int arm_feature(CPUARMState *env, int feature)
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
- void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
+                                             FloatPartsN *c, float_status *s,
+                                             int ab_mask, int abc_mask)
  #if !defined(CONFIG_USER_ONLY)
 -/* Return true if exception levels below EL3 are in secure state,
 +/*
 + * Return true if exception levels below EL3 are in secure state,
   * or would be following an exception return to that level.
   * Unlike arm_is_secure() (which is always a question about the
   * _current_ state of the CPU) this doesn't care about the current
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
   */
  static inline bool arm_is_secure_below_el3(CPUARMState *env)
  {
-+    assert(!arm_feature(env, ARM_FEATURE_M));
+-    int which;
-     if (arm_feature(env, ARM_FEATURE_EL3)) {
+     bool infzero = (ab_mask == float_cmask_infzero);
-         return !(env->cp15.scr_el3 & SCR_NS);
+     bool have_snan = (abc_mask & float_cmask_snan);
 +    FloatPartsN *ret;
      if (unlikely(have_snan)) {
          float_raise(float_flag_invalid | float_flag_invalid_snan, s);
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
          default:
              g_assert_not_reached();
          }
 -        which = 2;
 +        ret = c;
      } else {
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure_below_el3(CPUARMState *env)
+-        FloatClass cls[3] = { a->cls, b->cls, c->cls };
- /* Return true if the CPU is AArch64 EL3 or AArch32 Mon */
++        FloatPartsN *val[3] = { a, b, c };
- static inline bool arm_is_el3_or_mon(CPUARMState *env)
+         Float3NaNPropRule rule = s->float_3nan_prop_rule;
- {
-+    assert(!arm_feature(env, ARM_FEATURE_M));
+         assert(rule != float_3nan_prop_none);
-     if (arm_feature(env, ARM_FEATURE_EL3)) {
+         if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
-         if (is_a64(env) && extract32(env->pstate, 2, 2) == 3) {
+             /* We have at least one SNaN input and should prefer it */
-             /* CPU currently in AArch64 state and EL3 */
+             do {
 -                which = rule & R_3NAN_1ST_MASK;
 +                ret = val[rule & R_3NAN_1ST_MASK];
                  rule >>= R_3NAN_1ST_LENGTH;
 -            } while (!is_snan(cls[which]));
 +            } while (!is_snan(ret->cls));
          } else {
              do {
 -                which = rule & R_3NAN_1ST_MASK;
 +                ret = val[rule & R_3NAN_1ST_MASK];
                  rule >>= R_3NAN_1ST_LENGTH;
 -            } while (!is_nan(cls[which]));
 +            } while (!is_nan(ret->cls));
          }
      }
 -    switch (which) {
 -    case 0:
 -        break;
 -    case 1:
 -        a = b;
 -        break;
 -    case 2:
 -        a = c;
 -        break;
 -    default:
 -        g_assert_not_reached();
 +    if (is_snan(ret->cls)) {
 +        parts_silence_nan(ret, s);
      }
 -    if (is_snan(a->cls)) {
 -        parts_silence_nan(a, s);
 -    }
 -    return a;
 +    return ret;
   default_nan:
      parts_default_nan(a, s);
 --
 .34.1

-[PULL 06/21] target/arm: Hoist pred_width in arm_gen_dynamic_svereg_xml
+[PULL 64/72] softfloat: Pad array size in pick_nan_muladd
 From: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
+While all indices into val[] should be in [0-2], the mask
 applied is two bits.  To help static analysis see there is
 no possibility of read beyond the end of the array, pad the
 array to 4 entries, with the final being (implicitly) NULL.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241203203949.483774-6-richard.henderson@linaro.org
 Message-id: 20230227213329.793795-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/gdbstub64.c | 5 +++--
+ fpu/softfloat-parts.c.inc | 2 +-
-file changed, 3 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub64.c
+--- a/fpu/softfloat-parts.c.inc
-+++ b/target/arm/gdbstub64.c
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
-     GString *s = g_string_new(NULL);
+         }
-     DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
+         ret = c;
-     int reg_width = cpu->sve_max_vq * 128;
+     } else {
-+    int pred_width = cpu->sve_max_vq * 16;
+-        FloatPartsN *val[3] = { a, b, c };
-     int base_reg = orig_base_reg;
++        FloatPartsN *val[R_3NAN_1ST_MASK + 1] = { a, b, c };
-     int i;
+         Float3NaNPropRule rule = s->float_3nan_prop_rule;
-@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
+         assert(rule != float_3nan_prop_none);
          g_string_append_printf(s,
                                 "<reg name=\"p%d\" bitsize=\"%d\""
                                 " regnum=\"%d\" type=\"svep\"/>",
 -                               i, cpu->sve_max_vq * 16, base_reg++);
 +                               i, pred_width, base_reg++);
      }
      g_string_append_printf(s,
                             "<reg name=\"ffr\" bitsize=\"%d\""
                             " regnum=\"%d\" group=\"vector\""
                             " type=\"svep\"/>",
 -                           cpu->sve_max_vq * 16, base_reg++);
 +                           pred_width, base_reg++);
      /* Define the vector length pseudo-register. */
      g_string_append_printf(s,
 --
 .34.1

-[PULL 10/21] target/arm: Create pauth_ptr_mask
+[PULL 65/72] softfloat: Move propagateFloatx80NaN to softfloat.c
 From: Richard Henderson <richard.henderson@linaro.org>
-Keep the logic for pauth within pauth_helper.c, and expose
+This function is part of the public interface and
-a helper function for use with the gdbstub pac extension.
+is not "specialized" to any target in any way.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241203203949.483774-7-richard.henderson@linaro.org
 Message-id: 20230227213329.793795-11-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h        | 10 ++++++++++
+ fpu/softfloat.c                | 52 ++++++++++++++++++++++++++++++++++
- target/arm/tcg/pauth_helper.c | 26 ++++++++++++++++++++++----
+ fpu/softfloat-specialize.c.inc | 52 ----------------------------------
-files changed, 32 insertions(+), 4 deletions(-)
+files changed, 52 insertions(+), 52 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/fpu/softfloat.c
-+++ b/target/arm/internals.h
++++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@ int exception_target_el(CPUARMState *env);
+@@ -XXX,XX +XXX,XX @@ void normalizeFloatx80Subnormal(uint64_t aSig, int32_t *zExpPtr,
- bool arm_singlestep_active(CPUARMState *env);
+     *zExpPtr = 1 - shiftCount;
- bool arm_generate_debug_exceptions(CPUARMState *env);
+ }
-+/**
++/*----------------------------------------------------------------------------
-+ * pauth_ptr_mask:
++| Takes two extended double-precision floating-point values `a' and `b', one
-+ * @env: cpu context
++| of which is a NaN, and returns the appropriate NaN result.  If either `a' or
-+ * @ptr: selects between TTBR0 and TTBR1
++| `b' is a signaling NaN, the invalid exception is raised.
-+ * @data: selects between TBI and TBID
++*----------------------------------------------------------------------------*/
 + *
 + * Return a mask of the bits of @ptr that contain the authentication code.
 + */
 +uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data);
 +
- /* Add the cpreg definitions for debug related system registers */
++floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
- void define_debug_regs(ARMCPU *cpu);
++{
++    bool aIsLargerSignificand;
-diff --git a/target/arm/tcg/pauth_helper.c b/target/arm/tcg/pauth_helper.c
++    FloatClass a_cls, b_cls;
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/pauth_helper.c
 +++ b/target/arm/tcg/pauth_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
      return pac | ext | ptr;
  }
 -static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
 +static uint64_t pauth_ptr_mask_internal(ARMVAParameters param)
  {
 -    /* Note that bit 55 is used whether or not the regime has 2 ranges. */
 -    uint64_t extfield = sextract64(ptr, 55, 1);
      int bot_pac_bit = 64 - param.tsz;
      int top_pac_bit = 64 - 8 * param.tbi;
 -    return deposit64(ptr, bot_pac_bit, top_pac_bit - bot_pac_bit, extfield);
 +    return MAKE_64BIT_MASK(bot_pac_bit, top_pac_bit - bot_pac_bit);
 +}
 +
-+static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
++    /* This is not complete, but is good enough for pickNaN.  */
-+{
++    a_cls = (!floatx80_is_any_nan(a)
-+    uint64_t mask = pauth_ptr_mask_internal(param);
++             ? float_class_normal
 +             : floatx80_is_signaling_nan(a, status)
 +             ? float_class_snan
 +             : float_class_qnan);
 +    b_cls = (!floatx80_is_any_nan(b)
 +             ? float_class_normal
 +             : floatx80_is_signaling_nan(b, status)
 +             ? float_class_snan
 +             : float_class_qnan);
 +
-+    /* Note that bit 55 is used whether or not the regime has 2 ranges. */
++    if (is_snan(a_cls) || is_snan(b_cls)) {
-+    if (extract64(ptr, 55, 1)) {
++        float_raise(float_flag_invalid, status);
-+        return ptr | mask;
++    }
 +
 +    if (status->default_nan_mode) {
 +        return floatx80_default_nan(status);
 +    }
 +
 +    if (a.low < b.low) {
 +        aIsLargerSignificand = 0;
 +    } else if (b.low < a.low) {
 +        aIsLargerSignificand = 1;
 +    } else {
-+        return ptr & ~mask;
++        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
 +    }
 +
 +    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
 +        if (is_snan(b_cls)) {
 +            return floatx80_silence_nan(b, status);
 +        }
 +        return b;
 +    } else {
 +        if (is_snan(a_cls)) {
 +            return floatx80_silence_nan(a, status);
 +        }
 +        return a;
 +    }
 +}
 +
-+uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data)
+ /*----------------------------------------------------------------------------
-+{
+ | Takes an abstract floating-point value having sign `zSign', exponent `zExp',
-+    ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
+ | and extended significand formed by the concatenation of `zSig0' and `zSig1',
-+    ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
+diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
-+
+index XXXXXXX..XXXXXXX 100644
-+    return pauth_ptr_mask_internal(param);
+--- a/fpu/softfloat-specialize.c.inc
 +++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ floatx80 floatx80_silence_nan(floatx80 a, float_status *status)
      return a;
  }
- static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
+-/*----------------------------------------------------------------------------
 -| Takes two extended double-precision floating-point values `a' and `b', one
 -| of which is a NaN, and returns the appropriate NaN result.  If either `a' or
 -| `b' is a signaling NaN, the invalid exception is raised.
 -*----------------------------------------------------------------------------*/
 -
 -floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
 -{
 -    bool aIsLargerSignificand;
 -    FloatClass a_cls, b_cls;
 -
 -    /* This is not complete, but is good enough for pickNaN.  */
 -    a_cls = (!floatx80_is_any_nan(a)
 -             ? float_class_normal
 -             : floatx80_is_signaling_nan(a, status)
 -             ? float_class_snan
 -             : float_class_qnan);
 -    b_cls = (!floatx80_is_any_nan(b)
 -             ? float_class_normal
 -             : floatx80_is_signaling_nan(b, status)
 -             ? float_class_snan
 -             : float_class_qnan);
 -
 -    if (is_snan(a_cls) || is_snan(b_cls)) {
 -        float_raise(float_flag_invalid, status);
 -    }
 -
 -    if (status->default_nan_mode) {
 -        return floatx80_default_nan(status);
 -    }
 -
 -    if (a.low < b.low) {
 -        aIsLargerSignificand = 0;
 -    } else if (b.low < a.low) {
 -        aIsLargerSignificand = 1;
 -    } else {
 -        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
 -    }
 -
 -    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
 -        if (is_snan(b_cls)) {
 -            return floatx80_silence_nan(b, status);
 -        }
 -        return b;
 -    } else {
 -        if (is_snan(a_cls)) {
 -            return floatx80_silence_nan(a, status);
 -        }
 -        return a;
 -    }
 -}
 -
  /*----------------------------------------------------------------------------
  | Returns 1 if the quadruple-precision floating-point value `a' is a quiet
  | NaN; otherwise returns 0.
 --
 .34.1

-[PULL 04/21] target/arm: Split out output_vector_union_type
+[PULL 66/72] softfloat: Use parts_pick_nan in propagateFloatx80NaN
 From: Richard Henderson <richard.henderson@linaro.org>
-Create a subroutine for creating the union of unions
+Unpacking and repacking the parts may be slightly more work
-of the various type sizes that a vector may contain.
+than we did before, but we get to reuse more code.  For a
 code path handling exceptional values, this is an improvement.
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20241203203949.483774-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230227213329.793795-5-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/gdbstub64.c | 83 +++++++++++++++++++++++-------------------
+ fpu/softfloat.c | 43 +++++--------------------------------------
-file changed, 45 insertions(+), 38 deletions(-)
+file changed, 5 insertions(+), 38 deletions(-)
-diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
+diff --git a/fpu/softfloat.c b/fpu/softfloat.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub64.c
+--- a/fpu/softfloat.c
-+++ b/target/arm/gdbstub64.c
++++ b/fpu/softfloat.c
-@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
+@@ -XXX,XX +XXX,XX @@ void normalizeFloatx80Subnormal(uint64_t aSig, int32_t *zExpPtr,
-     return 0;
  floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
  {
 -    bool aIsLargerSignificand;
 -    FloatClass a_cls, b_cls;
 +    FloatParts128 pa, pb, *pr;
 -    /* This is not complete, but is good enough for pickNaN.  */
 -    a_cls = (!floatx80_is_any_nan(a)
 -             ? float_class_normal
 -             : floatx80_is_signaling_nan(a, status)
 -             ? float_class_snan
 -             : float_class_qnan);
 -    b_cls = (!floatx80_is_any_nan(b)
 -             ? float_class_normal
 -             : floatx80_is_signaling_nan(b, status)
 -             ? float_class_snan
 -             : float_class_qnan);
 -
 -    if (is_snan(a_cls) || is_snan(b_cls)) {
 -        float_raise(float_flag_invalid, status);
 -    }
 -
 -    if (status->default_nan_mode) {
 +    if (!floatx80_unpack_canonical(&pa, a, status) ||
 +        !floatx80_unpack_canonical(&pb, b, status)) {
          return floatx80_default_nan(status);
      }
 -    if (a.low < b.low) {
 -        aIsLargerSignificand = 0;
 -    } else if (b.low < a.low) {
 -        aIsLargerSignificand = 1;
 -    } else {
 -        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
 -    }
 -
 -    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
 -        if (is_snan(b_cls)) {
 -            return floatx80_silence_nan(b, status);
 -        }
 -        return b;
 -    } else {
 -        if (is_snan(a_cls)) {
 -            return floatx80_silence_nan(a, status);
 -        }
 -        return a;
 -    }
 +    pr = parts_pick_nan(&pa, &pb, status);
 +    return floatx80_round_pack_canonical(pr, status);
  }
--struct TypeSize {
+ /*----------------------------------------------------------------------------
 -    const char *gdb_type;
 -    short size;
 -    char sz, suffix;
 -};
 -
 -static const struct TypeSize vec_lanes[] = {
 -    /* quads */
 -    { "uint128", 128, 'q', 'u' },
 -    { "int128", 128, 'q', 's' },
 -    /* 64 bit */
 -    { "ieee_double", 64, 'd', 'f' },
 -    { "uint64", 64, 'd', 'u' },
 -    { "int64", 64, 'd', 's' },
 -    /* 32 bit */
 -    { "ieee_single", 32, 's', 'f' },
 -    { "uint32", 32, 's', 'u' },
 -    { "int32", 32, 's', 's' },
 -    /* 16 bit */
 -    { "ieee_half", 16, 'h', 'f' },
 -    { "uint16", 16, 'h', 'u' },
 -    { "int16", 16, 'h', 's' },
 -    /* bytes */
 -    { "uint8", 8, 'b', 'u' },
 -    { "int8", 8, 'b', 's' },
 -};
 -
 -int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
 +static void output_vector_union_type(GString *s, int reg_width)
  {
 -    ARMCPU *cpu = ARM_CPU(cs);
 -    GString *s = g_string_new(NULL);
 -    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
 +    struct TypeSize {
 +        const char *gdb_type;
 +        short size;
 +        char sz, suffix;
 +    };
 +
 +    static const struct TypeSize vec_lanes[] = {
 +        /* quads */
 +        { "uint128", 128, 'q', 'u' },
 +        { "int128", 128, 'q', 's' },
 +        /* 64 bit */
 +        { "ieee_double", 64, 'd', 'f' },
 +        { "uint64", 64, 'd', 'u' },
 +        { "int64", 64, 'd', 's' },
 +        /* 32 bit */
 +        { "ieee_single", 32, 's', 'f' },
 +        { "uint32", 32, 's', 'u' },
 +        { "int32", 32, 's', 's' },
 +        /* 16 bit */
 +        { "ieee_half", 16, 'h', 'f' },
 +        { "uint16", 16, 'h', 'u' },
 +        { "int16", 16, 'h', 's' },
 +        /* bytes */
 +        { "uint8", 8, 'b', 'u' },
 +        { "int8", 8, 'b', 's' },
 +    };
 +
 +    static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
 +
      g_autoptr(GString) ts = g_string_new("");
 -    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
 -    info->num = 0;
 -    g_string_printf(s, "<?xml version=\"1.0\"?>");
 -    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
 -    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 +    int i, j, bits;
      /* First define types and totals in a whole VL */
      for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
       * 8 bits.
       */
      for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 -        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
          g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
          for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
              if (vec_lanes[j].size == bits) {
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
      /* And now the final union of unions */
      g_string_append(s, "<union id=\"svev\">");
      for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 -        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
          g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
                                 suf[i], suf[i]);
      }
      g_string_append(s, "</union>");
 +}
 +
 +int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
 +{
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    GString *s = g_string_new(NULL);
 +    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
 +    int i, reg_width = (cpu->sve_max_vq * 128);
 +    info->num = 0;
 +    g_string_printf(s, "<?xml version=\"1.0\"?>");
 +    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
 +    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 +
 +    output_vector_union_type(s, reg_width);
      /* Finally the sve prefix type */
      g_string_append_printf(s,
 --
 .34.1

-[PULL 13/21] target/arm: Export arm_v7m_get_sp_ptr
+[PULL 67/72] softfloat: Inline pickNaN
-From: David Reiss <dreiss@meta.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Allow the function to be used outside of m_helper.c.
+Inline pickNaN into its only caller.  This makes one assert
-Move to be outside of ifndef CONFIG_USER_ONLY block.
+redundant with the immediately preceding IF.
-Rename from get_v7m_sp_ptr.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: David Reiss <dreiss@meta.com>
+Message-id: 20241203203949.483774-9-richard.henderson@linaro.org
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230227213329.793795-14-richard.henderson@linaro.org
 [rth: Split out of a larger patch]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h    | 10 +++++
+ fpu/softfloat-parts.c.inc      | 82 +++++++++++++++++++++++++----
- target/arm/tcg/m_helper.c | 84 +++++++++++++++++++--------------------
+ fpu/softfloat-specialize.c.inc | 96 ----------------------------------
-files changed, 51 insertions(+), 43 deletions(-)
+files changed, 73 insertions(+), 105 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/fpu/softfloat-parts.c.inc
-+++ b/target/arm/internals.h
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
+@@ -XXX,XX +XXX,XX @@ static void partsN(return_nan)(FloatPartsN *a, float_status *s)
- /* Read the CONTROL register as the MRS instruction would. */
+ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
- uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);
+                                      float_status *s)
+ {
-+/*
++    int cmp, which;
 + * Return a pointer to the location where we currently store the
 + * stack pointer for the requested security state and thread mode.
 + * This pointer will become invalid if the CPU state is updated
 + * such that the stack pointers are switched around (eg changing
 + * the SPSEL control bit).
 + */
 +uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure,
 +                             bool threadmode, bool spsel);
 +
- #ifdef CONFIG_USER_ONLY
+     if (is_snan(a->cls) || is_snan(b->cls)) {
- static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
+         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
- #else
+     }
-diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
      if (s->default_nan_mode) {
          parts_default_nan(a, s);
 -    } else {
 -        int cmp = frac_cmp(a, b);
 -        if (cmp == 0) {
 -            cmp = a->sign < b->sign;
 -        }
 +        return a;
 +    }
 -        if (pickNaN(a->cls, b->cls, cmp > 0, s)) {
 -            a = b;
 -        }
 +    cmp = frac_cmp(a, b);
 +    if (cmp == 0) {
 +        cmp = a->sign < b->sign;
 +    }
 +
 +    switch (s->float_2nan_prop_rule) {
 +    case float_2nan_prop_s_ab:
          if (is_snan(a->cls)) {
 -            parts_silence_nan(a, s);
 +            which = 0;
 +        } else if (is_snan(b->cls)) {
 +            which = 1;
 +        } else if (is_qnan(a->cls)) {
 +            which = 0;
 +        } else {
 +            which = 1;
          }
 +        break;
 +    case float_2nan_prop_s_ba:
 +        if (is_snan(b->cls)) {
 +            which = 1;
 +        } else if (is_snan(a->cls)) {
 +            which = 0;
 +        } else if (is_qnan(b->cls)) {
 +            which = 1;
 +        } else {
 +            which = 0;
 +        }
 +        break;
 +    case float_2nan_prop_ab:
 +        which = is_nan(a->cls) ? 0 : 1;
 +        break;
 +    case float_2nan_prop_ba:
 +        which = is_nan(b->cls) ? 1 : 0;
 +        break;
 +    case float_2nan_prop_x87:
 +        /*
 +         * This implements x87 NaN propagation rules:
 +         * SNaN + QNaN => return the QNaN
 +         * two SNaNs => return the one with the larger significand, silenced
 +         * two QNaNs => return the one with the larger significand
 +         * SNaN and a non-NaN => return the SNaN, silenced
 +         * QNaN and a non-NaN => return the QNaN
 +         *
 +         * If we get down to comparing significands and they are the same,
 +         * return the NaN with the positive sign bit (if any).
 +         */
 +        if (is_snan(a->cls)) {
 +            if (is_snan(b->cls)) {
 +                which = cmp > 0 ? 0 : 1;
 +            } else {
 +                which = is_qnan(b->cls) ? 1 : 0;
 +            }
 +        } else if (is_qnan(a->cls)) {
 +            if (is_snan(b->cls) || !is_qnan(b->cls)) {
 +                which = 0;
 +            } else {
 +                which = cmp > 0 ? 0 : 1;
 +            }
 +        } else {
 +            which = 1;
 +        }
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    }
 +
 +    if (which) {
 +        a = b;
 +    }
 +    if (is_snan(a->cls)) {
 +        parts_silence_nan(a, s);
      }
      return a;
  }
 diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/tcg/m_helper.c
+--- a/fpu/softfloat-specialize.c.inc
-+++ b/target/arm/tcg/m_helper.c
++++ b/fpu/softfloat-specialize.c.inc
-@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
+@@ -XXX,XX +XXX,XX @@ bool float32_is_signaling_nan(float32 a_, float_status *status)
-     arm_rebuild_hflags(env);
+     }
  }
--static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
+-/*----------------------------------------------------------------------------
--                                bool spsel)
+-| Select which NaN to propagate for a two-input operation.
 -| IEEE754 doesn't specify all the details of this, so the
 -| algorithm is target-specific.
 -| The routine is passed various bits of information about the
 -| two NaNs and should return 0 to select NaN a and 1 for NaN b.
 -| Note that signalling NaNs are always squashed to quiet NaNs
 -| by the caller, by calling floatXX_silence_nan() before
 -| returning them.
 -|
 -| aIsLargerSignificand is only valid if both a and b are NaNs
 -| of some kind, and is true if a has the larger significand,
 -| or if both a and b have the same significand but a is
 -| positive but b is negative. It is only needed for the x87
 -| tie-break rule.
 -*----------------------------------------------------------------------------*/
 -
 -static int pickNaN(FloatClass a_cls, FloatClass b_cls,
 -                   bool aIsLargerSignificand, float_status *status)
 -{
 -    /*
--     * Return a pointer to the location where we currently store the
+-     * We guarantee not to require the target to tell us how to
--     * stack pointer for the requested security state and thread mode.
+-     * pick a NaN if we're always returning the default NaN.
--     * This pointer will become invalid if the CPU state is updated
+-     * But if we're not in default-NaN mode then the target must
--     * such that the stack pointers are switched around (eg changing
+-     * specify via set_float_2nan_prop_rule().
 -     * the SPSEL control bit).
 -     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
 -     * Unlike that pseudocode, we require the caller to pass us in the
 -     * SPSEL control bit value; this is because we also use this
 -     * function in handling of pushing of the callee-saves registers
 -     * part of the v8M stack frame (pseudocode PushCalleeStack()),
 -     * and in the tailchain codepath the SPSEL bit comes from the exception
 -     * return magic LR value from the previous exception. The pseudocode
 -     * opencodes the stack-selection in PushCalleeStack(), but we prefer
 -     * to make this utility function generic enough to do the job.
 -     */
--    bool want_psp = threadmode && spsel;
+-    assert(!status->default_nan_mode);
 -
--    if (secure == env->v7m.secure) {
+-    switch (status->float_2nan_prop_rule) {
--        if (want_psp == v7m_using_psp(env)) {
+-    case float_2nan_prop_s_ab:
--            return &env->regs[13];
+-        if (is_snan(a_cls)) {
--        } else {
+-            return 0;
--            return &env->v7m.other_sp;
+-        } else if (is_snan(b_cls)) {
--        }
+-            return 1;
--    } else {
+-        } else if (is_qnan(a_cls)) {
--        if (want_psp) {
+-            return 0;
--            return &env->v7m.other_ss_psp;
+-        } else {
--        } else {
+-            return 1;
--            return &env->v7m.other_ss_msp;
+-        }
--        }
+-        break;
 -    case float_2nan_prop_s_ba:
 -        if (is_snan(b_cls)) {
 -            return 1;
 -        } else if (is_snan(a_cls)) {
 -            return 0;
 -        } else if (is_qnan(b_cls)) {
 -            return 1;
 -        } else {
 -            return 0;
 -        }
 -        break;
 -    case float_2nan_prop_ab:
 -        if (is_nan(a_cls)) {
 -            return 0;
 -        } else {
 -            return 1;
 -        }
 -        break;
 -    case float_2nan_prop_ba:
 -        if (is_nan(b_cls)) {
 -            return 1;
 -        } else {
 -            return 0;
 -        }
 -        break;
 -    case float_2nan_prop_x87:
 -        /*
 -         * This implements x87 NaN propagation rules:
 -         * SNaN + QNaN => return the QNaN
 -         * two SNaNs => return the one with the larger significand, silenced
 -         * two QNaNs => return the one with the larger significand
 -         * SNaN and a non-NaN => return the SNaN, silenced
 -         * QNaN and a non-NaN => return the QNaN
 -         *
 -         * If we get down to comparing significands and they are the same,
 -         * return the NaN with the positive sign bit (if any).
 -         */
 -        if (is_snan(a_cls)) {
 -            if (is_snan(b_cls)) {
 -                return aIsLargerSignificand ? 0 : 1;
 -            }
 -            return is_qnan(b_cls) ? 1 : 0;
 -        } else if (is_qnan(a_cls)) {
 -            if (is_snan(b_cls) || !is_qnan(b_cls)) {
 -                return 0;
 -            } else {
 -                return aIsLargerSignificand ? 0 : 1;
 -            }
 -        } else {
 -            return 1;
 -        }
 -    default:
 -        g_assert_not_reached();
 -    }
 -}
 -
- static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
+ /*----------------------------------------------------------------------------
-                                 uint32_t *pvec)
+ | Returns 1 if the double-precision floating-point value `a' is a quiet
- {
+ | NaN; otherwise returns 0.
@@ -XXX,XX +XXX,XX @@ static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
              !mode;
          mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
 -        frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,
 -                                    lr & R_V7M_EXCRET_SPSEL_MASK);
 +        frame_sp_p = arm_v7m_get_sp_ptr(env, M_REG_S, mode,
 +                                        lr & R_V7M_EXCRET_SPSEL_MASK);
          want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
          if (want_psp) {
              limit = env->v7m.psplim[M_REG_S];
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
           * use 'frame_sp_p' after we do something that makes it invalid.
           */
          bool spsel = env->v7m.control[return_to_secure] & R_V7M_CONTROL_SPSEL_MASK;
 -        uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
 -                                              return_to_secure,
 -                                              !return_to_handler,
 -                                              spsel);
 +        uint32_t *frame_sp_p = arm_v7m_get_sp_ptr(env, return_to_secure,
 +                                                  !return_to_handler, spsel);
          uint32_t frameptr = *frame_sp_p;
          bool pop_ok = true;
          ARMMMUIdx mmu_idx;
@@ -XXX,XX +XXX,XX @@ static bool do_v7m_function_return(ARMCPU *cpu)
          threadmode = !arm_v7m_is_handler_mode(env);
          spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
 -        frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
 +        frame_sp_p = arm_v7m_get_sp_ptr(env, true, threadmode, spsel);
          frameptr = *frame_sp_p;
          /*
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
  }
  #endif /* !CONFIG_USER_ONLY */
 +
 +uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
 +                             bool spsel)
 +{
 +    /*
 +     * Return a pointer to the location where we currently store the
 +     * stack pointer for the requested security state and thread mode.
 +     * This pointer will become invalid if the CPU state is updated
 +     * such that the stack pointers are switched around (eg changing
 +     * the SPSEL control bit).
 +     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
 +     * Unlike that pseudocode, we require the caller to pass us in the
 +     * SPSEL control bit value; this is because we also use this
 +     * function in handling of pushing of the callee-saves registers
 +     * part of the v8M stack frame (pseudocode PushCalleeStack()),
 +     * and in the tailchain codepath the SPSEL bit comes from the exception
 +     * return magic LR value from the previous exception. The pseudocode
 +     * opencodes the stack-selection in PushCalleeStack(), but we prefer
 +     * to make this utility function generic enough to do the job.
 +     */
 +    bool want_psp = threadmode && spsel;
 +
 +    if (secure == env->v7m.secure) {
 +        if (want_psp == v7m_using_psp(env)) {
 +            return &env->regs[13];
 +        } else {
 +            return &env->v7m.other_sp;
 +        }
 +    } else {
 +        if (want_psp) {
 +            return &env->v7m.other_ss_psp;
 +        } else {
 +            return &env->v7m.other_ss_msp;
 +        }
 +    }
 +}
 --
 .34.1

-[PULL 15/21] target/arm: Handle m-profile in arm_is_secure
+[PULL 68/72] softfloat: Share code between parts_pick_nan cases
 From: Richard Henderson <richard.henderson@linaro.org>
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1421
+Remember if there was an SNaN, and use that to simplify
 float_2nan_prop_s_{ab,ba} to only the snan component.
 Then, fall through to the corresponding
 float_2nan_prop_{ab,ba} case to handle any remaining
 nans, which must be quiet.
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241203203949.483774-10-richard.henderson@linaro.org
 Message-id: 20230227225832.816605-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h | 3 +++
+ fpu/softfloat-parts.c.inc | 32 ++++++++++++--------------------
-file changed, 3 insertions(+)
+file changed, 12 insertions(+), 20 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/fpu/softfloat-parts.c.inc
-+++ b/target/arm/cpu.h
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_el3_or_mon(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static void partsN(return_nan)(FloatPartsN *a, float_status *s)
- /* Return true if the processor is in secure state */
+ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
- static inline bool arm_is_secure(CPUARMState *env)
+                                      float_status *s)
  {
-+    if (arm_feature(env, ARM_FEATURE_M)) {
++    bool have_snan = false;
-+        return env->v7m.secure;
+     int cmp, which;
-+    }
-     if (arm_is_el3_or_mon(env)) {
+     if (is_snan(a->cls) || is_snan(b->cls)) {
-         return true;
+         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
 +        have_snan = true;
      }
+     if (s->default_nan_mode) {
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
+     switch (s->float_2nan_prop_rule) {
+     case float_2nan_prop_s_ab:
+-        if (is_snan(a->cls)) {
+-            which = 0;
+-        } else if (is_snan(b->cls)) {
+-            which = 1;
+-        } else if (is_qnan(a->cls)) {
+-            which = 0;
+-        } else {
+-            which = 1;
++        if (have_snan) {
++            which = is_snan(a->cls) ? 0 : 1;
++            break;
+         }
+-        break;
+-    case float_2nan_prop_s_ba:
+-        if (is_snan(b->cls)) {
+-            which = 1;
+-        } else if (is_snan(a->cls)) {
+-            which = 0;
+-        } else if (is_qnan(b->cls)) {
+-            which = 1;
+-        } else {
+-            which = 0;
+-        }
+-        break;
++        /* fall through */
+     case float_2nan_prop_ab:
+         which = is_nan(a->cls) ? 0 : 1;
+         break;
++    case float_2nan_prop_s_ba:
++        if (have_snan) {
++            which = is_snan(b->cls) ? 1 : 0;
++            break;
++        }
++        /* fall through */
+     case float_2nan_prop_ba:
+         which = is_nan(b->cls) ? 1 : 0;
+         break;
 --
 .34.1

