Series comparison

-[Qemu-devel] [PULL 00/20] target-arm queue
+[PULL 00/12] target-arm queue
-Mostly my stuff with a few easy patches from others. I know I have
+The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:
 a few big series in my to-review queue, but I've been too jetlagged
 to try to tackle those :-(
-thanks
+  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)
 -- PMM
-The following changes since commit a26a98dfb9d448d7234d931ae3720feddf6f0651:
+are available in the Git repository at:
-  Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20171006' into staging (2017-10-06 13:19:03 +0100)
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201008
-are available in the git repository at:
+for you to fetch changes up to ba118c26e16a97e6ff6de8184057d3420ce16a23:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171006
+  target/arm: Make '-cpu max' have a 48-bit PA (2020-10-08 15:24:32 +0100)
 for you to fetch changes up to 04829ce334bece78d4fa1d0fdbc8bc27dae9b242:
   nvic: Add missing code for writing SHCSR.HARDFAULTPENDED bit (2017-10-06 16:46:49 +0100)
 ----------------------------------------------------------------
-target-arm:
+target-arm queue:
- * v8M: more preparatory work
+ * hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer
- * nvic: reset properly rather than leaving the nvic in a weird state
+ * hw/arm/fsl-imx25: Fix a typo
- * xlnx-zynqmp: Mark the "xlnx, zynqmp" device with user_creatable = false
+ * hw/arm/sbsa-ref : Fix SMMUv3 Initialisation
- * sd: fix out-of-bounds check for multi block reads
+ * hw/arm/sbsa-ref : allocate IRQs for SMMUv3
- * arm: Fix SMC reporting to EL2 when QEMU provides PSCI
+ * hw/char/bcm2835_aux: Allow less than 32-bit accesses
  * hw/arm/virt: Implement kvm-steal-time
  * target/arm: Make '-cpu max' have a 48-bit PA
 ----------------------------------------------------------------
-Jan Kiszka (1):
+Andrew Jones (6):
-      arm: Fix SMC reporting to EL2 when QEMU provides PSCI
+      linux headers: sync to 5.9-rc7
       target/arm/kvm: Make uncalled stubs explicitly unreachable
       hw/arm/virt: Move post cpu realize check into its own function
       hw/arm/virt: Move kvm pmu setup to virt_cpu_post_init
       tests/qtest: Restore aarch64 arm-cpu-features test
       hw/arm/virt: Implement kvm-steal-time
-Michael Olbrich (1):
+Graeme Gregory (2):
-      hw/sd: fix out-of-bounds check for multi block reads
+      hw/arm/sbsa-ref : Fix SMMUv3 Initialisation
       hw/arm/sbsa-ref : allocate IRQs for SMMUv3
-Peter Maydell (17):
+Peter Maydell (1):
-      nvic: Clear the vector arrays and prigroup on reset
+      target/arm: Make '-cpu max' have a 48-bit PA
       target/arm: Don't switch to target stack early in v7M exception return
       target/arm: Prepare for CONTROL.SPSEL being nonzero in Handler mode
       target/arm: Restore security state on exception return
       target/arm: Restore SPSEL to correct CONTROL register on exception return
       target/arm: Check for xPSR mismatch usage faults earlier for v8M
       target/arm: Warn about restoring to unaligned stack
       target/arm: Don't warn about exception return with PC low bit set for v8M
       target/arm: Add new-in-v8M SFSR and SFAR
       target/arm: Update excret sanity checks for v8M
       target/arm: Add support for restoring v8M additional state context
       target/arm: Add v8M support to exception entry code
       nvic: Implement Security Attribution Unit registers
       target/arm: Implement security attribute lookups for memory accesses
       target/arm: Fix calculation of secure mm_idx values
       target/arm: Factor out "get mmuidx for specified security state"
       nvic: Add missing code for writing SHCSR.HARDFAULTPENDED bit
-Thomas Huth (1):
+Philippe Mathieu-Daudé (3):
-      hw/arm/xlnx-zynqmp: Mark the "xlnx, zynqmp" device with user_creatable = false
+      hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer
       hw/arm/fsl-imx25: Fix a typo
       hw/char/bcm2835_aux: Allow less than 32-bit accesses
- target/arm/cpu.h       |  60 ++++-
+ docs/system/arm/cpu-features.rst |  11 ++++
- target/arm/internals.h |  15 ++
+ include/hw/arm/fsl-imx25.h       |   2 +-
- hw/arm/xlnx-zynqmp.c   |   2 +
+ include/hw/arm/virt.h            |   5 ++
- hw/intc/armv7m_nvic.c  | 158 ++++++++++-
+ linux-headers/linux/kvm.h        |   6 ++-
- hw/sd/sd.c             |  12 +-
+ target/arm/cpu.h                 |   4 ++
- target/arm/cpu.c       |  27 ++
+ target/arm/kvm_arm.h             |  94 ++++++++++++++++++++++++++-------
- target/arm/helper.c    | 691 +++++++++++++++++++++++++++++++++++++++++++------
+ hw/arm/sbsa-ref.c                |   3 +-
- target/arm/machine.c   |  16 ++
+ hw/arm/virt.c                    | 110 ++++++++++++++++++++++++++++-----------
- target/arm/op_helper.c |  27 +-
+ hw/char/bcm2835_aux.c            |   4 +-
-files changed, 898 insertions(+), 110 deletions(-)
+ hw/ssi/npcm7xx_fiu.c             |  12 ++---
  target/arm/cpu.c                 |   8 +++
  target/arm/cpu64.c               |   4 ++
  target/arm/kvm.c                 |  16 ++++++
  target/arm/kvm64.c               |  64 +++++++++++++++++++++--
  target/arm/monitor.c             |   2 +-
  tests/qtest/arm-cpu-features.c   |  25 +++++++--
  hw/ssi/trace-events              |   2 +-
  tests/qtest/meson.build          |   3 +-
 files changed, 303 insertions(+), 72 deletions(-)

