Series comparison

-[Qemu-devel] [PULL 00/13] target-arm queue
+[PULL 00/26] target-arm queue
-Arm patch queue -- these are all bug fix patches but we might
+The following changes since commit 64ada298b98a51eb2512607f6e6180cb330c47b1:
 as well put them in to rc0...
-thanks
+  Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220302' into staging (2022-03-02 12:38:46 +0000)
 -- PMM
 The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:
   Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220302
-for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:
+for you to fetch changes up to 268c11984e67867c22f53beb3c7f8b98900d66b2:
-  hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)
+  ui/cocoa.m: Remove unnecessary NSAutoreleasePools (2022-03-02 19:27:37 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * fsl-imx6: Fix incorrect Ethernet interrupt defines
+ * mps3-an547: Add missing user ahb interfaces
- * dump: Update correct kdump phys_base field for AArch64
+ * hw/arm/mps2-tz.c: Update AN547 documentation URL
- * char: i.MX: Add support for "TX complete" interrupt
+ * hw/input/tsc210x: Don't abort on bad SPI word widths
- * bcm2836/raspi: Fix various bugs resulting in panics trying
+ * hw/i2c: flatten pca954x mux device
-   to boot a Debian Linux kernel on raspi3
+ * target/arm: Support PSCI 1.1 and SMCCC 1.0
  * target/arm: Fix early free of TCG temp in handle_simd_shift_fpint_conv()
  * tests/qtest: add qtests for npcm7xx sdhci
  * Implement FEAT_LVA
  * Implement FEAT_LPA
  * Implement FEAT_LPA2 (but do not enable it yet)
  * Report KVM's actual PSCI version to guest in dtb
  * ui/cocoa.m: Fix updateUIInfo threading issues
  * ui/cocoa.m: Remove unnecessary NSAutoreleasePools
 ----------------------------------------------------------------
-Andrey Smirnov (2):
+Akihiko Odaki (1):
-      char: i.MX: Simplify imx_update()
+      target/arm: Support PSCI 1.1 and SMCCC 1.0
       char: i.MX: Add support for "TX complete" interrupt
-Guenter Roeck (1):
+Jimmy Brisson (1):
-      fsl-imx6: Swap Ethernet interrupt defines
+      mps3-an547: Add missing user ahb interfaces
-Peter Maydell (9):
+Patrick Venture (1):
-      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+      hw/i2c: flatten pca954x mux device
       hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
       hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
       hw/arm/bcm2386: Fix parent type of bcm2386
       hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
       hw/arm/bcm2836: Create proper bcm2837 device
       hw/arm/bcm2836: Use correct affinity values for BCM2837
       hw/arm/bcm2836: Hardcode correct CPU type
       hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
-Wei Huang (1):
+Peter Maydell (5):
-      dump: Update correct kdump phys_base field for AArch64
+      hw/arm/mps2-tz.c: Update AN547 documentation URL
       hw/input/tsc210x: Don't abort on bad SPI word widths
       target/arm: Report KVM's actual PSCI version to guest in dtb
       ui/cocoa.m: Fix updateUIInfo threading issues
       ui/cocoa.m: Remove unnecessary NSAutoreleasePools
- include/hw/arm/bcm2836.h     | 31 +++++++++++++---
+Richard Henderson (16):
- include/hw/arm/fsl-imx6.h    |  4 +-
+      hw/registerfields: Add FIELD_SEX<N> and FIELD_SDP<N>
- include/hw/char/imx_serial.h |  3 ++
+      target/arm: Set TCR_EL1.TSZ for user-only
- dump.c                       | 14 +++++--
+      target/arm: Fault on invalid TCR_ELx.TxSZ
- hw/arm/bcm2836.c             | 87 +++++++++++++++++++++++++++++++-------------
+      target/arm: Move arm_pamax out of line
- hw/arm/boot.c                | 12 ++++++
+      target/arm: Pass outputsize down to check_s2_mmu_setup
- hw/arm/raspi.c               | 77 +++++++++++++++++++++++++++++++--------
+      target/arm: Use MAKE_64BIT_MASK to compute indexmask
- hw/char/imx_serial.c         | 44 ++++++++++++++++------
+      target/arm: Honor TCR_ELx.{I}PS
- hw/net/imx_fec.c             | 28 +++++++++++++-
+      target/arm: Prepare DBGBVR and DBGWVR for FEAT_LVA
-files changed, 237 insertions(+), 63 deletions(-)
+      target/arm: Implement FEAT_LVA
       target/arm: Implement FEAT_LPA
       target/arm: Extend arm_fi_to_lfsc to level -1
       target/arm: Introduce tlbi_aa64_get_range
       target/arm: Fix TLBIRange.base for 16k and 64k pages
       target/arm: Validate tlbi TG matches translation granule in use
       target/arm: Advertise all page sizes for -cpu max
       target/arm: Implement FEAT_LPA2
+Shengtan Mao (1):
+      tests/qtest: add qtests for npcm7xx sdhci
+Wentao_Liang (1):
+      target/arm: Fix early free of TCG temp in handle_simd_shift_fpint_conv()
+ docs/system/arm/emulation.rst    |   3 +
+ include/hw/registerfields.h      |  48 +++++-
+ target/arm/cpu-param.h           |   4 +-
+ target/arm/cpu.h                 |  27 ++++
+ target/arm/internals.h           |  58 ++++---
+ target/arm/kvm-consts.h          |  14 +-
+ hw/arm/boot.c                    |  11 +-
+ hw/arm/mps2-tz.c                 |   6 +-
+ hw/i2c/i2c_mux_pca954x.c         |  77 ++-------
+ hw/input/tsc210x.c               |   8 +-
+ target/arm/cpu.c                 |   8 +-
+ target/arm/cpu64.c               |   7 +-
+ target/arm/helper.c              | 332 ++++++++++++++++++++++++++++++---------
+ target/arm/hvf/hvf.c             |  27 +++-
+ target/arm/kvm64.c               |  14 +-
+ target/arm/psci.c                |  35 ++++-
+ target/arm/translate-a64.c       |   2 +-
+ tests/qtest/npcm7xx_sdhci-test.c | 215 +++++++++++++++++++++++++
+ tests/qtest/meson.build          |   1 +
+ ui/cocoa.m                       |  31 ++--
+files changed, 736 insertions(+), 192 deletions(-)
+ create mode 100644 tests/qtest/npcm7xx_sdhci-test.c

-New patch
+[PULL 01/26] mps3-an547: Add missing user ahb interfaces
+From: Jimmy Brisson <jimmy.brisson@linaro.org>
+With these interfaces missing, TFM would delegate peripherals 0, 1,
+, 3 and 8, and qemu would ignore the delegation of interface 8, as
+it thought interface 4 was eth & USB.
+This patch corrects this behavior and allows TFM to delegate the
+eth & USB peripheral to NS mode.
+(The old QEMU behaviour was based on revision B of the AN547
+appnote; revision C corrects this error in the documentation,
+and this commit brings QEMU in to line with how the FPGA
+image really behaves.)
+Signed-off-by: Jimmy Brisson <jimmy.brisson@linaro.org>
+Message-id: 20220210210227.3203883-1-jimmy.brisson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: added commit message note clarifying that the old behaviour
+was a docs issue, not because there were two different versions
+of the FPGA image]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/mps2-tz.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/mps2-tz.c
++++ b/hw/arm/mps2-tz.c
+@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
+                 { "gpio1", make_unimp_dev, &mms->gpio[1], 0x41101000, 0x1000 },
+                 { "gpio2", make_unimp_dev, &mms->gpio[2], 0x41102000, 0x1000 },
+                 { "gpio3", make_unimp_dev, &mms->gpio[3], 0x41103000, 0x1000 },
++                { /* port 4 USER AHB interface 0 */ },
++                { /* port 5 USER AHB interface 1 */ },
++                { /* port 6 USER AHB interface 2 */ },
++                { /* port 7 USER AHB interface 3 */ },
+                 { "eth-usb", make_eth_usb, NULL, 0x41400000, 0x200000, { 49 } },
+             },
+         },
+--
+.25.1

-[Qemu-devel] [PULL 08/13] hw/arm/bcm2386: Fix parent type of bcm2386
+[PULL 02/26] hw/arm/mps2-tz.c: Update AN547 documentation URL
-The TypeInfo and state struct for bcm2386 disagree about what the
+The AN547 application note URL has changed: update our comment
-parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
+accordingly. (Rev B is still downloadable from the old URL,
-but the BCM2386State struct only defines the parent_obj field
+but there is a new Rev C of the document now.)
 as DeviceState. This would have caused problems if anything
 actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
 Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
 need any of the additional functionality TYPE_SYS_BUS_DEVICE
 provides.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20220221094144.426191-1-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 2 +-
+ hw/arm/mps2-tz.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/hw/arm/mps2-tz.c
-+++ b/hw/arm/bcm2836.c
++++ b/hw/arm/mps2-tz.c
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@
+  * Application Note AN524:
- static const TypeInfo bcm2836_type_info = {
+  * https://developer.arm.com/documentation/dai0524/latest/
-     .name = TYPE_BCM2836,
+  * Application Note AN547:
--    .parent = TYPE_SYS_BUS_DEVICE,
+- * https://developer.arm.com/-/media/Arm%20Developer%20Community/PDF/DAI0547B_SSE300_PLUS_U55_FPGA_for_mps3.pdf
-+    .parent = TYPE_DEVICE,
++ * https://developer.arm.com/documentation/dai0547/latest/
-     .instance_size = sizeof(BCM2836State),
+  *
-     .instance_init = bcm2836_init,
+  * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
-     .class_init = bcm2836_class_init,
+  * (ARM ECM0601256) for the details of some of the device layout:
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 05/13] hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+[PULL 03/26] hw/input/tsc210x: Don't abort on bad SPI word widths
-For the rpi1 and 2 we want to boot the Linux kernel via some
+The tsc210x doesn't support anything other than 16-bit reads on the
-custom setup code that makes sure that the SMC instruction
+SPI bus, but the guest can program the SPI controller to attempt
-acts as a no-op, because it's used for cache maintenance.
+them anyway. If this happens, don't abort QEMU, just log this as
-The rpi3 boots AArch64 kernels, which don't need SMC for
+a guest error.
 cache maintenance and always expect to be booted non-secure.
 Don't fill in the aarch32-specific parts of the binfo struct.
+This fixes our machine_arm_n8x0.py:N8x0Machine.test_n800
+acceptance test, which hits this assertion.
+The reason we hit the assertion is because the guest kernel thinks
+there is a TSC2005 on this SPI bus address, not a TSC210x.  (The n810
+*does* have a TSC2005 at this address.) The TSC2005 supports the
+-bit accesses which the guest driver makes, and the TSC210x does
+not (that is, our TSC210x emulation is not missing support for a word
+width the hardware can handle).  It's not clear whether the problem
+here is that the guest kernel incorrectly thinks the n800 has the
+same device at this SPI bus address as the n810, or that QEMU's n810
+board model doesn't get the SPI devices right.  At this late date
+there no longer appears to be any reliable information on the web
+about the hardware behaviour, but I am inclined to think this is a
+guest kernel bug.  In any case, we prefer not to abort QEMU for
+guest-triggerable conditions, so logging the error is the right thing
+to do.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/736
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20220221140750.514557-1-peter.maydell@linaro.org
 Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 17 +++++++++++++----
+ hw/input/tsc210x.c | 8 ++++++--
-file changed, 13 insertions(+), 4 deletions(-)
+file changed, 6 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/hw/input/tsc210x.c b/hw/input/tsc210x.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/hw/input/tsc210x.c
-+++ b/hw/arm/raspi.c
++++ b/hw/input/tsc210x.c
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+@@ -XXX,XX +XXX,XX @@
-     binfo.board_id = raspi_boardid[version];
+ #include "hw/hw.h"
-     binfo.ram_size = ram_size;
+ #include "audio/audio.h"
-     binfo.nb_cpus = smp_cpus;
+ #include "qemu/timer.h"
--    binfo.board_setup_addr = BOARDSETUP_ADDR;
++#include "qemu/log.h"
--    binfo.write_board_setup = write_board_setup;
+ #include "sysemu/reset.h"
--    binfo.secure_board_setup = true;
+ #include "ui/console.h"
--    binfo.secure_boot = true;
+ #include "hw/arm/omap.h"            /* For I2SCodec */
-+
+@@ -XXX,XX +XXX,XX @@ uint32_t tsc210x_txrx(void *opaque, uint32_t value, int len)
-+    if (version <= 2) {
+     TSC210xState *s = opaque;
-+        /* The rpi1 and 2 require some custom setup code to run in Secure
+     uint32_t ret = 0;
-+         * mode before booting a kernel (to set up the SMC vectors so
-+         * that we get a no-op SMC; this is used by Linux to call the
+-    if (len != 16)
-+         * firmware for some cache maintenance operations.
+-        hw_error("%s: FIXME: bad SPI word width %i\n", __func__, len);
-+         * The rpi3 doesn't need this.
++    if (len != 16) {
-+         */
++        qemu_log_mask(LOG_GUEST_ERROR,
-+        binfo.board_setup_addr = BOARDSETUP_ADDR;
++                      "%s: bad SPI word width %i\n", __func__, len);
-+        binfo.write_board_setup = write_board_setup;
++        return 0;
 +        binfo.secure_board_setup = true;
 +        binfo.secure_boot = true;
 +    }
-     /* Pi2 and Pi3 requires SMP setup */
+     /* TODO: sequential reads etc - how do we make sure the host doesn't
-     if (version >= 2) {
+      * unintentionally read out a conversion result from a register while
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 09/13] hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
+[PULL 04/26] hw/i2c: flatten pca954x mux device
-Our BCM2836 type is really a generic one that can be any of
+From: Patrick Venture <venture@google.com>
 the bcm283x family. Rename it accordingly. We change only
 the names which are visible via the header file to the
 rest of the QEMU code, leaving private function names
 in bcm2836.c as they are.
-This is a preliminary to making bcm283x be an abstract
+Previously this device created N subdevices which each owned an i2c bus.
-parent class to specific types for the bcm2836 and bcm2837.
+Now this device simply owns the N i2c busses directly.
+Tested: Verified devices behind mux are still accessible via qmp and i2c
+from within an arm32 SoC.
+Reviewed-by: Hao Wu <wuhaotsh@google.com>
+Signed-off-by: Patrick Venture <venture@google.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 20220202164533.1283668-1-venture@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
 ---
- include/hw/arm/bcm2836.h | 12 ++++++------
+ hw/i2c/i2c_mux_pca954x.c | 77 +++++++---------------------------------
- hw/arm/bcm2836.c         | 17 +++++++++--------
+file changed, 13 insertions(+), 64 deletions(-)
  hw/arm/raspi.c           | 16 ++++++++--------
 files changed, 23 insertions(+), 22 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/hw/i2c/i2c_mux_pca954x.c b/hw/i2c/i2c_mux_pca954x.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/hw/i2c/i2c_mux_pca954x.c
-+++ b/include/hw/arm/bcm2836.h
++++ b/hw/i2c/i2c_mux_pca954x.c
 @@ -XXX,XX +XXX,XX @@
- #include "hw/arm/bcm2835_peripherals.h"
+ #define PCA9548_CHANNEL_COUNT 8
- #include "hw/intc/bcm2836_control.h"
+ #define PCA9546_CHANNEL_COUNT 4
--#define TYPE_BCM2836 "bcm2836"
+-/*
--#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
+- * struct Pca954xChannel - The i2c mux device will have N of these states
-+#define TYPE_BCM283X "bcm283x"
+- * that own the i2c channel bus.
-+#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
+- * @bus: The owned channel bus.
+- * @enabled: Is this channel active?
--#define BCM2836_NCPUS 4
+- */
-+#define BCM283X_NCPUS 4
+-typedef struct Pca954xChannel {
+-    SysBusDevice parent;
--typedef struct BCM2836State {
+-
-+typedef struct BCM283XState {
+-    I2CBus       *bus;
-     /*< private >*/
+-
-     DeviceState parent_obj;
+-    bool         enabled;
-     /*< public >*/
+-} Pca954xChannel;
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
+-
-     char *cpu_type;
+-#define TYPE_PCA954X_CHANNEL "pca954x-channel"
-     uint32_t enabled_cpus;
+-#define PCA954X_CHANNEL(obj) \
+-    OBJECT_CHECK(Pca954xChannel, (obj), TYPE_PCA954X_CHANNEL)
--    ARMCPU cpus[BCM2836_NCPUS];
+-
-+    ARMCPU cpus[BCM283X_NCPUS];
+ /*
-     BCM2836ControlState control;
+  * struct Pca954xState - The pca954x state object.
-     BCM2835PeripheralState peripherals;
+  * @control: The value written to the mux control.
--} BCM2836State;
+@@ -XXX,XX +XXX,XX @@ typedef struct Pca954xState {
-+} BCM283XState;
+     uint8_t control;
- #endif /* BCM2836_H */
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+-    /* The channel i2c buses. */
-index XXXXXXX..XXXXXXX 100644
+-    Pca954xChannel channel[PCA9548_CHANNEL_COUNT];
---- a/hw/arm/bcm2836.c
++    bool enabled[PCA9548_CHANNEL_COUNT];
-+++ b/hw/arm/bcm2836.c
++    I2CBus *bus[PCA9548_CHANNEL_COUNT];
-@@ -XXX,XX +XXX,XX @@
+ } Pca954xState;
- static void bcm2836_init(Object *obj)
+ /*
@@ -XXX,XX +XXX,XX @@ static bool pca954x_match(I2CSlave *candidate, uint8_t address,
      }
      for (i = 0; i < mc->nchans; i++) {
 -        if (!mux->channel[i].enabled) {
 +        if (!mux->enabled[i]) {
              continue;
          }
 -        if (i2c_scan_bus(mux->channel[i].bus, address, broadcast,
 +        if (i2c_scan_bus(mux->bus[i], address, broadcast,
                           current_devs)) {
              if (!broadcast) {
                  return true;
@@ -XXX,XX +XXX,XX @@ static void pca954x_enable_channel(Pca954xState *s, uint8_t enable_mask)
       */
      for (i = 0; i < mc->nchans; i++) {
          if (enable_mask & (1 << i)) {
 -            s->channel[i].enabled = true;
 +            s->enabled[i] = true;
          } else {
 -            s->channel[i].enabled = false;
 +            s->enabled[i] = false;
          }
      }
  }
@@ -XXX,XX +XXX,XX @@ I2CBus *pca954x_i2c_get_bus(I2CSlave *mux, uint8_t channel)
      Pca954xState *pca954x = PCA954X(mux);
      g_assert(channel < pc->nchans);
 -    return I2C_BUS(qdev_get_child_bus(DEVICE(&pca954x->channel[channel]),
 -                                      "i2c-bus"));
 -}
 -
 -static void pca954x_channel_init(Object *obj)
 -{
 -    Pca954xChannel *s = PCA954X_CHANNEL(obj);
 -    s->bus = i2c_init_bus(DEVICE(s), "i2c-bus");
 -
 -    /* Start all channels as disabled. */
 -    s->enabled = false;
 -}
 -
 -static void pca954x_channel_class_init(ObjectClass *klass, void *data)
 -{
 -    DeviceClass *dc = DEVICE_CLASS(klass);
 -    dc->desc = "Pca954x Channel";
 +    return pca954x->bus[channel];
  }
  static void pca9546_class_init(ObjectClass *klass, void *data)
@@ -XXX,XX +XXX,XX @@ static void pca9548_class_init(ObjectClass *klass, void *data)
      s->nchans = PCA9548_CHANNEL_COUNT;
  }
 -static void pca954x_realize(DeviceState *dev, Error **errp)
 -{
 -    Pca954xState *s = PCA954X(dev);
 -    Pca954xClass *c = PCA954X_GET_CLASS(s);
 -    int i;
 -
 -    /* SMBus modules. Cannot fail. */
 -    for (i = 0; i < c->nchans; i++) {
 -        sysbus_realize(SYS_BUS_DEVICE(&s->channel[i]), &error_abort);
 -    }
 -}
 -
  static void pca954x_init(Object *obj)
  {
--    BCM2836State *s = BCM2836(obj);
+     Pca954xState *s = PCA954X(obj);
-+    BCM283XState *s = BCM283X(obj);
+     Pca954xClass *c = PCA954X_GET_CLASS(obj);
+     int i;
-     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
-     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
+-    /* Only initialize the children we expect. */
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
++    /* SMBus modules. Cannot fail. */
+     for (i = 0; i < c->nchans; i++) {
- static void bcm2836_realize(DeviceState *dev, Error **errp)
+-        object_initialize_child(obj, "channel[*]", &s->channel[i],
- {
+-                                TYPE_PCA954X_CHANNEL);
--    BCM2836State *s = BCM2836(dev);
++        g_autofree gchar *bus_name = g_strdup_printf("i2c.%d", i);
-+    BCM283XState *s = BCM283X(dev);
++
-     Object *obj;
++        /* start all channels as disabled. */
-     Error *err = NULL;
++        s->enabled[i] = false;
-     int n;
++        s->bus[i] = i2c_init_bus(DEVICE(s), bus_name);
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
+     }
      /* common peripherals from bcm2835 */
      obj = OBJECT(dev);
 -    for (n = 0; n < BCM2836_NCPUS; n++) {
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
          object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
                            s->cpu_type);
          object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
          qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 -    for (n = 0; n < BCM2836_NCPUS; n++) {
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
          /* Mirror bcm2836, which has clusterid set to 0xf
           * TODO: this should be converted to a property of ARM_CPU
           */
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
  }
- static Property bcm2836_props[] = {
+@@ -XXX,XX +XXX,XX @@ static void pca954x_class_init(ObjectClass *klass, void *data)
--    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
+     rc->phases.enter = pca954x_enter_reset;
--    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
-+    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
+     dc->desc = "Pca954x i2c-mux";
-+    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
+-    dc->realize = pca954x_realize;
-+                       BCM283X_NCPUS),
-     DEFINE_PROP_END_OF_LIST()
+     k->write_data = pca954x_write_data;
      k->receive_byte = pca954x_read_byte;
@@ -XXX,XX +XXX,XX @@ static const TypeInfo pca954x_info[] = {
          .parent        = TYPE_PCA954X,
          .class_init    = pca9548_class_init,
      },
 -    {
 -        .name = TYPE_PCA954X_CHANNEL,
 -        .parent = TYPE_SYS_BUS_DEVICE,
 -        .class_init = pca954x_channel_class_init,
 -        .instance_size = sizeof(Pca954xChannel),
 -        .instance_init = pca954x_channel_init,
 -    }
  };
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
+ DEFINE_TYPES(pca954x_info)
  }
  static const TypeInfo bcm2836_type_info = {
 -    .name = TYPE_BCM2836,
 +    .name = TYPE_BCM283X,
      .parent = TYPE_DEVICE,
 -    .instance_size = sizeof(BCM2836State),
 +    .instance_size = sizeof(BCM283XState),
      .instance_init = bcm2836_init,
      .class_init = bcm2836_class_init,
  };
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
  static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
  typedef struct RasPiState {
 -    BCM2836State soc;
 +    BCM283XState soc;
      MemoryRegion ram;
  } RasPiState;
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
      BusState *bus;
      DeviceState *carddev;
 -    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
 +    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
      object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                                &error_abort);
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
 -    mc->max_cpus = BCM2836_NCPUS;
 -    mc->min_cpus = BCM2836_NCPUS;
 -    mc->default_cpus = BCM2836_NCPUS;
 +    mc->max_cpus = BCM283X_NCPUS;
 +    mc->min_cpus = BCM283X_NCPUS;
 +    mc->default_cpus = BCM283X_NCPUS;
      mc->default_ram_size = 1024 * 1024 * 1024;
      mc->ignore_memory_transaction_failures = true;
  };
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
      mc->no_floppy = 1;
      mc->no_cdrom = 1;
      mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
 -    mc->max_cpus = BCM2836_NCPUS;
 -    mc->min_cpus = BCM2836_NCPUS;
 -    mc->default_cpus = BCM2836_NCPUS;
 +    mc->max_cpus = BCM283X_NCPUS;
 +    mc->min_cpus = BCM283X_NCPUS;
 +    mc->default_cpus = BCM283X_NCPUS;
      mc->default_ram_size = 1024 * 1024 * 1024;
  }
  DEFINE_MACHINE("raspi3", raspi3_machine_init)
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 06/13] hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
+[PULL 05/26] target/arm: Support PSCI 1.1 and SMCCC 1.0
-Add some assertions that if we're about to boot an AArch64 kernel,
+From: Akihiko Odaki <akihiko.odaki@gmail.com>
 the board code has not mistakenly set either secure_boot or
 secure_board_setup. It doesn't make sense to set secure_boot,
 because all AArch64 kernels must be booted in non-secure mode.
-It might in theory make sense to set secure_board_setup, but
+Support the latest PSCI on TCG and HVF. A 64-bit function called from
-we don't currently support that, because only the AArch32
+AArch32 now returns NOT_SUPPORTED, which is necessary to adhere to SMC
-bootloader[] code calls this hook; bootloader_aarch64[] does not.
+Calling Convention 1.0. It is still not compliant with SMCCC 1.3 since
-Since we don't have a current need for this functionality, just
+they do not implement mandatory functions.
 assert that we don't try to use it. If it's needed we'll add
 it later.
+Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com>
+Message-id: 20220213035753.34577-1-akihiko.odaki@gmail.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: update MISMATCH_CHECK checks on PSCI_VERSION macros to match]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 7 +++++++
+ target/arm/kvm-consts.h | 13 +++++++++----
-file changed, 7 insertions(+)
+ hw/arm/boot.c           | 12 +++++++++---
  target/arm/cpu.c        |  5 +++--
  target/arm/hvf/hvf.c    | 27 ++++++++++++++++++++++++++-
  target/arm/kvm64.c      |  2 +-
  target/arm/psci.c       | 35 ++++++++++++++++++++++++++++++++---
 files changed, 80 insertions(+), 14 deletions(-)
+diff --git a/target/arm/kvm-consts.h b/target/arm/kvm-consts.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/kvm-consts.h
++++ b/target/arm/kvm-consts.h
+@@ -XXX,XX +XXX,XX @@ MISMATCH_CHECK(QEMU_PSCI_0_1_FN_MIGRATE, KVM_PSCI_FN_MIGRATE);
+ #define QEMU_PSCI_0_2_FN64_AFFINITY_INFO QEMU_PSCI_0_2_FN64(4)
+ #define QEMU_PSCI_0_2_FN64_MIGRATE QEMU_PSCI_0_2_FN64(5)
++#define QEMU_PSCI_1_0_FN_PSCI_FEATURES QEMU_PSCI_0_2_FN(10)
++
+ MISMATCH_CHECK(QEMU_PSCI_0_2_FN_CPU_SUSPEND, PSCI_0_2_FN_CPU_SUSPEND);
+ MISMATCH_CHECK(QEMU_PSCI_0_2_FN_CPU_OFF, PSCI_0_2_FN_CPU_OFF);
+ MISMATCH_CHECK(QEMU_PSCI_0_2_FN_CPU_ON, PSCI_0_2_FN_CPU_ON);
+@@ -XXX,XX +XXX,XX @@ MISMATCH_CHECK(QEMU_PSCI_0_2_FN_MIGRATE, PSCI_0_2_FN_MIGRATE);
+ MISMATCH_CHECK(QEMU_PSCI_0_2_FN64_CPU_SUSPEND, PSCI_0_2_FN64_CPU_SUSPEND);
+ MISMATCH_CHECK(QEMU_PSCI_0_2_FN64_CPU_ON, PSCI_0_2_FN64_CPU_ON);
+ MISMATCH_CHECK(QEMU_PSCI_0_2_FN64_MIGRATE, PSCI_0_2_FN64_MIGRATE);
++MISMATCH_CHECK(QEMU_PSCI_1_0_FN_PSCI_FEATURES, PSCI_1_0_FN_PSCI_FEATURES);
+ /* PSCI v0.2 return values used by TCG emulation of PSCI */
+ /* No Trusted OS migration to worry about when offlining CPUs */
+ #define QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED        2
+-/* We implement version 0.2 only */
+-#define QEMU_PSCI_0_2_RET_VERSION_0_2                       2
++#define QEMU_PSCI_VERSION_0_1                     0x00001
++#define QEMU_PSCI_VERSION_0_2                     0x00002
++#define QEMU_PSCI_VERSION_1_1                     0x10001
+ MISMATCH_CHECK(QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED, PSCI_0_2_TOS_MP);
+-MISMATCH_CHECK(QEMU_PSCI_0_2_RET_VERSION_0_2,
+-               (PSCI_VERSION_MAJOR(0) | PSCI_VERSION_MINOR(2)));
++/* We don't bother to check every possible version value */
++MISMATCH_CHECK(QEMU_PSCI_VERSION_0_2, PSCI_VERSION(0, 2));
++MISMATCH_CHECK(QEMU_PSCI_VERSION_1_1, PSCI_VERSION(1, 1));
+ /* PSCI return values (inclusive of all PSCI versions) */
+ #define QEMU_PSCI_RET_SUCCESS                     0
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
-                     } else {
+     }
-                         env->pstate = PSTATE_MODE_EL1h;
-                     }
+     qemu_fdt_add_subnode(fdt, "/psci");
-+                    /* AArch64 kernels never boot in secure mode */
+-    if (armcpu->psci_version == 2) {
-+                    assert(!info->secure_boot);
+-        const char comp[] = "arm,psci-0.2\0arm,psci";
-+                    /* This hook is only supported for AArch32 currently:
+-        qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
-+                     * bootloader_aarch64[] will not call the hook, and
++    if (armcpu->psci_version == QEMU_PSCI_VERSION_0_2 ||
-+                     * the code above has already dropped us into EL2 or EL1.
++        armcpu->psci_version == QEMU_PSCI_VERSION_1_1) {
-+                     */
++        if (armcpu->psci_version == QEMU_PSCI_VERSION_0_2) {
-+                    assert(!info->secure_board_setup);
++            const char comp[] = "arm,psci-0.2\0arm,psci";
-                 }
++            qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
++        } else {
-                 /* Set to non-secure if not a secure boot */
++            const char comp[] = "arm,psci-1.0\0arm,psci-0.2\0arm,psci";
 +            qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
 +        }
          cpu_off_fn = QEMU_PSCI_0_2_FN_CPU_OFF;
          if (arm_feature(&armcpu->env, ARM_FEATURE_AARCH64)) {
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
       * picky DTB consumer will also provide a helpful error message.
       */
      cpu->dtb_compatible = "qemu,unknown";
 -    cpu->psci_version = 1; /* By default assume PSCI v0.1 */
 +    cpu->psci_version = QEMU_PSCI_VERSION_0_1; /* By default assume PSCI v0.1 */
      cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
      if (tcg_enabled() || hvf_enabled()) {
 -        cpu->psci_version = 2; /* TCG and HVF implement PSCI 0.2 */
 +        /* TCG and HVF implement PSCI 1.1 */
 +        cpu->psci_version = QEMU_PSCI_VERSION_1_1;
      }
  }
 diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/hvf/hvf.c
 +++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@ static bool hvf_handle_psci_call(CPUState *cpu)
      switch (param[0]) {
      case QEMU_PSCI_0_2_FN_PSCI_VERSION:
 -        ret = QEMU_PSCI_0_2_RET_VERSION_0_2;
 +        ret = QEMU_PSCI_VERSION_1_1;
          break;
      case QEMU_PSCI_0_2_FN_MIGRATE_INFO_TYPE:
          ret = QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED; /* No trusted OS */
@@ -XXX,XX +XXX,XX @@ static bool hvf_handle_psci_call(CPUState *cpu)
      case QEMU_PSCI_0_2_FN_MIGRATE:
          ret = QEMU_PSCI_RET_NOT_SUPPORTED;
          break;
 +    case QEMU_PSCI_1_0_FN_PSCI_FEATURES:
 +        switch (param[1]) {
 +        case QEMU_PSCI_0_2_FN_PSCI_VERSION:
 +        case QEMU_PSCI_0_2_FN_MIGRATE_INFO_TYPE:
 +        case QEMU_PSCI_0_2_FN_AFFINITY_INFO:
 +        case QEMU_PSCI_0_2_FN64_AFFINITY_INFO:
 +        case QEMU_PSCI_0_2_FN_SYSTEM_RESET:
 +        case QEMU_PSCI_0_2_FN_SYSTEM_OFF:
 +        case QEMU_PSCI_0_1_FN_CPU_ON:
 +        case QEMU_PSCI_0_2_FN_CPU_ON:
 +        case QEMU_PSCI_0_2_FN64_CPU_ON:
 +        case QEMU_PSCI_0_1_FN_CPU_OFF:
 +        case QEMU_PSCI_0_2_FN_CPU_OFF:
 +        case QEMU_PSCI_0_1_FN_CPU_SUSPEND:
 +        case QEMU_PSCI_0_2_FN_CPU_SUSPEND:
 +        case QEMU_PSCI_0_2_FN64_CPU_SUSPEND:
 +        case QEMU_PSCI_1_0_FN_PSCI_FEATURES:
 +            ret = 0;
 +            break;
 +        case QEMU_PSCI_0_1_FN_MIGRATE:
 +        case QEMU_PSCI_0_2_FN_MIGRATE:
 +        default:
 +            ret = QEMU_PSCI_RET_NOT_SUPPORTED;
 +        }
 +        break;
      default:
          return false;
      }
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
          cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_POWER_OFF;
      }
      if (kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PSCI_0_2)) {
 -        cpu->psci_version = 2;
 +        cpu->psci_version = QEMU_PSCI_VERSION_0_2;
          cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PSCI_0_2;
      }
      if (!arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
 diff --git a/target/arm/psci.c b/target/arm/psci.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/psci.c
 +++ b/target/arm/psci.c
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu)
  {
      /*
       * This function partially implements the logic for dispatching Power State
 -     * Coordination Interface (PSCI) calls (as described in ARM DEN 0022B.b),
 +     * Coordination Interface (PSCI) calls (as described in ARM DEN 0022D.b),
       * to the extent required for bringing up and taking down secondary cores,
       * and for handling reset and poweroff requests.
       * Additional information about the calling convention used is available in
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu)
      }
      if ((param[0] & QEMU_PSCI_0_2_64BIT) && !is_a64(env)) {
 -        ret = QEMU_PSCI_RET_INVALID_PARAMS;
 +        ret = QEMU_PSCI_RET_NOT_SUPPORTED;
          goto err;
      }
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu)
          ARMCPU *target_cpu;
      case QEMU_PSCI_0_2_FN_PSCI_VERSION:
 -        ret = QEMU_PSCI_0_2_RET_VERSION_0_2;
 +        ret = QEMU_PSCI_VERSION_1_1;
          break;
      case QEMU_PSCI_0_2_FN_MIGRATE_INFO_TYPE:
          ret = QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED; /* No trusted OS */
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu)
          }
          helper_wfi(env, 4);
          break;
 +    case QEMU_PSCI_1_0_FN_PSCI_FEATURES:
 +        switch (param[1]) {
 +        case QEMU_PSCI_0_2_FN_PSCI_VERSION:
 +        case QEMU_PSCI_0_2_FN_MIGRATE_INFO_TYPE:
 +        case QEMU_PSCI_0_2_FN_AFFINITY_INFO:
 +        case QEMU_PSCI_0_2_FN64_AFFINITY_INFO:
 +        case QEMU_PSCI_0_2_FN_SYSTEM_RESET:
 +        case QEMU_PSCI_0_2_FN_SYSTEM_OFF:
 +        case QEMU_PSCI_0_1_FN_CPU_ON:
 +        case QEMU_PSCI_0_2_FN_CPU_ON:
 +        case QEMU_PSCI_0_2_FN64_CPU_ON:
 +        case QEMU_PSCI_0_1_FN_CPU_OFF:
 +        case QEMU_PSCI_0_2_FN_CPU_OFF:
 +        case QEMU_PSCI_0_1_FN_CPU_SUSPEND:
 +        case QEMU_PSCI_0_2_FN_CPU_SUSPEND:
 +        case QEMU_PSCI_0_2_FN64_CPU_SUSPEND:
 +        case QEMU_PSCI_1_0_FN_PSCI_FEATURES:
 +            if (!(param[1] & QEMU_PSCI_0_2_64BIT) || is_a64(env)) {
 +                ret = 0;
 +                break;
 +            }
 +            /* fallthrough */
 +        case QEMU_PSCI_0_1_FN_MIGRATE:
 +        case QEMU_PSCI_0_2_FN_MIGRATE:
 +        default:
 +            ret = QEMU_PSCI_RET_NOT_SUPPORTED;
 +            break;
 +        }
 +        break;
      case QEMU_PSCI_0_1_FN_MIGRATE:
      case QEMU_PSCI_0_2_FN_MIGRATE:
      default:
 --
-.16.2
+.25.1