-[PULL 18/21] target/arm: Rewrite check_s2_mmu_setup
+[PULL 69/72] softfloat: Sink frac_cmp in parts_pick_nan until needed
 From: Richard Henderson <richard.henderson@linaro.org>
-Integrate neighboring code from get_phys_addr_lpae which computed
+Move the fractional comparison to the end of the
-starting level, as it is easier to validate when doing both at the
+float_2nan_prop_x87 case.  This is not required for
-same time.  Mirror the checks at the start of AArch{64,32}.S2Walk,
+any other 2nan propagation rule.  Reorganize the
-especially S2InvalidSL and S2InconsistentSL.
+x87 case itself to break out of the switch when the
 fractional comparison is not required.
-This reverts 49ba115bb74, which was incorrect -- there is nothing
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 in the ARM pseudocode that depends on TxSZ, i.e. outputsize; the
 pseudocode is consistent in referencing PAMax.
 Fixes: 49ba115bb74 ("target/arm: Pass outputsize down to check_s2_mmu_setup")
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241203203949.483774-11-richard.henderson@linaro.org
 Message-id: 20230227225832.816605-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/ptw.c | 173 ++++++++++++++++++++++++++---------------------
+ fpu/softfloat-parts.c.inc | 19 +++++++++----------
-file changed, 97 insertions(+), 76 deletions(-)
+file changed, 9 insertions(+), 10 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
+--- a/fpu/softfloat-parts.c.inc
-+++ b/target/arm/ptw.c
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
-  * check_s2_mmu_setup
+         return a;
-  * @cpu:        ARMCPU
+     }
-  * @is_aa64:    True if the translation regime is in AArch64 state
-- * @startlevel: Suggested starting level
+-    cmp = frac_cmp(a, b);
-- * @inputsize:  Bitsize of IPAs
+-    if (cmp == 0) {
-+ * @tcr:        VTCR_EL2 or VSTCR_EL2
+-        cmp = a->sign < b->sign;
 + * @ds:         Effective value of TCR.DS.
 + * @iasize:     Bitsize of IPAs
   * @stride:     Page-table stride (See the ARM ARM)
   *
 - * Returns true if the suggested S2 translation parameters are OK and
 - * false otherwise.
 + * Decode the starting level of the S2 lookup, returning INT_MIN if
 + * the configuration is invalid.
   */
 -static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
 -                               int inputsize, int stride, int outputsize)
 +static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
 +                              bool ds, int iasize, int stride)
  {
 -    const int grainsize = stride + 3;
 -    int startsizecheck;
 -
 -    /*
 -     * Negative levels are usually not allowed...
 -     * Except for FEAT_LPA2, 4k page table, 52-bit address space, which
 -     * begins with level -1.  Note that previous feature tests will have
 -     * eliminated this combination if it is not enabled.
 -     */
 -    if (level < (inputsize == 52 && stride == 9 ? -1 : 0)) {
 -        return false;
 -    }
 -
--    startsizecheck = inputsize - ((3 - level) * stride + grainsize);
+     switch (s->float_2nan_prop_rule) {
--    if (startsizecheck < 1 || startsizecheck > stride + 4) {
+     case float_2nan_prop_s_ab:
--        return false;
+         if (have_snan) {
--    }
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
-+    int sl0, sl2, startlevel, granulebits, levels;
+          * return the NaN with the positive sign bit (if any).
-+    int s1_min_iasize, s1_max_iasize;
+          */
+         if (is_snan(a->cls)) {
-+    sl0 = extract32(tcr, 6, 2);
+-            if (is_snan(b->cls)) {
-     if (is_aa64) {
+-                which = cmp > 0 ? 0 : 1;
-+        /*
+-            } else {
-+         * AArch64.S2InvalidTxSZ: While we checked tsz_oob near the top of
++            if (!is_snan(b->cls)) {
-+         * get_phys_addr_lpae, that used aa64_va_parameters which apply
+                 which = is_qnan(b->cls) ? 1 : 0;
 +         * to aarch64.  If Stage1 is aarch32, the min_txsz is larger.
 +         * See AArch64.S2MinTxSZ, where min_tsz is 24, translated to
 +         * inputsize is 64 - 24 = 40.
 +         */
 +        if (iasize < 40 && !arm_el_is_aa64(&cpu->env, 1)) {
 +            goto fail;
 +        }
 +
 +        /*
 +         * AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
 +         * so interleave AArch64.S2StartLevel.
 +         */
          switch (stride) {
 -        case 13: /* 64KB Pages.  */
 -            if (level == 0 || (level == 1 && outputsize <= 42)) {
 -                return false;
 +        case 9: /* 4KB */
 +            /* SL2 is RES0 unless DS=1 & 4KB granule. */
 +            sl2 = extract64(tcr, 33, 1);
 +            if (ds && sl2) {
 +                if (sl0 != 0) {
 +                    goto fail;
 +                }
 +                startlevel = -1;
 +            } else {
 +                startlevel = 2 - sl0;
 +                switch (sl0) {
 +                case 2:
 +                    if (arm_pamax(cpu) < 44) {
 +                        goto fail;
 +                    }
 +                    break;
 +                case 3:
 +                    if (!cpu_isar_feature(aa64_st, cpu)) {
 +                        goto fail;
 +                    }
 +                    startlevel = 3;
 +                    break;
 +                }
              }
              break;
 -        case 11: /* 16KB Pages.  */
 -            if (level == 0 || (level == 1 && outputsize <= 40)) {
 -                return false;
 +        case 11: /* 16KB */
 +            switch (sl0) {
 +            case 2:
 +                if (arm_pamax(cpu) < 42) {
 +                    goto fail;
 +                }
 +                break;
 +            case 3:
 +                if (!ds) {
 +                    goto fail;
 +                }
 +                break;
              }
-+            startlevel = 3 - sl0;
+         } else if (is_qnan(a->cls)) {
-             break;
+             if (is_snan(b->cls) || !is_qnan(b->cls)) {
--        case 9: /* 4KB Pages.  */
+                 which = 0;
--            if (level == 0 && outputsize <= 42) {
+-            } else {
--                return false;
+-                which = cmp > 0 ? 0 : 1;
 +        case 13: /* 64KB */
 +            switch (sl0) {
 +            case 2:
 +                if (arm_pamax(cpu) < 44) {
 +                    goto fail;
 +                }
 +                break;
-+            case 3:
-+                goto fail;
              }
-+            startlevel = 3 - sl0;
+         } else {
-             break;
+             which = 1;
-         default:
++            break;
              g_assert_not_reached();
          }
--
++        cmp = frac_cmp(a, b);
--        /* Inputsize checks.  */
++        if (cmp == 0) {
--        if (inputsize > outputsize &&
++            cmp = a->sign < b->sign;
--            (arm_el_is_aa64(&cpu->env, 1) || inputsize > 40)) {
++        }
--            /* This is CONSTRAINED UNPREDICTABLE and we choose to fault.  */
++        which = cmp > 0 ? 0 : 1;
--            return false;
+         break;
--        }
+     default:
-     } else {
+         g_assert_not_reached();
 -        /* AArch32 only supports 4KB pages. Assert on that.  */
 +        /*
 +         * Things are simpler for AArch32 EL2, with only 4k pages.
 +         * There is no separate S2InvalidSL function, but AArch32.S2Walk
 +         * begins with walkparms.sl0 in {'1x'}.
 +         */
          assert(stride == 9);
 -
 -        if (level == 0) {
 -            return false;
 +        if (sl0 >= 2) {
 +            goto fail;
          }
 +        startlevel = 2 - sl0;
      }
 -    return true;
 +
 +    /* AArch{64,32}.S2InconsistentSL are functionally equivalent.  */
 +    levels = 3 - startlevel;
 +    granulebits = stride + 3;
 +
 +    s1_min_iasize = levels * stride + granulebits + 1;
 +    s1_max_iasize = s1_min_iasize + (stride - 1) + 4;
 +
 +    if (iasize >= s1_min_iasize && iasize <= s1_max_iasize) {
 +        return startlevel;
 +    }
 +
 + fail:
 +    return INT_MIN;
  }
  /**
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
           */
          level = 4 - (inputsize - 4) / stride;
      } else {
 -        /*
 -         * For stage 2 translations the starting level is specified by the
 -         * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
 -         */
 -        uint32_t sl0 = extract32(tcr, 6, 2);
 -        uint32_t sl2 = extract64(tcr, 33, 1);
 -        int32_t startlevel;
 -        bool ok;
 -
 -        /* SL2 is RES0 unless DS=1 & 4kb granule. */
 -        if (param.ds && stride == 9 && sl2) {
 -            if (sl0 != 0) {
 -                level = 0;
 -                goto do_translation_fault;
 -            }
 -            startlevel = -1;
 -        } else if (!aarch64 || stride == 9) {
 -            /* AArch32 or 4KB pages */
 -            startlevel = 2 - sl0;
 -
 -            if (cpu_isar_feature(aa64_st, cpu)) {
 -                startlevel &= 3;
 -            }
 -        } else {
 -            /* 16KB or 64KB pages */
 -            startlevel = 3 - sl0;
 -        }
 -
 -        /* Check that the starting level is valid. */
 -        ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
 -                                inputsize, stride, outputsize);
 -        if (!ok) {
 +        int startlevel = check_s2_mmu_setup(cpu, aarch64, tcr, param.ds,
 +                                            inputsize, stride);
 +        if (startlevel == INT_MIN) {
 +            level = 0;
              goto do_translation_fault;
          }
          level = startlevel;
 --
 .34.1

-[PULL 03/21] target/arm: Move arm_gen_dynamic_svereg_xml to gdbstub64.c
+[PULL 70/72] softfloat: Replace WHICH with RET in parts_pick_nan
 From: Richard Henderson <richard.henderson@linaro.org>
-The function is only used for aarch64, so move it to the
+Replace the "index" selecting between A and B with a result variable
-file that has the other aarch64 gdbstub stuff.  Move the
+of the proper type.  This improves clarity within the function.
 declaration to internals.h.
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241203203949.483774-12-richard.henderson@linaro.org
 Message-id: 20230227213329.793795-4-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h       |   6 ---
+ fpu/softfloat-parts.c.inc | 28 +++++++++++++---------------
- target/arm/internals.h |   1 +
+file changed, 13 insertions(+), 15 deletions(-)
  target/arm/gdbstub.c   | 120 -----------------------------------------
  target/arm/gdbstub64.c | 118 ++++++++++++++++++++++++++++++++++++++++
 files changed, 119 insertions(+), 126 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/fpu/softfloat-parts.c.inc
-+++ b/target/arm/cpu.h
++++ b/fpu/softfloat-parts.c.inc
-@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
- int arm_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
+                                      float_status *s)
- int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
+ {
+     bool have_snan = false;
--/*
+-    int cmp, which;
-- * Helpers to dynamically generates XML descriptions of the sysregs
++    FloatPartsN *ret;
-- * and SVE registers. Returns the number of registers in each set.
++    int cmp;
-- */
--int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
+     if (is_snan(a->cls) || is_snan(b->cls)) {
--
+         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
- /* Returns the dynamically generated XML for the gdb stub.
+@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
-  * Returns a pointer to the XML contents for the specified XML file or NULL
+     switch (s->float_2nan_prop_rule) {
-  * if the XML name doesn't match the predefined one.
+     case float_2nan_prop_s_ab:
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+         if (have_snan) {
-index XXXXXXX..XXXXXXX 100644
+-            which = is_snan(a->cls) ? 0 : 1;
---- a/target/arm/internals.h
++            ret = is_snan(a->cls) ? a : b;
-+++ b/target/arm/internals.h
+             break;
-@@ -XXX,XX +XXX,XX @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
+         }
          /* fall through */
      case float_2nan_prop_ab:
 -        which = is_nan(a->cls) ? 0 : 1;
 +        ret = is_nan(a->cls) ? a : b;
          break;
      case float_2nan_prop_s_ba:
          if (have_snan) {
 -            which = is_snan(b->cls) ? 1 : 0;
 +            ret = is_snan(b->cls) ? b : a;
              break;
          }
          /* fall through */
      case float_2nan_prop_ba:
 -        which = is_nan(b->cls) ? 1 : 0;
 +        ret = is_nan(b->cls) ? b : a;
          break;
      case float_2nan_prop_x87:
          /*
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
           */
          if (is_snan(a->cls)) {
              if (!is_snan(b->cls)) {
 -                which = is_qnan(b->cls) ? 1 : 0;
 +                ret = is_qnan(b->cls) ? b : a;
                  break;
              }
          } else if (is_qnan(a->cls)) {
              if (is_snan(b->cls) || !is_qnan(b->cls)) {
 -                which = 0;
 +                ret = a;
                  break;
              }
          } else {
 -            which = 1;
 +            ret = b;
              break;
          }
          cmp = frac_cmp(a, b);
          if (cmp == 0) {
              cmp = a->sign < b->sign;
          }
 -        which = cmp > 0 ? 0 : 1;
 +        ret = cmp > 0 ? a : b;
          break;
      default:
          g_assert_not_reached();
      }
 -    if (which) {
 -        a = b;
 +    if (is_snan(ret->cls)) {
 +        parts_silence_nan(ret, s);
      }
 -    if (is_snan(a->cls)) {
 -        parts_silence_nan(a, s);
 -    }
 -    return a;
 +    return ret;
  }
- #ifdef TARGET_AARCH64
+ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
 +int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
  int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
  int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
  int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
 diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub.c
 +++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
      return cpu->dyn_sysreg_xml.num;
  }
 -struct TypeSize {
 -    const char *gdb_type;
 -    int  size;
 -    const char sz, suffix;
 -};
 -
 -static const struct TypeSize vec_lanes[] = {
 -    /* quads */
 -    { "uint128", 128, 'q', 'u' },
 -    { "int128", 128, 'q', 's' },
 -    /* 64 bit */
 -    { "ieee_double", 64, 'd', 'f' },
 -    { "uint64", 64, 'd', 'u' },
 -    { "int64", 64, 'd', 's' },
 -    /* 32 bit */
 -    { "ieee_single", 32, 's', 'f' },
 -    { "uint32", 32, 's', 'u' },
 -    { "int32", 32, 's', 's' },
 -    /* 16 bit */
 -    { "ieee_half", 16, 'h', 'f' },
 -    { "uint16", 16, 'h', 'u' },
 -    { "int16", 16, 'h', 's' },
 -    /* bytes */
 -    { "uint8", 8, 'b', 'u' },
 -    { "int8", 8, 'b', 's' },
 -};
 -
 -
 -int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
 -{
 -    ARMCPU *cpu = ARM_CPU(cs);
 -    GString *s = g_string_new(NULL);
 -    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
 -    g_autoptr(GString) ts = g_string_new("");
 -    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
 -    info->num = 0;
 -    g_string_printf(s, "<?xml version=\"1.0\"?>");
 -    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
 -    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 -
 -    /* First define types and totals in a whole VL */
 -    for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
 -        int count = reg_width / vec_lanes[i].size;
 -        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
 -        g_string_append_printf(s,
 -                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
 -                               ts->str, vec_lanes[i].gdb_type, count);
 -    }
 -    /*
 -     * Now define a union for each size group containing unsigned and
 -     * signed and potentially float versions of each size from 128 to
 -     * 8 bits.
 -     */
 -    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 -        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
 -        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
 -        for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
 -            if (vec_lanes[j].size == bits) {
 -                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
 -                                       vec_lanes[j].suffix,
 -                                       vec_lanes[j].sz, vec_lanes[j].suffix);
 -            }
 -        }
 -        g_string_append(s, "</union>");
 -    }
 -    /* And now the final union of unions */
 -    g_string_append(s, "<union id=\"svev\">");
 -    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 -        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
 -        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
 -                               suf[i], suf[i]);
 -    }
 -    g_string_append(s, "</union>");
 -
 -    /* Finally the sve prefix type */
 -    g_string_append_printf(s,
 -                           "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
 -                           reg_width / 8);
 -
 -    /* Then define each register in parts for each vq */
 -    for (i = 0; i < 32; i++) {
 -        g_string_append_printf(s,
 -                               "<reg name=\"z%d\" bitsize=\"%d\""
 -                               " regnum=\"%d\" type=\"svev\"/>",
 -                               i, reg_width, base_reg++);
 -        info->num++;
 -    }
 -    /* fpscr & status registers */
 -    g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
 -                           " regnum=\"%d\" group=\"float\""
 -                           " type=\"int\"/>", base_reg++);
 -    g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
 -                           " regnum=\"%d\" group=\"float\""
 -                           " type=\"int\"/>", base_reg++);
 -    info->num += 2;
 -
 -    for (i = 0; i < 16; i++) {
 -        g_string_append_printf(s,
 -                               "<reg name=\"p%d\" bitsize=\"%d\""
 -                               " regnum=\"%d\" type=\"svep\"/>",
 -                               i, cpu->sve_max_vq * 16, base_reg++);
 -        info->num++;
 -    }
 -    g_string_append_printf(s,
 -                           "<reg name=\"ffr\" bitsize=\"%d\""
 -                           " regnum=\"%d\" group=\"vector\""
 -                           " type=\"svep\"/>",
 -                           cpu->sve_max_vq * 16, base_reg++);
 -    g_string_append_printf(s,
 -                           "<reg name=\"vg\" bitsize=\"64\""
 -                           " regnum=\"%d\" type=\"int\"/>",
 -                           base_reg++);
 -    info->num += 2;
 -    g_string_append_printf(s, "</feature>");
 -    cpu->dyn_svereg_xml.desc = g_string_free(s, false);
 -
 -    return cpu->dyn_svereg_xml.num;
 -}
 -
 -
  const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
  {
      ARMCPU *cpu = ARM_CPU(cs);
 diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/gdbstub64.c
 +++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
      return 0;
  }
 +
 +struct TypeSize {
 +    const char *gdb_type;
 +    short size;
 +    char sz, suffix;
 +};
 +
 +static const struct TypeSize vec_lanes[] = {
 +    /* quads */
 +    { "uint128", 128, 'q', 'u' },
 +    { "int128", 128, 'q', 's' },
 +    /* 64 bit */
 +    { "ieee_double", 64, 'd', 'f' },
 +    { "uint64", 64, 'd', 'u' },
 +    { "int64", 64, 'd', 's' },
 +    /* 32 bit */
 +    { "ieee_single", 32, 's', 'f' },
 +    { "uint32", 32, 's', 'u' },
 +    { "int32", 32, 's', 's' },
 +    /* 16 bit */
 +    { "ieee_half", 16, 'h', 'f' },
 +    { "uint16", 16, 'h', 'u' },
 +    { "int16", 16, 'h', 's' },
 +    /* bytes */
 +    { "uint8", 8, 'b', 'u' },
 +    { "int8", 8, 'b', 's' },
 +};
 +
 +int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
 +{
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    GString *s = g_string_new(NULL);
 +    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
 +    g_autoptr(GString) ts = g_string_new("");
 +    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
 +    info->num = 0;
 +    g_string_printf(s, "<?xml version=\"1.0\"?>");
 +    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
 +    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 +
 +    /* First define types and totals in a whole VL */
 +    for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
 +        int count = reg_width / vec_lanes[i].size;
 +        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
 +        g_string_append_printf(s,
 +                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
 +                               ts->str, vec_lanes[i].gdb_type, count);
 +    }
 +    /*
 +     * Now define a union for each size group containing unsigned and
 +     * signed and potentially float versions of each size from 128 to
 +     * 8 bits.
 +     */
 +    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 +        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
 +        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
 +        for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
 +            if (vec_lanes[j].size == bits) {
 +                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
 +                                       vec_lanes[j].suffix,
 +                                       vec_lanes[j].sz, vec_lanes[j].suffix);
 +            }
 +        }
 +        g_string_append(s, "</union>");
 +    }
 +    /* And now the final union of unions */
 +    g_string_append(s, "<union id=\"svev\">");
 +    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
 +        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
 +        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
 +                               suf[i], suf[i]);
 +    }
 +    g_string_append(s, "</union>");
 +
 +    /* Finally the sve prefix type */
 +    g_string_append_printf(s,
 +                           "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
 +                           reg_width / 8);
 +
 +    /* Then define each register in parts for each vq */
 +    for (i = 0; i < 32; i++) {
 +        g_string_append_printf(s,
 +                               "<reg name=\"z%d\" bitsize=\"%d\""
 +                               " regnum=\"%d\" type=\"svev\"/>",
 +                               i, reg_width, base_reg++);
 +        info->num++;
 +    }
 +    /* fpscr & status registers */
 +    g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
 +                           " regnum=\"%d\" group=\"float\""
 +                           " type=\"int\"/>", base_reg++);
 +    g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
 +                           " regnum=\"%d\" group=\"float\""
 +                           " type=\"int\"/>", base_reg++);
 +    info->num += 2;
 +
 +    for (i = 0; i < 16; i++) {
 +        g_string_append_printf(s,
 +                               "<reg name=\"p%d\" bitsize=\"%d\""
 +                               " regnum=\"%d\" type=\"svep\"/>",
 +                               i, cpu->sve_max_vq * 16, base_reg++);
 +        info->num++;
 +    }
 +    g_string_append_printf(s,
 +                           "<reg name=\"ffr\" bitsize=\"%d\""
 +                           " regnum=\"%d\" group=\"vector\""
 +                           " type=\"svep\"/>",
 +                           cpu->sve_max_vq * 16, base_reg++);
 +    g_string_append_printf(s,
 +                           "<reg name=\"vg\" bitsize=\"64\""
 +                           " regnum=\"%d\" type=\"int\"/>",
 +                           base_reg++);
 +    info->num += 2;
 +    g_string_append_printf(s, "</feature>");
 +    info->desc = g_string_free(s, false);
 +
 +    return info->num;
 +}
 --
 .34.1

-[PULL 12/21] target/arm: Export arm_v7m_mrs_control
+[PULL 71/72] MAINTAINERS: update email address for Leif Lindholm
-From: David Reiss <dreiss@meta.com>
+From: Leif Lindholm <quic_llindhol@quicinc.com>
-Allow the function to be used outside of m_helper.c.
+I'm migrating to Qualcomm's new open source email infrastructure, so
-Rename with an "arm_" prefix.
+update my email address, and update the mailmap to match.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
 Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
 Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: David Reiss <dreiss@meta.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20241205114047.1125842-1-leif.lindholm@oss.qualcomm.com
 Message-id: 20230227213329.793795-13-richard.henderson@linaro.org
 [rth: Split out of a larger patch]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h    | 3 +++
+ MAINTAINERS | 2 +-
- target/arm/tcg/m_helper.c | 6 +++---
+ .mailmap    | 5 +++--
-files changed, 6 insertions(+), 3 deletions(-)
+files changed, 4 insertions(+), 3 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/MAINTAINERS
-+++ b/target/arm/internals.h
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
+@@ -XXX,XX +XXX,XX @@ F: include/hw/ssi/imx_spi.h
- void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
+ SBSA-REF
- #endif
+ M: Radoslaw Biernacki <rad@semihalf.com>
+ M: Peter Maydell <peter.maydell@linaro.org>
-+/* Read the CONTROL register as the MRS instruction would. */
+-R: Leif Lindholm <quic_llindhol@quicinc.com>
-+uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);
++R: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
-+
+ R: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
- #ifdef CONFIG_USER_ONLY
+ L: qemu-arm@nongnu.org
- static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
+ S: Maintained
- #else
+diff --git a/.mailmap b/.mailmap
 diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/tcg/m_helper.c
+--- a/.mailmap
-+++ b/target/arm/tcg/m_helper.c
++++ b/.mailmap
-@@ -XXX,XX +XXX,XX @@ static uint32_t v7m_mrs_xpsr(CPUARMState *env, uint32_t reg, unsigned el)
+@@ -XXX,XX +XXX,XX @@ Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
-     return xpsr_read(env) & mask;
+ Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
- }
+ James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
+ Juan Quintela <quintela@trasno.org> <quintela@redhat.com>
--static uint32_t v7m_mrs_control(CPUARMState *env, uint32_t secure)
+-Leif Lindholm <quic_llindhol@quicinc.com> <leif.lindholm@linaro.org>
-+uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure)
+-Leif Lindholm <quic_llindhol@quicinc.com> <leif@nuviainc.com>
- {
++Leif Lindholm <leif.lindholm@oss.qualcomm.com> <quic_llindhol@quicinc.com>
-     uint32_t value = env->v7m.control[secure];
++Leif Lindholm <leif.lindholm@oss.qualcomm.com> <leif.lindholm@linaro.org>
++Leif Lindholm <leif.lindholm@oss.qualcomm.com> <leif@nuviainc.com>
-@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
+ Luc Michel <luc@lmichel.fr> <luc.michel@git.antfield.fr>
-     case 0 ... 7: /* xPSR sub-fields */
+ Luc Michel <luc@lmichel.fr> <luc.michel@greensocs.com>
-         return v7m_mrs_xpsr(env, reg, 0);
+ Luc Michel <luc@lmichel.fr> <lmichel@kalray.eu>
      case 20: /* CONTROL */
 -        return v7m_mrs_control(env, 0);
 +        return arm_v7m_mrs_control(env, 0);
      default:
          /* Unprivileged reads others as zero.  */
          return 0;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
      case 0 ... 7: /* xPSR sub-fields */
          return v7m_mrs_xpsr(env, reg, el);
      case 20: /* CONTROL */
 -        return v7m_mrs_control(env, env->v7m.secure);
 +        return arm_v7m_mrs_control(env, env->v7m.secure);
      case 0x94: /* CONTROL_NS */
          /*
           * We have to handle this here because unprivileged Secure code
 --
 .34.1

-[PULL 20/21] hw: allwinner-i2c: Fix TWI_CNTR_INT_FLAG on SUN6i SoCs
+[PULL 72/72] MAINTAINERS: Add correct email address for Vikram Garhwal
-From: qianfan Zhao <qianfanguijin@163.com>
+From: Vikram Garhwal <vikram.garhwal@bytedance.com>
-TWI_CNTR_INT_FLAG is W1C(write 1 to clear and write 0 has non-effect)
+Previously, maintainer role was paused due to inactive email id. Commit id:
-register on SUN6i based SoCs, we should lower interrupt when the guest
+c009d715721861984c4987bcc78b7ee183e86d75.
 set this bit.
-The linux kernel will hang in irq handler(mv64xxx_i2c_intr) if no
+Signed-off-by: Vikram Garhwal <vikram.garhwal@bytedance.com>
-device connected on the i2c bus, next is the trace log:
+Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
+Message-id: 20241204184205.12952-1-vikram.garhwal@bytedance.com
 allwinner_i2c_write write   CNTR(0x0c): 0xc4 A_ACK BUS_EN INT_EN
 allwinner_i2c_write write   CNTR(0x0c): 0xcc A_ACK INT_FLAG BUS_EN INT_EN
 allwinner_i2c_read  read    CNTR(0x0c): 0xcc A_ACK INT_FLAG BUS_EN INT_EN
 allwinner_i2c_read  read    STAT(0x10): 0x20 STAT_M_ADDR_WR_NACK
 allwinner_i2c_write write   CNTR(0x0c): 0x54 A_ACK M_STP BUS_EN
 allwinner_i2c_write write   CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
 allwinner_i2c_read  read    CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
 allwinner_i2c_read  read    STAT(0x10): 0xf8 STAT_IDLE
 allwinner_i2c_write write   CNTR(0x0c): 0x54 A_ACK M_STP BUS_EN
 allwinner_i2c_write write   CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
 allwinner_i2c_read  read    CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
 allwinner_i2c_read  read    STAT(0x10): 0xf8 STAT_IDLE
 ...
 Fix it.
 Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
 Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
 Tested-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/i2c/allwinner-i2c.h |  6 ++++++
+ MAINTAINERS | 2 ++
- hw/i2c/allwinner-i2c.c         | 26 ++++++++++++++++++++++++--
+file changed, 2 insertions(+)
 files changed, 30 insertions(+), 2 deletions(-)
-diff --git a/include/hw/i2c/allwinner-i2c.h b/include/hw/i2c/allwinner-i2c.h
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i2c/allwinner-i2c.h
+--- a/MAINTAINERS
-+++ b/include/hw/i2c/allwinner-i2c.h
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ F: tests/qtest/fuzz-sb16-test.c
- #include "qom/object.h"
+ Xilinx CAN
- #define TYPE_AW_I2C "allwinner.i2c"
+ M: Francisco Iglesias <francisco.iglesias@amd.com>
-+
++M: Vikram Garhwal <vikram.garhwal@bytedance.com>
-+/** Allwinner I2C sun6i family and newer (A31, H2+, H3, etc) */
+ S: Maintained
-+#define TYPE_AW_I2C_SUN6I    TYPE_AW_I2C "-sun6i"
+ F: hw/net/can/xlnx-*
-+
+ F: include/hw/net/xlnx-*
- OBJECT_DECLARE_SIMPLE_TYPE(AWI2CState, AW_I2C)
+@@ -XXX,XX +XXX,XX @@ F: include/hw/rx/
+ CAN bus subsystem and hardware
- #define AW_I2C_MEM_SIZE         0x24
+ M: Pavel Pisa <pisa@cmp.felk.cvut.cz>
-@@ -XXX,XX +XXX,XX @@ struct AWI2CState {
+ M: Francisco Iglesias <francisco.iglesias@amd.com>
-     uint8_t srst;
++M: Vikram Garhwal <vikram.garhwal@bytedance.com>
-     uint8_t efr;
+ S: Maintained
-     uint8_t lcr;
+ W: https://canbus.pages.fel.cvut.cz/
-+
+ F: net/can/*
 +    bool irq_clear_inverted;
  };
  #endif /* ALLWINNER_I2C_H */
 diff --git a/hw/i2c/allwinner-i2c.c b/hw/i2c/allwinner-i2c.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/i2c/allwinner-i2c.c
 +++ b/hw/i2c/allwinner-i2c.c
@@ -XXX,XX +XXX,XX @@ static void allwinner_i2c_write(void *opaque, hwaddr offset,
                  s->stat = STAT_FROM_STA(STAT_IDLE);
                  s->cntr &= ~TWI_CNTR_M_STP;
              }
 -            if ((s->cntr & TWI_CNTR_INT_FLAG) == 0) {
 -                /* Interrupt flag cleared */
 +
 +            if (!s->irq_clear_inverted && !(s->cntr & TWI_CNTR_INT_FLAG)) {
 +                /* Write 0 to clear this flag */
 +                qemu_irq_lower(s->irq);
 +            } else if (s->irq_clear_inverted && (s->cntr & TWI_CNTR_INT_FLAG)) {
 +                /* Write 1 to clear this flag */
 +                s->cntr &= ~TWI_CNTR_INT_FLAG;
                  qemu_irq_lower(s->irq);
              }
 +
              if ((s->cntr & TWI_CNTR_A_ACK) == 0) {
                  if (STAT_TO_STA(s->stat) == STAT_M_DATA_RX_ACK) {
                      s->stat = STAT_FROM_STA(STAT_M_DATA_RX_NACK);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo allwinner_i2c_type_info = {
      .class_init = allwinner_i2c_class_init,
  };
 +static void allwinner_i2c_sun6i_init(Object *obj)
 +{
 +    AWI2CState *s = AW_I2C(obj);
 +
 +    s->irq_clear_inverted = true;
 +}
 +
 +static const TypeInfo allwinner_i2c_sun6i_type_info = {
 +    .name = TYPE_AW_I2C_SUN6I,
 +    .parent = TYPE_SYS_BUS_DEVICE,
 +    .instance_size = sizeof(AWI2CState),
 +    .instance_init = allwinner_i2c_sun6i_init,
 +    .class_init = allwinner_i2c_class_init,
 +};
 +
  static void allwinner_i2c_register_types(void)
  {
      type_register_static(&allwinner_i2c_type_info);
 +    type_register_static(&allwinner_i2c_sun6i_type_info);
  }
  type_init(allwinner_i2c_register_types)
 --
 .34.1

The following changes since commit f003dd8d81f7d88f4b1f8802309eaa76f6eb223a:

Merge tag 'pull-tcg-20230305' of https://gitlab.com/rth7680/qemu into staging (2023-03-06 10:20:04 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230306

for you to fetch changes up to 2ddc45954f97cd1d7ee5cbca0def05e980d1da9f:

hw: arm: allwinner-h3: Fix and complete H3 i2c devices (2023-03-06 15:31:24 +0000)

----------------------------------------------------------------
target-arm queue:
 * allwinner-h3: Fix I2C controller model for Sun6i SoCs
 * allwinner-h3: Add missing i2c controllers
 * Expose M-profile system registers to gdbstub
 * Expose pauth information to gdbstub
 * Support direct boot for Linux/arm64 EFI zboot images
 * Fix incorrect stage 2 MMU setup validation

----------------------------------------------------------------
Ard Biesheuvel (1):
      hw: arm: Support direct boot for Linux/arm64 EFI zboot images

David Reiss (2):
      target/arm: Export arm_v7m_mrs_control
      target/arm: Export arm_v7m_get_sp_ptr

Richard Henderson (16):
      target/arm: Normalize aarch64 gdbstub get/set function names
      target/arm: Unexport arm_gen_dynamic_sysreg_xml
      target/arm: Move arm_gen_dynamic_svereg_xml to gdbstub64.c
      target/arm: Split out output_vector_union_type
      target/arm: Simplify register counting in arm_gen_dynamic_svereg_xml
      target/arm: Hoist pred_width in arm_gen_dynamic_svereg_xml
      target/arm: Fix svep width in arm_gen_dynamic_svereg_xml
      target/arm: Add name argument to output_vector_union_type
      target/arm: Simplify iteration over bit widths
      target/arm: Create pauth_ptr_mask
      target/arm: Implement gdbstub pauth extension
      target/arm: Implement gdbstub m-profile systemreg and secext
      target/arm: Handle m-profile in arm_is_secure
      target/arm: Stub arm_hcr_el2_eff for m-profile
      target/arm: Diagnose incorrect usage of arm_is_secure subroutines
      target/arm: Rewrite check_s2_mmu_setup

qianfan Zhao (2):
      hw: allwinner-i2c: Fix TWI_CNTR_INT_FLAG on SUN6i SoCs
      hw: arm: allwinner-h3: Fix and complete H3 i2c devices

From: Richard Henderson <richard.henderson@linaro.org>

Make the form of the function names between fp and sve the same:
  - arm_gdb_*_svereg -> aarch64_gdb_*_sve_reg.
  - aarch64_fpu_gdb_*_reg -> aarch64_gdb_*_fpu_reg.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 8 ++++----
 target/arm/gdbstub.c   | 9 +++++----
 target/arm/gdbstub64.c | 8 ++++----
 3 files changed, 13 insertions(+), 12 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
 }
 
 #ifdef TARGET_AARCH64
-int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg);
-int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
-int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
-int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
+int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
+int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
+int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
+int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg);
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
          */
 #ifdef TARGET_AARCH64
         if (isar_feature_aa64_sve(&cpu->isar)) {
-            gdb_register_coprocessor(cs, arm_gdb_get_svereg, arm_gdb_set_svereg,
-                                     arm_gen_dynamic_svereg_xml(cs, cs->gdb_num_regs),
+            int nreg = arm_gen_dynamic_svereg_xml(cs, cs->gdb_num_regs);
+            gdb_register_coprocessor(cs, aarch64_gdb_get_sve_reg,
+                                     aarch64_gdb_set_sve_reg, nreg,
                                      "sve-registers.xml", 0);
         } else {
-            gdb_register_coprocessor(cs, aarch64_fpu_gdb_get_reg,
-                                     aarch64_fpu_gdb_set_reg,
+            gdb_register_coprocessor(cs, aarch64_gdb_get_fpu_reg,
+                                     aarch64_gdb_set_fpu_reg,
                                      34, "aarch64-fpu.xml", 0);
         }
 #endif
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
     return 0;
 }
 
-int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg)
+int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg)
 {
     switch (reg) {
     case 0 ... 31:
@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg)
     }
 }
 
-int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
+int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg)
 {
     switch (reg) {
     case 0 ... 31:
@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg)
     }
 }
 
-int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg)
+int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg)
 {
     ARMCPU *cpu = env_archcpu(env);
 
@@ -XXX,XX +XXX,XX @@ int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg)
     return 0;
 }
 
-int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg)
+int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
 {
     ARMCPU *cpu = env_archcpu(env);
 
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

This function is not used outside gdbstub.c.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     | 1 -
 target/arm/gdbstub.c | 2 +-
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
  * Helpers to dynamically generates XML descriptions of the sysregs
  * and SVE registers. Returns the number of registers in each set.
  */
-int arm_gen_dynamic_sysreg_xml(CPUState *cpu, int base_reg);
 int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
 
 /* Returns the dynamically generated XML for the gdb stub.
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static void arm_register_sysreg_for_xml(gpointer key, gpointer value,
     }
 }
 
-int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
+static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     GString *s = g_string_new(NULL);
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

The function is only used for aarch64, so move it to the
file that has the other aarch64 gdbstub stuff.  Move the
declaration to internals.h.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       |   6 ---
 target/arm/internals.h |   1 +
 target/arm/gdbstub.c   | 120 -----------------------------------------
 target/arm/gdbstub64.c | 118 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 119 insertions(+), 126 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ hwaddr arm_cpu_get_phys_page_attrs_debug(CPUState *cpu, vaddr addr,
 int arm_cpu_gdb_read_register(CPUState *cpu, GByteArray *buf, int reg);
 int arm_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 
-/*
- * Helpers to dynamically generates XML descriptions of the sysregs
- * and SVE registers. Returns the number of registers in each set.
- */
-int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
-
 /* Returns the dynamically generated XML for the gdb stub.
  * Returns a pointer to the XML contents for the specified XML file or NULL
  * if the XML name doesn't match the predefined one.
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint64_t pmu_counter_mask(CPUARMState *env)
 }
 
 #ifdef TARGET_AARCH64
+int arm_gen_dynamic_svereg_xml(CPUState *cpu, int base_reg);
 int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
 int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
 int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
     return cpu->dyn_sysreg_xml.num;
 }
 
-struct TypeSize {
-    const char *gdb_type;
-    int  size;
-    const char sz, suffix;
-};
-
-static const struct TypeSize vec_lanes[] = {
-    /* quads */
-    { "uint128", 128, 'q', 'u' },
-    { "int128", 128, 'q', 's' },
-    /* 64 bit */
-    { "ieee_double", 64, 'd', 'f' },
-    { "uint64", 64, 'd', 'u' },
-    { "int64", 64, 'd', 's' },
-    /* 32 bit */
-    { "ieee_single", 32, 's', 'f' },
-    { "uint32", 32, 's', 'u' },
-    { "int32", 32, 's', 's' },
-    /* 16 bit */
-    { "ieee_half", 16, 'h', 'f' },
-    { "uint16", 16, 'h', 'u' },
-    { "int16", 16, 'h', 's' },
-    /* bytes */
-    { "uint8", 8, 'b', 'u' },
-    { "int8", 8, 'b', 's' },
-};
-
-
-int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
-{
-    ARMCPU *cpu = ARM_CPU(cs);
-    GString *s = g_string_new(NULL);
-    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
-    g_autoptr(GString) ts = g_string_new("");
-    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
-    info->num = 0;
-    g_string_printf(s, "<?xml version=\"1.0\"?>");
-    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
-    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
-
-    /* First define types and totals in a whole VL */
-    for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
-        int count = reg_width / vec_lanes[i].size;
-        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
-        g_string_append_printf(s,
-                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
-                               ts->str, vec_lanes[i].gdb_type, count);
-    }
-    /*
-     * Now define a union for each size group containing unsigned and
-     * signed and potentially float versions of each size from 128 to
-     * 8 bits.
-     */
-    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
-        for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
-            if (vec_lanes[j].size == bits) {
-                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
-                                       vec_lanes[j].suffix,
-                                       vec_lanes[j].sz, vec_lanes[j].suffix);
-            }
-        }
-        g_string_append(s, "</union>");
-    }
-    /* And now the final union of unions */
-    g_string_append(s, "<union id=\"svev\">");
-    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
-                               suf[i], suf[i]);
-    }
-    g_string_append(s, "</union>");
-
-    /* Finally the sve prefix type */
-    g_string_append_printf(s,
-                           "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
-                           reg_width / 8);
-
-    /* Then define each register in parts for each vq */
-    for (i = 0; i < 32; i++) {
-        g_string_append_printf(s,
-                               "<reg name=\"z%d\" bitsize=\"%d\""
-                               " regnum=\"%d\" type=\"svev\"/>",
-                               i, reg_width, base_reg++);
-        info->num++;
-    }
-    /* fpscr & status registers */
-    g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
-                           " regnum=\"%d\" group=\"float\""
-                           " type=\"int\"/>", base_reg++);
-    g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
-                           " regnum=\"%d\" group=\"float\""
-                           " type=\"int\"/>", base_reg++);
-    info->num += 2;
-
-    for (i = 0; i < 16; i++) {
-        g_string_append_printf(s,
-                               "<reg name=\"p%d\" bitsize=\"%d\""
-                               " regnum=\"%d\" type=\"svep\"/>",
-                               i, cpu->sve_max_vq * 16, base_reg++);
-        info->num++;
-    }
-    g_string_append_printf(s,
-                           "<reg name=\"ffr\" bitsize=\"%d\""
-                           " regnum=\"%d\" group=\"vector\""
-                           " type=\"svep\"/>",
-                           cpu->sve_max_vq * 16, base_reg++);
-    g_string_append_printf(s,
-                           "<reg name=\"vg\" bitsize=\"64\""
-                           " regnum=\"%d\" type=\"int\"/>",
-                           base_reg++);
-    info->num += 2;
-    g_string_append_printf(s, "</feature>");
-    cpu->dyn_svereg_xml.desc = g_string_free(s, false);
-
-    return cpu->dyn_svereg_xml.num;
-}
-
-
 const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
 {
     ARMCPU *cpu = ARM_CPU(cs);
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
 
     return 0;
 }
+
+struct TypeSize {
+    const char *gdb_type;
+    short size;
+    char sz, suffix;
+};
+
+static const struct TypeSize vec_lanes[] = {
+    /* quads */
+    { "uint128", 128, 'q', 'u' },
+    { "int128", 128, 'q', 's' },
+    /* 64 bit */
+    { "ieee_double", 64, 'd', 'f' },
+    { "uint64", 64, 'd', 'u' },
+    { "int64", 64, 'd', 's' },
+    /* 32 bit */
+    { "ieee_single", 32, 's', 'f' },
+    { "uint32", 32, 's', 'u' },
+    { "int32", 32, 's', 's' },
+    /* 16 bit */
+    { "ieee_half", 16, 'h', 'f' },
+    { "uint16", 16, 'h', 'u' },
+    { "int16", 16, 'h', 's' },
+    /* bytes */
+    { "uint8", 8, 'b', 'u' },
+    { "int8", 8, 'b', 's' },
+};
+
+int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    GString *s = g_string_new(NULL);
+    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
+    g_autoptr(GString) ts = g_string_new("");
+    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
+    info->num = 0;
+    g_string_printf(s, "<?xml version=\"1.0\"?>");
+    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
+    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
+
+    /* First define types and totals in a whole VL */
+    for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
+        int count = reg_width / vec_lanes[i].size;
+        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
+        g_string_append_printf(s,
+                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
+                               ts->str, vec_lanes[i].gdb_type, count);
+    }
+    /*
+     * Now define a union for each size group containing unsigned and
+     * signed and potentially float versions of each size from 128 to
+     * 8 bits.
+     */
+    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
+        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
+        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
+        for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
+            if (vec_lanes[j].size == bits) {
+                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
+                                       vec_lanes[j].suffix,
+                                       vec_lanes[j].sz, vec_lanes[j].suffix);
+            }
+        }
+        g_string_append(s, "</union>");
+    }
+    /* And now the final union of unions */
+    g_string_append(s, "<union id=\"svev\">");
+    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
+        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
+        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
+                               suf[i], suf[i]);
+    }
+    g_string_append(s, "</union>");
+
+    /* Finally the sve prefix type */
+    g_string_append_printf(s,
+                           "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
+                           reg_width / 8);
+
+    /* Then define each register in parts for each vq */
+    for (i = 0; i < 32; i++) {
+        g_string_append_printf(s,
+                               "<reg name=\"z%d\" bitsize=\"%d\""
+                               " regnum=\"%d\" type=\"svev\"/>",
+                               i, reg_width, base_reg++);
+        info->num++;
+    }
+    /* fpscr & status registers */
+    g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
+                           " regnum=\"%d\" group=\"float\""
+                           " type=\"int\"/>", base_reg++);
+    g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
+                           " regnum=\"%d\" group=\"float\""
+                           " type=\"int\"/>", base_reg++);
+    info->num += 2;
+
+    for (i = 0; i < 16; i++) {
+        g_string_append_printf(s,
+                               "<reg name=\"p%d\" bitsize=\"%d\""
+                               " regnum=\"%d\" type=\"svep\"/>",
+                               i, cpu->sve_max_vq * 16, base_reg++);
+        info->num++;
+    }
+    g_string_append_printf(s,
+                           "<reg name=\"ffr\" bitsize=\"%d\""
+                           " regnum=\"%d\" group=\"vector\""
+                           " type=\"svep\"/>",
+                           cpu->sve_max_vq * 16, base_reg++);
+    g_string_append_printf(s,
+                           "<reg name=\"vg\" bitsize=\"64\""
+                           " regnum=\"%d\" type=\"int\"/>",
+                           base_reg++);
+    info->num += 2;
+    g_string_append_printf(s, "</feature>");
+    info->desc = g_string_free(s, false);
+
+    return info->num;
+}
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Create a subroutine for creating the union of unions
of the various type sizes that a vector may contain.