-[Qemu-devel] [PULL 05/20] target/arm: Don't switch to target stack early in v7M exception return
+[PULL 01/12] hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer
-Currently our M profile exception return code switches to the
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 target stack pointer relatively early in the process, before
 it tries to pop the exception frame off the stack. This is
 awkward for v8M for two reasons:
  * in v8M the process vs main stack pointer is not selected
    purely by the value of CONTROL.SPSEL, so updating SPSEL
    and relying on that to switch to the right stack pointer
    won't work
  * the stack we should be reading the stack frame from and
    the stack we will eventually switch to might not be the
    same if the guest is doing strange things
-Change our exception return code to use a 'frame pointer'
+Fix integer handling issues handling issue reported by Coverity:
 to read the exception frame rather than assuming that we
 can switch the live stack pointer this early.
+  hw/ssi/npcm7xx_fiu.c: 162 in npcm7xx_fiu_flash_read()
+  >>>     CID 1432730:  Integer handling issues  (NEGATIVE_RETURNS)
+  >>>     "npcm7xx_fiu_cs_index(fiu, f)" is passed to a parameter that cannot be negative.
+npcm7xx_fiu_select(fiu, npcm7xx_fiu_cs_index(fiu, f));
+  hw/ssi/npcm7xx_fiu.c: 221 in npcm7xx_fiu_flash_write()
+cs_id = npcm7xx_fiu_cs_index(fiu, f);
+trace_npcm7xx_fiu_flash_write(DEVICE(fiu)->canonical_path, cs_id, addr,
+size, v);
+  >>>     CID 1432729:  Integer handling issues  (NEGATIVE_RETURNS)
+  >>>     "cs_id" is passed to a parameter that cannot be negative.
+npcm7xx_fiu_select(fiu, cs_id);
+Since the index of the flash can not be negative, return an
+unsigned type.
+Reported-by: Coverity (CID 1432729 & 1432730: NEGATIVE_RETURNS)
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
+Message-id: 20200919132435.310527-1-f4bug@amsat.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-3-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 130 +++++++++++++++++++++++++++++++++++++++-------------
+ hw/ssi/npcm7xx_fiu.c | 12 ++++++------
-file changed, 98 insertions(+), 32 deletions(-)
+ hw/ssi/trace-events  |  2 +-
 files changed, 7 insertions(+), 7 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/ssi/npcm7xx_fiu.c b/hw/ssi/npcm7xx_fiu.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/ssi/npcm7xx_fiu.c
-+++ b/target/arm/helper.c
++++ b/hw/ssi/npcm7xx_fiu.c
-@@ -XXX,XX +XXX,XX @@ static void v7m_push(CPUARMState *env, uint32_t val)
+@@ -XXX,XX +XXX,XX @@ enum NPCM7xxFIURegister {
-     stl_phys(cs->as, env->regs[13], val);
+  * Returns the index of flash in the fiu->flash array. This corresponds to the
   * chip select ID of the flash.
   */
 -static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)
 +static unsigned npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu,
 +                                     NPCM7xxFIUFlash *flash)
  {
      int index = flash - fiu->flash;
@@ -XXX,XX +XXX,XX @@ static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)
  }
--static uint32_t v7m_pop(CPUARMState *env)
+ /* Assert the chip select specified in the UMA Control/Status Register. */
--{
+-static void npcm7xx_fiu_select(NPCM7xxFIUState *s, int cs_id)
--    CPUState *cs = CPU(arm_env_get_cpu(env));
++static void npcm7xx_fiu_select(NPCM7xxFIUState *s, unsigned cs_id)
--    uint32_t val;
+ {
      trace_npcm7xx_fiu_select(DEVICE(s)->canonical_path, cs_id);
      if (cs_id < s->cs_count) {
          qemu_irq_lower(s->cs_lines[cs_id]);
 +        s->active_cs = cs_id;
      } else {
          qemu_log_mask(LOG_GUEST_ERROR,
                        "%s: UMA to CS%d; this module has only %d chip selects",
                        DEVICE(s)->canonical_path, cs_id, s->cs_count);
 -        cs_id = -1;
 +        s->active_cs = -1;
      }
 -
--    val = ldl_phys(cs->as, env->regs[13]);
+-    s->active_cs = cs_id;
 -    env->regs[13] += 4;
 -    return val;
 -}
 -
  /* Return true if we're using the process stack pointer (not the MSP) */
  static bool v7m_using_psp(CPUARMState *env)
  {
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
      env->regs[15] = dest & ~1;
  }
-+static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
+ /* Deassert the currently active chip select. */
-+                                bool spsel)
+@@ -XXX,XX +XXX,XX @@ static void npcm7xx_fiu_flash_write(void *opaque, hwaddr addr, uint64_t v,
-+{
+     NPCM7xxFIUFlash *f = opaque;
-+    /* Return a pointer to the location where we currently store the
+     NPCM7xxFIUState *fiu = f->fiu;
-+     * stack pointer for the requested security state and thread mode.
+     uint32_t dwr_cfg;
-+     * This pointer will become invalid if the CPU state is updated
+-    int cs_id;
-+     * such that the stack pointers are switched around (eg changing
++    unsigned cs_id;
-+     * the SPSEL control bit).
+     int i;
-+     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
-+     * Unlike that pseudocode, we require the caller to pass us in the
+     if (fiu->active_cs != -1) {
-+     * SPSEL control bit value; this is because we also use this
+diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
-+     * function in handling of pushing of the callee-saves registers
+index XXXXXXX..XXXXXXX 100644
-+     * part of the v8M stack frame (pseudocode PushCalleeStack()),
+--- a/hw/ssi/trace-events
-+     * and in the tailchain codepath the SPSEL bit comes from the exception
++++ b/hw/ssi/trace-events
-+     * return magic LR value from the previous exception. The pseudocode
+@@ -XXX,XX +XXX,XX @@ npcm7xx_fiu_deselect(const char *id, int cs) "%s deselect CS%d"
-+     * opencodes the stack-selection in PushCalleeStack(), but we prefer
+ npcm7xx_fiu_ctrl_read(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
-+     * to make this utility function generic enough to do the job.
+ npcm7xx_fiu_ctrl_write(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
-+     */
+ npcm7xx_fiu_flash_read(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
-+    bool want_psp = threadmode && spsel;
+-npcm7xx_fiu_flash_write(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
-+
++npcm7xx_fiu_flash_write(const char *id, unsigned cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
 +    if (secure == env->v7m.secure) {
 +        /* Currently switch_v7m_sp switches SP as it updates SPSEL,
 +         * so the SP we want is always in regs[13].
 +         * When we decouple SPSEL from the actually selected SP
 +         * we need to check want_psp against v7m_using_psp()
 +         * to see whether we need regs[13] or v7m.other_sp.
 +         */
 +        return &env->regs[13];
 +    } else {
 +        if (want_psp) {
 +            return &env->v7m.other_ss_psp;
 +        } else {
 +            return &env->v7m.other_ss_msp;
 +        }
 +    }
 +}
 +
  static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
  {
      CPUState *cs = CPU(cpu);
@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
  static void do_v7m_exception_exit(ARMCPU *cpu)
  {
      CPUARMState *env = &cpu->env;
 +    CPUState *cs = CPU(cpu);
      uint32_t excret;
      uint32_t xpsr;
      bool ufault = false;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      bool return_to_handler = false;
      bool rettobase = false;
      bool exc_secure = false;
 +    bool return_to_secure;
      /* We can only get here from an EXCP_EXCEPTION_EXIT, and
       * gen_bx_excret() enforces the architectural rule
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          g_assert_not_reached();
      }
 +    return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
 +        (excret & R_V7M_EXCRET_S_MASK);
 +
      switch (excret & 0xf) {
      case 1: /* Return to Handler */
          return_to_handler = true;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          return;
      }
 -    /* Switch to the target stack.  */
 +    /* Set CONTROL.SPSEL from excret.SPSEL. For QEMU this currently
 +     * causes us to switch the active SP, but we will change this
 +     * later to not do that so we can support v8M.
 +     */
      switch_v7m_sp(env, return_to_sp_process);
 -    /* Pop registers.  */
 -    env->regs[0] = v7m_pop(env);
 -    env->regs[1] = v7m_pop(env);
 -    env->regs[2] = v7m_pop(env);
 -    env->regs[3] = v7m_pop(env);
 -    env->regs[12] = v7m_pop(env);
 -    env->regs[14] = v7m_pop(env);
 -    env->regs[15] = v7m_pop(env);
 -    if (env->regs[15] & 1) {
 -        qemu_log_mask(LOG_GUEST_ERROR,
 -                      "M profile return from interrupt with misaligned "
 -                      "PC is UNPREDICTABLE\n");
 -        /* Actual hardware seems to ignore the lsbit, and there are several
 -         * RTOSes out there which incorrectly assume the r15 in the stack
 -         * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
 +
 +    {
 +        /* The stack pointer we should be reading the exception frame from
 +         * depends on bits in the magic exception return type value (and
 +         * for v8M isn't necessarily the stack pointer we will eventually
 +         * end up resuming execution with). Get a pointer to the location
 +         * in the CPU state struct where the SP we need is currently being
 +         * stored; we will use and modify it in place.
 +         * We use this limited C variable scope so we don't accidentally
 +         * use 'frame_sp_p' after we do something that makes it invalid.
 +         */
 +        uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
 +                                              return_to_secure,
 +                                              !return_to_handler,
 +                                              return_to_sp_process);
 +        uint32_t frameptr = *frame_sp_p;
 +
 +        /* Pop registers. TODO: make these accesses use the correct
 +         * attributes and address space (S/NS, priv/unpriv) and handle
 +         * memory transaction failures.
           */
 -        env->regs[15] &= ~1U;
 +        env->regs[0] = ldl_phys(cs->as, frameptr);
 +        env->regs[1] = ldl_phys(cs->as, frameptr + 0x4);
 +        env->regs[2] = ldl_phys(cs->as, frameptr + 0x8);
 +        env->regs[3] = ldl_phys(cs->as, frameptr + 0xc);
 +        env->regs[12] = ldl_phys(cs->as, frameptr + 0x10);
 +        env->regs[14] = ldl_phys(cs->as, frameptr + 0x14);
 +        env->regs[15] = ldl_phys(cs->as, frameptr + 0x18);
 +        if (env->regs[15] & 1) {
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "M profile return from interrupt with misaligned "
 +                          "PC is UNPREDICTABLE\n");
 +            /* Actual hardware seems to ignore the lsbit, and there are several
 +             * RTOSes out there which incorrectly assume the r15 in the stack
 +             * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
 +             */
 +            env->regs[15] &= ~1U;
 +        }
 +        xpsr = ldl_phys(cs->as, frameptr + 0x1c);
 +
 +        /* Commit to consuming the stack frame */
 +        frameptr += 0x20;
 +        /* Undo stack alignment (the SPREALIGN bit indicates that the original
 +         * pre-exception SP was not 8-aligned and we added a padding word to
 +         * align it, so we undo this by ORing in the bit that increases it
 +         * from the current 8-aligned value to the 8-unaligned value. (Adding 4
 +         * would work too but a logical OR is how the pseudocode specifies it.)
 +         */
 +        if (xpsr & XPSR_SPREALIGN) {
 +            frameptr |= 4;
 +        }
 +        *frame_sp_p = frameptr;
      }
 -    xpsr = v7m_pop(env);
 +    /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
      xpsr_write(env, xpsr, ~XPSR_SPREALIGN);
 -    /* Undo stack alignment.  */
 -    if (xpsr & XPSR_SPREALIGN) {
 -        env->regs[13] |= 4;
 -    }
      /* The restored xPSR exception field will be zero if we're
       * resuming in Thread mode. If that doesn't match what the
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 01/20] arm: Fix SMC reporting to EL2 when QEMU provides PSCI
+[PULL 02/12] hw/arm/fsl-imx25: Fix a typo
-From: Jan Kiszka <jan.kiszka@siemens.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-This properly forwards SMC events to EL2 when PSCI is provided by QEMU
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-itself and, thus, ARM_FEATURE_EL3 is off.
+Message-id: 20201002080935.1660005-1-f4bug@amsat.org
 Found and tested with the Jailhouse hypervisor. Solution based on
 suggestions by Peter Maydell.
 Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
 Message-id: 4f243068-aaea-776f-d18f-f9e05e7be9cd@siemens.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c    |  9 ++++++++-
+ include/hw/arm/fsl-imx25.h | 2 +-
- target/arm/op_helper.c | 27 +++++++++++++++++----------
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 25 insertions(+), 11 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/include/hw/arm/fsl-imx25.h
-+++ b/target/arm/helper.c
++++ b/include/hw/arm/fsl-imx25.h
-@@ -XXX,XX +XXX,XX @@ static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+@@ -XXX,XX +XXX,XX @@ struct FslIMX25State {
+  * 0xBB00_0000 0xBB00_0FFF 4 Kbytes     NAND flash main area buffer
-     if (arm_feature(env, ARM_FEATURE_EL3)) {
+  * 0xBB00_1000 0xBB00_11FF 512 B        NAND flash spare area buffer
-         valid_mask &= ~HCR_HCD;
+  * 0xBB00_1200 0xBB00_1DFF 3 Kbytes     Reserved
--    } else {
+- * 0xBB00_1E00 0xBB00_1FFF 512 B        NAND flash control regisers
-+    } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
++ * 0xBB00_1E00 0xBB00_1FFF 512 B        NAND flash control registers
-+        /* Architecturally HCR.TSC is RES0 if EL3 is not implemented.
+  * 0xBB01_2000 0xBFFF_FFFF 96 Mbytes (minus 8 Kbytes) Reserved
-+         * However, if we're using the SMC PSCI conduit then QEMU is
+  * 0xC000_0000 0xFFFF_FFFF 1024 Mbytes  Reserved
-+         * effectively acting like EL3 firmware and so the guest at
+  */
 +         * EL2 should retain the ability to prevent EL1 from being
 +         * able to make SMC calls into the ersatz firmware, so in
 +         * that case HCR.TSC should be read/write.
 +         */
          valid_mask &= ~HCR_TSC;
      }
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
       */
      bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure;
 -    if (arm_is_psci_call(cpu, EXCP_SMC)) {
 -        /* If PSCI is enabled and this looks like a valid PSCI call then
 -         * that overrides the architecturally mandated SMC behaviour.
 +    if (!arm_feature(env, ARM_FEATURE_EL3) &&
 +        cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
 +        /* If we have no EL3 then SMC always UNDEFs and can't be
 +         * trapped to EL2. PSCI-via-SMC is a sort of ersatz EL3
 +         * firmware within QEMU, and we want an EL2 guest to be able
 +         * to forbid its EL1 from making PSCI calls into QEMU's
 +         * "firmware" via HCR.TSC, so for these purposes treat
 +         * PSCI-via-SMC as implying an EL3.
           */
 -        return;
 -    }
 -
 -    if (!arm_feature(env, ARM_FEATURE_EL3)) {
 -        /* If we have no EL3 then SMC always UNDEFs */
          undef = true;
      } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
 -        /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
 +        /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
 +         * We also want an EL2 guest to be able to forbid its EL1 from
 +         * making PSCI calls into QEMU's "firmware" via HCR.TSC.
 +         */
          raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
      }
 -    if (undef) {
 +    /* If PSCI is enabled and this looks like a valid PSCI call then
 +     * suppress the UNDEF -- we'll catch the SMC exception and
 +     * implement the PSCI call behaviour there.
 +     */
 +    if (undef && !arm_is_psci_call(cpu, EXCP_SMC)) {
          raise_exception(env, EXCP_UDEF, syn_uncategorized(),
                          exception_target_el(env));
      }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 19/20] target/arm: Factor out "get mmuidx for specified security state"
+[PULL 03/12] hw/arm/sbsa-ref : Fix SMMUv3 Initialisation
-For the SG instruction and secure function return we are going
+From: Graeme Gregory <graeme@nuviainc.com>
 to want to do memory accesses using the MMU index of the CPU
 in secure state, even though the CPU is currently in non-secure
 state. Write arm_v7m_mmu_idx_for_secstate() to do this job,
 and use it in cpu_mmu_index().
+SMMUv3 has an error in a previous patch where an i was transposed to a 1
+meaning interrupts would not have been correctly assigned to the SMMUv3
+instance.
+Fixes: 48ba18e6d3f3 ("hw/arm/sbsa-ref: Simplify by moving the gic in the machine state")
+Signed-off-by: Graeme Gregory <graeme@nuviainc.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 20201007100732.4103790-2-graeme@nuviainc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-17-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h | 32 +++++++++++++++++++++-----------
+ hw/arm/sbsa-ref.c | 2 +-
-file changed, 21 insertions(+), 11 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/sbsa-ref.c
-+++ b/target/arm/cpu.h
++++ b/hw/arm/sbsa-ref.c
-@@ -XXX,XX +XXX,XX @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
+@@ -XXX,XX +XXX,XX @@ static void create_smmu(const SBSAMachineState *sms, PCIBus *bus)
      sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
      for (i = 0; i < NUM_SMMU_IRQS; i++) {
          sysbus_connect_irq(SYS_BUS_DEVICE(dev), i,
 -                           qdev_get_gpio_in(sms->gic, irq + 1));
 +                           qdev_get_gpio_in(sms->gic, irq + i));
      }
  }
-+/* Return the MMU index for a v7M CPU in the specified security state */
-+static inline ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env,
-+                                                     bool secstate)
-+{
-+    int el = arm_current_el(env);
-+    ARMMMUIdx mmu_idx;
-+
-+    if (el == 0) {
-+        mmu_idx = secstate ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
-+    } else {
-+        mmu_idx = secstate ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
-+    }
-+
-+    if (armv7m_nvic_neg_prio_requested(env->nvic, secstate)) {
-+        mmu_idx = secstate ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
-+    }
-+
-+    return mmu_idx;
-+}
-+
- /* Determine the current mmu_idx to use for normal loads/stores */
- static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
- {
-     int el = arm_current_el(env);
-     if (arm_feature(env, ARM_FEATURE_M)) {
--        ARMMMUIdx mmu_idx;
--
--        if (el == 0) {
--            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
--        } else {
--            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
--        }
--
--        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
--            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
--        }
-+        ARMMMUIdx mmu_idx = arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
-         return arm_to_core_mmu_idx(mmu_idx);
-     }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 20/20] nvic: Add missing code for writing SHCSR.HARDFAULTPENDED bit
+[PULL 04/12] hw/arm/sbsa-ref : allocate IRQs for SMMUv3
-When we added support for the new SHCSR bits in v8M in commit
+From: Graeme Gregory <graeme@nuviainc.com>
 d59c17e9 the code to support writing to the new HARDFAULTPENDED
 bit was accidentally only added for non-secure writes; the
 secure banked version of the bit should also be writable.
+Original commit did not allocate IRQs for the SMMUv3 in the irqmap
+effectively using irq 0->3 (shared with other devices). Assuming
+original intent was to allocate unique IRQs then add an allocation
+to the irqmap.
+Fixes: e9fdf453240 ("hw/arm: Add arm SBSA reference machine, devices part")
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Graeme Gregory <graeme@nuviainc.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Message-id: 20201007100732.4103790-3-graeme@nuviainc.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-21-git-send-email-peter.maydell@linaro.org
 ---
- hw/intc/armv7m_nvic.c | 1 +
+ hw/arm/sbsa-ref.c | 1 +
 file changed, 1 insertion(+)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
+--- a/hw/arm/sbsa-ref.c
-+++ b/hw/intc/armv7m_nvic.c
++++ b/hw/arm/sbsa-ref.c
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
+@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {
-             s->sec_vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
+     [SBSA_SECURE_UART_MM] = 9,
-             s->sec_vectors[ARMV7M_EXCP_USAGE].enabled =
+     [SBSA_AHCI] = 10,
-                 (value & (1 << 18)) != 0;
+     [SBSA_EHCI] = 11,
-+            s->sec_vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
++    [SBSA_SMMU] = 12, /* ... to 15 */
-             /* SecureFault not banked, but RAZ/WI to NS */
+ };
-             s->vectors[ARMV7M_EXCP_SECURE].active = (value & (1 << 4)) != 0;
-             s->vectors[ARMV7M_EXCP_SECURE].enabled = (value & (1 << 19)) != 0;
+ static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 15/20] target/arm: Add v8M support to exception entry code
+[PULL 05/12] hw/char/bcm2835_aux: Allow less than 32-bit accesses
-Add support for v8M and in particular the security extension
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
 to the exception entry code. This requires changes to:
  * calculation of the exception-return magic LR value
  * push the callee-saves registers in certain cases
  * clear registers when taking non-secure exceptions to avoid
    leaking information from the interrupted secure code
  * switch to the correct security state on entry
  * use the vector table for the security state we're targeting
+The "BCM2835 ARM Peripherals" datasheet [*] chapter 2
+("Auxiliaries: UART1 & SPI1, SPI2"), list the register
+sizes as 3/8/16/32 bits. We assume this means this
+peripheral allows 8-bit accesses.
+This was not an issue until commit 5d971f9e67 which reverted
+("memory: accept mismatching sizes in memory_region_access_valid").
+The model is implemented as 32-bit accesses (see commit 97398d900c,
+all registers are 32-bit) so replace MemoryRegionOps.valid as
+MemoryRegionOps.impl, and re-introduce MemoryRegionOps.valid
+with a 8/32-bit range.
+[*] https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf
+Fixes: 97398d900c ("bcm2835_aux: add emulation of BCM2835 AUX (aka UART1) block")
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20201002181032.1899463-1-f4bug@amsat.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-13-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 165 +++++++++++++++++++++++++++++++++++++++++++++-------
+ hw/char/bcm2835_aux.c | 4 +++-
-file changed, 145 insertions(+), 20 deletions(-)
+file changed, 3 insertions(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/char/bcm2835_aux.c
-+++ b/target/arm/helper.c
++++ b/hw/char/bcm2835_aux.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps bcm2835_aux_ops = {
-     }
+     .read = bcm2835_aux_read,
- }
+     .write = bcm2835_aux_write,
+     .endianness = DEVICE_NATIVE_ENDIAN,
--static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
+-    .valid.min_access_size = 4,
-+static uint32_t arm_v7m_load_vector(ARMCPU *cpu, bool targets_secure)
++    .impl.min_access_size = 4,
- {
++    .impl.max_access_size = 4,
-     CPUState *cs = CPU(cpu);
++    .valid.min_access_size = 1,
-     CPUARMState *env = &cpu->env;
+     .valid.max_access_size = 4,
-     MemTxResult result;
+ };
 -    hwaddr vec = env->v7m.vecbase[env->v7m.secure] + env->v7m.exception * 4;
 +    hwaddr vec = env->v7m.vecbase[targets_secure] + env->v7m.exception * 4;
      uint32_t addr;
      addr = address_space_ldl(cs->as, vec,
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
           * Since we don't model Lockup, we just report this guest error
           * via cpu_abort().
           */
 -        cpu_abort(cs, "Failed to read from exception vector table "
 -                  "entry %08x\n", (unsigned)vec);
 +        cpu_abort(cs, "Failed to read from %s exception vector table "
 +                  "entry %08x\n", targets_secure ? "secure" : "nonsecure",
 +                  (unsigned)vec);
      }
      return addr;
  }
 -static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
 +static void v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain)
 +{
 +    /* For v8M, push the callee-saves register part of the stack frame.
 +     * Compare the v8M pseudocode PushCalleeStack().
 +     * In the tailchaining case this may not be the current stack.
 +     */
 +    CPUARMState *env = &cpu->env;
 +    CPUState *cs = CPU(cpu);
 +    uint32_t *frame_sp_p;
 +    uint32_t frameptr;
 +
 +    if (dotailchain) {
 +        frame_sp_p = get_v7m_sp_ptr(env, true,
 +                                    lr & R_V7M_EXCRET_MODE_MASK,
 +                                    lr & R_V7M_EXCRET_SPSEL_MASK);
 +    } else {
 +        frame_sp_p = &env->regs[13];
 +    }
 +
 +    frameptr = *frame_sp_p - 0x28;
 +
 +    stl_phys(cs->as, frameptr, 0xfefa125b);
 +    stl_phys(cs->as, frameptr + 0x8, env->regs[4]);
 +    stl_phys(cs->as, frameptr + 0xc, env->regs[5]);
 +    stl_phys(cs->as, frameptr + 0x10, env->regs[6]);
 +    stl_phys(cs->as, frameptr + 0x14, env->regs[7]);
 +    stl_phys(cs->as, frameptr + 0x18, env->regs[8]);
 +    stl_phys(cs->as, frameptr + 0x1c, env->regs[9]);
 +    stl_phys(cs->as, frameptr + 0x20, env->regs[10]);
 +    stl_phys(cs->as, frameptr + 0x24, env->regs[11]);
 +
 +    *frame_sp_p = frameptr;
 +}
 +
 +static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain)
  {
      /* Do the "take the exception" parts of exception entry,
       * but not the pushing of state to the stack. This is
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
       */
      CPUARMState *env = &cpu->env;
      uint32_t addr;
 +    bool targets_secure;
 +
 +    targets_secure = armv7m_nvic_acknowledge_irq(env->nvic);
 -    armv7m_nvic_acknowledge_irq(env->nvic);
 +    if (arm_feature(env, ARM_FEATURE_V8)) {
 +        if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
 +            (lr & R_V7M_EXCRET_S_MASK)) {
 +            /* The background code (the owner of the registers in the
 +             * exception frame) is Secure. This means it may either already
 +             * have or now needs to push callee-saves registers.
 +             */
 +            if (targets_secure) {
 +                if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
 +                    /* We took an exception from Secure to NonSecure
 +                     * (which means the callee-saved registers got stacked)
 +                     * and are now tailchaining to a Secure exception.
 +                     * Clear DCRS so eventual return from this Secure
 +                     * exception unstacks the callee-saved registers.
 +                     */
 +                    lr &= ~R_V7M_EXCRET_DCRS_MASK;
 +                }
 +            } else {
 +                /* We're going to a non-secure exception; push the
 +                 * callee-saves registers to the stack now, if they're
 +                 * not already saved.
 +                 */
 +                if (lr & R_V7M_EXCRET_DCRS_MASK &&
 +                    !(dotailchain && (lr & R_V7M_EXCRET_ES_MASK))) {
 +                    v7m_push_callee_stack(cpu, lr, dotailchain);
 +                }
 +                lr |= R_V7M_EXCRET_DCRS_MASK;
 +            }
 +        }
 +
 +        lr &= ~R_V7M_EXCRET_ES_MASK;
 +        if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) {
 +            lr |= R_V7M_EXCRET_ES_MASK;
 +        }
 +        lr &= ~R_V7M_EXCRET_SPSEL_MASK;
 +        if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
 +            lr |= R_V7M_EXCRET_SPSEL_MASK;
 +        }
 +
 +        /* Clear registers if necessary to prevent non-secure exception
 +         * code being able to see register values from secure code.
 +         * Where register values become architecturally UNKNOWN we leave
 +         * them with their previous values.
 +         */
 +        if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
 +            if (!targets_secure) {
 +                /* Always clear the caller-saved registers (they have been
 +                 * pushed to the stack earlier in v7m_push_stack()).
 +                 * Clear callee-saved registers if the background code is
 +                 * Secure (in which case these regs were saved in
 +                 * v7m_push_callee_stack()).
 +                 */
 +                int i;
 +
 +                for (i = 0; i < 13; i++) {
 +                    /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */
 +                    if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) {
 +                        env->regs[i] = 0;
 +                    }
 +                }
 +                /* Clear EAPSR */
 +                xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
 +            }
 +        }
 +    }
 +
 +    /* Switch to target security state -- must do this before writing SPSEL */
 +    switch_v7m_security_state(env, targets_secure);
      write_v7m_control_spsel(env, 0);
      arm_clear_exclusive(env);
      /* Clear IT bits */
      env->condexec_bits = 0;
      env->regs[14] = lr;
 -    addr = arm_v7m_load_vector(cpu);
 +    addr = arm_v7m_load_vector(cpu, targets_secure);
      env->regs[15] = addr & 0xfffffffe;
      env->thumb = addr & 1;
  }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      if (sfault) {
          env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 -        v7m_exception_taken(cpu, excret);
 +        v7m_exception_taken(cpu, excret, true);
          qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
                        "stackframe: failed EXC_RETURN.ES validity check\n");
          return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
           */
          env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
 -        v7m_exception_taken(cpu, excret);
 +        v7m_exception_taken(cpu, excret, true);
          qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                        "stackframe: failed exception return integrity check\n");
          return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                  /* Take a SecureFault on the current stack */
                  env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
                  armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 -                v7m_exception_taken(cpu, excret);
 +                v7m_exception_taken(cpu, excret, true);
                  qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
                                "stackframe: failed exception return integrity "
                                "signature check\n");
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                  armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
                                          env->v7m.secure);
                  env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
 -                v7m_exception_taken(cpu, excret);
 +                v7m_exception_taken(cpu, excret, true);
                  qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                                "stackframe: failed exception return integrity "
                                "check\n");
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
          env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
          v7m_push_stack(cpu);
 -        v7m_exception_taken(cpu, excret);
 +        v7m_exception_taken(cpu, excret, false);
          qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                        "failed exception return integrity check\n");
          return;
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
          return; /* Never happens.  Keep compiler happy.  */
      }
 -    lr = R_V7M_EXCRET_RES1_MASK |
 -        R_V7M_EXCRET_S_MASK |
 -        R_V7M_EXCRET_DCRS_MASK |
 -        R_V7M_EXCRET_FTYPE_MASK |
 -        R_V7M_EXCRET_ES_MASK;
 -    if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
 -        lr |= R_V7M_EXCRET_SPSEL_MASK;
 +    if (arm_feature(env, ARM_FEATURE_V8)) {
 +        lr = R_V7M_EXCRET_RES1_MASK |
 +            R_V7M_EXCRET_DCRS_MASK |
 +            R_V7M_EXCRET_FTYPE_MASK;
 +        /* The S bit indicates whether we should return to Secure
 +         * or NonSecure (ie our current state).
 +         * The ES bit indicates whether we're taking this exception
 +         * to Secure or NonSecure (ie our target state). We set it
 +         * later, in v7m_exception_taken().
 +         * The SPSEL bit is also set in v7m_exception_taken() for v8M.
 +         * This corresponds to the ARM ARM pseudocode for v8M setting
 +         * some LR bits in PushStack() and some in ExceptionTaken();
 +         * the distinction matters for the tailchain cases where we
 +         * can take an exception without pushing the stack.
 +         */
 +        if (env->v7m.secure) {
 +            lr |= R_V7M_EXCRET_S_MASK;
 +        }
 +    } else {
 +        lr = R_V7M_EXCRET_RES1_MASK |
 +            R_V7M_EXCRET_S_MASK |
 +            R_V7M_EXCRET_DCRS_MASK |
 +            R_V7M_EXCRET_FTYPE_MASK |
 +            R_V7M_EXCRET_ES_MASK;
 +        if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
 +            lr |= R_V7M_EXCRET_SPSEL_MASK;
 +        }
      }
      if (!arm_v7m_is_handler_mode(env)) {
          lr |= R_V7M_EXCRET_MODE_MASK;
      }
      v7m_push_stack(cpu);
 -    v7m_exception_taken(cpu, lr);
 +    v7m_exception_taken(cpu, lr, false);
      qemu_log_mask(CPU_LOG_INT, "... as %d\n", env->v7m.exception);
  }
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 08/20] target/arm: Restore SPSEL to correct CONTROL register on exception return
+[PULL 06/12] linux headers: sync to 5.9-rc7
-On exception return for v8M, the SPSEL bit in the EXC_RETURN magic
+From: Andrew Jones <drjones@redhat.com>
 value should be restored to the SPSEL bit in the CONTROL register
 banked specified by the EXC_RETURN.ES bit.
-Add write_v7m_control_spsel_for_secstate() which behaves like
+Update against Linux 5.9-rc7.
 write_v7m_control_spsel() but allows the caller to specify which
 CONTROL bank to use, reimplement write_v7m_control_spsel() in
 terms of it, and use it in exception return.
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20201001061718.101915-2-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-6-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 40 +++++++++++++++++++++++++++-------------
+ linux-headers/linux/kvm.h | 6 ++++--
-file changed, 27 insertions(+), 13 deletions(-)
+file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/linux-headers/linux/kvm.h
-+++ b/target/arm/helper.c
++++ b/linux-headers/linux/kvm.h
-@@ -XXX,XX +XXX,XX @@ static bool v7m_using_psp(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
-         env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK;
+ #define KVM_VM_PPC_HV 1
- }
+ #define KVM_VM_PPC_PR 2
--/* Write to v7M CONTROL.SPSEL bit. This may change the current
+-/* on MIPS, 0 forces trap & emulate, 1 forces VZ ASE */
-- * stack pointer between Main and Process stack pointers.
+-#define KVM_VM_MIPS_TE        0
-+/* Write to v7M CONTROL.SPSEL bit for the specified security bank.
++/* on MIPS, 0 indicates auto, 1 forces VZ ASE, 2 forces trap & emulate */
-+ * This may change the current stack pointer between Main and Process
++#define KVM_VM_MIPS_AUTO    0
-+ * stack pointers if it is done for the CONTROL register for the current
+ #define KVM_VM_MIPS_VZ        1
-+ * security state.
++#define KVM_VM_MIPS_TE        2
-  */
--static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
+ #define KVM_S390_SIE_PAGE_OFFSET 1
-+static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
-+                                                 bool new_spsel,
+@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
-+                                                 bool secstate)
+ #define KVM_CAP_LAST_CPU 184
- {
+ #define KVM_CAP_SMALLER_MAXPHYADDR 185
--    uint32_t tmp;
+ #define KVM_CAP_S390_DIAG318 186
--    bool new_is_psp, old_is_psp = v7m_using_psp(env);
++#define KVM_CAP_STEAL_TIME 187
-+    bool old_is_psp = v7m_using_psp(env);
+ #ifdef KVM_CAP_IRQ_ROUTING
 -    env->v7m.control[env->v7m.secure] =
 -        deposit32(env->v7m.control[env->v7m.secure],
 +    env->v7m.control[secstate] =
 +        deposit32(env->v7m.control[secstate],
                    R_V7M_CONTROL_SPSEL_SHIFT,
                    R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
 -    new_is_psp = v7m_using_psp(env);
 +    if (secstate == env->v7m.secure) {
 +        bool new_is_psp = v7m_using_psp(env);
 +        uint32_t tmp;
 -    if (old_is_psp != new_is_psp) {
 -        tmp = env->v7m.other_sp;
 -        env->v7m.other_sp = env->regs[13];
 -        env->regs[13] = tmp;
 +        if (old_is_psp != new_is_psp) {
 +            tmp = env->v7m.other_sp;
 +            env->v7m.other_sp = env->regs[13];
 +            env->regs[13] = tmp;
 +        }
      }
  }
 +/* Write to v7M CONTROL.SPSEL bit. This may change the current
 + * stack pointer between Main and Process stack pointers.
 + */
 +static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
 +{
 +    write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
 +}
 +
  void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
  {
      /* Write a new value to v7m.exception, thus transitioning into or out
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
       * Handler mode (and will be until we write the new XPSR.Interrupt
       * field) this does not switch around the current stack pointer.
       */
 -    write_v7m_control_spsel(env, return_to_sp_process);
 +    write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
      switch_v7m_security_state(env, return_to_secure);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 17/20] target/arm: Implement security attribute lookups for memory accesses
+[PULL 07/12] target/arm/kvm: Make uncalled stubs explicitly unreachable
-Implement the security attribute lookups for memory accesses
+From: Andrew Jones <drjones@redhat.com>
 in the get_phys_addr() functions, causing these to generate
 various kinds of SecureFault for bad accesses.
-The major subtlety in this code relates to handling of the
+When we compile without KVM support !defined(CONFIG_KVM) we generate
-case when the security attributes the SAU assigns to the
+stubs for functions that the linker will still encounter. Sometimes
-address don't match the current security state of the CPU.
+these stubs can be executed safely and are placed in paths where they
 get executed with or without KVM. Other functions should never be
 called without KVM. Those functions should be guarded by kvm_enabled(),
 but should also be robust to refactoring mistakes. Putting a
 g_assert_not_reached() in the function should help. Additionally,
 the g_assert_not_reached() calls may actually help the linker remove
 some code.
-In the ARM ARM pseudocode for validating instruction
+We remove the stubs for kvm_arm_get/put_virtual_time(), as they aren't
-accesses, the security attributes of the address determine
+necessary at all - the only caller is in kvm.c
 whether the Secure or NonSecure MPU state is used. At face
 value, handling this would require us to encode the relevant
 bits of state into mmu_idx for both S and NS at once, which
 would result in our needing 16 mmu indexes. Fortunately we
 don't actually need to do this because a mismatch between
 address attributes and CPU state means either:
  * some kind of fault (usually a SecureFault, but in theory
    perhaps a UserFault for unaligned access to Device memory)
  * execution of the SG instruction in NS state from a
    Secure & NonSecure code region
-The purpose of SG is simply to flip the CPU into Secure
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-state, so we can handle it by emulating execution of that
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-instruction directly in arm_v7m_cpu_do_interrupt(), which
+Message-id: 20201001061718.101915-3-drjones@redhat.com
-means we can treat all the mismatch cases as "throw an
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-exception" and we don't need to encode the state of the
+---
-other MPU bank into our mmu_idx values.
+ target/arm/kvm_arm.h | 51 +++++++++++++++++++++++++++-----------------
 file changed, 32 insertions(+), 19 deletions(-)
-This commit doesn't include the actual emulation of SG;
+diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
 it also doesn't include implementation of the IDAU, which
 is a per-board way to specify hard-coded memory attributes
 for addresses, which override the CPU-internal SAU if they
 specify a more secure setting than the SAU is programmed to.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 1506092407-26985-15-git-send-email-peter.maydell@linaro.org
 ---
  target/arm/internals.h |  15 ++++
  target/arm/helper.c    | 182 ++++++++++++++++++++++++++++++++++++++++++++++++-
 files changed, 195 insertions(+), 2 deletions(-)
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/target/arm/kvm_arm.h
-+++ b/target/arm/internals.h
++++ b/target/arm/kvm_arm.h
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_EXCRET, DCRS, 5, 1)
+@@ -XXX,XX +XXX,XX @@ int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
- FIELD(V7M_EXCRET, S, 6, 1)
- FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
+ #else
-+/* We use a few fake FSR values for internal purposes in M profile.
+-static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
-+ * M profile cores don't have A/R format FSRs, but currently our
+-{
-+ * get_phys_addr() code assumes A/R profile and reports failures via
+-    /*
-+ * an A/R format FSR value. We then translate that into the proper
+-     * This should never actually be called in the "not KVM" case,
-+ * M profile exception and FSR status bit in arm_v7m_cpu_do_interrupt().
+-     * but set up the fields to indicate an error anyway.
-+ * Mostly the FSR values we use for this are those defined for v7PMSA,
+-     */
-+ * since we share some of that codepath. A few kinds of fault are
+-    cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
-+ * only for M profile and have no A/R equivalent, though, so we have
+-    cpu->host_cpu_probe_failed = true;
-+ * to pick a value from the reserved range (which we never otherwise
+-}
-+ * generate) to use for these.
+-
-+ * These values will never be visible to the guest.
+-static inline void kvm_arm_add_vcpu_properties(Object *obj) {}
 -
 +/*
 + * It's safe to call these functions without KVM support.
 + * They should either do nothing or return "not supported".
 + */
-+#define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */
+ static inline bool kvm_arm_aarch32_supported(void)
-+#define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */
+ {
-+
+     return false;
- /*
+@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_sve_supported(void)
-  * For AArch64, map a given EL to an index in the banked_spsr array.
+     return false;
   * Note that this mapping and the AArch32 mapping defined in bank_number()
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                 target_ulong *page_size_ptr, uint32_t *fsr,
                                 ARMMMUFaultInfo *fi);
 +/* Security attributes for an address, as returned by v8m_security_lookup. */
 +typedef struct V8M_SAttributes {
 +    bool ns;
 +    bool nsc;
 +    uint8_t sregion;
 +    bool srvalid;
 +    uint8_t iregion;
 +    bool irvalid;
 +} V8M_SAttributes;
 +
  /* Definitions for the PMCCNTR and PMCR registers */
  #define PMCRD   0x8
  #define PMCRC   0x4
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
           * raises the fault, in the A profile short-descriptor format.
           */
          switch (env->exception.fsr & 0xf) {
 +        case M_FAKE_FSR_NSC_EXEC:
 +            /* Exception generated when we try to execute code at an address
 +             * which is marked as Secure & Non-Secure Callable and the CPU
 +             * is in the Non-Secure state. The only instruction which can
 +             * be executed like this is SG (and that only if both halves of
 +             * the SG instruction have the same security attributes.)
 +             * Everything else must generate an INVEP SecureFault, so we
 +             * emulate the SG instruction here.
 +             * TODO: actually emulate SG.
 +             */
 +            env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
 +            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 +            qemu_log_mask(CPU_LOG_INT,
 +                          "...really SecureFault with SFSR.INVEP\n");
 +            break;
 +        case M_FAKE_FSR_SFAULT:
 +            /* Various flavours of SecureFault for attempts to execute or
 +             * access data in the wrong security state.
 +             */
 +            switch (cs->exception_index) {
 +            case EXCP_PREFETCH_ABORT:
 +                if (env->v7m.secure) {
 +                    env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
 +                    qemu_log_mask(CPU_LOG_INT,
 +                                  "...really SecureFault with SFSR.INVTRAN\n");
 +                } else {
 +                    env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
 +                    qemu_log_mask(CPU_LOG_INT,
 +                                  "...really SecureFault with SFSR.INVEP\n");
 +                }
 +                break;
 +            case EXCP_DATA_ABORT:
 +                /* This must be an NS access to S memory */
 +                env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
 +                qemu_log_mask(CPU_LOG_INT,
 +                              "...really SecureFault with SFSR.AUVIOL\n");
 +                break;
 +            }
 +            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 +            break;
          case 0x8: /* External Abort */
              switch (cs->exception_index) {
              case EXCP_PREFETCH_ABORT:
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
      return !(*prot & (1 << access_type));
  }
-+static bool v8m_is_sau_exempt(CPUARMState *env,
++/*
-+                              uint32_t address, MMUAccessType access_type)
++ * These functions should never actually be called without KVM support.
 + */
 +static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
 +{
-+    /* The architecture specifies that certain address ranges are
++    g_assert_not_reached();
 +     * exempt from v8M SAU/IDAU checks.
 +     */
 +    return
 +        (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
 +        (address >= 0xe0000000 && address <= 0xe0002fff) ||
 +        (address >= 0xe000e000 && address <= 0xe000efff) ||
 +        (address >= 0xe002e000 && address <= 0xe002efff) ||
 +        (address >= 0xe0040000 && address <= 0xe0041fff) ||
 +        (address >= 0xe00ff000 && address <= 0xe00fffff);
 +}
 +
-+static void v8m_security_lookup(CPUARMState *env, uint32_t address,
++static inline void kvm_arm_add_vcpu_properties(Object *obj)
 +                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
 +                                V8M_SAttributes *sattrs)
 +{
-+    /* Look up the security attributes for this address. Compare the
++    g_assert_not_reached();
 +     * pseudocode SecurityCheck() function.
 +     * We assume the caller has zero-initialized *sattrs.
 +     */
 +    ARMCPU *cpu = arm_env_get_cpu(env);
 +    int r;
 +
 +    /* TODO: implement IDAU */
 +
 +    if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
 +        /* 0xf0000000..0xffffffff is always S for insn fetches */
 +        return;
 +    }
 +
 +    if (v8m_is_sau_exempt(env, address, access_type)) {
 +        sattrs->ns = !regime_is_secure(env, mmu_idx);
 +        return;
 +    }
 +
 +    switch (env->sau.ctrl & 3) {
 +    case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
 +        break;
 +    case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
 +        sattrs->ns = true;
 +        break;
 +    default: /* SAU.ENABLE == 1 */
 +        for (r = 0; r < cpu->sau_sregion; r++) {
 +            if (env->sau.rlar[r] & 1) {
 +                uint32_t base = env->sau.rbar[r] & ~0x1f;
 +                uint32_t limit = env->sau.rlar[r] | 0x1f;
 +
 +                if (base <= address && limit >= address) {
 +                    if (sattrs->srvalid) {
 +                        /* If we hit in more than one region then we must report
 +                         * as Secure, not NS-Callable, with no valid region
 +                         * number info.
 +                         */
 +                        sattrs->ns = false;
 +                        sattrs->nsc = false;
 +                        sattrs->sregion = 0;
 +                        sattrs->srvalid = false;
 +                        break;
 +                    } else {
 +                        if (env->sau.rlar[r] & 2) {
 +                            sattrs->nsc = true;
 +                        } else {
 +                            sattrs->ns = true;
 +                        }
 +                        sattrs->srvalid = true;
 +                        sattrs->sregion = r;
 +                    }
 +                }
 +            }
 +        }
 +
 +        /* TODO when we support the IDAU then it may override the result here */
 +        break;
 +    }
 +}
 +
- static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
+ static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
                                   MMUAccessType access_type, ARMMMUIdx mmu_idx,
 -                                 hwaddr *phys_ptr, int *prot, uint32_t *fsr)
 +                                 hwaddr *phys_ptr, MemTxAttrs *txattrs,
 +                                 int *prot, uint32_t *fsr)
  {
-     ARMCPU *cpu = arm_env_get_cpu(env);
+-    return -ENOENT;
-     bool is_user = regime_is_user(env, mmu_idx);
++    g_assert_not_reached();
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
+ }
-     int n;
-     int matchregion = -1;
+ static inline int kvm_arm_vgic_probe(void)
-     bool hit = false;
+ {
-+    V8M_SAttributes sattrs = {};
+-    return 0;
++    g_assert_not_reached();
-     *phys_ptr = address;
+ }
-     *prot = 0;
+-static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq) {}
-+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+-static inline void kvm_arm_pmu_init(CPUState *cs) {}
-+        v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs);
++static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq)
-+        if (access_type == MMU_INST_FETCH) {
++{
-+            /* Instruction fetches always use the MMU bank and the
++    g_assert_not_reached();
-+             * transaction attribute determined by the fetch address,
++}
-+             * regardless of CPU state. This is painful for QEMU
-+             * to handle, because it would mean we need to encode
+-static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map) {}
-+             * into the mmu_idx not just the (user, negpri) information
++static inline void kvm_arm_pmu_init(CPUState *cs)
-+             * for the current security state but also that for the
++{
-+             * other security state, which would balloon the number
++    g_assert_not_reached();
-+             * of mmu_idx values needed alarmingly.
++}
 +             * Fortunately we can avoid this because it's not actually
 +             * possible to arbitrarily execute code from memory with
 +             * the wrong security attribute: it will always generate
 +             * an exception of some kind or another, apart from the
 +             * special case of an NS CPU executing an SG instruction
 +             * in S&NSC memory. So we always just fail the translation
 +             * here and sort things out in the exception handler
 +             * (including possibly emulating an SG instruction).
 +             */
 +            if (sattrs.ns != !secure) {
 +                *fsr = sattrs.nsc ? M_FAKE_FSR_NSC_EXEC : M_FAKE_FSR_SFAULT;
 +                return true;
 +            }
 +        } else {
 +            /* For data accesses we always use the MMU bank indicated
 +             * by the current CPU state, but the security attributes
 +             * might downgrade a secure access to nonsecure.
 +             */
 +            if (sattrs.ns) {
 +                txattrs->secure = false;
 +            } else if (!secure) {
 +                /* NS access to S memory must fault.
 +                 * Architecturally we should first check whether the
 +                 * MPU information for this address indicates that we
 +                 * are doing an unaligned access to Device memory, which
 +                 * should generate a UsageFault instead. QEMU does not
 +                 * currently check for that kind of unaligned access though.
 +                 * If we added it we would need to do so as a special case
 +                 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
 +                 */
 +                *fsr = M_FAKE_FSR_SFAULT;
 +                return true;
 +            }
 +        }
 +    }
 +
-     /* Unlike the ARM ARM pseudocode, we don't need to check whether this
++static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
-      * was an exception vector read from the vector table (which is always
++{
-      * done using the default system address map), because those accesses
++    g_assert_not_reached();
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
++}
-         if (arm_feature(env, ARM_FEATURE_V8)) {
-             /* PMSAv8 */
+-static inline void kvm_arm_get_virtual_time(CPUState *cs) {}
-             ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx,
+-static inline void kvm_arm_put_virtual_time(CPUState *cs) {}
--                                       phys_ptr, prot, fsr);
+ #endif
-+                                       phys_ptr, attrs, prot, fsr);
-         } else if (arm_feature(env, ARM_FEATURE_V7)) {
+ static inline const char *gic_class_name(void)
              /* PMSAv7 */
              ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 06/20] target/arm: Prepare for CONTROL.SPSEL being nonzero in Handler mode
+[PULL 08/12] hw/arm/virt: Move post cpu realize check into its own function
-In the v7M architecture, there is an invariant that if the CPU is
+From: Andrew Jones <drjones@redhat.com>
 in Handler mode then the CONTROL.SPSEL bit cannot be nonzero.
 This in turn means that the current stack pointer is always
 indicated by CONTROL.SPSEL, even though Handler mode always uses
 the Main stack pointer.
-In v8M, this invariant is removed, and CONTROL.SPSEL may now
+We'll add more to this new function in coming patches so we also
-be nonzero in Handler mode (though Handler mode still always
+state the gic must be created and call it below create_gic().
 uses the Main stack pointer). In preparation for this change,
 change how we handle this bit: rename switch_v7m_sp() to
 the now more accurate write_v7m_control_spsel(), and make it
 check both the handler mode state and the SPSEL bit.
-Note that this implicitly changes the point at which we switch
+No functional change intended.
 active SP on exception exit from before we pop the exception
 frame to after it.
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20201001061718.101915-4-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-4-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      |  8 ++++++-
+ hw/arm/virt.c | 43 +++++++++++++++++++++++++++----------------
- hw/intc/armv7m_nvic.c |  2 +-
+file changed, 27 insertions(+), 16 deletions(-)
  target/arm/helper.c   | 65 ++++++++++++++++++++++++++++++++++-----------------
 files changed, 51 insertions(+), 24 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/virt.c
-+++ b/target/arm/cpu.h
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ void pmccntr_sync(CPUARMState *env);
+@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
  #define PSTATE_MODE_EL1t 4
  #define PSTATE_MODE_EL0t 0
 +/* Write a new value to v7m.exception, thus transitioning into or out
 + * of Handler mode; this may result in a change of active stack pointer.
 + */
 +void write_v7m_exception(CPUARMState *env, uint32_t new_exc);
 +
  /* Map EL and handler into a PSTATE_MODE.  */
  static inline unsigned int aarch64_pstate_mode(unsigned int el, bool handler)
  {
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
          env->condexec_bits |= (val >> 8) & 0xfc;
      }
      if (mask & XPSR_EXCP) {
 -        env->v7m.exception = val & XPSR_EXCP;
 +        /* Note that this only happens on exception exit */
 +        write_v7m_exception(env, val & XPSR_EXCP);
      }
  }
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
++/*
-index XXXXXXX..XXXXXXX 100644
++ * virt_cpu_post_init() must be called after the CPUs have
---- a/hw/intc/armv7m_nvic.c
++ * been realized and the GIC has been created.
 +++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_acknowledge_irq(void *opaque)
      vec->active = 1;
      vec->pending = 0;
 -    env->v7m.exception = s->vectpending;
 +    write_v7m_exception(env, s->vectpending);
      nvic_irq_update(s);
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool v7m_using_psp(CPUARMState *env)
          env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK;
  }
 -/* Switch to V7M main or process stack pointer.  */
 -static void switch_v7m_sp(CPUARMState *env, bool new_spsel)
 +/* Write to v7M CONTROL.SPSEL bit. This may change the current
 + * stack pointer between Main and Process stack pointers.
 + */
-+static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
++static void virt_cpu_post_init(VirtMachineState *vms)
- {
++{
-     uint32_t tmp;
++    bool aarch64;
 -    uint32_t old_control = env->v7m.control[env->v7m.secure];
 -    bool old_spsel = old_control & R_V7M_CONTROL_SPSEL_MASK;
 +    bool new_is_psp, old_is_psp = v7m_using_psp(env);
 +
-+    env->v7m.control[env->v7m.secure] =
++    aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
 +        deposit32(env->v7m.control[env->v7m.secure],
 +                  R_V7M_CONTROL_SPSEL_SHIFT,
 +                  R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
 +
-+    new_is_psp = v7m_using_psp(env);
++    if (!kvm_enabled()) {
++        if (aarch64 && vms->highmem) {
--    if (old_spsel != new_spsel) {
++            int requested_pa_size = 64 - clz64(vms->highest_gpa);
-+    if (old_is_psp != new_is_psp) {
++            int pamax = arm_pamax(ARM_CPU(first_cpu));
-         tmp = env->v7m.other_sp;
++
-         env->v7m.other_sp = env->regs[13];
++            if (pamax < requested_pa_size) {
-         env->regs[13] = tmp;
++                error_report("VCPU supports less PA bits (%d) than "
 +                             "requested by the memory map (%d)",
 +                             pamax, requested_pa_size);
 +                exit(1);
 +            }
 +        }
 +    }
 +}
 +
-+void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
+ static void machvirt_init(MachineState *machine)
-+{
+ {
-+    /* Write a new value to v7m.exception, thus transitioning into or out
+     VirtMachineState *vms = VIRT_MACHINE(machine);
-+     * of Handler mode; this may result in a change of active stack pointer.
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-+     */
+     fdt_add_timer_nodes(vms);
-+    bool new_is_psp, old_is_psp = v7m_using_psp(env);
+     fdt_add_cpu_nodes(vms);
-+    uint32_t tmp;
+-   if (!kvm_enabled()) {
--        env->v7m.control[env->v7m.secure] = deposit32(old_control,
+-        ARMCPU *cpu = ARM_CPU(first_cpu);
--                                     R_V7M_CONTROL_SPSEL_SHIFT,
+-        bool aarch64 = object_property_get_bool(OBJECT(cpu), "aarch64", NULL);
--                                     R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
+-
-+    env->v7m.exception = new_exc;
+-        if (aarch64 && vms->highmem) {
 -            int requested_pa_size, pamax = arm_pamax(cpu);
 -
 -            requested_pa_size = 64 - clz64(vms->highest_gpa);
 -            if (pamax < requested_pa_size) {
 -                error_report("VCPU supports less PA bits (%d) than requested "
 -                            "by the memory map (%d)", pamax, requested_pa_size);
 -                exit(1);
 -            }
 -        }
 -    }
 -
      memory_region_add_subregion(sysmem, vms->memmap[VIRT_MEM].base,
                                  machine->ram);
      if (machine->device_memory) {
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
      create_gic(vms);
 +    virt_cpu_post_init(vms);
 +
-+    new_is_psp = v7m_using_psp(env);
+     fdt_add_pmu_nodes(vms);
-+
-+    if (old_is_psp != new_is_psp) {
+     create_uart(vms, VIRT_UART, sysmem, serial_hd(0));
 +        tmp = env->v7m.other_sp;
 +        env->v7m.other_sp = env->regs[13];
 +        env->regs[13] = tmp;
      }
  }
@@ -XXX,XX +XXX,XX @@ static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
      bool want_psp = threadmode && spsel;
      if (secure == env->v7m.secure) {
 -        /* Currently switch_v7m_sp switches SP as it updates SPSEL,
 -         * so the SP we want is always in regs[13].
 -         * When we decouple SPSEL from the actually selected SP
 -         * we need to check want_psp against v7m_using_psp()
 -         * to see whether we need regs[13] or v7m.other_sp.
 -         */
 -        return &env->regs[13];
 +        if (want_psp == v7m_using_psp(env)) {
 +            return &env->regs[13];
 +        } else {
 +            return &env->v7m.other_sp;
 +        }
      } else {
          if (want_psp) {
              return &env->v7m.other_ss_psp;
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
      uint32_t addr;
      armv7m_nvic_acknowledge_irq(env->nvic);
 -    switch_v7m_sp(env, 0);
 +    write_v7m_control_spsel(env, 0);
      arm_clear_exclusive(env);
      /* Clear IT bits */
      env->condexec_bits = 0;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          return;
      }
 -    /* Set CONTROL.SPSEL from excret.SPSEL. For QEMU this currently
 -     * causes us to switch the active SP, but we will change this
 -     * later to not do that so we can support v8M.
 +    /* Set CONTROL.SPSEL from excret.SPSEL. Since we're still in
 +     * Handler mode (and will be until we write the new XPSR.Interrupt
 +     * field) this does not switch around the current stack pointer.
       */
 -    switch_v7m_sp(env, return_to_sp_process);
 +    write_v7m_control_spsel(env, return_to_sp_process);
      {
          /* The stack pointer we should be reading the exception frame from
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
      case 20: /* CONTROL */
          /* Writing to the SPSEL bit only has an effect if we are in
           * thread mode; other bits can be updated by any privileged code.
 -         * switch_v7m_sp() deals with updating the SPSEL bit in
 +         * write_v7m_control_spsel() deals with updating the SPSEL bit in
           * env->v7m.control, so we only need update the others.
           */
          if (!arm_v7m_is_handler_mode(env)) {
 -            switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
 +            write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
          }
          env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
          env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 13/20] target/arm: Update excret sanity checks for v8M
+[PULL 09/12] hw/arm/virt: Move kvm pmu setup to virt_cpu_post_init
-In v8M, more bits are defined in the exception-return magic
+From: Andrew Jones <drjones@redhat.com>
 values; update the code that checks these so we accept
 the v8M values when the CPU permits them.
+Move the KVM PMU setup part of fdt_add_pmu_nodes() to
+virt_cpu_post_init(), which is a more appropriate location. Now
+fdt_add_pmu_nodes() is also named more appropriately, because it
+no longer does anything but fdt node creation.
+No functional change intended.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20201001061718.101915-5-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-11-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 73 ++++++++++++++++++++++++++++++++++++++++++-----------
+ hw/arm/virt.c | 34 ++++++++++++++++++----------------
-file changed, 58 insertions(+), 15 deletions(-)
+file changed, 18 insertions(+), 16 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/arm/virt.c
-+++ b/target/arm/helper.c
++++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ static void fdt_add_gic_node(VirtMachineState *vms)
-     uint32_t excret;
-     uint32_t xpsr;
+ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
-     bool ufault = false;
+ {
--    bool return_to_sp_process = false;
+-    CPUState *cpu;
--    bool return_to_handler = false;
+-    ARMCPU *armcpu;
-+    bool sfault = false;
++    ARMCPU *armcpu = ARM_CPU(first_cpu);
-+    bool return_to_sp_process;
+     uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
-+    bool return_to_handler;
-     bool rettobase = false;
+-    CPU_FOREACH(cpu) {
-     bool exc_secure = false;
+-        armcpu = ARM_CPU(cpu);
-     bool return_to_secure;
+-        if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU)) {
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+-            return;
-                       excret);
+-        }
 -        if (kvm_enabled()) {
 -            if (kvm_irqchip_in_kernel()) {
 -                kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ));
 -            }
 -            kvm_arm_pmu_init(cpu);
 -        }
 +    if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU)) {
 +        assert(!object_property_get_bool(OBJECT(armcpu), "pmu", NULL));
 +        return;
      }
-+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+     if (vms->gic_version == VIRT_GIC_VERSION_2) {
-+        /* EXC_RETURN.ES validation check (R_SMFL). We must do this before
+@@ -XXX,XX +XXX,XX @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
-+         * we pick which FAULTMASK to clear.
+                              (1 << vms->smp_cpus) - 1);
 +         */
 +        if (!env->v7m.secure &&
 +            ((excret & R_V7M_EXCRET_ES_MASK) ||
 +             !(excret & R_V7M_EXCRET_DCRS_MASK))) {
 +            sfault = 1;
 +            /* For all other purposes, treat ES as 0 (R_HXSR) */
 +            excret &= ~R_V7M_EXCRET_ES_MASK;
 +        }
 +    }
 +
      if (env->v7m.exception != ARMV7M_EXCP_NMI) {
          /* Auto-clear FAULTMASK on return from other than NMI.
           * If the security extension is implemented then this only
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          g_assert_not_reached();
      }
-+    return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
+-    armcpu = ARM_CPU(qemu_get_cpu(0));
-+    return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
+     qemu_fdt_add_subnode(vms->fdt, "/pmu");
-     return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
+     if (arm_feature(&armcpu->env, ARM_FEATURE_V8)) {
-         (excret & R_V7M_EXCRET_S_MASK);
+         const char compat[] = "arm,armv8-pmuv3";
+@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
--    switch (excret & 0xf) {
+  */
--    case 1: /* Return to Handler */
+ static void virt_cpu_post_init(VirtMachineState *vms)
--        return_to_handler = true;
+ {
--        break;
+-    bool aarch64;
--    case 13: /* Return to Thread using Process stack */
++    bool aarch64, pmu;
--        return_to_sp_process = true;
++    CPUState *cpu;
--        /* fall through */
--    case 9: /* Return to Thread using Main stack */
+     aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
--        if (!rettobase &&
++    pmu = object_property_get_bool(OBJECT(first_cpu), "pmu", NULL);
--            !(env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_NONBASETHRDENA_MASK)) {
-+    if (arm_feature(env, ARM_FEATURE_V8)) {
+-    if (!kvm_enabled()) {
-+        if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
++    if (kvm_enabled()) {
-+            /* UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP);
++        CPU_FOREACH(cpu) {
-+             * we choose to take the UsageFault.
++            if (pmu) {
-+             */
++                assert(arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_PMU));
-+            if ((excret & R_V7M_EXCRET_S_MASK) ||
++                if (kvm_irqchip_in_kernel()) {
-+                (excret & R_V7M_EXCRET_ES_MASK) ||
++                    kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ));
-+                !(excret & R_V7M_EXCRET_DCRS_MASK)) {
++                }
-+                ufault = true;
++                kvm_arm_pmu_init(cpu);
 +            }
 +        }
-+        if (excret & R_V7M_EXCRET_RES0_MASK) {
-             ufault = true;
-         }
--        break;
--    default:
--        ufault = true;
 +    } else {
-+        /* For v7M we only recognize certain combinations of the low bits */
+         if (aarch64 && vms->highmem) {
-+        switch (excret & 0xf) {
+             int requested_pa_size = 64 - clz64(vms->highest_gpa);
-+        case 1: /* Return to Handler */
+             int pamax = arm_pamax(ARM_CPU(first_cpu));
 +            break;
 +        case 13: /* Return to Thread using Process stack */
 +        case 9: /* Return to Thread using Main stack */
 +            /* We only need to check NONBASETHRDENA for v7M, because in
 +             * v8M this bit does not exist (it is RES1).
 +             */
 +            if (!rettobase &&
 +                !(env->v7m.ccr[env->v7m.secure] &
 +                  R_V7M_CCR_NONBASETHRDENA_MASK)) {
 +                ufault = true;
 +            }
 +            break;
 +        default:
 +            ufault = true;
 +        }
 +    }
 +
 +    if (sfault) {
 +        env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
 +        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
 +        v7m_exception_taken(cpu, excret);
 +        qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
 +                      "stackframe: failed EXC_RETURN.ES validity check\n");
 +        return;
      }
      if (ufault) {
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 02/20] hw/sd: fix out-of-bounds check for multi block reads
+[PULL 10/12] tests/qtest: Restore aarch64 arm-cpu-features test
-From: Michael Olbrich <m.olbrich@pengutronix.de>
+From: Andrew Jones <drjones@redhat.com>
-The current code checks if the next block exceeds the size of the card.
+arm-cpu-features got dropped from the AArch64 tests during the meson
-This generates an error while reading the last block of the card.
+conversion shuffle.
 Do the out-of-bounds check when starting to read a new block to fix this.
-This issue became visible with increased error checking in Linux 4.13.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20201001061718.101915-6-drjones@redhat.com
-Cc: qemu-stable@nongnu.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
 Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
 Message-id: 20170916091611.10241-1-m.olbrich@pengutronix.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/sd.c | 12 ++++++------
+ tests/qtest/meson.build | 3 ++-
-file changed, 6 insertions(+), 6 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/sd/sd.c b/hw/sd/sd.c
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/sd.c
+--- a/tests/qtest/meson.build
-+++ b/hw/sd/sd.c
++++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
+@@ -XXX,XX +XXX,XX @@ qtests_aarch64 = \
-         break;
+   (cpu != 'arm' ? ['bios-tables-test'] : []) +                                                  \
+   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-test'] : []) +        \
-     case 18:    /* CMD18:  READ_MULTIPLE_BLOCK */
+   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-swtpm-test'] : []) +  \
--        if (sd->data_offset == 0)
+-  ['numa-test',
-+        if (sd->data_offset == 0) {
++  ['arm-cpu-features',
-+            if (sd->data_start + io_len > sd->size) {
++   'numa-test',
-+                sd->card_status |= ADDRESS_ERROR;
+    'boot-serial-test',
-+                return 0x00;
+    'migration-test']
 +            }
              BLK_READ_BLOCK(sd->data_start, io_len);
 +        }
          ret = sd->data[sd->data_offset ++];
          if (sd->data_offset >= io_len) {
@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
                      break;
                  }
              }
 -
 -            if (sd->data_start + io_len > sd->size) {
 -                sd->card_status |= ADDRESS_ERROR;
 -                break;
 -            }
          }
          break;
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 03/20] hw/arm/xlnx-zynqmp: Mark the "xlnx, zynqmp" device with user_creatable = false
+Deleted patch
-From: Thomas Huth <thuth@redhat.com>
-The device uses serial_hds in its realize function and thus can't be
-used twice. Apart from that, the comma in its name makes it quite hard
-to use for the user anyway, since a comma is normally used to separate
-the device name from its properties when using the "-device" parameter
-or the "device_add" HMP command.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1506441116-16627-1-git-send-email-thuth@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/xlnx-zynqmp.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zynqmp.c
-+++ b/hw/arm/xlnx-zynqmp.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_class_init(ObjectClass *oc, void *data)
-     dc->props = xlnx_zynqmp_props;
-     dc->realize = xlnx_zynqmp_realize;
-+    /* Reason: Uses serial_hds in realize function, thus can't be used twice */
-+    dc->user_creatable = false;
- }
- static const TypeInfo xlnx_zynqmp_type_info = {
---
-.7.4