-New patch
+[PULL 06/26] target/arm: Fix early free of TCG temp in handle_simd_shift_fpint_conv()
+From: Wentao_Liang <Wentao_Liang_g@163.com>
+handle_simd_shift_fpint_conv() was accidentally freeing the TCG
+temporary tcg_fpstatus too early, before the last use of it.  Move
+the free down to where it belongs.
+Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+[PMM: cleaned up commit message]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-a64.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
+         }
+     }
+-    tcg_temp_free_ptr(tcg_fpstatus);
+     tcg_temp_free_i32(tcg_shift);
+     gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
++    tcg_temp_free_ptr(tcg_fpstatus);
+     tcg_temp_free_i32(tcg_rmode);
+ }
+--
+.25.1

-New patch
+[PULL 07/26] tests/qtest: add qtests for npcm7xx sdhci
+From: Shengtan Mao <stmao@google.com>
+Reviewed-by: Hao Wu <wuhaotsh@google.com>
+Reviewed-by: Chris Rauer <crauer@google.com>
+Signed-off-by: Shengtan Mao <stmao@google.com>
+Signed-off-by: Patrick Venture <venture@google.com>
+Message-id: 20220225174451.192304-1-wuhaotsh@google.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ tests/qtest/npcm7xx_sdhci-test.c | 215 +++++++++++++++++++++++++++++++
+ tests/qtest/meson.build          |   1 +
+files changed, 216 insertions(+)
+ create mode 100644 tests/qtest/npcm7xx_sdhci-test.c
+diff --git a/tests/qtest/npcm7xx_sdhci-test.c b/tests/qtest/npcm7xx_sdhci-test.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/tests/qtest/npcm7xx_sdhci-test.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * QTests for NPCM7xx SD-3.0 / MMC-4.51 Host Controller
++ *
++ * Copyright (c) 2022 Google LLC
++ *
++ * This program is free software; you can redistribute it and/or modify it
++ * under the terms of the GNU General Public License as published by the
++ * Free Software Foundation; either version 2 of the License, or
++ * (at your option) any later version.
++ *
++ * This program is distributed in the hope that it will be useful, but WITHOUT
++ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
++ * for more details.
++ */
++
++#include "qemu/osdep.h"
++#include "hw/sd/npcm7xx_sdhci.h"
++
++#include "libqos/libqtest.h"
++#include "libqtest-single.h"
++#include "libqos/sdhci-cmd.h"
++
++#define NPCM7XX_REG_SIZE 0x100
++#define NPCM7XX_MMC_BA 0xF0842000
++#define NPCM7XX_BLK_SIZE 512
++#define NPCM7XX_TEST_IMAGE_SIZE (1 << 30)
++
++char *sd_path;
++
++static QTestState *setup_sd_card(void)
++{
++    QTestState *qts = qtest_initf(
++        "-machine kudo-bmc "
++        "-device sd-card,drive=drive0 "
++        "-drive id=drive0,if=none,file=%s,format=raw,auto-read-only=off",
++        sd_path);
++
++    qtest_writew(qts, NPCM7XX_MMC_BA + SDHC_SWRST, SDHC_RESET_ALL);
++    qtest_writew(qts, NPCM7XX_MMC_BA + SDHC_CLKCON,
++                 SDHC_CLOCK_SDCLK_EN | SDHC_CLOCK_INT_STABLE |
++                     SDHC_CLOCK_INT_EN);
++    sdhci_cmd_regs(qts, NPCM7XX_MMC_BA, 0, 0, 0, 0, SDHC_APP_CMD);
++    sdhci_cmd_regs(qts, NPCM7XX_MMC_BA, 0, 0, 0x41200000, 0, (41 << 8));
++    sdhci_cmd_regs(qts, NPCM7XX_MMC_BA, 0, 0, 0, 0, SDHC_ALL_SEND_CID);
++    sdhci_cmd_regs(qts, NPCM7XX_MMC_BA, 0, 0, 0, 0, SDHC_SEND_RELATIVE_ADDR);
++    sdhci_cmd_regs(qts, NPCM7XX_MMC_BA, 0, 0, 0x45670000, 0,
++                   SDHC_SELECT_DESELECT_CARD);
++
++    return qts;
++}
++
++static void write_sdread(QTestState *qts, const char *msg)
++{
++    int fd, ret;
++    size_t len = strlen(msg);
++    char *rmsg = g_malloc(len);
++
++    /* write message to sd */
++    fd = open(sd_path, O_WRONLY);
++    g_assert(fd >= 0);
++    ret = write(fd, msg, len);
++    close(fd);
++    g_assert(ret == len);
++
++    /* read message using sdhci */
++    ret = sdhci_read_cmd(qts, NPCM7XX_MMC_BA, rmsg, len);
++    g_assert(ret == len);
++    g_assert(!memcmp(rmsg, msg, len));
++
++    g_free(rmsg);
++}
++
++/* Check MMC can read values from sd */
++static void test_read_sd(void)
++{
++    QTestState *qts = setup_sd_card();
++
++    write_sdread(qts, "hello world");
++    write_sdread(qts, "goodbye");
++
++    qtest_quit(qts);
++}
++
++static void sdwrite_read(QTestState *qts, const char *msg)
++{
++    int fd, ret;
++    size_t len = strlen(msg);
++    char *rmsg = g_malloc(len);
++
++    /* write message using sdhci */
++    sdhci_write_cmd(qts, NPCM7XX_MMC_BA, msg, len, NPCM7XX_BLK_SIZE);
++
++    /* read message from sd */
++    fd = open(sd_path, O_RDONLY);
++    g_assert(fd >= 0);
++    ret = read(fd, rmsg, len);
++    close(fd);
++    g_assert(ret == len);
++
++    g_assert(!memcmp(rmsg, msg, len));
++
++    g_free(rmsg);
++}
++
++/* Check MMC can write values to sd */
++static void test_write_sd(void)
++{
++    QTestState *qts = setup_sd_card();
++
++    sdwrite_read(qts, "hello world");
++    sdwrite_read(qts, "goodbye");
++
++    qtest_quit(qts);
++}
++
++/* Check SDHCI has correct default values. */
++static void test_reset(void)
++{
++    QTestState *qts = qtest_init("-machine kudo-bmc");
++    uint64_t addr = NPCM7XX_MMC_BA;
++    uint64_t end_addr = addr + NPCM7XX_REG_SIZE;
++    uint16_t prstvals_resets[] = {NPCM7XX_PRSTVALS_0_RESET,
++                                  NPCM7XX_PRSTVALS_1_RESET,
++                                  0,
++                                  NPCM7XX_PRSTVALS_3_RESET,
++                                  0,
++                                  0};
++    int i;
++    uint32_t mask;
++
++    while (addr < end_addr) {
++        switch (addr - NPCM7XX_MMC_BA) {
++        case SDHC_PRNSTS:
++            /*
++             * ignores bits 20 to 24: they are changed when reading registers
++             */
++            mask = 0x1f00000;
++            g_assert_cmphex(qtest_readl(qts, addr) | mask, ==,
++                            NPCM7XX_PRSNTS_RESET | mask);
++            addr += 4;
++            break;
++        case SDHC_BLKGAP:
++            g_assert_cmphex(qtest_readb(qts, addr), ==, NPCM7XX_BLKGAP_RESET);
++            addr += 1;
++            break;
++        case SDHC_CAPAB:
++            g_assert_cmphex(qtest_readq(qts, addr), ==, NPCM7XX_CAPAB_RESET);
++            addr += 8;
++            break;
++        case SDHC_MAXCURR:
++            g_assert_cmphex(qtest_readq(qts, addr), ==, NPCM7XX_MAXCURR_RESET);
++            addr += 8;
++            break;
++        case SDHC_HCVER:
++            g_assert_cmphex(qtest_readw(qts, addr), ==, NPCM7XX_HCVER_RESET);
++            addr += 2;
++            break;
++        case NPCM7XX_PRSTVALS:
++            for (i = 0; i < NPCM7XX_PRSTVALS_SIZE; ++i) {
++                g_assert_cmphex(qtest_readw(qts, addr + 2 * i), ==,
++                                prstvals_resets[i]);
++            }
++            addr += NPCM7XX_PRSTVALS_SIZE * 2;
++            break;
++        default:
++            g_assert_cmphex(qtest_readb(qts, addr), ==, 0);
++            addr += 1;
++        }
++    }
++
++    qtest_quit(qts);
++}
++
++static void drive_destroy(void)
++{
++    unlink(sd_path);
++    g_free(sd_path);
++}
++
++static void drive_create(void)
++{
++    int fd, ret;
++    GError *error = NULL;
++
++    /* Create a temporary raw image */
++    fd = g_file_open_tmp("sdhci_XXXXXX", &sd_path, &error);
++    if (fd == -1) {
++        fprintf(stderr, "unable to create sdhci file: %s\n", error->message);
++        g_error_free(error);
++    }
++    g_assert(sd_path != NULL);
++
++    ret = ftruncate(fd, NPCM7XX_TEST_IMAGE_SIZE);
++    g_assert_cmpint(ret, ==, 0);
++    g_message("%s", sd_path);
++    close(fd);
++}
++
++int main(int argc, char **argv)
++{
++    int ret;
++
++    drive_create();
++
++    g_test_init(&argc, &argv, NULL);
++
++    qtest_add_func("npcm7xx_sdhci/reset", test_reset);
++    qtest_add_func("npcm7xx_sdhci/write_sd", test_write_sd);
++    qtest_add_func("npcm7xx_sdhci/read_sd", test_read_sd);
++
++    ret = g_test_run();
++    drive_destroy();
++    return ret;
++}
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/meson.build
++++ b/tests/qtest/meson.build
+@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
+    'npcm7xx_gpio-test',
+    'npcm7xx_pwm-test',
+    'npcm7xx_rng-test',
++   'npcm7xx_sdhci-test',
+    'npcm7xx_smbus-test',
+    'npcm7xx_timer-test',
+    'npcm7xx_watchdog_timer-test'] + \
+--
+.25.1