Reviewed-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 83 +++++++++++++++++++++++-------------------
 1 file changed, 45 insertions(+), 38 deletions(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
     return 0;
 }
 
-struct TypeSize {
-    const char *gdb_type;
-    short size;
-    char sz, suffix;
-};
-
-static const struct TypeSize vec_lanes[] = {
-    /* quads */
-    { "uint128", 128, 'q', 'u' },
-    { "int128", 128, 'q', 's' },
-    /* 64 bit */
-    { "ieee_double", 64, 'd', 'f' },
-    { "uint64", 64, 'd', 'u' },
-    { "int64", 64, 'd', 's' },
-    /* 32 bit */
-    { "ieee_single", 32, 's', 'f' },
-    { "uint32", 32, 's', 'u' },
-    { "int32", 32, 's', 's' },
-    /* 16 bit */
-    { "ieee_half", 16, 'h', 'f' },
-    { "uint16", 16, 'h', 'u' },
-    { "int16", 16, 'h', 's' },
-    /* bytes */
-    { "uint8", 8, 'b', 'u' },
-    { "int8", 8, 'b', 's' },
-};
-
-int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
+static void output_vector_union_type(GString *s, int reg_width)
 {
-    ARMCPU *cpu = ARM_CPU(cs);
-    GString *s = g_string_new(NULL);
-    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
+    struct TypeSize {
+        const char *gdb_type;
+        short size;
+        char sz, suffix;
+    };
+
+    static const struct TypeSize vec_lanes[] = {
+        /* quads */
+        { "uint128", 128, 'q', 'u' },
+        { "int128", 128, 'q', 's' },
+        /* 64 bit */
+        { "ieee_double", 64, 'd', 'f' },
+        { "uint64", 64, 'd', 'u' },
+        { "int64", 64, 'd', 's' },
+        /* 32 bit */
+        { "ieee_single", 32, 's', 'f' },
+        { "uint32", 32, 's', 'u' },
+        { "int32", 32, 's', 's' },
+        /* 16 bit */
+        { "ieee_half", 16, 'h', 'f' },
+        { "uint16", 16, 'h', 'u' },
+        { "int16", 16, 'h', 's' },
+        /* bytes */
+        { "uint8", 8, 'b', 'u' },
+        { "int8", 8, 'b', 's' },
+    };
+
+    static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
+
     g_autoptr(GString) ts = g_string_new("");
-    int i, j, bits, reg_width = (cpu->sve_max_vq * 128);
-    info->num = 0;
-    g_string_printf(s, "<?xml version=\"1.0\"?>");
-    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
-    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
+    int i, j, bits;
 
     /* First define types and totals in a whole VL */
     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
      * 8 bits.
      */
     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
         g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
         for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
             if (vec_lanes[j].size == bits) {
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
     /* And now the final union of unions */
     g_string_append(s, "<union id=\"svev\">");
     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        const char suf[] = { 'q', 'd', 's', 'h', 'b' };
         g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
                                suf[i], suf[i]);
     }
     g_string_append(s, "</union>");
+}
+
+int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    GString *s = g_string_new(NULL);
+    DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
+    int i, reg_width = (cpu->sve_max_vq * 128);
+    info->num = 0;
+    g_string_printf(s, "<?xml version=\"1.0\"?>");
+    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
+    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
+
+    output_vector_union_type(s, reg_width);
 
     /* Finally the sve prefix type */
     g_string_append_printf(s,
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Rather than increment base_reg and num, compute num from the change
to base_reg at the end.  Clean up some nearby comments.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 27 ++++++++++++++++-----------
 1 file changed, 16 insertions(+), 11 deletions(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width)
     g_string_append(s, "</union>");
 }
 
-int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
+int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     GString *s = g_string_new(NULL);
     DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
-    int i, reg_width = (cpu->sve_max_vq * 128);
-    info->num = 0;
+    int reg_width = cpu->sve_max_vq * 128;
+    int base_reg = orig_base_reg;
+    int i;
+
     g_string_printf(s, "<?xml version=\"1.0\"?>");
     g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
     g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 
+    /* Create the vector union type. */
     output_vector_union_type(s, reg_width);
 
-    /* Finally the sve prefix type */
+    /* Create the predicate vector type. */
     g_string_append_printf(s,
                            "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
                            reg_width / 8);
 
-    /* Then define each register in parts for each vq */
+    /* Define the vector registers. */
     for (i = 0; i < 32; i++) {
         g_string_append_printf(s,
                                "<reg name=\"z%d\" bitsize=\"%d\""
                                " regnum=\"%d\" type=\"svev\"/>",
                                i, reg_width, base_reg++);
-        info->num++;
     }
+
     /* fpscr & status registers */
     g_string_append_printf(s, "<reg name=\"fpsr\" bitsize=\"32\""
                            " regnum=\"%d\" group=\"float\""
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int base_reg)
     g_string_append_printf(s, "<reg name=\"fpcr\" bitsize=\"32\""
                            " regnum=\"%d\" group=\"float\""
                            " type=\"int\"/>", base_reg++);
-    info->num += 2;
 
+    /* Define the predicate registers. */
     for (i = 0; i < 16; i++) {
         g_string_append_printf(s,
                                "<reg name=\"p%d\" bitsize=\"%d\""
                                " regnum=\"%d\" type=\"svep\"/>",
                                i, cpu->sve_max_vq * 16, base_reg++);
-        info->num++;
     }
     g_string_append_printf(s,
                            "<reg name=\"ffr\" bitsize=\"%d\""
                            " regnum=\"%d\" group=\"vector\""
                            " type=\"svep\"/>",
                            cpu->sve_max_vq * 16, base_reg++);
+
+    /* Define the vector length pseudo-register. */
     g_string_append_printf(s,
                            "<reg name=\"vg\" bitsize=\"64\""
                            " regnum=\"%d\" type=\"int\"/>",
                            base_reg++);
-    info->num += 2;
-    g_string_append_printf(s, "</feature>");
-    info->desc = g_string_free(s, false);
 
+    g_string_append_printf(s, "</feature>");
+
+    info->desc = g_string_free(s, false);
+    info->num = base_reg - orig_base_reg;
     return info->num;
 }
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
     GString *s = g_string_new(NULL);
     DynamicGDBXMLInfo *info = &cpu->dyn_svereg_xml;
     int reg_width = cpu->sve_max_vq * 128;
+    int pred_width = cpu->sve_max_vq * 16;
     int base_reg = orig_base_reg;
     int i;
 
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
         g_string_append_printf(s,
                                "<reg name=\"p%d\" bitsize=\"%d\""
                                " regnum=\"%d\" type=\"svep\"/>",
-                               i, cpu->sve_max_vq * 16, base_reg++);
+                               i, pred_width, base_reg++);
     }
     g_string_append_printf(s,
                            "<reg name=\"ffr\" bitsize=\"%d\""
                            " regnum=\"%d\" group=\"vector\""
                            " type=\"svep\"/>",
-                           cpu->sve_max_vq * 16, base_reg++);
+                           pred_width, base_reg++);
 
     /* Define the vector length pseudo-register. */
     g_string_append_printf(s,
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Define svep based on the size of the predicates,
not the primary vector registers.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
     /* Create the predicate vector type. */
     g_string_append_printf(s,
                            "<vector id=\"svep\" type=\"uint8\" count=\"%d\"/>",
-                           reg_width / 8);
+                           pred_width / 8);
 
     /* Define the vector registers. */
     for (i = 0; i < 32; i++) {
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

This will make the function usable between SVE and SME.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
     return 0;
 }
 
-static void output_vector_union_type(GString *s, int reg_width)
+static void output_vector_union_type(GString *s, int reg_width,
+                                     const char *name)
 {
     struct TypeSize {
         const char *gdb_type;
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width)
     };
 
     static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-
-    g_autoptr(GString) ts = g_string_new("");
     int i, j, bits;
 
     /* First define types and totals in a whole VL */
     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
-        int count = reg_width / vec_lanes[i].size;
-        g_string_printf(ts, "svev%c%c", vec_lanes[i].sz, vec_lanes[i].suffix);
         g_string_append_printf(s,
-                               "<vector id=\"%s\" type=\"%s\" count=\"%d\"/>",
-                               ts->str, vec_lanes[i].gdb_type, count);
+                               "<vector id=\"%s%c%c\" type=\"%s\" count=\"%d\"/>",
+                               name, vec_lanes[i].sz, vec_lanes[i].suffix,
+                               vec_lanes[i].gdb_type, reg_width / vec_lanes[i].size);
     }
+
     /*
      * Now define a union for each size group containing unsigned and
      * signed and potentially float versions of each size from 128 to
      * 8 bits.
      */
     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        g_string_append_printf(s, "<union id=\"svevn%c\">", suf[i]);
+        g_string_append_printf(s, "<union id=\"%sn%c\">", name, suf[i]);
         for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
             if (vec_lanes[j].size == bits) {
-                g_string_append_printf(s, "<field name=\"%c\" type=\"svev%c%c\"/>",
-                                       vec_lanes[j].suffix,
+                g_string_append_printf(s, "<field name=\"%c\" type=\"%s%c%c\"/>",
+                                       vec_lanes[j].suffix, name,
                                        vec_lanes[j].sz, vec_lanes[j].suffix);
             }
         }
         g_string_append(s, "</union>");
     }
+
     /* And now the final union of unions */
-    g_string_append(s, "<union id=\"svev\">");
+    g_string_append_printf(s, "<union id=\"%s\">", name);
     for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
-        g_string_append_printf(s, "<field name=\"%c\" type=\"svevn%c\"/>",
-                               suf[i], suf[i]);
+        g_string_append_printf(s, "<field name=\"%c\" type=\"%sn%c\"/>",
+                               suf[i], name, suf[i]);
     }
     g_string_append(s, "</union>");
 }
@@ -XXX,XX +XXX,XX @@ int arm_gen_dynamic_svereg_xml(CPUState *cs, int orig_base_reg)
     g_string_append_printf(s, "<feature name=\"org.gnu.gdb.aarch64.sve\">");
 
     /* Create the vector union type. */
-    output_vector_union_type(s, reg_width);
+    output_vector_union_type(s, reg_width, "svev");
 
     /* Create the predicate vector type. */
     g_string_append_printf(s,
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Order suf[] by the log8 of the width.
Use ARRAY_SIZE instead of hard-coding 128.

This changes the order of the union definitions,
but retains the order of the union-of-union members.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub64.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
         { "int8", 8, 'b', 's' },
     };
 
-    static const char suf[] = { 'q', 'd', 's', 'h', 'b' };
-    int i, j, bits;
+    static const char suf[] = { 'b', 'h', 's', 'd', 'q' };
+    int i, j;
 
     /* First define types and totals in a whole VL */
     for (i = 0; i < ARRAY_SIZE(vec_lanes); i++) {
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
      * signed and potentially float versions of each size from 128 to
      * 8 bits.
      */
-    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
+    for (i = 0; i < ARRAY_SIZE(suf); i++) {
+        int bits = 8 << i;
+
         g_string_append_printf(s, "<union id=\"%sn%c\">", name, suf[i]);
         for (j = 0; j < ARRAY_SIZE(vec_lanes); j++) {
             if (vec_lanes[j].size == bits) {
@@ -XXX,XX +XXX,XX @@ static void output_vector_union_type(GString *s, int reg_width,
 
     /* And now the final union of unions */
     g_string_append_printf(s, "<union id=\"%s\">", name);
-    for (bits = 128, i = 0; bits >= 8; bits /= 2, i++) {
+    for (i = ARRAY_SIZE(suf) - 1; i >= 0; i--) {
         g_string_append_printf(s, "<field name=\"%c\" type=\"%sn%c\"/>",
                                suf[i], name, suf[i]);
     }
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Keep the logic for pauth within pauth_helper.c, and expose
a helper function for use with the gdbstub pac extension.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h        | 10 ++++++++++
 target/arm/tcg/pauth_helper.c | 26 ++++++++++++++++++++++----
 2 files changed, 32 insertions(+), 4 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int exception_target_el(CPUARMState *env);
 bool arm_singlestep_active(CPUARMState *env);
 bool arm_generate_debug_exceptions(CPUARMState *env);
 
+/**
+ * pauth_ptr_mask:
+ * @env: cpu context
+ * @ptr: selects between TTBR0 and TTBR1
+ * @data: selects between TBI and TBID
+ *
+ * Return a mask of the bits of @ptr that contain the authentication code.
+ */
+uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data);
+
 /* Add the cpreg definitions for debug related system registers */
 void define_debug_regs(ARMCPU *cpu);
 
diff --git a/target/arm/tcg/pauth_helper.c b/target/arm/tcg/pauth_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/pauth_helper.c
+++ b/target/arm/tcg/pauth_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
     return pac | ext | ptr;
 }
 
-static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
+static uint64_t pauth_ptr_mask_internal(ARMVAParameters param)
 {
-    /* Note that bit 55 is used whether or not the regime has 2 ranges. */
-    uint64_t extfield = sextract64(ptr, 55, 1);
     int bot_pac_bit = 64 - param.tsz;
     int top_pac_bit = 64 - 8 * param.tbi;
 
-    return deposit64(ptr, bot_pac_bit, top_pac_bit - bot_pac_bit, extfield);
+    return MAKE_64BIT_MASK(bot_pac_bit, top_pac_bit - bot_pac_bit);
+}
+
+static uint64_t pauth_original_ptr(uint64_t ptr, ARMVAParameters param)
+{
+    uint64_t mask = pauth_ptr_mask_internal(param);
+
+    /* Note that bit 55 is used whether or not the regime has 2 ranges. */
+    if (extract64(ptr, 55, 1)) {
+        return ptr | mask;
+    } else {
+        return ptr & ~mask;
+    }
+}
+
+uint64_t pauth_ptr_mask(CPUARMState *env, uint64_t ptr, bool data)
+{
+    ARMMMUIdx mmu_idx = arm_stage1_mmu_idx(env);
+    ARMVAParameters param = aa64_va_parameters(env, ptr, mmu_idx, data);
+
+    return pauth_ptr_mask_internal(param);
 }
 
 static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

The extension is primarily defined by the Linux kernel NT_ARM_PAC_MASK
ptrace register set.

The original gdb feature consists of two masks, data and code, which are
used to mask out the authentication code within a pointer.  Following
discussion with Luis Machado, add two more masks in order to support
pointers within the high half of the address space (i.e. TTBR1 vs TTBR0).

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1105
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configs/targets/aarch64-linux-user.mak    |  2 +-
 configs/targets/aarch64-softmmu.mak       |  2 +-
 configs/targets/aarch64_be-linux-user.mak |  2 +-
 target/arm/internals.h                    |  2 ++
 target/arm/gdbstub.c                      |  5 ++++
 target/arm/gdbstub64.c                    | 34 +++++++++++++++++++++++
 gdb-xml/aarch64-pauth.xml                 | 15 ++++++++++
 7 files changed, 59 insertions(+), 3 deletions(-)
 create mode 100644 gdb-xml/aarch64-pauth.xml

diff --git a/configs/targets/aarch64-linux-user.mak b/configs/targets/aarch64-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/aarch64-linux-user.mak
+++ b/configs/targets/aarch64-linux-user.mak
@@ -XXX,XX +XXX,XX @@
 TARGET_ARCH=aarch64
 TARGET_BASE_ARCH=arm
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml
 TARGET_HAS_BFLT=y
 CONFIG_SEMIHOSTING=y
 CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
diff --git a/configs/targets/aarch64-softmmu.mak b/configs/targets/aarch64-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/aarch64-softmmu.mak
+++ b/configs/targets/aarch64-softmmu.mak
@@ -XXX,XX +XXX,XX @@
 TARGET_ARCH=aarch64
 TARGET_BASE_ARCH=arm
 TARGET_SUPPORTS_MTTCG=y
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/arm-core.xml gdb-xml/arm-vfp.xml gdb-xml/arm-vfp3.xml gdb-xml/arm-vfp-sysregs.xml gdb-xml/arm-neon.xml gdb-xml/arm-m-profile.xml gdb-xml/arm-m-profile-mve.xml gdb-xml/aarch64-pauth.xml
 TARGET_NEED_FDT=y
diff --git a/configs/targets/aarch64_be-linux-user.mak b/configs/targets/aarch64_be-linux-user.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/targets/aarch64_be-linux-user.mak
+++ b/configs/targets/aarch64_be-linux-user.mak
@@ -XXX,XX +XXX,XX @@
 TARGET_ARCH=aarch64
 TARGET_BASE_ARCH=arm
 TARGET_BIG_ENDIAN=y
-TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml
+TARGET_XML_FILES= gdb-xml/aarch64-core.xml gdb-xml/aarch64-fpu.xml gdb-xml/aarch64-pauth.xml
 TARGET_HAS_BFLT=y
 CONFIG_SEMIHOSTING=y
 CONFIG_ARM_COMPATIBLE_SEMIHOSTING=y
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_get_sve_reg(CPUARMState *env, GByteArray *buf, int reg);
 int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg);
 int aarch64_gdb_get_fpu_reg(CPUARMState *env, GByteArray *buf, int reg);
 int aarch64_gdb_set_fpu_reg(CPUARMState *env, uint8_t *buf, int reg);
+int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg);
+int aarch64_gdb_set_pauth_reg(CPUARMState *env, uint8_t *buf, int reg);
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                                      aarch64_gdb_set_fpu_reg,
                                      34, "aarch64-fpu.xml", 0);
         }
+        if (isar_feature_aa64_pauth(&cpu->isar)) {
+            gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg,
+                                     aarch64_gdb_set_pauth_reg,
+                                     4, "aarch64-pauth.xml", 0);
+        }
 #endif
     } else {
         if (arm_feature(env, ARM_FEATURE_NEON)) {
diff --git a/target/arm/gdbstub64.c b/target/arm/gdbstub64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub64.c
+++ b/target/arm/gdbstub64.c
@@ -XXX,XX +XXX,XX @@ int aarch64_gdb_set_sve_reg(CPUARMState *env, uint8_t *buf, int reg)
     return 0;
 }
 
+int aarch64_gdb_get_pauth_reg(CPUARMState *env, GByteArray *buf, int reg)
+{
+    switch (reg) {
+    case 0: /* pauth_dmask */
+    case 1: /* pauth_cmask */
+    case 2: /* pauth_dmask_high */
+    case 3: /* pauth_cmask_high */
+        /*
+         * Note that older versions of this feature only contained
+         * pauth_{d,c}mask, for use with Linux user processes, and
+         * thus exclusively in the low half of the address space.
+         *
+         * To support system mode, and to debug kernels, two new regs
+         * were added to cover the high half of the address space.
+         * For the purpose of pauth_ptr_mask, we can use any well-formed
+         * address within the address space half -- here, 0 and -1.
+         */
+        {
+            bool is_data = !(reg & 1);
+            bool is_high = reg & 2;
+            uint64_t mask = pauth_ptr_mask(env, -is_high, is_data);
+            return gdb_get_reg64(buf, mask);
+        }
+    default:
+        return 0;
+    }
+}
+
+int aarch64_gdb_set_pauth_reg(CPUARMState *env, uint8_t *buf, int reg)
+{
+    /* All pseudo registers are read-only. */
+    return 0;
+}
+
 static void output_vector_union_type(GString *s, int reg_width,
                                      const char *name)
 {
diff --git a/gdb-xml/aarch64-pauth.xml b/gdb-xml/aarch64-pauth.xml
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/gdb-xml/aarch64-pauth.xml
@@ -XXX,XX +XXX,XX @@
+<?xml version="1.0"?>
+
+
+<!DOCTYPE feature SYSTEM "gdb-target.dtd">
+<feature name="org.gnu.gdb.aarch64.pauth">
+  <reg name="pauth_dmask" bitsize="64"/>
+  <reg name="pauth_cmask" bitsize="64"/>
+  <reg name="pauth_dmask_high" bitsize="64"/>
+  <reg name="pauth_cmask_high" bitsize="64"/>
+</feature>
+
-- 
2.34.1

From: David Reiss <dreiss@meta.com>

Allow the function to be used outside of m_helper.c.
Rename with an "arm_" prefix.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: David Reiss <dreiss@meta.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-13-richard.henderson@linaro.org
[rth: Split out of a larger patch]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h    | 3 +++
 target/arm/tcg/m_helper.c | 6 +++---
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
 #endif
 
+/* Read the CONTROL register as the MRS instruction would. */
+uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);
+
 #ifdef CONFIG_USER_ONLY
 static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
 #else
diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t v7m_mrs_xpsr(CPUARMState *env, uint32_t reg, unsigned el)
     return xpsr_read(env) & mask;
 }
 
-static uint32_t v7m_mrs_control(CPUARMState *env, uint32_t secure)
+uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure)
 {
     uint32_t value = env->v7m.control[secure];
 
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
     case 0 ... 7: /* xPSR sub-fields */
         return v7m_mrs_xpsr(env, reg, 0);
     case 20: /* CONTROL */
-        return v7m_mrs_control(env, 0);
+        return arm_v7m_mrs_control(env, 0);
     default:
         /* Unprivileged reads others as zero.  */
         return 0;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_mrs)(CPUARMState *env, uint32_t reg)
     case 0 ... 7: /* xPSR sub-fields */
         return v7m_mrs_xpsr(env, reg, el);
     case 20: /* CONTROL */
-        return v7m_mrs_control(env, env->v7m.secure);
+        return arm_v7m_mrs_control(env, env->v7m.secure);
     case 0x94: /* CONTROL_NS */
         /*
          * We have to handle this here because unprivileged Secure code
-- 
2.34.1

From: David Reiss <dreiss@meta.com>

Allow the function to be used outside of m_helper.c.
Move to be outside of ifndef CONFIG_USER_ONLY block.
Rename from get_v7m_sp_ptr.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: David Reiss <dreiss@meta.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-14-richard.henderson@linaro.org
[rth: Split out of a larger patch]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h    | 10 +++++
 target/arm/tcg/m_helper.c | 84 +++++++++++++++++++--------------------
 2 files changed, 51 insertions(+), 43 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
 /* Read the CONTROL register as the MRS instruction would. */
 uint32_t arm_v7m_mrs_control(CPUARMState *env, uint32_t secure);
 
+/*
+ * Return a pointer to the location where we currently store the
+ * stack pointer for the requested security state and thread mode.
+ * This pointer will become invalid if the CPU state is updated
+ * such that the stack pointers are switched around (eg changing
+ * the SPSEL control bit).
+ */
+uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure,
+                             bool threadmode, bool spsel);
+
 #ifdef CONFIG_USER_ONLY
 static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
 #else
diff --git a/target/arm/tcg/m_helper.c b/target/arm/tcg/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/m_helper.c
+++ b/target/arm/tcg/m_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_blxns)(CPUARMState *env, uint32_t dest)
     arm_rebuild_hflags(env);
 }
 
-static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
-                                bool spsel)
-{
-    /*
-     * Return a pointer to the location where we currently store the
-     * stack pointer for the requested security state and thread mode.
-     * This pointer will become invalid if the CPU state is updated
-     * such that the stack pointers are switched around (eg changing
-     * the SPSEL control bit).
-     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
-     * Unlike that pseudocode, we require the caller to pass us in the
-     * SPSEL control bit value; this is because we also use this
-     * function in handling of pushing of the callee-saves registers
-     * part of the v8M stack frame (pseudocode PushCalleeStack()),
-     * and in the tailchain codepath the SPSEL bit comes from the exception
-     * return magic LR value from the previous exception. The pseudocode
-     * opencodes the stack-selection in PushCalleeStack(), but we prefer
-     * to make this utility function generic enough to do the job.
-     */
-    bool want_psp = threadmode && spsel;
-
-    if (secure == env->v7m.secure) {
-        if (want_psp == v7m_using_psp(env)) {
-            return &env->regs[13];
-        } else {
-            return &env->v7m.other_sp;
-        }
-    } else {
-        if (want_psp) {
-            return &env->v7m.other_ss_psp;
-        } else {
-            return &env->v7m.other_ss_msp;
-        }
-    }
-}
-
 static bool arm_v7m_load_vector(ARMCPU *cpu, int exc, bool targets_secure,
                                 uint32_t *pvec)
 {
@@ -XXX,XX +XXX,XX @@ static bool v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain,
             !mode;
 
         mmu_idx = arm_v7m_mmu_idx_for_secstate_and_priv(env, M_REG_S, priv);
-        frame_sp_p = get_v7m_sp_ptr(env, M_REG_S, mode,
-                                    lr & R_V7M_EXCRET_SPSEL_MASK);
+        frame_sp_p = arm_v7m_get_sp_ptr(env, M_REG_S, mode,
+                                        lr & R_V7M_EXCRET_SPSEL_MASK);
         want_psp = mode && (lr & R_V7M_EXCRET_SPSEL_MASK);
         if (want_psp) {
             limit = env->v7m.psplim[M_REG_S];
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          * use 'frame_sp_p' after we do something that makes it invalid.
          */
         bool spsel = env->v7m.control[return_to_secure] & R_V7M_CONTROL_SPSEL_MASK;
-        uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
-                                              return_to_secure,
-                                              !return_to_handler,
-                                              spsel);
+        uint32_t *frame_sp_p = arm_v7m_get_sp_ptr(env, return_to_secure,
+                                                  !return_to_handler, spsel);
         uint32_t frameptr = *frame_sp_p;
         bool pop_ok = true;
         ARMMMUIdx mmu_idx;
@@ -XXX,XX +XXX,XX @@ static bool do_v7m_function_return(ARMCPU *cpu)
         threadmode = !arm_v7m_is_handler_mode(env);
         spsel = env->v7m.control[M_REG_S] & R_V7M_CONTROL_SPSEL_MASK;
 
-        frame_sp_p = get_v7m_sp_ptr(env, true, threadmode, spsel);
+        frame_sp_p = arm_v7m_get_sp_ptr(env, true, threadmode, spsel);
         frameptr = *frame_sp_p;
 
         /*
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
 }
 
 #endif /* !CONFIG_USER_ONLY */
+
+uint32_t *arm_v7m_get_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
+                             bool spsel)
+{
+    /*
+     * Return a pointer to the location where we currently store the
+     * stack pointer for the requested security state and thread mode.
+     * This pointer will become invalid if the CPU state is updated
+     * such that the stack pointers are switched around (eg changing
+     * the SPSEL control bit).
+     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
+     * Unlike that pseudocode, we require the caller to pass us in the
+     * SPSEL control bit value; this is because we also use this
+     * function in handling of pushing of the callee-saves registers
+     * part of the v8M stack frame (pseudocode PushCalleeStack()),
+     * and in the tailchain codepath the SPSEL bit comes from the exception
+     * return magic LR value from the previous exception. The pseudocode
+     * opencodes the stack-selection in PushCalleeStack(), but we prefer
+     * to make this utility function generic enough to do the job.
+     */
+    bool want_psp = threadmode && spsel;
+
+    if (secure == env->v7m.secure) {
+        if (want_psp == v7m_using_psp(env)) {
+            return &env->regs[13];
+        } else {
+            return &env->v7m.other_sp;
+        }
+    } else {
+        if (want_psp) {
+            return &env->v7m.other_ss_psp;
+        } else {
+            return &env->v7m.other_ss_msp;
+        }
+    }
+}
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

The upstream gdb xml only implements {MSP,PSP}{,_NS,S}, but
go ahead and implement the other system registers as well.

Since there is significant overlap between the two, implement
them with common code.  The only exception is the systemreg
view of CONTROL, which merges the banked bits as per MRS.

Signed-off-by: David Reiss <dreiss@meta.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227213329.793795-15-richard.henderson@linaro.org
[rth: Substatial rewrite using enumerator and shared code.]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     |   2 +
 target/arm/gdbstub.c | 178 +++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 180 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
 
     DynamicGDBXMLInfo dyn_sysreg_xml;
     DynamicGDBXMLInfo dyn_svereg_xml;
+    DynamicGDBXMLInfo dyn_m_systemreg_xml;
+    DynamicGDBXMLInfo dyn_m_secextreg_xml;
 
     /* Timers used by the generic (architected) timer */
     QEMUTimer *gt_timer[NUM_GTIMERS];
diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static int arm_gen_dynamic_sysreg_xml(CPUState *cs, int base_reg)
     return cpu->dyn_sysreg_xml.num;
 }
 
+typedef enum {
+    M_SYSREG_MSP,
+    M_SYSREG_PSP,
+    M_SYSREG_PRIMASK,
+    M_SYSREG_CONTROL,
+    M_SYSREG_BASEPRI,
+    M_SYSREG_FAULTMASK,
+    M_SYSREG_MSPLIM,
+    M_SYSREG_PSPLIM,
+} MProfileSysreg;
+
+static const struct {
+    const char *name;
+    int feature;
+} m_sysreg_def[] = {
+    [M_SYSREG_MSP] = { "msp", ARM_FEATURE_M },
+    [M_SYSREG_PSP] = { "psp", ARM_FEATURE_M },
+    [M_SYSREG_PRIMASK] = { "primask", ARM_FEATURE_M },
+    [M_SYSREG_CONTROL] = { "control", ARM_FEATURE_M },
+    [M_SYSREG_BASEPRI] = { "basepri", ARM_FEATURE_M_MAIN },
+    [M_SYSREG_FAULTMASK] = { "faultmask", ARM_FEATURE_M_MAIN },
+    [M_SYSREG_MSPLIM] = { "msplim", ARM_FEATURE_V8 },
+    [M_SYSREG_PSPLIM] = { "psplim", ARM_FEATURE_V8 },
+};
+
+static uint32_t *m_sysreg_ptr(CPUARMState *env, MProfileSysreg reg, bool sec)
+{
+    uint32_t *ptr;
+
+    switch (reg) {
+    case M_SYSREG_MSP:
+        ptr = arm_v7m_get_sp_ptr(env, sec, false, true);
+        break;
+    case M_SYSREG_PSP:
+        ptr = arm_v7m_get_sp_ptr(env, sec, true, true);
+        break;
+    case M_SYSREG_MSPLIM:
+        ptr = &env->v7m.msplim[sec];
+        break;
+    case M_SYSREG_PSPLIM:
+        ptr = &env->v7m.psplim[sec];
+        break;
+    case M_SYSREG_PRIMASK:
+        ptr = &env->v7m.primask[sec];
+        break;
+    case M_SYSREG_BASEPRI:
+        ptr = &env->v7m.basepri[sec];
+        break;
+    case M_SYSREG_FAULTMASK:
+        ptr = &env->v7m.faultmask[sec];
+        break;
+    case M_SYSREG_CONTROL:
+        ptr = &env->v7m.control[sec];
+        break;
+    default:
+        return NULL;
+    }
+    return arm_feature(env, m_sysreg_def[reg].feature) ? ptr : NULL;
+}
+
+static int m_sysreg_get(CPUARMState *env, GByteArray *buf,
+                        MProfileSysreg reg, bool secure)
+{
+    uint32_t *ptr = m_sysreg_ptr(env, reg, secure);
+
+    if (ptr == NULL) {
+        return 0;
+    }
+    return gdb_get_reg32(buf, *ptr);
+}
+
+static int arm_gdb_get_m_systemreg(CPUARMState *env, GByteArray *buf, int reg)
+{
+    /*
+     * Here, we emulate MRS instruction, where CONTROL has a mix of
+     * banked and non-banked bits.
+     */
+    if (reg == M_SYSREG_CONTROL) {
+        return gdb_get_reg32(buf, arm_v7m_mrs_control(env, env->v7m.secure));
+    }
+    return m_sysreg_get(env, buf, reg, env->v7m.secure);
+}
+
+static int arm_gdb_set_m_systemreg(CPUARMState *env, uint8_t *buf, int reg)
+{
+    return 0; /* TODO */
+}
+
+static int arm_gen_dynamic_m_systemreg_xml(CPUState *cs, int orig_base_reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    GString *s = g_string_new(NULL);
+    int base_reg = orig_base_reg;
+    int i;
+
+    g_string_printf(s, "<?xml version=\"1.0\"?>");
+    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
+    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.arm.m-system\">\n");
+
+    for (i = 0; i < ARRAY_SIZE(m_sysreg_def); i++) {
+        if (arm_feature(env, m_sysreg_def[i].feature)) {
+            g_string_append_printf(s,
+                "<reg name=\"%s\" bitsize=\"32\" regnum=\"%d\"/>\n",
+                m_sysreg_def[i].name, base_reg++);
+        }
+    }
+
+    g_string_append_printf(s, "</feature>");
+    cpu->dyn_m_systemreg_xml.desc = g_string_free(s, false);
+    cpu->dyn_m_systemreg_xml.num = base_reg - orig_base_reg;
+
+    return cpu->dyn_m_systemreg_xml.num;
+}
+
+#ifndef CONFIG_USER_ONLY
+/*
+ * For user-only, we see the non-secure registers via m_systemreg above.
+ * For secext, encode the non-secure view as even and secure view as odd.
+ */
+static int arm_gdb_get_m_secextreg(CPUARMState *env, GByteArray *buf, int reg)
+{
+    return m_sysreg_get(env, buf, reg >> 1, reg & 1);
+}
+
+static int arm_gdb_set_m_secextreg(CPUARMState *env, uint8_t *buf, int reg)
+{
+    return 0; /* TODO */
+}
+
+static int arm_gen_dynamic_m_secextreg_xml(CPUState *cs, int orig_base_reg)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    GString *s = g_string_new(NULL);
+    int base_reg = orig_base_reg;
+    int i;
+
+    g_string_printf(s, "<?xml version=\"1.0\"?>");
+    g_string_append_printf(s, "<!DOCTYPE target SYSTEM \"gdb-target.dtd\">");
+    g_string_append_printf(s, "<feature name=\"org.gnu.gdb.arm.secext\">\n");
+
+    for (i = 0; i < ARRAY_SIZE(m_sysreg_def); i++) {
+        g_string_append_printf(s,
+            "<reg name=\"%s_ns\" bitsize=\"32\" regnum=\"%d\"/>\n",
+            m_sysreg_def[i].name, base_reg++);
+        g_string_append_printf(s,
+            "<reg name=\"%s_s\" bitsize=\"32\" regnum=\"%d\"/>\n",
+            m_sysreg_def[i].name, base_reg++);
+    }
+
+    g_string_append_printf(s, "</feature>");
+    cpu->dyn_m_secextreg_xml.desc = g_string_free(s, false);
+    cpu->dyn_m_secextreg_xml.num = base_reg - orig_base_reg;
+
+    return cpu->dyn_m_secextreg_xml.num;
+}
+#endif
+
 const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
 {
     ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ const char *arm_gdb_get_dynamic_xml(CPUState *cs, const char *xmlname)
         return cpu->dyn_sysreg_xml.desc;
     } else if (strcmp(xmlname, "sve-registers.xml") == 0) {
         return cpu->dyn_svereg_xml.desc;
+    } else if (strcmp(xmlname, "arm-m-system.xml") == 0) {
+        return cpu->dyn_m_systemreg_xml.desc;
+#ifndef CONFIG_USER_ONLY
+    } else if (strcmp(xmlname, "arm-m-secext.xml") == 0) {
+        return cpu->dyn_m_secextreg_xml.desc;
+#endif
     }
     return NULL;
 }
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                              arm_gen_dynamic_sysreg_xml(cs, cs->gdb_num_regs),
                              "system-registers.xml", 0);
 
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        gdb_register_coprocessor(cs,
+            arm_gdb_get_m_systemreg, arm_gdb_set_m_systemreg,
+            arm_gen_dynamic_m_systemreg_xml(cs, cs->gdb_num_regs),
+            "arm-m-system.xml", 0);
+#ifndef CONFIG_USER_ONLY
+        if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+            gdb_register_coprocessor(cs,
+                arm_gdb_get_m_secextreg, arm_gdb_set_m_secextreg,
+                arm_gen_dynamic_m_secextreg_xml(cs, cs->gdb_num_regs),
+                "arm-m-secext.xml", 0);
+        }
+#endif
+    }
 }
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

M-profile doesn't have HCR_EL2.  While we could test features
before each call, zero is a generally safe return value to
disable the code in the caller.  This test is required to
avoid an assert in arm_is_secure_below_el3.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227225832.816605-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, bool secure)
 
 uint64_t arm_hcr_el2_eff(CPUARMState *env)
 {
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return 0;
+    }
     return arm_hcr_el2_eff_secstate(env, arm_is_secure_below_el3(env));
 }
 
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

In several places we use arm_is_secure_below_el3 and
arm_is_el3_or_mon separately from arm_is_secure.
These functions make no sense for m-profile, and
would indicate prior incorrect feature testing.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227225832.816605-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline int arm_feature(CPUARMState *env, int feature)
 void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
 
 #if !defined(CONFIG_USER_ONLY)
-/* Return true if exception levels below EL3 are in secure state,
+/*
+ * Return true if exception levels below EL3 are in secure state,
  * or would be following an exception return to that level.
  * Unlike arm_is_secure() (which is always a question about the
  * _current_ state of the CPU) this doesn't care about the current
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
  */
 static inline bool arm_is_secure_below_el3(CPUARMState *env)
 {
+    assert(!arm_feature(env, ARM_FEATURE_M));
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         return !(env->cp15.scr_el3 & SCR_NS);
     } else {
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure_below_el3(CPUARMState *env)
 /* Return true if the CPU is AArch64 EL3 or AArch32 Mon */
 static inline bool arm_is_el3_or_mon(CPUARMState *env)
 {
+    assert(!arm_feature(env, ARM_FEATURE_M));
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         if (is_a64(env) && extract32(env->pstate, 2, 2) == 3) {
             /* CPU currently in AArch64 state and EL3 */
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Integrate neighboring code from get_phys_addr_lpae which computed
starting level, as it is easier to validate when doing both at the
same time.  Mirror the checks at the start of AArch{64,32}.S2Walk,
especially S2InvalidSL and S2InconsistentSL.