-[Qemu-devel] [PULL 04/20] nvic: Clear the vector arrays and prigroup on reset
+Deleted patch
-Reset for devices does not include an automatic clear of the
-device state (unlike CPU state, where most of the state
-structure is cleared to zero). Add some missing initialization
-of NVIC state that meant that the device was left in the wrong
-state if the guest did a warm reset.
-(In particular, since we were resetting the computed state like
-s->exception_prio but not all the state it was computed
-from like s->vectors[x].active, the NVIC wound up in an
-inconsistent state that could later trigger assertion failures.)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1506092407-26985-2-git-send-email-peter.maydell@linaro.org
----
- hw/intc/armv7m_nvic.c | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
-     int resetprio;
-     NVICState *s = NVIC(dev);
-+    memset(s->vectors, 0, sizeof(s->vectors));
-+    memset(s->sec_vectors, 0, sizeof(s->sec_vectors));
-+    s->prigroup[M_REG_NS] = 0;
-+    s->prigroup[M_REG_S] = 0;
-+
-     s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
-     /* MEM, BUS, and USAGE are enabled through
-      * the System Handler Control register
---
-.7.4

-[Qemu-devel] [PULL 07/20] target/arm: Restore security state on exception return
+Deleted patch
-Now that we can handle the CONTROL.SPSEL bit not necessarily being
-in sync with the current stack pointer, we can restore the correct
-security state on exception return. This happens before we start
-to read registers off the stack frame, but after we have taken
-possible usage faults for bad exception return magic values and
-updated CONTROL.SPSEL.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-5-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-      */
-     write_v7m_control_spsel(env, return_to_sp_process);
-+    switch_v7m_security_state(env, return_to_secure);
-+
-     {
-         /* The stack pointer we should be reading the exception frame from
-          * depends on bits in the magic exception return type value (and
---
-.7.4

-[Qemu-devel] [PULL 09/20] target/arm: Check for xPSR mismatch usage faults earlier for v8M
+Deleted patch
-ARM v8M specifies that the INVPC usage fault for mismatched
-xPSR exception field and handler mode bit should be checked
-before updating the PSR and SP, so that the fault is taken
-with the existing stack frame rather than by pushing a new one.
-Perform this check in the right place for v8M.
-Since v7M specifies in its pseudocode that this usage fault
-check should happen later, we have to retain the original
-code for that check rather than being able to merge the two.
-(The distinction is architecturally visible but only in
-very obscure corner cases like attempting an invalid exception
-return with an exception frame in read only memory.)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-7-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 30 +++++++++++++++++++++++++++---
-file changed, 27 insertions(+), 3 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-         }
-         xpsr = ldl_phys(cs->as, frameptr + 0x1c);
-+        if (arm_feature(env, ARM_FEATURE_V8)) {
-+            /* For v8M we have to check whether the xPSR exception field
-+             * matches the EXCRET value for return to handler/thread
-+             * before we commit to changing the SP and xPSR.
-+             */
-+            bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
-+            if (return_to_handler != will_be_handler) {
-+                /* Take an INVPC UsageFault on the current stack.
-+                 * By this point we will have switched to the security state
-+                 * for the background state, so this UsageFault will target
-+                 * that state.
-+                 */
-+                armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
-+                                        env->v7m.secure);
-+                env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-+                v7m_exception_taken(cpu, excret);
-+                qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
-+                              "stackframe: failed exception return integrity "
-+                              "check\n");
-+                return;
-+            }
-+        }
-+
-         /* Commit to consuming the stack frame */
-         frameptr += 0x20;
-         /* Undo stack alignment (the SPREALIGN bit indicates that the original
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-     /* The restored xPSR exception field will be zero if we're
-      * resuming in Thread mode. If that doesn't match what the
-      * exception return excret specified then this is a UsageFault.
-+     * v7M requires we make this check here; v8M did it earlier.
-      */
-     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
--        /* Take an INVPC UsageFault by pushing the stack again.
--         * TODO: the v8M version of this code should target the
--         * background state for this exception.
-+        /* Take an INVPC UsageFault by pushing the stack again;
-+         * we know we're v7M so this is never a Secure UsageFault.
-          */
-+        assert(!arm_feature(env, ARM_FEATURE_V8));
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
-         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-         v7m_push_stack(cpu);
---
-.7.4

-[Qemu-devel] [PULL 10/20] target/arm: Warn about restoring to unaligned stack
+Deleted patch
-Attempting to do an exception return with an exception frame that
-is not 8-aligned is UNPREDICTABLE in v8M; warn about this.
-(It is not UNPREDICTABLE in v7M, and our implementation can
-handle the merely-4-aligned case fine, so we don't need to
-do anything except warn.)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-8-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 7 +++++++
-file changed, 7 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-                                               return_to_sp_process);
-         uint32_t frameptr = *frame_sp_p;
-+        if (!QEMU_IS_ALIGNED(frameptr, 8) &&
-+            arm_feature(env, ARM_FEATURE_V8)) {
-+            qemu_log_mask(LOG_GUEST_ERROR,
-+                          "M profile exception return with non-8-aligned SP "
-+                          "for destination state is UNPREDICTABLE\n");
-+        }
-+
-         /* Pop registers. TODO: make these accesses use the correct
-          * attributes and address space (S/NS, priv/unpriv) and handle
-          * memory transaction failures.
---
-.7.4

-[Qemu-devel] [PULL 11/20] target/arm: Don't warn about exception return with PC low bit set for v8M
+Deleted patch
-In the v8M architecture, return from an exception to a PC which
-has bit 0 set is not UNPREDICTABLE; it is defined that bit 0
-is discarded [R_HRJH]. Restrict our complaint about this to v7M.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-9-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 22 +++++++++++++++-------
-file changed, 15 insertions(+), 7 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-         env->regs[12] = ldl_phys(cs->as, frameptr + 0x10);
-         env->regs[14] = ldl_phys(cs->as, frameptr + 0x14);
-         env->regs[15] = ldl_phys(cs->as, frameptr + 0x18);
-+
-+        /* Returning from an exception with a PC with bit 0 set is defined
-+         * behaviour on v8M (bit 0 is ignored), but for v7M it was specified
-+         * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore
-+         * the lsbit, and there are several RTOSes out there which incorrectly
-+         * assume the r15 in the stack frame should be a Thumb-style "lsbit
-+         * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but
-+         * complain about the badly behaved guest.
-+         */
-         if (env->regs[15] & 1) {
--            qemu_log_mask(LOG_GUEST_ERROR,
--                          "M profile return from interrupt with misaligned "
--                          "PC is UNPREDICTABLE\n");
--            /* Actual hardware seems to ignore the lsbit, and there are several
--             * RTOSes out there which incorrectly assume the r15 in the stack
--             * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
--             */
-             env->regs[15] &= ~1U;
-+            if (!arm_feature(env, ARM_FEATURE_V8)) {
-+                qemu_log_mask(LOG_GUEST_ERROR,
-+                              "M profile return from interrupt with misaligned "
-+                              "PC is UNPREDICTABLE on v7M\n");
-+            }
-         }
-+
-         xpsr = ldl_phys(cs->as, frameptr + 0x1c);
-         if (arm_feature(env, ARM_FEATURE_V8)) {
---
-.7.4