-[Qemu-devel] [PULL 04/13] char: i.MX: Add support for "TX complete" interrupt
+[PULL 08/26] hw/registerfields: Add FIELD_SEX<N> and FIELD_SDP<N>
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Add support for "TX complete"/TXDC interrupt generate by real HW since
+Add new macros to manipulate signed fields within the register.
 it is needed to support guests other than Linux.
-Based on the patch by Bill Paul as found here:
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-https://bugs.launchpad.net/qemu/+bug/1753314
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-2-richard.henderson@linaro.org
-Cc: qemu-devel@nongnu.org
+Suggested-by: Peter Maydell <peter.maydell@linaro.org>
-Cc: qemu-arm@nongnu.org
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Cc: Bill Paul <wpaul@windriver.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Bill Paul <wpaul@windriver.com>
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/char/imx_serial.h |  3 +++
+ include/hw/registerfields.h | 48 ++++++++++++++++++++++++++++++++++++-
- hw/char/imx_serial.c         | 20 +++++++++++++++++---
+file changed, 47 insertions(+), 1 deletion(-)
 files changed, 20 insertions(+), 3 deletions(-)
-diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
+diff --git a/include/hw/registerfields.h b/include/hw/registerfields.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/char/imx_serial.h
+--- a/include/hw/registerfields.h
-+++ b/include/hw/char/imx_serial.h
++++ b/include/hw/registerfields.h
 @@ -XXX,XX +XXX,XX @@
- #define UCR2_RXEN       (1<<1)    /* Receiver enable */
+     extract64((storage), R_ ## reg ## _ ## field ## _SHIFT,               \
- #define UCR2_SRST       (1<<0)    /* Reset complete */
+               R_ ## reg ## _ ## field ## _LENGTH)
-+#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
++#define FIELD_SEX8(storage, reg, field)                                   \
 +    sextract8((storage), R_ ## reg ## _ ## field ## _SHIFT,               \
 +              R_ ## reg ## _ ## field ## _LENGTH)
 +#define FIELD_SEX16(storage, reg, field)                                  \
 +    sextract16((storage), R_ ## reg ## _ ## field ## _SHIFT,              \
 +               R_ ## reg ## _ ## field ## _LENGTH)
 +#define FIELD_SEX32(storage, reg, field)                                  \
 +    sextract32((storage), R_ ## reg ## _ ## field ## _SHIFT,              \
 +               R_ ## reg ## _ ## field ## _LENGTH)
 +#define FIELD_SEX64(storage, reg, field)                                  \
 +    sextract64((storage), R_ ## reg ## _ ## field ## _SHIFT,              \
 +               R_ ## reg ## _ ## field ## _LENGTH)
 +
- #define UTS1_TXEMPTY    (1<<6)
+ /* Extract a field from an array of registers */
- #define UTS1_RXEMPTY    (1<<5)
+ #define ARRAY_FIELD_EX32(regs, reg, field)                                \
- #define UTS1_TXFULL     (1<<4)
+     FIELD_EX32((regs)[R_ ## reg], reg, field)
@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
      uint32_t ubmr;
      uint32_t ubrc;
      uint32_t ucr3;
 +    uint32_t ucr4;
      qemu_irq irq;
      CharBackend chr;
 diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/imx_serial.c
 +++ b/hw/char/imx_serial.c
 @@ -XXX,XX +XXX,XX @@
+     _d; })
- static const VMStateDescription vmstate_imx_serial = {
+ #define FIELD_DP64(storage, reg, field, val) ({                           \
-     .name = TYPE_IMX_SERIAL,
+     struct {                                                              \
--    .version_id = 1,
+-        uint64_t v:R_ ## reg ## _ ## field ## _LENGTH;                \
--    .minimum_version_id = 1,
++        uint64_t v:R_ ## reg ## _ ## field ## _LENGTH;                    \
-+    .version_id = 2,
++    } _v = { .v = val };                                                  \
-+    .minimum_version_id = 2,
++    uint64_t _d;                                                          \
-     .fields = (VMStateField[]) {
++    _d = deposit64((storage), R_ ## reg ## _ ## field ## _SHIFT,          \
-         VMSTATE_INT32(readbuff, IMXSerialState),
++                  R_ ## reg ## _ ## field ## _LENGTH, _v.v);              \
-         VMSTATE_UINT32(usr1, IMXSerialState),
++    _d; })
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
          VMSTATE_UINT32(ubmr, IMXSerialState),
          VMSTATE_UINT32(ubrc, IMXSerialState),
          VMSTATE_UINT32(ucr3, IMXSerialState),
 +        VMSTATE_UINT32(ucr4, IMXSerialState),
          VMSTATE_END_OF_LIST()
      },
  };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
       * unfortunately.
       */
      mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
 +    /*
 +     * TCEN and TXDC are both bit 3
 +     */
 +    mask |= s->ucr4 & UCR4_TCEN;
 +
-     usr2 = s->usr2 & mask;
++#define FIELD_SDP8(storage, reg, field, val) ({                           \
++    struct {                                                              \
-     qemu_set_irq(s->irq, usr1 || usr2);
++        signed int v:R_ ## reg ## _ ## field ## _LENGTH;                  \
-@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
++    } _v = { .v = val };                                                  \
-         return s->ucr3;
++    uint8_t _d;                                                           \
++    _d = deposit32((storage), R_ ## reg ## _ ## field ## _SHIFT,          \
-     case 0x23: /* UCR4 */
++                  R_ ## reg ## _ ## field ## _LENGTH, _v.v);              \
-+        return s->ucr4;
++    _d; })
-+
++#define FIELD_SDP16(storage, reg, field, val) ({                          \
-     case 0x29: /* BRM Incremental */
++    struct {                                                              \
-         return 0x0; /* TODO */
++        signed int v:R_ ## reg ## _ ## field ## _LENGTH;                  \
++    } _v = { .v = val };                                                  \
-@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
++    uint16_t _d;                                                          \
-              * qemu_chr_fe_write and background I/O callbacks */
++    _d = deposit32((storage), R_ ## reg ## _ ## field ## _SHIFT,          \
-             qemu_chr_fe_write_all(&s->chr, &ch, 1);
++                  R_ ## reg ## _ ## field ## _LENGTH, _v.v);              \
-             s->usr1 &= ~USR1_TRDY;
++    _d; })
-+            s->usr2 &= ~USR2_TXDC;
++#define FIELD_SDP32(storage, reg, field, val) ({                          \
-             imx_update(s);
++    struct {                                                              \
-             s->usr1 |= USR1_TRDY;
++        signed int v:R_ ## reg ## _ ## field ## _LENGTH;                  \
-+            s->usr2 |= USR2_TXDC;
++    } _v = { .v = val };                                                  \
-             imx_update(s);
++    uint32_t _d;                                                          \
-         }
++    _d = deposit32((storage), R_ ## reg ## _ ## field ## _SHIFT,          \
-         break;
++                  R_ ## reg ## _ ## field ## _LENGTH, _v.v);              \
-@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
++    _d; })
-         s->ucr3 = value & 0xffff;
++#define FIELD_SDP64(storage, reg, field, val) ({                          \
-         break;
++    struct {                                                              \
++        int64_t v:R_ ## reg ## _ ## field ## _LENGTH;                     \
--    case 0x2d: /* UTS1 */
+     } _v = { .v = val };                                                  \
-     case 0x23: /* UCR4 */
+     uint64_t _d;                                                          \
-+        s->ucr4 = value & 0xffff;
+     _d = deposit64((storage), R_ ## reg ## _ ## field ## _SHIFT,          \
 +        imx_update(s);
 +        break;
 +
 +    case 0x2d: /* UTS1 */
          qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
                        HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
          /* TODO */
 --
-.16.2
+.25.1

-New patch
+[PULL 09/26] target/arm: Set TCR_EL1.TSZ for user-only
+From: Richard Henderson <richard.henderson@linaro.org>
+Set this as the kernel would, to 48 bits, to keep the computation
+of the address space correct for PAuth.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-3-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.c | 3 ++-
+file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
+                 aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
+         }
+         /*
++         * Enable 48-bit address space (TODO: take reserved_va into account).
+          * Enable TBI0 but not TBI1.
+          * Note that this must match useronly_clean_ptr.
+          */
+-        env->cp15.tcr_el[1].raw_tcr = (1ULL << 37);
++        env->cp15.tcr_el[1].raw_tcr = 5 | (1ULL << 37);
+         /* Enable MTE */
+         if (cpu_isar_feature(aa64_mte, cpu)) {
+--
+.25.1

-New patch
+[PULL 10/26] target/arm: Fault on invalid TCR_ELx.TxSZ
+From: Richard Henderson <richard.henderson@linaro.org>
+Without FEAT_LVA, the behaviour of programming an invalid value
+is IMPLEMENTATION DEFINED.  With FEAT_LVA, programming an invalid
+minimum value requires a Translation fault.
+It is most self-consistent to choose to generate the fault always.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-4-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/internals.h |  1 +
+ target/arm/helper.c    | 32 ++++++++++++++++++++++++++++----
+files changed, 29 insertions(+), 4 deletions(-)
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
+     bool hpd        : 1;
+     bool using16k   : 1;
+     bool using64k   : 1;
++    bool tsz_oob    : 1;  /* tsz has been clamped to legal range */
+ } ARMVAParameters;
+ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+                                    ARMMMUIdx mmu_idx, bool data)
+ {
+     uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
+-    bool epd, hpd, using16k, using64k;
+-    int select, tsz, tbi, max_tsz;
++    bool epd, hpd, using16k, using64k, tsz_oob;
++    int select, tsz, tbi, max_tsz, min_tsz;
+     if (!regime_has_2_ranges(mmu_idx)) {
+         select = 0;
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+     } else {
+         max_tsz = 39;
+     }
++    min_tsz = 16;  /* TODO: ARMv8.2-LVA  */
+-    tsz = MIN(tsz, max_tsz);
+-    tsz = MAX(tsz, 16);  /* TODO: ARMv8.2-LVA  */
++    if (tsz > max_tsz) {
++        tsz = max_tsz;
++        tsz_oob = true;
++    } else if (tsz < min_tsz) {
++        tsz = min_tsz;
++        tsz_oob = true;
++    } else {
++        tsz_oob = false;
++    }
+     /* Present TBI as a composite with TBID.  */
+     tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+         .hpd = hpd,
+         .using16k = using16k,
+         .using64k = using64k,
++        .tsz_oob = tsz_oob,
+     };
+ }
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
+         param = aa64_va_parameters(env, address, mmu_idx,
+                                    access_type != MMU_INST_FETCH);
+         level = 0;
++
++        /*
++         * If TxSZ is programmed to a value larger than the maximum,
++         * or smaller than the effective minimum, it is IMPLEMENTATION
++         * DEFINED whether we behave as if the field were programmed
++         * within bounds, or if a level 0 Translation fault is generated.
++         *
++         * With FEAT_LVA, fault on less than minimum becomes required,
++         * so our choice is to always raise the fault.
++         */
++        if (param.tsz_oob) {
++            fault_type = ARMFault_Translation;
++            goto do_fault;
++        }
++
+         addrsize = 64 - 8 * param.tbi;
+         inputsize = 64 - param.tsz;
+     } else {
+--
+.25.1

-[Qemu-devel] [PULL 01/13] fsl-imx6: Swap Ethernet interrupt defines
+[PULL 11/26] target/arm: Move arm_pamax out of line
-From: Guenter Roeck <linux@roeck-us.net>
+From: Richard Henderson <richard.henderson@linaro.org>
-The sabrelite machine model used by qemu-system-arm is based on the
+We will shortly share parts of this function with other portions
-Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
+of address translation.
 controller which is supported in QEMU using the imx_fec.c module
 (actually called imx.enet for this model.)
-The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
-imx.enet device like this:
- #define FSL_IMX6_ENET_MAC_1588_IRQ 118
- #define FSL_IMX6_ENET_MAC_IRQ 119
-According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
-page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
-interrupts are as follows.
-ENET MAC 0 IRQ
-ENET MAC 0 1588 Timer interrupt
-where
-- 32 == 118
-- 32 == 119
-In other words, the vector definitions in the fsl-imx6.h file are reversed.
-Fixing the interrupts alone causes problems with older Linux kernels:
-The Ethernet interface will fail to probe with Linux v4.9 and earlier.
-Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
-error handling. This is a Linux kernel problem, not a qemu problem:
-the Linux kernel only worked by accident since it requested both interrupts.
-For backward compatibility, generate the Ethernet interrupt on both interrupt
-lines. This was shown to work from all Linux kernel releases starting with
-v3.16.
-Link: https://bugs.launchpad.net/qemu/+bug/1753309
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-5-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/fsl-imx6.h |  4 ++--
+ target/arm/internals.h | 19 +------------------
- hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
+ target/arm/helper.c    | 22 ++++++++++++++++++++++
-files changed, 29 insertions(+), 3 deletions(-)
+files changed, 23 insertions(+), 18 deletions(-)
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6.h
+--- a/target/arm/internals.h
-+++ b/include/hw/arm/fsl-imx6.h
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
+@@ -XXX,XX +XXX,XX @@ static inline void update_spsel(CPUARMState *env, uint32_t imm)
- #define FSL_IMX6_HDMI_MASTER_IRQ 115
+  * Returns the implementation defined bit-width of physical addresses.
- #define FSL_IMX6_HDMI_CEC_IRQ 116
+  * The ARMv8 reference manuals refer to this as PAMax().
- #define FSL_IMX6_MLB150_LOW_IRQ 117
+  */
--#define FSL_IMX6_ENET_MAC_1588_IRQ 118
+-static inline unsigned int arm_pamax(ARMCPU *cpu)
--#define FSL_IMX6_ENET_MAC_IRQ 119
+-{
-+#define FSL_IMX6_ENET_MAC_IRQ 118
+-    static const unsigned int pamax_map[] = {
-+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
+-        [0] = 32,
- #define FSL_IMX6_PCIE1_IRQ 120
+-        [1] = 36,
- #define FSL_IMX6_PCIE2_IRQ 121
+-        [2] = 40,
- #define FSL_IMX6_PCIE3_IRQ 122
+-        [3] = 42,
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+-        [4] = 44,
 -        [5] = 48,
 -    };
 -    unsigned int parange =
 -        FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
 -
 -    /* id_aa64mmfr0 is a read-only register so values outside of the
 -     * supported mappings can be considered an implementation error.  */
 -    assert(parange < ARRAY_SIZE(pamax_map));
 -    return pamax_map[parange];
 -}
 +unsigned int arm_pamax(ARMCPU *cpu);
  /* Return true if extended addresses are enabled.
   * This is always the case if our translation regime is 64 bit,
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
+--- a/target/arm/helper.c
-+++ b/hw/net/imx_fec.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
+@@ -XXX,XX +XXX,XX @@ static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
+ }
- static void imx_eth_update(IMXFECState *s)
+ #endif /* !CONFIG_USER_ONLY */
 +/* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
 +unsigned int arm_pamax(ARMCPU *cpu)
 +{
 +    static const unsigned int pamax_map[] = {
 +        [0] = 32,
 +        [1] = 36,
 +        [2] = 40,
 +        [3] = 42,
 +        [4] = 44,
 +        [5] = 48,
 +    };
 +    unsigned int parange =
 +        FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
 +
 +    /*
 +     * id_aa64mmfr0 is a read-only register so values outside of the
 +     * supported mappings can be considered an implementation error.
 +     */
 +    assert(parange < ARRAY_SIZE(pamax_map));
 +    return pamax_map[parange];
 +}
 +
  static int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx)
  {
--    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
+     if (regime_has_2_ranges(mmu_idx)) {
 +    /*
 +     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
 +     * interrupts swapped. This worked with older versions of Linux (4.14
 +     * and older) since Linux associated both interrupt lines with Ethernet
 +     * MAC interrupts. Specifically,
 +     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
 +     *   timer interrupts. Those versions of Linux fail with versions of QEMU
 +     *   with swapped interrupt assignments.
 +     * - In linux 4.14, both interrupt lines were registered with the Ethernet
 +     *   MAC interrupt handler. As a result, all versions of qemu happen to
 +     *   work, though that is accidental.
 +     * - In Linux 4.9 and older, the timer interrupt was registered directly
 +     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
 +     *   redirected to a GPIO interrupt to work around erratum ERR006687.
 +     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
 +     *   interrupt never fired since IOMUX is currently not supported in qemu.
 +     *   Linux instead received MAC interrupts on the timer interrupt.
 +     *   As a result, qemu versions with the swapped interrupt assignment work,
 +     *   albeit accidentally, but qemu versions with the correct interrupt
 +     *   assignment fail.
 +     *
 +     * To ensure that all versions of Linux work, generate ENET_INT_MAC
 +     * interrrupts on both interrupt lines. This should be changed if and when
 +     * qemu supports IOMUX.
 +     */
 +    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
 +        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
          qemu_set_irq(s->irq[1], 1);
      } else {
          qemu_set_irq(s->irq[1], 0);
 --
-.16.2
+.25.1

-New patch
+[PULL 12/26] target/arm: Pass outputsize down to check_s2_mmu_setup
+From: Richard Henderson <richard.henderson@linaro.org>
+Pass down the width of the output address from translation.
+For now this is still just PAMax, but a subsequent patch will
+compute the correct value from TCR_ELx.{I}PS.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-6-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.c | 21 ++++++++++-----------
+file changed, 10 insertions(+), 11 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ do_fault:
+  * false otherwise.
+  */
+ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
+-                               int inputsize, int stride)
++                               int inputsize, int stride, int outputsize)
+ {
+     const int grainsize = stride + 3;
+     int startsizecheck;
+@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
+     }
+     if (is_aa64) {
+-        CPUARMState *env = &cpu->env;
+-        unsigned int pamax = arm_pamax(cpu);
+-
+         switch (stride) {
+         case 13: /* 64KB Pages.  */
+-            if (level == 0 || (level == 1 && pamax <= 42)) {
++            if (level == 0 || (level == 1 && outputsize <= 42)) {
+                 return false;
+             }
+             break;
+         case 11: /* 16KB Pages.  */
+-            if (level == 0 || (level == 1 && pamax <= 40)) {
++            if (level == 0 || (level == 1 && outputsize <= 40)) {
+                 return false;
+             }
+             break;
+         case 9: /* 4KB Pages.  */
+-            if (level == 0 && pamax <= 42) {
++            if (level == 0 && outputsize <= 42) {
+                 return false;
+             }
+             break;
+@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
+         }
+         /* Inputsize checks.  */
+-        if (inputsize > pamax &&
+-            (arm_el_is_aa64(env, 1) || inputsize > 40)) {
++        if (inputsize > outputsize &&
++            (arm_el_is_aa64(&cpu->env, 1) || inputsize > 40)) {
+             /* This is CONSTRAINED UNPREDICTABLE and we choose to fault.  */
+             return false;
+         }
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
+     target_ulong page_size;
+     uint32_t attrs;
+     int32_t stride;
+-    int addrsize, inputsize;
++    int addrsize, inputsize, outputsize;
+     TCR *tcr = regime_tcr(env, mmu_idx);
+     int ap, ns, xn, pxn;
+     uint32_t el = regime_el(env, mmu_idx);
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
+         addrsize = 64 - 8 * param.tbi;
+         inputsize = 64 - param.tsz;
++        outputsize = arm_pamax(cpu);
+     } else {
+         param = aa32_va_parameters(env, address, mmu_idx);
+         level = 1;
+         addrsize = (mmu_idx == ARMMMUIdx_Stage2 ? 40 : 32);
+         inputsize = addrsize - param.tsz;
++        outputsize = 40;
+     }
+     /*
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
+         /* Check that the starting level is valid. */
+         ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
+-                                inputsize, stride);
++                                inputsize, stride, outputsize);
+         if (!ok) {
+             fault_type = ARMFault_Translation;
+             goto do_fault;
+--
+.25.1

-[Qemu-devel] [PULL 02/13] dump: Update correct kdump phys_base field for AArch64
+[PULL 13/26] target/arm: Use MAKE_64BIT_MASK to compute indexmask
-From: Wei Huang <wei@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-For guest kernel that supports KASLR, the load address can change every
+The macro is a bit more readable than the inlined computation.
 time when guest VM runs. To find the physical base address correctly,
 current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
 However this string pattern is only available on x86_64. AArch64 uses a
 different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
 QEMU dump uses the correct string on AArch64.
-Signed-off-by: Wei Huang <wei@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
+Message-id: 20220301215958.157011-7-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- dump.c | 14 +++++++++++---
+ target/arm/helper.c | 4 ++--
-file changed, 11 insertions(+), 3 deletions(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/dump.c b/dump.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/dump.c
+--- a/target/arm/helper.c
-+++ b/dump.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
+         level = startlevel;
-     lines = g_strsplit((char *)vmci, "\n", -1);
+     }
-     for (i = 0; lines[i]; i++) {
--        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
+-    indexmask_grainsize = (1ULL << (stride + 3)) - 1;
--            if (qemu_strtou64(lines[i] + 18, NULL, 16,
+-    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
-+        const char *prefix = NULL;
++    indexmask_grainsize = MAKE_64BIT_MASK(0, stride + 3);
-+
++    indexmask = MAKE_64BIT_MASK(0, inputsize - (stride * (4 - level)));
-+        if (s->dump_info.d_machine == EM_X86_64) {
-+            prefix = "NUMBER(phys_base)=";
+     /* Now we can extract the actual base address from the TTBR */
-+        } else if (s->dump_info.d_machine == EM_AARCH64) {
+     descaddr = extract64(ttbr, 0, 48);
 +            prefix = "NUMBER(PHYS_OFFSET)=";
 +        }
 +
 +        if (prefix && g_str_has_prefix(lines[i], prefix)) {
 +            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
                                &phys_base) < 0) {
 -                warn_report("Failed to read NUMBER(phys_base)=");
 +                warn_report("Failed to read %s", prefix);
              } else {
                  s->dump_info.phys_base = phys_base;
              }
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 10/13] hw/arm/bcm2836: Create proper bcm2837 device
+[PULL 14/26] target/arm: Honor TCR_ELx.{I}PS
-The bcm2837 is pretty similar to the bcm2836, but it does have
+From: Richard Henderson <richard.henderson@linaro.org>
 some differences. Notably, the MPIDR affinity aff1 values it
 sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
 uses, and if this is wrong Linux will not boot.
-Rather than trying to have one device with properties that
+This field controls the output (intermediate) physical address size
-configure it differently for the two cases, create two
+of the translation process.  V8 requires to raise an AddressSize
-separate QOM devices for the two SoCs. We use the same approach
+fault if the page tables are programmed incorrectly, such that any
-as hw/arm/aspeed_soc.c and share code and have a data table
+intermediate descriptor address, or the final translated address,
-that might differ per-SoC. For the moment the two types don't
+is out of range.
 actually have different behaviour.
+Add a PS field to ARMVAParameters, and properly compute outputsize
+in get_phys_addr_lpae.  Test the descaddr as extracted from TTBR
+and from page table entries.
+Restrict descaddrmask so that we won't raise the fault for v7.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-8-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
 ---
- include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
+ target/arm/internals.h |  1 +
- hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
+ target/arm/helper.c    | 72 ++++++++++++++++++++++++++++++++----------
- hw/arm/raspi.c           |  3 ++-
+files changed, 57 insertions(+), 16 deletions(-)
 files changed, 53 insertions(+), 6 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/target/arm/internals.h
-+++ b/include/hw/arm/bcm2836.h
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t aarch64_pstate_valid_mask(const ARMISARegisters *id)
+  */
- #define BCM283X_NCPUS 4
+ typedef struct ARMVAParameters {
+     unsigned tsz    : 8;
-+/* These type names are for specific SoCs; other than instantiating
++    unsigned ps     : 3;
-+ * them, code using these devices should always handle them via the
+     unsigned select : 1;
-+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
+     bool tbi        : 1;
-+ */
+     bool epd        : 1;
-+#define TYPE_BCM2836 "bcm2836"
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 +#define TYPE_BCM2837 "bcm2837"
 +
  typedef struct BCM283XState {
      /*< private >*/
      DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
      BCM2835PeripheralState peripherals;
  } BCM283XState;
 +typedef struct BCM283XInfo BCM283XInfo;
 +
 +typedef struct BCM283XClass {
 +    DeviceClass parent_class;
 +    const BCM283XInfo *info;
 +} BCM283XClass;
 +
 +#define BCM283X_CLASS(klass) \
 +    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
 +#define BCM283X_GET_CLASS(obj) \
 +    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
 +
  #endif /* BCM2836_H */
 diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/target/arm/helper.c
-+++ b/hw/arm/bcm2836.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
- /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
+ }
- #define BCM2836_CONTROL_BASE    0x40000000
+ #endif /* !CONFIG_USER_ONLY */
-+struct BCM283XInfo {
++/* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
-+    const char *name;
++static const uint8_t pamax_map[] = {
 +    [0] = 32,
 +    [1] = 36,
 +    [2] = 40,
 +    [3] = 42,
 +    [4] = 44,
 +    [5] = 48,
 +};
 +
-+static const BCM283XInfo bcm283x_socs[] = {
+ /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
-+    {
+ unsigned int arm_pamax(ARMCPU *cpu)
-+        .name = TYPE_BCM2836,
+ {
-+    },
+-    static const unsigned int pamax_map[] = {
-+    {
+-        [0] = 32,
-+        .name = TYPE_BCM2837,
+-        [1] = 36,
-+    },
+-        [2] = 40,
-+};
+-        [3] = 42,
 -        [4] = 44,
 -        [5] = 48,
 -    };
      unsigned int parange =
          FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
  {
      uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
      bool epd, hpd, using16k, using64k, tsz_oob;
 -    int select, tsz, tbi, max_tsz, min_tsz;
 +    int select, tsz, tbi, max_tsz, min_tsz, ps;
      if (!regime_has_2_ranges(mmu_idx)) {
          select = 0;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
              hpd = extract32(tcr, 24, 1);
          }
          epd = false;
 +        ps = extract32(tcr, 16, 3);
      } else {
          /*
           * Bit 55 is always between the two regions, and is canonical for
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
              epd = extract32(tcr, 23, 1);
              hpd = extract64(tcr, 42, 1);
          }
 +        ps = extract64(tcr, 32, 3);
      }
      if (cpu_isar_feature(aa64_st, env_archcpu(env))) {
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
      return (ARMVAParameters) {
          .tsz = tsz,
 +        .ps = ps,
          .select = select,
          .tbi = tbi,
          .epd = epd,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
      /* TODO: This code does not support shareability levels. */
      if (aarch64) {
 +        int ps;
 +
- static void bcm2836_init(Object *obj)
+         param = aa64_va_parameters(env, address, mmu_idx,
- {
+                                    access_type != MMU_INST_FETCH);
-     BCM283XState *s = BCM283X(obj);
+         level = 0;
-@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
-     DEFINE_PROP_END_OF_LIST()
- };
+         addrsize = 64 - 8 * param.tbi;
+         inputsize = 64 - param.tsz;
--static void bcm2836_class_init(ObjectClass *oc, void *data)
+-        outputsize = arm_pamax(cpu);
 +static void bcm283x_class_init(ObjectClass *oc, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 +    BCM283XClass *bc = BCM283X_CLASS(oc);
 -    dc->props = bcm2836_props;
 +    bc->info = data;
      dc->realize = bcm2836_realize;
 +    dc->props = bcm2836_props;
  }
 -static const TypeInfo bcm2836_type_info = {
 +static const TypeInfo bcm283x_type_info = {
      .name = TYPE_BCM283X,
      .parent = TYPE_DEVICE,
      .instance_size = sizeof(BCM283XState),
      .instance_init = bcm2836_init,
 -    .class_init = bcm2836_class_init,
 +    .class_size = sizeof(BCM283XClass),
 +    .abstract = true,
  };
  static void bcm2836_register_types(void)
  {
 -    type_register_static(&bcm2836_type_info);
 +    int i;
 +
-+    type_register_static(&bcm283x_type_info);
++        /*
-+    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
++         * Bound PS by PARANGE to find the effective output address size.
-+        TypeInfo ti = {
++         * ID_AA64MMFR0 is a read-only register so values outside of the
-+            .name = bcm283x_socs[i].name,
++         * supported mappings can be considered an implementation error.
-+            .parent = TYPE_BCM283X,
++         */
-+            .class_init = bcm283x_class_init,
++        ps = FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
-+            .class_data = (void *) &bcm283x_socs[i],
++        ps = MIN(ps, param.ps);
-+        };
++        assert(ps < ARRAY_SIZE(pamax_map));
-+        type_register(&ti);
++        outputsize = pamax_map[ps];
      } else {
          param = aa32_va_parameters(env, address, mmu_idx);
          level = 1;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
      /* Now we can extract the actual base address from the TTBR */
      descaddr = extract64(ttbr, 0, 48);
 +
 +    /*
 +     * If the base address is out of range, raise AddressSizeFault.
 +     * In the pseudocode, this is !IsZero(baseregister<47:outputsize>),
 +     * but we've just cleared the bits above 47, so simplify the test.
 +     */
 +    if (descaddr >> outputsize) {
 +        level = 0;
 +        fault_type = ARMFault_AddressSize;
 +        goto do_fault;
 +    }
- }
++
+     /*
- type_init(bcm2836_register_types)
+      * We rely on this masking to clear the RES0 bits at the bottom of the TTBR
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+      * and also to mask out CnP (bit 0) which could validly be non-zero.
-index XXXXXXX..XXXXXXX 100644
+      */
---- a/hw/arm/raspi.c
+     descaddr &= ~indexmask;
-+++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
+-    /* The address field in the descriptor goes up to bit 39 for ARMv7
-     BusState *bus;
+-     * but up to bit 47 for ARMv8, but we use the descaddrmask
-     DeviceState *carddev;
+-     * up to bit 39 for AArch32, because we don't need other bits in that case
+-     * to construct next descriptor address (anyway they should be all zeroes).
--    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
++    /*
-+    object_initialize(&s->soc, sizeof(s->soc),
++     * For AArch32, the address field in the descriptor goes up to bit 39
-+                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
++     * for both v7 and v8.  However, for v8 the SBZ bits [47:40] must be 0
-     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
++     * or an AddressSize fault is raised.  So for v8 we extract those SBZ
-                               &error_abort);
++     * bits as part of the address, which will be checked via outputsize.
++     * For AArch64, the address field always goes up to bit 47 (with extra
 +     * bits for FEAT_LPA placed elsewhere).  AArch64 implies v8.
       */
 -    descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) &
 -                   ~indexmask_grainsize;
 +    if (arm_feature(env, ARM_FEATURE_V8)) {
 +        descaddrmask = MAKE_64BIT_MASK(0, 48);
 +    } else {
 +        descaddrmask = MAKE_64BIT_MASK(0, 40);
 +    }
 +    descaddrmask &= ~indexmask_grainsize;
      /* Secure accesses start with the page table in secure memory and
       * can be downgraded to non-secure at any step. Non-secure accesses
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
              /* Invalid, or the Reserved level 3 encoding */
              goto do_fault;
          }
 +
          descaddr = descriptor & descaddrmask;
 +        if (descaddr >> outputsize) {
 +            fault_type = ARMFault_AddressSize;
 +            goto do_fault;
 +        }
          if ((descriptor & 2) && (level < 3)) {
              /* Table entry. The top five bits are attributes which may
 --
-.16.2
+.25.1