This reverts 49ba115bb74, which was incorrect -- there is nothing
in the ARM pseudocode that depends on TxSZ, i.e. outputsize; the
pseudocode is consistent in referencing PAMax.

Fixes: 49ba115bb74 ("target/arm: Pass outputsize down to check_s2_mmu_setup")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230227225832.816605-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 173 ++++++++++++++++++++++++++---------------------
 1 file changed, 97 insertions(+), 76 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
  * check_s2_mmu_setup
  * @cpu:        ARMCPU
  * @is_aa64:    True if the translation regime is in AArch64 state
- * @startlevel: Suggested starting level
- * @inputsize:  Bitsize of IPAs
+ * @tcr:        VTCR_EL2 or VSTCR_EL2
+ * @ds:         Effective value of TCR.DS.
+ * @iasize:     Bitsize of IPAs
  * @stride:     Page-table stride (See the ARM ARM)
  *
- * Returns true if the suggested S2 translation parameters are OK and
- * false otherwise.
+ * Decode the starting level of the S2 lookup, returning INT_MIN if
+ * the configuration is invalid.
  */
-static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
-                               int inputsize, int stride, int outputsize)
+static int check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, uint64_t tcr,
+                              bool ds, int iasize, int stride)
 {
-    const int grainsize = stride + 3;
-    int startsizecheck;
-
-    /*
-     * Negative levels are usually not allowed...
-     * Except for FEAT_LPA2, 4k page table, 52-bit address space, which
-     * begins with level -1.  Note that previous feature tests will have
-     * eliminated this combination if it is not enabled.
-     */
-    if (level < (inputsize == 52 && stride == 9 ? -1 : 0)) {
-        return false;
-    }
-
-    startsizecheck = inputsize - ((3 - level) * stride + grainsize);
-    if (startsizecheck < 1 || startsizecheck > stride + 4) {
-        return false;
-    }
+    int sl0, sl2, startlevel, granulebits, levels;
+    int s1_min_iasize, s1_max_iasize;
 
+    sl0 = extract32(tcr, 6, 2);
     if (is_aa64) {
+        /*
+         * AArch64.S2InvalidTxSZ: While we checked tsz_oob near the top of
+         * get_phys_addr_lpae, that used aa64_va_parameters which apply
+         * to aarch64.  If Stage1 is aarch32, the min_txsz is larger.
+         * See AArch64.S2MinTxSZ, where min_tsz is 24, translated to
+         * inputsize is 64 - 24 = 40.
+         */
+        if (iasize < 40 && !arm_el_is_aa64(&cpu->env, 1)) {
+            goto fail;
+        }
+
+        /*
+         * AArch64.S2InvalidSL: Interpretation of SL depends on the page size,
+         * so interleave AArch64.S2StartLevel.
+         */
         switch (stride) {
-        case 13: /* 64KB Pages.  */
-            if (level == 0 || (level == 1 && outputsize <= 42)) {
-                return false;
+        case 9: /* 4KB */
+            /* SL2 is RES0 unless DS=1 & 4KB granule. */
+            sl2 = extract64(tcr, 33, 1);
+            if (ds && sl2) {
+                if (sl0 != 0) {
+                    goto fail;
+                }
+                startlevel = -1;
+            } else {
+                startlevel = 2 - sl0;
+                switch (sl0) {
+                case 2:
+                    if (arm_pamax(cpu) < 44) {
+                        goto fail;
+                    }
+                    break;
+                case 3:
+                    if (!cpu_isar_feature(aa64_st, cpu)) {
+                        goto fail;
+                    }
+                    startlevel = 3;
+                    break;
+                }
             }
             break;
-        case 11: /* 16KB Pages.  */
-            if (level == 0 || (level == 1 && outputsize <= 40)) {
-                return false;
+        case 11: /* 16KB */
+            switch (sl0) {
+            case 2:
+                if (arm_pamax(cpu) < 42) {
+                    goto fail;
+                }
+                break;
+            case 3:
+                if (!ds) {
+                    goto fail;
+                }
+                break;
             }
+            startlevel = 3 - sl0;
             break;
-        case 9: /* 4KB Pages.  */
-            if (level == 0 && outputsize <= 42) {
-                return false;
+        case 13: /* 64KB */
+            switch (sl0) {
+            case 2:
+                if (arm_pamax(cpu) < 44) {
+                    goto fail;
+                }
+                break;
+            case 3:
+                goto fail;
             }
+            startlevel = 3 - sl0;
             break;
         default:
             g_assert_not_reached();
         }
-
-        /* Inputsize checks.  */
-        if (inputsize > outputsize &&
-            (arm_el_is_aa64(&cpu->env, 1) || inputsize > 40)) {
-            /* This is CONSTRAINED UNPREDICTABLE and we choose to fault.  */
-            return false;
-        }
     } else {
-        /* AArch32 only supports 4KB pages. Assert on that.  */
+        /*
+         * Things are simpler for AArch32 EL2, with only 4k pages.
+         * There is no separate S2InvalidSL function, but AArch32.S2Walk
+         * begins with walkparms.sl0 in {'1x'}.
+         */
         assert(stride == 9);
-
-        if (level == 0) {
-            return false;
+        if (sl0 >= 2) {
+            goto fail;
         }
+        startlevel = 2 - sl0;
     }
-    return true;
+
+    /* AArch{64,32}.S2InconsistentSL are functionally equivalent.  */
+    levels = 3 - startlevel;
+    granulebits = stride + 3;
+
+    s1_min_iasize = levels * stride + granulebits + 1;
+    s1_max_iasize = s1_min_iasize + (stride - 1) + 4;
+
+    if (iasize >= s1_min_iasize && iasize <= s1_max_iasize) {
+        return startlevel;
+    }
+
+ fail:
+    return INT_MIN;
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          */
         level = 4 - (inputsize - 4) / stride;
     } else {
-        /*
-         * For stage 2 translations the starting level is specified by the
-         * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
-         */
-        uint32_t sl0 = extract32(tcr, 6, 2);
-        uint32_t sl2 = extract64(tcr, 33, 1);
-        int32_t startlevel;
-        bool ok;
-
-        /* SL2 is RES0 unless DS=1 & 4kb granule. */
-        if (param.ds && stride == 9 && sl2) {
-            if (sl0 != 0) {
-                level = 0;
-                goto do_translation_fault;
-            }
-            startlevel = -1;
-        } else if (!aarch64 || stride == 9) {
-            /* AArch32 or 4KB pages */
-            startlevel = 2 - sl0;
-
-            if (cpu_isar_feature(aa64_st, cpu)) {
-                startlevel &= 3;
-            }
-        } else {
-            /* 16KB or 64KB pages */
-            startlevel = 3 - sl0;
-        }
-
-        /* Check that the starting level is valid. */
-        ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
-                                inputsize, stride, outputsize);
-        if (!ok) {
+        int startlevel = check_s2_mmu_setup(cpu, aarch64, tcr, param.ds,
+                                            inputsize, stride);
+        if (startlevel == INT_MIN) {
+            level = 0;
             goto do_translation_fault;
         }
         level = startlevel;
-- 
2.34.1

From: Ard Biesheuvel <ardb@kernel.org>

Fedora 39 will ship its arm64 kernels in the new generic EFI zboot
format, using gzip compression for the payload.

For doing EFI boot in QEMU, this is completely transparent, as the
firmware or bootloader will take care of this. However, for direct
kernel boot without firmware, we will lose the ability to boot such
distro kernels unless we deal with the new format directly.

EFI zboot images contain metadata in the header regarding the placement
of the compressed payload inside the image, and the type of compression
used. This means we can wire up the existing gzip support without too
much hassle, by parsing the header and grabbing the payload from inside
the loaded zboot image.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Alex Bennée <alex.bennee@linaro.org>
Cc: Richard Henderson <richard.henderson@linaro.org>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
Message-id: 20230303160109.3626966-1-ardb@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: tweaked comment formatting, fixed checkpatch nits]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/loader.h | 19 ++++++++++
 hw/arm/boot.c       |  6 +++
 hw/core/loader.c    | 91 +++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 116 insertions(+)

diff --git a/include/hw/loader.h b/include/hw/loader.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/loader.h
+++ b/include/hw/loader.h
@@ -XXX,XX +XXX,XX @@ ssize_t load_image_gzipped_buffer(const char *filename, uint64_t max_sz,
                                   uint8_t **buffer);
 ssize_t load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz);
 
+/**
+ * unpack_efi_zboot_image:
+ * @buffer: pointer to a variable holding the address of a buffer containing the
+ *          image
+ * @size: pointer to a variable holding the size of the buffer
+ *
+ * Check whether the buffer contains a EFI zboot image, and if it does, extract
+ * the compressed payload and decompress it into a new buffer. If successful,
+ * the old buffer is freed, and the *buffer and size variables pointed to by the
+ * function arguments are updated to refer to the newly populated buffer.
+ *
+ * Returns 0 if the image could not be identified as a EFI zboot image.
+ * Returns -1 if the buffer contents were identified as a EFI zboot image, but
+ * unpacking failed for any reason.
+ * Returns the size of the decompressed payload if decompression was performed
+ * successfully.
+ */
+ssize_t unpack_efi_zboot_image(uint8_t **buffer, int *size);
+
 #define ELF_LOAD_FAILED       -1
 #define ELF_LOAD_NOT_ELF      -2
 #define ELF_LOAD_WRONG_ARCH   -3
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static uint64_t load_aarch64_image(const char *filename, hwaddr mem_base,
             return -1;
         }
         size = len;
+
+        /* Unpack the image if it is a EFI zboot image */
+        if (unpack_efi_zboot_image(&buffer, &size) < 0) {
+            g_free(buffer);
+            return -1;
+        }
     }
 
     /* check the arm64 magic header value -- very old kernels may not have it */
diff --git a/hw/core/loader.c b/hw/core/loader.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -XXX,XX +XXX,XX @@ ssize_t load_image_gzipped(const char *filename, hwaddr addr, uint64_t max_sz)
     return bytes;
 }
 
+/* The PE/COFF MS-DOS stub magic number */
+#define EFI_PE_MSDOS_MAGIC        "MZ"
+
+/*
+ * The Linux header magic number for a EFI PE/COFF
+ * image targetting an unspecified architecture.
+ */
+#define EFI_PE_LINUX_MAGIC        "\xcd\x23\x82\x81"
+
+/*
+ * Bootable Linux kernel images may be packaged as EFI zboot images, which are
+ * self-decompressing executables when loaded via EFI. The compressed payload
+ * can also be extracted from the image and decompressed by a non-EFI loader.
+ *
+ * The de facto specification for this format is at the following URL:
+ *
+ * https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/firmware/efi/libstub/zboot-header.S
+ *
+ * This definition is based on Linux upstream commit 29636a5ce87beba.
+ */
+struct linux_efi_zboot_header {
+    uint8_t     msdos_magic[2];         /* PE/COFF 'MZ' magic number */
+    uint8_t     reserved0[2];
+    uint8_t     zimg[4];                /* "zimg" for Linux EFI zboot images */
+    uint32_t    payload_offset;         /* LE offset to compressed payload */
+    uint32_t    payload_size;           /* LE size of the compressed payload */
+    uint8_t     reserved1[8];
+    char        compression_type[32];   /* Compression type, NUL terminated */
+    uint8_t     linux_magic[4];         /* Linux header magic */
+    uint32_t    pe_header_offset;       /* LE offset to the PE header */
+};
+
+/*
+ * Check whether *buffer points to a Linux EFI zboot image in memory.
+ *
+ * If it does, attempt to decompress it to a new buffer, and free the old one.
+ * If any of this fails, return an error to the caller.
+ *
+ * If the image is not a Linux EFI zboot image, do nothing and return success.
+ */
+ssize_t unpack_efi_zboot_image(uint8_t **buffer, int *size)
+{
+    const struct linux_efi_zboot_header *header;
+    uint8_t *data = NULL;
+    int ploff, plsize;
+    ssize_t bytes;
+
+    /* ignore if this is too small to be a EFI zboot image */
+    if (*size < sizeof(*header)) {
+        return 0;
+    }
+
+    header = (struct linux_efi_zboot_header *)*buffer;
+
+    /* ignore if this is not a Linux EFI zboot image */
+    if (memcmp(&header->msdos_magic, EFI_PE_MSDOS_MAGIC, 2) != 0 ||
+        memcmp(&header->zimg, "zimg", 4) != 0 ||
+        memcmp(&header->linux_magic, EFI_PE_LINUX_MAGIC, 4) != 0) {
+        return 0;
+    }
+
+    if (strcmp(header->compression_type, "gzip") != 0) {
+        fprintf(stderr,
+                "unable to handle EFI zboot image with \"%.*s\" compression\n",
+                (int)sizeof(header->compression_type) - 1,
+                header->compression_type);
+        return -1;
+    }
+
+    ploff = ldl_le_p(&header->payload_offset);
+    plsize = ldl_le_p(&header->payload_size);
+
+    if (ploff < 0 || plsize < 0 || ploff + plsize > *size) {
+        fprintf(stderr, "unable to handle corrupt EFI zboot image\n");
+        return -1;
+    }
+
+    data = g_malloc(LOAD_IMAGE_MAX_GUNZIP_BYTES);
+    bytes = gunzip(data, LOAD_IMAGE_MAX_GUNZIP_BYTES, *buffer + ploff, plsize);
+    if (bytes < 0) {
+        fprintf(stderr, "failed to decompress EFI zboot image\n");
+        g_free(data);
+        return -1;
+    }
+
+    g_free(*buffer);
+    *buffer = g_realloc(data, bytes);
+    *size = bytes;
+    return bytes;
+}
+
 /*
  * Functions for reboot-persistent memory regions.
  *  - used for vga bios and option roms.
-- 
2.34.1

From: qianfan Zhao <qianfanguijin@163.com>

TWI_CNTR_INT_FLAG is W1C(write 1 to clear and write 0 has non-effect)
register on SUN6i based SoCs, we should lower interrupt when the guest
set this bit.

The linux kernel will hang in irq handler(mv64xxx_i2c_intr) if no
device connected on the i2c bus, next is the trace log:

allwinner_i2c_write write   CNTR(0x0c): 0xc4 A_ACK BUS_EN INT_EN
allwinner_i2c_write write   CNTR(0x0c): 0xcc A_ACK INT_FLAG BUS_EN INT_EN
allwinner_i2c_read  read    CNTR(0x0c): 0xcc A_ACK INT_FLAG BUS_EN INT_EN
allwinner_i2c_read  read    STAT(0x10): 0x20 STAT_M_ADDR_WR_NACK
allwinner_i2c_write write   CNTR(0x0c): 0x54 A_ACK M_STP BUS_EN
allwinner_i2c_write write   CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
allwinner_i2c_read  read    CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
allwinner_i2c_read  read    STAT(0x10): 0xf8 STAT_IDLE
allwinner_i2c_write write   CNTR(0x0c): 0x54 A_ACK M_STP BUS_EN
allwinner_i2c_write write   CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
allwinner_i2c_read  read    CNTR(0x0c): 0x4c A_ACK INT_FLAG BUS_EN
allwinner_i2c_read  read    STAT(0x10): 0xf8 STAT_IDLE
...

Fix it.

Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
Tested-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/i2c/allwinner-i2c.h |  6 ++++++
 hw/i2c/allwinner-i2c.c         | 26 ++++++++++++++++++++++++--
 2 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/include/hw/i2c/allwinner-i2c.h b/include/hw/i2c/allwinner-i2c.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i2c/allwinner-i2c.h
+++ b/include/hw/i2c/allwinner-i2c.h
@@ -XXX,XX +XXX,XX @@
 #include "qom/object.h"
 
 #define TYPE_AW_I2C "allwinner.i2c"
+
+/** Allwinner I2C sun6i family and newer (A31, H2+, H3, etc) */
+#define TYPE_AW_I2C_SUN6I    TYPE_AW_I2C "-sun6i"
+
 OBJECT_DECLARE_SIMPLE_TYPE(AWI2CState, AW_I2C)
 
 #define AW_I2C_MEM_SIZE         0x24
@@ -XXX,XX +XXX,XX @@ struct AWI2CState {
     uint8_t srst;
     uint8_t efr;
     uint8_t lcr;
+
+    bool irq_clear_inverted;
 };
 
 #endif /* ALLWINNER_I2C_H */
diff --git a/hw/i2c/allwinner-i2c.c b/hw/i2c/allwinner-i2c.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/allwinner-i2c.c
+++ b/hw/i2c/allwinner-i2c.c
@@ -XXX,XX +XXX,XX @@ static void allwinner_i2c_write(void *opaque, hwaddr offset,
                 s->stat = STAT_FROM_STA(STAT_IDLE);
                 s->cntr &= ~TWI_CNTR_M_STP;
             }
-            if ((s->cntr & TWI_CNTR_INT_FLAG) == 0) {
-                /* Interrupt flag cleared */
+
+            if (!s->irq_clear_inverted && !(s->cntr & TWI_CNTR_INT_FLAG)) {
+                /* Write 0 to clear this flag */
+                qemu_irq_lower(s->irq);
+            } else if (s->irq_clear_inverted && (s->cntr & TWI_CNTR_INT_FLAG)) {
+                /* Write 1 to clear this flag */
+                s->cntr &= ~TWI_CNTR_INT_FLAG;
                 qemu_irq_lower(s->irq);
             }
+
             if ((s->cntr & TWI_CNTR_A_ACK) == 0) {
                 if (STAT_TO_STA(s->stat) == STAT_M_DATA_RX_ACK) {
                     s->stat = STAT_FROM_STA(STAT_M_DATA_RX_NACK);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo allwinner_i2c_type_info = {
     .class_init = allwinner_i2c_class_init,
 };
 
+static void allwinner_i2c_sun6i_init(Object *obj)
+{
+    AWI2CState *s = AW_I2C(obj);
+
+    s->irq_clear_inverted = true;
+}
+
+static const TypeInfo allwinner_i2c_sun6i_type_info = {
+    .name = TYPE_AW_I2C_SUN6I,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(AWI2CState),
+    .instance_init = allwinner_i2c_sun6i_init,
+    .class_init = allwinner_i2c_class_init,
+};
+
 static void allwinner_i2c_register_types(void)
 {
     type_register_static(&allwinner_i2c_type_info);
+    type_register_static(&allwinner_i2c_sun6i_type_info);
 }
 
 type_init(allwinner_i2c_register_types)
-- 
2.34.1

From: qianfan Zhao <qianfanguijin@163.com>

Allwinner h3 has 4 twi(i2c) devices named twi0, twi1, twi2 and r_twi.
The registers are compatible with TYPE_AW_I2C_SUN6I, write 1 to clear
control register's INT_FLAG bit.

Signed-off-by: qianfan Zhao <qianfanguijin@163.com>
Reviewed-by: Strahinja Jankovic <strahinja.p.jankovic@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/allwinner-h3.h |  6 ++++++
 hw/arm/allwinner-h3.c         | 29 +++++++++++++++++++++++++----
 2 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/include/hw/arm/allwinner-h3.h b/include/hw/arm/allwinner-h3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/allwinner-h3.h
+++ b/include/hw/arm/allwinner-h3.h
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_DEV_UART3,
     AW_H3_DEV_EMAC,
     AW_H3_DEV_TWI0,
+    AW_H3_DEV_TWI1,
+    AW_H3_DEV_TWI2,
     AW_H3_DEV_DRAMCOM,
     AW_H3_DEV_DRAMCTL,
     AW_H3_DEV_DRAMPHY,
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_DEV_GIC_VCPU,
     AW_H3_DEV_RTC,
     AW_H3_DEV_CPUCFG,
+    AW_H3_DEV_R_TWI,
     AW_H3_DEV_SDRAM
 };
 
@@ -XXX,XX +XXX,XX @@ struct AwH3State {
     AwSidState sid;
     AwSdHostState mmc0;
     AWI2CState i2c0;
+    AWI2CState i2c1;
+    AWI2CState i2c2;
+    AWI2CState r_twi;
     AwSun8iEmacState emac;
     AwRtcState rtc;
     GICState gic;
diff --git a/hw/arm/allwinner-h3.c b/hw/arm/allwinner-h3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/allwinner-h3.c
+++ b/hw/arm/allwinner-h3.c
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
     [AW_H3_DEV_UART2]      = 0x01c28800,
     [AW_H3_DEV_UART3]      = 0x01c28c00,
     [AW_H3_DEV_TWI0]       = 0x01c2ac00,
+    [AW_H3_DEV_TWI1]       = 0x01c2b000,
+    [AW_H3_DEV_TWI2]       = 0x01c2b400,
     [AW_H3_DEV_EMAC]       = 0x01c30000,
     [AW_H3_DEV_DRAMCOM]    = 0x01c62000,
     [AW_H3_DEV_DRAMCTL]    = 0x01c63000,
@@ -XXX,XX +XXX,XX @@ const hwaddr allwinner_h3_memmap[] = {
     [AW_H3_DEV_GIC_VCPU]   = 0x01c86000,
     [AW_H3_DEV_RTC]        = 0x01f00000,
     [AW_H3_DEV_CPUCFG]     = 0x01f01c00,
+    [AW_H3_DEV_R_TWI]      = 0x01f02400,
     [AW_H3_DEV_SDRAM]      = 0x40000000
 };
 
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
     { "uart1",     0x01c28400, 1 * KiB },
     { "uart2",     0x01c28800, 1 * KiB },
     { "uart3",     0x01c28c00, 1 * KiB },
-    { "twi1",      0x01c2b000, 1 * KiB },
-    { "twi2",      0x01c2b400, 1 * KiB },
     { "scr",       0x01c2c400, 1 * KiB },
     { "gpu",       0x01c40000, 64 * KiB },
     { "hstmr",     0x01c60000, 4 * KiB },
@@ -XXX,XX +XXX,XX @@ struct AwH3Unimplemented {
     { "r_prcm",    0x01f01400, 1 * KiB },
     { "r_twd",     0x01f01800, 1 * KiB },
     { "r_cir-rx",  0x01f02000, 1 * KiB },
-    { "r_twi",     0x01f02400, 1 * KiB },
     { "r_uart",    0x01f02800, 1 * KiB },
     { "r_pio",     0x01f02c00, 1 * KiB },
     { "r_pwm",     0x01f03800, 1 * KiB },
@@ -XXX,XX +XXX,XX @@ enum {
     AW_H3_GIC_SPI_UART2     =  2,
     AW_H3_GIC_SPI_UART3     =  3,
     AW_H3_GIC_SPI_TWI0      =  6,
+    AW_H3_GIC_SPI_TWI1      =  7,
+    AW_H3_GIC_SPI_TWI2      =  8,
     AW_H3_GIC_SPI_TIMER0    = 18,
     AW_H3_GIC_SPI_TIMER1    = 19,
+    AW_H3_GIC_SPI_R_TWI     = 44,
     AW_H3_GIC_SPI_MMC0      = 60,
     AW_H3_GIC_SPI_EHCI0     = 72,
     AW_H3_GIC_SPI_OHCI0     = 73,
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_init(Object *obj)
 
     object_initialize_child(obj, "rtc", &s->rtc, TYPE_AW_RTC_SUN6I);
 
-    object_initialize_child(obj, "twi0", &s->i2c0, TYPE_AW_I2C);
+    object_initialize_child(obj, "twi0",  &s->i2c0,  TYPE_AW_I2C_SUN6I);
+    object_initialize_child(obj, "twi1",  &s->i2c1,  TYPE_AW_I2C_SUN6I);
+    object_initialize_child(obj, "twi2",  &s->i2c2,  TYPE_AW_I2C_SUN6I);
+    object_initialize_child(obj, "r_twi", &s->r_twi, TYPE_AW_I2C_SUN6I);
 }
 
 static void allwinner_h3_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void allwinner_h3_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c0), 0,
                        qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI0));
 
+    sysbus_realize(SYS_BUS_DEVICE(&s->i2c1), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c1), 0, s->memmap[AW_H3_DEV_TWI1]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c1), 0,
+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI1));
+
+    sysbus_realize(SYS_BUS_DEVICE(&s->i2c2), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->i2c2), 0, s->memmap[AW_H3_DEV_TWI2]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->i2c2), 0,
+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_TWI2));
+
+    sysbus_realize(SYS_BUS_DEVICE(&s->r_twi), &error_fatal);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->r_twi), 0, s->memmap[AW_H3_DEV_R_TWI]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->r_twi), 0,
+                       qdev_get_gpio_in(DEVICE(&s->gic), AW_H3_GIC_SPI_R_TWI));
+
     /* Unimplemented devices */
     for (i = 0; i < ARRAY_SIZE(unimplemented); i++) {
         create_unimplemented_device(unimplemented[i].device_name,
-- 
2.34.1

First arm pullreq of the cycle; this is mostly my softfloat NaN
handling series. (Lots more in my to-review queue, but I don't
like pullreqs growing too close to a hundred patches at a time :-))

thanks
-- PMM

The following changes since commit 97f2796a3736ed37a1b85dc1c76a6c45b829dd17:

Open 10.0 development tree (2024-12-10 17:41:17 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20241211

for you to fetch changes up to 1abe28d519239eea5cf9620bb13149423e5665f8:

MAINTAINERS: Add correct email address for Vikram Garhwal (2024-12-11 15:31:09 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/net/lan9118: Extract PHY model, reuse with imx_fec, fix bugs
 * fpu: Make muladd NaN handling runtime-selected, not compile-time
 * fpu: Make default NaN pattern runtime-selected, not compile-time
 * fpu: Minor NaN-related cleanups
 * MAINTAINERS: email address updates

----------------------------------------------------------------
Bernhard Beschow (5):
      hw/net/lan9118: Extract lan9118_phy
      hw/net/lan9118_phy: Reuse in imx_fec and consolidate implementations
      hw/net/lan9118_phy: Fix off-by-one error in MII_ANLPAR register
      hw/net/lan9118_phy: Reuse MII constants
      hw/net/lan9118_phy: Add missing 100 mbps full duplex advertisement

Leif Lindholm (1):
      MAINTAINERS: update email address for Leif Lindholm

Peter Maydell (54):
      fpu: handle raising Invalid for infzero in pick_nan_muladd
      fpu: Check for default_nan_mode before calling pickNaNMulAdd
      softfloat: Allow runtime choice of inf * 0 + NaN result
      tests/fp: Explicitly set inf-zero-nan rule
      target/arm: Set FloatInfZeroNaNRule explicitly
      target/s390: Set FloatInfZeroNaNRule explicitly
      target/ppc: Set FloatInfZeroNaNRule explicitly
      target/mips: Set FloatInfZeroNaNRule explicitly
      target/sparc: Set FloatInfZeroNaNRule explicitly
      target/xtensa: Set FloatInfZeroNaNRule explicitly
      target/x86: Set FloatInfZeroNaNRule explicitly
      target/loongarch: Set FloatInfZeroNaNRule explicitly
      target/hppa: Set FloatInfZeroNaNRule explicitly
      softfloat: Pass have_snan to pickNaNMulAdd
      softfloat: Allow runtime choice of NaN propagation for muladd
      tests/fp: Explicitly set 3-NaN propagation rule
      target/arm: Set Float3NaNPropRule explicitly
      target/loongarch: Set Float3NaNPropRule explicitly
      target/ppc: Set Float3NaNPropRule explicitly
      target/s390x: Set Float3NaNPropRule explicitly
      target/sparc: Set Float3NaNPropRule explicitly
      target/mips: Set Float3NaNPropRule explicitly
      target/xtensa: Set Float3NaNPropRule explicitly
      target/i386: Set Float3NaNPropRule explicitly
      target/hppa: Set Float3NaNPropRule explicitly
      fpu: Remove use_first_nan field from float_status
      target/m68k: Don't pass NULL float_status to floatx80_default_nan()
      softfloat: Create floatx80 default NaN from parts64_default_nan
      target/loongarch: Use normal float_status in fclass_s and fclass_d helpers
      target/m68k: In frem helper, initialize local float_status from env->fp_status
      target/m68k: Init local float_status from env fp_status in gdb get/set reg
      target/sparc: Initialize local scratch float_status from env->fp_status
      target/ppc: Use env->fp_status in helper_compute_fprf functions
      fpu: Allow runtime choice of default NaN value
      tests/fp: Set default NaN pattern explicitly
      target/microblaze: Set default NaN pattern explicitly
      target/i386: Set default NaN pattern explicitly
      target/hppa: Set default NaN pattern explicitly
      target/alpha: Set default NaN pattern explicitly
      target/arm: Set default NaN pattern explicitly
      target/loongarch: Set default NaN pattern explicitly
      target/m68k: Set default NaN pattern explicitly
      target/mips: Set default NaN pattern explicitly
      target/openrisc: Set default NaN pattern explicitly
      target/ppc: Set default NaN pattern explicitly
      target/sh4: Set default NaN pattern explicitly
      target/rx: Set default NaN pattern explicitly
      target/s390x: Set default NaN pattern explicitly
      target/sparc: Set default NaN pattern explicitly
      target/xtensa: Set default NaN pattern explicitly
      target/hexagon: Set default NaN pattern explicitly
      target/riscv: Set default NaN pattern explicitly
      target/tricore: Set default NaN pattern explicitly
      fpu: Remove default handling for dnan_pattern

Richard Henderson (11):
      target/arm: Copy entire float_status in is_ebf
      softfloat: Inline pickNaNMulAdd
      softfloat: Use goto for default nan case in pick_nan_muladd
      softfloat: Remove which from parts_pick_nan_muladd
      softfloat: Pad array size in pick_nan_muladd
      softfloat: Move propagateFloatx80NaN to softfloat.c
      softfloat: Use parts_pick_nan in propagateFloatx80NaN
      softfloat: Inline pickNaN
      softfloat: Share code between parts_pick_nan cases
      softfloat: Sink frac_cmp in parts_pick_nan until needed
      softfloat: Replace WHICH with RET in parts_pick_nan

Vikram Garhwal (1):
      MAINTAINERS: Add correct email address for Vikram Garhwal

From: Bernhard Beschow <shentey@gmail.com>

A very similar implementation of the same device exists in imx_fec. Prepare for
a common implementation by extracting a device model into its own files.

Some migration state has been moved into the new device model which breaks
migration compatibility for the following machines:
* smdkc210
* realview-*
* vexpress-*
* kzm
* mps2-*

While breaking migration ABI, fix the size of the MII registers to be 16 bit,
as defined by IEEE 802.3u.