-[Qemu-devel] [PULL 12/20] target/arm: Add new-in-v8M SFSR and SFAR
+[PULL 11/12] hw/arm/virt: Implement kvm-steal-time
-Add the new M profile Secure Fault Status Register
+From: Andrew Jones <drjones@redhat.com>
 and Secure Fault Address Register.
+We add the kvm-steal-time CPU property and implement it for machvirt.
+A tiny bit of refactoring was also done to allow pmu and pvtime to
+use the same vcpu device helper functions.
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Message-id: 20201001061718.101915-7-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-10-git-send-email-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      | 12 ++++++++++++
+ docs/system/arm/cpu-features.rst | 11 ++++++
- hw/intc/armv7m_nvic.c | 34 ++++++++++++++++++++++++++++++++++
+ include/hw/arm/virt.h            |  5 +++
- target/arm/machine.c  |  2 ++
+ target/arm/cpu.h                 |  4 ++
-files changed, 48 insertions(+)
+ target/arm/kvm_arm.h             | 43 +++++++++++++++++++++
  hw/arm/virt.c                    | 43 +++++++++++++++++++--
  target/arm/cpu.c                 |  8 ++++
  target/arm/kvm.c                 | 16 ++++++++
  target/arm/kvm64.c               | 64 +++++++++++++++++++++++++++++---
  target/arm/monitor.c             |  2 +-
  tests/qtest/arm-cpu-features.c   | 25 +++++++++++--
 files changed, 208 insertions(+), 13 deletions(-)
+diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/arm/cpu-features.rst
++++ b/docs/system/arm/cpu-features.rst
+@@ -XXX,XX +XXX,XX @@ the list of KVM VCPU features and their descriptions.
+                            adjustment, also restoring the legacy (pre-5.0)
+                            behavior.
++  kvm-steal-time           Since v5.2, kvm-steal-time is enabled by
++                           default when KVM is enabled, the feature is
++                           supported, and the guest is 64-bit.
++
++                           When kvm-steal-time is enabled a 64-bit guest
++                           can account for time its CPUs were not running
++                           due to the host not scheduling the corresponding
++                           VCPU threads.  The accounting statistics may
++                           influence the guest scheduler behavior and/or be
++                           exposed to the guest userspace.
++
+ SVE CPU Properties
+ ==================
+diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/virt.h
++++ b/include/hw/arm/virt.h
+@@ -XXX,XX +XXX,XX @@
+ #define PPI(irq) ((irq) + 16)
++/* See Linux kernel arch/arm64/include/asm/pvclock-abi.h */
++#define PVTIME_SIZE_PER_CPU 64
++
+ enum {
+     VIRT_FLASH,
+     VIRT_MEM,
+@@ -XXX,XX +XXX,XX @@ enum {
+     VIRT_PCDIMM_ACPI,
+     VIRT_ACPI_GED,
+     VIRT_NVDIMM_ACPI,
++    VIRT_PVTIME,
+     VIRT_LOWMEMMAP_LAST,
+ };
+@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
+     bool no_highmem_ecam;
+     bool no_ged;   /* Machines < 4.2 has no support for ACPI GED device */
+     bool kvm_no_adjvtime;
++    bool no_kvm_steal_time;
+     bool acpi_expose_flash;
+ };
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@
-         uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
+ #include "hw/registerfields.h"
-         uint32_t hfsr; /* HardFault Status */
+ #include "cpu-qom.h"
-         uint32_t dfsr; /* Debug Fault Status Register */
+ #include "exec/cpu-defs.h"
-+        uint32_t sfsr; /* Secure Fault Status Register */
++#include "qapi/qapi-types-common.h"
-         uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
-         uint32_t bfar; /* BusFault Address */
+ /* ARM processors have a weak memory model */
-+        uint32_t sfar; /* Secure Fault Address Register */
+ #define TCG_GUEST_DEFAULT_MO      (0)
-         unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
-         int exception;
+     bool kvm_vtime_dirty;
-         uint32_t primask[M_REG_NUM_BANKS];
+     uint64_t kvm_vtime;
-@@ -XXX,XX +XXX,XX @@ FIELD(V7M_DFSR, DWTTRAP, 2, 1)
- FIELD(V7M_DFSR, VCATCH, 3, 1)
++    /* KVM steal time */
- FIELD(V7M_DFSR, EXTERNAL, 4, 1)
++    OnOffAuto kvm_steal_time;
++
-+/* V7M SFSR bits */
+     /* Uniprocessor system with MP extensions */
-+FIELD(V7M_SFSR, INVEP, 0, 1)
+     bool mp_is_up;
-+FIELD(V7M_SFSR, INVIS, 1, 1)
-+FIELD(V7M_SFSR, INVER, 2, 1)
+diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
-+FIELD(V7M_SFSR, AUVIOL, 3, 1)
+index XXXXXXX..XXXXXXX 100644
-+FIELD(V7M_SFSR, INVTRAN, 4, 1)
+--- a/target/arm/kvm_arm.h
-+FIELD(V7M_SFSR, LSPERR, 5, 1)
++++ b/target/arm/kvm_arm.h
-+FIELD(V7M_SFSR, SFARVALID, 6, 1)
+@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu);
-+FIELD(V7M_SFSR, LSERR, 7, 1)
+  */
-+
+ void kvm_arm_add_vcpu_properties(Object *obj);
- /* v7M MPU_CTRL bits */
- FIELD(V7M_MPU_CTRL, ENABLE, 0, 1)
++/**
- FIELD(V7M_MPU_CTRL, HFNMIENA, 1, 1)
++ * kvm_arm_steal_time_finalize:
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
++ * @cpu: ARMCPU for which to finalize kvm-steal-time
-index XXXXXXX..XXXXXXX 100644
++ * @errp: Pointer to Error* for error propagation
---- a/hw/intc/armv7m_nvic.c
++ *
-+++ b/hw/intc/armv7m_nvic.c
++ * Validate the kvm-steal-time property selection and set its default
-@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
++ * based on KVM support and guest configuration.
-             goto bad_offset;
++ */
 +void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp);
 +
 +/**
 + * kvm_arm_steal_time_supported:
 + *
 + * Returns: true if KVM can enable steal time reporting
 + * and false otherwise.
 + */
 +bool kvm_arm_steal_time_supported(void);
 +
  /**
   * kvm_arm_aarch32_supported:
   *
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void);
  void kvm_arm_pmu_set_irq(CPUState *cs, int irq);
  void kvm_arm_pmu_init(CPUState *cs);
 +
 +/**
 + * kvm_arm_pvtime_init:
 + * @cs: CPUState
 + * @ipa: Per-vcpu guest physical base address of the pvtime structures
 + *
 + * Initializes PVTIME for the VCPU, setting the PVTIME IPA to @ipa.
 + */
 +void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa);
 +
  int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
  #else
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_sve_supported(void)
      return false;
  }
 +static inline bool kvm_arm_steal_time_supported(void)
 +{
 +    return false;
 +}
 +
  /*
   * These functions should never actually be called without KVM support.
   */
@@ -XXX,XX +XXX,XX @@ static inline void kvm_arm_pmu_init(CPUState *cs)
      g_assert_not_reached();
  }
 +static inline void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa)
 +{
 +    g_assert_not_reached();
 +}
 +
 +static inline void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
 +{
 +    g_assert_not_reached();
 +}
 +
  static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
  {
      g_assert_not_reached();
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry base_memmap[] = {
      [VIRT_PCDIMM_ACPI] =        { 0x09070000, MEMORY_HOTPLUG_IO_LEN },
      [VIRT_ACPI_GED] =           { 0x09080000, ACPI_GED_EVT_SEL_LEN },
      [VIRT_NVDIMM_ACPI] =        { 0x09090000, NVDIMM_ACPI_IO_LEN},
 +    [VIRT_PVTIME] =             { 0x090a0000, 0x00010000 },
      [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
      /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
      [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
   * virt_cpu_post_init() must be called after the CPUs have
   * been realized and the GIC has been created.
   */
 -static void virt_cpu_post_init(VirtMachineState *vms)
 +static void virt_cpu_post_init(VirtMachineState *vms, int max_cpus,
 +                               MemoryRegion *sysmem)
  {
 -    bool aarch64, pmu;
 +    bool aarch64, pmu, steal_time;
      CPUState *cpu;
      aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
      pmu = object_property_get_bool(OBJECT(first_cpu), "pmu", NULL);
 +    steal_time = object_property_get_bool(OBJECT(first_cpu),
 +                                          "kvm-steal-time", NULL);
      if (kvm_enabled()) {
 +        hwaddr pvtime_reg_base = vms->memmap[VIRT_PVTIME].base;
 +        hwaddr pvtime_reg_size = vms->memmap[VIRT_PVTIME].size;
 +
 +        if (steal_time) {
 +            MemoryRegion *pvtime = g_new(MemoryRegion, 1);
 +            hwaddr pvtime_size = max_cpus * PVTIME_SIZE_PER_CPU;
 +
 +            /* The memory region size must be a multiple of host page size. */
 +            pvtime_size = REAL_HOST_PAGE_ALIGN(pvtime_size);
 +
 +            if (pvtime_size > pvtime_reg_size) {
 +                error_report("pvtime requires a %ld byte memory region for "
 +                             "%d CPUs, but only %ld has been reserved",
 +                             pvtime_size, max_cpus, pvtime_reg_size);
 +                exit(1);
 +            }
 +
 +            memory_region_init_ram(pvtime, NULL, "pvtime", pvtime_size, NULL);
 +            memory_region_add_subregion(sysmem, pvtime_reg_base, pvtime);
 +        }
 +
          CPU_FOREACH(cpu) {
              if (pmu) {
                  assert(arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_PMU));
@@ -XXX,XX +XXX,XX @@ static void virt_cpu_post_init(VirtMachineState *vms)
                  }
                  kvm_arm_pmu_init(cpu);
              }
 +            if (steal_time) {
 +                kvm_arm_pvtime_init(cpu, pvtime_reg_base +
 +                                         cpu->cpu_index * PVTIME_SIZE_PER_CPU);
 +            }
          }
-         return cpu->env.pmsav8.mair1[attrs.secure];
+     } else {
-+    case 0xde4: /* SFSR */
+         if (aarch64 && vms->highmem) {
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-+            goto bad_offset;
+             object_property_set_bool(cpuobj, "kvm-no-adjvtime", true, NULL);
          }
 +        if (vmc->no_kvm_steal_time &&
 +            object_property_find(cpuobj, "kvm-steal-time")) {
 +            object_property_set_bool(cpuobj, "kvm-steal-time", false, NULL);
 +        }
-+        if (!attrs.secure) {
++
-+            return 0;
+         if (vmc->no_pmu && object_property_find(cpuobj, "pmu")) {
-+        }
+             object_property_set_bool(cpuobj, "pmu", false, NULL);
-+        return cpu->env.v7m.sfsr;
+         }
-+    case 0xde8: /* SFAR */
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
-+            goto bad_offset;
+     create_gic(vms);
-+        }
-+        if (!attrs.secure) {
+-    virt_cpu_post_init(vms);
-+            return 0;
++    virt_cpu_post_init(vms, possible_cpus->len, sysmem);
-+        }
-+        return cpu->env.v7m.sfar;
+     fdt_add_pmu_nodes(vms);
-     default:
-     bad_offset:
+@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(5, 2)
-         qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
-@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
+ static void virt_machine_5_1_options(MachineClass *mc)
-          * only affect cacheability, and we don't implement caching.
+ {
-          */
++    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
-         break;
++
-+    case 0xde4: /* SFSR */
+     virt_machine_5_2_options(mc);
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+     compat_props_add(mc->compat_props, hw_compat_5_1, hw_compat_5_1_len);
-+            goto bad_offset;
++    vmc->no_kvm_steal_time = true;
-+        }
+ }
-+        if (!attrs.secure) {
+ DEFINE_VIRT_MACHINE(5, 1)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
              return;
          }
      }
 +
 +    if (kvm_enabled()) {
 +        kvm_arm_steal_time_finalize(cpu, &local_err);
 +        if (local_err != NULL) {
 +            error_propagate(errp, local_err);
 +            return;
 +        }
-+        cpu->env.v7m.sfsr &= ~value; /* W1C */
++    }
-+        break;
+ }
-+    case 0xde8: /* SFAR */
-+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-+            goto bad_offset;
+diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_no_adjvtime_set(Object *obj, bool value, Error **errp)
      ARM_CPU(obj)->kvm_adjvtime = !value;
  }
 +static bool kvm_steal_time_get(Object *obj, Error **errp)
 +{
 +    return ARM_CPU(obj)->kvm_steal_time != ON_OFF_AUTO_OFF;
 +}
 +
 +static void kvm_steal_time_set(Object *obj, bool value, Error **errp)
 +{
 +    ARM_CPU(obj)->kvm_steal_time = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
 +}
 +
  /* KVM VCPU properties should be prefixed with "kvm-". */
  void kvm_arm_add_vcpu_properties(Object *obj)
  {
@@ -XXX,XX +XXX,XX @@ void kvm_arm_add_vcpu_properties(Object *obj)
                                          "the virtual counter. VM stopped time "
                                          "will be counted.");
      }
 +
 +    cpu->kvm_steal_time = ON_OFF_AUTO_AUTO;
 +    object_property_add_bool(obj, "kvm-steal-time", kvm_steal_time_get,
 +                             kvm_steal_time_set);
 +    object_property_set_description(obj, "kvm-steal-time",
 +                                    "Set off to disable KVM steal time.");
  }
  bool kvm_arm_pmu_supported(void)
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
  #include <linux/kvm.h>
  #include "qemu-common.h"
 +#include "qapi/error.h"
  #include "cpu.h"
  #include "qemu/timer.h"
  #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static CPUWatchpoint *find_hw_watchpoint(CPUState *cpu, target_ulong addr)
      return NULL;
  }
 -static bool kvm_arm_pmu_set_attr(CPUState *cs, struct kvm_device_attr *attr)
 +static bool kvm_arm_set_device_attr(CPUState *cs, struct kvm_device_attr *attr,
 +                                    const char *name)
  {
      int err;
      err = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr);
      if (err != 0) {
 -        error_report("PMU: KVM_HAS_DEVICE_ATTR: %s", strerror(-err));
 +        error_report("%s: KVM_HAS_DEVICE_ATTR: %s", name, strerror(-err));
          return false;
      }
      err = kvm_vcpu_ioctl(cs, KVM_SET_DEVICE_ATTR, attr);
      if (err != 0) {
 -        error_report("PMU: KVM_SET_DEVICE_ATTR: %s", strerror(-err));
 +        error_report("%s: KVM_SET_DEVICE_ATTR: %s", name, strerror(-err));
          return false;
      }
@@ -XXX,XX +XXX,XX @@ void kvm_arm_pmu_init(CPUState *cs)
      if (!ARM_CPU(cs)->has_pmu) {
          return;
      }
 -    if (!kvm_arm_pmu_set_attr(cs, &attr)) {
 +    if (!kvm_arm_set_device_attr(cs, &attr, "PMU")) {
          error_report("failed to init PMU");
          abort();
      }
@@ -XXX,XX +XXX,XX @@ void kvm_arm_pmu_set_irq(CPUState *cs, int irq)
      if (!ARM_CPU(cs)->has_pmu) {
          return;
      }
 -    if (!kvm_arm_pmu_set_attr(cs, &attr)) {
 +    if (!kvm_arm_set_device_attr(cs, &attr, "PMU")) {
          error_report("failed to set irq for PMU");
          abort();
      }
  }
 +void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa)
 +{
 +    struct kvm_device_attr attr = {
 +        .group = KVM_ARM_VCPU_PVTIME_CTRL,
 +        .attr = KVM_ARM_VCPU_PVTIME_IPA,
 +        .addr = (uint64_t)&ipa,
 +    };
 +
 +    if (ARM_CPU(cs)->kvm_steal_time == ON_OFF_AUTO_OFF) {
 +        return;
 +    }
 +    if (!kvm_arm_set_device_attr(cs, &attr, "PVTIME IPA")) {
 +        error_report("failed to init PVTIME IPA");
 +        abort();
 +    }
 +}
 +
  static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
  {
      uint64_t ret;
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      return true;
  }
 +void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
 +{
 +    bool has_steal_time = kvm_arm_steal_time_supported();
 +
 +    if (cpu->kvm_steal_time == ON_OFF_AUTO_AUTO) {
 +        if (!has_steal_time || !arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
 +            cpu->kvm_steal_time = ON_OFF_AUTO_OFF;
 +        } else {
 +            cpu->kvm_steal_time = ON_OFF_AUTO_ON;
 +        }
-+        if (!attrs.secure) {
++    } else if (cpu->kvm_steal_time == ON_OFF_AUTO_ON) {
 +        if (!has_steal_time) {
 +            error_setg(errp, "'kvm-steal-time' cannot be enabled "
 +                             "on this host");
 +            return;
 +        } else if (!arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
 +            /*
 +             * DEN0057A chapter 2 says "This specification only covers
 +             * systems in which the Execution state of the hypervisor
 +             * as well as EL1 of virtual machines is AArch64.". And,
 +             * to ensure that, the smc/hvc calls are only specified as
 +             * smc64/hvc64.
 +             */
 +            error_setg(errp, "'kvm-steal-time' cannot be enabled "
 +                             "for AArch32 guests");
 +            return;
 +        }
-+        cpu->env.v7m.sfsr = value;
++    }
-+        break;
++}
-     case 0xf00: /* Software Triggered Interrupt Register */
++
-     {
+ bool kvm_arm_aarch32_supported(void)
-         int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
+ {
-diff --git a/target/arm/machine.c b/target/arm/machine.c
+     return kvm_check_extension(kvm_state, KVM_CAP_ARM_EL1_32BIT);
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_sve_supported(void)
---- a/target/arm/machine.c
+     return kvm_check_extension(kvm_state, KVM_CAP_ARM_SVE);
-+++ b/target/arm/machine.c
+ }
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
-         VMSTATE_UINT32(env.v7m.ccr[M_REG_S], ARMCPU),
++bool kvm_arm_steal_time_supported(void)
-         VMSTATE_UINT32(env.v7m.mmfar[M_REG_S], ARMCPU),
++{
-         VMSTATE_UINT32(env.v7m.cfsr[M_REG_S], ARMCPU),
++    return kvm_check_extension(kvm_state, KVM_CAP_STEAL_TIME);
-+        VMSTATE_UINT32(env.v7m.sfsr, ARMCPU),
++}
-+        VMSTATE_UINT32(env.v7m.sfar, ARMCPU),
++
-         VMSTATE_END_OF_LIST()
+ QEMU_BUILD_BUG_ON(KVM_ARM64_SVE_VQ_MIN != 1);
-     }
  void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
 diff --git a/target/arm/monitor.c b/target/arm/monitor.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/monitor.c
 +++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ static const char *cpu_model_advertised_features[] = {
      "sve128", "sve256", "sve384", "sve512",
      "sve640", "sve768", "sve896", "sve1024", "sve1152", "sve1280",
      "sve1408", "sve1536", "sve1664", "sve1792", "sve1920", "sve2048",
 -    "kvm-no-adjvtime",
 +    "kvm-no-adjvtime", "kvm-steal-time",
      NULL
  };
+diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/arm-cpu-features.c
++++ b/tests/qtest/arm-cpu-features.c
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
+     assert_set_feature(qts, "max", "pmu", true);
+     assert_has_not_feature(qts, "max", "kvm-no-adjvtime");
++    assert_has_not_feature(qts, "max", "kvm-steal-time");
+     if (g_str_equal(qtest_get_arch(), "aarch64")) {
+         assert_has_feature_enabled(qts, "max", "aarch64");
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
+     assert_set_feature(qts, "host", "kvm-no-adjvtime", false);
+     if (g_str_equal(qtest_get_arch(), "aarch64")) {
++        bool kvm_supports_steal_time;
+         bool kvm_supports_sve;
+         char max_name[8], name[8];
+         uint32_t max_vq, vq;
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
+         QDict *resp;
+         char *error;
++        assert_error(qts, "cortex-a15",
++            "We cannot guarantee the CPU type 'cortex-a15' works "
++            "with KVM on this host", NULL);
++
+         assert_has_feature_enabled(qts, "host", "aarch64");
+         /* Enabling and disabling pmu should always work. */
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
+         assert_set_feature(qts, "host", "pmu", false);
+         assert_set_feature(qts, "host", "pmu", true);
+-        assert_error(qts, "cortex-a15",
+-            "We cannot guarantee the CPU type 'cortex-a15' works "
+-            "with KVM on this host", NULL);
+-
++        /*
++         * Some features would be enabled by default, but they're disabled
++         * because this instance of KVM doesn't support them. Test that the
++         * features are present, and, when enabled, issue further tests.
++         */
++        assert_has_feature(qts, "host", "kvm-steal-time");
+         assert_has_feature(qts, "host", "sve");
++
+         resp = do_query_no_props(qts, "host");
++        kvm_supports_steal_time = resp_get_feature(resp, "kvm-steal-time");
+         kvm_supports_sve = resp_get_feature(resp, "sve");
+         vls = resp_get_sve_vls(resp);
+         qobject_unref(resp);
++        if (kvm_supports_steal_time) {
++            /* If we have steal-time then we should be able to toggle it. */
++            assert_set_feature(qts, "host", "kvm-steal-time", false);
++            assert_set_feature(qts, "host", "kvm-steal-time", true);
++        }
++
+         if (kvm_supports_sve) {
+             g_assert(vls != 0);
+             max_vq = 64 - __builtin_clzll(vls);
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
+         assert_has_not_feature(qts, "host", "aarch64");
+         assert_has_not_feature(qts, "host", "pmu");
+         assert_has_not_feature(qts, "host", "sve");
++        assert_has_not_feature(qts, "host", "kvm-steal-time");
+     }
+     qtest_quit(qts);
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 14/20] target/arm: Add support for restoring v8M additional state context
+Deleted patch
-For v8M, exceptions from Secure to Non-Secure state will save
-callee-saved registers to the exception frame as well as the
-caller-saved registers. Add support for unstacking these
-registers in exception exit when necessary.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-12-git-send-email-peter.maydell@linaro.org
----
- target/arm/helper.c | 30 ++++++++++++++++++++++++++++++
-file changed, 30 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
-                           "for destination state is UNPREDICTABLE\n");
-         }
-+        /* Do we need to pop callee-saved registers? */
-+        if (return_to_secure &&
-+            ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
-+             (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
-+            uint32_t expected_sig = 0xfefa125b;
-+            uint32_t actual_sig = ldl_phys(cs->as, frameptr);
-+
-+            if (expected_sig != actual_sig) {
-+                /* Take a SecureFault on the current stack */
-+                env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
-+                armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
-+                v7m_exception_taken(cpu, excret);
-+                qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
-+                              "stackframe: failed exception return integrity "
-+                              "signature check\n");
-+                return;
-+            }
-+
-+            env->regs[4] = ldl_phys(cs->as, frameptr + 0x8);
-+            env->regs[5] = ldl_phys(cs->as, frameptr + 0xc);
-+            env->regs[6] = ldl_phys(cs->as, frameptr + 0x10);
-+            env->regs[7] = ldl_phys(cs->as, frameptr + 0x14);
-+            env->regs[8] = ldl_phys(cs->as, frameptr + 0x18);
-+            env->regs[9] = ldl_phys(cs->as, frameptr + 0x1c);
-+            env->regs[10] = ldl_phys(cs->as, frameptr + 0x20);
-+            env->regs[11] = ldl_phys(cs->as, frameptr + 0x24);
-+
-+            frameptr += 0x28;
-+        }
-+
-         /* Pop registers. TODO: make these accesses use the correct
-          * attributes and address space (S/NS, priv/unpriv) and handle
-          * memory transaction failures.
---
-.7.4

-[Qemu-devel] [PULL 16/20] nvic: Implement Security Attribution Unit registers
+[PULL 12/12] target/arm: Make '-cpu max' have a 48-bit PA
-Implement the register interface for the SAU: SAU_CTRL,
+QEMU supports a 48-bit physical address range, but we don't currently
-SAU_TYPE, SAU_RNR, SAU_RBAR and SAU_RLAR. None of the
+expose it in the '-cpu max' ID registers (you get the same range as
-actual behaviour is implemented here; registers just
+Cortex-A57, which is 44 bits).
 read back as written.
-When the CPU definition for Cortex-M33 is eventually
+Set the ID_AA64MMFR0.PARange field to indicate 48 bits.
 added, its initfn will set cpu->sau_sregion, in the same
 way that we currently set cpu->pmsav7_dregion for the
 M3 and M4.
 Number of SAU regions is typically a configurable
 CPU parameter, but this patch doesn't provide a
 QEMU CPU property for it. We can easily add one when
 we have a board that requires it.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-14-git-send-email-peter.maydell@linaro.org
+Message-id: 20201001160116.18095-1-peter.maydell@linaro.org
 ---
- target/arm/cpu.h      |  10 +++++
+ target/arm/cpu64.c | 4 ++++
- hw/intc/armv7m_nvic.c | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++
+file changed, 4 insertions(+)
  target/arm/cpu.c      |  27 ++++++++++++
  target/arm/machine.c  |  14 ++++++
 files changed, 167 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/cpu64.c
-+++ b/target/arm/cpu.h
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-         uint32_t mair1[M_REG_NUM_BANKS];
+         t = FIELD_DP64(t, ID_AA64PFR1, MTE, 2);
-     } pmsav8;
+         cpu->isar.id_aa64pfr1 = t;
-+    /* v8M SAU */
++        t = cpu->isar.id_aa64mmfr0;
-+    struct {
++        t = FIELD_DP64(t, ID_AA64MMFR0, PARANGE, 5); /* PARange: 48 bits */
-+        uint32_t *rbar;
++        cpu->isar.id_aa64mmfr0 = t;
 +        uint32_t *rlar;
 +        uint32_t rnr;
 +        uint32_t ctrl;
 +    } sau;
 +
-     void *nvic;
+         t = cpu->isar.id_aa64mmfr1;
-     const struct arm_boot_info *boot_info;
+         t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1); /* HPD */
-     /* Store GICv3CPUState to access from this struct */
+         t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1);
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      bool has_mpu;
      /* PMSAv7 MPU number of supported regions */
      uint32_t pmsav7_dregion;
 +    /* v8M SAU number of supported regions */
 +    uint32_t sau_sregion;
      /* PSCI conduit used to invoke PSCI methods
       * 0 - disabled, 1 - smc, 2 - hvc
 diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/armv7m_nvic.c
 +++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
              goto bad_offset;
          }
          return cpu->env.pmsav8.mair1[attrs.secure];
 +    case 0xdd0: /* SAU_CTRL */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return 0;
 +        }
 +        return cpu->env.sau.ctrl;
 +    case 0xdd4: /* SAU_TYPE */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return 0;
 +        }
 +        return cpu->sau_sregion;
 +    case 0xdd8: /* SAU_RNR */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return 0;
 +        }
 +        return cpu->env.sau.rnr;
 +    case 0xddc: /* SAU_RBAR */
 +    {
 +        int region = cpu->env.sau.rnr;
 +
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return 0;
 +        }
 +        if (region >= cpu->sau_sregion) {
 +            return 0;
 +        }
 +        return cpu->env.sau.rbar[region];
 +    }
 +    case 0xde0: /* SAU_RLAR */
 +    {
 +        int region = cpu->env.sau.rnr;
 +
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return 0;
 +        }
 +        if (region >= cpu->sau_sregion) {
 +            return 0;
 +        }
 +        return cpu->env.sau.rlar[region];
 +    }
      case 0xde4: /* SFSR */
          if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
              goto bad_offset;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
           * only affect cacheability, and we don't implement caching.
           */
          break;
 +    case 0xdd0: /* SAU_CTRL */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return;
 +        }
 +        cpu->env.sau.ctrl = value & 3;
 +    case 0xdd4: /* SAU_TYPE */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        break;
 +    case 0xdd8: /* SAU_RNR */
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return;
 +        }
 +        if (value >= cpu->sau_sregion) {
 +            qemu_log_mask(LOG_GUEST_ERROR, "SAU region out of range %"
 +                          PRIu32 "/%" PRIu32 "\n",
 +                          value, cpu->sau_sregion);
 +        } else {
 +            cpu->env.sau.rnr = value;
 +        }
 +        break;
 +    case 0xddc: /* SAU_RBAR */
 +    {
 +        int region = cpu->env.sau.rnr;
 +
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return;
 +        }
 +        if (region >= cpu->sau_sregion) {
 +            return;
 +        }
 +        cpu->env.sau.rbar[region] = value & ~0x1f;
 +        tlb_flush(CPU(cpu));
 +        break;
 +    }
 +    case 0xde0: /* SAU_RLAR */
 +    {
 +        int region = cpu->env.sau.rnr;
 +
 +        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
 +            goto bad_offset;
 +        }
 +        if (!attrs.secure) {
 +            return;
 +        }
 +        if (region >= cpu->sau_sregion) {
 +            return;
 +        }
 +        cpu->env.sau.rlar[region] = value & ~0x1c;
 +        tlb_flush(CPU(cpu));
 +        break;
 +    }
      case 0xde4: /* SFSR */
          if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
              goto bad_offset;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
          env->pmsav8.mair1[M_REG_S] = 0;
      }
 +    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
 +        if (cpu->sau_sregion > 0) {
 +            memset(env->sau.rbar, 0, sizeof(*env->sau.rbar) * cpu->sau_sregion);
 +            memset(env->sau.rlar, 0, sizeof(*env->sau.rlar) * cpu->sau_sregion);
 +        }
 +        env->sau.rnr = 0;
 +        /* SAU_CTRL reset value is IMPDEF; we choose 0, which is what
 +         * the Cortex-M33 does.
 +         */
 +        env->sau.ctrl = 0;
 +    }
 +
      set_flush_to_zero(1, &env->vfp.standard_fp_status);
      set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
      set_default_nan_mode(1, &env->vfp.standard_fp_status);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          }
      }
 +    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
 +        uint32_t nr = cpu->sau_sregion;
 +
 +        if (nr > 0xff) {
 +            error_setg(errp, "v8M SAU #regions invalid %" PRIu32, nr);
 +            return;
 +        }
 +
 +        if (nr) {
 +            env->sau.rbar = g_new0(uint32_t, nr);
 +            env->sau.rlar = g_new0(uint32_t, nr);
 +        }
 +    }
 +
      if (arm_feature(env, ARM_FEATURE_EL3)) {
          set_feature(env, ARM_FEATURE_VBAR);
      }
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
      cpu->midr = 0x410fc240; /* r0p0 */
      cpu->pmsav7_dregion = 8;
  }
 +
  static void arm_v7m_class_init(ObjectClass *oc, void *data)
  {
      CPUClass *cc = CPU_CLASS(oc);
 diff --git a/target/arm/machine.c b/target/arm/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/machine.c
 +++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static bool s_rnr_vmstate_validate(void *opaque, int version_id)
      return cpu->env.pmsav7.rnr[M_REG_S] < cpu->pmsav7_dregion;
  }
 +static bool sau_rnr_vmstate_validate(void *opaque, int version_id)
 +{
 +    ARMCPU *cpu = opaque;
 +
 +    return cpu->env.sau.rnr < cpu->sau_sregion;
 +}
 +
  static bool m_security_needed(void *opaque)
  {
      ARMCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
          VMSTATE_UINT32(env.v7m.cfsr[M_REG_S], ARMCPU),
          VMSTATE_UINT32(env.v7m.sfsr, ARMCPU),
          VMSTATE_UINT32(env.v7m.sfar, ARMCPU),
 +        VMSTATE_VARRAY_UINT32(env.sau.rbar, ARMCPU, sau_sregion, 0,
 +                              vmstate_info_uint32, uint32_t),
 +        VMSTATE_VARRAY_UINT32(env.sau.rlar, ARMCPU, sau_sregion, 0,
 +                              vmstate_info_uint32, uint32_t),
 +        VMSTATE_UINT32(env.sau.rnr, ARMCPU),
 +        VMSTATE_VALIDATE("SAU_RNR is valid", sau_rnr_vmstate_validate),
 +        VMSTATE_UINT32(env.sau.ctrl, ARMCPU),
          VMSTATE_END_OF_LIST()
      }
  };
 --
-.7.4
+.20.1