-New patch
+[PULL 15/26] target/arm: Prepare DBGBVR and DBGWVR for FEAT_LVA
+From: Richard Henderson <richard.henderson@linaro.org>
+The original A.a revision of the AArch64 ARM required that we
+force-extend the addresses in these registers from 49 bits.
+This language has been loosened via a combination of IMPLEMENTATION
+DEFINED and CONSTRAINTED UNPREDICTABLE to allow consideration of
+the entire aligned address.
+This means that we do not have to consider whether or not FEAT_LVA
+is enabled, and decide from which bit an address might need to be
+extended.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-9-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.c | 32 ++++++++++++++++++++++++--------
+file changed, 24 insertions(+), 8 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+     ARMCPU *cpu = env_archcpu(env);
+     int i = ri->crm;
+-    /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
+-     * register reads and behaves as if values written are sign extended.
++    /*
+      * Bits [1:0] are RES0.
++     *
++     * It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA)
++     * are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if
++     * they contain the value written.  It is CONSTRAINED UNPREDICTABLE
++     * whether the RESS bits are ignored when comparing an address.
++     *
++     * Therefore we are allowed to compare the entire register, which lets
++     * us avoid considering whether or not FEAT_LVA is actually enabled.
+      */
+-    value = sextract64(value, 0, 49) & ~3ULL;
++    value &= ~3ULL;
+     raw_write(env, ri, value);
+     hw_watchpoint_update(cpu, i);
+@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update(ARMCPU *cpu, int n)
+     case 0: /* unlinked address match */
+     case 1: /* linked address match */
+     {
+-        /* Bits [63:49] are hardwired to the value of bit [48]; that is,
+-         * we behave as if the register was sign extended. Bits [1:0] are
+-         * RES0. The BAS field is used to allow setting breakpoints on 16
+-         * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether
++        /*
++         * Bits [1:0] are RES0.
++         *
++         * It is IMPLEMENTATION DEFINED whether bits [63:49]
++         * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
++         * of the VA field ([48] or [52] for FEAT_LVA), or whether the
++         * value is read as written.  It is CONSTRAINED UNPREDICTABLE
++         * whether the RESS bits are ignored when comparing an address.
++         * Therefore we are allowed to compare the entire register, which
++         * lets us avoid considering whether FEAT_LVA is actually enabled.
++         *
++         * The BAS field is used to allow setting breakpoints on 16-bit
++         * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
+          * a bp will fire if the addresses covered by the bp and the addresses
+          * covered by the insn overlap but the insn doesn't start at the
+          * start of the bp address range. We choose to require the insn and
+@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update(ARMCPU *cpu, int n)
+          * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
+          */
+         int bas = extract64(bcr, 5, 4);
+-        addr = sextract64(bvr, 0, 49) & ~3ULL;
++        addr = bvr & ~3ULL;
+         if (bas == 0) {
+             return;
+         }
+--
+.25.1

-New patch
+[PULL 16/26] target/arm: Implement FEAT_LVA
+From: Richard Henderson <richard.henderson@linaro.org>
+This feature is relatively small, as it applies only to
+k pages and thus requires no additional changes to the
+table descriptor walking algorithm, only a change to the
+minimum TSZ (which is the inverse of the maximum virtual
+address space size).
+Note that this feature widens VBAR_ELx, but we already
+treat the register as being 64 bits wide.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-10-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ docs/system/arm/emulation.rst | 1 +
+ target/arm/cpu-param.h        | 2 +-
+ target/arm/cpu.h              | 5 +++++
+ target/arm/cpu64.c            | 1 +
+ target/arm/helper.c           | 9 ++++++++-
+files changed, 16 insertions(+), 2 deletions(-)
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/arm/emulation.rst
++++ b/docs/system/arm/emulation.rst
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
+ - FEAT_LRCPC (Load-acquire RCpc instructions)
+ - FEAT_LRCPC2 (Load-acquire RCpc instructions v2)
+ - FEAT_LSE (Large System Extensions)
++- FEAT_LVA (Large Virtual Address space)
+ - FEAT_MTE (Memory Tagging Extension)
+ - FEAT_MTE2 (Memory Tagging Extension)
+ - FEAT_MTE3 (MTE Asymmetric Fault Handling)
+diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu-param.h
++++ b/target/arm/cpu-param.h
+@@ -XXX,XX +XXX,XX @@
+ #ifdef TARGET_AARCH64
+ # define TARGET_LONG_BITS             64
+ # define TARGET_PHYS_ADDR_SPACE_BITS  48
+-# define TARGET_VIRT_ADDR_SPACE_BITS  48
++# define TARGET_VIRT_ADDR_SPACE_BITS  52
+ #else
+ # define TARGET_LONG_BITS             32
+ # define TARGET_PHYS_ADDR_SPACE_BITS  40
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
+ }
++static inline bool isar_feature_aa64_lva(const ARMISARegisters *id)
++{
++    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, VARANGE) != 0;
++}
++
+ static inline bool isar_feature_aa64_tts2uxn(const ARMISARegisters *id)
+ {
+     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, XNX) != 0;
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu64.c
++++ b/target/arm/cpu64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+     t = FIELD_DP64(t, ID_AA64MMFR2, UAO, 1);
+     t = FIELD_DP64(t, ID_AA64MMFR2, CNP, 1); /* TTCNP */
+     t = FIELD_DP64(t, ID_AA64MMFR2, ST, 1); /* TTST */
++    t = FIELD_DP64(t, ID_AA64MMFR2, VARANGE, 1); /* FEAT_LVA */
+     cpu->isar.id_aa64mmfr2 = t;
+     t = cpu->isar.id_aa64zfr0;
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+     } else {
+         max_tsz = 39;
+     }
+-    min_tsz = 16;  /* TODO: ARMv8.2-LVA  */
++
++    min_tsz = 16;
++    if (using64k) {
++        if (cpu_isar_feature(aa64_lva, env_archcpu(env))) {
++            min_tsz = 12;
++        }
++    }
++    /* TODO: FEAT_LPA2 */
+     if (tsz > max_tsz) {
+         tsz = max_tsz;
+--
+.25.1

-[Qemu-devel] [PULL 11/13] hw/arm/bcm2836: Use correct affinity values for BCM2837
+[PULL 17/26] target/arm: Implement FEAT_LPA
-The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
+From: Richard Henderson <richard.henderson@linaro.org>
 CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
 is required for Linux to boot.
+This feature widens physical addresses (and intermediate physical
+addresses for 2-stage translation) from 48 to 52 bits, when using
+k pages.  The only thing left at this point is to handle the
+extra bits in the TTBR and in the table descriptors.
+Note that PAR_EL1 and HPFAR_EL2 are nominally extended, but we don't
+mask out the high bits when writing to those registers, so no changes
+are required there.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-11-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 11 +++++++----
+ docs/system/arm/emulation.rst |  1 +
-file changed, 7 insertions(+), 4 deletions(-)
+ target/arm/cpu-param.h        |  2 +-
  target/arm/cpu64.c            |  2 +-
  target/arm/helper.c           | 19 ++++++++++++++++---
 files changed, 19 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/docs/system/arm/emulation.rst
-+++ b/hw/arm/bcm2836.c
++++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
  - FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
  - FEAT_JSCVT (JavaScript conversion instructions)
  - FEAT_LOR (Limited ordering regions)
 +- FEAT_LPA (Large Physical Address space)
  - FEAT_LRCPC (Load-acquire RCpc instructions)
  - FEAT_LRCPC2 (Load-acquire RCpc instructions v2)
  - FEAT_LSE (Large System Extensions)
 diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu-param.h
 +++ b/target/arm/cpu-param.h
 @@ -XXX,XX +XXX,XX @@
- struct BCM283XInfo {
+ #ifdef TARGET_AARCH64
-     const char *name;
+ # define TARGET_LONG_BITS             64
-+    int clusterid;
+-# define TARGET_PHYS_ADDR_SPACE_BITS  48
 +# define TARGET_PHYS_ADDR_SPACE_BITS  52
  # define TARGET_VIRT_ADDR_SPACE_BITS  52
  #else
  # define TARGET_LONG_BITS             32
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
      cpu->isar.id_aa64pfr1 = t;
      t = cpu->isar.id_aa64mmfr0;
 -    t = FIELD_DP64(t, ID_AA64MMFR0, PARANGE, 5); /* PARange: 48 bits */
 +    t = FIELD_DP64(t, ID_AA64MMFR0, PARANGE, 6); /* FEAT_LPA: 52 bits */
      cpu->isar.id_aa64mmfr0 = t;
      t = cpu->isar.id_aa64mmfr1;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t pamax_map[] = {
      [3] = 42,
      [4] = 44,
      [5] = 48,
 +    [6] = 52,
  };
- static const BCM283XInfo bcm283x_socs[] = {
+ /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
-     {
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
-         .name = TYPE_BCM2836,
+     descaddr = extract64(ttbr, 0, 48);
-+        .clusterid = 0xf,
-     },
+     /*
-     {
+-     * If the base address is out of range, raise AddressSizeFault.
-         .name = TYPE_BCM2837,
++     * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [5:2] of TTBR.
-+        .clusterid = 0x0,
++     *
-     },
++     * Otherwise, if the base address is out of range, raise AddressSizeFault.
- };
+      * In the pseudocode, this is !IsZero(baseregister<47:outputsize>),
+      * but we've just cleared the bits above 47, so simplify the test.
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
+      */
- static void bcm2836_realize(DeviceState *dev, Error **errp)
+-    if (descaddr >> outputsize) {
- {
++    if (outputsize > 48) {
-     BCM283XState *s = BCM283X(dev);
++        descaddr |= extract64(ttbr, 2, 4) << 48;
-+    BCM283XClass *bc = BCM283X_GET_CLASS(dev);
++    } else if (descaddr >> outputsize) {
-+    const BCM283XInfo *info = bc->info;
+         level = 0;
-     Object *obj;
+         fault_type = ARMFault_AddressSize;
-     Error *err = NULL;
+         goto do_fault;
-     int n;
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
+         }
-         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
+         descaddr = descriptor & descaddrmask;
-     for (n = 0; n < BCM283X_NCPUS; n++) {
+-        if (descaddr >> outputsize) {
--        /* Mirror bcm2836, which has clusterid set to 0xf
++
--         * TODO: this should be converted to a property of ARM_CPU
++        /*
--         */
++         * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
--        s->cpus[n].mp_affinity = 0xF00 | n;
++         * of descriptor.  Otherwise, if descaddr is out of range, raise
-+        /* TODO: this should be converted to a property of ARM_CPU */
++         * AddressSizeFault.
-+        s->cpus[n].mp_affinity = (info->clusterid << 8) | n;
++         */
++        if (outputsize > 48) {
-         /* set periphbase/CBAR value for CPU-local registers */
++            descaddr |= extract64(descriptor, 12, 4) << 48;
-         object_property_set_int(OBJECT(&s->cpus[n]),
++        } else if (descaddr >> outputsize) {
              fault_type = ARMFault_AddressSize;
              goto do_fault;
          }
 --
-.16.2
+.25.1

-New patch
+[PULL 18/26] target/arm: Extend arm_fi_to_lfsc to level -1
+From: Richard Henderson <richard.henderson@linaro.org>
+With FEAT_LPA2, rather than introducing translation level 4,
+we introduce level -1, below the current level 0.  Extend
+arm_fi_to_lfsc to handle these faults.
+Assert that this new translation level does not leak into
+fault types for which it is not defined, which allows some
+masking of fi->level to be removed.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-12-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/internals.h | 35 +++++++++++++++++++++++++++++------
+file changed, 29 insertions(+), 6 deletions(-)
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
+     case ARMFault_None:
+         return 0;
+     case ARMFault_AddressSize:
+-        fsc = fi->level & 3;
++        assert(fi->level >= -1 && fi->level <= 3);
++        if (fi->level < 0) {
++            fsc = 0b101001;
++        } else {
++            fsc = fi->level;
++        }
+         break;
+     case ARMFault_AccessFlag:
+-        fsc = (fi->level & 3) | (0x2 << 2);
++        assert(fi->level >= 0 && fi->level <= 3);
++        fsc = 0b001000 | fi->level;
+         break;
+     case ARMFault_Permission:
+-        fsc = (fi->level & 3) | (0x3 << 2);
++        assert(fi->level >= 0 && fi->level <= 3);
++        fsc = 0b001100 | fi->level;
+         break;
+     case ARMFault_Translation:
+-        fsc = (fi->level & 3) | (0x1 << 2);
++        assert(fi->level >= -1 && fi->level <= 3);
++        if (fi->level < 0) {
++            fsc = 0b101011;
++        } else {
++            fsc = 0b000100 | fi->level;
++        }
+         break;
+     case ARMFault_SyncExternal:
+         fsc = 0x10 | (fi->ea << 12);
+         break;
+     case ARMFault_SyncExternalOnWalk:
+-        fsc = (fi->level & 3) | (0x5 << 2) | (fi->ea << 12);
++        assert(fi->level >= -1 && fi->level <= 3);
++        if (fi->level < 0) {
++            fsc = 0b010011;
++        } else {
++            fsc = 0b010100 | fi->level;
++        }
++        fsc |= fi->ea << 12;
+         break;
+     case ARMFault_SyncParity:
+         fsc = 0x18;
+         break;
+     case ARMFault_SyncParityOnWalk:
+-        fsc = (fi->level & 3) | (0x7 << 2);
++        assert(fi->level >= -1 && fi->level <= 3);
++        if (fi->level < 0) {
++            fsc = 0b011011;
++        } else {
++            fsc = 0b011100 | fi->level;
++        }
+         break;
+     case ARMFault_AsyncParity:
+         fsc = 0x19;
+--
+.25.1

-New patch
+[PULL 19/26] target/arm: Introduce tlbi_aa64_get_range
+From: Richard Henderson <richard.henderson@linaro.org>
+Merge tlbi_aa64_range_get_length and tlbi_aa64_range_get_base,
+returning a structure containing both results.  Pass in the
+ARMMMUIdx, rather than the digested two_ranges boolean.
+This is in preparation for FEAT_LPA2, where the interpretation
+of 'value' depends on the effective value of DS for the regime.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-13-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.c | 58 +++++++++++++++++++--------------------------
+file changed, 24 insertions(+), 34 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
+ }
+ #ifdef TARGET_AARCH64
+-static uint64_t tlbi_aa64_range_get_length(CPUARMState *env,
+-                                           uint64_t value)
+-{
+-    unsigned int page_shift;
+-    unsigned int page_size_granule;
+-    uint64_t num;
+-    uint64_t scale;
+-    uint64_t exponent;
++typedef struct {
++    uint64_t base;
+     uint64_t length;
++} TLBIRange;
++
++static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
++                                     uint64_t value)
++{
++    unsigned int page_size_granule, page_shift, num, scale, exponent;
++    TLBIRange ret = { };
+-    num = extract64(value, 39, 5);
+-    scale = extract64(value, 44, 2);
+     page_size_granule = extract64(value, 46, 2);
+     if (page_size_granule == 0) {
+         qemu_log_mask(LOG_GUEST_ERROR, "Invalid page size granule %d\n",
+                       page_size_granule);
+-        return 0;
++        return ret;
+     }
+     page_shift = (page_size_granule - 1) * 2 + 12;
+-
++    num = extract64(value, 39, 5);
++    scale = extract64(value, 44, 2);
+     exponent = (5 * scale) + 1;
+-    length = (num + 1) << (exponent + page_shift);
+-    return length;
+-}
++    ret.length = (num + 1) << (exponent + page_shift);
+-static uint64_t tlbi_aa64_range_get_base(CPUARMState *env, uint64_t value,
+-                                        bool two_ranges)
+-{
+-    /* TODO: ARMv8.7 FEAT_LPA2 */
+-    uint64_t pageaddr;
+-
+-    if (two_ranges) {
+-        pageaddr = sextract64(value, 0, 37) << TARGET_PAGE_BITS;
++    if (regime_has_2_ranges(mmuidx)) {
++        ret.base = sextract64(value, 0, 37) << TARGET_PAGE_BITS;
+     } else {
+-        pageaddr = extract64(value, 0, 37) << TARGET_PAGE_BITS;
++        ret.base = extract64(value, 0, 37) << TARGET_PAGE_BITS;
+     }
+-    return pageaddr;
++    return ret;
+ }
+ static void do_rvae_write(CPUARMState *env, uint64_t value,
+                           int idxmap, bool synced)
+ {
+     ARMMMUIdx one_idx = ARM_MMU_IDX_A | ctz32(idxmap);
+-    bool two_ranges = regime_has_2_ranges(one_idx);
+-    uint64_t baseaddr, length;
++    TLBIRange range;
+     int bits;
+-    baseaddr = tlbi_aa64_range_get_base(env, value, two_ranges);
+-    length = tlbi_aa64_range_get_length(env, value);
+-    bits = tlbbits_for_regime(env, one_idx, baseaddr);
++    range = tlbi_aa64_get_range(env, one_idx, value);
++    bits = tlbbits_for_regime(env, one_idx, range.base);
+     if (synced) {
+         tlb_flush_range_by_mmuidx_all_cpus_synced(env_cpu(env),
+-                                                  baseaddr,
+-                                                  length,
++                                                  range.base,
++                                                  range.length,
+                                                   idxmap,
+                                                   bits);
+     } else {
+-        tlb_flush_range_by_mmuidx(env_cpu(env), baseaddr,
+-                                  length, idxmap, bits);
++        tlb_flush_range_by_mmuidx(env_cpu(env), range.base,
++                                  range.length, idxmap, bits);
+     }
+ }
+--
+.25.1

-New patch
+[PULL 20/26] target/arm: Fix TLBIRange.base for 16k and 64k pages
+From: Richard Henderson <richard.henderson@linaro.org>
+The shift of the BaseADDR field depends on the translation
+granule in use.
+Fixes: 84940ed8255 ("target/arm: Add support for FEAT_TLBIRANGE")
+Reported-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-14-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.c | 5 +++--
+file changed, 3 insertions(+), 2 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
+     ret.length = (num + 1) << (exponent + page_shift);
+     if (regime_has_2_ranges(mmuidx)) {
+-        ret.base = sextract64(value, 0, 37) << TARGET_PAGE_BITS;
++        ret.base = sextract64(value, 0, 37);
+     } else {
+-        ret.base = extract64(value, 0, 37) << TARGET_PAGE_BITS;
++        ret.base = extract64(value, 0, 37);
+     }
++    ret.base <<= page_shift;
+     return ret;
+ }
+--
+.25.1

-New patch
+[PULL 21/26] target/arm: Validate tlbi TG matches translation granule in use
+From: Richard Henderson <richard.henderson@linaro.org>
+For FEAT_LPA2, we will need other ARMVAParameters, which themselves
+depend on the translation granule in use.  We might as well validate
+that the given TG matches; the architecture "does not require that
+the instruction invalidates any entries" if this is not true.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-15-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.c | 10 +++++++---
+file changed, 7 insertions(+), 3 deletions(-)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
+                                      uint64_t value)
+ {
+     unsigned int page_size_granule, page_shift, num, scale, exponent;
++    /* Extract one bit to represent the va selector in use. */
++    uint64_t select = sextract64(value, 36, 1);
++    ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true);
+     TLBIRange ret = { };
+     page_size_granule = extract64(value, 46, 2);
+-    if (page_size_granule == 0) {
+-        qemu_log_mask(LOG_GUEST_ERROR, "Invalid page size granule %d\n",
++    /* The granule encoded in value must match the granule in use. */
++    if (page_size_granule != (param.using64k ? 3 : param.using16k ? 2 : 1)) {
++        qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n",
+                       page_size_granule);
+         return ret;
+     }
+@@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
+     ret.length = (num + 1) << (exponent + page_shift);
+-    if (regime_has_2_ranges(mmuidx)) {
++    if (param.select) {
+         ret.base = sextract64(value, 0, 37);
+     } else {
+         ret.base = extract64(value, 0, 37);
+--
+.25.1

-New patch
+[PULL 22/26] target/arm: Advertise all page sizes for -cpu max
+From: Richard Henderson <richard.henderson@linaro.org>
+We support 16k pages, but do not advertize that in ID_AA64MMFR0.
+The value 0 in the TGRAN*_2 fields indicates that stage2 lookups defer
+to the same support as stage1 lookups.  This setting is deprecated, so
+indicate support for all stage2 page sizes directly.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220301215958.157011-16-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu64.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu64.c
++++ b/target/arm/cpu64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+     t = cpu->isar.id_aa64mmfr0;
+     t = FIELD_DP64(t, ID_AA64MMFR0, PARANGE, 6); /* FEAT_LPA: 52 bits */
++    t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN16, 1);   /* 16k pages supported */
++    t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN16_2, 2); /* 16k stage2 supported */
++    t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
++    t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
+     cpu->isar.id_aa64mmfr0 = t;
+     t = cpu->isar.id_aa64mmfr1;
+--
+.25.1