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241102125724.532843-2-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/lan9118_phy.h |  37 ++++++++
 hw/net/lan9118.c             | 137 +++++-----------------------
 hw/net/lan9118_phy.c         | 169 +++++++++++++++++++++++++++++++++++
 hw/net/Kconfig               |   4 +
 hw/net/meson.build           |   1 +
 5 files changed, 233 insertions(+), 115 deletions(-)
 create mode 100644 include/hw/net/lan9118_phy.h
 create mode 100644 hw/net/lan9118_phy.c

diff --git a/include/hw/net/lan9118_phy.h b/include/hw/net/lan9118_phy.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/net/lan9118_phy.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * SMSC LAN9118 PHY emulation
+ *
+ * Copyright (c) 2009 CodeSourcery, LLC.
+ * Written by Paul Brook
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#ifndef HW_NET_LAN9118_PHY_H
+#define HW_NET_LAN9118_PHY_H
+
+#include "qom/object.h"
+#include "hw/sysbus.h"
+
+#define TYPE_LAN9118_PHY "lan9118-phy"
+OBJECT_DECLARE_SIMPLE_TYPE(Lan9118PhyState, LAN9118_PHY)
+
+typedef struct Lan9118PhyState {
+    SysBusDevice parent_obj;
+
+    uint16_t status;
+    uint16_t control;
+    uint16_t advertise;
+    uint16_t ints;
+    uint16_t int_mask;
+    qemu_irq irq;
+    bool link_down;
+} Lan9118PhyState;
+
+void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down);
+void lan9118_phy_reset(Lan9118PhyState *s);
+uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg);
+void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val);
+
+#endif
diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -XXX,XX +XXX,XX @@
 #include "net/net.h"
 #include "net/eth.h"
 #include "hw/irq.h"
+#include "hw/net/lan9118_phy.h"
 #include "hw/net/lan9118.h"
 #include "hw/ptimer.h"
 #include "hw/qdev-properties.h"
@@ -XXX,XX +XXX,XX @@ do { printf("lan9118: " fmt , ## __VA_ARGS__); } while (0)
 #define MAC_CR_RXEN     0x00000004
 #define MAC_CR_RESERVED 0x7f404213
 
-#define PHY_INT_ENERGYON            0x80
-#define PHY_INT_AUTONEG_COMPLETE    0x40
-#define PHY_INT_FAULT               0x20
-#define PHY_INT_DOWN                0x10
-#define PHY_INT_AUTONEG_LP          0x08
-#define PHY_INT_PARFAULT            0x04
-#define PHY_INT_AUTONEG_PAGE        0x02
-
 #define GPT_TIMER_EN    0x20000000
 
 /*
@@ -XXX,XX +XXX,XX @@ struct lan9118_state {
     uint32_t mac_mii_data;
     uint32_t mac_flow;
 
-    uint32_t phy_status;
-    uint32_t phy_control;
-    uint32_t phy_advertise;
-    uint32_t phy_int;
-    uint32_t phy_int_mask;
+    Lan9118PhyState mii;
+    IRQState mii_irq;
 
     int32_t eeprom_writable;
     uint8_t eeprom[128];
@@ -XXX,XX +XXX,XX @@ struct lan9118_state {
 
 static const VMStateDescription vmstate_lan9118 = {
     .name = "lan9118",
-    .version_id = 2,
-    .minimum_version_id = 1,
+    .version_id = 3,
+    .minimum_version_id = 3,
     .fields = (const VMStateField[]) {
         VMSTATE_PTIMER(timer, lan9118_state),
         VMSTATE_UINT32(irq_cfg, lan9118_state),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_lan9118 = {
         VMSTATE_UINT32(mac_mii_acc, lan9118_state),
         VMSTATE_UINT32(mac_mii_data, lan9118_state),
         VMSTATE_UINT32(mac_flow, lan9118_state),
-        VMSTATE_UINT32(phy_status, lan9118_state),
-        VMSTATE_UINT32(phy_control, lan9118_state),
-        VMSTATE_UINT32(phy_advertise, lan9118_state),
-        VMSTATE_UINT32(phy_int, lan9118_state),
-        VMSTATE_UINT32(phy_int_mask, lan9118_state),
         VMSTATE_INT32(eeprom_writable, lan9118_state),
         VMSTATE_UINT8_ARRAY(eeprom, lan9118_state, 128),
         VMSTATE_INT32(tx_fifo_size, lan9118_state),
@@ -XXX,XX +XXX,XX @@ static void lan9118_reload_eeprom(lan9118_state *s)
     lan9118_mac_changed(s);
 }
 
-static void phy_update_irq(lan9118_state *s)
+static void lan9118_update_irq(void *opaque, int n, int level)
 {
-    if (s->phy_int & s->phy_int_mask) {
+    lan9118_state *s = opaque;
+
+    if (level) {
         s->int_sts |= PHY_INT;
     } else {
         s->int_sts &= ~PHY_INT;
@@ -XXX,XX +XXX,XX @@ static void phy_update_irq(lan9118_state *s)
     lan9118_update(s);
 }
 
-static void phy_update_link(lan9118_state *s)
-{
-    /* Autonegotiation status mirrors link status.  */
-    if (qemu_get_queue(s->nic)->link_down) {
-        s->phy_status &= ~0x0024;
-        s->phy_int |= PHY_INT_DOWN;
-    } else {
-        s->phy_status |= 0x0024;
-        s->phy_int |= PHY_INT_ENERGYON;
-        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
-    }
-    phy_update_irq(s);
-}
-
 static void lan9118_set_link(NetClientState *nc)
 {
-    phy_update_link(qemu_get_nic_opaque(nc));
-}
-
-static void phy_reset(lan9118_state *s)
-{
-    s->phy_status = 0x7809;
-    s->phy_control = 0x3000;
-    s->phy_advertise = 0x01e1;
-    s->phy_int_mask = 0;
-    s->phy_int = 0;
-    phy_update_link(s);
+    lan9118_phy_update_link(&LAN9118(qemu_get_nic_opaque(nc))->mii,
+                            nc->link_down);
 }
 
 static void lan9118_reset(DeviceState *d)
@@ -XXX,XX +XXX,XX @@ static void lan9118_reset(DeviceState *d)
     s->read_word_n = 0;
     s->write_word_n = 0;
 
-    phy_reset(s);
-
     s->eeprom_writable = 0;
     lan9118_reload_eeprom(s);
 }
@@ -XXX,XX +XXX,XX @@ static void do_tx_packet(lan9118_state *s)
     uint32_t status;
 
     /* FIXME: Honor TX disable, and allow queueing of packets.  */
-    if (s->phy_control & 0x4000)  {
+    if (s->mii.control & 0x4000) {
         /* This assumes the receive routine doesn't touch the VLANClient.  */
         qemu_receive_packet(qemu_get_queue(s->nic), s->txp->data, s->txp->len);
     } else {
@@ -XXX,XX +XXX,XX @@ static void tx_fifo_push(lan9118_state *s, uint32_t val)
     }
 }
 
-static uint32_t do_phy_read(lan9118_state *s, int reg)
-{
-    uint32_t val;
-
-    switch (reg) {
-    case 0: /* Basic Control */
-        return s->phy_control;
-    case 1: /* Basic Status */
-        return s->phy_status;
-    case 2: /* ID1 */
-        return 0x0007;
-    case 3: /* ID2 */
-        return 0xc0d1;
-    case 4: /* Auto-neg advertisement */
-        return s->phy_advertise;
-    case 5: /* Auto-neg Link Partner Ability */
-        return 0x0f71;
-    case 6: /* Auto-neg Expansion */
-        return 1;
-        /* TODO 17, 18, 27, 29, 30, 31 */
-    case 29: /* Interrupt source.  */
-        val = s->phy_int;
-        s->phy_int = 0;
-        phy_update_irq(s);
-        return val;
-    case 30: /* Interrupt mask */
-        return s->phy_int_mask;
-    default:
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "do_phy_read: PHY read reg %d\n", reg);
-        return 0;
-    }
-}
-
-static void do_phy_write(lan9118_state *s, int reg, uint32_t val)
-{
-    switch (reg) {
-    case 0: /* Basic Control */
-        if (val & 0x8000) {
-            phy_reset(s);
-            break;
-        }
-        s->phy_control = val & 0x7980;
-        /* Complete autonegotiation immediately.  */
-        if (val & 0x1000) {
-            s->phy_status |= 0x0020;
-        }
-        break;
-    case 4: /* Auto-neg advertisement */
-        s->phy_advertise = (val & 0x2d7f) | 0x80;
-        break;
-        /* TODO 17, 18, 27, 31 */
-    case 30: /* Interrupt mask */
-        s->phy_int_mask = val & 0xff;
-        phy_update_irq(s);
-        break;
-    default:
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "do_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
-    }
-}
-
 static void do_mac_write(lan9118_state *s, int reg, uint32_t val)
 {
     switch (reg) {
@@ -XXX,XX +XXX,XX @@ static void do_mac_write(lan9118_state *s, int reg, uint32_t val)
         if (val & 2) {
             DPRINTF("PHY write %d = 0x%04x\n",
                     (val >> 6) & 0x1f, s->mac_mii_data);
-            do_phy_write(s, (val >> 6) & 0x1f, s->mac_mii_data);
+            lan9118_phy_write(&s->mii, (val >> 6) & 0x1f, s->mac_mii_data);
         } else {
-            s->mac_mii_data = do_phy_read(s, (val >> 6) & 0x1f);
+            s->mac_mii_data = lan9118_phy_read(&s->mii, (val >> 6) & 0x1f);
             DPRINTF("PHY read %d = 0x%04x\n",
                     (val >> 6) & 0x1f, s->mac_mii_data);
         }
@@ -XXX,XX +XXX,XX @@ static void lan9118_writel(void *opaque, hwaddr offset,
         break;
     case CSR_PMT_CTRL:
         if (val & 0x400) {
-            phy_reset(s);
+            lan9118_phy_reset(&s->mii);
         }
         s->pmt_ctrl &= ~0x34e;
         s->pmt_ctrl |= (val & 0x34e);
@@ -XXX,XX +XXX,XX @@ static void lan9118_realize(DeviceState *dev, Error **errp)
     const MemoryRegionOps *mem_ops =
             s->mode_16bit ? &lan9118_16bit_mem_ops : &lan9118_mem_ops;
 
+    qemu_init_irq(&s->mii_irq, lan9118_update_irq, s, 0);
+    object_initialize_child(OBJECT(s), "mii", &s->mii, TYPE_LAN9118_PHY);
+    if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(&s->mii), errp)) {
+        return;
+    }
+    qdev_connect_gpio_out(DEVICE(&s->mii), 0, &s->mii_irq);
+
     memory_region_init_io(&s->mmio, OBJECT(dev), mem_ops, s,
                           "lan9118-mmio", 0x100);
     sysbus_init_mmio(sbd, &s->mmio);
diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * SMSC LAN9118 PHY emulation
+ *
+ * Copyright (c) 2009 CodeSourcery, LLC.
+ * Written by Paul Brook
+ *
+ * This code is licensed under the GNU GPL v2
+ *
+ * Contributions after 2012-01-13 are licensed under the terms of the
+ * GNU GPL, version 2 or (at your option) any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/net/lan9118_phy.h"
+#include "hw/irq.h"
+#include "hw/resettable.h"
+#include "migration/vmstate.h"
+#include "qemu/log.h"
+
+#define PHY_INT_ENERGYON            (1 << 7)
+#define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
+#define PHY_INT_FAULT               (1 << 5)
+#define PHY_INT_DOWN                (1 << 4)
+#define PHY_INT_AUTONEG_LP          (1 << 3)
+#define PHY_INT_PARFAULT            (1 << 2)
+#define PHY_INT_AUTONEG_PAGE        (1 << 1)
+
+static void lan9118_phy_update_irq(Lan9118PhyState *s)
+{
+    qemu_set_irq(s->irq, !!(s->ints & s->int_mask));
+}
+
+uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
+{
+    uint16_t val;
+
+    switch (reg) {
+    case 0: /* Basic Control */
+        return s->control;
+    case 1: /* Basic Status */
+        return s->status;
+    case 2: /* ID1 */
+        return 0x0007;
+    case 3: /* ID2 */
+        return 0xc0d1;
+    case 4: /* Auto-neg advertisement */
+        return s->advertise;
+    case 5: /* Auto-neg Link Partner Ability */
+        return 0x0f71;
+    case 6: /* Auto-neg Expansion */
+        return 1;
+        /* TODO 17, 18, 27, 29, 30, 31 */
+    case 29: /* Interrupt source. */
+        val = s->ints;
+        s->ints = 0;
+        lan9118_phy_update_irq(s);
+        return val;
+    case 30: /* Interrupt mask */
+        return s->int_mask;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "lan9118_phy_read: PHY read reg %d\n", reg);
+        return 0;
+    }
+}
+
+void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
+{
+    switch (reg) {
+    case 0: /* Basic Control */
+        if (val & 0x8000) {
+            lan9118_phy_reset(s);
+            break;
+        }
+        s->control = val & 0x7980;
+        /* Complete autonegotiation immediately. */
+        if (val & 0x1000) {
+            s->status |= 0x0020;
+        }
+        break;
+    case 4: /* Auto-neg advertisement */
+        s->advertise = (val & 0x2d7f) | 0x80;
+        break;
+        /* TODO 17, 18, 27, 31 */
+    case 30: /* Interrupt mask */
+        s->int_mask = val & 0xff;
+        lan9118_phy_update_irq(s);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "lan9118_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
+    }
+}
+
+void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
+{
+    s->link_down = link_down;
+
+    /* Autonegotiation status mirrors link status. */
+    if (link_down) {
+        s->status &= ~0x0024;
+        s->ints |= PHY_INT_DOWN;
+    } else {
+        s->status |= 0x0024;
+        s->ints |= PHY_INT_ENERGYON;
+        s->ints |= PHY_INT_AUTONEG_COMPLETE;
+    }
+    lan9118_phy_update_irq(s);
+}
+
+void lan9118_phy_reset(Lan9118PhyState *s)
+{
+    s->control = 0x3000;
+    s->status = 0x7809;
+    s->advertise = 0x01e1;
+    s->int_mask = 0;
+    s->ints = 0;
+    lan9118_phy_update_link(s, s->link_down);
+}
+
+static void lan9118_phy_reset_hold(Object *obj, ResetType type)
+{
+    Lan9118PhyState *s = LAN9118_PHY(obj);
+
+    lan9118_phy_reset(s);
+}
+
+static void lan9118_phy_init(Object *obj)
+{
+    Lan9118PhyState *s = LAN9118_PHY(obj);
+
+    qdev_init_gpio_out(DEVICE(s), &s->irq, 1);
+}
+
+static const VMStateDescription vmstate_lan9118_phy = {
+    .name = "lan9118-phy",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (const VMStateField[]) {
+        VMSTATE_UINT16(control, Lan9118PhyState),
+        VMSTATE_UINT16(status, Lan9118PhyState),
+        VMSTATE_UINT16(advertise, Lan9118PhyState),
+        VMSTATE_UINT16(ints, Lan9118PhyState),
+        VMSTATE_UINT16(int_mask, Lan9118PhyState),
+        VMSTATE_BOOL(link_down, Lan9118PhyState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void lan9118_phy_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    rc->phases.hold = lan9118_phy_reset_hold;
+    dc->vmsd = &vmstate_lan9118_phy;
+}
+
+static const TypeInfo types[] = {
+    {
+        .name          = TYPE_LAN9118_PHY,
+        .parent        = TYPE_SYS_BUS_DEVICE,
+        .instance_size = sizeof(Lan9118PhyState),
+        .instance_init = lan9118_phy_init,
+        .class_init    = lan9118_phy_class_init,
+    }
+};
+
+DEFINE_TYPES(types)
diff --git a/hw/net/Kconfig b/hw/net/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/Kconfig
+++ b/hw/net/Kconfig
@@ -XXX,XX +XXX,XX @@ config VMXNET3_PCI
 config SMC91C111
     bool
 
+config LAN9118_PHY
+    bool
+
 config LAN9118
     bool
+    select LAN9118_PHY
     select PTIMER
 
 config NE2000_ISA
diff --git a/hw/net/meson.build b/hw/net/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/meson.build
+++ b/hw/net/meson.build
@@ -XXX,XX +XXX,XX @@ system_ss.add(when: 'CONFIG_VMXNET3_PCI', if_true: files('vmxnet3.c'))
 
 system_ss.add(when: 'CONFIG_SMC91C111', if_true: files('smc91c111.c'))
 system_ss.add(when: 'CONFIG_LAN9118', if_true: files('lan9118.c'))
+system_ss.add(when: 'CONFIG_LAN9118_PHY', if_true: files('lan9118_phy.c'))
 system_ss.add(when: 'CONFIG_NE2000_ISA', if_true: files('ne2000-isa.c'))
 system_ss.add(when: 'CONFIG_OPENCORES_ETH', if_true: files('opencores_eth.c'))
 system_ss.add(when: 'CONFIG_XGMAC', if_true: files('xgmac.c'))
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

imx_fec models the same PHY as lan9118_phy. The code is almost the same with
imx_fec having more logging and tracing. Merge these improvements into
lan9118_phy and reuse in imx_fec to fix the code duplication.

Some migration state how resides in the new device model which breaks migration
compatibility for the following machines:
* imx25-pdk
* sabrelite
* mcimx7d-sabre
* mcimx6ul-evk

Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241102125724.532843-3-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/imx_fec.h |   9 ++-
 hw/net/imx_fec.c         | 146 ++++-----------------------------------
 hw/net/lan9118_phy.c     |  82 ++++++++++++++++------
 hw/net/Kconfig           |   1 +
 hw/net/trace-events      |  10 +--
 5 files changed, 85 insertions(+), 163 deletions(-)

diff --git a/include/hw/net/imx_fec.h b/include/hw/net/imx_fec.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/imx_fec.h
+++ b/include/hw/net/imx_fec.h
@@ -XXX,XX +XXX,XX @@ OBJECT_DECLARE_SIMPLE_TYPE(IMXFECState, IMX_FEC)
 #define TYPE_IMX_ENET "imx.enet"
 
 #include "hw/sysbus.h"
+#include "hw/net/lan9118_phy.h"
+#include "hw/irq.h"
 #include "net/net.h"
 
 #define ENET_EIR               1
@@ -XXX,XX +XXX,XX @@ struct IMXFECState {
     uint32_t tx_descriptor[ENET_TX_RING_NUM];
     uint32_t tx_ring_num;
 
-    uint32_t phy_status;
-    uint32_t phy_control;
-    uint32_t phy_advertise;
-    uint32_t phy_int;
-    uint32_t phy_int_mask;
+    Lan9118PhyState mii;
+    IRQState mii_irq;
     uint32_t phy_num;
     bool phy_connected;
     struct IMXFECState *phy_consumer;
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_eth_txdescs = {
 
 static const VMStateDescription vmstate_imx_eth = {
     .name = TYPE_IMX_FEC,
-    .version_id = 2,
-    .minimum_version_id = 2,
+    .version_id = 3,
+    .minimum_version_id = 3,
     .fields = (const VMStateField[]) {
         VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX),
         VMSTATE_UINT32(rx_descriptor, IMXFECState),
         VMSTATE_UINT32(tx_descriptor[0], IMXFECState),
-        VMSTATE_UINT32(phy_status, IMXFECState),
-        VMSTATE_UINT32(phy_control, IMXFECState),
-        VMSTATE_UINT32(phy_advertise, IMXFECState),
-        VMSTATE_UINT32(phy_int, IMXFECState),
-        VMSTATE_UINT32(phy_int_mask, IMXFECState),
         VMSTATE_END_OF_LIST()
     },
     .subsections = (const VMStateDescription * const []) {
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_eth = {
     },
 };
 
-#define PHY_INT_ENERGYON            (1 << 7)
-#define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
-#define PHY_INT_FAULT               (1 << 5)
-#define PHY_INT_DOWN                (1 << 4)
-#define PHY_INT_AUTONEG_LP          (1 << 3)
-#define PHY_INT_PARFAULT            (1 << 2)
-#define PHY_INT_AUTONEG_PAGE        (1 << 1)
-
 static void imx_eth_update(IMXFECState *s);
 
 /*
@@ -XXX,XX +XXX,XX @@ static void imx_eth_update(IMXFECState *s);
  * For now we don't handle any GPIO/interrupt line, so the OS will
  * have to poll for the PHY status.
  */
-static void imx_phy_update_irq(IMXFECState *s)
+static void imx_phy_update_irq(void *opaque, int n, int level)
 {
-    imx_eth_update(s);
-}
-
-static void imx_phy_update_link(IMXFECState *s)
-{
-    /* Autonegotiation status mirrors link status.  */
-    if (qemu_get_queue(s->nic)->link_down) {
-        trace_imx_phy_update_link("down");
-        s->phy_status &= ~0x0024;
-        s->phy_int |= PHY_INT_DOWN;
-    } else {
-        trace_imx_phy_update_link("up");
-        s->phy_status |= 0x0024;
-        s->phy_int |= PHY_INT_ENERGYON;
-        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
-    }
-    imx_phy_update_irq(s);
+    imx_eth_update(opaque);
 }
 
 static void imx_eth_set_link(NetClientState *nc)
 {
-    imx_phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc)));
-}
-
-static void imx_phy_reset(IMXFECState *s)
-{
-    trace_imx_phy_reset();
-
-    s->phy_status = 0x7809;
-    s->phy_control = 0x3000;
-    s->phy_advertise = 0x01e1;
-    s->phy_int_mask = 0;
-    s->phy_int = 0;
-    imx_phy_update_link(s);
+    lan9118_phy_update_link(&IMX_FEC(qemu_get_nic_opaque(nc))->mii,
+                            nc->link_down);
 }
 
 static uint32_t imx_phy_read(IMXFECState *s, int reg)
 {
-    uint32_t val;
     uint32_t phy = reg / 32;
 
     if (!s->phy_connected) {
@@ -XXX,XX +XXX,XX @@ static uint32_t imx_phy_read(IMXFECState *s, int reg)
 
     reg %= 32;
 
-    switch (reg) {
-    case 0:     /* Basic Control */
-        val = s->phy_control;
-        break;
-    case 1:     /* Basic Status */
-        val = s->phy_status;
-        break;
-    case 2:     /* ID1 */
-        val = 0x0007;
-        break;
-    case 3:     /* ID2 */
-        val = 0xc0d1;
-        break;
-    case 4:     /* Auto-neg advertisement */
-        val = s->phy_advertise;
-        break;
-    case 5:     /* Auto-neg Link Partner Ability */
-        val = 0x0f71;
-        break;
-    case 6:     /* Auto-neg Expansion */
-        val = 1;
-        break;
-    case 29:    /* Interrupt source.  */
-        val = s->phy_int;
-        s->phy_int = 0;
-        imx_phy_update_irq(s);
-        break;
-    case 30:    /* Interrupt mask */
-        val = s->phy_int_mask;
-        break;
-    case 17:
-    case 18:
-    case 27:
-    case 31:
-        qemu_log_mask(LOG_UNIMP, "[%s.phy]%s: reg %d not implemented\n",
-                      TYPE_IMX_FEC, __func__, reg);
-        val = 0;
-        break;
-    default:
-        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
-                      TYPE_IMX_FEC, __func__, reg);
-        val = 0;
-        break;
-    }
-
-    trace_imx_phy_read(val, phy, reg);
-
-    return val;
+    return lan9118_phy_read(&s->mii, reg);
 }
 
 static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)
@@ -XXX,XX +XXX,XX @@ static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)
 
     reg %= 32;
 
-    trace_imx_phy_write(val, phy, reg);
-
-    switch (reg) {
-    case 0:     /* Basic Control */
-        if (val & 0x8000) {
-            imx_phy_reset(s);
-        } else {
-            s->phy_control = val & 0x7980;
-            /* Complete autonegotiation immediately.  */
-            if (val & 0x1000) {
-                s->phy_status |= 0x0020;
-            }
-        }
-        break;
-    case 4:     /* Auto-neg advertisement */
-        s->phy_advertise = (val & 0x2d7f) | 0x80;
-        break;
-    case 30:    /* Interrupt mask */
-        s->phy_int_mask = val & 0xff;
-        imx_phy_update_irq(s);
-        break;
-    case 17:
-    case 18:
-    case 27:
-    case 31:
-        qemu_log_mask(LOG_UNIMP, "[%s.phy)%s: reg %d not implemented\n",
-                      TYPE_IMX_FEC, __func__, reg);
-        break;
-    default:
-        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
-                      TYPE_IMX_FEC, __func__, reg);
-        break;
-    }
+    lan9118_phy_write(&s->mii, reg, val);
 }
 
 static void imx_fec_read_bd(IMXFECBufDesc *bd, dma_addr_t addr)
@@ -XXX,XX +XXX,XX @@ static void imx_eth_reset(DeviceState *d)
 
     s->rx_descriptor = 0;
     memset(s->tx_descriptor, 0, sizeof(s->tx_descriptor));
-
-    /* We also reset the PHY */
-    imx_phy_reset(s);
 }
 
 static uint32_t imx_default_read(IMXFECState *s, uint32_t index)
@@ -XXX,XX +XXX,XX @@ static void imx_eth_realize(DeviceState *dev, Error **errp)
     sysbus_init_irq(sbd, &s->irq[0]);
     sysbus_init_irq(sbd, &s->irq[1]);
 
+    qemu_init_irq(&s->mii_irq, imx_phy_update_irq, s, 0);
+    object_initialize_child(OBJECT(s), "mii", &s->mii, TYPE_LAN9118_PHY);
+    if (!sysbus_realize_and_unref(SYS_BUS_DEVICE(&s->mii), errp)) {
+        return;
+    }
+    qdev_connect_gpio_out(DEVICE(&s->mii), 0, &s->mii_irq);
+
     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
     s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf,
diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118_phy.c
+++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@
  * Copyright (c) 2009 CodeSourcery, LLC.
  * Written by Paul Brook
  *
+ * Copyright (c) 2013 Jean-Christophe Dubois. <jcd@tribudubois.net>
+ *
  * This code is licensed under the GNU GPL v2
  *
  * Contributions after 2012-01-13 are licensed under the terms of the
@@ -XXX,XX +XXX,XX @@
 #include "hw/resettable.h"
 #include "migration/vmstate.h"
 #include "qemu/log.h"
+#include "trace.h"
 
 #define PHY_INT_ENERGYON            (1 << 7)
 #define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
 
     switch (reg) {
     case 0: /* Basic Control */
-        return s->control;
+        val = s->control;
+        break;
     case 1: /* Basic Status */
-        return s->status;
+        val = s->status;
+        break;
     case 2: /* ID1 */
-        return 0x0007;
+        val = 0x0007;
+        break;
     case 3: /* ID2 */
-        return 0xc0d1;
+        val = 0xc0d1;
+        break;
     case 4: /* Auto-neg advertisement */
-        return s->advertise;
+        val = s->advertise;
+        break;
     case 5: /* Auto-neg Link Partner Ability */
-        return 0x0f71;
+        val = 0x0f71;
+        break;
     case 6: /* Auto-neg Expansion */
-        return 1;
-        /* TODO 17, 18, 27, 29, 30, 31 */
+        val = 1;
+        break;
     case 29: /* Interrupt source. */
         val = s->ints;
         s->ints = 0;
         lan9118_phy_update_irq(s);
-        return val;
+        break;
     case 30: /* Interrupt mask */
-        return s->int_mask;
+        val = s->int_mask;
+        break;
+    case 17:
+    case 18:
+    case 27:
+    case 31:
+        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
+                      __func__, reg);
+        val = 0;
+        break;
     default:
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "lan9118_phy_read: PHY read reg %d\n", reg);
-        return 0;
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
+                      __func__, reg);
+        val = 0;
+        break;
     }
+
+    trace_lan9118_phy_read(val, reg);
+
+    return val;
 }
 
 void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
 {
+    trace_lan9118_phy_write(val, reg);
+
     switch (reg) {
     case 0: /* Basic Control */
         if (val & 0x8000) {
             lan9118_phy_reset(s);
-            break;
-        }
-        s->control = val & 0x7980;
-        /* Complete autonegotiation immediately. */
-        if (val & 0x1000) {
-            s->status |= 0x0020;
+        } else {
+            s->control = val & 0x7980;
+            /* Complete autonegotiation immediately. */
+            if (val & 0x1000) {
+                s->status |= 0x0020;
+            }
         }
         break;
     case 4: /* Auto-neg advertisement */
         s->advertise = (val & 0x2d7f) | 0x80;
         break;
-        /* TODO 17, 18, 27, 31 */
     case 30: /* Interrupt mask */
         s->int_mask = val & 0xff;
         lan9118_phy_update_irq(s);
         break;
+    case 17:
+    case 18:
+    case 27:
+    case 31:
+        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
+                      __func__, reg);
+        break;
     default:
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "lan9118_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
+                      __func__, reg);
+        break;
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
 
     /* Autonegotiation status mirrors link status. */
     if (link_down) {
+        trace_lan9118_phy_update_link("down");
         s->status &= ~0x0024;
         s->ints |= PHY_INT_DOWN;
     } else {
+        trace_lan9118_phy_update_link("up");
         s->status |= 0x0024;
         s->ints |= PHY_INT_ENERGYON;
         s->ints |= PHY_INT_AUTONEG_COMPLETE;
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
 
 void lan9118_phy_reset(Lan9118PhyState *s)
 {
+    trace_lan9118_phy_reset();
+
     s->control = 0x3000;
     s->status = 0x7809;
     s->advertise = 0x01e1;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_lan9118_phy = {
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (const VMStateField[]) {
-        VMSTATE_UINT16(control, Lan9118PhyState),
         VMSTATE_UINT16(status, Lan9118PhyState),
+        VMSTATE_UINT16(control, Lan9118PhyState),
         VMSTATE_UINT16(advertise, Lan9118PhyState),
         VMSTATE_UINT16(ints, Lan9118PhyState),
         VMSTATE_UINT16(int_mask, Lan9118PhyState),
diff --git a/hw/net/Kconfig b/hw/net/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/Kconfig
+++ b/hw/net/Kconfig
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_SUN8I_EMAC
 
 config IMX_FEC
     bool
+    select LAN9118_PHY
 
 config CADENCE
     bool
diff --git a/hw/net/trace-events b/hw/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ allwinner_sun8i_emac_set_link(bool active) "Set link: active=%u"
 allwinner_sun8i_emac_read(uint64_t offset, uint64_t val) "MMIO read: offset=0x%" PRIx64 " value=0x%" PRIx64
 allwinner_sun8i_emac_write(uint64_t offset, uint64_t val) "MMIO write: offset=0x%" PRIx64 " value=0x%" PRIx64
 
+# lan9118_phy.c
+lan9118_phy_read(uint16_t val, int reg) "[0x%02x] -> 0x%04" PRIx16
+lan9118_phy_write(uint16_t val, int reg) "[0x%02x] <- 0x%04" PRIx16
+lan9118_phy_update_link(const char *s) "%s"
+lan9118_phy_reset(void) ""
+
 # lance.c
 lance_mem_readw(uint64_t addr, uint32_t ret) "addr=0x%"PRIx64"val=0x%04x"
 lance_mem_writew(uint64_t addr, uint32_t val) "addr=0x%"PRIx64"val=0x%04x"
@@ -XXX,XX +XXX,XX @@ i82596_set_multicast(uint16_t count) "Added %d multicast entries"
 i82596_channel_attention(void *s) "%p: Received CHANNEL ATTENTION"
 
 # imx_fec.c
-imx_phy_read(uint32_t val, int phy, int reg) "0x%04"PRIx32" <= phy[%d].reg[%d]"
 imx_phy_read_num(int phy, int configured) "read request from unconfigured phy %d (configured %d)"
-imx_phy_write(uint32_t val, int phy, int reg) "0x%04"PRIx32" => phy[%d].reg[%d]"
 imx_phy_write_num(int phy, int configured) "write request to unconfigured phy %d (configured %d)"
-imx_phy_update_link(const char *s) "%s"
-imx_phy_reset(void) ""
 imx_fec_read_bd(uint64_t addr, int flags, int len, int data) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x"
 imx_enet_read_bd(uint64_t addr, int flags, int len, int data, int options, int status) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x option 0x%04x status 0x%04x"
 imx_eth_tx_bd_busy(void) "tx_bd ran out of descriptors to transmit"
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

Turns 0x70 into 0xe0 (== 0x70 << 1) which adds the missing MII_ANLPAR_TX and
fixes the MSB of selector field to be zero, as specified in the datasheet.

Fixes: 2a424990170b "LAN9118 emulation"
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241102125724.532843-4-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/lan9118_phy.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118_phy.c
+++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
         val = s->advertise;
         break;
     case 5: /* Auto-neg Link Partner Ability */
-        val = 0x0f71;
+        val = 0x0fe1;
         break;
     case 6: /* Auto-neg Expansion */
         val = 1;
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

Prefer named constants over magic values for better readability.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20241102125724.532843-5-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/net/mii.h |  6 +++++
 hw/net/lan9118_phy.c | 63 ++++++++++++++++++++++++++++----------------
 2 files changed, 46 insertions(+), 23 deletions(-)

diff --git a/include/hw/net/mii.h b/include/hw/net/mii.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/mii.h
+++ b/include/hw/net/mii.h
@@ -XXX,XX +XXX,XX @@
 #define MII_BMSR_JABBER     (1 << 1)  /* Jabber detected */
 #define MII_BMSR_EXTCAP     (1 << 0)  /* Ext-reg capability */
 
+#define MII_ANAR_RFAULT     (1 << 13) /* Say we can detect faults */
 #define MII_ANAR_PAUSE_ASYM (1 << 11) /* Try for asymmetric pause */
 #define MII_ANAR_PAUSE      (1 << 10) /* Try for pause */
 #define MII_ANAR_TXFD       (1 << 8)
@@ -XXX,XX +XXX,XX @@
 #define MII_ANAR_10FD       (1 << 6)
 #define MII_ANAR_10         (1 << 5)
 #define MII_ANAR_CSMACD     (1 << 0)
+#define MII_ANAR_SELECT     (0x001f)  /* Selector bits */
 
 #define MII_ANLPAR_ACK      (1 << 14)
 #define MII_ANLPAR_PAUSEASY (1 << 11) /* can pause asymmetrically */
@@ -XXX,XX +XXX,XX @@
 #define RTL8201CP_PHYID1    0x0000
 #define RTL8201CP_PHYID2    0x8201
 
+/* SMSC LAN9118 */
+#define SMSCLAN9118_PHYID1  0x0007
+#define SMSCLAN9118_PHYID2  0xc0d1
+
 /* RealTek 8211E */
 #define RTL8211E_PHYID1     0x001c
 #define RTL8211E_PHYID2     0xc915
diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118_phy.c
+++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "hw/net/lan9118_phy.h"
+#include "hw/net/mii.h"
 #include "hw/irq.h"
 #include "hw/resettable.h"
 #include "migration/vmstate.h"
@@ -XXX,XX +XXX,XX @@ uint16_t lan9118_phy_read(Lan9118PhyState *s, int reg)
     uint16_t val;
 
     switch (reg) {
-    case 0: /* Basic Control */
+    case MII_BMCR:
         val = s->control;
         break;
-    case 1: /* Basic Status */
+    case MII_BMSR:
         val = s->status;
         break;
-    case 2: /* ID1 */
-        val = 0x0007;
+    case MII_PHYID1:
+        val = SMSCLAN9118_PHYID1;
         break;
-    case 3: /* ID2 */
-        val = 0xc0d1;
+    case MII_PHYID2:
+        val = SMSCLAN9118_PHYID2;
         break;
-    case 4: /* Auto-neg advertisement */
+    case MII_ANAR:
         val = s->advertise;
         break;
-    case 5: /* Auto-neg Link Partner Ability */
-        val = 0x0fe1;
+    case MII_ANLPAR:
+        val = MII_ANLPAR_PAUSEASY | MII_ANLPAR_PAUSE | MII_ANLPAR_T4 |
+              MII_ANLPAR_TXFD | MII_ANLPAR_TX | MII_ANLPAR_10FD |
+              MII_ANLPAR_10 | MII_ANLPAR_CSMACD;
         break;
-    case 6: /* Auto-neg Expansion */
-        val = 1;
+    case MII_ANER:
+        val = MII_ANER_NWAY;
         break;
     case 29: /* Interrupt source. */
         val = s->ints;
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
     trace_lan9118_phy_write(val, reg);
 
     switch (reg) {
-    case 0: /* Basic Control */
-        if (val & 0x8000) {
+    case MII_BMCR:
+        if (val & MII_BMCR_RESET) {
             lan9118_phy_reset(s);
         } else {
-            s->control = val & 0x7980;
+            s->control = val & (MII_BMCR_LOOPBACK | MII_BMCR_SPEED100 |
+                                MII_BMCR_AUTOEN | MII_BMCR_PDOWN | MII_BMCR_FD |
+                                MII_BMCR_CTST);
             /* Complete autonegotiation immediately. */
-            if (val & 0x1000) {
-                s->status |= 0x0020;
+            if (val & MII_BMCR_AUTOEN) {
+                s->status |= MII_BMSR_AN_COMP;
             }
         }
         break;
-    case 4: /* Auto-neg advertisement */
-        s->advertise = (val & 0x2d7f) | 0x80;
+    case MII_ANAR:
+        s->advertise = (val & (MII_ANAR_RFAULT | MII_ANAR_PAUSE_ASYM |
+                               MII_ANAR_PAUSE | MII_ANAR_10FD | MII_ANAR_10 |
+                               MII_ANAR_SELECT))
+                     | MII_ANAR_TX;
         break;
     case 30: /* Interrupt mask */
         s->int_mask = val & 0xff;
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_update_link(Lan9118PhyState *s, bool link_down)
     /* Autonegotiation status mirrors link status. */
     if (link_down) {
         trace_lan9118_phy_update_link("down");
-        s->status &= ~0x0024;
+        s->status &= ~(MII_BMSR_AN_COMP | MII_BMSR_LINK_ST);
         s->ints |= PHY_INT_DOWN;
     } else {
         trace_lan9118_phy_update_link("up");
-        s->status |= 0x0024;
+        s->status |= MII_BMSR_AN_COMP | MII_BMSR_LINK_ST;
         s->ints |= PHY_INT_ENERGYON;
         s->ints |= PHY_INT_AUTONEG_COMPLETE;
     }
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_reset(Lan9118PhyState *s)
 {
     trace_lan9118_phy_reset();
 
-    s->control = 0x3000;
-    s->status = 0x7809;
-    s->advertise = 0x01e1;
+    s->control = MII_BMCR_AUTOEN | MII_BMCR_SPEED100;
+    s->status = MII_BMSR_100TX_FD
+                | MII_BMSR_100TX_HD
+                | MII_BMSR_10T_FD
+                | MII_BMSR_10T_HD
+                | MII_BMSR_AUTONEG
+                | MII_BMSR_EXTCAP;
+    s->advertise = MII_ANAR_TXFD
+                   | MII_ANAR_TX
+                   | MII_ANAR_10FD
+                   | MII_ANAR_10
+                   | MII_ANAR_CSMACD;
     s->int_mask = 0;
     s->ints = 0;
     lan9118_phy_update_link(s, s->link_down);
-- 
2.34.1

From: Bernhard Beschow <shentey@gmail.com>

The real device advertises this mode and the device model already advertises
100 mbps half duplex and 10 mbps full+half duplex. So advertise this mode to
make the model more realistic.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bernhard Beschow <shentey@gmail.com>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20241102125724.532843-6-shentey@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/lan9118_phy.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/net/lan9118_phy.c b/hw/net/lan9118_phy.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118_phy.c
+++ b/hw/net/lan9118_phy.c
@@ -XXX,XX +XXX,XX @@ void lan9118_phy_write(Lan9118PhyState *s, int reg, uint16_t val)
         break;
     case MII_ANAR:
         s->advertise = (val & (MII_ANAR_RFAULT | MII_ANAR_PAUSE_ASYM |
-                               MII_ANAR_PAUSE | MII_ANAR_10FD | MII_ANAR_10 |
-                               MII_ANAR_SELECT))
+                               MII_ANAR_PAUSE | MII_ANAR_TXFD | MII_ANAR_10FD |
+                               MII_ANAR_10 | MII_ANAR_SELECT))
                      | MII_ANAR_TX;
         break;
     case 30: /* Interrupt mask */
-- 
2.34.1

For IEEE fused multiply-add, the (0 * inf) + NaN case should raise
Invalid for the multiplication of 0 by infinity.  Currently we handle
this in the per-architecture ifdef ladder in pickNaNMulAdd().
However, since this isn't really architecture specific we can hoist
it up to the generic code.