-[Qemu-devel] [PULL 18/20] target/arm: Fix calculation of secure mm_idx values
+Deleted patch
-In cpu_mmu_index() we try to do this:
-        if (env->v7m.secure) {
-            mmu_idx += ARMMMUIdx_MSUser;
-        }
-but it will give the wrong answer, because ARMMMUIdx_MSUser
-includes the 0x40 ARM_MMU_IDX_M field, and so does the
-mmu_idx we're adding to, and we'll end up with 0x8n rather
-than 0x4n. This error is then nullified by the call to
-arm_to_core_mmu_idx() which masks out the high part, but
-we're about to factor out the code that calculates the
-ARMMMUIdx values so it can be used without passing it through
-arm_to_core_mmu_idx(), so fix this bug first.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1506092407-26985-16-git-send-email-peter.maydell@linaro.org
----
- target/arm/cpu.h | 12 +++++++-----
-file changed, 7 insertions(+), 5 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
-     int el = arm_current_el(env);
-     if (arm_feature(env, ARM_FEATURE_M)) {
--        ARMMMUIdx mmu_idx = el == 0 ? ARMMMUIdx_MUser : ARMMMUIdx_MPriv;
-+        ARMMMUIdx mmu_idx;
--        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
--            mmu_idx = ARMMMUIdx_MNegPri;
-+        if (el == 0) {
-+            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
-+        } else {
-+            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
-         }
--        if (env->v7m.secure) {
--            mmu_idx += ARMMMUIdx_MSUser;
-+        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
-+            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
-         }
-         return arm_to_core_mmu_idx(mmu_idx);
---
-.7.4

Mostly my stuff with a few easy patches from others. I know I have
a few big series in my to-review queue, but I've been too jetlagged
to try to tackle those :-(

thanks
-- PMM

The following changes since commit a26a98dfb9d448d7234d931ae3720feddf6f0651:

Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20171006' into staging (2017-10-06 13:19:03 +0100)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171006

for you to fetch changes up to 04829ce334bece78d4fa1d0fdbc8bc27dae9b242:

nvic: Add missing code for writing SHCSR.HARDFAULTPENDED bit (2017-10-06 16:46:49 +0100)

----------------------------------------------------------------
target-arm:
 * v8M: more preparatory work
 * nvic: reset properly rather than leaving the nvic in a weird state
 * xlnx-zynqmp: Mark the "xlnx, zynqmp" device with user_creatable = false
 * sd: fix out-of-bounds check for multi block reads
 * arm: Fix SMC reporting to EL2 when QEMU provides PSCI

----------------------------------------------------------------
Jan Kiszka (1):
      arm: Fix SMC reporting to EL2 when QEMU provides PSCI

Michael Olbrich (1):
      hw/sd: fix out-of-bounds check for multi block reads

Peter Maydell (17):
      nvic: Clear the vector arrays and prigroup on reset
      target/arm: Don't switch to target stack early in v7M exception return
      target/arm: Prepare for CONTROL.SPSEL being nonzero in Handler mode
      target/arm: Restore security state on exception return
      target/arm: Restore SPSEL to correct CONTROL register on exception return
      target/arm: Check for xPSR mismatch usage faults earlier for v8M
      target/arm: Warn about restoring to unaligned stack
      target/arm: Don't warn about exception return with PC low bit set for v8M
      target/arm: Add new-in-v8M SFSR and SFAR
      target/arm: Update excret sanity checks for v8M
      target/arm: Add support for restoring v8M additional state context
      target/arm: Add v8M support to exception entry code
      nvic: Implement Security Attribution Unit registers
      target/arm: Implement security attribute lookups for memory accesses
      target/arm: Fix calculation of secure mm_idx values
      target/arm: Factor out "get mmuidx for specified security state"
      nvic: Add missing code for writing SHCSR.HARDFAULTPENDED bit

Thomas Huth (1):
      hw/arm/xlnx-zynqmp: Mark the "xlnx, zynqmp" device with user_creatable = false

From: Jan Kiszka <jan.kiszka@siemens.com>

This properly forwards SMC events to EL2 when PSCI is provided by QEMU
itself and, thus, ARM_FEATURE_EL3 is off.

Found and tested with the Jailhouse hypervisor. Solution based on
suggestions by Peter Maydell.

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Message-id: 4f243068-aaea-776f-d18f-f9e05e7be9cd@siemens.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c    |  9 ++++++++-
 target/arm/op_helper.c | 27 +++++++++++++++++----------
 2 files changed, 25 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         valid_mask &= ~HCR_HCD;
-    } else {
+    } else if (cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
+        /* Architecturally HCR.TSC is RES0 if EL3 is not implemented.
+         * However, if we're using the SMC PSCI conduit then QEMU is
+         * effectively acting like EL3 firmware and so the guest at
+         * EL2 should retain the ability to prevent EL1 from being
+         * able to make SMC calls into the ersatz firmware, so in
+         * that case HCR.TSC should be read/write.
+         */
         valid_mask &= ~HCR_TSC;
     }
 
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(pre_smc)(CPUARMState *env, uint32_t syndrome)
      */
     bool undef = arm_feature(env, ARM_FEATURE_AARCH64) ? smd : smd && !secure;
 
-    if (arm_is_psci_call(cpu, EXCP_SMC)) {
-        /* If PSCI is enabled and this looks like a valid PSCI call then
-         * that overrides the architecturally mandated SMC behaviour.
+    if (!arm_feature(env, ARM_FEATURE_EL3) &&
+        cpu->psci_conduit != QEMU_PSCI_CONDUIT_SMC) {
+        /* If we have no EL3 then SMC always UNDEFs and can't be
+         * trapped to EL2. PSCI-via-SMC is a sort of ersatz EL3
+         * firmware within QEMU, and we want an EL2 guest to be able
+         * to forbid its EL1 from making PSCI calls into QEMU's
+         * "firmware" via HCR.TSC, so for these purposes treat
+         * PSCI-via-SMC as implying an EL3.
          */
-        return;
-    }
-
-    if (!arm_feature(env, ARM_FEATURE_EL3)) {
-        /* If we have no EL3 then SMC always UNDEFs */
         undef = true;
     } else if (!secure && cur_el == 1 && (env->cp15.hcr_el2 & HCR_TSC)) {
-        /* In NS EL1, HCR controlled routing to EL2 has priority over SMD. */
+        /* In NS EL1, HCR controlled routing to EL2 has priority over SMD.
+         * We also want an EL2 guest to be able to forbid its EL1 from
+         * making PSCI calls into QEMU's "firmware" via HCR.TSC.
+         */
         raise_exception(env, EXCP_HYP_TRAP, syndrome, 2);
     }
 
-    if (undef) {
+    /* If PSCI is enabled and this looks like a valid PSCI call then
+     * suppress the UNDEF -- we'll catch the SMC exception and
+     * implement the PSCI call behaviour there.
+     */
+    if (undef && !arm_is_psci_call(cpu, EXCP_SMC)) {
         raise_exception(env, EXCP_UDEF, syn_uncategorized(),
                         exception_target_el(env));
     }
-- 
2.7.4

From: Michael Olbrich <m.olbrich@pengutronix.de>

The current code checks if the next block exceeds the size of the card.
This generates an error while reading the last block of the card.
Do the out-of-bounds check when starting to read a new block to fix this.

This issue became visible with increased error checking in Linux 4.13.

Cc: qemu-stable@nongnu.org
Signed-off-by: Michael Olbrich <m.olbrich@pengutronix.de>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 20170916091611.10241-1-m.olbrich@pengutronix.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/sd.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/hw/sd/sd.c b/hw/sd/sd.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/sd.c
+++ b/hw/sd/sd.c
@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
         break;
 
     case 18:	/* CMD18:  READ_MULTIPLE_BLOCK */
-        if (sd->data_offset == 0)
+        if (sd->data_offset == 0) {
+            if (sd->data_start + io_len > sd->size) {
+                sd->card_status |= ADDRESS_ERROR;
+                return 0x00;
+            }
             BLK_READ_BLOCK(sd->data_start, io_len);
+        }
         ret = sd->data[sd->data_offset ++];
 
         if (sd->data_offset >= io_len) {
@@ -XXX,XX +XXX,XX @@ uint8_t sd_read_data(SDState *sd)
                     break;
                 }
             }
-
-            if (sd->data_start + io_len > sd->size) {
-                sd->card_status |= ADDRESS_ERROR;
-                break;
-            }
         }
         break;
 
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

The device uses serial_hds in its realize function and thus can't be
used twice. Apart from that, the comma in its name makes it quite hard
to use for the user anyway, since a comma is normally used to separate
the device name from its properties when using the "-device" parameter
or the "device_add" HMP command.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1506441116-16627-1-git-send-email-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zynqmp.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_class_init(ObjectClass *oc, void *data)
 
     dc->props = xlnx_zynqmp_props;
     dc->realize = xlnx_zynqmp_realize;
+    /* Reason: Uses serial_hds in realize function, thus can't be used twice */
+    dc->user_creatable = false;
 }
 
 static const TypeInfo xlnx_zynqmp_type_info = {
-- 
2.7.4

Reset for devices does not include an automatic clear of the
device state (unlike CPU state, where most of the state
structure is cleared to zero). Add some missing initialization
of NVIC state that meant that the device was left in the wrong
state if the guest did a warm reset.

(In particular, since we were resetting the computed state like
s->exception_prio but not all the state it was computed
from like s->vectors[x].active, the NVIC wound up in an
inconsistent state that could later trigger assertion failures.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1506092407-26985-2-git-send-email-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void armv7m_nvic_reset(DeviceState *dev)
     int resetprio;
     NVICState *s = NVIC(dev);
 
+    memset(s->vectors, 0, sizeof(s->vectors));
+    memset(s->sec_vectors, 0, sizeof(s->sec_vectors));
+    s->prigroup[M_REG_NS] = 0;
+    s->prigroup[M_REG_S] = 0;
+
     s->vectors[ARMV7M_EXCP_NMI].enabled = 1;
     /* MEM, BUS, and USAGE are enabled through
      * the System Handler Control register
-- 
2.7.4

Currently our M profile exception return code switches to the
target stack pointer relatively early in the process, before
it tries to pop the exception frame off the stack. This is
awkward for v8M for two reasons:
 * in v8M the process vs main stack pointer is not selected
   purely by the value of CONTROL.SPSEL, so updating SPSEL
   and relying on that to switch to the right stack pointer
   won't work
 * the stack we should be reading the stack frame from and
   the stack we will eventually switch to might not be the
   same if the guest is doing strange things

Change our exception return code to use a 'frame pointer'
to read the exception frame rather than assuming that we
can switch the live stack pointer this early.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-3-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 130 +++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 98 insertions(+), 32 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_push(CPUARMState *env, uint32_t val)
     stl_phys(cs->as, env->regs[13], val);
 }
 
-static uint32_t v7m_pop(CPUARMState *env)
-{
-    CPUState *cs = CPU(arm_env_get_cpu(env));
-    uint32_t val;
-
-    val = ldl_phys(cs->as, env->regs[13]);
-    env->regs[13] += 4;
-    return val;
-}
-
 /* Return true if we're using the process stack pointer (not the MSP) */
 static bool v7m_using_psp(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_bxns)(CPUARMState *env, uint32_t dest)
     env->regs[15] = dest & ~1;
 }
 
+static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
+                                bool spsel)
+{
+    /* Return a pointer to the location where we currently store the
+     * stack pointer for the requested security state and thread mode.
+     * This pointer will become invalid if the CPU state is updated
+     * such that the stack pointers are switched around (eg changing
+     * the SPSEL control bit).
+     * Compare the v8M ARM ARM pseudocode LookUpSP_with_security_mode().
+     * Unlike that pseudocode, we require the caller to pass us in the
+     * SPSEL control bit value; this is because we also use this
+     * function in handling of pushing of the callee-saves registers
+     * part of the v8M stack frame (pseudocode PushCalleeStack()),
+     * and in the tailchain codepath the SPSEL bit comes from the exception
+     * return magic LR value from the previous exception. The pseudocode
+     * opencodes the stack-selection in PushCalleeStack(), but we prefer
+     * to make this utility function generic enough to do the job.
+     */
+    bool want_psp = threadmode && spsel;
+
+    if (secure == env->v7m.secure) {
+        /* Currently switch_v7m_sp switches SP as it updates SPSEL,
+         * so the SP we want is always in regs[13].
+         * When we decouple SPSEL from the actually selected SP
+         * we need to check want_psp against v7m_using_psp()
+         * to see whether we need regs[13] or v7m.other_sp.
+         */
+        return &env->regs[13];
+    } else {
+        if (want_psp) {
+            return &env->v7m.other_ss_psp;
+        } else {
+            return &env->v7m.other_ss_msp;
+        }
+    }
+}
+
 static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
 {
     CPUState *cs = CPU(cpu);
@@ -XXX,XX +XXX,XX @@ static void v7m_push_stack(ARMCPU *cpu)
 static void do_v7m_exception_exit(ARMCPU *cpu)
 {
     CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
     uint32_t excret;
     uint32_t xpsr;
     bool ufault = false;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     bool return_to_handler = false;
     bool rettobase = false;
     bool exc_secure = false;
+    bool return_to_secure;
 
     /* We can only get here from an EXCP_EXCEPTION_EXIT, and
      * gen_bx_excret() enforces the architectural rule
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         g_assert_not_reached();
     }
 
+    return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
+        (excret & R_V7M_EXCRET_S_MASK);
+
     switch (excret & 0xf) {
     case 1: /* Return to Handler */
         return_to_handler = true;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         return;
     }
 
-    /* Switch to the target stack.  */
+    /* Set CONTROL.SPSEL from excret.SPSEL. For QEMU this currently
+     * causes us to switch the active SP, but we will change this
+     * later to not do that so we can support v8M.
+     */
     switch_v7m_sp(env, return_to_sp_process);
-    /* Pop registers.  */
-    env->regs[0] = v7m_pop(env);
-    env->regs[1] = v7m_pop(env);
-    env->regs[2] = v7m_pop(env);
-    env->regs[3] = v7m_pop(env);
-    env->regs[12] = v7m_pop(env);
-    env->regs[14] = v7m_pop(env);
-    env->regs[15] = v7m_pop(env);
-    if (env->regs[15] & 1) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "M profile return from interrupt with misaligned "
-                      "PC is UNPREDICTABLE\n");
-        /* Actual hardware seems to ignore the lsbit, and there are several
-         * RTOSes out there which incorrectly assume the r15 in the stack
-         * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
+
+    {
+        /* The stack pointer we should be reading the exception frame from
+         * depends on bits in the magic exception return type value (and
+         * for v8M isn't necessarily the stack pointer we will eventually
+         * end up resuming execution with). Get a pointer to the location
+         * in the CPU state struct where the SP we need is currently being
+         * stored; we will use and modify it in place.
+         * We use this limited C variable scope so we don't accidentally
+         * use 'frame_sp_p' after we do something that makes it invalid.
+         */
+        uint32_t *frame_sp_p = get_v7m_sp_ptr(env,
+                                              return_to_secure,
+                                              !return_to_handler,
+                                              return_to_sp_process);
+        uint32_t frameptr = *frame_sp_p;
+
+        /* Pop registers. TODO: make these accesses use the correct
+         * attributes and address space (S/NS, priv/unpriv) and handle
+         * memory transaction failures.
          */
-        env->regs[15] &= ~1U;
+        env->regs[0] = ldl_phys(cs->as, frameptr);
+        env->regs[1] = ldl_phys(cs->as, frameptr + 0x4);
+        env->regs[2] = ldl_phys(cs->as, frameptr + 0x8);
+        env->regs[3] = ldl_phys(cs->as, frameptr + 0xc);
+        env->regs[12] = ldl_phys(cs->as, frameptr + 0x10);
+        env->regs[14] = ldl_phys(cs->as, frameptr + 0x14);
+        env->regs[15] = ldl_phys(cs->as, frameptr + 0x18);
+        if (env->regs[15] & 1) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "M profile return from interrupt with misaligned "
+                          "PC is UNPREDICTABLE\n");
+            /* Actual hardware seems to ignore the lsbit, and there are several
+             * RTOSes out there which incorrectly assume the r15 in the stack
+             * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
+             */
+            env->regs[15] &= ~1U;
+        }
+        xpsr = ldl_phys(cs->as, frameptr + 0x1c);
+
+        /* Commit to consuming the stack frame */
+        frameptr += 0x20;
+        /* Undo stack alignment (the SPREALIGN bit indicates that the original
+         * pre-exception SP was not 8-aligned and we added a padding word to
+         * align it, so we undo this by ORing in the bit that increases it
+         * from the current 8-aligned value to the 8-unaligned value. (Adding 4
+         * would work too but a logical OR is how the pseudocode specifies it.)
+         */
+        if (xpsr & XPSR_SPREALIGN) {
+            frameptr |= 4;
+        }
+        *frame_sp_p = frameptr;
     }
-    xpsr = v7m_pop(env);
+    /* This xpsr_write() will invalidate frame_sp_p as it may switch stack */
     xpsr_write(env, xpsr, ~XPSR_SPREALIGN);
-    /* Undo stack alignment.  */
-    if (xpsr & XPSR_SPREALIGN) {
-        env->regs[13] |= 4;
-    }
 
     /* The restored xPSR exception field will be zero if we're
      * resuming in Thread mode. If that doesn't match what the
-- 
2.7.4

In the v7M architecture, there is an invariant that if the CPU is
in Handler mode then the CONTROL.SPSEL bit cannot be nonzero.
This in turn means that the current stack pointer is always
indicated by CONTROL.SPSEL, even though Handler mode always uses
the Main stack pointer.

In v8M, this invariant is removed, and CONTROL.SPSEL may now
be nonzero in Handler mode (though Handler mode still always
uses the Main stack pointer). In preparation for this change,
change how we handle this bit: rename switch_v7m_sp() to
the now more accurate write_v7m_control_spsel(), and make it
check both the handler mode state and the SPSEL bit.

Note that this implicitly changes the point at which we switch
active SP on exception exit from before we pop the exception
frame to after it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-4-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h      |  8 ++++++-
 hw/intc/armv7m_nvic.c |  2 +-
 target/arm/helper.c   | 65 ++++++++++++++++++++++++++++++++++-----------------
 3 files changed, 51 insertions(+), 24 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void pmccntr_sync(CPUARMState *env);
 #define PSTATE_MODE_EL1t 4
 #define PSTATE_MODE_EL0t 0
 
+/* Write a new value to v7m.exception, thus transitioning into or out
+ * of Handler mode; this may result in a change of active stack pointer.
+ */
+void write_v7m_exception(CPUARMState *env, uint32_t new_exc);
+
 /* Map EL and handler into a PSTATE_MODE.  */
 static inline unsigned int aarch64_pstate_mode(unsigned int el, bool handler)
 {
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
         env->condexec_bits |= (val >> 8) & 0xfc;
     }
     if (mask & XPSR_EXCP) {
-        env->v7m.exception = val & XPSR_EXCP;
+        /* Note that this only happens on exception exit */
+        write_v7m_exception(env, val & XPSR_EXCP);
     }
 }
 
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_acknowledge_irq(void *opaque)
     vec->active = 1;
     vec->pending = 0;
 
-    env->v7m.exception = s->vectpending;
+    write_v7m_exception(env, s->vectpending);
 
     nvic_irq_update(s);
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool v7m_using_psp(CPUARMState *env)
         env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK;
 }
 
-/* Switch to V7M main or process stack pointer.  */
-static void switch_v7m_sp(CPUARMState *env, bool new_spsel)
+/* Write to v7M CONTROL.SPSEL bit. This may change the current
+ * stack pointer between Main and Process stack pointers.
+ */
+static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
 {
     uint32_t tmp;
-    uint32_t old_control = env->v7m.control[env->v7m.secure];
-    bool old_spsel = old_control & R_V7M_CONTROL_SPSEL_MASK;
+    bool new_is_psp, old_is_psp = v7m_using_psp(env);
+
+    env->v7m.control[env->v7m.secure] =
+        deposit32(env->v7m.control[env->v7m.secure],
+                  R_V7M_CONTROL_SPSEL_SHIFT,
+                  R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
+
+    new_is_psp = v7m_using_psp(env);
 
-    if (old_spsel != new_spsel) {
+    if (old_is_psp != new_is_psp) {
         tmp = env->v7m.other_sp;
         env->v7m.other_sp = env->regs[13];
         env->regs[13] = tmp;
+    }
+}
+
+void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
+{
+    /* Write a new value to v7m.exception, thus transitioning into or out
+     * of Handler mode; this may result in a change of active stack pointer.
+     */
+    bool new_is_psp, old_is_psp = v7m_using_psp(env);
+    uint32_t tmp;
 
-        env->v7m.control[env->v7m.secure] = deposit32(old_control,
-                                     R_V7M_CONTROL_SPSEL_SHIFT,
-                                     R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
+    env->v7m.exception = new_exc;
+
+    new_is_psp = v7m_using_psp(env);
+
+    if (old_is_psp != new_is_psp) {
+        tmp = env->v7m.other_sp;
+        env->v7m.other_sp = env->regs[13];
+        env->regs[13] = tmp;
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
     bool want_psp = threadmode && spsel;
 
     if (secure == env->v7m.secure) {
-        /* Currently switch_v7m_sp switches SP as it updates SPSEL,
-         * so the SP we want is always in regs[13].
-         * When we decouple SPSEL from the actually selected SP
-         * we need to check want_psp against v7m_using_psp()
-         * to see whether we need regs[13] or v7m.other_sp.
-         */
-        return &env->regs[13];
+        if (want_psp == v7m_using_psp(env)) {
+            return &env->regs[13];
+        } else {
+            return &env->v7m.other_sp;
+        }
     } else {
         if (want_psp) {
             return &env->v7m.other_ss_psp;
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
     uint32_t addr;
 
     armv7m_nvic_acknowledge_irq(env->nvic);
-    switch_v7m_sp(env, 0);
+    write_v7m_control_spsel(env, 0);
     arm_clear_exclusive(env);
     /* Clear IT bits */
     env->condexec_bits = 0;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         return;
     }
 
-    /* Set CONTROL.SPSEL from excret.SPSEL. For QEMU this currently
-     * causes us to switch the active SP, but we will change this
-     * later to not do that so we can support v8M.
+    /* Set CONTROL.SPSEL from excret.SPSEL. Since we're still in
+     * Handler mode (and will be until we write the new XPSR.Interrupt
+     * field) this does not switch around the current stack pointer.
      */
-    switch_v7m_sp(env, return_to_sp_process);
+    write_v7m_control_spsel(env, return_to_sp_process);
 
     {
         /* The stack pointer we should be reading the exception frame from
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
     case 20: /* CONTROL */
         /* Writing to the SPSEL bit only has an effect if we are in
          * thread mode; other bits can be updated by any privileged code.
-         * switch_v7m_sp() deals with updating the SPSEL bit in
+         * write_v7m_control_spsel() deals with updating the SPSEL bit in
          * env->v7m.control, so we only need update the others.
          */
         if (!arm_v7m_is_handler_mode(env)) {
-            switch_v7m_sp(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
+            write_v7m_control_spsel(env, (val & R_V7M_CONTROL_SPSEL_MASK) != 0);
         }
         env->v7m.control[env->v7m.secure] &= ~R_V7M_CONTROL_NPRIV_MASK;
         env->v7m.control[env->v7m.secure] |= val & R_V7M_CONTROL_NPRIV_MASK;
-- 
2.7.4

Now that we can handle the CONTROL.SPSEL bit not necessarily being
in sync with the current stack pointer, we can restore the correct
security state on exception return. This happens before we start
to read registers off the stack frame, but after we have taken
possible usage faults for bad exception return magic values and
updated CONTROL.SPSEL.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-5-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      */
     write_v7m_control_spsel(env, return_to_sp_process);
 
+    switch_v7m_security_state(env, return_to_secure);
+
     {
         /* The stack pointer we should be reading the exception frame from
          * depends on bits in the magic exception return type value (and
-- 
2.7.4

On exception return for v8M, the SPSEL bit in the EXC_RETURN magic
value should be restored to the SPSEL bit in the CONTROL register
banked specified by the EXC_RETURN.ES bit.

Add write_v7m_control_spsel_for_secstate() which behaves like
write_v7m_control_spsel() but allows the caller to specify which
CONTROL bank to use, reimplement write_v7m_control_spsel() in
terms of it, and use it in exception return.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-6-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 40 +++++++++++++++++++++++++++-------------
 1 file changed, 27 insertions(+), 13 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool v7m_using_psp(CPUARMState *env)
         env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK;
 }
 
-/* Write to v7M CONTROL.SPSEL bit. This may change the current
- * stack pointer between Main and Process stack pointers.
+/* Write to v7M CONTROL.SPSEL bit for the specified security bank.
+ * This may change the current stack pointer between Main and Process
+ * stack pointers if it is done for the CONTROL register for the current
+ * security state.
  */
-static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
+static void write_v7m_control_spsel_for_secstate(CPUARMState *env,
+                                                 bool new_spsel,
+                                                 bool secstate)
 {
-    uint32_t tmp;
-    bool new_is_psp, old_is_psp = v7m_using_psp(env);
+    bool old_is_psp = v7m_using_psp(env);
 
-    env->v7m.control[env->v7m.secure] =
-        deposit32(env->v7m.control[env->v7m.secure],
+    env->v7m.control[secstate] =
+        deposit32(env->v7m.control[secstate],
                   R_V7M_CONTROL_SPSEL_SHIFT,
                   R_V7M_CONTROL_SPSEL_LENGTH, new_spsel);
 
-    new_is_psp = v7m_using_psp(env);
+    if (secstate == env->v7m.secure) {
+        bool new_is_psp = v7m_using_psp(env);
+        uint32_t tmp;
 
-    if (old_is_psp != new_is_psp) {
-        tmp = env->v7m.other_sp;
-        env->v7m.other_sp = env->regs[13];
-        env->regs[13] = tmp;
+        if (old_is_psp != new_is_psp) {
+            tmp = env->v7m.other_sp;
+            env->v7m.other_sp = env->regs[13];
+            env->regs[13] = tmp;
+        }
     }
 }
 
+/* Write to v7M CONTROL.SPSEL bit. This may change the current
+ * stack pointer between Main and Process stack pointers.
+ */
+static void write_v7m_control_spsel(CPUARMState *env, bool new_spsel)
+{
+    write_v7m_control_spsel_for_secstate(env, new_spsel, env->v7m.secure);
+}
+
 void write_v7m_exception(CPUARMState *env, uint32_t new_exc)
 {
     /* Write a new value to v7m.exception, thus transitioning into or out
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
      * Handler mode (and will be until we write the new XPSR.Interrupt
      * field) this does not switch around the current stack pointer.
      */
-    write_v7m_control_spsel(env, return_to_sp_process);
+    write_v7m_control_spsel_for_secstate(env, return_to_sp_process, exc_secure);
 
     switch_v7m_security_state(env, return_to_secure);
 
-- 
2.7.4

ARM v8M specifies that the INVPC usage fault for mismatched
xPSR exception field and handler mode bit should be checked
before updating the PSR and SP, so that the fault is taken
with the existing stack frame rather than by pushing a new one.
Perform this check in the right place for v8M.