-[Qemu-devel] [PULL 03/13] char: i.MX: Simplify imx_update()
+[PULL 23/26] target/arm: Implement FEAT_LPA2
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Code of imx_update() is slightly confusing since the "flags" variable
+This feature widens physical addresses (and intermediate physical
-doesn't really corespond to anything in real hardware and server as a
+addresses for 2-stage translation) from 48 to 52 bits, when using
-kitchensink accumulating events normally reported via USR1 and USR2
+k or 16k pages.
-registers.
+This introduces the DS bit to TCR_ELx, which is RES0 unless the
-Change the code to explicitly evaluate state of interrupts reported
+page size is enabled and supports LPA2, resulting in the effective
-via USR1 and USR2 against corresponding masking bits and use the to
+value of DS for a given table walk.  The DS bit changes the format
-detemine if IRQ line should be asserted or not.
+of the page table descriptor slightly, moving the PS field out to
+TCR so that all pages have the same sharability and repurposing
-NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
+those bits of the page table descriptor for the highest bits of
-reasons:
+the output address.
-. Emulation code implements a single character FIFO, so this flag
+Do not yet enable FEAT_LPA2; we need extra plumbing to avoid
-       will always be set since characters are trasmitted as a part of
+tickling an old kernel bug.
-       the code emulating "push" into the FIFO
 . imx_update() is really just a function doing ORing and maksing
        of reported events, so checking for UTS1_TXEMPTY should happen,
        if it's ever really needed should probably happen outside of
        it.
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Cc: Bill Paul <wpaul@windriver.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220301215958.157011-17-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/imx_serial.c | 24 ++++++++++++++++--------
+ docs/system/arm/emulation.rst |   1 +
-file changed, 16 insertions(+), 8 deletions(-)
+ target/arm/cpu.h              |  22 ++++++++
+ target/arm/internals.h        |   2 +
-diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+ target/arm/helper.c           | 102 +++++++++++++++++++++++++++++-----
 files changed, 112 insertions(+), 15 deletions(-)
 diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/imx_serial.c
+--- a/docs/system/arm/emulation.rst
-+++ b/hw/char/imx_serial.c
++++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
+@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
+ - FEAT_JSCVT (JavaScript conversion instructions)
- static void imx_update(IMXSerialState *s)
+ - FEAT_LOR (Limited ordering regions)
  - FEAT_LPA (Large Physical Address space)
 +- FEAT_LPA2 (Large Physical and virtual Address space v2)
  - FEAT_LRCPC (Load-acquire RCpc instructions)
  - FEAT_LRCPC2 (Load-acquire RCpc instructions v2)
  - FEAT_LSE (Large System Extensions)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_i8mm(const ARMISARegisters *id)
      return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, I8MM) != 0;
  }
 +static inline bool isar_feature_aa64_tgran4_lpa2(const ARMISARegisters *id)
 +{
 +    return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4) >= 1;
 +}
 +
 +static inline bool isar_feature_aa64_tgran4_2_lpa2(const ARMISARegisters *id)
 +{
 +    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4_2);
 +    return t >= 3 || (t == 0 && isar_feature_aa64_tgran4_lpa2(id));
 +}
 +
 +static inline bool isar_feature_aa64_tgran16_lpa2(const ARMISARegisters *id)
 +{
 +    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16) >= 2;
 +}
 +
 +static inline bool isar_feature_aa64_tgran16_2_lpa2(const ARMISARegisters *id)
 +{
 +    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16_2);
 +    return t >= 3 || (t == 0 && isar_feature_aa64_tgran16_lpa2(id));
 +}
 +
  static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
  {
--    uint32_t flags;
+     return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
-+    uint32_t usr1;
+diff --git a/target/arm/internals.h b/target/arm/internals.h
-+    uint32_t usr2;
+index XXXXXXX..XXXXXXX 100644
-+    uint32_t mask;
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
--    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t aarch64_pstate_valid_mask(const ARMISARegisters *id)
--    if (s->ucr1 & UCR1_TXMPTYEN) {
+ typedef struct ARMVAParameters {
--        flags |= (s->uts1 & UTS1_TXEMPTY);
+     unsigned tsz    : 8;
--    } else {
+     unsigned ps     : 3;
--        flags &= ~USR1_TRDY;
++    unsigned sh     : 2;
--    }
+     unsigned select : 1;
      bool tbi        : 1;
      bool epd        : 1;
@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
      bool using16k   : 1;
      bool using64k   : 1;
      bool tsz_oob    : 1;  /* tsz has been clamped to legal range */
 +    bool ds         : 1;
  } ARMVAParameters;
  ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
      } else {
          ret.base = extract64(value, 0, 37);
      }
 +    if (param.ds) {
 +        /*
 +         * With DS=1, BaseADDR is always shifted 16 so that it is able
 +         * to address all 52 va bits.  The input address is perforce
 +         * aligned on a 64k boundary regardless of translation granule.
 +         */
 +        page_shift = 16;
 +    }
      ret.base <<= page_shift;
      return ret;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
      const int grainsize = stride + 3;
      int startsizecheck;
 -    /* Negative levels are never allowed.  */
 -    if (level < 0) {
 +    /*
-+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
++     * Negative levels are usually not allowed...
-+     * UCR1, so we can get away with something as simple as the
++     * Except for FEAT_LPA2, 4k page table, 52-bit address space, which
-+     * following:
++     * begins with level -1.  Note that previous feature tests will have
 +     * eliminated this combination if it is not enabled.
 +     */
-+    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
++    if (level < (inputsize == 52 && stride == 9 ? -1 : 0)) {
          return false;
      }
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                     ARMMMUIdx mmu_idx, bool data)
  {
      uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
 -    bool epd, hpd, using16k, using64k, tsz_oob;
 -    int select, tsz, tbi, max_tsz, min_tsz, ps;
 +    bool epd, hpd, using16k, using64k, tsz_oob, ds;
 +    int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
 +    ARMCPU *cpu = env_archcpu(env);
      if (!regime_has_2_ranges(mmu_idx)) {
          select = 0;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
              hpd = extract32(tcr, 24, 1);
          }
          epd = false;
 +        sh = extract32(tcr, 12, 2);
          ps = extract32(tcr, 16, 3);
 +        ds = extract64(tcr, 32, 1);
      } else {
          /*
           * Bit 55 is always between the two regions, and is canonical for
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
          if (!select) {
              tsz = extract32(tcr, 0, 6);
              epd = extract32(tcr, 7, 1);
 +            sh = extract32(tcr, 12, 2);
              using64k = extract32(tcr, 14, 1);
              using16k = extract32(tcr, 15, 1);
              hpd = extract64(tcr, 41, 1);
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
              using64k = tg == 3;
              tsz = extract32(tcr, 16, 6);
              epd = extract32(tcr, 23, 1);
 +            sh = extract32(tcr, 28, 2);
              hpd = extract64(tcr, 42, 1);
          }
          ps = extract64(tcr, 32, 3);
 +        ds = extract64(tcr, 59, 1);
      }
 -    if (cpu_isar_feature(aa64_st, env_archcpu(env))) {
 +    if (cpu_isar_feature(aa64_st, cpu)) {
          max_tsz = 48 - using64k;
      } else {
          max_tsz = 39;
      }
 +    /*
-+     * Bits that we want in USR2 are not as conveniently laid out,
++     * DS is RES0 unless FEAT_LPA2 is supported for the given page size;
-+     * unfortunately.
++     * adjust the effective value of DS, as documented.
 +     */
-+    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+     min_tsz = 16;
-+    usr2 = s->usr2 & mask;
+     if (using64k) {
+-        if (cpu_isar_feature(aa64_lva, env_archcpu(env))) {
--    qemu_set_irq(s->irq, !!flags);
++        if (cpu_isar_feature(aa64_lva, cpu)) {
-+    qemu_set_irq(s->irq, usr1 || usr2);
++            min_tsz = 12;
 +        }
 +        ds = false;
 +    } else if (ds) {
 +        switch (mmu_idx) {
 +        case ARMMMUIdx_Stage2:
 +        case ARMMMUIdx_Stage2_S:
 +            if (using16k) {
 +                ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu);
 +            } else {
 +                ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu);
 +            }
 +            break;
 +        default:
 +            if (using16k) {
 +                ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu);
 +            } else {
 +                ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu);
 +            }
 +            break;
 +        }
 +        if (ds) {
              min_tsz = 12;
          }
      }
 -    /* TODO: FEAT_LPA2 */
      if (tsz > max_tsz) {
          tsz = max_tsz;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
      return (ARMVAParameters) {
          .tsz = tsz,
          .ps = ps,
 +        .sh = sh,
          .select = select,
          .tbi = tbi,
          .epd = epd,
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
          .using16k = using16k,
          .using64k = using64k,
          .tsz_oob = tsz_oob,
 +        .ds = ds,
      };
  }
- static void imx_serial_reset(IMXSerialState *s)
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
           * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
           */
          uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2);
 +        uint32_t sl2 = extract64(tcr->raw_tcr, 33, 1);
          uint32_t startlevel;
          bool ok;
 -        if (!aarch64 || stride == 9) {
 +        /* SL2 is RES0 unless DS=1 & 4kb granule. */
 +        if (param.ds && stride == 9 && sl2) {
 +            if (sl0 != 0) {
 +                level = 0;
 +                fault_type = ARMFault_Translation;
 +                goto do_fault;
 +            }
 +            startlevel = -1;
 +        } else if (!aarch64 || stride == 9) {
              /* AArch32 or 4KB pages */
              startlevel = 2 - sl0;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
       * for both v7 and v8.  However, for v8 the SBZ bits [47:40] must be 0
       * or an AddressSize fault is raised.  So for v8 we extract those SBZ
       * bits as part of the address, which will be checked via outputsize.
 -     * For AArch64, the address field always goes up to bit 47 (with extra
 -     * bits for FEAT_LPA placed elsewhere).  AArch64 implies v8.
 +     * For AArch64, the address field goes up to bit 47, or 49 with FEAT_LPA2;
 +     * the highest bits of a 52-bit output are placed elsewhere.
       */
 -    if (arm_feature(env, ARM_FEATURE_V8)) {
 +    if (param.ds) {
 +        descaddrmask = MAKE_64BIT_MASK(0, 50);
 +    } else if (arm_feature(env, ARM_FEATURE_V8)) {
          descaddrmask = MAKE_64BIT_MASK(0, 48);
      } else {
          descaddrmask = MAKE_64BIT_MASK(0, 40);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
          /*
           * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
 -         * of descriptor.  Otherwise, if descaddr is out of range, raise
 -         * AddressSizeFault.
 +         * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
 +         * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
 +         * raise AddressSizeFault.
           */
          if (outputsize > 48) {
 -            descaddr |= extract64(descriptor, 12, 4) << 48;
 +            if (param.ds) {
 +                descaddr |= extract64(descriptor, 8, 2) << 50;
 +            } else {
 +                descaddr |= extract64(descriptor, 12, 4) << 48;
 +            }
          } else if (descaddr >> outputsize) {
              fault_type = ARMFault_AddressSize;
              goto do_fault;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
          assert(attrindx <= 7);
          cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
      }
 -    cacheattrs->shareability = extract32(attrs, 6, 2);
 +
 +    /*
 +     * For FEAT_LPA2 and effective DS, the SH field in the attributes
 +     * was re-purposed for output address bits.  The SH attribute in
 +     * that case comes from TCR_ELx, which we extracted earlier.
 +     */
 +    if (param.ds) {
 +        cacheattrs->shareability = param.sh;
 +    } else {
 +        cacheattrs->shareability = extract32(attrs, 6, 2);
 +    }
      *phys_ptr = descaddr;
      *page_size_ptr = page_size;
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 07/13] hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
+[PULL 24/26] target/arm: Report KVM's actual PSCI version to guest in dtb
-If we're directly booting a Linux kernel and the CPU supports both
+When we're using KVM, the PSCI implementation is provided by the
-EL3 and EL2, we start the kernel in EL2, as it expects. We must also
+kernel, but QEMU has to tell the guest about it via the device tree.
-set the SCR_EL3.HCE bit in this situation, so that the HVC
+Currently we look at the KVM_CAP_ARM_PSCI_0_2 capability to determine
-instruction is enabled rather than UNDEFing. Otherwise at least some
+if the kernel is providing at least PSCI 0.2, but if the kernel
-kernels will panic when trying to initialize KVM in the guest.
+provides a newer version than that we will still only tell the guest
 it has PSCI 0.2.  (This is fairly harmless; it just means the guest
 won't use newer parts of the PSCI API.)
 The kernel exposes the specific PSCI version it is implementing via
 the ONE_REG API; use this to report in the dtb that the PSCI
 implementation is 1.0-compatible if appropriate.  (The device tree
 binding currently only distinguishes "pre-0.2", "0.2-compatible" and
 "1.0-compatible".)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
+Reviewed-by: Marc Zyngier <maz@kernel.org>
 Reviewed-by: Akihiko Odaki <akihiko.odaki@gmail.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20220224134655.1207865-1-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 5 +++++
+ target/arm/kvm-consts.h |  1 +
-file changed, 5 insertions(+)
+ hw/arm/boot.c           |  5 ++---
  target/arm/kvm64.c      | 12 ++++++++++++
 files changed, 15 insertions(+), 3 deletions(-)
+diff --git a/target/arm/kvm-consts.h b/target/arm/kvm-consts.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/kvm-consts.h
++++ b/target/arm/kvm-consts.h
+@@ -XXX,XX +XXX,XX @@ MISMATCH_CHECK(QEMU_PSCI_1_0_FN_PSCI_FEATURES, PSCI_1_0_FN_PSCI_FEATURES);
+ #define QEMU_PSCI_VERSION_0_1                     0x00001
+ #define QEMU_PSCI_VERSION_0_2                     0x00002
++#define QEMU_PSCI_VERSION_1_0                     0x10000
+ #define QEMU_PSCI_VERSION_1_1                     0x10001
+ MISMATCH_CHECK(QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED, PSCI_0_2_TOS_MP);
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
-                     assert(!info->secure_board_setup);
+     }
-                 }
+     qemu_fdt_add_subnode(fdt, "/psci");
-+                if (arm_feature(env, ARM_FEATURE_EL2)) {
+-    if (armcpu->psci_version == QEMU_PSCI_VERSION_0_2 ||
-+                    /* If we have EL2 then Linux expects the HVC insn to work */
+-        armcpu->psci_version == QEMU_PSCI_VERSION_1_1) {
-+                    env->cp15.scr_el3 |= SCR_HCE;
+-        if (armcpu->psci_version == QEMU_PSCI_VERSION_0_2) {
-+                }
++    if (armcpu->psci_version >= QEMU_PSCI_VERSION_0_2) {
 +        if (armcpu->psci_version < QEMU_PSCI_VERSION_1_0) {
              const char comp[] = "arm,psci-0.2\0arm,psci";
              qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
          } else {
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
      uint64_t mpidr;
      ARMCPU *cpu = ARM_CPU(cs);
      CPUARMState *env = &cpu->env;
 +    uint64_t psciver;
      if (cpu->kvm_target == QEMU_KVM_ARM_TARGET_NONE ||
          !object_dynamic_cast(OBJECT(cpu), TYPE_AARCH64_CPU)) {
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
          }
      }
 +    /*
 +     * KVM reports the exact PSCI version it is implementing via a
 +     * special sysreg. If it is present, use its contents to determine
 +     * what to report to the guest in the dtb (it is the PSCI version,
 +     * in the same 15-bits major 16-bits minor format that PSCI_VERSION
 +     * returns).
 +     */
 +    if (!kvm_get_one_reg(cs, KVM_REG_ARM_PSCI_VERSION, &psciver)) {
 +        cpu->psci_version = psciver;
 +    }
 +
-                 /* Set to non-secure if not a secure boot */
+     /*
-                 if (!info->secure_boot &&
+      * When KVM is in use, PSCI is emulated in-kernel and not by qemu.
-                     (cs != first_cpu || !info->secure_board_setup)) {
+      * Currently KVM has its own idea about MPIDR assignment, so we
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 13/13] hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
+[PULL 25/26] ui/cocoa.m: Fix updateUIInfo threading issues
-The raspi3 has AArch64 CPUs, which means that our smpboot
+The updateUIInfo method makes Cocoa API calls.  It also calls back
-code for keeping the secondary CPUs in a pen needs to have
+into QEMU functions like dpy_set_ui_info().  To do this safely, we
-a version for A64 as well as A32. Without this, the
+need to follow two rules:
-secondary CPUs go into an infinite loop of taking undefined
+ * Cocoa API calls are made on the Cocoa UI thread
-instruction exceptions.
+ * When calling back into QEMU we must hold the iothread lock
 Fix the places where we got this wrong, by taking the iothread lock
 while executing updateUIInfo, and moving the call in cocoa_switch()
 inside the dispatch_async block.
 Some of the Cocoa UI methods which call updateUIInfo are invoked as
 part of the initial application startup, while we're still doing the
 little cross-thread dance described in the comment just above
 call_qemu_main().  This meant they were calling back into the QEMU UI
 layer before we'd actually finished initializing our display and
 registered the DisplayChangeListener, which isn't really valid.  Once
 updateUIInfo takes the iothread lock, we no longer get away with
 this, because during this startup phase the iothread lock is held by
 the QEMU main-loop thread which is waiting for us to finish our
 display initialization.  So we must suppress updateUIInfo until
 applicationDidFinishLaunching allows the QEMU main-loop thread to
 continue.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Akihiko Odaki <akihiko.odaki@gmail.com>
-Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
+Tested-by: Akihiko Odaki <akihiko.odaki@gmail.com>
 Message-id: 20220224101330.967429-2-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
+ ui/cocoa.m | 25 ++++++++++++++++++++++---
-file changed, 40 insertions(+), 1 deletion(-)
+file changed, 22 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/ui/cocoa.m b/ui/cocoa.m
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/ui/cocoa.m
-+++ b/hw/arm/raspi.c
++++ b/ui/cocoa.m
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ QemuCocoaView *cocoaView;
- #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
+     }
  #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
  #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
 +#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
  /* Table of Linux board IDs for different Pi versions */
  static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
                         info->smp_loader_start);
  }
-+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
+-- (void) updateUIInfo
 +- (void) updateUIInfoLocked
  {
 +    /* Must be called with the iothread lock, i.e. via updateUIInfo */
      NSSize frameSize;
      QemuUIInfo info;
@@ -XXX,XX +XXX,XX @@ QemuCocoaView *cocoaView;
      dpy_set_ui_info(dcl.con, &info, TRUE);
  }
 +- (void) updateUIInfo
 +{
-+    /* Unlike the AArch32 version we don't need to call the board setup hook.
++    if (!allow_events) {
-+     * The mechanism for doing the spin-table is also entirely different.
++        /*
-+     * We must have four 64-bit fields at absolute addresses
++         * Don't try to tell QEMU about UI information in the application
-+     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
++         * startup phase -- we haven't yet registered dcl with the QEMU UI
-+     * our CPUs, and which we must ensure are zero initialized before
++         * layer, and also trying to take the iothread lock would deadlock.
-+     * the primary CPU goes into the kernel. We put these variables inside
++         * When cocoa_display_init() does register the dcl, the UI layer
-+     * a rom blob, so that the reset for ROM contents zeroes them for us.
++         * will call cocoa_switch(), which will call updateUIInfo, so
-+     */
++         * we don't lose any information here.
-+    static const uint32_t smpboot[] = {
++         */
-+        0xd2801b05, /*        mov     x5, 0xd8 */
++        return;
-+        0xd53800a6, /*        mrs     x6, mpidr_el1 */
++    }
 +        0x924004c6, /*        and     x6, x6, #0x3 */
 +        0xd503205f, /* spin:  wfe */
 +        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
 +        0xb4ffffc4, /*        cbz     x4, spin */
 +        0xd2800000, /*        mov     x0, #0x0 */
 +        0xd2800001, /*        mov     x1, #0x0 */
 +        0xd2800002, /*        mov     x2, #0x0 */
 +        0xd2800003, /*        mov     x3, #0x0 */
 +        0xd61f0080, /*        br      x4 */
 +    };
 +
-+    static const uint64_t spintables[] = {
++    with_iothread_lock(^{
-+        0, 0, 0, 0
++        [self updateUIInfoLocked];
-+    };
++    });
 +
 +    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
 +                       info->smp_loader_start);
 +    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
 +                       SPINTABLE_ADDR);
 +}
 +
- static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
+ - (void)viewDidMoveToWindow
  {
-     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
+     [self updateUIInfo];
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+@@ -XXX,XX +XXX,XX @@ static void cocoa_switch(DisplayChangeListener *dcl,
-     /* Pi2 and Pi3 requires SMP setup */
-     if (version >= 2) {
+     COCOA_DEBUG("qemu_cocoa: cocoa_switch\n");
-         binfo.smp_loader_start = SMPBOOT_ADDR;
--        binfo.write_secondary_boot = write_smpboot;
+-    [cocoaView updateUIInfo];
-+        if (version == 2) {
+-
-+            binfo.write_secondary_boot = write_smpboot;
+     // The DisplaySurface will be freed as soon as this callback returns.
-+        } else {
+     // We take a reference to the underlying pixman image here so it does
-+            binfo.write_secondary_boot = write_smpboot64;
+     // not disappear from under our feet; the switchSurface method will
-+        }
+@@ -XXX,XX +XXX,XX @@ static void cocoa_switch(DisplayChangeListener *dcl,
-         binfo.secondary_cpu_reset_hook = reset_secondary;
+     pixman_image_ref(image);
-     }
+     dispatch_async(dispatch_get_main_queue(), ^{
 +        [cocoaView updateUIInfo];
          [cocoaView switchSurface:image];
      });
      [pool release];
 --
-.16.2
+.25.1

-[Qemu-devel] [PULL 12/13] hw/arm/bcm2836: Hardcode correct CPU type
+[PULL 26/26] ui/cocoa.m: Remove unnecessary NSAutoreleasePools
-Now we have separate types for BCM2386 and BCM2387, we might as well
+In commit 6e657e64cdc478 in 2013 we added some autorelease pools to
-just hard-code the CPU type they use rather than having it passed
+deal with complaints from macOS when we made calls into Cocoa from
-through as an object property. This then lets us put the initialization
+threads that didn't have automatically created autorelease pools.
-of the CPU object in init rather than realize.
+Later on, macOS got stricter about forbidding cross-thread Cocoa
 calls, and in commit 5588840ff77800e839d8 we restructured the code to
 avoid them.  This left the autorelease pool creation in several
 functions without any purpose; delete it.
-Note that this change means that it's no longer possible on
+We still need the pool in cocoa_refresh() for the clipboard related
-the command line to use -cpu to ask for a different kind of
+code which is called directly there.
 CPU than the SoC supports. This was never a supported thing to
 do anyway; we were just not sanity-checking the command line.
 This does require us to only build the bcm2837 object on
 TARGET_AARCH64 configs, since otherwise it won't instantiate
 due to the missing cortex-a53 device and "make check" will fail.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Reviewed-by: Akihiko Odaki <akihiko.odaki@gmail.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Akihiko Odaki <akihiko.odaki@gmail.com>
-Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
+Message-id: 20220224101330.967429-3-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 24 +++++++++++++++---------
+ ui/cocoa.m | 6 ------
- hw/arm/raspi.c   |  2 --
+file changed, 6 deletions(-)
 files changed, 15 insertions(+), 11 deletions(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/ui/cocoa.m b/ui/cocoa.m
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/ui/cocoa.m
-+++ b/hw/arm/bcm2836.c
++++ b/ui/cocoa.m
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ int main (int argc, char **argv) {
+ static void cocoa_update(DisplayChangeListener *dcl,
- struct BCM283XInfo {
+                          int x, int y, int w, int h)
      const char *name;
 +    const char *cpu_type;
      int clusterid;
  };
  static const BCM283XInfo bcm283x_socs[] = {
      {
          .name = TYPE_BCM2836,
 +        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
          .clusterid = 0xf,
      },
 +#ifdef TARGET_AARCH64
      {
          .name = TYPE_BCM2837,
 +        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
          .clusterid = 0x0,
      },
 +#endif
  };
  static void bcm2836_init(Object *obj)
  {
-     BCM283XState *s = BCM283X(obj);
+-    NSAutoreleasePool * pool = [[NSAutoreleasePool alloc] init];
 +    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
 +    const BCM283XInfo *info = bc->info;
 +    int n;
 +
 +    for (n = 0; n < BCM283X_NCPUS; n++) {
 +        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
 +                          info->cpu_type);
 +        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
 +                                  &error_abort);
 +    }
      object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
      object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
      /* common peripherals from bcm2835 */
 -    obj = OBJECT(dev);
 -    for (n = 0; n < BCM283X_NCPUS; n++) {
 -        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
 -                          s->cpu_type);
 -        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
 -                                  &error_abort);
 -    }
 -
-     obj = object_property_get_link(OBJECT(dev), "ram", &err);
+     COCOA_DEBUG("qemu_cocoa: cocoa_update\n");
-     if (obj == NULL) {
-         error_setg(errp, "%s: required ram link not found: %s",
+     dispatch_async(dispatch_get_main_queue(), ^{
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void cocoa_update(DisplayChangeListener *dcl,
          }
          [cocoaView setNeedsDisplayInRect:rect];
      });
 -
 -    [pool release];
  }
- static Property bcm2836_props[] = {
+ static void cocoa_switch(DisplayChangeListener *dcl,
--    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
+                          DisplaySurface *surface)
-     DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
+ {
-                        BCM283X_NCPUS),
+-    NSAutoreleasePool * pool = [[NSAutoreleasePool alloc] init];
-     DEFINE_PROP_END_OF_LIST()
+     pixman_image_t *image = surface->image;
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
-index XXXXXXX..XXXXXXX 100644
+     COCOA_DEBUG("qemu_cocoa: cocoa_switch\n");
---- a/hw/arm/raspi.c
+@@ -XXX,XX +XXX,XX @@ static void cocoa_switch(DisplayChangeListener *dcl,
-+++ b/hw/arm/raspi.c
+         [cocoaView updateUIInfo];
-@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
+         [cocoaView switchSurface:image];
-     /* Setup the SOC */
+     });
-     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
+-    [pool release];
-                                    &error_abort);
+ }
--    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
--                            &error_abort);
+ static void cocoa_refresh(DisplayChangeListener *dcl)
      object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                              &error_abort);
      int board_rev = version == 3 ? 0xa02082 : 0xa21041;
 --
-.16.2
+.25.1

Arm patch queue -- these are all bug fix patches but we might
as well put them in to rc0...

thanks
-- PMM

The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319

for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:

hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)

----------------------------------------------------------------
target-arm queue:
 * fsl-imx6: Fix incorrect Ethernet interrupt defines
 * dump: Update correct kdump phys_base field for AArch64
 * char: i.MX: Add support for "TX complete" interrupt
 * bcm2836/raspi: Fix various bugs resulting in panics trying
   to boot a Debian Linux kernel on raspi3

----------------------------------------------------------------
Andrey Smirnov (2):
      char: i.MX: Simplify imx_update()
      char: i.MX: Add support for "TX complete" interrupt

Guenter Roeck (1):
      fsl-imx6: Swap Ethernet interrupt defines

Peter Maydell (9):
      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
      hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
      hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
      hw/arm/bcm2386: Fix parent type of bcm2386
      hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
      hw/arm/bcm2836: Create proper bcm2837 device
      hw/arm/bcm2836: Use correct affinity values for BCM2837
      hw/arm/bcm2836: Hardcode correct CPU type
      hw/arm/raspi: Provide spin-loop code for AArch64 CPUs

Wei Huang (1):
      dump: Update correct kdump phys_base field for AArch64

From: Guenter Roeck <linux@roeck-us.net>

The sabrelite machine model used by qemu-system-arm is based on the
Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
controller which is supported in QEMU using the imx_fec.c module
(actually called imx.enet for this model.)