For the cases where the infzero test in pickNaNMulAdd was
returning 2, we can delete the check entirely and allow the
code to fall into the normal pick-a-NaN handling, because this
will return 2 anyway (input 'c' being the only NaN in this case).
For the cases where infzero was returning 3 to indicate "return
the default NaN", we must retain that "return 3".

For Arm, this looks like it might be a behaviour change because we
used to set float_flag_invalid | float_flag_invalid_imz only if C is
a quiet NaN.  However, it is not, because Arm target code never looks
at float_flag_invalid_imz, and for the (0 * inf) + SNaN case we
already raised float_flag_invalid via the "abc_mask &
float_cmask_snan" check in pick_nan_muladd.

For any target architecture using the "default implementation" at the
bottom of the ifdef, this is a behaviour change but will be fixing a
bug (where we failed to raise the Invalid exception for (0 * inf +
QNaN).  The architectures using the default case are:
 * hppa
 * i386
 * sh4
 * tricore

The x86, Tricore and SH4 CPU architecture manuals are clear that this
should have raised Invalid; HPPA is a bit vaguer but still seems
clear enough.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-2-peter.maydell@linaro.org
---
 fpu/softfloat-parts.c.inc      | 13 +++++++------
 fpu/softfloat-specialize.c.inc | 29 +----------------------------
 2 files changed, 8 insertions(+), 34 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
                                             int ab_mask, int abc_mask)
 {
     int which;
+    bool infzero = (ab_mask == float_cmask_infzero);
 
     if (unlikely(abc_mask & float_cmask_snan)) {
         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
     }
 
-    which = pickNaNMulAdd(a->cls, b->cls, c->cls,
-                          ab_mask == float_cmask_infzero, s);
+    if (infzero) {
+        /* This is (0 * inf) + NaN or (inf * 0) + NaN */
+        float_raise(float_flag_invalid | float_flag_invalid_imz, s);
+    }
+
+    which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
 
     if (s->default_nan_mode || which == 3) {
-        /*
-         * Note that this check is after pickNaNMulAdd so that function
-         * has an opportunity to set the Invalid flag for infzero.
-         */
         parts_default_nan(a, s);
         return a;
     }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      * the default NaN
      */
     if (infzero && is_qnan(c_cls)) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
         return 3;
     }
 
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          * case sets InvalidOp and returns the default NaN
          */
         if (infzero) {
-            float_raise(float_flag_invalid | float_flag_invalid_imz, status);
             return 3;
         }
         /* Prefer sNaN over qNaN, in the a, b, c order. */
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
          * case sets InvalidOp and returns the input value 'c'
          */
-        if (infzero) {
-            float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-            return 2;
-        }
         /* Prefer sNaN over qNaN, in the c, a, b order. */
         if (is_snan(c_cls)) {
             return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
      * case sets InvalidOp and returns the input value 'c'
      */
-    if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-        return 2;
-    }
+
     /* Prefer sNaN over qNaN, in the c, a, b order. */
     if (is_snan(c_cls)) {
         return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      * to return an input NaN if we have one (ie c) rather than generating
      * a default NaN
      */
-    if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-        return 2;
-    }
 
     /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
      * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         return 1;
     }
 #elif defined(TARGET_RISCV)
-    /* For RISC-V, InvalidOp is set when multiplicands are Inf and zero */
-    if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-    }
     return 3; /* default NaN */
 #elif defined(TARGET_S390X)
     if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
         return 3;
     }
 
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         return 2;
     }
 #elif defined(TARGET_SPARC)
-    /* For (inf,0,nan) return c. */
-    if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-        return 2;
-    }
     /* Prefer SNaN over QNaN, order C, B, A. */
     if (is_snan(c_cls)) {
         return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      * For Xtensa, the (inf,zero,nan) case sets InvalidOp and returns
      * an input NaN if we have one (ie c).
      */
-    if (infzero) {
-        float_raise(float_flag_invalid | float_flag_invalid_imz, status);
-        return 2;
-    }
     if (status->use_first_nan) {
         if (is_nan(a_cls)) {
             return 0;
-- 
2.34.1

If the target sets default_nan_mode then we're always going to return
the default NaN, and pickNaNMulAdd() no longer has any side effects.
For consistency with pickNaN(), check for default_nan_mode before
calling pickNaNMulAdd().

When we convert pickNaNMulAdd() to allow runtime selection of the NaN
propagation rule, this means we won't have to make the targets which
use default_nan_mode also set a propagation rule.

Since RiscV always uses default_nan_mode, this allows us to remove
its ifdef case from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-3-peter.maydell@linaro.org
---
 fpu/softfloat-parts.c.inc      | 8 ++++++--
 fpu/softfloat-specialize.c.inc | 9 +++++++--
 2 files changed, 13 insertions(+), 4 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
         float_raise(float_flag_invalid | float_flag_invalid_imz, s);
     }
 
-    which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
+    if (s->default_nan_mode) {
+        which = 3;
+    } else {
+        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
+    }
 
-    if (s->default_nan_mode || which == 3) {
+    if (which == 3) {
         parts_default_nan(a, s);
         return a;
     }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
 static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
                          bool infzero, float_status *status)
 {
+    /*
+     * We guarantee not to require the target to tell us how to
+     * pick a NaN if we're always returning the default NaN.
+     * But if we're not in default-NaN mode then the target must
+     * specify.
+     */
+    assert(!status->default_nan_mode);
 #if defined(TARGET_ARM)
     /* For ARM, the (inf,zero,qnan) case sets InvalidOp and returns
      * the default NaN
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
     } else {
         return 1;
     }
-#elif defined(TARGET_RISCV)
-    return 3; /* default NaN */
 #elif defined(TARGET_S390X)
     if (infzero) {
         return 3;
-- 
2.34.1

IEEE 758 does not define a fixed rule for what NaN to return in
the case of a fused multiply-add of inf * 0 + NaN. Different
architectures thus do different things:
 * some return the default NaN
 * some return the input NaN
 * Arm returns the default NaN if the input NaN is quiet,
   and the input NaN if it is signalling

We want to make this logic be runtime selected rather than
hardcoded into the binary, because:
 * this will let us have multiple targets in one QEMU binary
 * the Arm FEAT_AFP architectural feature includes letting
   the guest select a NaN propagation rule at runtime

In this commit we add an enum for the propagation rule, the field in
float_status, and the corresponding getters and setters.  We change
pickNaNMulAdd to honour this, but because all targets still leave
this field at its default 0 value, the fallback logic will pick the
rule type with the old ifdef ladder.

Note that four architectures both use the muladd softfloat functions
and did not have a branch of the ifdef ladder to specify their
behaviour (and so were ending up with the "default" case, probably
wrongly): i386, HPPA, SH4 and Tricore.  SH4 and Tricore both set
default_nan_mode, and so will never get into pickNaNMulAdd().  For
HPPA and i386 we retain the same behaviour as the old default-case,
which is to not ever return the default NaN.  This might not be
correct but it is not a behaviour change.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-4-peter.maydell@linaro.org
---
 include/fpu/softfloat-helpers.h | 11 ++++
 include/fpu/softfloat-types.h   | 23 +++++++++
 fpu/softfloat-specialize.c.inc  | 91 ++++++++++++++++++++++-----------
 3 files changed, 95 insertions(+), 30 deletions(-)

diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-helpers.h
+++ b/include/fpu/softfloat-helpers.h
@@ -XXX,XX +XXX,XX @@ static inline void set_float_2nan_prop_rule(Float2NaNPropRule rule,
     status->float_2nan_prop_rule = rule;
 }
 
+static inline void set_float_infzeronan_rule(FloatInfZeroNaNRule rule,
+                                             float_status *status)
+{
+    status->float_infzeronan_rule = rule;
+}
+
 static inline void set_flush_to_zero(bool val, float_status *status)
 {
     status->flush_to_zero = val;
@@ -XXX,XX +XXX,XX @@ static inline Float2NaNPropRule get_float_2nan_prop_rule(float_status *status)
     return status->float_2nan_prop_rule;
 }
 
+static inline FloatInfZeroNaNRule get_float_infzeronan_rule(float_status *status)
+{
+    return status->float_infzeronan_rule;
+}
+
 static inline bool get_flush_to_zero(float_status *status)
 {
     return status->flush_to_zero;
diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
     float_2nan_prop_x87,
 } Float2NaNPropRule;
 
+/*
+ * Rule for result of fused multiply-add 0 * Inf + NaN.
+ * This must be a NaN, but implementations differ on whether this
+ * is the input NaN or the default NaN.
+ *
+ * You don't need to set this if default_nan_mode is enabled.
+ * When not in default-NaN mode, it is an error for the target
+ * not to set the rule in float_status if it uses muladd, and we
+ * will assert if we need to handle an input NaN and no rule was
+ * selected.
+ */
+typedef enum __attribute__((__packed__)) {
+    /* No propagation rule specified */
+    float_infzeronan_none = 0,
+    /* Result is never the default NaN (so always the input NaN) */
+    float_infzeronan_dnan_never,
+    /* Result is always the default NaN */
+    float_infzeronan_dnan_always,
+    /* Result is the default NaN if the input NaN is quiet */
+    float_infzeronan_dnan_if_qnan,
+} FloatInfZeroNaNRule;
+
 /*
  * Floating Point Status. Individual architectures may maintain
  * several versions of float_status for different functions. The
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
     FloatRoundMode float_rounding_mode;
     FloatX80RoundPrec floatx80_rounding_precision;
     Float2NaNPropRule float_2nan_prop_rule;
+    FloatInfZeroNaNRule float_infzeronan_rule;
     bool tininess_before_rounding;
     /* should denormalised results go to zero and set the inexact flag? */
     bool flush_to_zero;
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
 static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
                          bool infzero, float_status *status)
 {
+    FloatInfZeroNaNRule rule = status->float_infzeronan_rule;
+
     /*
      * We guarantee not to require the target to tell us how to
      * pick a NaN if we're always returning the default NaN.
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      * specify.
      */
     assert(!status->default_nan_mode);
+
+    if (rule == float_infzeronan_none) {
+        /*
+         * Temporarily fall back to ifdef ladder
+         */
 #if defined(TARGET_ARM)
-    /* For ARM, the (inf,zero,qnan) case sets InvalidOp and returns
-     * the default NaN
-     */
-    if (infzero && is_qnan(c_cls)) {
-        return 3;
+        /*
+         * For ARM, the (inf,zero,qnan) case returns the default NaN,
+         * but (inf,zero,snan) returns the input NaN.
+         */
+        rule = float_infzeronan_dnan_if_qnan;
+#elif defined(TARGET_MIPS)
+        if (snan_bit_is_one(status)) {
+            /*
+             * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
+             * case sets InvalidOp and returns the default NaN
+             */
+            rule = float_infzeronan_dnan_always;
+        } else {
+            /*
+             * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
+             * case sets InvalidOp and returns the input value 'c'
+             */
+            rule = float_infzeronan_dnan_never;
+        }
+#elif defined(TARGET_PPC) || defined(TARGET_SPARC) || \
+    defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+    defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+        /*
+         * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+         * case sets InvalidOp and returns the input value 'c'
+         */
+        /*
+         * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
+         * to return an input NaN if we have one (ie c) rather than generating
+         * a default NaN
+         */
+        rule = float_infzeronan_dnan_never;
+#elif defined(TARGET_S390X)
+        rule = float_infzeronan_dnan_always;
+#endif
     }
 
+    if (infzero) {
+        /*
+         * Inf * 0 + NaN -- some implementations return the default NaN here,
+         * and some return the input NaN.
+         */
+        switch (rule) {
+        case float_infzeronan_dnan_never:
+            return 2;
+        case float_infzeronan_dnan_always:
+            return 3;
+        case float_infzeronan_dnan_if_qnan:
+            return is_qnan(c_cls) ? 3 : 2;
+        default:
+            g_assert_not_reached();
+        }
+    }
+
+#if defined(TARGET_ARM)
+
     /* This looks different from the ARM ARM pseudocode, because the ARM ARM
      * puts the operands to a fused mac operation (a*b)+c in the order c,a,b.
      */
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
     }
 #elif defined(TARGET_MIPS)
     if (snan_bit_is_one(status)) {
-        /*
-         * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
-         * case sets InvalidOp and returns the default NaN
-         */
-        if (infzero) {
-            return 3;
-        }
         /* Prefer sNaN over qNaN, in the a, b, c order. */
         if (is_snan(a_cls)) {
             return 0;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
             return 2;
         }
     } else {
-        /*
-         * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
-         * case sets InvalidOp and returns the input value 'c'
-         */
         /* Prefer sNaN over qNaN, in the c, a, b order. */
         if (is_snan(c_cls)) {
             return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         }
     }
 #elif defined(TARGET_LOONGARCH64)
-    /*
-     * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
-     * case sets InvalidOp and returns the input value 'c'
-     */
-
     /* Prefer sNaN over qNaN, in the c, a, b order. */
     if (is_snan(c_cls)) {
         return 2;
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         return 1;
     }
 #elif defined(TARGET_PPC)
-    /* For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
-     * to return an input NaN if we have one (ie c) rather than generating
-     * a default NaN
-     */
-
     /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
      * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
      */
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         return 1;
     }
 #elif defined(TARGET_S390X)
-    if (infzero) {
-        return 3;
-    }
-
     if (is_snan(a_cls)) {
         return 0;
     } else if (is_snan(b_cls)) {
-- 
2.34.1

Explicitly set a rule in the softfloat tests for the inf-zero-nan
muladd special case.  In meson.build we put -DTARGET_ARM in fpcflags,
and so we should select here the Arm rule of
float_infzeronan_dnan_if_qnan.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241202131347.498124-5-peter.maydell@linaro.org
---
 tests/fp/fp-bench.c | 5 +++++
 tests/fp/fp-test.c  | 5 +++++
 2 files changed, 10 insertions(+)

diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-bench.c
+++ b/tests/fp/fp-bench.c
@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
 {
     bench_func_t f;
 
+    /*
+     * These implementation-defined choices for various things IEEE
+     * doesn't specify match those used by the Arm architecture.
+     */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
+    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
 
     f = bench_funcs[operation][precision];
     g_assert(f);
diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-test.c
+++ b/tests/fp/fp-test.c
@@ -XXX,XX +XXX,XX @@ void run_test(void)
 {
     unsigned int i;
 
+    /*
+     * These implementation-defined choices for various things IEEE
+     * doesn't specify match those used by the Arm architecture.
+     */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
+    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
 
     genCases_setLevel(test_level);
     verCases_maxErrorCount = n_max_errors;
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the Arm target,
so we can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-6-peter.maydell@linaro.org
---
 target/arm/cpu.c               | 3 +++
 fpu/softfloat-specialize.c.inc | 8 +-------
 2 files changed, 4 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
  *  * tininess-before-rounding
  *  * 2-input NaN propagation prefers SNaN over QNaN, and then
  *    operand A over operand B (see FPProcessNaNs() pseudocode)
+ *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
+ *    and the input NaN if it is signalling
  */
 static void arm_set_default_fp_behaviours(float_status *s)
 {
     set_float_detect_tininess(float_tininess_before_rounding, s);
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
+    set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
 }
 
 static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         /*
          * Temporarily fall back to ifdef ladder
          */
-#if defined(TARGET_ARM)
-        /*
-         * For ARM, the (inf,zero,qnan) case returns the default NaN,
-         * but (inf,zero,snan) returns the input NaN.
-         */
-        rule = float_infzeronan_dnan_if_qnan;
-#elif defined(TARGET_MIPS)
+#if defined(TARGET_MIPS)
         if (snan_bit_is_one(status)) {
             /*
              * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for s390, so we
can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-7-peter.maydell@linaro.org
---
 target/s390x/cpu.c             | 2 ++
 fpu/softfloat-specialize.c.inc | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_hold(Object *obj, ResetType type)
         set_float_detect_tininess(float_tininess_before_rounding,
                                   &env->fpu_status);
         set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fpu_status);
+        set_float_infzeronan_rule(float_infzeronan_dnan_always,
+                                  &env->fpu_status);
        /* fall through */
     case RESET_TYPE_S390_CPU_NORMAL:
         env->psw.mask &= ~PSW_MASK_RI;
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          * a default NaN
          */
         rule = float_infzeronan_dnan_never;
-#elif defined(TARGET_S390X)
-        rule = float_infzeronan_dnan_always;
 #endif
     }
 
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the PPC target,
so we can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-8-peter.maydell@linaro.org
---
 target/ppc/cpu_init.c          | 7 +++++++
 fpu/softfloat-specialize.c.inc | 7 +------
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
      */
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->vec_status);
+    /*
+     * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
+     * to return an input NaN if we have one (ie c) rather than generating
+     * a default NaN
+     */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->vec_status);
 
     for (i = 0; i < ARRAY_SIZE(env->spr_cb); i++) {
         ppc_spr_t *spr = &env->spr_cb[i];
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
              */
             rule = float_infzeronan_dnan_never;
         }
-#elif defined(TARGET_PPC) || defined(TARGET_SPARC) || \
+#elif defined(TARGET_SPARC) || \
     defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
         /*
          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
          * case sets InvalidOp and returns the input value 'c'
          */
-        /*
-         * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
-         * to return an input NaN if we have one (ie c) rather than generating
-         * a default NaN
-         */
         rule = float_infzeronan_dnan_never;
 #endif
     }
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the MIPS target,
so we can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-9-peter.maydell@linaro.org
---
 target/mips/fpu_helper.h       |  9 +++++++++
 target/mips/msa.c              |  4 ++++
 fpu/softfloat-specialize.c.inc | 16 +---------------
 3 files changed, 14 insertions(+), 15 deletions(-)

diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/fpu_helper.h
+++ b/target/mips/fpu_helper.h
@@ -XXX,XX +XXX,XX @@ static inline void restore_flush_mode(CPUMIPSState *env)
 static inline void restore_snan_bit_mode(CPUMIPSState *env)
 {
     bool nan2008 = env->active_fpu.fcr31 & (1 << FCR31_NAN2008);
+    FloatInfZeroNaNRule izn_rule;
 
     /*
      * With nan2008, SNaNs are silenced in the usual way.
@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
      */
     set_snan_bit_is_one(!nan2008, &env->active_fpu.fp_status);
     set_default_nan_mode(!nan2008, &env->active_fpu.fp_status);
+    /*
+     * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
+     * case sets InvalidOp and returns the default NaN.
+     * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
+     * case sets InvalidOp and returns the input value 'c'.
+     */
+    izn_rule = nan2008 ? float_infzeronan_dnan_never : float_infzeronan_dnan_always;
+    set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
 }
 
 static inline void restore_fp_status(CPUMIPSState *env)
diff --git a/target/mips/msa.c b/target/mips/msa.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/msa.c
+++ b/target/mips/msa.c
@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
 
     /* set proper signanling bit meaning ("1" means "quiet") */
     set_snan_bit_is_one(0, &env->active_tc.msa_fp_status);
+
+    /* Inf * 0 + NaN returns the input NaN */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never,
+                              &env->active_tc.msa_fp_status);
 }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         /*
          * Temporarily fall back to ifdef ladder
          */
-#if defined(TARGET_MIPS)
-        if (snan_bit_is_one(status)) {
-            /*
-             * For MIPS systems that conform to IEEE754-1985, the (inf,zero,nan)
-             * case sets InvalidOp and returns the default NaN
-             */
-            rule = float_infzeronan_dnan_always;
-        } else {
-            /*
-             * For MIPS systems that conform to IEEE754-2008, the (inf,zero,nan)
-             * case sets InvalidOp and returns the input value 'c'
-             */
-            rule = float_infzeronan_dnan_never;
-        }
-#elif defined(TARGET_SPARC) || \
+#if defined(TARGET_SPARC) || \
     defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
         /*
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the SPARC target,
so we can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-10-peter.maydell@linaro.org
---
 target/sparc/cpu.c             | 2 ++
 fpu/softfloat-specialize.c.inc | 3 +--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
      * the CPU state struct so it won't get zeroed on reset.
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &env->fp_status);
+    /* For inf * 0 + NaN, return the input NaN */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
 
     cpu_exec_realizefn(cs, &local_err);
     if (local_err != NULL) {
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         /*
          * Temporarily fall back to ifdef ladder
          */
-#if defined(TARGET_SPARC) || \
-    defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+#if defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
         /*
          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the xtensa target,
so we can remove the ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-11-peter.maydell@linaro.org
---
 target/xtensa/cpu.c            | 2 ++
 fpu/softfloat-specialize.c.inc | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/xtensa/cpu.c b/target/xtensa/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/cpu.c
+++ b/target/xtensa/cpu.c
@@ -XXX,XX +XXX,XX @@ static void xtensa_cpu_reset_hold(Object *obj, ResetType type)
     reset_mmu(env);
     cs->halted = env->runstall;
 #endif
+    /* For inf * 0 + NaN, return the input NaN */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
     set_no_signaling_nans(!dfpu, &env->fp_status);
     xtensa_use_first_nan(env, !dfpu);
 }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         /*
          * Temporarily fall back to ifdef ladder
          */
-#if defined(TARGET_XTENSA) || defined(TARGET_HPPA) || \
+#if defined(TARGET_HPPA) || \
     defined(TARGET_I386) || defined(TARGET_LOONGARCH)
         /*
          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the x86 target.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-12-peter.maydell@linaro.org
---
 target/i386/tcg/fpu_helper.c   | 7 +++++++
 fpu/softfloat-specialize.c.inc | 2 +-
 2 files changed, 8 insertions(+), 1 deletion(-)

diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
      */
     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->mmx_status);
     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->sse_status);
+    /*
+     * Only SSE has multiply-add instructions. In the SDM Section 14.5.2
+     * "Fused-Multiply-ADD (FMA) Numeric Behavior" the NaN handling is
+     * specified -- for 0 * inf + NaN the input NaN is selected, and if
+     * there are multiple input NaNs they are selected in the order a, b, c.
+     */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->sse_status);
 }
 
 static inline uint8_t save_exception_flags(CPUX86State *env)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
          * Temporarily fall back to ifdef ladder
          */
 #if defined(TARGET_HPPA) || \
-    defined(TARGET_I386) || defined(TARGET_LOONGARCH)
+    defined(TARGET_LOONGARCH)
         /*
          * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
          * case sets InvalidOp and returns the input value 'c'
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the loongarch target.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-13-peter.maydell@linaro.org
---
 target/loongarch/tcg/fpu_helper.c | 5 +++++
 fpu/softfloat-specialize.c.inc    | 7 +------
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/fpu_helper.c
+++ b/target/loongarch/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void restore_fp_status(CPULoongArchState *env)
                             &env->fp_status);
     set_flush_to_zero(0, &env->fp_status);
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
+    /*
+     * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
+     * case sets InvalidOp and returns the input value 'c'
+     */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
 }
 
 int ieee_ex_to_loongarch(int xcpt)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         /*
          * Temporarily fall back to ifdef ladder
          */
-#if defined(TARGET_HPPA) || \
-    defined(TARGET_LOONGARCH)
-        /*
-         * For LoongArch systems that conform to IEEE754-2008, the (inf,zero,nan)
-         * case sets InvalidOp and returns the input value 'c'
-         */
+#if defined(TARGET_HPPA)
         rule = float_infzeronan_dnan_never;
 #endif
     }
-- 
2.34.1

Set the FloatInfZeroNaNRule explicitly for the HPPA target,
so we can remove the ifdef from pickNaNMulAdd().

As this is the last target to be converted to explicitly setting
the rule, we can remove the fallback code in pickNaNMulAdd()
entirely.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-14-peter.maydell@linaro.org
---
 target/hppa/fpu_helper.c       |  2 ++
 fpu/softfloat-specialize.c.inc | 13 +------------
 2 files changed, 3 insertions(+), 12 deletions(-)

diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/fpu_helper.c
+++ b/target/hppa/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
      * HPPA does note implement a CPU reset method at all...
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
+    /* For inf * 0 + NaN, return the input NaN */
+    set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
 }
 
 void cpu_hppa_loaded_fr0(CPUHPPAState *env)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
 static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
                          bool infzero, float_status *status)
 {
-    FloatInfZeroNaNRule rule = status->float_infzeronan_rule;
-
     /*
      * We guarantee not to require the target to tell us how to
      * pick a NaN if we're always returning the default NaN.
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
      */
     assert(!status->default_nan_mode);
 
-    if (rule == float_infzeronan_none) {
-        /*
-         * Temporarily fall back to ifdef ladder
-         */
-#if defined(TARGET_HPPA)
-        rule = float_infzeronan_dnan_never;
-#endif
-    }
-
     if (infzero) {
         /*
          * Inf * 0 + NaN -- some implementations return the default NaN here,
          * and some return the input NaN.
          */
-        switch (rule) {
+        switch (status->float_infzeronan_rule) {
         case float_infzeronan_dnan_never:
             return 2;
         case float_infzeronan_dnan_always:
-- 
2.34.1

The new implementation of pickNaNMulAdd() will find it convenient
to know whether at least one of the three arguments to the muladd
was a signaling NaN. We already calculate that in the caller,
so pass it in as a new bool have_snan.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-15-peter.maydell@linaro.org
---
 fpu/softfloat-parts.c.inc      | 5 +++--
 fpu/softfloat-specialize.c.inc | 2 +-
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
 {
     int which;
     bool infzero = (ab_mask == float_cmask_infzero);
+    bool have_snan = (abc_mask & float_cmask_snan);
 
-    if (unlikely(abc_mask & float_cmask_snan)) {
+    if (unlikely(have_snan)) {
         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
     }
 
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
     if (s->default_nan_mode) {
         which = 3;
     } else {
-        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, s);
+        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, have_snan, s);
     }
 
     if (which == 3) {
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
 | Return values : 0 : a; 1 : b; 2 : c; 3 : default-NaN
 *----------------------------------------------------------------------------*/
 static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
-                         bool infzero, float_status *status)
+                         bool infzero, bool have_snan, float_status *status)
 {
     /*
      * We guarantee not to require the target to tell us how to
-- 
2.34.1

IEEE 758 does not define a fixed rule for which NaN to pick as the
result if both operands of a 3-operand fused multiply-add operation
are NaNs.  As a result different architectures have ended up with
different rules for propagating NaNs.

QEMU currently hardcodes the NaN propagation logic into the binary
because pickNaNMulAdd() has an ifdef ladder for different targets.
We want to make the propagation rule instead be selectable at
runtime, because:
 * this will let us have multiple targets in one QEMU binary
 * the Arm FEAT_AFP architectural feature includes letting
   the guest select a NaN propagation rule at runtime

It's valid not to set a propagation rule if default_nan_mode is
enabled, because in that case there's no need to pick a NaN; all the
callers of pickNaNMulAdd() catch this case and skip calling it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-16-peter.maydell@linaro.org
---
 include/fpu/softfloat-helpers.h |  11 +++
 include/fpu/softfloat-types.h   |  55 +++++++++++
 fpu/softfloat-specialize.c.inc  | 167 ++++++++------------------------
 3 files changed, 107 insertions(+), 126 deletions(-)

diff --git a/include/fpu/softfloat-helpers.h b/include/fpu/softfloat-helpers.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-helpers.h
+++ b/include/fpu/softfloat-helpers.h
@@ -XXX,XX +XXX,XX @@ static inline void set_float_2nan_prop_rule(Float2NaNPropRule rule,
     status->float_2nan_prop_rule = rule;
 }
 
+static inline void set_float_3nan_prop_rule(Float3NaNPropRule rule,
+                                            float_status *status)
+{
+    status->float_3nan_prop_rule = rule;
+}
+
 static inline void set_float_infzeronan_rule(FloatInfZeroNaNRule rule,
                                              float_status *status)
 {
@@ -XXX,XX +XXX,XX @@ static inline Float2NaNPropRule get_float_2nan_prop_rule(float_status *status)
     return status->float_2nan_prop_rule;
 }
 
+static inline Float3NaNPropRule get_float_3nan_prop_rule(float_status *status)
+{
+    return status->float_3nan_prop_rule;
+}
+
 static inline FloatInfZeroNaNRule get_float_infzeronan_rule(float_status *status)
 {
     return status->float_infzeronan_rule;
diff --git a/include/fpu/softfloat-types.h b/include/fpu/softfloat-types.h
index XXXXXXX..XXXXXXX 100644
--- a/include/fpu/softfloat-types.h
+++ b/include/fpu/softfloat-types.h
@@ -XXX,XX +XXX,XX @@ this code that are retained.
 #ifndef SOFTFLOAT_TYPES_H
 #define SOFTFLOAT_TYPES_H
 
+#include "hw/registerfields.h"
+
 /*
  * Software IEC/IEEE floating-point types.
  */
@@ -XXX,XX +XXX,XX @@ typedef enum __attribute__((__packed__)) {
     float_2nan_prop_x87,
 } Float2NaNPropRule;
 
+/*
+ * 3-input NaN propagation rule, for fused multiply-add. Individual
+ * architectures have different rules for which input NaN is
+ * propagated to the output when there is more than one NaN on the
+ * input.
+ *
+ * If default_nan_mode is enabled then it is valid not to set a NaN
+ * propagation rule, because the softfloat code guarantees not to try
+ * to pick a NaN to propagate in default NaN mode.  When not in
+ * default-NaN mode, it is an error for the target not to set the rule
+ * in float_status if it uses a muladd, and we will assert if we need
+ * to handle an input NaN and no rule was selected.
+ *
+ * The naming scheme for Float3NaNPropRule values is:
+ *  float_3nan_prop_s_abc:
+ *    = "Prefer SNaN over QNaN, then operand A over B over C"
+ *  float_3nan_prop_abc:
+ *    = "Prefer A over B over C regardless of SNaN vs QNAN"
+ *
+ * For QEMU, the multiply-add operation is A * B + C.
+ */
+
+/*
+ * We set the Float3NaNPropRule enum values up so we can select the
+ * right value in pickNaNMulAdd in a data driven way.
+ */
+FIELD(3NAN, 1ST, 0, 2)   /* which operand is most preferred ? */
+FIELD(3NAN, 2ND, 2, 2)   /* which operand is next most preferred ? */
+FIELD(3NAN, 3RD, 4, 2)   /* which operand is least preferred ? */
+FIELD(3NAN, SNAN, 6, 1)  /* do we prefer SNaN over QNaN ? */
+
+#define PROPRULE(X, Y, Z) \
+    ((X << R_3NAN_1ST_SHIFT) | (Y << R_3NAN_2ND_SHIFT) | (Z << R_3NAN_3RD_SHIFT))
+
+typedef enum __attribute__((__packed__)) {
+    float_3nan_prop_none = 0,     /* No propagation rule specified */
+    float_3nan_prop_abc = PROPRULE(0, 1, 2),
+    float_3nan_prop_acb = PROPRULE(0, 2, 1),
+    float_3nan_prop_bac = PROPRULE(1, 0, 2),
+    float_3nan_prop_bca = PROPRULE(1, 2, 0),
+    float_3nan_prop_cab = PROPRULE(2, 0, 1),
+    float_3nan_prop_cba = PROPRULE(2, 1, 0),
+    float_3nan_prop_s_abc = float_3nan_prop_abc | R_3NAN_SNAN_MASK,
+    float_3nan_prop_s_acb = float_3nan_prop_acb | R_3NAN_SNAN_MASK,
+    float_3nan_prop_s_bac = float_3nan_prop_bac | R_3NAN_SNAN_MASK,
+    float_3nan_prop_s_bca = float_3nan_prop_bca | R_3NAN_SNAN_MASK,
+    float_3nan_prop_s_cab = float_3nan_prop_cab | R_3NAN_SNAN_MASK,
+    float_3nan_prop_s_cba = float_3nan_prop_cba | R_3NAN_SNAN_MASK,
+} Float3NaNPropRule;
+
+#undef PROPRULE
+
 /*
  * Rule for result of fused multiply-add 0 * Inf + NaN.
  * This must be a NaN, but implementations differ on whether this
@@ -XXX,XX +XXX,XX @@ typedef struct float_status {
     FloatRoundMode float_rounding_mode;
     FloatX80RoundPrec floatx80_rounding_precision;
     Float2NaNPropRule float_2nan_prop_rule;
+    Float3NaNPropRule float_3nan_prop_rule;
     FloatInfZeroNaNRule float_infzeronan_rule;
     bool tininess_before_rounding;
     /* should denormalised results go to zero and set the inexact flag? */
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
 static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
                          bool infzero, bool have_snan, float_status *status)
 {
+    FloatClass cls[3] = { a_cls, b_cls, c_cls };
+    Float3NaNPropRule rule = status->float_3nan_prop_rule;
+    int which;
+
     /*
      * We guarantee not to require the target to tell us how to
      * pick a NaN if we're always returning the default NaN.
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         }
     }
 
+    if (rule == float_3nan_prop_none) {
 #if defined(TARGET_ARM)
-
-    /* This looks different from the ARM ARM pseudocode, because the ARM ARM
-     * puts the operands to a fused mac operation (a*b)+c in the order c,a,b.
-     */
-    if (is_snan(c_cls)) {
-        return 2;
-    } else if (is_snan(a_cls)) {
-        return 0;
-    } else if (is_snan(b_cls)) {
-        return 1;
-    } else if (is_qnan(c_cls)) {
-        return 2;
-    } else if (is_qnan(a_cls)) {
-        return 0;
-    } else {
-        return 1;
-    }
+        /*
+         * This looks different from the ARM ARM pseudocode, because the ARM ARM
+         * puts the operands to a fused mac operation (a*b)+c in the order c,a,b
+         */
+        rule = float_3nan_prop_s_cab;
 #elif defined(TARGET_MIPS)
-    if (snan_bit_is_one(status)) {
-        /* Prefer sNaN over qNaN, in the a, b, c order. */
-        if (is_snan(a_cls)) {
-            return 0;
-        } else if (is_snan(b_cls)) {
-            return 1;
-        } else if (is_snan(c_cls)) {
-            return 2;
-        } else if (is_qnan(a_cls)) {
-            return 0;
-        } else if (is_qnan(b_cls)) {
-            return 1;
+        if (snan_bit_is_one(status)) {
+            rule = float_3nan_prop_s_abc;
         } else {
-            return 2;
+            rule = float_3nan_prop_s_cab;
         }
-    } else {
-        /* Prefer sNaN over qNaN, in the c, a, b order. */
-        if (is_snan(c_cls)) {
-            return 2;
-        } else if (is_snan(a_cls)) {
-            return 0;
-        } else if (is_snan(b_cls)) {
-            return 1;
-        } else if (is_qnan(c_cls)) {
-            return 2;
-        } else if (is_qnan(a_cls)) {
-            return 0;
-        } else {
-            return 1;
-        }
-    }
 #elif defined(TARGET_LOONGARCH64)
-    /* Prefer sNaN over qNaN, in the c, a, b order. */
-    if (is_snan(c_cls)) {
-        return 2;
-    } else if (is_snan(a_cls)) {
-        return 0;
-    } else if (is_snan(b_cls)) {
-        return 1;
-    } else if (is_qnan(c_cls)) {
-        return 2;
-    } else if (is_qnan(a_cls)) {
-        return 0;
-    } else {
-        return 1;
-    }
+        rule = float_3nan_prop_s_cab;
 #elif defined(TARGET_PPC)
-    /* If fRA is a NaN return it; otherwise if fRB is a NaN return it;
-     * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
-     */
-    if (is_nan(a_cls)) {
-        return 0;
-    } else if (is_nan(c_cls)) {
-        return 2;
-    } else {
-        return 1;
-    }
+        /*
+         * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
+         * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
+         */
+        rule = float_3nan_prop_acb;
 #elif defined(TARGET_S390X)
-    if (is_snan(a_cls)) {
-        return 0;
-    } else if (is_snan(b_cls)) {
-        return 1;
-    } else if (is_snan(c_cls)) {
-        return 2;
-    } else if (is_qnan(a_cls)) {
-        return 0;
-    } else if (is_qnan(b_cls)) {
-        return 1;
-    } else {
-        return 2;
-    }
+        rule = float_3nan_prop_s_abc;
 #elif defined(TARGET_SPARC)
-    /* Prefer SNaN over QNaN, order C, B, A. */
-    if (is_snan(c_cls)) {
-        return 2;
-    } else if (is_snan(b_cls)) {
-        return 1;
-    } else if (is_snan(a_cls)) {
-        return 0;
-    } else if (is_qnan(c_cls)) {
-        return 2;
-    } else if (is_qnan(b_cls)) {
-        return 1;
-    } else {
-        return 0;
-    }
+        rule = float_3nan_prop_s_cba;
 #elif defined(TARGET_XTENSA)
-    /*
-     * For Xtensa, the (inf,zero,nan) case sets InvalidOp and returns
-     * an input NaN if we have one (ie c).
-     */
-    if (status->use_first_nan) {
-        if (is_nan(a_cls)) {
-            return 0;
-        } else if (is_nan(b_cls)) {
-            return 1;
+        if (status->use_first_nan) {
+            rule = float_3nan_prop_abc;
         } else {
-            return 2;
+            rule = float_3nan_prop_cba;
         }
-    } else {
-        if (is_nan(c_cls)) {
-            return 2;
-        } else if (is_nan(b_cls)) {
-            return 1;
-        } else {
-            return 0;
-        }
-    }
 #else
-    /* A default implementation: prefer a to b to c.
-     * This is unlikely to actually match any real implementation.
-     */
-    if (is_nan(a_cls)) {
-        return 0;
-    } else if (is_nan(b_cls)) {
-        return 1;
-    } else {
-        return 2;
-    }
+        rule = float_3nan_prop_abc;
 #endif
+    }
+
+    assert(rule != float_3nan_prop_none);
+    if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
+        /* We have at least one SNaN input and should prefer it */
+        do {
+            which = rule & R_3NAN_1ST_MASK;
+            rule >>= R_3NAN_1ST_LENGTH;
+        } while (!is_snan(cls[which]));
+    } else {
+        do {
+            which = rule & R_3NAN_1ST_MASK;
+            rule >>= R_3NAN_1ST_LENGTH;
+        } while (!is_nan(cls[which]));
+    }
+    return which;
 }
 