Since v7M specifies in its pseudocode that this usage fault
check should happen later, we have to retain the original
code for that check rather than being able to merge the two.
(The distinction is architecturally visible but only in
very obscure corner cases like attempting an invalid exception
return with an exception frame in read only memory.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-7-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 30 +++++++++++++++++++++++++++---
 1 file changed, 27 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         }
         xpsr = ldl_phys(cs->as, frameptr + 0x1c);
 
+        if (arm_feature(env, ARM_FEATURE_V8)) {
+            /* For v8M we have to check whether the xPSR exception field
+             * matches the EXCRET value for return to handler/thread
+             * before we commit to changing the SP and xPSR.
+             */
+            bool will_be_handler = (xpsr & XPSR_EXCP) != 0;
+            if (return_to_handler != will_be_handler) {
+                /* Take an INVPC UsageFault on the current stack.
+                 * By this point we will have switched to the security state
+                 * for the background state, so this UsageFault will target
+                 * that state.
+                 */
+                armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                        env->v7m.secure);
+                env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
+                v7m_exception_taken(cpu, excret);
+                qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+                              "stackframe: failed exception return integrity "
+                              "check\n");
+                return;
+            }
+        }
+
         /* Commit to consuming the stack frame */
         frameptr += 0x20;
         /* Undo stack alignment (the SPREALIGN bit indicates that the original
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     /* The restored xPSR exception field will be zero if we're
      * resuming in Thread mode. If that doesn't match what the
      * exception return excret specified then this is a UsageFault.
+     * v7M requires we make this check here; v8M did it earlier.
      */
     if (return_to_handler != arm_v7m_is_handler_mode(env)) {
-        /* Take an INVPC UsageFault by pushing the stack again.
-         * TODO: the v8M version of this code should target the
-         * background state for this exception.
+        /* Take an INVPC UsageFault by pushing the stack again;
+         * we know we're v7M so this is never a Secure UsageFault.
          */
+        assert(!arm_feature(env, ARM_FEATURE_V8));
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-- 
2.7.4

Attempting to do an exception return with an exception frame that
is not 8-aligned is UNPREDICTABLE in v8M; warn about this.
(It is not UNPREDICTABLE in v7M, and our implementation can
handle the merely-4-aligned case fine, so we don't need to
do anything except warn.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-8-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                                               return_to_sp_process);
         uint32_t frameptr = *frame_sp_p;
 
+        if (!QEMU_IS_ALIGNED(frameptr, 8) &&
+            arm_feature(env, ARM_FEATURE_V8)) {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "M profile exception return with non-8-aligned SP "
+                          "for destination state is UNPREDICTABLE\n");
+        }
+
         /* Pop registers. TODO: make these accesses use the correct
          * attributes and address space (S/NS, priv/unpriv) and handle
          * memory transaction failures.
-- 
2.7.4

In the v8M architecture, return from an exception to a PC which
has bit 0 set is not UNPREDICTABLE; it is defined that bit 0
is discarded [R_HRJH]. Restrict our complaint about this to v7M.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-9-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 22 +++++++++++++++-------
 1 file changed, 15 insertions(+), 7 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         env->regs[12] = ldl_phys(cs->as, frameptr + 0x10);
         env->regs[14] = ldl_phys(cs->as, frameptr + 0x14);
         env->regs[15] = ldl_phys(cs->as, frameptr + 0x18);
+
+        /* Returning from an exception with a PC with bit 0 set is defined
+         * behaviour on v8M (bit 0 is ignored), but for v7M it was specified
+         * to be UNPREDICTABLE. In practice actual v7M hardware seems to ignore
+         * the lsbit, and there are several RTOSes out there which incorrectly
+         * assume the r15 in the stack frame should be a Thumb-style "lsbit
+         * indicates ARM/Thumb" value, so ignore the bit on v7M as well, but
+         * complain about the badly behaved guest.
+         */
         if (env->regs[15] & 1) {
-            qemu_log_mask(LOG_GUEST_ERROR,
-                          "M profile return from interrupt with misaligned "
-                          "PC is UNPREDICTABLE\n");
-            /* Actual hardware seems to ignore the lsbit, and there are several
-             * RTOSes out there which incorrectly assume the r15 in the stack
-             * frame should be a Thumb-style "lsbit indicates ARM/Thumb" value.
-             */
             env->regs[15] &= ~1U;
+            if (!arm_feature(env, ARM_FEATURE_V8)) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "M profile return from interrupt with misaligned "
+                              "PC is UNPREDICTABLE on v7M\n");
+            }
         }
+
         xpsr = ldl_phys(cs->as, frameptr + 0x1c);
 
         if (arm_feature(env, ARM_FEATURE_V8)) {
-- 
2.7.4

Add the new M profile Secure Fault Status Register
and Secure Fault Address Register.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-10-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h      | 12 ++++++++++++
 hw/intc/armv7m_nvic.c | 34 ++++++++++++++++++++++++++++++++++
 target/arm/machine.c  |  2 ++
 3 files changed, 48 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t cfsr[M_REG_NUM_BANKS]; /* Configurable Fault Status */
         uint32_t hfsr; /* HardFault Status */
         uint32_t dfsr; /* Debug Fault Status Register */
+        uint32_t sfsr; /* Secure Fault Status Register */
         uint32_t mmfar[M_REG_NUM_BANKS]; /* MemManage Fault Address */
         uint32_t bfar; /* BusFault Address */
+        uint32_t sfar; /* Secure Fault Address Register */
         unsigned mpu_ctrl[M_REG_NUM_BANKS]; /* MPU_CTRL */
         int exception;
         uint32_t primask[M_REG_NUM_BANKS];
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_DFSR, DWTTRAP, 2, 1)
 FIELD(V7M_DFSR, VCATCH, 3, 1)
 FIELD(V7M_DFSR, EXTERNAL, 4, 1)
 
+/* V7M SFSR bits */
+FIELD(V7M_SFSR, INVEP, 0, 1)
+FIELD(V7M_SFSR, INVIS, 1, 1)
+FIELD(V7M_SFSR, INVER, 2, 1)
+FIELD(V7M_SFSR, AUVIOL, 3, 1)
+FIELD(V7M_SFSR, INVTRAN, 4, 1)
+FIELD(V7M_SFSR, LSPERR, 5, 1)
+FIELD(V7M_SFSR, SFARVALID, 6, 1)
+FIELD(V7M_SFSR, LSERR, 7, 1)
+
 /* v7M MPU_CTRL bits */
 FIELD(V7M_MPU_CTRL, ENABLE, 0, 1)
 FIELD(V7M_MPU_CTRL, HFNMIENA, 1, 1)
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
             goto bad_offset;
         }
         return cpu->env.pmsav8.mair1[attrs.secure];
+    case 0xde4: /* SFSR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        return cpu->env.v7m.sfsr;
+    case 0xde8: /* SFAR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        return cpu->env.v7m.sfar;
     default:
     bad_offset:
         qemu_log_mask(LOG_GUEST_ERROR, "NVIC: Bad read offset 0x%x\n", offset);
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
          * only affect cacheability, and we don't implement caching.
          */
         break;
+    case 0xde4: /* SFSR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        cpu->env.v7m.sfsr &= ~value; /* W1C */
+        break;
+    case 0xde8: /* SFAR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        cpu->env.v7m.sfsr = value;
+        break;
     case 0xf00: /* Software Triggered Interrupt Register */
     {
         int excnum = (value & 0x1ff) + NVIC_FIRST_IRQ;
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
         VMSTATE_UINT32(env.v7m.ccr[M_REG_S], ARMCPU),
         VMSTATE_UINT32(env.v7m.mmfar[M_REG_S], ARMCPU),
         VMSTATE_UINT32(env.v7m.cfsr[M_REG_S], ARMCPU),
+        VMSTATE_UINT32(env.v7m.sfsr, ARMCPU),
+        VMSTATE_UINT32(env.v7m.sfar, ARMCPU),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.7.4

In v8M, more bits are defined in the exception-return magic
values; update the code that checks these so we accept
the v8M values when the CPU permits them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-11-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 73 ++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 58 insertions(+), 15 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     uint32_t excret;
     uint32_t xpsr;
     bool ufault = false;
-    bool return_to_sp_process = false;
-    bool return_to_handler = false;
+    bool sfault = false;
+    bool return_to_sp_process;
+    bool return_to_handler;
     bool rettobase = false;
     bool exc_secure = false;
     bool return_to_secure;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                       excret);
     }
 
+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+        /* EXC_RETURN.ES validation check (R_SMFL). We must do this before
+         * we pick which FAULTMASK to clear.
+         */
+        if (!env->v7m.secure &&
+            ((excret & R_V7M_EXCRET_ES_MASK) ||
+             !(excret & R_V7M_EXCRET_DCRS_MASK))) {
+            sfault = 1;
+            /* For all other purposes, treat ES as 0 (R_HXSR) */
+            excret &= ~R_V7M_EXCRET_ES_MASK;
+        }
+    }
+
     if (env->v7m.exception != ARMV7M_EXCP_NMI) {
         /* Auto-clear FAULTMASK on return from other than NMI.
          * If the security extension is implemented then this only
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         g_assert_not_reached();
     }
 
+    return_to_handler = !(excret & R_V7M_EXCRET_MODE_MASK);
+    return_to_sp_process = excret & R_V7M_EXCRET_SPSEL_MASK;
     return_to_secure = arm_feature(env, ARM_FEATURE_M_SECURITY) &&
         (excret & R_V7M_EXCRET_S_MASK);
 
-    switch (excret & 0xf) {
-    case 1: /* Return to Handler */
-        return_to_handler = true;
-        break;
-    case 13: /* Return to Thread using Process stack */
-        return_to_sp_process = true;
-        /* fall through */
-    case 9: /* Return to Thread using Main stack */
-        if (!rettobase &&
-            !(env->v7m.ccr[env->v7m.secure] & R_V7M_CCR_NONBASETHRDENA_MASK)) {
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        if (!arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+            /* UNPREDICTABLE if S == 1 or DCRS == 0 or ES == 1 (R_XLCP);
+             * we choose to take the UsageFault.
+             */
+            if ((excret & R_V7M_EXCRET_S_MASK) ||
+                (excret & R_V7M_EXCRET_ES_MASK) ||
+                !(excret & R_V7M_EXCRET_DCRS_MASK)) {
+                ufault = true;
+            }
+        }
+        if (excret & R_V7M_EXCRET_RES0_MASK) {
             ufault = true;
         }
-        break;
-    default:
-        ufault = true;
+    } else {
+        /* For v7M we only recognize certain combinations of the low bits */
+        switch (excret & 0xf) {
+        case 1: /* Return to Handler */
+            break;
+        case 13: /* Return to Thread using Process stack */
+        case 9: /* Return to Thread using Main stack */
+            /* We only need to check NONBASETHRDENA for v7M, because in
+             * v8M this bit does not exist (it is RES1).
+             */
+            if (!rettobase &&
+                !(env->v7m.ccr[env->v7m.secure] &
+                  R_V7M_CCR_NONBASETHRDENA_MASK)) {
+                ufault = true;
+            }
+            break;
+        default:
+            ufault = true;
+        }
+    }
+
+    if (sfault) {
+        env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
+        armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
+        v7m_exception_taken(cpu, excret);
+        qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
+                      "stackframe: failed EXC_RETURN.ES validity check\n");
+        return;
     }
 
     if (ufault) {
-- 
2.7.4

For v8M, exceptions from Secure to Non-Secure state will save
callee-saved registers to the exception frame as well as the
caller-saved registers. Add support for unstacking these
registers in exception exit when necessary.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-12-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 30 ++++++++++++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                           "for destination state is UNPREDICTABLE\n");
         }
 
+        /* Do we need to pop callee-saved registers? */
+        if (return_to_secure &&
+            ((excret & R_V7M_EXCRET_ES_MASK) == 0 ||
+             (excret & R_V7M_EXCRET_DCRS_MASK) == 0)) {
+            uint32_t expected_sig = 0xfefa125b;
+            uint32_t actual_sig = ldl_phys(cs->as, frameptr);
+
+            if (expected_sig != actual_sig) {
+                /* Take a SecureFault on the current stack */
+                env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
+                armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
+                v7m_exception_taken(cpu, excret);
+                qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
+                              "stackframe: failed exception return integrity "
+                              "signature check\n");
+                return;
+            }
+
+            env->regs[4] = ldl_phys(cs->as, frameptr + 0x8);
+            env->regs[5] = ldl_phys(cs->as, frameptr + 0xc);
+            env->regs[6] = ldl_phys(cs->as, frameptr + 0x10);
+            env->regs[7] = ldl_phys(cs->as, frameptr + 0x14);
+            env->regs[8] = ldl_phys(cs->as, frameptr + 0x18);
+            env->regs[9] = ldl_phys(cs->as, frameptr + 0x1c);
+            env->regs[10] = ldl_phys(cs->as, frameptr + 0x20);
+            env->regs[11] = ldl_phys(cs->as, frameptr + 0x24);
+
+            frameptr += 0x28;
+        }
+
         /* Pop registers. TODO: make these accesses use the correct
          * attributes and address space (S/NS, priv/unpriv) and handle
          * memory transaction failures.
-- 
2.7.4

Add support for v8M and in particular the security extension
to the exception entry code. This requires changes to:
 * calculation of the exception-return magic LR value
 * push the callee-saves registers in certain cases
 * clear registers when taking non-secure exceptions to avoid
   leaking information from the interrupted secure code
 * switch to the correct security state on entry
 * use the vector table for the security state we're targeting

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-13-git-send-email-peter.maydell@linaro.org
---
 target/arm/helper.c | 165 +++++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 145 insertions(+), 20 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t *get_v7m_sp_ptr(CPUARMState *env, bool secure, bool threadmode,
     }
 }
 
-static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
+static uint32_t arm_v7m_load_vector(ARMCPU *cpu, bool targets_secure)
 {
     CPUState *cs = CPU(cpu);
     CPUARMState *env = &cpu->env;
     MemTxResult result;
-    hwaddr vec = env->v7m.vecbase[env->v7m.secure] + env->v7m.exception * 4;
+    hwaddr vec = env->v7m.vecbase[targets_secure] + env->v7m.exception * 4;
     uint32_t addr;
 
     addr = address_space_ldl(cs->as, vec,
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_v7m_load_vector(ARMCPU *cpu)
          * Since we don't model Lockup, we just report this guest error
          * via cpu_abort().
          */
-        cpu_abort(cs, "Failed to read from exception vector table "
-                  "entry %08x\n", (unsigned)vec);
+        cpu_abort(cs, "Failed to read from %s exception vector table "
+                  "entry %08x\n", targets_secure ? "secure" : "nonsecure",
+                  (unsigned)vec);
     }
     return addr;
 }
 
-static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
+static void v7m_push_callee_stack(ARMCPU *cpu, uint32_t lr, bool dotailchain)
+{
+    /* For v8M, push the callee-saves register part of the stack frame.
+     * Compare the v8M pseudocode PushCalleeStack().
+     * In the tailchaining case this may not be the current stack.
+     */
+    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+    uint32_t *frame_sp_p;
+    uint32_t frameptr;
+
+    if (dotailchain) {
+        frame_sp_p = get_v7m_sp_ptr(env, true,
+                                    lr & R_V7M_EXCRET_MODE_MASK,
+                                    lr & R_V7M_EXCRET_SPSEL_MASK);
+    } else {
+        frame_sp_p = &env->regs[13];
+    }
+
+    frameptr = *frame_sp_p - 0x28;
+
+    stl_phys(cs->as, frameptr, 0xfefa125b);
+    stl_phys(cs->as, frameptr + 0x8, env->regs[4]);
+    stl_phys(cs->as, frameptr + 0xc, env->regs[5]);
+    stl_phys(cs->as, frameptr + 0x10, env->regs[6]);
+    stl_phys(cs->as, frameptr + 0x14, env->regs[7]);
+    stl_phys(cs->as, frameptr + 0x18, env->regs[8]);
+    stl_phys(cs->as, frameptr + 0x1c, env->regs[9]);
+    stl_phys(cs->as, frameptr + 0x20, env->regs[10]);
+    stl_phys(cs->as, frameptr + 0x24, env->regs[11]);
+
+    *frame_sp_p = frameptr;
+}
+
+static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr, bool dotailchain)
 {
     /* Do the "take the exception" parts of exception entry,
      * but not the pushing of state to the stack. This is
@@ -XXX,XX +XXX,XX @@ static void v7m_exception_taken(ARMCPU *cpu, uint32_t lr)
      */
     CPUARMState *env = &cpu->env;
     uint32_t addr;
+    bool targets_secure;
+
+    targets_secure = armv7m_nvic_acknowledge_irq(env->nvic);
 
-    armv7m_nvic_acknowledge_irq(env->nvic);
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        if (arm_feature(env, ARM_FEATURE_M_SECURITY) &&
+            (lr & R_V7M_EXCRET_S_MASK)) {
+            /* The background code (the owner of the registers in the
+             * exception frame) is Secure. This means it may either already
+             * have or now needs to push callee-saves registers.
+             */
+            if (targets_secure) {
+                if (dotailchain && !(lr & R_V7M_EXCRET_ES_MASK)) {
+                    /* We took an exception from Secure to NonSecure
+                     * (which means the callee-saved registers got stacked)
+                     * and are now tailchaining to a Secure exception.
+                     * Clear DCRS so eventual return from this Secure
+                     * exception unstacks the callee-saved registers.
+                     */
+                    lr &= ~R_V7M_EXCRET_DCRS_MASK;
+                }
+            } else {
+                /* We're going to a non-secure exception; push the
+                 * callee-saves registers to the stack now, if they're
+                 * not already saved.
+                 */
+                if (lr & R_V7M_EXCRET_DCRS_MASK &&
+                    !(dotailchain && (lr & R_V7M_EXCRET_ES_MASK))) {
+                    v7m_push_callee_stack(cpu, lr, dotailchain);
+                }
+                lr |= R_V7M_EXCRET_DCRS_MASK;
+            }
+        }
+
+        lr &= ~R_V7M_EXCRET_ES_MASK;
+        if (targets_secure || !arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+            lr |= R_V7M_EXCRET_ES_MASK;
+        }
+        lr &= ~R_V7M_EXCRET_SPSEL_MASK;
+        if (env->v7m.control[targets_secure] & R_V7M_CONTROL_SPSEL_MASK) {
+            lr |= R_V7M_EXCRET_SPSEL_MASK;
+        }
+
+        /* Clear registers if necessary to prevent non-secure exception
+         * code being able to see register values from secure code.
+         * Where register values become architecturally UNKNOWN we leave
+         * them with their previous values.
+         */
+        if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+            if (!targets_secure) {
+                /* Always clear the caller-saved registers (they have been
+                 * pushed to the stack earlier in v7m_push_stack()).
+                 * Clear callee-saved registers if the background code is
+                 * Secure (in which case these regs were saved in
+                 * v7m_push_callee_stack()).
+                 */
+                int i;
+
+                for (i = 0; i < 13; i++) {
+                    /* r4..r11 are callee-saves, zero only if EXCRET.S == 1 */
+                    if (i < 4 || i > 11 || (lr & R_V7M_EXCRET_S_MASK)) {
+                        env->regs[i] = 0;
+                    }
+                }
+                /* Clear EAPSR */
+                xpsr_write(env, 0, XPSR_NZCV | XPSR_Q | XPSR_GE | XPSR_IT);
+            }
+        }
+    }
+
+    /* Switch to target security state -- must do this before writing SPSEL */
+    switch_v7m_security_state(env, targets_secure);
     write_v7m_control_spsel(env, 0);
     arm_clear_exclusive(env);
     /* Clear IT bits */
     env->condexec_bits = 0;
     env->regs[14] = lr;
-    addr = arm_v7m_load_vector(cpu);
+    addr = arm_v7m_load_vector(cpu, targets_secure);
     env->regs[15] = addr & 0xfffffffe;
     env->thumb = addr & 1;
 }
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     if (sfault) {
         env->v7m.sfsr |= R_V7M_SFSR_INVER_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
-        v7m_exception_taken(cpu, excret);
+        v7m_exception_taken(cpu, excret, true);
         qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
                       "stackframe: failed EXC_RETURN.ES validity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
          */
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
-        v7m_exception_taken(cpu, excret);
+        v7m_exception_taken(cpu, excret, true);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                       "stackframe: failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                 /* Take a SecureFault on the current stack */
                 env->v7m.sfsr |= R_V7M_SFSR_INVIS_MASK;
                 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
-                v7m_exception_taken(cpu, excret);
+                v7m_exception_taken(cpu, excret, true);
                 qemu_log_mask(CPU_LOG_INT, "...taking SecureFault on existing "
                               "stackframe: failed exception return integrity "
                               "signature check\n");
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                 armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
                                         env->v7m.secure);
                 env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
-                v7m_exception_taken(cpu, excret);
+                v7m_exception_taken(cpu, excret, true);
                 qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                               "stackframe: failed exception return integrity "
                               "check\n");
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, false);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_INVPC_MASK;
         v7m_push_stack(cpu);
-        v7m_exception_taken(cpu, excret);
+        v7m_exception_taken(cpu, excret, false);
         qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on new stackframe: "
                       "failed exception return integrity check\n");
         return;
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         return; /* Never happens.  Keep compiler happy.  */
     }
 
-    lr = R_V7M_EXCRET_RES1_MASK |
-        R_V7M_EXCRET_S_MASK |
-        R_V7M_EXCRET_DCRS_MASK |
-        R_V7M_EXCRET_FTYPE_MASK |
-        R_V7M_EXCRET_ES_MASK;
-    if (env->v7m.control[env->v7m.secure] & R_V7M_CONTROL_SPSEL_MASK) {
-        lr |= R_V7M_EXCRET_SPSEL_MASK;
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        lr = R_V7M_EXCRET_RES1_MASK |
+            R_V7M_EXCRET_DCRS_MASK |
+            R_V7M_EXCRET_FTYPE_MASK;
+        /* The S bit indicates whether we should return to Secure
+         * or NonSecure (ie our current state).
+         * The ES bit indicates whether we're taking this exception
+         * to Secure or NonSecure (ie our target state). We set it
+         * later, in v7m_exception_taken().
+         * The SPSEL bit is also set in v7m_exception_taken() for v8M.
+         * This corresponds to the ARM ARM pseudocode for v8M setting
+         * some LR bits in PushStack() and some in ExceptionTaken();
+         * the distinction matters for the tailchain cases where we
+         * can take an exception without pushing the stack.
+         */
+        if (env->v7m.secure) {
+            lr |= R_V7M_EXCRET_S_MASK;
+        }
+    } else {
+        lr = R_V7M_EXCRET_RES1_MASK |
+            R_V7M_EXCRET_S_MASK |
+            R_V7M_EXCRET_DCRS_MASK |
+            R_V7M_EXCRET_FTYPE_MASK |
+            R_V7M_EXCRET_ES_MASK;
+        if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
+            lr |= R_V7M_EXCRET_SPSEL_MASK;
+        }
     }
     if (!arm_v7m_is_handler_mode(env)) {
         lr |= R_V7M_EXCRET_MODE_MASK;
     }
 
     v7m_push_stack(cpu);
-    v7m_exception_taken(cpu, lr);
+    v7m_exception_taken(cpu, lr, false);
     qemu_log_mask(CPU_LOG_INT, "... as %d\n", env->v7m.exception);
 }
 
-- 
2.7.4

Implement the register interface for the SAU: SAU_CTRL,
SAU_TYPE, SAU_RNR, SAU_RBAR and SAU_RLAR. None of the
actual behaviour is implemented here; registers just
read back as written.

When the CPU definition for Cortex-M33 is eventually
added, its initfn will set cpu->sau_sregion, in the same
way that we currently set cpu->pmsav7_dregion for the
M3 and M4.

Number of SAU regions is typically a configurable
CPU parameter, but this patch doesn't provide a
QEMU CPU property for it. We can easily add one when
we have a board that requires it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-14-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h      |  10 +++++
 hw/intc/armv7m_nvic.c | 116 ++++++++++++++++++++++++++++++++++++++++++++++++++
 target/arm/cpu.c      |  27 ++++++++++++
 target/arm/machine.c  |  14 ++++++
 4 files changed, 167 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint32_t mair1[M_REG_NUM_BANKS];
     } pmsav8;
 
+    /* v8M SAU */
+    struct {
+        uint32_t *rbar;
+        uint32_t *rlar;
+        uint32_t rnr;
+        uint32_t ctrl;
+    } sau;
+
     void *nvic;
     const struct arm_boot_info *boot_info;
     /* Store GICv3CPUState to access from this struct */
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool has_mpu;
     /* PMSAv7 MPU number of supported regions */
     uint32_t pmsav7_dregion;
+    /* v8M SAU number of supported regions */
+    uint32_t sau_sregion;
 
     /* PSCI conduit used to invoke PSCI methods
      * 0 - disabled, 1 - smc, 2 - hvc
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
             goto bad_offset;
         }
         return cpu->env.pmsav8.mair1[attrs.secure];
+    case 0xdd0: /* SAU_CTRL */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        return cpu->env.sau.ctrl;
+    case 0xdd4: /* SAU_TYPE */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        return cpu->sau_sregion;
+    case 0xdd8: /* SAU_RNR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        return cpu->env.sau.rnr;
+    case 0xddc: /* SAU_RBAR */
+    {
+        int region = cpu->env.sau.rnr;
+
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        if (region >= cpu->sau_sregion) {
+            return 0;
+        }
+        return cpu->env.sau.rbar[region];
+    }
+    case 0xde0: /* SAU_RLAR */
+    {
+        int region = cpu->env.sau.rnr;
+
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return 0;
+        }
+        if (region >= cpu->sau_sregion) {
+            return 0;
+        }
+        return cpu->env.sau.rlar[region];
+    }
     case 0xde4: /* SFSR */
         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
             goto bad_offset;
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
          * only affect cacheability, and we don't implement caching.
          */
         break;
+    case 0xdd0: /* SAU_CTRL */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        cpu->env.sau.ctrl = value & 3;
+    case 0xdd4: /* SAU_TYPE */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        break;
+    case 0xdd8: /* SAU_RNR */
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        if (value >= cpu->sau_sregion) {
+            qemu_log_mask(LOG_GUEST_ERROR, "SAU region out of range %"
+                          PRIu32 "/%" PRIu32 "\n",
+                          value, cpu->sau_sregion);
+        } else {
+            cpu->env.sau.rnr = value;
+        }
+        break;
+    case 0xddc: /* SAU_RBAR */
+    {
+        int region = cpu->env.sau.rnr;
+
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        if (region >= cpu->sau_sregion) {
+            return;
+        }
+        cpu->env.sau.rbar[region] = value & ~0x1f;
+        tlb_flush(CPU(cpu));
+        break;
+    }
+    case 0xde0: /* SAU_RLAR */
+    {
+        int region = cpu->env.sau.rnr;
+
+        if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
+            goto bad_offset;
+        }
+        if (!attrs.secure) {
+            return;
+        }
+        if (region >= cpu->sau_sregion) {
+            return;
+        }
+        cpu->env.sau.rlar[region] = value & ~0x1c;
+        tlb_flush(CPU(cpu));
+        break;
+    }
     case 0xde4: /* SFSR */
         if (!arm_feature(&cpu->env, ARM_FEATURE_V8)) {
             goto bad_offset;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
         env->pmsav8.mair1[M_REG_S] = 0;
     }
 
+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+        if (cpu->sau_sregion > 0) {
+            memset(env->sau.rbar, 0, sizeof(*env->sau.rbar) * cpu->sau_sregion);
+            memset(env->sau.rlar, 0, sizeof(*env->sau.rlar) * cpu->sau_sregion);
+        }
+        env->sau.rnr = 0;
+        /* SAU_CTRL reset value is IMPDEF; we choose 0, which is what
+         * the Cortex-M33 does.
+         */
+        env->sau.ctrl = 0;
+    }
+
     set_flush_to_zero(1, &env->vfp.standard_fp_status);
     set_flush_inputs_to_zero(1, &env->vfp.standard_fp_status);
     set_default_nan_mode(1, &env->vfp.standard_fp_status);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         }
     }
 
+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+        uint32_t nr = cpu->sau_sregion;
+
+        if (nr > 0xff) {
+            error_setg(errp, "v8M SAU #regions invalid %" PRIu32, nr);
+            return;
+        }
+
+        if (nr) {
+            env->sau.rbar = g_new0(uint32_t, nr);
+            env->sau.rlar = g_new0(uint32_t, nr);
+        }
+    }
+
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         set_feature(env, ARM_FEATURE_VBAR);
     }
@@ -XXX,XX +XXX,XX @@ static void cortex_m4_initfn(Object *obj)
     cpu->midr = 0x410fc240; /* r0p0 */
     cpu->pmsav7_dregion = 8;
 }
+
 static void arm_v7m_class_init(ObjectClass *oc, void *data)
 {
     CPUClass *cc = CPU_CLASS(oc);
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static bool s_rnr_vmstate_validate(void *opaque, int version_id)
     return cpu->env.pmsav7.rnr[M_REG_S] < cpu->pmsav7_dregion;
 }
 
+static bool sau_rnr_vmstate_validate(void *opaque, int version_id)
+{
+    ARMCPU *cpu = opaque;
+
+    return cpu->env.sau.rnr < cpu->sau_sregion;
+}
+
 static bool m_security_needed(void *opaque)
 {
     ARMCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_m_security = {
         VMSTATE_UINT32(env.v7m.cfsr[M_REG_S], ARMCPU),
         VMSTATE_UINT32(env.v7m.sfsr, ARMCPU),
         VMSTATE_UINT32(env.v7m.sfar, ARMCPU),
+        VMSTATE_VARRAY_UINT32(env.sau.rbar, ARMCPU, sau_sregion, 0,
+                              vmstate_info_uint32, uint32_t),
+        VMSTATE_VARRAY_UINT32(env.sau.rlar, ARMCPU, sau_sregion, 0,
+                              vmstate_info_uint32, uint32_t),
+        VMSTATE_UINT32(env.sau.rnr, ARMCPU),
+        VMSTATE_VALIDATE("SAU_RNR is valid", sau_rnr_vmstate_validate),
+        VMSTATE_UINT32(env.sau.ctrl, ARMCPU),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.7.4

Implement the security attribute lookups for memory accesses
in the get_phys_addr() functions, causing these to generate
various kinds of SecureFault for bad accesses.