The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
imx.enet device like this:

#define FSL_IMX6_ENET_MAC_1588_IRQ 118
 #define FSL_IMX6_ENET_MAC_IRQ 119

According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
interrupts are as follows.

150 ENET MAC 0 IRQ
151 ENET MAC 0 1588 Timer interrupt

where

150 - 32 == 118
151 - 32 == 119

In other words, the vector definitions in the fsl-imx6.h file are reversed.

Fixing the interrupts alone causes problems with older Linux kernels:
The Ethernet interface will fail to probe with Linux v4.9 and earlier.
Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
error handling. This is a Linux kernel problem, not a qemu problem:
the Linux kernel only worked by accident since it requested both interrupts.

For backward compatibility, generate the Ethernet interrupt on both interrupt
lines. This was shown to work from all Linux kernel releases starting with
v3.16.

Link: https://bugs.launchpad.net/qemu/+bug/1753309
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h |  4 ++--
 hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
 #define FSL_IMX6_HDMI_MASTER_IRQ 115
 #define FSL_IMX6_HDMI_CEC_IRQ 116
 #define FSL_IMX6_MLB150_LOW_IRQ 117
-#define FSL_IMX6_ENET_MAC_1588_IRQ 118
-#define FSL_IMX6_ENET_MAC_IRQ 119
+#define FSL_IMX6_ENET_MAC_IRQ 118
+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
 #define FSL_IMX6_PCIE1_IRQ 120
 #define FSL_IMX6_PCIE2_IRQ 121
 #define FSL_IMX6_PCIE3_IRQ 122
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
 
 static void imx_eth_update(IMXFECState *s)
 {
-    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
+    /*
+     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
+     * interrupts swapped. This worked with older versions of Linux (4.14
+     * and older) since Linux associated both interrupt lines with Ethernet
+     * MAC interrupts. Specifically,
+     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
+     *   timer interrupts. Those versions of Linux fail with versions of QEMU
+     *   with swapped interrupt assignments.
+     * - In linux 4.14, both interrupt lines were registered with the Ethernet
+     *   MAC interrupt handler. As a result, all versions of qemu happen to
+     *   work, though that is accidental.
+     * - In Linux 4.9 and older, the timer interrupt was registered directly
+     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
+     *   redirected to a GPIO interrupt to work around erratum ERR006687.
+     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
+     *   interrupt never fired since IOMUX is currently not supported in qemu.
+     *   Linux instead received MAC interrupts on the timer interrupt.
+     *   As a result, qemu versions with the swapped interrupt assignment work,
+     *   albeit accidentally, but qemu versions with the correct interrupt
+     *   assignment fail.
+     *
+     * To ensure that all versions of Linux work, generate ENET_INT_MAC
+     * interrrupts on both interrupt lines. This should be changed if and when
+     * qemu supports IOMUX.
+     */
+    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
+        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
         qemu_set_irq(s->irq[1], 1);
     } else {
         qemu_set_irq(s->irq[1], 0);
-- 
2.16.2

From: Wei Huang <wei@redhat.com>

For guest kernel that supports KASLR, the load address can change every
time when guest VM runs. To find the physical base address correctly,
current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
However this string pattern is only available on x86_64. AArch64 uses a
different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
QEMU dump uses the correct string on AArch64.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 dump.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/dump.c b/dump.c
index XXXXXXX..XXXXXXX 100644
--- a/dump.c
+++ b/dump.c
@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
 
     lines = g_strsplit((char *)vmci, "\n", -1);
     for (i = 0; lines[i]; i++) {
-        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
-            if (qemu_strtou64(lines[i] + 18, NULL, 16,
+        const char *prefix = NULL;
+
+        if (s->dump_info.d_machine == EM_X86_64) {
+            prefix = "NUMBER(phys_base)=";
+        } else if (s->dump_info.d_machine == EM_AARCH64) {
+            prefix = "NUMBER(PHYS_OFFSET)=";
+        }
+
+        if (prefix && g_str_has_prefix(lines[i], prefix)) {
+            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
                               &phys_base) < 0) {
-                warn_report("Failed to read NUMBER(phys_base)=");
+                warn_report("Failed to read %s", prefix);
             } else {
                 s->dump_info.phys_base = phys_base;
             }
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Code of imx_update() is slightly confusing since the "flags" variable
doesn't really corespond to anything in real hardware and server as a
kitchensink accumulating events normally reported via USR1 and USR2
registers.

Change the code to explicitly evaluate state of interrupts reported
via USR1 and USR2 against corresponding masking bits and use the to
detemine if IRQ line should be asserted or not.

NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
reasons:

1. Emulation code implements a single character FIFO, so this flag
       will always be set since characters are trasmitted as a part of
       the code emulating "push" into the FIFO

2. imx_update() is really just a function doing ORing and maksing
       of reported events, so checking for UTS1_TXEMPTY should happen,
       if it's ever really needed should probably happen outside of
       it.

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/imx_serial.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
 
 static void imx_update(IMXSerialState *s)
 {
-    uint32_t flags;
+    uint32_t usr1;
+    uint32_t usr2;
+    uint32_t mask;
 
-    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
-    if (s->ucr1 & UCR1_TXMPTYEN) {
-        flags |= (s->uts1 & UTS1_TXEMPTY);
-    } else {
-        flags &= ~USR1_TRDY;
-    }
+    /*
+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
+     * UCR1, so we can get away with something as simple as the
+     * following:
+     */
+    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
+    /*
+     * Bits that we want in USR2 are not as conveniently laid out,
+     * unfortunately.
+     */
+    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    usr2 = s->usr2 & mask;
 
-    qemu_set_irq(s->irq, !!flags);
+    qemu_set_irq(s->irq, usr1 || usr2);
 }
 
 static void imx_serial_reset(IMXSerialState *s)
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Add support for "TX complete"/TXDC interrupt generate by real HW since
it is needed to support guests other than Linux.

Based on the patch by Bill Paul as found here:
https://bugs.launchpad.net/qemu/+bug/1753314

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bill Paul <wpaul@windriver.com>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/imx_serial.h |  3 +++
 hw/char/imx_serial.c         | 20 +++++++++++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -XXX,XX +XXX,XX @@
 #define UCR2_RXEN       (1<<1)    /* Receiver enable */
 #define UCR2_SRST       (1<<0)    /* Reset complete */
 
+#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
+
 #define UTS1_TXEMPTY    (1<<6)
 #define UTS1_RXEMPTY    (1<<5)
 #define UTS1_TXFULL     (1<<4)
@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
     uint32_t ubmr;
     uint32_t ubrc;
     uint32_t ucr3;
+    uint32_t ucr4;
 
     qemu_irq irq;
     CharBackend chr;
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@
 
 static const VMStateDescription vmstate_imx_serial = {
     .name = TYPE_IMX_SERIAL,
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_INT32(readbuff, IMXSerialState),
         VMSTATE_UINT32(usr1, IMXSerialState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
         VMSTATE_UINT32(ubmr, IMXSerialState),
         VMSTATE_UINT32(ubrc, IMXSerialState),
         VMSTATE_UINT32(ucr3, IMXSerialState),
+        VMSTATE_UINT32(ucr4, IMXSerialState),
         VMSTATE_END_OF_LIST()
     },
 };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
      * unfortunately.
      */
     mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    /*
+     * TCEN and TXDC are both bit 3
+     */
+    mask |= s->ucr4 & UCR4_TCEN;
+
     usr2 = s->usr2 & mask;
 
     qemu_set_irq(s->irq, usr1 || usr2);
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
         return s->ucr3;
 
     case 0x23: /* UCR4 */
+        return s->ucr4;
+
     case 0x29: /* BRM Incremental */
         return 0x0; /* TODO */
 
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
              * qemu_chr_fe_write and background I/O callbacks */
             qemu_chr_fe_write_all(&s->chr, &ch, 1);
             s->usr1 &= ~USR1_TRDY;
+            s->usr2 &= ~USR2_TXDC;
             imx_update(s);
             s->usr1 |= USR1_TRDY;
+            s->usr2 |= USR2_TXDC;
             imx_update(s);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
         s->ucr3 = value & 0xffff;
         break;
 
-    case 0x2d: /* UTS1 */
     case 0x23: /* UCR4 */
+        s->ucr4 = value & 0xffff;
+        imx_update(s);
+        break;
+
+    case 0x2d: /* UTS1 */
         qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
                       HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
         /* TODO */
-- 
2.16.2

For the rpi1 and 2 we want to boot the Linux kernel via some
custom setup code that makes sure that the SMC instruction
acts as a no-op, because it's used for cache maintenance.
The rpi3 boots AArch64 kernels, which don't need SMC for
cache maintenance and always expect to be booted non-secure.
Don't fill in the aarch32-specific parts of the binfo struct.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     binfo.board_id = raspi_boardid[version];
     binfo.ram_size = ram_size;
     binfo.nb_cpus = smp_cpus;
-    binfo.board_setup_addr = BOARDSETUP_ADDR;
-    binfo.write_board_setup = write_board_setup;
-    binfo.secure_board_setup = true;
-    binfo.secure_boot = true;
+
+    if (version <= 2) {
+        /* The rpi1 and 2 require some custom setup code to run in Secure
+         * mode before booting a kernel (to set up the SMC vectors so
+         * that we get a no-op SMC; this is used by Linux to call the
+         * firmware for some cache maintenance operations.
+         * The rpi3 doesn't need this.
+         */
+        binfo.board_setup_addr = BOARDSETUP_ADDR;
+        binfo.write_board_setup = write_board_setup;
+        binfo.secure_board_setup = true;
+        binfo.secure_boot = true;
+    }
 
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
-- 
2.16.2

Add some assertions that if we're about to boot an AArch64 kernel,
the board code has not mistakenly set either secure_boot or
secure_board_setup. It doesn't make sense to set secure_boot,
because all AArch64 kernels must be booted in non-secure mode.

It might in theory make sense to set secure_board_setup, but
we don't currently support that, because only the AArch32
bootloader[] code calls this hook; bootloader_aarch64[] does not.
Since we don't have a current need for this functionality, just
assert that we don't try to use it. If it's needed we'll add
it later.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     } else {
                         env->pstate = PSTATE_MODE_EL1h;
                     }
+                    /* AArch64 kernels never boot in secure mode */
+                    assert(!info->secure_boot);
+                    /* This hook is only supported for AArch32 currently:
+                     * bootloader_aarch64[] will not call the hook, and
+                     * the code above has already dropped us into EL2 or EL1.
+                     */
+                    assert(!info->secure_board_setup);
                 }
 
                 /* Set to non-secure if not a secure boot */
-- 
2.16.2

If we're directly booting a Linux kernel and the CPU supports both
EL3 and EL2, we start the kernel in EL2, as it expects. We must also
set the SCR_EL3.HCE bit in this situation, so that the HVC
instruction is enabled rather than UNDEFing. Otherwise at least some
kernels will panic when trying to initialize KVM in the guest.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
---
 hw/arm/boot.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     assert(!info->secure_board_setup);
                 }
 
+                if (arm_feature(env, ARM_FEATURE_EL2)) {
+                    /* If we have EL2 then Linux expects the HVC insn to work */
+                    env->cp15.scr_el3 |= SCR_HCE;
+                }
+
                 /* Set to non-secure if not a secure boot */
                 if (!info->secure_boot &&
                     (cs != first_cpu || !info->secure_board_setup)) {
-- 
2.16.2

The TypeInfo and state struct for bcm2386 disagree about what the
parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
but the BCM2386State struct only defines the parent_obj field
as DeviceState. This would have caused problems if anything
actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
need any of the additional functionality TYPE_SYS_BUS_DEVICE
provides.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 
 static const TypeInfo bcm2836_type_info = {
     .name = TYPE_BCM2836,
-    .parent = TYPE_SYS_BUS_DEVICE,
+    .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM2836State),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
-- 
2.16.2

Our BCM2836 type is really a generic one that can be any of
the bcm283x family. Rename it accordingly. We change only
the names which are visible via the header file to the
rest of the QEMU code, leaving private function names
in bcm2836.c as they are.

This is a preliminary to making bcm283x be an abstract
parent class to specific types for the bcm2836 and bcm2837.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 12 ++++++------
 hw/arm/bcm2836.c         | 17 +++++++++--------
 hw/arm/raspi.c           | 16 ++++++++--------
 3 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
-#define TYPE_BCM2836 "bcm2836"
-#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
+#define TYPE_BCM283X "bcm283x"
+#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
 
-#define BCM2836_NCPUS 4
+#define BCM283X_NCPUS 4
 
-typedef struct BCM2836State {
+typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
     /*< public >*/
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
     char *cpu_type;
     uint32_t enabled_cpus;
 
-    ARMCPU cpus[BCM2836_NCPUS];
+    ARMCPU cpus[BCM283X_NCPUS];
     BCM2836ControlState control;
     BCM2835PeripheralState peripherals;
-} BCM2836State;
+} BCM283XState;
 
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 static void bcm2836_init(Object *obj)
 {
-    BCM2836State *s = BCM2836(obj);
+    BCM283XState *s = BCM283X(obj);
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
 
 static void bcm2836_realize(DeviceState *dev, Error **errp)
 {
-    BCM2836State *s = BCM2836(dev);
+    BCM283XState *s = BCM283X(dev);
     Object *obj;
     Error *err = NULL;
     int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     /* common peripherals from bcm2835 */
 
     obj = OBJECT(dev);
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
                           s->cpu_type);
         object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         /* Mirror bcm2836, which has clusterid set to 0xf
          * TODO: this should be converted to a property of ARM_CPU
          */
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
-    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
+    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
+    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
+                       BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
 };
 
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 }
 
 static const TypeInfo bcm2836_type_info = {
-    .name = TYPE_BCM2836,
+    .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
-    .instance_size = sizeof(BCM2836State),
+    .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
 };
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
 
 typedef struct RasPiState {
-    BCM2836State soc;
+    BCM283XState soc;
     MemoryRegion ram;
 } RasPiState;
 
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
     mc->ignore_memory_transaction_failures = true;
 };
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
 }
 DEFINE_MACHINE("raspi3", raspi3_machine_init)
-- 
2.16.2

The bcm2837 is pretty similar to the bcm2836, but it does have
some differences. Notably, the MPIDR affinity aff1 values it
sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
uses, and if this is wrong Linux will not boot.

Rather than trying to have one device with properties that
configure it differently for the two cases, create two
separate QOM devices for the two SoCs. We use the same approach
as hw/arm/aspeed_soc.c and share code and have a data table
that might differ per-SoC. For the moment the two types don't
actually have different behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
 hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
 hw/arm/raspi.c           |  3 ++-
 3 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 
 #define BCM283X_NCPUS 4
 
+/* These type names are for specific SoCs; other than instantiating
+ * them, code using these devices should always handle them via the
+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
+ */
+#define TYPE_BCM2836 "bcm2836"
+#define TYPE_BCM2837 "bcm2837"
+
 typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
     BCM2835PeripheralState peripherals;
 } BCM283XState;
 
+typedef struct BCM283XInfo BCM283XInfo;
+
+typedef struct BCM283XClass {
+    DeviceClass parent_class;
+    const BCM283XInfo *info;
+} BCM283XClass;
+
+#define BCM283X_CLASS(klass) \
+    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
+#define BCM283X_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
+
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
 #define BCM2836_CONTROL_BASE    0x40000000
 
+struct BCM283XInfo {
+    const char *name;
+};
+
+static const BCM283XInfo bcm283x_socs[] = {
+    {
+        .name = TYPE_BCM2836,
+    },
+    {
+        .name = TYPE_BCM2837,
+    },
+};
+
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
-static void bcm2836_class_init(ObjectClass *oc, void *data)
+static void bcm283x_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
+    BCM283XClass *bc = BCM283X_CLASS(oc);
 
-    dc->props = bcm2836_props;
+    bc->info = data;
     dc->realize = bcm2836_realize;
+    dc->props = bcm2836_props;
 }
 
-static const TypeInfo bcm2836_type_info = {
+static const TypeInfo bcm283x_type_info = {
     .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
-    .class_init = bcm2836_class_init,
+    .class_size = sizeof(BCM283XClass),
+    .abstract = true,
 };
 
 static void bcm2836_register_types(void)
 {
-    type_register_static(&bcm2836_type_info);
+    int i;
+
+    type_register_static(&bcm283x_type_info);
+    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
+        TypeInfo ti = {
+            .name = bcm283x_socs[i].name,
+            .parent = TYPE_BCM283X,
+            .class_init = bcm283x_class_init,
+            .class_data = (void *) &bcm283x_socs[i],
+        };
+        type_register(&ti);
+    }
 }
 
 type_init(bcm2836_register_types)
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
+    object_initialize(&s->soc, sizeof(s->soc),
+                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
-- 
2.16.2

The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
is required for Linux to boot.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Now we have separate types for BCM2386 and BCM2387, we might as well
just hard-code the CPU type they use rather than having it passed
through as an object property. This then lets us put the initialization
of the CPU object in init rather than realize.

Note that this change means that it's no longer possible on
the command line to use -cpu to ask for a different kind of
CPU than the SoC supports. This was never a supported thing to
do anyway; we were just not sanity-checking the command line.

This does require us to only build the bcm2837 object on
TARGET_AARCH64 configs, since otherwise it won't instantiate
due to the missing cortex-a53 device and "make check" will fail.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 24 +++++++++++++++---------
 hw/arm/raspi.c   |  2 --
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 struct BCM283XInfo {
     const char *name;
+    const char *cpu_type;
     int clusterid;
 };
 
 static const BCM283XInfo bcm283x_socs[] = {
     {
         .name = TYPE_BCM2836,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
         .clusterid = 0xf,
     },
+#ifdef TARGET_AARCH64
     {
         .name = TYPE_BCM2837,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
         .clusterid = 0x0,
     },
+#endif
 };
 
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
+    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
+    const BCM283XInfo *info = bc->info;
+    int n;
+
+    for (n = 0; n < BCM283X_NCPUS; n++) {
+        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
+                          info->cpu_type);
+        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
+                                  &error_abort);
+    }
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
     /* common peripherals from bcm2835 */
 
-    obj = OBJECT(dev);
-    for (n = 0; n < BCM283X_NCPUS; n++) {
-        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
-                          s->cpu_type);
-        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
-                                  &error_abort);
-    }
-
     obj = object_property_get_link(OBJECT(dev), "ram", &err);
     if (obj == NULL) {
         error_setg(errp, "%s: required ram link not found: %s",
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
     DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
                        BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     /* Setup the SOC */
     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
                                    &error_abort);
-    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
-                            &error_abort);
     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                             &error_abort);
     int board_rev = version == 3 ? 0xa02082 : 0xa21041;
-- 
2.16.2

The raspi3 has AArch64 CPUs, which means that our smpboot
code for keeping the secondary CPUs in a pen needs to have
a version for A64 as well as A32. Without this, the
secondary CPUs go into an infinite loop of taking undefined
instruction exceptions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
 #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
 #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
+#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
 
 /* Table of Linux board IDs for different Pi versions */
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
                        info->smp_loader_start);
 }
 
+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
+{
+    /* Unlike the AArch32 version we don't need to call the board setup hook.
+     * The mechanism for doing the spin-table is also entirely different.
+     * We must have four 64-bit fields at absolute addresses
+     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
+     * our CPUs, and which we must ensure are zero initialized before
+     * the primary CPU goes into the kernel. We put these variables inside
+     * a rom blob, so that the reset for ROM contents zeroes them for us.
+     */
+    static const uint32_t smpboot[] = {
+        0xd2801b05, /*        mov     x5, 0xd8 */
+        0xd53800a6, /*        mrs     x6, mpidr_el1 */
+        0x924004c6, /*        and     x6, x6, #0x3 */
+        0xd503205f, /* spin:  wfe */
+        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
+        0xb4ffffc4, /*        cbz     x4, spin */
+        0xd2800000, /*        mov     x0, #0x0 */
+        0xd2800001, /*        mov     x1, #0x0 */
+        0xd2800002, /*        mov     x2, #0x0 */
+        0xd2800003, /*        mov     x3, #0x0 */
+        0xd61f0080, /*        br      x4 */
+    };
+
+    static const uint64_t spintables[] = {
+        0, 0, 0, 0
+    };
+
+    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
+                       info->smp_loader_start);
+    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
+                       SPINTABLE_ADDR);
+}
+
 static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
 {
     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
         binfo.smp_loader_start = SMPBOOT_ADDR;
-        binfo.write_secondary_boot = write_smpboot;
+        if (version == 2) {
+            binfo.write_secondary_boot = write_smpboot;
+        } else {
+            binfo.write_secondary_boot = write_smpboot64;
+        }
         binfo.secondary_cpu_reset_hook = reset_secondary;
     }
 
-- 
2.16.2

The following changes since commit 64ada298b98a51eb2512607f6e6180cb330c47b1:

Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220302' into staging (2022-03-02 12:38:46 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220302

for you to fetch changes up to 268c11984e67867c22f53beb3c7f8b98900d66b2:

ui/cocoa.m: Remove unnecessary NSAutoreleasePools (2022-03-02 19:27:37 +0000)

----------------------------------------------------------------
target-arm queue:
 * mps3-an547: Add missing user ahb interfaces
 * hw/arm/mps2-tz.c: Update AN547 documentation URL
 * hw/input/tsc210x: Don't abort on bad SPI word widths
 * hw/i2c: flatten pca954x mux device
 * target/arm: Support PSCI 1.1 and SMCCC 1.0
 * target/arm: Fix early free of TCG temp in handle_simd_shift_fpint_conv()
 * tests/qtest: add qtests for npcm7xx sdhci
 * Implement FEAT_LVA
 * Implement FEAT_LPA
 * Implement FEAT_LPA2 (but do not enable it yet)
 * Report KVM's actual PSCI version to guest in dtb
 * ui/cocoa.m: Fix updateUIInfo threading issues
 * ui/cocoa.m: Remove unnecessary NSAutoreleasePools

----------------------------------------------------------------
Akihiko Odaki (1):
      target/arm: Support PSCI 1.1 and SMCCC 1.0

Jimmy Brisson (1):
      mps3-an547: Add missing user ahb interfaces

Patrick Venture (1):
      hw/i2c: flatten pca954x mux device

Peter Maydell (5):
      hw/arm/mps2-tz.c: Update AN547 documentation URL
      hw/input/tsc210x: Don't abort on bad SPI word widths
      target/arm: Report KVM's actual PSCI version to guest in dtb
      ui/cocoa.m: Fix updateUIInfo threading issues
      ui/cocoa.m: Remove unnecessary NSAutoreleasePools

Richard Henderson (16):
      hw/registerfields: Add FIELD_SEX<N> and FIELD_SDP<N>
      target/arm: Set TCR_EL1.TSZ for user-only
      target/arm: Fault on invalid TCR_ELx.TxSZ
      target/arm: Move arm_pamax out of line
      target/arm: Pass outputsize down to check_s2_mmu_setup
      target/arm: Use MAKE_64BIT_MASK to compute indexmask
      target/arm: Honor TCR_ELx.{I}PS
      target/arm: Prepare DBGBVR and DBGWVR for FEAT_LVA
      target/arm: Implement FEAT_LVA
      target/arm: Implement FEAT_LPA
      target/arm: Extend arm_fi_to_lfsc to level -1
      target/arm: Introduce tlbi_aa64_get_range
      target/arm: Fix TLBIRange.base for 16k and 64k pages
      target/arm: Validate tlbi TG matches translation granule in use
      target/arm: Advertise all page sizes for -cpu max
      target/arm: Implement FEAT_LPA2

Shengtan Mao (1):
      tests/qtest: add qtests for npcm7xx sdhci

Wentao_Liang (1):
      target/arm: Fix early free of TCG temp in handle_simd_shift_fpint_conv()

From: Jimmy Brisson <jimmy.brisson@linaro.org>

With these interfaces missing, TFM would delegate peripherals 0, 1,
2, 3 and 8, and qemu would ignore the delegation of interface 8, as
it thought interface 4 was eth & USB.