 /*----------------------------------------------------------------------------
-- 
2.34.1

Explicitly set a rule in the softfloat tests for propagating NaNs in
the muladd case.  In meson.build we put -DTARGET_ARM in fpcflags, and
so we should select here the Arm rule of float_3nan_prop_s_cab.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-17-peter.maydell@linaro.org
---
 tests/fp/fp-bench.c | 1 +
 tests/fp/fp-test.c  | 1 +
 2 files changed, 2 insertions(+)

diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-bench.c
+++ b/tests/fp/fp-bench.c
@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
      * doesn't specify match those used by the Arm architecture.
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
+    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &soft_status);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
 
     f = bench_funcs[operation][precision];
diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-test.c
+++ b/tests/fp/fp-test.c
@@ -XXX,XX +XXX,XX @@ void run_test(void)
      * doesn't specify match those used by the Arm architecture.
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
+    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &qsf);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
 
     genCases_setLevel(test_level);
-- 
2.34.1

Set the Float3NaNPropRule explicitly for Arm, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-18-peter.maydell@linaro.org
---
 target/arm/cpu.c               | 5 +++++
 fpu/softfloat-specialize.c.inc | 8 +-------
 2 files changed, 6 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
  *  * tininess-before-rounding
  *  * 2-input NaN propagation prefers SNaN over QNaN, and then
  *    operand A over operand B (see FPProcessNaNs() pseudocode)
+ *  * 3-input NaN propagation prefers SNaN over QNaN, and then
+ *    operand C over A over B (see FPProcessNaNs3() pseudocode,
+ *    but note that for QEMU muladd is a * b + c, whereas for
+ *    the pseudocode function the arguments are in the order c, a, b.
  *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
  *    and the input NaN if it is signalling
  */
@@ -XXX,XX +XXX,XX @@ static void arm_set_default_fp_behaviours(float_status *s)
 {
     set_float_detect_tininess(float_tininess_before_rounding, s);
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
+    set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
 }
 
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
     }
 
     if (rule == float_3nan_prop_none) {
-#if defined(TARGET_ARM)
-        /*
-         * This looks different from the ARM ARM pseudocode, because the ARM ARM
-         * puts the operands to a fused mac operation (a*b)+c in the order c,a,b
-         */
-        rule = float_3nan_prop_s_cab;
-#elif defined(TARGET_MIPS)
+#if defined(TARGET_MIPS)
         if (snan_bit_is_one(status)) {
             rule = float_3nan_prop_s_abc;
         } else {
-- 
2.34.1

Set the Float3NaNPropRule explicitly for loongarch, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-19-peter.maydell@linaro.org
---
 target/loongarch/tcg/fpu_helper.c | 1 +
 fpu/softfloat-specialize.c.inc    | 2 --
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/fpu_helper.c
+++ b/target/loongarch/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void restore_fp_status(CPULoongArchState *env)
      * case sets InvalidOp and returns the input value 'c'
      */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+    set_float_3nan_prop_rule(float_3nan_prop_s_cab, &env->fp_status);
 }
 
 int ieee_ex_to_loongarch(int xcpt)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         } else {
             rule = float_3nan_prop_s_cab;
         }
-#elif defined(TARGET_LOONGARCH64)
-        rule = float_3nan_prop_s_cab;
 #elif defined(TARGET_PPC)
         /*
          * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
-- 
2.34.1

Set the Float3NaNPropRule explicitly for PPC, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-20-peter.maydell@linaro.org
---
 target/ppc/cpu_init.c          | 8 ++++++++
 fpu/softfloat-specialize.c.inc | 6 ------
 2 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/target/ppc/cpu_init.c b/target/ppc/cpu_init.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/cpu_init.c
+++ b/target/ppc/cpu_init.c
@@ -XXX,XX +XXX,XX @@ static void ppc_cpu_reset_hold(Object *obj, ResetType type)
      */
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->vec_status);
+    /*
+     * NaN propagation for fused multiply-add:
+     * if fRA is a NaN return it; otherwise if fRB is a NaN return it;
+     * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
+     * whereas QEMU labels the operands as (a * b) + c.
+     */
+    set_float_3nan_prop_rule(float_3nan_prop_acb, &env->fp_status);
+    set_float_3nan_prop_rule(float_3nan_prop_acb, &env->vec_status);
     /*
      * For PPC, the (inf,zero,qnan) case sets InvalidOp, but we prefer
      * to return an input NaN if we have one (ie c) rather than generating
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         } else {
             rule = float_3nan_prop_s_cab;
         }
-#elif defined(TARGET_PPC)
-        /*
-         * If fRA is a NaN return it; otherwise if fRB is a NaN return it;
-         * otherwise return fRC. Note that muladd on PPC is (fRA * fRC) + frB
-         */
-        rule = float_3nan_prop_acb;
 #elif defined(TARGET_S390X)
         rule = float_3nan_prop_s_abc;
 #elif defined(TARGET_SPARC)
-- 
2.34.1

Set the Float3NaNPropRule explicitly for s390x, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-21-peter.maydell@linaro.org
---
 target/s390x/cpu.c             | 1 +
 fpu/softfloat-specialize.c.inc | 2 --
 2 files changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/s390x/cpu.c b/target/s390x/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/s390x/cpu.c
+++ b/target/s390x/cpu.c
@@ -XXX,XX +XXX,XX @@ static void s390_cpu_reset_hold(Object *obj, ResetType type)
         set_float_detect_tininess(float_tininess_before_rounding,
                                   &env->fpu_status);
         set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fpu_status);
+        set_float_3nan_prop_rule(float_3nan_prop_s_abc, &env->fpu_status);
         set_float_infzeronan_rule(float_infzeronan_dnan_always,
                                   &env->fpu_status);
        /* fall through */
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         } else {
             rule = float_3nan_prop_s_cab;
         }
-#elif defined(TARGET_S390X)
-        rule = float_3nan_prop_s_abc;
 #elif defined(TARGET_SPARC)
         rule = float_3nan_prop_s_cba;
 #elif defined(TARGET_XTENSA)
-- 
2.34.1

Set the Float3NaNPropRule explicitly for SPARC, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-22-peter.maydell@linaro.org
---
 target/sparc/cpu.c             | 2 ++
 fpu/softfloat-specialize.c.inc | 2 --
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
      * the CPU state struct so it won't get zeroed on reset.
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &env->fp_status);
+    /* For fused-multiply add, prefer SNaN over QNaN, then C->B->A */
+    set_float_3nan_prop_rule(float_3nan_prop_s_cba, &env->fp_status);
     /* For inf * 0 + NaN, return the input NaN */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
 
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         } else {
             rule = float_3nan_prop_s_cab;
         }
-#elif defined(TARGET_SPARC)
-        rule = float_3nan_prop_s_cba;
 #elif defined(TARGET_XTENSA)
         if (status->use_first_nan) {
             rule = float_3nan_prop_abc;
-- 
2.34.1

Set the Float3NaNPropRule explicitly for Arm, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-23-peter.maydell@linaro.org
---
 target/mips/fpu_helper.h       | 4 ++++
 target/mips/msa.c              | 3 +++
 fpu/softfloat-specialize.c.inc | 8 +-------
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/fpu_helper.h
+++ b/target/mips/fpu_helper.h
@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
 {
     bool nan2008 = env->active_fpu.fcr31 & (1 << FCR31_NAN2008);
     FloatInfZeroNaNRule izn_rule;
+    Float3NaNPropRule nan3_rule;
 
     /*
      * With nan2008, SNaNs are silenced in the usual way.
@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
      */
     izn_rule = nan2008 ? float_infzeronan_dnan_never : float_infzeronan_dnan_always;
     set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
+    nan3_rule = nan2008 ? float_3nan_prop_s_cab : float_3nan_prop_s_abc;
+    set_float_3nan_prop_rule(nan3_rule, &env->active_fpu.fp_status);
+
 }
 
 static inline void restore_fp_status(CPUMIPSState *env)
diff --git a/target/mips/msa.c b/target/mips/msa.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/msa.c
+++ b/target/mips/msa.c
@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
     set_float_2nan_prop_rule(float_2nan_prop_s_ab,
                              &env->active_tc.msa_fp_status);
 
+    set_float_3nan_prop_rule(float_3nan_prop_s_cab,
+                             &env->active_tc.msa_fp_status);
+
     /* clear float_status exception flags */
     set_float_exception_flags(0, &env->active_tc.msa_fp_status);
 
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
     }
 
     if (rule == float_3nan_prop_none) {
-#if defined(TARGET_MIPS)
-        if (snan_bit_is_one(status)) {
-            rule = float_3nan_prop_s_abc;
-        } else {
-            rule = float_3nan_prop_s_cab;
-        }
-#elif defined(TARGET_XTENSA)
+#if defined(TARGET_XTENSA)
         if (status->use_first_nan) {
             rule = float_3nan_prop_abc;
         } else {
-- 
2.34.1

Set the Float3NaNPropRule explicitly for xtensa, and remove the
ifdef from pickNaNMulAdd().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-24-peter.maydell@linaro.org
---
 target/xtensa/fpu_helper.c     | 2 ++
 fpu/softfloat-specialize.c.inc | 8 --------
 2 files changed, 2 insertions(+), 8 deletions(-)

diff --git a/target/xtensa/fpu_helper.c b/target/xtensa/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/xtensa/fpu_helper.c
+++ b/target/xtensa/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void xtensa_use_first_nan(CPUXtensaState *env, bool use_first)
     set_use_first_nan(use_first, &env->fp_status);
     set_float_2nan_prop_rule(use_first ? float_2nan_prop_ab : float_2nan_prop_ba,
                              &env->fp_status);
+    set_float_3nan_prop_rule(use_first ? float_3nan_prop_abc : float_3nan_prop_cba,
+                             &env->fp_status);
 }
 
 void HELPER(wur_fpu2k_fcr)(CPUXtensaState *env, uint32_t v)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
     }
 
     if (rule == float_3nan_prop_none) {
-#if defined(TARGET_XTENSA)
-        if (status->use_first_nan) {
-            rule = float_3nan_prop_abc;
-        } else {
-            rule = float_3nan_prop_cba;
-        }
-#else
         rule = float_3nan_prop_abc;
-#endif
     }
 
     assert(rule != float_3nan_prop_none);
-- 
2.34.1

Set the Float3NaNPropRule explicitly for i386.  We had no
i386-specific behaviour in the old ifdef ladder, so we were using the
default "prefer a then b then c" fallback; this is actually the
correct per-the-spec handling for i386.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-25-peter.maydell@linaro.org
---
 target/i386/tcg/fpu_helper.c | 1 +
 1 file changed, 1 insertion(+)

Set the Float3NaNPropRule explicitly for HPPA, and remove the
ifdef from pickNaNMulAdd().

HPPA is the only target that was using the default branch of the
ifdef ladder (other targets either do not use muladd or set
default_nan_mode), so we can remove the ifdef fallback entirely now
(allowing the "rule not set" case to fall into the default of the
switch statement and assert).

We add a TODO note that the HPPA rule is probably wrong; this is
not a behavioural change for this refactoring.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-26-peter.maydell@linaro.org
---
 target/hppa/fpu_helper.c       | 8 ++++++++
 fpu/softfloat-specialize.c.inc | 4 ----
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/fpu_helper.c
+++ b/target/hppa/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
      * HPPA does note implement a CPU reset method at all...
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &env->fp_status);
+    /*
+     * TODO: The HPPA architecture reference only documents its NaN
+     * propagation rule for 2-operand operations. Testing on real hardware
+     * might be necessary to confirm whether this order for muladd is correct.
+     * Not preferring the SNaN is almost certainly incorrect as it diverges
+     * from the documented rules for 2-operand operations.
+     */
+    set_float_3nan_prop_rule(float_3nan_prop_abc, &env->fp_status);
     /* For inf * 0 + NaN, return the input NaN */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
 }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
         }
     }
 
-    if (rule == float_3nan_prop_none) {
-        rule = float_3nan_prop_abc;
-    }
-
     assert(rule != float_3nan_prop_none);
     if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
         /* We have at least one SNaN input and should prefer it */
-- 
2.34.1

The use_first_nan field in float_status was an xtensa-specific way to
select at runtime from two different NaN propagation rules.  Now that
xtensa is using the target-agnostic NaN propagation rule selection
that we've just added, we can remove use_first_nan, because there is
no longer any code that reads it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-27-peter.maydell@linaro.org
---
 include/fpu/softfloat-helpers.h | 5 -----
 include/fpu/softfloat-types.h   | 1 -
 target/xtensa/fpu_helper.c      | 1 -
 3 files changed, 7 deletions(-)

Currently m68k_cpu_reset_hold() calls floatx80_default_nan(NULL)
to get the NaN bit pattern to reset the FPU registers. This
works because it happens that our implementation of
floatx80_default_nan() doesn't actually look at the float_status
pointer except for TARGET_MIPS. However, this isn't guaranteed,
and to be able to remove the ifdef in floatx80_default_nan()
we're going to need a real float_status here.

Rearrange m68k_cpu_reset_hold() so that we initialize env->fp_status
earlier, and thus can pass it to floatx80_default_nan().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-28-peter.maydell@linaro.org
---
 target/m68k/cpu.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
     CPUState *cs = CPU(obj);
     M68kCPUClass *mcc = M68K_CPU_GET_CLASS(obj);
     CPUM68KState *env = cpu_env(cs);
-    floatx80 nan = floatx80_default_nan(NULL);
+    floatx80 nan;
     int i;
 
     if (mcc->parent_phases.hold) {
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
 #else
     cpu_m68k_set_sr(env, SR_S | SR_I);
 #endif
-    for (i = 0; i < 8; i++) {
-        env->fregs[i].d = nan;
-    }
-    cpu_m68k_set_fpcr(env, 0);
     /*
      * M68000 FAMILY PROGRAMMER'S REFERENCE MANUAL
      * 3.4 FLOATING-POINT INSTRUCTION DETAILS
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
      * preceding paragraph for nonsignaling NaNs.
      */
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
+
+    nan = floatx80_default_nan(&env->fp_status);
+    for (i = 0; i < 8; i++) {
+        env->fregs[i].d = nan;
+    }
+    cpu_m68k_set_fpcr(env, 0);
     env->fpsr = 0;
 
     /* TODO: We should set PC from the interrupt vector.  */
-- 
2.34.1

We create our 128-bit default NaN by calling parts64_default_nan()
and then adjusting the result.  We can do the same trick for creating
the floatx80 default NaN, which lets us drop a target ifdef.

floatx80 is used only by:
 i386
 m68k
 arm nwfpe old floating-point emulation emulation support
    (which is essentially dead, especially the parts involving floatx80)
 PPC (only in the xsrqpxp instruction, which just rounds an input
    value by converting to floatx80 and back, so will never generate
    the default NaN)

The floatx80 default NaN as currently implemented is:
 m68k: sign = 0, exp = 1...1, int = 1, frac = 1....1
 i386: sign = 1, exp = 1...1, int = 1, frac = 10...0

These are the same as the parts64_default_nan for these architectures.

This is technically a possible behaviour change for arm linux-user
nwfpe emulation emulation, because the default NaN will now have the
sign bit clear.  But we were already generating a different floatx80
default NaN from the real kernel emulation we are supposedly
following, which appears to use an all-bits-1 value:
 https://elixir.bootlin.com/linux/v6.12/source/arch/arm/nwfpe/softfloat-specialize#L267

This won't affect the only "real" use of the nwfpe emulation, which
is ancient binaries that used it as part of the old floating point
calling convention; that only uses loads and stores of 32 and 64 bit
floats, not any of the floatx80 behaviour the original hardware had.
We also get the nwfpe float64 default NaN value wrong:
 https://elixir.bootlin.com/linux/v6.12/source/arch/arm/nwfpe/softfloat-specialize#L166
so if we ever cared about this obscure corner the right fix would be
to correct that so nwfpe used its own default-NaN setting rather
than the Arm VFP one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-29-peter.maydell@linaro.org
---
 fpu/softfloat-specialize.c.inc | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts128_silence_nan(FloatParts128 *p, float_status *status)
 floatx80 floatx80_default_nan(float_status *status)
 {
     floatx80 r;
+    /*
+     * Extrapolate from the choices made by parts64_default_nan to fill
+     * in the floatx80 format. We assume that floatx80's explicit
+     * integer bit is always set (this is true for i386 and m68k,
+     * which are the only real users of this format).
+     */
+    FloatParts64 p64;
+    parts64_default_nan(&p64, status);
 
-    /* None of the targets that have snan_bit_is_one use floatx80.  */
-    assert(!snan_bit_is_one(status));
-#if defined(TARGET_M68K)
-    r.low = UINT64_C(0xFFFFFFFFFFFFFFFF);
-    r.high = 0x7FFF;
-#else
-    /* X86 */
-    r.low = UINT64_C(0xC000000000000000);
-    r.high = 0xFFFF;
-#endif
+    r.high = 0x7FFF | (p64.sign << 15);
+    r.low = (1ULL << DECOMPOSED_BINARY_POINT) | p64.frac;
     return r;
 }
 
-- 
2.34.1

In target/loongarch's helper_fclass_s() and helper_fclass_d() we pass
a zero-initialized float_status struct to float32_is_quiet_nan() and
float64_is_quiet_nan(), with the cryptic comment "for
snan_bit_is_one".

This pattern appears to have been copied from target/riscv, where it
is used because the functions there do not have ready access to the
CPU state struct. The comment presumably refers to the fact that the
main reason the is_quiet_nan() functions want the float_state is
because they want to know about the snan_bit_is_one config.

In the loongarch helpers, though, we have the CPU state struct
to hand. Use the usual env->fp_status here. This avoids our needing
to track that we need to update the initializer of the local
float_status structs when the core softfloat code adds new
options for targets to configure their behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-30-peter.maydell@linaro.org
---
 target/loongarch/tcg/fpu_helper.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/loongarch/tcg/fpu_helper.c b/target/loongarch/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/loongarch/tcg/fpu_helper.c
+++ b/target/loongarch/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fclass_s(CPULoongArchState *env, uint64_t fj)
     } else if (float32_is_zero_or_denormal(f)) {
         return sign ? 1 << 4 : 1 << 8;
     } else if (float32_is_any_nan(f)) {
-        float_status s = { }; /* for snan_bit_is_one */
-        return float32_is_quiet_nan(f, &s) ? 1 << 1 : 1 << 0;
+        return float32_is_quiet_nan(f, &env->fp_status) ? 1 << 1 : 1 << 0;
     } else {
         return sign ? 1 << 3 : 1 << 7;
     }
@@ -XXX,XX +XXX,XX @@ uint64_t helper_fclass_d(CPULoongArchState *env, uint64_t fj)
     } else if (float64_is_zero_or_denormal(f)) {
         return sign ? 1 << 4 : 1 << 8;
     } else if (float64_is_any_nan(f)) {
-        float_status s = { }; /* for snan_bit_is_one */
-        return float64_is_quiet_nan(f, &s) ? 1 << 1 : 1 << 0;
+        return float64_is_quiet_nan(f, &env->fp_status) ? 1 << 1 : 1 << 0;
     } else {
         return sign ? 1 << 3 : 1 << 7;
     }
-- 
2.34.1

In the frem helper, we have a local float_status because we want to
execute the floatx80_div() with a custom rounding mode.  Instead of
zero-initializing the local float_status and then having to set it up
with the m68k standard behaviour (including the NaN propagation rule
and copying the rounding precision from env->fp_status), initialize
it as a complete copy of env->fp_status. This will avoid our having
to add new code in this function for every new config knob we add
to fp_status.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-31-peter.maydell@linaro.org
---
 target/m68k/fpu_helper.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/target/m68k/fpu_helper.c b/target/m68k/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/fpu_helper.c
+++ b/target/m68k/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(frem)(CPUM68KState *env, FPReg *res, FPReg *val0, FPReg *val1)
 
     fp_rem = floatx80_rem(val1->d, val0->d, &env->fp_status);
     if (!floatx80_is_any_nan(fp_rem)) {
-        float_status fp_status = { };
+        /* Use local temporary fp_status to set different rounding mode */
+        float_status fp_status = env->fp_status;
         uint32_t quotient;
         int sign;
 
         /* Calculate quotient directly using round to nearest mode */
-        set_float_2nan_prop_rule(float_2nan_prop_ab, &fp_status);
         set_float_rounding_mode(float_round_nearest_even, &fp_status);
-        set_floatx80_rounding_precision(
-            get_floatx80_rounding_precision(&env->fp_status), &fp_status);
         fp_quot.d = floatx80_div(val1->d, val0->d, &fp_status);
 
         sign = extractFloatx80Sign(fp_quot.d);
-- 
2.34.1

In cf_fpu_gdb_get_reg() and cf_fpu_gdb_set_reg() we do the conversion
from float64 to floatx80 using a scratch float_status, because we
don't want the conversion to affect the CPU's floating point exception
status. Currently we use a zero-initialized float_status. This will
get steadily more awkward as we add config knobs to float_status
that the target must initialize. Avoid having to add any of that
configuration here by instead initializing our local float_status
from the env->fp_status.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-32-peter.maydell@linaro.org
---
 target/m68k/helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/m68k/helper.c b/target/m68k/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/helper.c
+++ b/target/m68k/helper.c
@@ -XXX,XX +XXX,XX @@ static int cf_fpu_gdb_get_reg(CPUState *cs, GByteArray *mem_buf, int n)
     CPUM68KState *env = &cpu->env;
 
     if (n < 8) {
-        float_status s = {};
+        /* Use scratch float_status so any exceptions don't change CPU state */
+        float_status s = env->fp_status;
         return gdb_get_reg64(mem_buf, floatx80_to_float64(env->fregs[n].d, &s));
     }
     switch (n) {
@@ -XXX,XX +XXX,XX @@ static int cf_fpu_gdb_set_reg(CPUState *cs, uint8_t *mem_buf, int n)
     CPUM68KState *env = &cpu->env;
 
     if (n < 8) {
-        float_status s = {};
+        /* Use scratch float_status so any exceptions don't change CPU state */
+        float_status s = env->fp_status;
         env->fregs[n].d = float64_to_floatx80(ldq_be_p(mem_buf), &s);
         return 8;
     }
-- 
2.34.1

In the helper functions flcmps and flcmpd we use a scratch float_status
so that we don't change the CPU state if the comparison raises any
floating point exception flags. Instead of zero-initializing this
scratch float_status, initialize it as a copy of env->fp_status. This
avoids the need to explicitly initialize settings like the NaN
propagation rule or others we might add to softfloat in future.

To do this we need to pass the CPU env pointer in to the helper.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-33-peter.maydell@linaro.org
---
 target/sparc/helper.h     | 4 ++--
 target/sparc/fop_helper.c | 8 ++++----
 target/sparc/translate.c  | 4 ++--
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/target/sparc/helper.h b/target/sparc/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/helper.h
+++ b/target/sparc/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(fcmpd, TCG_CALL_NO_WG, i32, env, f64, f64)
 DEF_HELPER_FLAGS_3(fcmped, TCG_CALL_NO_WG, i32, env, f64, f64)
 DEF_HELPER_FLAGS_3(fcmpq, TCG_CALL_NO_WG, i32, env, i128, i128)
 DEF_HELPER_FLAGS_3(fcmpeq, TCG_CALL_NO_WG, i32, env, i128, i128)
-DEF_HELPER_FLAGS_2(flcmps, TCG_CALL_NO_RWG_SE, i32, f32, f32)
-DEF_HELPER_FLAGS_2(flcmpd, TCG_CALL_NO_RWG_SE, i32, f64, f64)
+DEF_HELPER_FLAGS_3(flcmps, TCG_CALL_NO_RWG_SE, i32, env, f32, f32)
+DEF_HELPER_FLAGS_3(flcmpd, TCG_CALL_NO_RWG_SE, i32, env, f64, f64)
 DEF_HELPER_2(raise_exception, noreturn, env, int)
 
 DEF_HELPER_FLAGS_3(faddd, TCG_CALL_NO_WG, f64, env, f64, f64)
diff --git a/target/sparc/fop_helper.c b/target/sparc/fop_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/fop_helper.c
+++ b/target/sparc/fop_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t helper_fcmpeq(CPUSPARCState *env, Int128 src1, Int128 src2)
     return finish_fcmp(env, r, GETPC());
 }
 
-uint32_t helper_flcmps(float32 src1, float32 src2)
+uint32_t helper_flcmps(CPUSPARCState *env, float32 src1, float32 src2)
 {
     /*
      * FLCMP never raises an exception nor modifies any FSR fields.
      * Perform the comparison with a dummy fp environment.
      */
-    float_status discard = { };
+    float_status discard = env->fp_status;
     FloatRelation r;
 
     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &discard);
@@ -XXX,XX +XXX,XX @@ uint32_t helper_flcmps(float32 src1, float32 src2)
     g_assert_not_reached();
 }
 
-uint32_t helper_flcmpd(float64 src1, float64 src2)
+uint32_t helper_flcmpd(CPUSPARCState *env, float64 src1, float64 src2)
 {
-    float_status discard = { };
+    float_status discard = env->fp_status;
     FloatRelation r;
 
     set_float_2nan_prop_rule(float_2nan_prop_s_ba, &discard);
diff --git a/target/sparc/translate.c b/target/sparc/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/translate.c
+++ b/target/sparc/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_FLCMPs(DisasContext *dc, arg_FLCMPs *a)
 
     src1 = gen_load_fpr_F(dc, a->rs1);
     src2 = gen_load_fpr_F(dc, a->rs2);
-    gen_helper_flcmps(cpu_fcc[a->cc], src1, src2);
+    gen_helper_flcmps(cpu_fcc[a->cc], tcg_env, src1, src2);
     return advance_pc(dc);
 }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_FLCMPd(DisasContext *dc, arg_FLCMPd *a)
 
     src1 = gen_load_fpr_D(dc, a->rs1);
     src2 = gen_load_fpr_D(dc, a->rs2);
-    gen_helper_flcmpd(cpu_fcc[a->cc], src1, src2);
+    gen_helper_flcmpd(cpu_fcc[a->cc], tcg_env, src1, src2);
     return advance_pc(dc);
 }
 
-- 
2.34.1

In the helper_compute_fprf functions, we pass a dummy float_status
in to the is_signaling_nan() function. This is unnecessary, because
we have convenient access to the CPU env pointer here and that
is already set up with the correct values for the snan_bit_is_one
and no_signaling_nans config settings. is_signaling_nan() doesn't
ever update the fp_status with any exception flags, so there is
no reason not to use env->fp_status here.

Use env->fp_status instead of the dummy fp_status.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-34-peter.maydell@linaro.org
---
 target/ppc/fpu_helper.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/target/ppc/fpu_helper.c b/target/ppc/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/ppc/fpu_helper.c
+++ b/target/ppc/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void helper_compute_fprf_##tp(CPUPPCState *env, tp arg)           \
     } else if (tp##_is_infinity(arg)) {                           \
         fprf = neg ? 0x09 << FPSCR_FPRF : 0x05 << FPSCR_FPRF;     \
     } else {                                                      \
-        float_status dummy = { };  /* snan_bit_is_one = 0 */      \
-        if (tp##_is_signaling_nan(arg, &dummy)) {                 \
+        if (tp##_is_signaling_nan(arg, &env->fp_status)) {        \
             fprf = 0x00 << FPSCR_FPRF;                            \
         } else {                                                  \
             fprf = 0x11 << FPSCR_FPRF;                            \
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Now that float_status has a bunch of fp parameters,
it is easier to copy an existing structure than create
one from scratch.  Begin by copying the structure that
corresponds to the FPSR and make only the adjustments
required for BFloat16 semantics.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241203203949.483774-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/vec_helper.c | 20 +++++++-------------
 1 file changed, 7 insertions(+), 13 deletions(-)

diff --git a/target/arm/tcg/vec_helper.c b/target/arm/tcg/vec_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/vec_helper.c
+++ b/target/arm/tcg/vec_helper.c
@@ -XXX,XX +XXX,XX @@ bool is_ebf(CPUARMState *env, float_status *statusp, float_status *oddstatusp)
      * no effect on AArch32 instructions.
      */
     bool ebf = is_a64(env) && env->vfp.fpcr & FPCR_EBF;
-    *statusp = (float_status){
-        .tininess_before_rounding = float_tininess_before_rounding,
-        .float_rounding_mode = float_round_to_odd_inf,
-        .flush_to_zero = true,
-        .flush_inputs_to_zero = true,
-        .default_nan_mode = true,
-    };
+
+    *statusp = env->vfp.fp_status;
+    set_default_nan_mode(true, statusp);
 
     if (ebf) {
-        float_status *fpst = &env->vfp.fp_status;
-        set_flush_to_zero(get_flush_to_zero(fpst), statusp);
-        set_flush_inputs_to_zero(get_flush_inputs_to_zero(fpst), statusp);
-        set_float_rounding_mode(get_float_rounding_mode(fpst), statusp);
-
         /* EBF=1 needs to do a step with round-to-odd semantics */
         *oddstatusp = *statusp;
         set_float_rounding_mode(float_round_to_odd, oddstatusp);
+    } else {
+        set_flush_to_zero(true, statusp);
+        set_flush_inputs_to_zero(true, statusp);
+        set_float_rounding_mode(float_round_to_odd_inf, statusp);
     }
-
     return ebf;
 }
 
-- 
2.34.1

Currently we hardcode the default NaN value in parts64_default_nan()
using a compile-time ifdef ladder. This is awkward for two cases:
 * for single-QEMU-binary we can't hard-code target-specifics like this
 * for Arm FEAT_AFP the default NaN value depends on FPCR.AH
   (specifically the sign bit is different)

Add a field to float_status to specify the default NaN value; fall
back to the old ifdef behaviour if these are not set.

The default NaN value is specified by setting a uint8_t to a
pattern corresponding to the sign and upper fraction parts of
the NaN; the lower bits of the fraction are set from bit 0 of
the pattern.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-35-peter.maydell@linaro.org
---
 include/fpu/softfloat-helpers.h | 11 +++++++
 include/fpu/softfloat-types.h   | 10 ++++++
 fpu/softfloat-specialize.c.inc  | 55 ++++++++++++++++++++-------------
 3 files changed, 54 insertions(+), 22 deletions(-)

Set the default NaN pattern explicitly for the tests/fp code.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-36-peter.maydell@linaro.org
---
 tests/fp/fp-bench.c     | 1 +
 tests/fp/fp-test-log2.c | 1 +
 tests/fp/fp-test.c      | 1 +
 3 files changed, 3 insertions(+)

diff --git a/tests/fp/fp-bench.c b/tests/fp/fp-bench.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-bench.c
+++ b/tests/fp/fp-bench.c
@@ -XXX,XX +XXX,XX @@ static void run_bench(void)
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &soft_status);
     set_float_3nan_prop_rule(float_3nan_prop_s_cab, &soft_status);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &soft_status);
+    set_float_default_nan_pattern(0b01000000, &soft_status);
 
     f = bench_funcs[operation][precision];
     g_assert(f);
diff --git a/tests/fp/fp-test-log2.c b/tests/fp/fp-test-log2.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-test-log2.c
+++ b/tests/fp/fp-test-log2.c
@@ -XXX,XX +XXX,XX @@ int main(int ac, char **av)
     int i;
 
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
+    set_float_default_nan_pattern(0b01000000, &qsf);
     set_float_rounding_mode(float_round_nearest_even, &qsf);
 
     test.d = 0.0;
diff --git a/tests/fp/fp-test.c b/tests/fp/fp-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/fp/fp-test.c
+++ b/tests/fp/fp-test.c
@@ -XXX,XX +XXX,XX @@ void run_test(void)
      */
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, &qsf);
     set_float_3nan_prop_rule(float_3nan_prop_s_cab, &qsf);
+    set_float_default_nan_pattern(0b01000000, &qsf);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, &qsf);
 
     genCases_setLevel(test_level);
-- 
2.34.1

Set the default NaN pattern explicitly, and remove the ifdef from
parts64_default_nan().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-37-peter.maydell@linaro.org
---
 target/microblaze/cpu.c        | 2 ++
 fpu/softfloat-specialize.c.inc | 3 +--
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/microblaze/cpu.c b/target/microblaze/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/microblaze/cpu.c
+++ b/target/microblaze/cpu.c
@@ -XXX,XX +XXX,XX @@ static void mb_cpu_reset_hold(Object *obj, ResetType type)
      * this architecture.
      */
     set_float_2nan_prop_rule(float_2nan_prop_x87, &env->fp_status);
+    /* Default NaN: sign bit set, most significant frac bit set */
+    set_float_default_nan_pattern(0b11000000, &env->fp_status);
 
 #if defined(CONFIG_USER_ONLY)
     /* start in user mode with interrupts enabled.  */
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
 #if defined(TARGET_SPARC) || defined(TARGET_M68K)
         /* Sign bit clear, all frac bits set */
         dnan_pattern = 0b01111111;
-#elif defined(TARGET_I386) || defined(TARGET_X86_64)    \
-    || defined(TARGET_MICROBLAZE)
+#elif defined(TARGET_I386) || defined(TARGET_X86_64)
         /* Sign bit set, most significant frac bit set */
         dnan_pattern = 0b11000000;
 #elif defined(TARGET_HPPA)
-- 
2.34.1

Set the default NaN pattern explicitly, and remove the ifdef from
parts64_default_nan().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-38-peter.maydell@linaro.org
---
 target/i386/tcg/fpu_helper.c   | 4 ++++
 fpu/softfloat-specialize.c.inc | 3 ---
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/i386/tcg/fpu_helper.c b/target/i386/tcg/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/fpu_helper.c
+++ b/target/i386/tcg/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void cpu_init_fp_statuses(CPUX86State *env)
      */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->sse_status);
     set_float_3nan_prop_rule(float_3nan_prop_abc, &env->sse_status);
+    /* Default NaN: sign bit set, most significant frac bit set */
+    set_float_default_nan_pattern(0b11000000, &env->fp_status);
+    set_float_default_nan_pattern(0b11000000, &env->mmx_status);
+    set_float_default_nan_pattern(0b11000000, &env->sse_status);
 }
 
 static inline uint8_t save_exception_flags(CPUX86State *env)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
 #if defined(TARGET_SPARC) || defined(TARGET_M68K)
         /* Sign bit clear, all frac bits set */
         dnan_pattern = 0b01111111;
-#elif defined(TARGET_I386) || defined(TARGET_X86_64)
-        /* Sign bit set, most significant frac bit set */
-        dnan_pattern = 0b11000000;
 #elif defined(TARGET_HPPA)
         /* Sign bit clear, msb-1 frac bit set */
         dnan_pattern = 0b00100000;
-- 
2.34.1

Set the default NaN pattern explicitly, and remove the ifdef from
parts64_default_nan().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-39-peter.maydell@linaro.org
---
 target/hppa/fpu_helper.c       | 2 ++
 fpu/softfloat-specialize.c.inc | 3 ---
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/target/hppa/fpu_helper.c b/target/hppa/fpu_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hppa/fpu_helper.c
+++ b/target/hppa/fpu_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(loaded_fr0)(CPUHPPAState *env)
     set_float_3nan_prop_rule(float_3nan_prop_abc, &env->fp_status);
     /* For inf * 0 + NaN, return the input NaN */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+    /* Default NaN: sign bit clear, msb-1 frac bit set */
+    set_float_default_nan_pattern(0b00100000, &env->fp_status);
 }
 
 void cpu_hppa_loaded_fr0(CPUHPPAState *env)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
 #if defined(TARGET_SPARC) || defined(TARGET_M68K)
         /* Sign bit clear, all frac bits set */
         dnan_pattern = 0b01111111;
-#elif defined(TARGET_HPPA)
-        /* Sign bit clear, msb-1 frac bit set */
-        dnan_pattern = 0b00100000;
 #elif defined(TARGET_HEXAGON)
         /* Sign bit set, all frac bits set. */
         dnan_pattern = 0b11111111;
-- 
2.34.1

Set the default NaN pattern explicitly for the arm target.
This includes setting it for the old linux-user nwfpe emulation.
For nwfpe, our default doesn't match the real kernel, but we
avoid making a behaviour change in this commit.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-41-peter.maydell@linaro.org
---
 linux-user/arm/nwfpe/fpa11.c | 5 +++++
 target/arm/cpu.c             | 2 ++
 2 files changed, 7 insertions(+)

diff --git a/linux-user/arm/nwfpe/fpa11.c b/linux-user/arm/nwfpe/fpa11.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/nwfpe/fpa11.c
+++ b/linux-user/arm/nwfpe/fpa11.c
@@ -XXX,XX +XXX,XX @@ void resetFPA11(void)
    * this late date.
    */
   set_float_2nan_prop_rule(float_2nan_prop_s_ab, &fpa11->fp_status);
+  /*
+   * Use the same default NaN value as Arm VFP. This doesn't match
+   * the Linux kernel's nwfpe emulation, which uses an all-1s value.
+   */
+  set_float_default_nan_pattern(0b01000000, &fpa11->fp_status);
 }
 
 void SetRoundingMode(const unsigned int opcode)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_register_el_change_hook(ARMCPU *cpu, ARMELChangeHookFn *hook,
  *    the pseudocode function the arguments are in the order c, a, b.
  *  * 0 * Inf + NaN returns the default NaN if the input NaN is quiet,
  *    and the input NaN if it is signalling
+ *  * Default NaN has sign bit clear, msb frac bit set
  */
 static void arm_set_default_fp_behaviours(float_status *s)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_set_default_fp_behaviours(float_status *s)
     set_float_2nan_prop_rule(float_2nan_prop_s_ab, s);
     set_float_3nan_prop_rule(float_3nan_prop_s_cab, s);
     set_float_infzeronan_rule(float_infzeronan_dnan_if_qnan, s);
+    set_float_default_nan_pattern(0b01000000, s);
 }
 
 static void cp_reg_reset(gpointer key, gpointer value, gpointer opaque)
-- 
2.34.1

Set the default NaN pattern explicitly for m68k.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-43-peter.maydell@linaro.org
---
 target/m68k/cpu.c              | 2 ++
 fpu/softfloat-specialize.c.inc | 2 +-
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/m68k/cpu.c b/target/m68k/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/m68k/cpu.c
+++ b/target/m68k/cpu.c
@@ -XXX,XX +XXX,XX @@ static void m68k_cpu_reset_hold(Object *obj, ResetType type)
      * preceding paragraph for nonsignaling NaNs.
      */
     set_float_2nan_prop_rule(float_2nan_prop_ab, &env->fp_status);
+    /* Default NaN: sign bit clear, all frac bits set */
+    set_float_default_nan_pattern(0b01111111, &env->fp_status);
 
     nan = floatx80_default_nan(&env->fp_status);
     for (i = 0; i < 8; i++) {
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
     uint8_t dnan_pattern = status->default_nan_pattern;
 
     if (dnan_pattern == 0) {
-#if defined(TARGET_SPARC) || defined(TARGET_M68K)
+#if defined(TARGET_SPARC)
         /* Sign bit clear, all frac bits set */
         dnan_pattern = 0b01111111;
 #elif defined(TARGET_HEXAGON)
-- 
2.34.1

Set the default NaN pattern explicitly for MIPS. Note that this
is our only target which currently changes the default NaN
at runtime (which it was previously doing indirectly when it
changed the snan_bit_is_one setting).