The major subtlety in this code relates to handling of the
case when the security attributes the SAU assigns to the
address don't match the current security state of the CPU.

In the ARM ARM pseudocode for validating instruction
accesses, the security attributes of the address determine
whether the Secure or NonSecure MPU state is used. At face
value, handling this would require us to encode the relevant
bits of state into mmu_idx for both S and NS at once, which
would result in our needing 16 mmu indexes. Fortunately we
don't actually need to do this because a mismatch between
address attributes and CPU state means either:
 * some kind of fault (usually a SecureFault, but in theory
   perhaps a UserFault for unaligned access to Device memory)
 * execution of the SG instruction in NS state from a
   Secure & NonSecure code region

The purpose of SG is simply to flip the CPU into Secure
state, so we can handle it by emulating execution of that
instruction directly in arm_v7m_cpu_do_interrupt(), which
means we can treat all the mismatch cases as "throw an
exception" and we don't need to encode the state of the
other MPU bank into our mmu_idx values.

This commit doesn't include the actual emulation of SG;
it also doesn't include implementation of the IDAU, which
is a per-board way to specify hard-coded memory attributes
for addresses, which override the CPU-internal SAU if they
specify a more secure setting than the SAU is programmed to.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-15-git-send-email-peter.maydell@linaro.org
---
 target/arm/internals.h |  15 ++++
 target/arm/helper.c    | 182 ++++++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 195 insertions(+), 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ FIELD(V7M_EXCRET, DCRS, 5, 1)
 FIELD(V7M_EXCRET, S, 6, 1)
 FIELD(V7M_EXCRET, RES1, 7, 25) /* including the must-be-1 prefix */
 
+/* We use a few fake FSR values for internal purposes in M profile.
+ * M profile cores don't have A/R format FSRs, but currently our
+ * get_phys_addr() code assumes A/R profile and reports failures via
+ * an A/R format FSR value. We then translate that into the proper
+ * M profile exception and FSR status bit in arm_v7m_cpu_do_interrupt().
+ * Mostly the FSR values we use for this are those defined for v7PMSA,
+ * since we share some of that codepath. A few kinds of fault are
+ * only for M profile and have no A/R equivalent, though, so we have
+ * to pick a value from the reserved range (which we never otherwise
+ * generate) to use for these.
+ * These values will never be visible to the guest.
+ */
+#define M_FAKE_FSR_NSC_EXEC 0xf /* NS executing in S&NSC memory */
+#define M_FAKE_FSR_SFAULT 0xe /* SecureFault INVTRAN, INVEP or AUVIOL */
+
 /*
  * For AArch64, map a given EL to an index in the banked_spsr array.
  * Note that this mapping and the AArch32 mapping defined in bank_number()
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
                                target_ulong *page_size_ptr, uint32_t *fsr,
                                ARMMMUFaultInfo *fi);
 
+/* Security attributes for an address, as returned by v8m_security_lookup. */
+typedef struct V8M_SAttributes {
+    bool ns;
+    bool nsc;
+    uint8_t sregion;
+    bool srvalid;
+    uint8_t iregion;
+    bool irvalid;
+} V8M_SAttributes;
+
 /* Definitions for the PMCCNTR and PMCR registers */
 #define PMCRD   0x8
 #define PMCRC   0x4
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
          * raises the fault, in the A profile short-descriptor format.
          */
         switch (env->exception.fsr & 0xf) {
+        case M_FAKE_FSR_NSC_EXEC:
+            /* Exception generated when we try to execute code at an address
+             * which is marked as Secure & Non-Secure Callable and the CPU
+             * is in the Non-Secure state. The only instruction which can
+             * be executed like this is SG (and that only if both halves of
+             * the SG instruction have the same security attributes.)
+             * Everything else must generate an INVEP SecureFault, so we
+             * emulate the SG instruction here.
+             * TODO: actually emulate SG.
+             */
+            env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
+            qemu_log_mask(CPU_LOG_INT,
+                          "...really SecureFault with SFSR.INVEP\n");
+            break;
+        case M_FAKE_FSR_SFAULT:
+            /* Various flavours of SecureFault for attempts to execute or
+             * access data in the wrong security state.
+             */
+            switch (cs->exception_index) {
+            case EXCP_PREFETCH_ABORT:
+                if (env->v7m.secure) {
+                    env->v7m.sfsr |= R_V7M_SFSR_INVTRAN_MASK;
+                    qemu_log_mask(CPU_LOG_INT,
+                                  "...really SecureFault with SFSR.INVTRAN\n");
+                } else {
+                    env->v7m.sfsr |= R_V7M_SFSR_INVEP_MASK;
+                    qemu_log_mask(CPU_LOG_INT,
+                                  "...really SecureFault with SFSR.INVEP\n");
+                }
+                break;
+            case EXCP_DATA_ABORT:
+                /* This must be an NS access to S memory */
+                env->v7m.sfsr |= R_V7M_SFSR_AUVIOL_MASK;
+                qemu_log_mask(CPU_LOG_INT,
+                              "...really SecureFault with SFSR.AUVIOL\n");
+                break;
+            }
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_SECURE, false);
+            break;
         case 0x8: /* External Abort */
             switch (cs->exception_index) {
             case EXCP_PREFETCH_ABORT:
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav7(CPUARMState *env, uint32_t address,
     return !(*prot & (1 << access_type));
 }
 
+static bool v8m_is_sau_exempt(CPUARMState *env,
+                              uint32_t address, MMUAccessType access_type)
+{
+    /* The architecture specifies that certain address ranges are
+     * exempt from v8M SAU/IDAU checks.
+     */
+    return
+        (access_type == MMU_INST_FETCH && m_is_system_region(env, address)) ||
+        (address >= 0xe0000000 && address <= 0xe0002fff) ||
+        (address >= 0xe000e000 && address <= 0xe000efff) ||
+        (address >= 0xe002e000 && address <= 0xe002efff) ||
+        (address >= 0xe0040000 && address <= 0xe0041fff) ||
+        (address >= 0xe00ff000 && address <= 0xe00fffff);
+}
+
+static void v8m_security_lookup(CPUARMState *env, uint32_t address,
+                                MMUAccessType access_type, ARMMMUIdx mmu_idx,
+                                V8M_SAttributes *sattrs)
+{
+    /* Look up the security attributes for this address. Compare the
+     * pseudocode SecurityCheck() function.
+     * We assume the caller has zero-initialized *sattrs.
+     */
+    ARMCPU *cpu = arm_env_get_cpu(env);
+    int r;
+
+    /* TODO: implement IDAU */
+
+    if (access_type == MMU_INST_FETCH && extract32(address, 28, 4) == 0xf) {
+        /* 0xf0000000..0xffffffff is always S for insn fetches */
+        return;
+    }
+
+    if (v8m_is_sau_exempt(env, address, access_type)) {
+        sattrs->ns = !regime_is_secure(env, mmu_idx);
+        return;
+    }
+
+    switch (env->sau.ctrl & 3) {
+    case 0: /* SAU.ENABLE == 0, SAU.ALLNS == 0 */
+        break;
+    case 2: /* SAU.ENABLE == 0, SAU.ALLNS == 1 */
+        sattrs->ns = true;
+        break;
+    default: /* SAU.ENABLE == 1 */
+        for (r = 0; r < cpu->sau_sregion; r++) {
+            if (env->sau.rlar[r] & 1) {
+                uint32_t base = env->sau.rbar[r] & ~0x1f;
+                uint32_t limit = env->sau.rlar[r] | 0x1f;
+
+                if (base <= address && limit >= address) {
+                    if (sattrs->srvalid) {
+                        /* If we hit in more than one region then we must report
+                         * as Secure, not NS-Callable, with no valid region
+                         * number info.
+                         */
+                        sattrs->ns = false;
+                        sattrs->nsc = false;
+                        sattrs->sregion = 0;
+                        sattrs->srvalid = false;
+                        break;
+                    } else {
+                        if (env->sau.rlar[r] & 2) {
+                            sattrs->nsc = true;
+                        } else {
+                            sattrs->ns = true;
+                        }
+                        sattrs->srvalid = true;
+                        sattrs->sregion = r;
+                    }
+                }
+            }
+        }
+
+        /* TODO when we support the IDAU then it may override the result here */
+        break;
+    }
+}
+
 static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
                                  MMUAccessType access_type, ARMMMUIdx mmu_idx,
-                                 hwaddr *phys_ptr, int *prot, uint32_t *fsr)
+                                 hwaddr *phys_ptr, MemTxAttrs *txattrs,
+                                 int *prot, uint32_t *fsr)
 {
     ARMCPU *cpu = arm_env_get_cpu(env);
     bool is_user = regime_is_user(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
     int n;
     int matchregion = -1;
     bool hit = false;
+    V8M_SAttributes sattrs = {};
 
     *phys_ptr = address;
     *prot = 0;
 
+    if (arm_feature(env, ARM_FEATURE_M_SECURITY)) {
+        v8m_security_lookup(env, address, access_type, mmu_idx, &sattrs);
+        if (access_type == MMU_INST_FETCH) {
+            /* Instruction fetches always use the MMU bank and the
+             * transaction attribute determined by the fetch address,
+             * regardless of CPU state. This is painful for QEMU
+             * to handle, because it would mean we need to encode
+             * into the mmu_idx not just the (user, negpri) information
+             * for the current security state but also that for the
+             * other security state, which would balloon the number
+             * of mmu_idx values needed alarmingly.
+             * Fortunately we can avoid this because it's not actually
+             * possible to arbitrarily execute code from memory with
+             * the wrong security attribute: it will always generate
+             * an exception of some kind or another, apart from the
+             * special case of an NS CPU executing an SG instruction
+             * in S&NSC memory. So we always just fail the translation
+             * here and sort things out in the exception handler
+             * (including possibly emulating an SG instruction).
+             */
+            if (sattrs.ns != !secure) {
+                *fsr = sattrs.nsc ? M_FAKE_FSR_NSC_EXEC : M_FAKE_FSR_SFAULT;
+                return true;
+            }
+        } else {
+            /* For data accesses we always use the MMU bank indicated
+             * by the current CPU state, but the security attributes
+             * might downgrade a secure access to nonsecure.
+             */
+            if (sattrs.ns) {
+                txattrs->secure = false;
+            } else if (!secure) {
+                /* NS access to S memory must fault.
+                 * Architecturally we should first check whether the
+                 * MPU information for this address indicates that we
+                 * are doing an unaligned access to Device memory, which
+                 * should generate a UsageFault instead. QEMU does not
+                 * currently check for that kind of unaligned access though.
+                 * If we added it we would need to do so as a special case
+                 * for M_FAKE_FSR_SFAULT in arm_v7m_cpu_do_interrupt().
+                 */
+                *fsr = M_FAKE_FSR_SFAULT;
+                return true;
+            }
+        }
+    }
+
     /* Unlike the ARM ARM pseudocode, we don't need to check whether this
      * was an exception vector read from the vector table (which is always
      * done using the default system address map), because those accesses
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr(CPUARMState *env, target_ulong address,
         if (arm_feature(env, ARM_FEATURE_V8)) {
             /* PMSAv8 */
             ret = get_phys_addr_pmsav8(env, address, access_type, mmu_idx,
-                                       phys_ptr, prot, fsr);
+                                       phys_ptr, attrs, prot, fsr);
         } else if (arm_feature(env, ARM_FEATURE_V7)) {
             /* PMSAv7 */
             ret = get_phys_addr_pmsav7(env, address, access_type, mmu_idx,
-- 
2.7.4

In cpu_mmu_index() we try to do this:
        if (env->v7m.secure) {
            mmu_idx += ARMMMUIdx_MSUser;
        }
but it will give the wrong answer, because ARMMMUIdx_MSUser
includes the 0x40 ARM_MMU_IDX_M field, and so does the
mmu_idx we're adding to, and we'll end up with 0x8n rather
than 0x4n. This error is then nullified by the call to
arm_to_core_mmu_idx() which masks out the high part, but
we're about to factor out the code that calculates the
ARMMMUIdx values so it can be used without passing it through
arm_to_core_mmu_idx(), so fix this bug first.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-16-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
     int el = arm_current_el(env);
 
     if (arm_feature(env, ARM_FEATURE_M)) {
-        ARMMMUIdx mmu_idx = el == 0 ? ARMMMUIdx_MUser : ARMMMUIdx_MPriv;
+        ARMMMUIdx mmu_idx;
 
-        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
-            mmu_idx = ARMMMUIdx_MNegPri;
+        if (el == 0) {
+            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
+        } else {
+            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
         }
 
-        if (env->v7m.secure) {
-            mmu_idx += ARMMMUIdx_MSUser;
+        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
+            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
         }
 
         return arm_to_core_mmu_idx(mmu_idx);
-- 
2.7.4

For the SG instruction and secure function return we are going
to want to do memory accesses using the MMU index of the CPU
in secure state, even though the CPU is currently in non-secure
state. Write arm_v7m_mmu_idx_for_secstate() to do this job,
and use it in cpu_mmu_index().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 1506092407-26985-17-git-send-email-peter.maydell@linaro.org
---
 target/arm/cpu.h | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
     }
 }
 
+/* Return the MMU index for a v7M CPU in the specified security state */
+static inline ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env,
+                                                     bool secstate)
+{
+    int el = arm_current_el(env);
+    ARMMMUIdx mmu_idx;
+
+    if (el == 0) {
+        mmu_idx = secstate ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
+    } else {
+        mmu_idx = secstate ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
+    }
+
+    if (armv7m_nvic_neg_prio_requested(env->nvic, secstate)) {
+        mmu_idx = secstate ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
+    }
+
+    return mmu_idx;
+}
+
 /* Determine the current mmu_idx to use for normal loads/stores */
 static inline int cpu_mmu_index(CPUARMState *env, bool ifetch)
 {
     int el = arm_current_el(env);
 
     if (arm_feature(env, ARM_FEATURE_M)) {
-        ARMMMUIdx mmu_idx;
-
-        if (el == 0) {
-            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSUser : ARMMMUIdx_MUser;
-        } else {
-            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSPriv : ARMMMUIdx_MPriv;
-        }
-
-        if (armv7m_nvic_neg_prio_requested(env->nvic, env->v7m.secure)) {
-            mmu_idx = env->v7m.secure ? ARMMMUIdx_MSNegPri : ARMMMUIdx_MNegPri;
-        }
+        ARMMMUIdx mmu_idx = arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
 
         return arm_to_core_mmu_idx(mmu_idx);
     }
-- 
2.7.4

When we added support for the new SHCSR bits in v8M in commit
437d59c17e9 the code to support writing to the new HARDFAULTPENDED
bit was accidentally only added for non-secure writes; the
secure banked version of the bit should also be writable.

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static void nvic_writel(NVICState *s, uint32_t offset, uint32_t value,
             s->sec_vectors[ARMV7M_EXCP_BUS].enabled = (value & (1 << 17)) != 0;
             s->sec_vectors[ARMV7M_EXCP_USAGE].enabled =
                 (value & (1 << 18)) != 0;
+            s->sec_vectors[ARMV7M_EXCP_HARD].pending = (value & (1 << 21)) != 0;
             /* SecureFault not banked, but RAZ/WI to NS */
             s->vectors[ARMV7M_EXCP_SECURE].active = (value & (1 << 4)) != 0;
             s->vectors[ARMV7M_EXCP_SECURE].enabled = (value & (1 << 19)) != 0;
-- 
2.7.4

The following changes since commit 6eeea6725a70e6fcb5abba0764496bdab07ddfb3:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2020-10-06' into staging (2020-10-06 21:13:34 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201008

for you to fetch changes up to ba118c26e16a97e6ff6de8184057d3420ce16a23:

target/arm: Make '-cpu max' have a 48-bit PA (2020-10-08 15:24:32 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer
 * hw/arm/fsl-imx25: Fix a typo
 * hw/arm/sbsa-ref : Fix SMMUv3 Initialisation
 * hw/arm/sbsa-ref : allocate IRQs for SMMUv3
 * hw/char/bcm2835_aux: Allow less than 32-bit accesses
 * hw/arm/virt: Implement kvm-steal-time
 * target/arm: Make '-cpu max' have a 48-bit PA

----------------------------------------------------------------
Andrew Jones (6):
      linux headers: sync to 5.9-rc7
      target/arm/kvm: Make uncalled stubs explicitly unreachable
      hw/arm/virt: Move post cpu realize check into its own function
      hw/arm/virt: Move kvm pmu setup to virt_cpu_post_init
      tests/qtest: Restore aarch64 arm-cpu-features test
      hw/arm/virt: Implement kvm-steal-time

Graeme Gregory (2):
      hw/arm/sbsa-ref : Fix SMMUv3 Initialisation
      hw/arm/sbsa-ref : allocate IRQs for SMMUv3

Peter Maydell (1):
      target/arm: Make '-cpu max' have a 48-bit PA

Philippe Mathieu-Daudé (3):
      hw/ssi/npcm7xx_fiu: Fix handling of unsigned integer
      hw/arm/fsl-imx25: Fix a typo
      hw/char/bcm2835_aux: Allow less than 32-bit accesses

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fix integer handling issues handling issue reported by Coverity:

hw/ssi/npcm7xx_fiu.c: 162 in npcm7xx_fiu_flash_read()
  >>>     CID 1432730:  Integer handling issues  (NEGATIVE_RETURNS)
  >>>     "npcm7xx_fiu_cs_index(fiu, f)" is passed to a parameter that cannot be negative.
  162         npcm7xx_fiu_select(fiu, npcm7xx_fiu_cs_index(fiu, f));

hw/ssi/npcm7xx_fiu.c: 221 in npcm7xx_fiu_flash_write()
  218         cs_id = npcm7xx_fiu_cs_index(fiu, f);
  219         trace_npcm7xx_fiu_flash_write(DEVICE(fiu)->canonical_path, cs_id, addr,
  220                                       size, v);
  >>>     CID 1432729:  Integer handling issues  (NEGATIVE_RETURNS)
  >>>     "cs_id" is passed to a parameter that cannot be negative.
  221         npcm7xx_fiu_select(fiu, cs_id);

Since the index of the flash can not be negative, return an
unsigned type.

Reported-by: Coverity (CID 1432729 & 1432730: NEGATIVE_RETURNS)
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20200919132435.310527-1-f4bug@amsat.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/npcm7xx_fiu.c | 12 ++++++------
 hw/ssi/trace-events  |  2 +-
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/ssi/npcm7xx_fiu.c b/hw/ssi/npcm7xx_fiu.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/npcm7xx_fiu.c
+++ b/hw/ssi/npcm7xx_fiu.c
@@ -XXX,XX +XXX,XX @@ enum NPCM7xxFIURegister {
  * Returns the index of flash in the fiu->flash array. This corresponds to the
  * chip select ID of the flash.
  */
-static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)
+static unsigned npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu,
+                                     NPCM7xxFIUFlash *flash)
 {
     int index = flash - fiu->flash;
 
@@ -XXX,XX +XXX,XX @@ static int npcm7xx_fiu_cs_index(NPCM7xxFIUState *fiu, NPCM7xxFIUFlash *flash)
 }
 
 /* Assert the chip select specified in the UMA Control/Status Register. */
-static void npcm7xx_fiu_select(NPCM7xxFIUState *s, int cs_id)
+static void npcm7xx_fiu_select(NPCM7xxFIUState *s, unsigned cs_id)
 {
     trace_npcm7xx_fiu_select(DEVICE(s)->canonical_path, cs_id);
 
     if (cs_id < s->cs_count) {
         qemu_irq_lower(s->cs_lines[cs_id]);
+        s->active_cs = cs_id;
     } else {
         qemu_log_mask(LOG_GUEST_ERROR,
                       "%s: UMA to CS%d; this module has only %d chip selects",
                       DEVICE(s)->canonical_path, cs_id, s->cs_count);
-        cs_id = -1;
+        s->active_cs = -1;
     }
-
-    s->active_cs = cs_id;
 }
 
 /* Deassert the currently active chip select. */
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_fiu_flash_write(void *opaque, hwaddr addr, uint64_t v,
     NPCM7xxFIUFlash *f = opaque;
     NPCM7xxFIUState *fiu = f->fiu;
     uint32_t dwr_cfg;
-    int cs_id;
+    unsigned cs_id;
     int i;
 
     if (fiu->active_cs != -1) {
diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/trace-events
+++ b/hw/ssi/trace-events
@@ -XXX,XX +XXX,XX @@ npcm7xx_fiu_deselect(const char *id, int cs) "%s deselect CS%d"
 npcm7xx_fiu_ctrl_read(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
 npcm7xx_fiu_ctrl_write(const char *id, uint64_t addr, uint32_t data) "%s offset: 0x%04" PRIx64 " value: 0x%08" PRIx32
 npcm7xx_fiu_flash_read(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
-npcm7xx_fiu_flash_write(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
+npcm7xx_fiu_flash_write(const char *id, unsigned cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201002080935.1660005-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx25.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/include/hw/arm/fsl-imx25.h b/include/hw/arm/fsl-imx25.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx25.h
+++ b/include/hw/arm/fsl-imx25.h
@@ -XXX,XX +XXX,XX @@ struct FslIMX25State {
  * 0xBB00_0000 0xBB00_0FFF 4 Kbytes     NAND flash main area buffer
  * 0xBB00_1000 0xBB00_11FF 512 B        NAND flash spare area buffer
  * 0xBB00_1200 0xBB00_1DFF 3 Kbytes     Reserved
- * 0xBB00_1E00 0xBB00_1FFF 512 B        NAND flash control regisers
+ * 0xBB00_1E00 0xBB00_1FFF 512 B        NAND flash control registers
  * 0xBB01_2000 0xBFFF_FFFF 96 Mbytes (minus 8 Kbytes) Reserved
  * 0xC000_0000 0xFFFF_FFFF 1024 Mbytes  Reserved
  */
-- 
2.20.1

From: Graeme Gregory <graeme@nuviainc.com>

SMMUv3 has an error in a previous patch where an i was transposed to a 1
meaning interrupts would not have been correctly assigned to the SMMUv3
instance.

Fixes: 48ba18e6d3f3 ("hw/arm/sbsa-ref: Simplify by moving the gic in the machine state")
Signed-off-by: Graeme Gregory <graeme@nuviainc.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20201007100732.4103790-2-graeme@nuviainc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static void create_smmu(const SBSAMachineState *sms, PCIBus *bus)
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
     for (i = 0; i < NUM_SMMU_IRQS; i++) {
         sysbus_connect_irq(SYS_BUS_DEVICE(dev), i,
-                           qdev_get_gpio_in(sms->gic, irq + 1));
+                           qdev_get_gpio_in(sms->gic, irq + i));
     }
 }
 
-- 
2.20.1

From: Graeme Gregory <graeme@nuviainc.com>

Original commit did not allocate IRQs for the SMMUv3 in the irqmap
effectively using irq 0->3 (shared with other devices). Assuming
original intent was to allocate unique IRQs then add an allocation
to the irqmap.

Fixes: e9fdf453240 ("hw/arm: Add arm SBSA reference machine, devices part")
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Graeme Gregory <graeme@nuviainc.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20201007100732.4103790-3-graeme@nuviainc.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {
     [SBSA_SECURE_UART_MM] = 9,
     [SBSA_AHCI] = 10,
     [SBSA_EHCI] = 11,
+    [SBSA_SMMU] = 12, /* ... to 15 */
 };
 
 static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The "BCM2835 ARM Peripherals" datasheet [*] chapter 2
("Auxiliaries: UART1 & SPI1, SPI2"), list the register
sizes as 3/8/16/32 bits. We assume this means this
peripheral allows 8-bit accesses.

This was not an issue until commit 5d971f9e67 which reverted
("memory: accept mismatching sizes in memory_region_access_valid").

The model is implemented as 32-bit accesses (see commit 97398d900c,
all registers are 32-bit) so replace MemoryRegionOps.valid as
MemoryRegionOps.impl, and re-introduce MemoryRegionOps.valid
with a 8/32-bit range.

[*] https://www.raspberrypi.org/app/uploads/2012/02/BCM2835-ARM-Peripherals.pdf

Fixes: 97398d900c ("bcm2835_aux: add emulation of BCM2835 AUX (aka UART1) block")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201002181032.1899463-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/bcm2835_aux.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/char/bcm2835_aux.c b/hw/char/bcm2835_aux.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/bcm2835_aux.c
+++ b/hw/char/bcm2835_aux.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps bcm2835_aux_ops = {
     .read = bcm2835_aux_read,
     .write = bcm2835_aux_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
-    .valid.min_access_size = 4,
+    .impl.min_access_size = 4,
+    .impl.max_access_size = 4,
+    .valid.min_access_size = 1,
     .valid.max_access_size = 4,
 };
 
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Update against Linux 5.9-rc7.