This patch corrects this behavior and allows TFM to delegate the
eth & USB peripheral to NS mode.

(The old QEMU behaviour was based on revision B of the AN547
appnote; revision C corrects this error in the documentation,
and this commit brings QEMU in to line with how the FPGA
image really behaves.)

Signed-off-by: Jimmy Brisson <jimmy.brisson@linaro.org>
Message-id: 20220210210227.3203883-1-jimmy.brisson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: added commit message note clarifying that the old behaviour
was a docs issue, not because there were two different versions
of the FPGA image]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/mps2-tz.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                 { "gpio1", make_unimp_dev, &mms->gpio[1], 0x41101000, 0x1000 },
                 { "gpio2", make_unimp_dev, &mms->gpio[2], 0x41102000, 0x1000 },
                 { "gpio3", make_unimp_dev, &mms->gpio[3], 0x41103000, 0x1000 },
+                { /* port 4 USER AHB interface 0 */ },
+                { /* port 5 USER AHB interface 1 */ },
+                { /* port 6 USER AHB interface 2 */ },
+                { /* port 7 USER AHB interface 3 */ },
                 { "eth-usb", make_eth_usb, NULL, 0x41400000, 0x200000, { 49 } },
             },
         },
-- 
2.25.1

The AN547 application note URL has changed: update our comment
accordingly. (Rev B is still downloadable from the old URL,
but there is a new Rev C of the document now.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220221094144.426191-1-peter.maydell@linaro.org
---
 hw/arm/mps2-tz.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@
  * Application Note AN524:
  * https://developer.arm.com/documentation/dai0524/latest/
  * Application Note AN547:
- * https://developer.arm.com/-/media/Arm%20Developer%20Community/PDF/DAI0547B_SSE300_PLUS_U55_FPGA_for_mps3.pdf
+ * https://developer.arm.com/documentation/dai0547/latest/
  *
  * The AN505 defers to the Cortex-M33 processor ARMv8M IoT Kit FVP User Guide
  * (ARM ECM0601256) for the details of some of the device layout:
-- 
2.25.1

The tsc210x doesn't support anything other than 16-bit reads on the
SPI bus, but the guest can program the SPI controller to attempt
them anyway. If this happens, don't abort QEMU, just log this as
a guest error.

This fixes our machine_arm_n8x0.py:N8x0Machine.test_n800
acceptance test, which hits this assertion.

The reason we hit the assertion is because the guest kernel thinks
there is a TSC2005 on this SPI bus address, not a TSC210x.  (The n810
*does* have a TSC2005 at this address.) The TSC2005 supports the
24-bit accesses which the guest driver makes, and the TSC210x does
not (that is, our TSC210x emulation is not missing support for a word
width the hardware can handle).  It's not clear whether the problem
here is that the guest kernel incorrectly thinks the n800 has the
same device at this SPI bus address as the n810, or that QEMU's n810
board model doesn't get the SPI devices right.  At this late date
there no longer appears to be any reliable information on the web
about the hardware behaviour, but I am inclined to think this is a
guest kernel bug.  In any case, we prefer not to abort QEMU for
guest-triggerable conditions, so logging the error is the right thing
to do.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/736
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20220221140750.514557-1-peter.maydell@linaro.org
---
 hw/input/tsc210x.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/input/tsc210x.c b/hw/input/tsc210x.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/input/tsc210x.c
+++ b/hw/input/tsc210x.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/hw.h"
 #include "audio/audio.h"
 #include "qemu/timer.h"
+#include "qemu/log.h"
 #include "sysemu/reset.h"
 #include "ui/console.h"
 #include "hw/arm/omap.h"            /* For I2SCodec */
@@ -XXX,XX +XXX,XX @@ uint32_t tsc210x_txrx(void *opaque, uint32_t value, int len)
     TSC210xState *s = opaque;
     uint32_t ret = 0;
 
-    if (len != 16)
-        hw_error("%s: FIXME: bad SPI word width %i\n", __func__, len);
+    if (len != 16) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: bad SPI word width %i\n", __func__, len);
+        return 0;
+    }
 
     /* TODO: sequential reads etc - how do we make sure the host doesn't
      * unintentionally read out a conversion result from a register while
-- 
2.25.1

From: Patrick Venture <venture@google.com>

Previously this device created N subdevices which each owned an i2c bus.
Now this device simply owns the N i2c busses directly.

Tested: Verified devices behind mux are still accessible via qmp and i2c
from within an arm32 SoC.

Reviewed-by: Hao Wu <wuhaotsh@google.com>
Signed-off-by: Patrick Venture <venture@google.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Tested-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20220202164533.1283668-1-venture@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i2c/i2c_mux_pca954x.c | 77 +++++++---------------------------------
 1 file changed, 13 insertions(+), 64 deletions(-)

diff --git a/hw/i2c/i2c_mux_pca954x.c b/hw/i2c/i2c_mux_pca954x.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i2c/i2c_mux_pca954x.c
+++ b/hw/i2c/i2c_mux_pca954x.c
@@ -XXX,XX +XXX,XX @@
 #define PCA9548_CHANNEL_COUNT 8
 #define PCA9546_CHANNEL_COUNT 4
 
-/*
- * struct Pca954xChannel - The i2c mux device will have N of these states
- * that own the i2c channel bus.
- * @bus: The owned channel bus.
- * @enabled: Is this channel active?
- */
-typedef struct Pca954xChannel {
-    SysBusDevice parent;
-
-    I2CBus       *bus;
-
-    bool         enabled;
-} Pca954xChannel;
-
-#define TYPE_PCA954X_CHANNEL "pca954x-channel"
-#define PCA954X_CHANNEL(obj) \
-    OBJECT_CHECK(Pca954xChannel, (obj), TYPE_PCA954X_CHANNEL)
-
 /*
  * struct Pca954xState - The pca954x state object.
  * @control: The value written to the mux control.
@@ -XXX,XX +XXX,XX @@ typedef struct Pca954xState {
 
     uint8_t control;
 
-    /* The channel i2c buses. */
-    Pca954xChannel channel[PCA9548_CHANNEL_COUNT];
+    bool enabled[PCA9548_CHANNEL_COUNT];
+    I2CBus *bus[PCA9548_CHANNEL_COUNT];
 } Pca954xState;
 
 /*
@@ -XXX,XX +XXX,XX @@ static bool pca954x_match(I2CSlave *candidate, uint8_t address,
     }
 
     for (i = 0; i < mc->nchans; i++) {
-        if (!mux->channel[i].enabled) {
+        if (!mux->enabled[i]) {
             continue;
         }
 
-        if (i2c_scan_bus(mux->channel[i].bus, address, broadcast,
+        if (i2c_scan_bus(mux->bus[i], address, broadcast,
                          current_devs)) {
             if (!broadcast) {
                 return true;
@@ -XXX,XX +XXX,XX @@ static void pca954x_enable_channel(Pca954xState *s, uint8_t enable_mask)
      */
     for (i = 0; i < mc->nchans; i++) {
         if (enable_mask & (1 << i)) {
-            s->channel[i].enabled = true;
+            s->enabled[i] = true;
         } else {
-            s->channel[i].enabled = false;
+            s->enabled[i] = false;
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ I2CBus *pca954x_i2c_get_bus(I2CSlave *mux, uint8_t channel)
     Pca954xState *pca954x = PCA954X(mux);
 
     g_assert(channel < pc->nchans);
-    return I2C_BUS(qdev_get_child_bus(DEVICE(&pca954x->channel[channel]),
-                                      "i2c-bus"));
-}
-
-static void pca954x_channel_init(Object *obj)
-{
-    Pca954xChannel *s = PCA954X_CHANNEL(obj);
-    s->bus = i2c_init_bus(DEVICE(s), "i2c-bus");
-
-    /* Start all channels as disabled. */
-    s->enabled = false;
-}
-
-static void pca954x_channel_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-    dc->desc = "Pca954x Channel";
+    return pca954x->bus[channel];
 }
 
 static void pca9546_class_init(ObjectClass *klass, void *data)
@@ -XXX,XX +XXX,XX @@ static void pca9548_class_init(ObjectClass *klass, void *data)
     s->nchans = PCA9548_CHANNEL_COUNT;
 }
 
-static void pca954x_realize(DeviceState *dev, Error **errp)
-{
-    Pca954xState *s = PCA954X(dev);
-    Pca954xClass *c = PCA954X_GET_CLASS(s);
-    int i;
-
-    /* SMBus modules. Cannot fail. */
-    for (i = 0; i < c->nchans; i++) {
-        sysbus_realize(SYS_BUS_DEVICE(&s->channel[i]), &error_abort);
-    }
-}
-
 static void pca954x_init(Object *obj)
 {
     Pca954xState *s = PCA954X(obj);
     Pca954xClass *c = PCA954X_GET_CLASS(obj);
     int i;
 
-    /* Only initialize the children we expect. */
+    /* SMBus modules. Cannot fail. */
     for (i = 0; i < c->nchans; i++) {
-        object_initialize_child(obj, "channel[*]", &s->channel[i],
-                                TYPE_PCA954X_CHANNEL);
+        g_autofree gchar *bus_name = g_strdup_printf("i2c.%d", i);
+
+        /* start all channels as disabled. */
+        s->enabled[i] = false;
+        s->bus[i] = i2c_init_bus(DEVICE(s), bus_name);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void pca954x_class_init(ObjectClass *klass, void *data)
     rc->phases.enter = pca954x_enter_reset;
 
     dc->desc = "Pca954x i2c-mux";
-    dc->realize = pca954x_realize;
 
     k->write_data = pca954x_write_data;
     k->receive_byte = pca954x_read_byte;
@@ -XXX,XX +XXX,XX @@ static const TypeInfo pca954x_info[] = {
         .parent        = TYPE_PCA954X,
         .class_init    = pca9548_class_init,
     },
-    {
-        .name = TYPE_PCA954X_CHANNEL,
-        .parent = TYPE_SYS_BUS_DEVICE,
-        .class_init = pca954x_channel_class_init,
-        .instance_size = sizeof(Pca954xChannel),
-        .instance_init = pca954x_channel_init,
-    }
 };
 
 DEFINE_TYPES(pca954x_info)
-- 
2.25.1

From: Akihiko Odaki <akihiko.odaki@gmail.com>

Support the latest PSCI on TCG and HVF. A 64-bit function called from
AArch32 now returns NOT_SUPPORTED, which is necessary to adhere to SMC
Calling Convention 1.0. It is still not compliant with SMCCC 1.3 since
they do not implement mandatory functions.

Signed-off-by: Akihiko Odaki <akihiko.odaki@gmail.com>
Message-id: 20220213035753.34577-1-akihiko.odaki@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: update MISMATCH_CHECK checks on PSCI_VERSION macros to match]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm-consts.h | 13 +++++++++----
 hw/arm/boot.c           | 12 +++++++++---
 target/arm/cpu.c        |  5 +++--
 target/arm/hvf/hvf.c    | 27 ++++++++++++++++++++++++++-
 target/arm/kvm64.c      |  2 +-
 target/arm/psci.c       | 35 ++++++++++++++++++++++++++++++++---
 6 files changed, 80 insertions(+), 14 deletions(-)

diff --git a/target/arm/kvm-consts.h b/target/arm/kvm-consts.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm-consts.h
+++ b/target/arm/kvm-consts.h
@@ -XXX,XX +XXX,XX @@ MISMATCH_CHECK(QEMU_PSCI_0_1_FN_MIGRATE, KVM_PSCI_FN_MIGRATE);
 #define QEMU_PSCI_0_2_FN64_AFFINITY_INFO QEMU_PSCI_0_2_FN64(4)
 #define QEMU_PSCI_0_2_FN64_MIGRATE QEMU_PSCI_0_2_FN64(5)
 
+#define QEMU_PSCI_1_0_FN_PSCI_FEATURES QEMU_PSCI_0_2_FN(10)
+
 MISMATCH_CHECK(QEMU_PSCI_0_2_FN_CPU_SUSPEND, PSCI_0_2_FN_CPU_SUSPEND);
 MISMATCH_CHECK(QEMU_PSCI_0_2_FN_CPU_OFF, PSCI_0_2_FN_CPU_OFF);
 MISMATCH_CHECK(QEMU_PSCI_0_2_FN_CPU_ON, PSCI_0_2_FN_CPU_ON);
@@ -XXX,XX +XXX,XX @@ MISMATCH_CHECK(QEMU_PSCI_0_2_FN_MIGRATE, PSCI_0_2_FN_MIGRATE);
 MISMATCH_CHECK(QEMU_PSCI_0_2_FN64_CPU_SUSPEND, PSCI_0_2_FN64_CPU_SUSPEND);
 MISMATCH_CHECK(QEMU_PSCI_0_2_FN64_CPU_ON, PSCI_0_2_FN64_CPU_ON);
 MISMATCH_CHECK(QEMU_PSCI_0_2_FN64_MIGRATE, PSCI_0_2_FN64_MIGRATE);
+MISMATCH_CHECK(QEMU_PSCI_1_0_FN_PSCI_FEATURES, PSCI_1_0_FN_PSCI_FEATURES);
 
 /* PSCI v0.2 return values used by TCG emulation of PSCI */
 
 /* No Trusted OS migration to worry about when offlining CPUs */
 #define QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED        2
 
-/* We implement version 0.2 only */
-#define QEMU_PSCI_0_2_RET_VERSION_0_2                       2
+#define QEMU_PSCI_VERSION_0_1                     0x00001
+#define QEMU_PSCI_VERSION_0_2                     0x00002
+#define QEMU_PSCI_VERSION_1_1                     0x10001
 
 MISMATCH_CHECK(QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED, PSCI_0_2_TOS_MP);
-MISMATCH_CHECK(QEMU_PSCI_0_2_RET_VERSION_0_2,
-               (PSCI_VERSION_MAJOR(0) | PSCI_VERSION_MINOR(2)));
+/* We don't bother to check every possible version value */
+MISMATCH_CHECK(QEMU_PSCI_VERSION_0_2, PSCI_VERSION(0, 2));
+MISMATCH_CHECK(QEMU_PSCI_VERSION_1_1, PSCI_VERSION(1, 1));
 
 /* PSCI return values (inclusive of all PSCI versions) */
 #define QEMU_PSCI_RET_SUCCESS                     0
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
     }
 
     qemu_fdt_add_subnode(fdt, "/psci");
-    if (armcpu->psci_version == 2) {
-        const char comp[] = "arm,psci-0.2\0arm,psci";
-        qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
+    if (armcpu->psci_version == QEMU_PSCI_VERSION_0_2 ||
+        armcpu->psci_version == QEMU_PSCI_VERSION_1_1) {
+        if (armcpu->psci_version == QEMU_PSCI_VERSION_0_2) {
+            const char comp[] = "arm,psci-0.2\0arm,psci";
+            qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
+        } else {
+            const char comp[] = "arm,psci-1.0\0arm,psci-0.2\0arm,psci";
+            qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
+        }
 
         cpu_off_fn = QEMU_PSCI_0_2_FN_CPU_OFF;
         if (arm_feature(&armcpu->env, ARM_FEATURE_AARCH64)) {
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
      * picky DTB consumer will also provide a helpful error message.
      */
     cpu->dtb_compatible = "qemu,unknown";
-    cpu->psci_version = 1; /* By default assume PSCI v0.1 */
+    cpu->psci_version = QEMU_PSCI_VERSION_0_1; /* By default assume PSCI v0.1 */
     cpu->kvm_target = QEMU_KVM_ARM_TARGET_NONE;
 
     if (tcg_enabled() || hvf_enabled()) {
-        cpu->psci_version = 2; /* TCG and HVF implement PSCI 0.2 */
+        /* TCG and HVF implement PSCI 1.1 */
+        cpu->psci_version = QEMU_PSCI_VERSION_1_1;
     }
 }
 
diff --git a/target/arm/hvf/hvf.c b/target/arm/hvf/hvf.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/hvf/hvf.c
+++ b/target/arm/hvf/hvf.c
@@ -XXX,XX +XXX,XX @@ static bool hvf_handle_psci_call(CPUState *cpu)
 
     switch (param[0]) {
     case QEMU_PSCI_0_2_FN_PSCI_VERSION:
-        ret = QEMU_PSCI_0_2_RET_VERSION_0_2;
+        ret = QEMU_PSCI_VERSION_1_1;
         break;
     case QEMU_PSCI_0_2_FN_MIGRATE_INFO_TYPE:
         ret = QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED; /* No trusted OS */
@@ -XXX,XX +XXX,XX @@ static bool hvf_handle_psci_call(CPUState *cpu)
     case QEMU_PSCI_0_2_FN_MIGRATE:
         ret = QEMU_PSCI_RET_NOT_SUPPORTED;
         break;
+    case QEMU_PSCI_1_0_FN_PSCI_FEATURES:
+        switch (param[1]) {
+        case QEMU_PSCI_0_2_FN_PSCI_VERSION:
+        case QEMU_PSCI_0_2_FN_MIGRATE_INFO_TYPE:
+        case QEMU_PSCI_0_2_FN_AFFINITY_INFO:
+        case QEMU_PSCI_0_2_FN64_AFFINITY_INFO:
+        case QEMU_PSCI_0_2_FN_SYSTEM_RESET:
+        case QEMU_PSCI_0_2_FN_SYSTEM_OFF:
+        case QEMU_PSCI_0_1_FN_CPU_ON:
+        case QEMU_PSCI_0_2_FN_CPU_ON:
+        case QEMU_PSCI_0_2_FN64_CPU_ON:
+        case QEMU_PSCI_0_1_FN_CPU_OFF:
+        case QEMU_PSCI_0_2_FN_CPU_OFF:
+        case QEMU_PSCI_0_1_FN_CPU_SUSPEND:
+        case QEMU_PSCI_0_2_FN_CPU_SUSPEND:
+        case QEMU_PSCI_0_2_FN64_CPU_SUSPEND:
+        case QEMU_PSCI_1_0_FN_PSCI_FEATURES:
+            ret = 0;
+            break;
+        case QEMU_PSCI_0_1_FN_MIGRATE:
+        case QEMU_PSCI_0_2_FN_MIGRATE:
+        default:
+            ret = QEMU_PSCI_RET_NOT_SUPPORTED;
+        }
+        break;
     default:
         return false;
     }
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_POWER_OFF;
     }
     if (kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PSCI_0_2)) {
-        cpu->psci_version = 2;
+        cpu->psci_version = QEMU_PSCI_VERSION_0_2;
         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PSCI_0_2;
     }
     if (!arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
diff --git a/target/arm/psci.c b/target/arm/psci.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/psci.c
+++ b/target/arm/psci.c
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu)
 {
     /*
      * This function partially implements the logic for dispatching Power State
-     * Coordination Interface (PSCI) calls (as described in ARM DEN 0022B.b),
+     * Coordination Interface (PSCI) calls (as described in ARM DEN 0022D.b),
      * to the extent required for bringing up and taking down secondary cores,
      * and for handling reset and poweroff requests.
      * Additional information about the calling convention used is available in
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu)
     }
 
     if ((param[0] & QEMU_PSCI_0_2_64BIT) && !is_a64(env)) {
-        ret = QEMU_PSCI_RET_INVALID_PARAMS;
+        ret = QEMU_PSCI_RET_NOT_SUPPORTED;
         goto err;
     }
 
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu)
         ARMCPU *target_cpu;
 
     case QEMU_PSCI_0_2_FN_PSCI_VERSION:
-        ret = QEMU_PSCI_0_2_RET_VERSION_0_2;
+        ret = QEMU_PSCI_VERSION_1_1;
         break;
     case QEMU_PSCI_0_2_FN_MIGRATE_INFO_TYPE:
         ret = QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED; /* No trusted OS */
@@ -XXX,XX +XXX,XX @@ void arm_handle_psci_call(ARMCPU *cpu)
         }
         helper_wfi(env, 4);
         break;
+    case QEMU_PSCI_1_0_FN_PSCI_FEATURES:
+        switch (param[1]) {
+        case QEMU_PSCI_0_2_FN_PSCI_VERSION:
+        case QEMU_PSCI_0_2_FN_MIGRATE_INFO_TYPE:
+        case QEMU_PSCI_0_2_FN_AFFINITY_INFO:
+        case QEMU_PSCI_0_2_FN64_AFFINITY_INFO:
+        case QEMU_PSCI_0_2_FN_SYSTEM_RESET:
+        case QEMU_PSCI_0_2_FN_SYSTEM_OFF:
+        case QEMU_PSCI_0_1_FN_CPU_ON:
+        case QEMU_PSCI_0_2_FN_CPU_ON:
+        case QEMU_PSCI_0_2_FN64_CPU_ON:
+        case QEMU_PSCI_0_1_FN_CPU_OFF:
+        case QEMU_PSCI_0_2_FN_CPU_OFF:
+        case QEMU_PSCI_0_1_FN_CPU_SUSPEND:
+        case QEMU_PSCI_0_2_FN_CPU_SUSPEND:
+        case QEMU_PSCI_0_2_FN64_CPU_SUSPEND:
+        case QEMU_PSCI_1_0_FN_PSCI_FEATURES:
+            if (!(param[1] & QEMU_PSCI_0_2_64BIT) || is_a64(env)) {
+                ret = 0;
+                break;
+            }
+            /* fallthrough */
+        case QEMU_PSCI_0_1_FN_MIGRATE:
+        case QEMU_PSCI_0_2_FN_MIGRATE:
+        default:
+            ret = QEMU_PSCI_RET_NOT_SUPPORTED;
+            break;
+        }
+        break;
     case QEMU_PSCI_0_1_FN_MIGRATE:
     case QEMU_PSCI_0_2_FN_MIGRATE:
     default:
-- 
2.25.1

From: Wentao_Liang <Wentao_Liang_g@163.com>

handle_simd_shift_fpint_conv() was accidentally freeing the TCG
temporary tcg_fpstatus too early, before the last use of it.  Move
the free down to where it belongs.