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-44-peter.maydell@linaro.org
---
 target/mips/fpu_helper.h | 7 +++++++
 target/mips/msa.c        | 3 +++
 2 files changed, 10 insertions(+)

diff --git a/target/mips/fpu_helper.h b/target/mips/fpu_helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/fpu_helper.h
+++ b/target/mips/fpu_helper.h
@@ -XXX,XX +XXX,XX @@ static inline void restore_snan_bit_mode(CPUMIPSState *env)
     set_float_infzeronan_rule(izn_rule, &env->active_fpu.fp_status);
     nan3_rule = nan2008 ? float_3nan_prop_s_cab : float_3nan_prop_s_abc;
     set_float_3nan_prop_rule(nan3_rule, &env->active_fpu.fp_status);
+    /*
+     * With nan2008, the default NaN value has the sign bit clear and the
+     * frac msb set; with the older mode, the sign bit is clear, and all
+     * frac bits except the msb are set.
+     */
+    set_float_default_nan_pattern(nan2008 ? 0b01000000 : 0b00111111,
+                                  &env->active_fpu.fp_status);
 
 }
 
diff --git a/target/mips/msa.c b/target/mips/msa.c
index XXXXXXX..XXXXXXX 100644
--- a/target/mips/msa.c
+++ b/target/mips/msa.c
@@ -XXX,XX +XXX,XX @@ void msa_reset(CPUMIPSState *env)
     /* Inf * 0 + NaN returns the input NaN */
     set_float_infzeronan_rule(float_infzeronan_dnan_never,
                               &env->active_tc.msa_fp_status);
+    /* Default NaN: sign bit clear, frac msb set */
+    set_float_default_nan_pattern(0b01000000,
+                                  &env->active_tc.msa_fp_status);
 }
-- 
2.34.1

Set the default NaN pattern explicitly for SPARC, and remove
the ifdef from parts64_default_nan.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-50-peter.maydell@linaro.org
---
 target/sparc/cpu.c             | 2 ++
 fpu/softfloat-specialize.c.inc | 5 +----
 2 files changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/sparc/cpu.c b/target/sparc/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/sparc/cpu.c
+++ b/target/sparc/cpu.c
@@ -XXX,XX +XXX,XX @@ static void sparc_cpu_realizefn(DeviceState *dev, Error **errp)
     set_float_3nan_prop_rule(float_3nan_prop_s_cba, &env->fp_status);
     /* For inf * 0 + NaN, return the input NaN */
     set_float_infzeronan_rule(float_infzeronan_dnan_never, &env->fp_status);
+    /* Default NaN value: sign bit clear, all frac bits set */
+    set_float_default_nan_pattern(0b01111111, &env->fp_status);
 
     cpu_exec_realizefn(cs, &local_err);
     if (local_err != NULL) {
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
     uint8_t dnan_pattern = status->default_nan_pattern;
 
     if (dnan_pattern == 0) {
-#if defined(TARGET_SPARC)
-        /* Sign bit clear, all frac bits set */
-        dnan_pattern = 0b01111111;
-#elif defined(TARGET_HEXAGON)
+#if defined(TARGET_HEXAGON)
         /* Sign bit set, all frac bits set. */
         dnan_pattern = 0b11111111;
 #else
-- 
2.34.1

Set the default NaN pattern explicitly for hexagon.
Remove the ifdef from parts64_default_nan(); the only
remaining unconverted targets all use the default case.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-52-peter.maydell@linaro.org
---
 target/hexagon/cpu.c           | 2 ++
 fpu/softfloat-specialize.c.inc | 5 -----
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/target/hexagon/cpu.c b/target/hexagon/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.c
+++ b/target/hexagon/cpu.c
@@ -XXX,XX +XXX,XX @@ static void hexagon_cpu_reset_hold(Object *obj, ResetType type)
 
     set_default_nan_mode(1, &env->fp_status);
     set_float_detect_tininess(float_tininess_before_rounding, &env->fp_status);
+    /* Default NaN value: sign bit set, all frac bits set */
+    set_float_default_nan_pattern(0b11111111, &env->fp_status);
 }
 
 static void hexagon_cpu_disas_set_info(CPUState *s, disassemble_info *info)
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
     uint8_t dnan_pattern = status->default_nan_pattern;
 
     if (dnan_pattern == 0) {
-#if defined(TARGET_HEXAGON)
-        /* Sign bit set, all frac bits set. */
-        dnan_pattern = 0b11111111;
-#else
         /*
          * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
          * S390, SH4, TriCore, and Xtensa.  Our other supported targets
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
             /* sign bit clear, set frac msb */
             dnan_pattern = 0b01000000;
         }
-#endif
     }
     assert(dnan_pattern != 0);
 
-- 
2.34.1

Now that all our targets have bene converted to explicitly specify
their pattern for the default NaN value we can remove the remaining
fallback code in parts64_default_nan().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241202131347.498124-55-peter.maydell@linaro.org
---
 fpu/softfloat-specialize.c.inc | 14 --------------
 1 file changed, 14 deletions(-)

diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static void parts64_default_nan(FloatParts64 *p, float_status *status)
     uint64_t frac;
     uint8_t dnan_pattern = status->default_nan_pattern;
 
-    if (dnan_pattern == 0) {
-        /*
-         * This case is true for Alpha, ARM, MIPS, OpenRISC, PPC, RISC-V,
-         * S390, SH4, TriCore, and Xtensa.  Our other supported targets
-         * do not have floating-point.
-         */
-        if (snan_bit_is_one(status)) {
-            /* sign bit clear, set all frac bits other than msb */
-            dnan_pattern = 0b00111111;
-        } else {
-            /* sign bit clear, set frac msb */
-            dnan_pattern = 0b01000000;
-        }
-    }
     assert(dnan_pattern != 0);
 
     sign = dnan_pattern >> 7;
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Inline pickNaNMulAdd into its only caller.  This makes
one assert redundant with the immediately preceding IF.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-3-richard.henderson@linaro.org
[PMM: keep comment from old code in new location]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc      | 41 +++++++++++++++++++++++++-
 fpu/softfloat-specialize.c.inc | 54 ----------------------------------
 2 files changed, 40 insertions(+), 55 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
     }
 
     if (s->default_nan_mode) {
+        /*
+         * We guarantee not to require the target to tell us how to
+         * pick a NaN if we're always returning the default NaN.
+         * But if we're not in default-NaN mode then the target must
+         * specify.
+         */
         which = 3;
+    } else if (infzero) {
+        /*
+         * Inf * 0 + NaN -- some implementations return the
+         * default NaN here, and some return the input NaN.
+         */
+        switch (s->float_infzeronan_rule) {
+        case float_infzeronan_dnan_never:
+            which = 2;
+            break;
+        case float_infzeronan_dnan_always:
+            which = 3;
+            break;
+        case float_infzeronan_dnan_if_qnan:
+            which = is_qnan(c->cls) ? 3 : 2;
+            break;
+        default:
+            g_assert_not_reached();
+        }
     } else {
-        which = pickNaNMulAdd(a->cls, b->cls, c->cls, infzero, have_snan, s);
+        FloatClass cls[3] = { a->cls, b->cls, c->cls };
+        Float3NaNPropRule rule = s->float_3nan_prop_rule;
+
+        assert(rule != float_3nan_prop_none);
+        if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
+            /* We have at least one SNaN input and should prefer it */
+            do {
+                which = rule & R_3NAN_1ST_MASK;
+                rule >>= R_3NAN_1ST_LENGTH;
+            } while (!is_snan(cls[which]));
+        } else {
+            do {
+                which = rule & R_3NAN_1ST_MASK;
+                rule >>= R_3NAN_1ST_LENGTH;
+            } while (!is_nan(cls[which]));
+        }
     }
 
     if (which == 3) {
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ static int pickNaN(FloatClass a_cls, FloatClass b_cls,
     }
 }
 
-/*----------------------------------------------------------------------------
-| Select which NaN to propagate for a three-input operation.
-| For the moment we assume that no CPU needs the 'larger significand'
-| information.
-| Return values : 0 : a; 1 : b; 2 : c; 3 : default-NaN
-*----------------------------------------------------------------------------*/
-static int pickNaNMulAdd(FloatClass a_cls, FloatClass b_cls, FloatClass c_cls,
-                         bool infzero, bool have_snan, float_status *status)
-{
-    FloatClass cls[3] = { a_cls, b_cls, c_cls };
-    Float3NaNPropRule rule = status->float_3nan_prop_rule;
-    int which;
-
-    /*
-     * We guarantee not to require the target to tell us how to
-     * pick a NaN if we're always returning the default NaN.
-     * But if we're not in default-NaN mode then the target must
-     * specify.
-     */
-    assert(!status->default_nan_mode);
-
-    if (infzero) {
-        /*
-         * Inf * 0 + NaN -- some implementations return the default NaN here,
-         * and some return the input NaN.
-         */
-        switch (status->float_infzeronan_rule) {
-        case float_infzeronan_dnan_never:
-            return 2;
-        case float_infzeronan_dnan_always:
-            return 3;
-        case float_infzeronan_dnan_if_qnan:
-            return is_qnan(c_cls) ? 3 : 2;
-        default:
-            g_assert_not_reached();
-        }
-    }
-
-    assert(rule != float_3nan_prop_none);
-    if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
-        /* We have at least one SNaN input and should prefer it */
-        do {
-            which = rule & R_3NAN_1ST_MASK;
-            rule >>= R_3NAN_1ST_LENGTH;
-        } while (!is_snan(cls[which]));
-    } else {
-        do {
-            which = rule & R_3NAN_1ST_MASK;
-            rule >>= R_3NAN_1ST_LENGTH;
-        } while (!is_nan(cls[which]));
-    }
-    return which;
-}
-
 /*----------------------------------------------------------------------------
 | Returns 1 if the double-precision floating-point value `a' is a quiet
 | NaN; otherwise returns 0.
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Remove "3" as a special case for which and simply
branch to return the desired value.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
          * But if we're not in default-NaN mode then the target must
          * specify.
          */
-        which = 3;
+        goto default_nan;
     } else if (infzero) {
         /*
          * Inf * 0 + NaN -- some implementations return the
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
          */
         switch (s->float_infzeronan_rule) {
         case float_infzeronan_dnan_never:
-            which = 2;
             break;
         case float_infzeronan_dnan_always:
-            which = 3;
-            break;
+            goto default_nan;
         case float_infzeronan_dnan_if_qnan:
-            which = is_qnan(c->cls) ? 3 : 2;
+            if (is_qnan(c->cls)) {
+                goto default_nan;
+            }
             break;
         default:
             g_assert_not_reached();
         }
+        which = 2;
     } else {
         FloatClass cls[3] = { a->cls, b->cls, c->cls };
         Float3NaNPropRule rule = s->float_3nan_prop_rule;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
         }
     }
 
-    if (which == 3) {
-        parts_default_nan(a, s);
-        return a;
-    }
-
     switch (which) {
     case 0:
         break;
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
         parts_silence_nan(a, s);
     }
     return a;
+
+ default_nan:
+    parts_default_nan(a, s);
+    return a;
 }
 
 /*
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Assign the pointer return value to 'a' directly,
rather than going through an intermediary index.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 32 ++++++++++----------------------
 1 file changed, 10 insertions(+), 22 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
                                             FloatPartsN *c, float_status *s,
                                             int ab_mask, int abc_mask)
 {
-    int which;
     bool infzero = (ab_mask == float_cmask_infzero);
     bool have_snan = (abc_mask & float_cmask_snan);
+    FloatPartsN *ret;
 
     if (unlikely(have_snan)) {
         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
         default:
             g_assert_not_reached();
         }
-        which = 2;
+        ret = c;
     } else {
-        FloatClass cls[3] = { a->cls, b->cls, c->cls };
+        FloatPartsN *val[3] = { a, b, c };
         Float3NaNPropRule rule = s->float_3nan_prop_rule;
 
         assert(rule != float_3nan_prop_none);
         if (have_snan && (rule & R_3NAN_SNAN_MASK)) {
             /* We have at least one SNaN input and should prefer it */
             do {
-                which = rule & R_3NAN_1ST_MASK;
+                ret = val[rule & R_3NAN_1ST_MASK];
                 rule >>= R_3NAN_1ST_LENGTH;
-            } while (!is_snan(cls[which]));
+            } while (!is_snan(ret->cls));
         } else {
             do {
-                which = rule & R_3NAN_1ST_MASK;
+                ret = val[rule & R_3NAN_1ST_MASK];
                 rule >>= R_3NAN_1ST_LENGTH;
-            } while (!is_nan(cls[which]));
+            } while (!is_nan(ret->cls));
         }
     }
 
-    switch (which) {
-    case 0:
-        break;
-    case 1:
-        a = b;
-        break;
-    case 2:
-        a = c;
-        break;
-    default:
-        g_assert_not_reached();
+    if (is_snan(ret->cls)) {
+        parts_silence_nan(ret, s);
     }
-    if (is_snan(a->cls)) {
-        parts_silence_nan(a, s);
-    }
-    return a;
+    return ret;
 
  default_nan:
     parts_default_nan(a, s);
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

While all indices into val[] should be in [0-2], the mask
applied is two bits.  To help static analysis see there is
no possibility of read beyond the end of the array, pad the
array to 4 entries, with the final being (implicitly) NULL.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
         }
         ret = c;
     } else {
-        FloatPartsN *val[3] = { a, b, c };
+        FloatPartsN *val[R_3NAN_1ST_MASK + 1] = { a, b, c };
         Float3NaNPropRule rule = s->float_3nan_prop_rule;
 
         assert(rule != float_3nan_prop_none);
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

This function is part of the public interface and
is not "specialized" to any target in any way.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241203203949.483774-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat.c                | 52 ++++++++++++++++++++++++++++++++++
 fpu/softfloat-specialize.c.inc | 52 ----------------------------------
 2 files changed, 52 insertions(+), 52 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ void normalizeFloatx80Subnormal(uint64_t aSig, int32_t *zExpPtr,
     *zExpPtr = 1 - shiftCount;
 }
 
+/*----------------------------------------------------------------------------
+| Takes two extended double-precision floating-point values `a' and `b', one
+| of which is a NaN, and returns the appropriate NaN result.  If either `a' or
+| `b' is a signaling NaN, the invalid exception is raised.
+*----------------------------------------------------------------------------*/
+
+floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
+{
+    bool aIsLargerSignificand;
+    FloatClass a_cls, b_cls;
+
+    /* This is not complete, but is good enough for pickNaN.  */
+    a_cls = (!floatx80_is_any_nan(a)
+             ? float_class_normal
+             : floatx80_is_signaling_nan(a, status)
+             ? float_class_snan
+             : float_class_qnan);
+    b_cls = (!floatx80_is_any_nan(b)
+             ? float_class_normal
+             : floatx80_is_signaling_nan(b, status)
+             ? float_class_snan
+             : float_class_qnan);
+
+    if (is_snan(a_cls) || is_snan(b_cls)) {
+        float_raise(float_flag_invalid, status);
+    }
+
+    if (status->default_nan_mode) {
+        return floatx80_default_nan(status);
+    }
+
+    if (a.low < b.low) {
+        aIsLargerSignificand = 0;
+    } else if (b.low < a.low) {
+        aIsLargerSignificand = 1;
+    } else {
+        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
+    }
+
+    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
+        if (is_snan(b_cls)) {
+            return floatx80_silence_nan(b, status);
+        }
+        return b;
+    } else {
+        if (is_snan(a_cls)) {
+            return floatx80_silence_nan(a, status);
+        }
+        return a;
+    }
+}
+
 /*----------------------------------------------------------------------------
 | Takes an abstract floating-point value having sign `zSign', exponent `zExp',
 | and extended significand formed by the concatenation of `zSig0' and `zSig1',
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ floatx80 floatx80_silence_nan(floatx80 a, float_status *status)
     return a;
 }
 
-/*----------------------------------------------------------------------------
-| Takes two extended double-precision floating-point values `a' and `b', one
-| of which is a NaN, and returns the appropriate NaN result.  If either `a' or
-| `b' is a signaling NaN, the invalid exception is raised.
-*----------------------------------------------------------------------------*/
-
-floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
-{
-    bool aIsLargerSignificand;
-    FloatClass a_cls, b_cls;
-
-    /* This is not complete, but is good enough for pickNaN.  */
-    a_cls = (!floatx80_is_any_nan(a)
-             ? float_class_normal
-             : floatx80_is_signaling_nan(a, status)
-             ? float_class_snan
-             : float_class_qnan);
-    b_cls = (!floatx80_is_any_nan(b)
-             ? float_class_normal
-             : floatx80_is_signaling_nan(b, status)
-             ? float_class_snan
-             : float_class_qnan);
-
-    if (is_snan(a_cls) || is_snan(b_cls)) {
-        float_raise(float_flag_invalid, status);
-    }
-
-    if (status->default_nan_mode) {
-        return floatx80_default_nan(status);
-    }
-
-    if (a.low < b.low) {
-        aIsLargerSignificand = 0;
-    } else if (b.low < a.low) {
-        aIsLargerSignificand = 1;
-    } else {
-        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
-    }
-
-    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
-        if (is_snan(b_cls)) {
-            return floatx80_silence_nan(b, status);
-        }
-        return b;
-    } else {
-        if (is_snan(a_cls)) {
-            return floatx80_silence_nan(a, status);
-        }
-        return a;
-    }
-}
-
 /*----------------------------------------------------------------------------
 | Returns 1 if the quadruple-precision floating-point value `a' is a quiet
 | NaN; otherwise returns 0.
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Unpacking and repacking the parts may be slightly more work
than we did before, but we get to reuse more code.  For a
code path handling exceptional values, this is an improvement.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20241203203949.483774-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat.c | 43 +++++--------------------------------------
 1 file changed, 5 insertions(+), 38 deletions(-)

diff --git a/fpu/softfloat.c b/fpu/softfloat.c
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat.c
+++ b/fpu/softfloat.c
@@ -XXX,XX +XXX,XX @@ void normalizeFloatx80Subnormal(uint64_t aSig, int32_t *zExpPtr,
 
 floatx80 propagateFloatx80NaN(floatx80 a, floatx80 b, float_status *status)
 {
-    bool aIsLargerSignificand;
-    FloatClass a_cls, b_cls;
+    FloatParts128 pa, pb, *pr;
 
-    /* This is not complete, but is good enough for pickNaN.  */
-    a_cls = (!floatx80_is_any_nan(a)
-             ? float_class_normal
-             : floatx80_is_signaling_nan(a, status)
-             ? float_class_snan
-             : float_class_qnan);
-    b_cls = (!floatx80_is_any_nan(b)
-             ? float_class_normal
-             : floatx80_is_signaling_nan(b, status)
-             ? float_class_snan
-             : float_class_qnan);
-
-    if (is_snan(a_cls) || is_snan(b_cls)) {
-        float_raise(float_flag_invalid, status);
-    }
-
-    if (status->default_nan_mode) {
+    if (!floatx80_unpack_canonical(&pa, a, status) ||
+        !floatx80_unpack_canonical(&pb, b, status)) {
         return floatx80_default_nan(status);
     }
 
-    if (a.low < b.low) {
-        aIsLargerSignificand = 0;
-    } else if (b.low < a.low) {
-        aIsLargerSignificand = 1;
-    } else {
-        aIsLargerSignificand = (a.high < b.high) ? 1 : 0;
-    }
-
-    if (pickNaN(a_cls, b_cls, aIsLargerSignificand, status)) {
-        if (is_snan(b_cls)) {
-            return floatx80_silence_nan(b, status);
-        }
-        return b;
-    } else {
-        if (is_snan(a_cls)) {
-            return floatx80_silence_nan(a, status);
-        }
-        return a;
-    }
+    pr = parts_pick_nan(&pa, &pb, status);
+    return floatx80_round_pack_canonical(pr, status);
 }
 
 /*----------------------------------------------------------------------------
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Inline pickNaN into its only caller.  This makes one assert
redundant with the immediately preceding IF.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc      | 82 +++++++++++++++++++++++++----
 fpu/softfloat-specialize.c.inc | 96 ----------------------------------
 2 files changed, 73 insertions(+), 105 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static void partsN(return_nan)(FloatPartsN *a, float_status *s)
 static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
                                      float_status *s)
 {
+    int cmp, which;
+
     if (is_snan(a->cls) || is_snan(b->cls)) {
         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
     }
 
     if (s->default_nan_mode) {
         parts_default_nan(a, s);
-    } else {
-        int cmp = frac_cmp(a, b);
-        if (cmp == 0) {
-            cmp = a->sign < b->sign;
-        }
+        return a;
+    }
 
-        if (pickNaN(a->cls, b->cls, cmp > 0, s)) {
-            a = b;
-        }
+    cmp = frac_cmp(a, b);
+    if (cmp == 0) {
+        cmp = a->sign < b->sign;
+    }
+
+    switch (s->float_2nan_prop_rule) {
+    case float_2nan_prop_s_ab:
         if (is_snan(a->cls)) {
-            parts_silence_nan(a, s);
+            which = 0;
+        } else if (is_snan(b->cls)) {
+            which = 1;
+        } else if (is_qnan(a->cls)) {
+            which = 0;
+        } else {
+            which = 1;
         }
+        break;
+    case float_2nan_prop_s_ba:
+        if (is_snan(b->cls)) {
+            which = 1;
+        } else if (is_snan(a->cls)) {
+            which = 0;
+        } else if (is_qnan(b->cls)) {
+            which = 1;
+        } else {
+            which = 0;
+        }
+        break;
+    case float_2nan_prop_ab:
+        which = is_nan(a->cls) ? 0 : 1;
+        break;
+    case float_2nan_prop_ba:
+        which = is_nan(b->cls) ? 1 : 0;
+        break;
+    case float_2nan_prop_x87:
+        /*
+         * This implements x87 NaN propagation rules:
+         * SNaN + QNaN => return the QNaN
+         * two SNaNs => return the one with the larger significand, silenced
+         * two QNaNs => return the one with the larger significand
+         * SNaN and a non-NaN => return the SNaN, silenced
+         * QNaN and a non-NaN => return the QNaN
+         *
+         * If we get down to comparing significands and they are the same,
+         * return the NaN with the positive sign bit (if any).
+         */
+        if (is_snan(a->cls)) {
+            if (is_snan(b->cls)) {
+                which = cmp > 0 ? 0 : 1;
+            } else {
+                which = is_qnan(b->cls) ? 1 : 0;
+            }
+        } else if (is_qnan(a->cls)) {
+            if (is_snan(b->cls) || !is_qnan(b->cls)) {
+                which = 0;
+            } else {
+                which = cmp > 0 ? 0 : 1;
+            }
+        } else {
+            which = 1;
+        }
+        break;
+    default:
+        g_assert_not_reached();
+    }
+
+    if (which) {
+        a = b;
+    }
+    if (is_snan(a->cls)) {
+        parts_silence_nan(a, s);
     }
     return a;
 }
diff --git a/fpu/softfloat-specialize.c.inc b/fpu/softfloat-specialize.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-specialize.c.inc
+++ b/fpu/softfloat-specialize.c.inc
@@ -XXX,XX +XXX,XX @@ bool float32_is_signaling_nan(float32 a_, float_status *status)
     }
 }
 
-/*----------------------------------------------------------------------------
-| Select which NaN to propagate for a two-input operation.
-| IEEE754 doesn't specify all the details of this, so the
-| algorithm is target-specific.
-| The routine is passed various bits of information about the
-| two NaNs and should return 0 to select NaN a and 1 for NaN b.
-| Note that signalling NaNs are always squashed to quiet NaNs
-| by the caller, by calling floatXX_silence_nan() before
-| returning them.
-|
-| aIsLargerSignificand is only valid if both a and b are NaNs
-| of some kind, and is true if a has the larger significand,
-| or if both a and b have the same significand but a is
-| positive but b is negative. It is only needed for the x87
-| tie-break rule.
-*----------------------------------------------------------------------------*/
-
-static int pickNaN(FloatClass a_cls, FloatClass b_cls,
-                   bool aIsLargerSignificand, float_status *status)
-{
-    /*
-     * We guarantee not to require the target to tell us how to
-     * pick a NaN if we're always returning the default NaN.
-     * But if we're not in default-NaN mode then the target must
-     * specify via set_float_2nan_prop_rule().
-     */
-    assert(!status->default_nan_mode);
-
-    switch (status->float_2nan_prop_rule) {
-    case float_2nan_prop_s_ab:
-        if (is_snan(a_cls)) {
-            return 0;
-        } else if (is_snan(b_cls)) {
-            return 1;
-        } else if (is_qnan(a_cls)) {
-            return 0;
-        } else {
-            return 1;
-        }
-        break;
-    case float_2nan_prop_s_ba:
-        if (is_snan(b_cls)) {
-            return 1;
-        } else if (is_snan(a_cls)) {
-            return 0;
-        } else if (is_qnan(b_cls)) {
-            return 1;
-        } else {
-            return 0;
-        }
-        break;
-    case float_2nan_prop_ab:
-        if (is_nan(a_cls)) {
-            return 0;
-        } else {
-            return 1;
-        }
-        break;
-    case float_2nan_prop_ba:
-        if (is_nan(b_cls)) {
-            return 1;
-        } else {
-            return 0;
-        }
-        break;
-    case float_2nan_prop_x87:
-        /*
-         * This implements x87 NaN propagation rules:
-         * SNaN + QNaN => return the QNaN
-         * two SNaNs => return the one with the larger significand, silenced
-         * two QNaNs => return the one with the larger significand
-         * SNaN and a non-NaN => return the SNaN, silenced
-         * QNaN and a non-NaN => return the QNaN
-         *
-         * If we get down to comparing significands and they are the same,
-         * return the NaN with the positive sign bit (if any).
-         */
-        if (is_snan(a_cls)) {
-            if (is_snan(b_cls)) {
-                return aIsLargerSignificand ? 0 : 1;
-            }
-            return is_qnan(b_cls) ? 1 : 0;
-        } else if (is_qnan(a_cls)) {
-            if (is_snan(b_cls) || !is_qnan(b_cls)) {
-                return 0;
-            } else {
-                return aIsLargerSignificand ? 0 : 1;
-            }
-        } else {
-            return 1;
-        }
-    default:
-        g_assert_not_reached();
-    }
-}
-
 /*----------------------------------------------------------------------------
 | Returns 1 if the double-precision floating-point value `a' is a quiet
 | NaN; otherwise returns 0.
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Remember if there was an SNaN, and use that to simplify
float_2nan_prop_s_{ab,ba} to only the snan component.
Then, fall through to the corresponding
float_2nan_prop_{ab,ba} case to handle any remaining
nans, which must be quiet.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241203203949.483774-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 32 ++++++++++++--------------------
 1 file changed, 12 insertions(+), 20 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Move the fractional comparison to the end of the
float_2nan_prop_x87 case.  This is not required for
any other 2nan propagation rule.  Reorganize the
x87 case itself to break out of the switch when the
fractional comparison is not required.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20241203203949.483774-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 19 +++++++++----------
 1 file changed, 9 insertions(+), 10 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
         return a;
     }
 
-    cmp = frac_cmp(a, b);
-    if (cmp == 0) {
-        cmp = a->sign < b->sign;
-    }
-
     switch (s->float_2nan_prop_rule) {
     case float_2nan_prop_s_ab:
         if (have_snan) {
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
          * return the NaN with the positive sign bit (if any).
          */
         if (is_snan(a->cls)) {
-            if (is_snan(b->cls)) {
-                which = cmp > 0 ? 0 : 1;
-            } else {
+            if (!is_snan(b->cls)) {
                 which = is_qnan(b->cls) ? 1 : 0;
+                break;
             }
         } else if (is_qnan(a->cls)) {
             if (is_snan(b->cls) || !is_qnan(b->cls)) {
                 which = 0;
-            } else {
-                which = cmp > 0 ? 0 : 1;
+                break;
             }
         } else {
             which = 1;
+            break;
         }
+        cmp = frac_cmp(a, b);
+        if (cmp == 0) {
+            cmp = a->sign < b->sign;
+        }
+        which = cmp > 0 ? 0 : 1;
         break;
     default:
         g_assert_not_reached();
-- 
2.34.1

From: Richard Henderson <richard.henderson@linaro.org>

Replace the "index" selecting between A and B with a result variable
of the proper type.  This improves clarity within the function.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241203203949.483774-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 fpu/softfloat-parts.c.inc | 28 +++++++++++++---------------
 1 file changed, 13 insertions(+), 15 deletions(-)

diff --git a/fpu/softfloat-parts.c.inc b/fpu/softfloat-parts.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/fpu/softfloat-parts.c.inc
+++ b/fpu/softfloat-parts.c.inc
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
                                      float_status *s)
 {
     bool have_snan = false;
-    int cmp, which;
+    FloatPartsN *ret;
+    int cmp;
 
     if (is_snan(a->cls) || is_snan(b->cls)) {
         float_raise(float_flag_invalid | float_flag_invalid_snan, s);
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
     switch (s->float_2nan_prop_rule) {
     case float_2nan_prop_s_ab:
         if (have_snan) {
-            which = is_snan(a->cls) ? 0 : 1;
+            ret = is_snan(a->cls) ? a : b;
             break;
         }
         /* fall through */
     case float_2nan_prop_ab:
-        which = is_nan(a->cls) ? 0 : 1;
+        ret = is_nan(a->cls) ? a : b;
         break;
     case float_2nan_prop_s_ba:
         if (have_snan) {
-            which = is_snan(b->cls) ? 1 : 0;
+            ret = is_snan(b->cls) ? b : a;
             break;
         }
         /* fall through */
     case float_2nan_prop_ba:
-        which = is_nan(b->cls) ? 1 : 0;
+        ret = is_nan(b->cls) ? b : a;
         break;
     case float_2nan_prop_x87:
         /*
@@ -XXX,XX +XXX,XX @@ static FloatPartsN *partsN(pick_nan)(FloatPartsN *a, FloatPartsN *b,
          */
         if (is_snan(a->cls)) {
             if (!is_snan(b->cls)) {
-                which = is_qnan(b->cls) ? 1 : 0;
+                ret = is_qnan(b->cls) ? b : a;
                 break;
             }
         } else if (is_qnan(a->cls)) {
             if (is_snan(b->cls) || !is_qnan(b->cls)) {
-                which = 0;
+                ret = a;
                 break;
             }
         } else {
-            which = 1;
+            ret = b;
             break;
         }
         cmp = frac_cmp(a, b);
         if (cmp == 0) {
             cmp = a->sign < b->sign;
         }
-        which = cmp > 0 ? 0 : 1;
+        ret = cmp > 0 ? a : b;
         break;
     default:
         g_assert_not_reached();
     }
 
-    if (which) {
-        a = b;
+    if (is_snan(ret->cls)) {
+        parts_silence_nan(ret, s);
     }
-    if (is_snan(a->cls)) {
-        parts_silence_nan(a, s);
-    }
-    return a;
+    return ret;
 }
 
 static FloatPartsN *partsN(pick_nan_muladd)(FloatPartsN *a, FloatPartsN *b,
-- 
2.34.1

From: Leif Lindholm <quic_llindhol@quicinc.com>

I'm migrating to Qualcomm's new open source email infrastructure, so
update my email address, and update the mailmap to match.

Signed-off-by: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
Reviewed-by: Leif Lindholm <quic_llindhol@quicinc.com>
Reviewed-by: Brian Cain <brian.cain@oss.qualcomm.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20241205114047.1125842-1-leif.lindholm@oss.qualcomm.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 2 +-
 .mailmap    | 5 +++--
 2 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/ssi/imx_spi.h
 SBSA-REF
 M: Radoslaw Biernacki <rad@semihalf.com>
 M: Peter Maydell <peter.maydell@linaro.org>
-R: Leif Lindholm <quic_llindhol@quicinc.com>
+R: Leif Lindholm <leif.lindholm@oss.qualcomm.com>
 R: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 L: qemu-arm@nongnu.org
 S: Maintained
diff --git a/.mailmap b/.mailmap
index XXXXXXX..XXXXXXX 100644
--- a/.mailmap
+++ b/.mailmap
@@ -XXX,XX +XXX,XX @@ Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
 Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
 James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
 Juan Quintela <quintela@trasno.org> <quintela@redhat.com>
-Leif Lindholm <quic_llindhol@quicinc.com> <leif.lindholm@linaro.org>
-Leif Lindholm <quic_llindhol@quicinc.com> <leif@nuviainc.com>
+Leif Lindholm <leif.lindholm@oss.qualcomm.com> <quic_llindhol@quicinc.com>
+Leif Lindholm <leif.lindholm@oss.qualcomm.com> <leif.lindholm@linaro.org>
+Leif Lindholm <leif.lindholm@oss.qualcomm.com> <leif@nuviainc.com>
 Luc Michel <luc@lmichel.fr> <luc.michel@git.antfield.fr>
 Luc Michel <luc@lmichel.fr> <luc.michel@greensocs.com>
 Luc Michel <luc@lmichel.fr> <lmichel@kalray.eu>
-- 
2.34.1

From: Vikram Garhwal <vikram.garhwal@bytedance.com>

Previously, maintainer role was paused due to inactive email id. Commit id:
c009d715721861984c4987bcc78b7ee183e86d75.

Signed-off-by: Vikram Garhwal <vikram.garhwal@bytedance.com>
Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
Message-id: 20241204184205.12952-1-vikram.garhwal@bytedance.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: tests/qtest/fuzz-sb16-test.c
 
 Xilinx CAN
 M: Francisco Iglesias <francisco.iglesias@amd.com>
+M: Vikram Garhwal <vikram.garhwal@bytedance.com>
 S: Maintained
 F: hw/net/can/xlnx-*
 F: include/hw/net/xlnx-*
@@ -XXX,XX +XXX,XX @@ F: include/hw/rx/
 CAN bus subsystem and hardware
 M: Pavel Pisa <pisa@cmp.felk.cvut.cz>
 M: Francisco Iglesias <francisco.iglesias@amd.com>
+M: Vikram Garhwal <vikram.garhwal@bytedance.com>
 S: Maintained
 W: https://canbus.pages.fel.cvut.cz/
 F: net/can/*
-- 
2.34.1