Cc: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-2-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-headers/linux/kvm.h | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/linux-headers/linux/kvm.h b/linux-headers/linux/kvm.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-headers/linux/kvm.h
+++ b/linux-headers/linux/kvm.h
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
 #define KVM_VM_PPC_HV 1
 #define KVM_VM_PPC_PR 2
 
-/* on MIPS, 0 forces trap & emulate, 1 forces VZ ASE */
-#define KVM_VM_MIPS_TE		0
+/* on MIPS, 0 indicates auto, 1 forces VZ ASE, 2 forces trap & emulate */
+#define KVM_VM_MIPS_AUTO	0
 #define KVM_VM_MIPS_VZ		1
+#define KVM_VM_MIPS_TE		2
 
 #define KVM_S390_SIE_PAGE_OFFSET 1
 
@@ -XXX,XX +XXX,XX @@ struct kvm_ppc_resize_hpt {
 #define KVM_CAP_LAST_CPU 184
 #define KVM_CAP_SMALLER_MAXPHYADDR 185
 #define KVM_CAP_S390_DIAG318 186
+#define KVM_CAP_STEAL_TIME 187
 
 #ifdef KVM_CAP_IRQ_ROUTING
 
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

When we compile without KVM support !defined(CONFIG_KVM) we generate
stubs for functions that the linker will still encounter. Sometimes
these stubs can be executed safely and are placed in paths where they
get executed with or without KVM. Other functions should never be
called without KVM. Those functions should be guarded by kvm_enabled(),
but should also be robust to refactoring mistakes. Putting a
g_assert_not_reached() in the function should help. Additionally,
the g_assert_not_reached() calls may actually help the linker remove
some code.

We remove the stubs for kvm_arm_get/put_virtual_time(), as they aren't
necessary at all - the only caller is in kvm.c

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-3-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h | 51 +++++++++++++++++++++++++++-----------------
 1 file changed, 32 insertions(+), 19 deletions(-)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
 
 #else
 
-static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
-{
-    /*
-     * This should never actually be called in the "not KVM" case,
-     * but set up the fields to indicate an error anyway.
-     */
-    cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
-    cpu->host_cpu_probe_failed = true;
-}
-
-static inline void kvm_arm_add_vcpu_properties(Object *obj) {}
-
+/*
+ * It's safe to call these functions without KVM support.
+ * They should either do nothing or return "not supported".
+ */
 static inline bool kvm_arm_aarch32_supported(void)
 {
     return false;
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_sve_supported(void)
     return false;
 }
 
+/*
+ * These functions should never actually be called without KVM support.
+ */
+static inline void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu)
+{
+    g_assert_not_reached();
+}
+
+static inline void kvm_arm_add_vcpu_properties(Object *obj)
+{
+    g_assert_not_reached();
+}
+
 static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
 {
-    return -ENOENT;
+    g_assert_not_reached();
 }
 
 static inline int kvm_arm_vgic_probe(void)
 {
-    return 0;
+    g_assert_not_reached();
 }
 
-static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq) {}
-static inline void kvm_arm_pmu_init(CPUState *cs) {}
+static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq)
+{
+    g_assert_not_reached();
+}
 
-static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map) {}
+static inline void kvm_arm_pmu_init(CPUState *cs)
+{
+    g_assert_not_reached();
+}
+
+static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
+{
+    g_assert_not_reached();
+}
 
-static inline void kvm_arm_get_virtual_time(CPUState *cs) {}
-static inline void kvm_arm_put_virtual_time(CPUState *cs) {}
 #endif
 
 static inline const char *gic_class_name(void)
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

We'll add more to this new function in coming patches so we also
state the gic must be created and call it below create_gic().

No functional change intended.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-4-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 43 +++++++++++++++++++++++++++----------------
 1 file changed, 27 insertions(+), 16 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
     }
 }
 
+/*
+ * virt_cpu_post_init() must be called after the CPUs have
+ * been realized and the GIC has been created.
+ */
+static void virt_cpu_post_init(VirtMachineState *vms)
+{
+    bool aarch64;
+
+    aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
+
+    if (!kvm_enabled()) {
+        if (aarch64 && vms->highmem) {
+            int requested_pa_size = 64 - clz64(vms->highest_gpa);
+            int pamax = arm_pamax(ARM_CPU(first_cpu));
+
+            if (pamax < requested_pa_size) {
+                error_report("VCPU supports less PA bits (%d) than "
+                             "requested by the memory map (%d)",
+                             pamax, requested_pa_size);
+                exit(1);
+            }
+        }
+    }
+}
+
 static void machvirt_init(MachineState *machine)
 {
     VirtMachineState *vms = VIRT_MACHINE(machine);
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     fdt_add_timer_nodes(vms);
     fdt_add_cpu_nodes(vms);
 
-   if (!kvm_enabled()) {
-        ARMCPU *cpu = ARM_CPU(first_cpu);
-        bool aarch64 = object_property_get_bool(OBJECT(cpu), "aarch64", NULL);
-
-        if (aarch64 && vms->highmem) {
-            int requested_pa_size, pamax = arm_pamax(cpu);
-
-            requested_pa_size = 64 - clz64(vms->highest_gpa);
-            if (pamax < requested_pa_size) {
-                error_report("VCPU supports less PA bits (%d) than requested "
-                            "by the memory map (%d)", pamax, requested_pa_size);
-                exit(1);
-            }
-        }
-    }
-
     memory_region_add_subregion(sysmem, vms->memmap[VIRT_MEM].base,
                                 machine->ram);
     if (machine->device_memory) {
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
 
     create_gic(vms);
 
+    virt_cpu_post_init(vms);
+
     fdt_add_pmu_nodes(vms);
 
     create_uart(vms, VIRT_UART, sysmem, serial_hd(0));
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Move the KVM PMU setup part of fdt_add_pmu_nodes() to
virt_cpu_post_init(), which is a more appropriate location. Now
fdt_add_pmu_nodes() is also named more appropriately, because it
no longer does anything but fdt node creation.

No functional change intended.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-5-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 34 ++++++++++++++++++----------------
 1 file changed, 18 insertions(+), 16 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void fdt_add_gic_node(VirtMachineState *vms)
 
 static void fdt_add_pmu_nodes(const VirtMachineState *vms)
 {
-    CPUState *cpu;
-    ARMCPU *armcpu;
+    ARMCPU *armcpu = ARM_CPU(first_cpu);
     uint32_t irqflags = GIC_FDT_IRQ_FLAGS_LEVEL_HI;
 
-    CPU_FOREACH(cpu) {
-        armcpu = ARM_CPU(cpu);
-        if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU)) {
-            return;
-        }
-        if (kvm_enabled()) {
-            if (kvm_irqchip_in_kernel()) {
-                kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ));
-            }
-            kvm_arm_pmu_init(cpu);
-        }
+    if (!arm_feature(&armcpu->env, ARM_FEATURE_PMU)) {
+        assert(!object_property_get_bool(OBJECT(armcpu), "pmu", NULL));
+        return;
     }
 
     if (vms->gic_version == VIRT_GIC_VERSION_2) {
@@ -XXX,XX +XXX,XX @@ static void fdt_add_pmu_nodes(const VirtMachineState *vms)
                              (1 << vms->smp_cpus) - 1);
     }
 
-    armcpu = ARM_CPU(qemu_get_cpu(0));
     qemu_fdt_add_subnode(vms->fdt, "/pmu");
     if (arm_feature(&armcpu->env, ARM_FEATURE_V8)) {
         const char compat[] = "arm,armv8-pmuv3";
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
  */
 static void virt_cpu_post_init(VirtMachineState *vms)
 {
-    bool aarch64;
+    bool aarch64, pmu;
+    CPUState *cpu;
 
     aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
+    pmu = object_property_get_bool(OBJECT(first_cpu), "pmu", NULL);
 
-    if (!kvm_enabled()) {
+    if (kvm_enabled()) {
+        CPU_FOREACH(cpu) {
+            if (pmu) {
+                assert(arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_PMU));
+                if (kvm_irqchip_in_kernel()) {
+                    kvm_arm_pmu_set_irq(cpu, PPI(VIRTUAL_PMU_IRQ));
+                }
+                kvm_arm_pmu_init(cpu);
+            }
+        }
+    } else {
         if (aarch64 && vms->highmem) {
             int requested_pa_size = 64 - clz64(vms->highest_gpa);
             int pamax = arm_pamax(ARM_CPU(first_cpu));
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

arm-cpu-features got dropped from the AArch64 tests during the meson
conversion shuffle.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-6-drjones@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/meson.build | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_aarch64 = \
   (cpu != 'arm' ? ['bios-tables-test'] : []) +                                                  \
   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-test'] : []) +        \
   (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-swtpm-test'] : []) +  \
-  ['numa-test',
+  ['arm-cpu-features',
+   'numa-test',
    'boot-serial-test',
    'migration-test']
 
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

We add the kvm-steal-time CPU property and implement it for machvirt.
A tiny bit of refactoring was also done to allow pmu and pvtime to
use the same vcpu device helper functions.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Andrew Jones <drjones@redhat.com>
Message-id: 20201001061718.101915-7-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst | 11 ++++++
 include/hw/arm/virt.h            |  5 +++
 target/arm/cpu.h                 |  4 ++
 target/arm/kvm_arm.h             | 43 +++++++++++++++++++++
 hw/arm/virt.c                    | 43 +++++++++++++++++++--
 target/arm/cpu.c                 |  8 ++++
 target/arm/kvm.c                 | 16 ++++++++
 target/arm/kvm64.c               | 64 +++++++++++++++++++++++++++++---
 target/arm/monitor.c             |  2 +-
 tests/qtest/arm-cpu-features.c   | 25 +++++++++++--
 10 files changed, 208 insertions(+), 13 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ the list of KVM VCPU features and their descriptions.
                            adjustment, also restoring the legacy (pre-5.0)
                            behavior.
 
+  kvm-steal-time           Since v5.2, kvm-steal-time is enabled by
+                           default when KVM is enabled, the feature is
+                           supported, and the guest is 64-bit.
+
+                           When kvm-steal-time is enabled a 64-bit guest
+                           can account for time its CPUs were not running
+                           due to the host not scheduling the corresponding
+                           VCPU threads.  The accounting statistics may
+                           influence the guest scheduler behavior and/or be
+                           exposed to the guest userspace.
+
 SVE CPU Properties
 ==================
 
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@
 
 #define PPI(irq) ((irq) + 16)
 
+/* See Linux kernel arch/arm64/include/asm/pvclock-abi.h */
+#define PVTIME_SIZE_PER_CPU 64
+
 enum {
     VIRT_FLASH,
     VIRT_MEM,
@@ -XXX,XX +XXX,XX @@ enum {
     VIRT_PCDIMM_ACPI,
     VIRT_ACPI_GED,
     VIRT_NVDIMM_ACPI,
+    VIRT_PVTIME,
     VIRT_LOWMEMMAP_LAST,
 };
 
@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
     bool no_highmem_ecam;
     bool no_ged;   /* Machines < 4.2 has no support for ACPI GED device */
     bool kvm_no_adjvtime;
+    bool no_kvm_steal_time;
     bool acpi_expose_flash;
 };
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/registerfields.h"
 #include "cpu-qom.h"
 #include "exec/cpu-defs.h"
+#include "qapi/qapi-types-common.h"
 
 /* ARM processors have a weak memory model */
 #define TCG_GUEST_DEFAULT_MO      (0)
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     bool kvm_vtime_dirty;
     uint64_t kvm_vtime;
 
+    /* KVM steal time */
+    OnOffAuto kvm_steal_time;
+
     /* Uniprocessor system with MP extensions */
     bool mp_is_up;
 
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ void kvm_arm_set_cpu_features_from_host(ARMCPU *cpu);
  */
 void kvm_arm_add_vcpu_properties(Object *obj);
 
+/**
+ * kvm_arm_steal_time_finalize:
+ * @cpu: ARMCPU for which to finalize kvm-steal-time
+ * @errp: Pointer to Error* for error propagation
+ *
+ * Validate the kvm-steal-time property selection and set its default
+ * based on KVM support and guest configuration.
+ */
+void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp);
+
+/**
+ * kvm_arm_steal_time_supported:
+ *
+ * Returns: true if KVM can enable steal time reporting
+ * and false otherwise.
+ */
+bool kvm_arm_steal_time_supported(void);
+
 /**
  * kvm_arm_aarch32_supported:
  *
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vgic_probe(void);
 
 void kvm_arm_pmu_set_irq(CPUState *cs, int irq);
 void kvm_arm_pmu_init(CPUState *cs);
+
+/**
+ * kvm_arm_pvtime_init:
+ * @cs: CPUState
+ * @ipa: Per-vcpu guest physical base address of the pvtime structures
+ *
+ * Initializes PVTIME for the VCPU, setting the PVTIME IPA to @ipa.
+ */
+void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa);
+
 int kvm_arm_set_irq(int cpu, int irqtype, int irq, int level);
 
 #else
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_sve_supported(void)
     return false;
 }
 
+static inline bool kvm_arm_steal_time_supported(void)
+{
+    return false;
+}
+
 /*
  * These functions should never actually be called without KVM support.
  */
@@ -XXX,XX +XXX,XX @@ static inline void kvm_arm_pmu_init(CPUState *cs)
     g_assert_not_reached();
 }
 
+static inline void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa)
+{
+    g_assert_not_reached();
+}
+
+static inline void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
+{
+    g_assert_not_reached();
+}
+
 static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
 {
     g_assert_not_reached();
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static const MemMapEntry base_memmap[] = {
     [VIRT_PCDIMM_ACPI] =        { 0x09070000, MEMORY_HOTPLUG_IO_LEN },
     [VIRT_ACPI_GED] =           { 0x09080000, ACPI_GED_EVT_SEL_LEN },
     [VIRT_NVDIMM_ACPI] =        { 0x09090000, NVDIMM_ACPI_IO_LEN},
+    [VIRT_PVTIME] =             { 0x090a0000, 0x00010000 },
     [VIRT_MMIO] =               { 0x0a000000, 0x00000200 },
     /* ...repeating for a total of NUM_VIRTIO_TRANSPORTS, each of that size */
     [VIRT_PLATFORM_BUS] =       { 0x0c000000, 0x02000000 },
@@ -XXX,XX +XXX,XX @@ static void finalize_gic_version(VirtMachineState *vms)
  * virt_cpu_post_init() must be called after the CPUs have
  * been realized and the GIC has been created.
  */
-static void virt_cpu_post_init(VirtMachineState *vms)
+static void virt_cpu_post_init(VirtMachineState *vms, int max_cpus,
+                               MemoryRegion *sysmem)
 {
-    bool aarch64, pmu;
+    bool aarch64, pmu, steal_time;
     CPUState *cpu;
 
     aarch64 = object_property_get_bool(OBJECT(first_cpu), "aarch64", NULL);
     pmu = object_property_get_bool(OBJECT(first_cpu), "pmu", NULL);
+    steal_time = object_property_get_bool(OBJECT(first_cpu),
+                                          "kvm-steal-time", NULL);
 
     if (kvm_enabled()) {
+        hwaddr pvtime_reg_base = vms->memmap[VIRT_PVTIME].base;
+        hwaddr pvtime_reg_size = vms->memmap[VIRT_PVTIME].size;
+
+        if (steal_time) {
+            MemoryRegion *pvtime = g_new(MemoryRegion, 1);
+            hwaddr pvtime_size = max_cpus * PVTIME_SIZE_PER_CPU;
+
+            /* The memory region size must be a multiple of host page size. */
+            pvtime_size = REAL_HOST_PAGE_ALIGN(pvtime_size);
+
+            if (pvtime_size > pvtime_reg_size) {
+                error_report("pvtime requires a %ld byte memory region for "
+                             "%d CPUs, but only %ld has been reserved",
+                             pvtime_size, max_cpus, pvtime_reg_size);
+                exit(1);
+            }
+
+            memory_region_init_ram(pvtime, NULL, "pvtime", pvtime_size, NULL);
+            memory_region_add_subregion(sysmem, pvtime_reg_base, pvtime);
+        }
+
         CPU_FOREACH(cpu) {
             if (pmu) {
                 assert(arm_feature(&ARM_CPU(cpu)->env, ARM_FEATURE_PMU));
@@ -XXX,XX +XXX,XX @@ static void virt_cpu_post_init(VirtMachineState *vms)
                 }
                 kvm_arm_pmu_init(cpu);
             }
+            if (steal_time) {
+                kvm_arm_pvtime_init(cpu, pvtime_reg_base +
+                                         cpu->cpu_index * PVTIME_SIZE_PER_CPU);
+            }
         }
     } else {
         if (aarch64 && vms->highmem) {
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
             object_property_set_bool(cpuobj, "kvm-no-adjvtime", true, NULL);
         }
 
+        if (vmc->no_kvm_steal_time &&
+            object_property_find(cpuobj, "kvm-steal-time")) {
+            object_property_set_bool(cpuobj, "kvm-steal-time", false, NULL);
+        }
+
         if (vmc->no_pmu && object_property_find(cpuobj, "pmu")) {
             object_property_set_bool(cpuobj, "pmu", false, NULL);
         }
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
 
     create_gic(vms);
 
-    virt_cpu_post_init(vms);
+    virt_cpu_post_init(vms, possible_cpus->len, sysmem);
 
     fdt_add_pmu_nodes(vms);
 
@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(5, 2)
 
 static void virt_machine_5_1_options(MachineClass *mc)
 {
+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
+
     virt_machine_5_2_options(mc);
     compat_props_add(mc->compat_props, hw_compat_5_1, hw_compat_5_1_len);
+    vmc->no_kvm_steal_time = true;
 }
 DEFINE_VIRT_MACHINE(5, 1)
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
             return;
         }
     }
+
+    if (kvm_enabled()) {
+        kvm_arm_steal_time_finalize(cpu, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
 }
 
 static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_no_adjvtime_set(Object *obj, bool value, Error **errp)
     ARM_CPU(obj)->kvm_adjvtime = !value;
 }
 
+static bool kvm_steal_time_get(Object *obj, Error **errp)
+{
+    return ARM_CPU(obj)->kvm_steal_time != ON_OFF_AUTO_OFF;
+}
+
+static void kvm_steal_time_set(Object *obj, bool value, Error **errp)
+{
+    ARM_CPU(obj)->kvm_steal_time = value ? ON_OFF_AUTO_ON : ON_OFF_AUTO_OFF;
+}
+
 /* KVM VCPU properties should be prefixed with "kvm-". */
 void kvm_arm_add_vcpu_properties(Object *obj)
 {
@@ -XXX,XX +XXX,XX @@ void kvm_arm_add_vcpu_properties(Object *obj)
                                         "the virtual counter. VM stopped time "
                                         "will be counted.");
     }
+
+    cpu->kvm_steal_time = ON_OFF_AUTO_AUTO;
+    object_property_add_bool(obj, "kvm-steal-time", kvm_steal_time_get,
+                             kvm_steal_time_set);
+    object_property_set_description(obj, "kvm-steal-time",
+                                    "Set off to disable KVM steal time.");
 }
 
 bool kvm_arm_pmu_supported(void)
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@
 #include <linux/kvm.h>
 
 #include "qemu-common.h"
+#include "qapi/error.h"
 #include "cpu.h"
 #include "qemu/timer.h"
 #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static CPUWatchpoint *find_hw_watchpoint(CPUState *cpu, target_ulong addr)
     return NULL;
 }
 
-static bool kvm_arm_pmu_set_attr(CPUState *cs, struct kvm_device_attr *attr)
+static bool kvm_arm_set_device_attr(CPUState *cs, struct kvm_device_attr *attr,
+                                    const char *name)
 {
     int err;
 
     err = kvm_vcpu_ioctl(cs, KVM_HAS_DEVICE_ATTR, attr);
     if (err != 0) {
-        error_report("PMU: KVM_HAS_DEVICE_ATTR: %s", strerror(-err));
+        error_report("%s: KVM_HAS_DEVICE_ATTR: %s", name, strerror(-err));
         return false;
     }
 
     err = kvm_vcpu_ioctl(cs, KVM_SET_DEVICE_ATTR, attr);
     if (err != 0) {
-        error_report("PMU: KVM_SET_DEVICE_ATTR: %s", strerror(-err));
+        error_report("%s: KVM_SET_DEVICE_ATTR: %s", name, strerror(-err));
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ void kvm_arm_pmu_init(CPUState *cs)
     if (!ARM_CPU(cs)->has_pmu) {
         return;
     }
-    if (!kvm_arm_pmu_set_attr(cs, &attr)) {
+    if (!kvm_arm_set_device_attr(cs, &attr, "PMU")) {
         error_report("failed to init PMU");
         abort();
     }
@@ -XXX,XX +XXX,XX @@ void kvm_arm_pmu_set_irq(CPUState *cs, int irq)
     if (!ARM_CPU(cs)->has_pmu) {
         return;
     }
-    if (!kvm_arm_pmu_set_attr(cs, &attr)) {
+    if (!kvm_arm_set_device_attr(cs, &attr, "PMU")) {
         error_report("failed to set irq for PMU");
         abort();
     }
 }
 
+void kvm_arm_pvtime_init(CPUState *cs, uint64_t ipa)
+{
+    struct kvm_device_attr attr = {
+        .group = KVM_ARM_VCPU_PVTIME_CTRL,
+        .attr = KVM_ARM_VCPU_PVTIME_IPA,
+        .addr = (uint64_t)&ipa,
+    };
+
+    if (ARM_CPU(cs)->kvm_steal_time == ON_OFF_AUTO_OFF) {
+        return;
+    }
+    if (!kvm_arm_set_device_attr(cs, &attr, "PVTIME IPA")) {
+        error_report("failed to init PVTIME IPA");
+        abort();
+    }
+}
+
 static int read_sys_reg32(int fd, uint32_t *pret, uint64_t id)
 {
     uint64_t ret;
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     return true;
 }
 
+void kvm_arm_steal_time_finalize(ARMCPU *cpu, Error **errp)
+{
+    bool has_steal_time = kvm_arm_steal_time_supported();
+
+    if (cpu->kvm_steal_time == ON_OFF_AUTO_AUTO) {
+        if (!has_steal_time || !arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+            cpu->kvm_steal_time = ON_OFF_AUTO_OFF;
+        } else {
+            cpu->kvm_steal_time = ON_OFF_AUTO_ON;
+        }
+    } else if (cpu->kvm_steal_time == ON_OFF_AUTO_ON) {
+        if (!has_steal_time) {
+            error_setg(errp, "'kvm-steal-time' cannot be enabled "
+                             "on this host");
+            return;
+        } else if (!arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+            /*
+             * DEN0057A chapter 2 says "This specification only covers
+             * systems in which the Execution state of the hypervisor
+             * as well as EL1 of virtual machines is AArch64.". And,
+             * to ensure that, the smc/hvc calls are only specified as
+             * smc64/hvc64.
+             */
+            error_setg(errp, "'kvm-steal-time' cannot be enabled "
+                             "for AArch32 guests");
+            return;
+        }
+    }
+}
+
 bool kvm_arm_aarch32_supported(void)
 {
     return kvm_check_extension(kvm_state, KVM_CAP_ARM_EL1_32BIT);
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_sve_supported(void)
     return kvm_check_extension(kvm_state, KVM_CAP_ARM_SVE);
 }
 
+bool kvm_arm_steal_time_supported(void)
+{
+    return kvm_check_extension(kvm_state, KVM_CAP_STEAL_TIME);
+}
+
 QEMU_BUILD_BUG_ON(KVM_ARM64_SVE_VQ_MIN != 1);
 
 void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
diff --git a/target/arm/monitor.c b/target/arm/monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/monitor.c
+++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ static const char *cpu_model_advertised_features[] = {
     "sve128", "sve256", "sve384", "sve512",
     "sve640", "sve768", "sve896", "sve1024", "sve1152", "sve1280",
     "sve1408", "sve1536", "sve1664", "sve1792", "sve1920", "sve2048",
-    "kvm-no-adjvtime",
+    "kvm-no-adjvtime", "kvm-steal-time",
     NULL
 };
 
diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/arm-cpu-features.c
+++ b/tests/qtest/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
     assert_set_feature(qts, "max", "pmu", true);
 
     assert_has_not_feature(qts, "max", "kvm-no-adjvtime");
+    assert_has_not_feature(qts, "max", "kvm-steal-time");
 
     if (g_str_equal(qtest_get_arch(), "aarch64")) {
         assert_has_feature_enabled(qts, "max", "aarch64");
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
     assert_set_feature(qts, "host", "kvm-no-adjvtime", false);
 
     if (g_str_equal(qtest_get_arch(), "aarch64")) {
+        bool kvm_supports_steal_time;
         bool kvm_supports_sve;
         char max_name[8], name[8];
         uint32_t max_vq, vq;
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
         QDict *resp;
         char *error;
 
+        assert_error(qts, "cortex-a15",
+            "We cannot guarantee the CPU type 'cortex-a15' works "
+            "with KVM on this host", NULL);
+
         assert_has_feature_enabled(qts, "host", "aarch64");
 
         /* Enabling and disabling pmu should always work. */
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
         assert_set_feature(qts, "host", "pmu", false);
         assert_set_feature(qts, "host", "pmu", true);
 
-        assert_error(qts, "cortex-a15",
-            "We cannot guarantee the CPU type 'cortex-a15' works "
-            "with KVM on this host", NULL);
-
+        /*
+         * Some features would be enabled by default, but they're disabled
+         * because this instance of KVM doesn't support them. Test that the
+         * features are present, and, when enabled, issue further tests.
+         */
+        assert_has_feature(qts, "host", "kvm-steal-time");
         assert_has_feature(qts, "host", "sve");
+
         resp = do_query_no_props(qts, "host");
+        kvm_supports_steal_time = resp_get_feature(resp, "kvm-steal-time");
         kvm_supports_sve = resp_get_feature(resp, "sve");
         vls = resp_get_sve_vls(resp);
         qobject_unref(resp);
 
+        if (kvm_supports_steal_time) {
+            /* If we have steal-time then we should be able to toggle it. */
+            assert_set_feature(qts, "host", "kvm-steal-time", false);
+            assert_set_feature(qts, "host", "kvm-steal-time", true);
+        }
+
         if (kvm_supports_sve) {
             g_assert(vls != 0);
             max_vq = 64 - __builtin_clzll(vls);
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
         assert_has_not_feature(qts, "host", "aarch64");
         assert_has_not_feature(qts, "host", "pmu");
         assert_has_not_feature(qts, "host", "sve");
+        assert_has_not_feature(qts, "host", "kvm-steal-time");
     }
 
     qtest_quit(qts);
-- 
2.20.1

QEMU supports a 48-bit physical address range, but we don't currently
expose it in the '-cpu max' ID registers (you get the same range as
Cortex-A57, which is 44 bits).

Set the ID_AA64MMFR0.PARange field to indicate 48 bits.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201001160116.18095-1-peter.maydell@linaro.org
---
 target/arm/cpu64.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         t = FIELD_DP64(t, ID_AA64PFR1, MTE, 2);
         cpu->isar.id_aa64pfr1 = t;
 
+        t = cpu->isar.id_aa64mmfr0;
+        t = FIELD_DP64(t, ID_AA64MMFR0, PARANGE, 5); /* PARange: 48 bits */
+        cpu->isar.id_aa64mmfr0 = t;
+
         t = cpu->isar.id_aa64mmfr1;
         t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1); /* HPD */
         t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1);
-- 
2.20.1