Signed-off-by: Wentao_Liang <Wentao_Liang_g@163.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: cleaned up commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_simd_shift_fpint_conv(DisasContext *s, bool is_scalar,
         }
     }
 
-    tcg_temp_free_ptr(tcg_fpstatus);
     tcg_temp_free_i32(tcg_shift);
     gen_helper_set_rmode(tcg_rmode, tcg_rmode, tcg_fpstatus);
+    tcg_temp_free_ptr(tcg_fpstatus);
     tcg_temp_free_i32(tcg_rmode);
 }
 
-- 
2.25.1

From: Shengtan Mao <stmao@google.com>

Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Chris Rauer <crauer@google.com>
Signed-off-by: Shengtan Mao <stmao@google.com>
Signed-off-by: Patrick Venture <venture@google.com>
Message-id: 20220225174451.192304-1-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_sdhci-test.c | 215 +++++++++++++++++++++++++++++++
 tests/qtest/meson.build          |   1 +
 2 files changed, 216 insertions(+)
 create mode 100644 tests/qtest/npcm7xx_sdhci-test.c

diff --git a/tests/qtest/npcm7xx_sdhci-test.c b/tests/qtest/npcm7xx_sdhci-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/npcm7xx_sdhci-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTests for NPCM7xx SD-3.0 / MMC-4.51 Host Controller
+ *
+ * Copyright (c) 2022 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/sd/npcm7xx_sdhci.h"
+
+#include "libqos/libqtest.h"
+#include "libqtest-single.h"
+#include "libqos/sdhci-cmd.h"
+
+#define NPCM7XX_REG_SIZE 0x100
+#define NPCM7XX_MMC_BA 0xF0842000
+#define NPCM7XX_BLK_SIZE 512
+#define NPCM7XX_TEST_IMAGE_SIZE (1 << 30)
+
+char *sd_path;
+
+static QTestState *setup_sd_card(void)
+{
+    QTestState *qts = qtest_initf(
+        "-machine kudo-bmc "
+        "-device sd-card,drive=drive0 "
+        "-drive id=drive0,if=none,file=%s,format=raw,auto-read-only=off",
+        sd_path);
+
+    qtest_writew(qts, NPCM7XX_MMC_BA + SDHC_SWRST, SDHC_RESET_ALL);
+    qtest_writew(qts, NPCM7XX_MMC_BA + SDHC_CLKCON,
+                 SDHC_CLOCK_SDCLK_EN | SDHC_CLOCK_INT_STABLE |
+                     SDHC_CLOCK_INT_EN);
+    sdhci_cmd_regs(qts, NPCM7XX_MMC_BA, 0, 0, 0, 0, SDHC_APP_CMD);
+    sdhci_cmd_regs(qts, NPCM7XX_MMC_BA, 0, 0, 0x41200000, 0, (41 << 8));
+    sdhci_cmd_regs(qts, NPCM7XX_MMC_BA, 0, 0, 0, 0, SDHC_ALL_SEND_CID);
+    sdhci_cmd_regs(qts, NPCM7XX_MMC_BA, 0, 0, 0, 0, SDHC_SEND_RELATIVE_ADDR);
+    sdhci_cmd_regs(qts, NPCM7XX_MMC_BA, 0, 0, 0x45670000, 0,
+                   SDHC_SELECT_DESELECT_CARD);
+
+    return qts;
+}
+
+static void write_sdread(QTestState *qts, const char *msg)
+{
+    int fd, ret;
+    size_t len = strlen(msg);
+    char *rmsg = g_malloc(len);
+
+    /* write message to sd */
+    fd = open(sd_path, O_WRONLY);
+    g_assert(fd >= 0);
+    ret = write(fd, msg, len);
+    close(fd);
+    g_assert(ret == len);
+
+    /* read message using sdhci */
+    ret = sdhci_read_cmd(qts, NPCM7XX_MMC_BA, rmsg, len);
+    g_assert(ret == len);
+    g_assert(!memcmp(rmsg, msg, len));
+
+    g_free(rmsg);
+}
+
+/* Check MMC can read values from sd */
+static void test_read_sd(void)
+{
+    QTestState *qts = setup_sd_card();
+
+    write_sdread(qts, "hello world");
+    write_sdread(qts, "goodbye");
+
+    qtest_quit(qts);
+}
+
+static void sdwrite_read(QTestState *qts, const char *msg)
+{
+    int fd, ret;
+    size_t len = strlen(msg);
+    char *rmsg = g_malloc(len);
+
+    /* write message using sdhci */
+    sdhci_write_cmd(qts, NPCM7XX_MMC_BA, msg, len, NPCM7XX_BLK_SIZE);
+
+    /* read message from sd */
+    fd = open(sd_path, O_RDONLY);
+    g_assert(fd >= 0);
+    ret = read(fd, rmsg, len);
+    close(fd);
+    g_assert(ret == len);
+
+    g_assert(!memcmp(rmsg, msg, len));
+
+    g_free(rmsg);
+}
+
+/* Check MMC can write values to sd */
+static void test_write_sd(void)
+{
+    QTestState *qts = setup_sd_card();
+
+    sdwrite_read(qts, "hello world");
+    sdwrite_read(qts, "goodbye");
+
+    qtest_quit(qts);
+}
+
+/* Check SDHCI has correct default values. */
+static void test_reset(void)
+{
+    QTestState *qts = qtest_init("-machine kudo-bmc");
+    uint64_t addr = NPCM7XX_MMC_BA;
+    uint64_t end_addr = addr + NPCM7XX_REG_SIZE;
+    uint16_t prstvals_resets[] = {NPCM7XX_PRSTVALS_0_RESET,
+                                  NPCM7XX_PRSTVALS_1_RESET,
+                                  0,
+                                  NPCM7XX_PRSTVALS_3_RESET,
+                                  0,
+                                  0};
+    int i;
+    uint32_t mask;
+
+    while (addr < end_addr) {
+        switch (addr - NPCM7XX_MMC_BA) {
+        case SDHC_PRNSTS:
+            /*
+             * ignores bits 20 to 24: they are changed when reading registers
+             */
+            mask = 0x1f00000;
+            g_assert_cmphex(qtest_readl(qts, addr) | mask, ==,
+                            NPCM7XX_PRSNTS_RESET | mask);
+            addr += 4;
+            break;
+        case SDHC_BLKGAP:
+            g_assert_cmphex(qtest_readb(qts, addr), ==, NPCM7XX_BLKGAP_RESET);
+            addr += 1;
+            break;
+        case SDHC_CAPAB:
+            g_assert_cmphex(qtest_readq(qts, addr), ==, NPCM7XX_CAPAB_RESET);
+            addr += 8;
+            break;
+        case SDHC_MAXCURR:
+            g_assert_cmphex(qtest_readq(qts, addr), ==, NPCM7XX_MAXCURR_RESET);
+            addr += 8;
+            break;
+        case SDHC_HCVER:
+            g_assert_cmphex(qtest_readw(qts, addr), ==, NPCM7XX_HCVER_RESET);
+            addr += 2;
+            break;
+        case NPCM7XX_PRSTVALS:
+            for (i = 0; i < NPCM7XX_PRSTVALS_SIZE; ++i) {
+                g_assert_cmphex(qtest_readw(qts, addr + 2 * i), ==,
+                                prstvals_resets[i]);
+            }
+            addr += NPCM7XX_PRSTVALS_SIZE * 2;
+            break;
+        default:
+            g_assert_cmphex(qtest_readb(qts, addr), ==, 0);
+            addr += 1;
+        }
+    }
+
+    qtest_quit(qts);
+}
+
+static void drive_destroy(void)
+{
+    unlink(sd_path);
+    g_free(sd_path);
+}
+
+static void drive_create(void)
+{
+    int fd, ret;
+    GError *error = NULL;
+
+    /* Create a temporary raw image */
+    fd = g_file_open_tmp("sdhci_XXXXXX", &sd_path, &error);
+    if (fd == -1) {
+        fprintf(stderr, "unable to create sdhci file: %s\n", error->message);
+        g_error_free(error);
+    }
+    g_assert(sd_path != NULL);
+
+    ret = ftruncate(fd, NPCM7XX_TEST_IMAGE_SIZE);
+    g_assert_cmpint(ret, ==, 0);
+    g_message("%s", sd_path);
+    close(fd);
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+
+    drive_create();
+
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_func("npcm7xx_sdhci/reset", test_reset);
+    qtest_add_func("npcm7xx_sdhci/write_sd", test_write_sd);
+    qtest_add_func("npcm7xx_sdhci/read_sd", test_read_sd);
+
+    ret = g_test_run();
+    drive_destroy();
+    return ret;
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_npcm7xx = \
    'npcm7xx_gpio-test',
    'npcm7xx_pwm-test',
    'npcm7xx_rng-test',
+   'npcm7xx_sdhci-test',
    'npcm7xx_smbus-test',
    'npcm7xx_timer-test',
    'npcm7xx_watchdog_timer-test'] + \
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Add new macros to manipulate signed fields within the register.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-2-richard.henderson@linaro.org
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/registerfields.h | 48 ++++++++++++++++++++++++++++++++++++-
 1 file changed, 47 insertions(+), 1 deletion(-)

diff --git a/include/hw/registerfields.h b/include/hw/registerfields.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/registerfields.h
+++ b/include/hw/registerfields.h
@@ -XXX,XX +XXX,XX @@
     extract64((storage), R_ ## reg ## _ ## field ## _SHIFT,               \
               R_ ## reg ## _ ## field ## _LENGTH)
 
+#define FIELD_SEX8(storage, reg, field)                                   \
+    sextract8((storage), R_ ## reg ## _ ## field ## _SHIFT,               \
+              R_ ## reg ## _ ## field ## _LENGTH)
+#define FIELD_SEX16(storage, reg, field)                                  \
+    sextract16((storage), R_ ## reg ## _ ## field ## _SHIFT,              \
+               R_ ## reg ## _ ## field ## _LENGTH)
+#define FIELD_SEX32(storage, reg, field)                                  \
+    sextract32((storage), R_ ## reg ## _ ## field ## _SHIFT,              \
+               R_ ## reg ## _ ## field ## _LENGTH)
+#define FIELD_SEX64(storage, reg, field)                                  \
+    sextract64((storage), R_ ## reg ## _ ## field ## _SHIFT,              \
+               R_ ## reg ## _ ## field ## _LENGTH)
+
 /* Extract a field from an array of registers */
 #define ARRAY_FIELD_EX32(regs, reg, field)                                \
     FIELD_EX32((regs)[R_ ## reg], reg, field)
@@ -XXX,XX +XXX,XX @@
     _d; })
 #define FIELD_DP64(storage, reg, field, val) ({                           \
     struct {                                                              \
-        uint64_t v:R_ ## reg ## _ ## field ## _LENGTH;                \
+        uint64_t v:R_ ## reg ## _ ## field ## _LENGTH;                    \
+    } _v = { .v = val };                                                  \
+    uint64_t _d;                                                          \
+    _d = deposit64((storage), R_ ## reg ## _ ## field ## _SHIFT,          \
+                  R_ ## reg ## _ ## field ## _LENGTH, _v.v);              \
+    _d; })
+
+#define FIELD_SDP8(storage, reg, field, val) ({                           \
+    struct {                                                              \
+        signed int v:R_ ## reg ## _ ## field ## _LENGTH;                  \
+    } _v = { .v = val };                                                  \
+    uint8_t _d;                                                           \
+    _d = deposit32((storage), R_ ## reg ## _ ## field ## _SHIFT,          \
+                  R_ ## reg ## _ ## field ## _LENGTH, _v.v);              \
+    _d; })
+#define FIELD_SDP16(storage, reg, field, val) ({                          \
+    struct {                                                              \
+        signed int v:R_ ## reg ## _ ## field ## _LENGTH;                  \
+    } _v = { .v = val };                                                  \
+    uint16_t _d;                                                          \
+    _d = deposit32((storage), R_ ## reg ## _ ## field ## _SHIFT,          \
+                  R_ ## reg ## _ ## field ## _LENGTH, _v.v);              \
+    _d; })
+#define FIELD_SDP32(storage, reg, field, val) ({                          \
+    struct {                                                              \
+        signed int v:R_ ## reg ## _ ## field ## _LENGTH;                  \
+    } _v = { .v = val };                                                  \
+    uint32_t _d;                                                          \
+    _d = deposit32((storage), R_ ## reg ## _ ## field ## _SHIFT,          \
+                  R_ ## reg ## _ ## field ## _LENGTH, _v.v);              \
+    _d; })
+#define FIELD_SDP64(storage, reg, field, val) ({                          \
+    struct {                                                              \
+        int64_t v:R_ ## reg ## _ ## field ## _LENGTH;                     \
     } _v = { .v = val };                                                  \
     uint64_t _d;                                                          \
     _d = deposit64((storage), R_ ## reg ## _ ## field ## _SHIFT,          \
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Set this as the kernel would, to 48 bits, to keep the computation
of the address space correct for PAuth.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
                 aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
         }
         /*
+         * Enable 48-bit address space (TODO: take reserved_va into account).
          * Enable TBI0 but not TBI1.
          * Note that this must match useronly_clean_ptr.
          */
-        env->cp15.tcr_el[1].raw_tcr = (1ULL << 37);
+        env->cp15.tcr_el[1].raw_tcr = 5 | (1ULL << 37);
 
         /* Enable MTE */
         if (cpu_isar_feature(aa64_mte, cpu)) {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Without FEAT_LVA, the behaviour of programming an invalid value
is IMPLEMENTATION DEFINED.  With FEAT_LVA, programming an invalid
minimum value requires a Translation fault.

It is most self-consistent to choose to generate the fault always.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h |  1 +
 target/arm/helper.c    | 32 ++++++++++++++++++++++++++++----
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
     bool hpd        : 1;
     bool using16k   : 1;
     bool using64k   : 1;
+    bool tsz_oob    : 1;  /* tsz has been clamped to legal range */
 } ARMVAParameters;
 
 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                    ARMMMUIdx mmu_idx, bool data)
 {
     uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
-    bool epd, hpd, using16k, using64k;
-    int select, tsz, tbi, max_tsz;
+    bool epd, hpd, using16k, using64k, tsz_oob;
+    int select, tsz, tbi, max_tsz, min_tsz;
 
     if (!regime_has_2_ranges(mmu_idx)) {
         select = 0;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
     } else {
         max_tsz = 39;
     }
+    min_tsz = 16;  /* TODO: ARMv8.2-LVA  */
 
-    tsz = MIN(tsz, max_tsz);
-    tsz = MAX(tsz, 16);  /* TODO: ARMv8.2-LVA  */
+    if (tsz > max_tsz) {
+        tsz = max_tsz;
+        tsz_oob = true;
+    } else if (tsz < min_tsz) {
+        tsz = min_tsz;
+        tsz_oob = true;
+    } else {
+        tsz_oob = false;
+    }
 
     /* Present TBI as a composite with TBID.  */
     tbi = aa64_va_parameter_tbi(tcr, mmu_idx);
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         .hpd = hpd,
         .using16k = using16k,
         .using64k = using64k,
+        .tsz_oob = tsz_oob,
     };
 }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
         param = aa64_va_parameters(env, address, mmu_idx,
                                    access_type != MMU_INST_FETCH);
         level = 0;
+
+        /*
+         * If TxSZ is programmed to a value larger than the maximum,
+         * or smaller than the effective minimum, it is IMPLEMENTATION
+         * DEFINED whether we behave as if the field were programmed
+         * within bounds, or if a level 0 Translation fault is generated.
+         *
+         * With FEAT_LVA, fault on less than minimum becomes required,
+         * so our choice is to always raise the fault.
+         */
+        if (param.tsz_oob) {
+            fault_type = ARMFault_Translation;
+            goto do_fault;
+        }
+
         addrsize = 64 - 8 * param.tbi;
         inputsize = 64 - param.tsz;
     } else {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We will shortly share parts of this function with other portions
of address translation.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 19 +------------------
 target/arm/helper.c    | 22 ++++++++++++++++++++++
 2 files changed, 23 insertions(+), 18 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline void update_spsel(CPUARMState *env, uint32_t imm)
  * Returns the implementation defined bit-width of physical addresses.
  * The ARMv8 reference manuals refer to this as PAMax().
  */
-static inline unsigned int arm_pamax(ARMCPU *cpu)
-{
-    static const unsigned int pamax_map[] = {
-        [0] = 32,
-        [1] = 36,
-        [2] = 40,
-        [3] = 42,
-        [4] = 44,
-        [5] = 48,
-    };
-    unsigned int parange =
-        FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
-
-    /* id_aa64mmfr0 is a read-only register so values outside of the
-     * supported mappings can be considered an implementation error.  */
-    assert(parange < ARRAY_SIZE(pamax_map));
-    return pamax_map[parange];
-}
+unsigned int arm_pamax(ARMCPU *cpu);
 
 /* Return true if extended addresses are enabled.
  * This is always the case if our translation regime is 64 bit,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
 }
 #endif /* !CONFIG_USER_ONLY */
 
+/* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
+unsigned int arm_pamax(ARMCPU *cpu)
+{
+    static const unsigned int pamax_map[] = {
+        [0] = 32,
+        [1] = 36,
+        [2] = 40,
+        [3] = 42,
+        [4] = 44,
+        [5] = 48,
+    };
+    unsigned int parange =
+        FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
+
+    /*
+     * id_aa64mmfr0 is a read-only register so values outside of the
+     * supported mappings can be considered an implementation error.
+     */
+    assert(parange < ARRAY_SIZE(pamax_map));
+    return pamax_map[parange];
+}
+
 static int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx)
 {
     if (regime_has_2_ranges(mmu_idx)) {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Pass down the width of the output address from translation.
For now this is still just PAMax, but a subsequent patch will
compute the correct value from TCR_ELx.{I}PS.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 21 ++++++++++-----------
 1 file changed, 10 insertions(+), 11 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ do_fault:
  * false otherwise.
  */
 static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
-                               int inputsize, int stride)
+                               int inputsize, int stride, int outputsize)
 {
     const int grainsize = stride + 3;
     int startsizecheck;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
     }
 
     if (is_aa64) {
-        CPUARMState *env = &cpu->env;
-        unsigned int pamax = arm_pamax(cpu);
-
         switch (stride) {
         case 13: /* 64KB Pages.  */
-            if (level == 0 || (level == 1 && pamax <= 42)) {
+            if (level == 0 || (level == 1 && outputsize <= 42)) {
                 return false;
             }
             break;
         case 11: /* 16KB Pages.  */
-            if (level == 0 || (level == 1 && pamax <= 40)) {
+            if (level == 0 || (level == 1 && outputsize <= 40)) {
                 return false;
             }
             break;
         case 9: /* 4KB Pages.  */
-            if (level == 0 && pamax <= 42) {
+            if (level == 0 && outputsize <= 42) {
                 return false;
             }
             break;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
         }
 
         /* Inputsize checks.  */
-        if (inputsize > pamax &&
-            (arm_el_is_aa64(env, 1) || inputsize > 40)) {
+        if (inputsize > outputsize &&
+            (arm_el_is_aa64(&cpu->env, 1) || inputsize > 40)) {
             /* This is CONSTRAINED UNPREDICTABLE and we choose to fault.  */
             return false;
         }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
     target_ulong page_size;
     uint32_t attrs;
     int32_t stride;
-    int addrsize, inputsize;
+    int addrsize, inputsize, outputsize;
     TCR *tcr = regime_tcr(env, mmu_idx);
     int ap, ns, xn, pxn;
     uint32_t el = regime_el(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
 
         addrsize = 64 - 8 * param.tbi;
         inputsize = 64 - param.tsz;
+        outputsize = arm_pamax(cpu);
     } else {
         param = aa32_va_parameters(env, address, mmu_idx);
         level = 1;
         addrsize = (mmu_idx == ARMMMUIdx_Stage2 ? 40 : 32);
         inputsize = addrsize - param.tsz;
+        outputsize = 40;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
 
         /* Check that the starting level is valid. */
         ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
-                                inputsize, stride);
+                                inputsize, stride, outputsize);
         if (!ok) {
             fault_type = ARMFault_Translation;
             goto do_fault;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The macro is a bit more readable than the inlined computation.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
         level = startlevel;
     }
 
-    indexmask_grainsize = (1ULL << (stride + 3)) - 1;
-    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
+    indexmask_grainsize = MAKE_64BIT_MASK(0, stride + 3);
+    indexmask = MAKE_64BIT_MASK(0, inputsize - (stride * (4 - level)));
 
     /* Now we can extract the actual base address from the TTBR */
     descaddr = extract64(ttbr, 0, 48);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This field controls the output (intermediate) physical address size
of the translation process.  V8 requires to raise an AddressSize
fault if the page tables are programmed incorrectly, such that any
intermediate descriptor address, or the final translated address,
is out of range.

Add a PS field to ARMVAParameters, and properly compute outputsize
in get_phys_addr_lpae.  Test the descaddr as extracted from TTBR
and from page table entries.

Restrict descaddrmask so that we won't raise the fault for v7.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h |  1 +
 target/arm/helper.c    | 72 ++++++++++++++++++++++++++++++++----------
 2 files changed, 57 insertions(+), 16 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t aarch64_pstate_valid_mask(const ARMISARegisters *id)
  */
 typedef struct ARMVAParameters {
     unsigned tsz    : 8;
+    unsigned ps     : 3;
     unsigned select : 1;
     bool tbi        : 1;
     bool epd        : 1;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
 }
 #endif /* !CONFIG_USER_ONLY */
 
+/* This mapping is common between ID_AA64MMFR0.PARANGE and TCR_ELx.{I}PS. */
+static const uint8_t pamax_map[] = {
+    [0] = 32,
+    [1] = 36,
+    [2] = 40,
+    [3] = 42,
+    [4] = 44,
+    [5] = 48,
+};
+
 /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
 unsigned int arm_pamax(ARMCPU *cpu)
 {
-    static const unsigned int pamax_map[] = {
-        [0] = 32,
-        [1] = 36,
-        [2] = 40,
-        [3] = 42,
-        [4] = 44,
-        [5] = 48,
-    };
     unsigned int parange =
         FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
 
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
 {
     uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
     bool epd, hpd, using16k, using64k, tsz_oob;
-    int select, tsz, tbi, max_tsz, min_tsz;
+    int select, tsz, tbi, max_tsz, min_tsz, ps;
 
     if (!regime_has_2_ranges(mmu_idx)) {
         select = 0;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
             hpd = extract32(tcr, 24, 1);
         }
         epd = false;
+        ps = extract32(tcr, 16, 3);
     } else {
         /*
          * Bit 55 is always between the two regions, and is canonical for
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
             epd = extract32(tcr, 23, 1);
             hpd = extract64(tcr, 42, 1);
         }
+        ps = extract64(tcr, 32, 3);
     }
 
     if (cpu_isar_feature(aa64_st, env_archcpu(env))) {
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
 
     return (ARMVAParameters) {
         .tsz = tsz,
+        .ps = ps,
         .select = select,
         .tbi = tbi,
         .epd = epd,
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
 
     /* TODO: This code does not support shareability levels. */
     if (aarch64) {
+        int ps;
+
         param = aa64_va_parameters(env, address, mmu_idx,
                                    access_type != MMU_INST_FETCH);
         level = 0;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
 
         addrsize = 64 - 8 * param.tbi;
         inputsize = 64 - param.tsz;
-        outputsize = arm_pamax(cpu);
+
+        /*
+         * Bound PS by PARANGE to find the effective output address size.
+         * ID_AA64MMFR0 is a read-only register so values outside of the
+         * supported mappings can be considered an implementation error.
+         */
+        ps = FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
+        ps = MIN(ps, param.ps);
+        assert(ps < ARRAY_SIZE(pamax_map));
+        outputsize = pamax_map[ps];
     } else {
         param = aa32_va_parameters(env, address, mmu_idx);
         level = 1;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
 
     /* Now we can extract the actual base address from the TTBR */
     descaddr = extract64(ttbr, 0, 48);
+
+    /*
+     * If the base address is out of range, raise AddressSizeFault.
+     * In the pseudocode, this is !IsZero(baseregister<47:outputsize>),
+     * but we've just cleared the bits above 47, so simplify the test.
+     */
+    if (descaddr >> outputsize) {
+        level = 0;
+        fault_type = ARMFault_AddressSize;
+        goto do_fault;
+    }
+
     /*
      * We rely on this masking to clear the RES0 bits at the bottom of the TTBR
      * and also to mask out CnP (bit 0) which could validly be non-zero.
      */
     descaddr &= ~indexmask;
 
-    /* The address field in the descriptor goes up to bit 39 for ARMv7
-     * but up to bit 47 for ARMv8, but we use the descaddrmask
-     * up to bit 39 for AArch32, because we don't need other bits in that case
-     * to construct next descriptor address (anyway they should be all zeroes).
+    /*
+     * For AArch32, the address field in the descriptor goes up to bit 39
+     * for both v7 and v8.  However, for v8 the SBZ bits [47:40] must be 0
+     * or an AddressSize fault is raised.  So for v8 we extract those SBZ
+     * bits as part of the address, which will be checked via outputsize.
+     * For AArch64, the address field always goes up to bit 47 (with extra
+     * bits for FEAT_LPA placed elsewhere).  AArch64 implies v8.
      */
-    descaddrmask = ((1ull << (aarch64 ? 48 : 40)) - 1) &
-                   ~indexmask_grainsize;
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        descaddrmask = MAKE_64BIT_MASK(0, 48);
+    } else {
+        descaddrmask = MAKE_64BIT_MASK(0, 40);
+    }
+    descaddrmask &= ~indexmask_grainsize;
 
     /* Secure accesses start with the page table in secure memory and
      * can be downgraded to non-secure at any step. Non-secure accesses
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
             /* Invalid, or the Reserved level 3 encoding */
             goto do_fault;
         }
+
         descaddr = descriptor & descaddrmask;
+        if (descaddr >> outputsize) {
+            fault_type = ARMFault_AddressSize;
+            goto do_fault;
+        }
 
         if ((descriptor & 2) && (level < 3)) {
             /* Table entry. The top five bits are attributes which may
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The original A.a revision of the AArch64 ARM required that we
force-extend the addresses in these registers from 49 bits.
This language has been loosened via a combination of IMPLEMENTATION
DEFINED and CONSTRAINTED UNPREDICTABLE to allow consideration of
the entire aligned address.

This means that we do not have to consider whether or not FEAT_LVA
is enabled, and decide from which bit an address might need to be
extended.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 32 ++++++++++++++++++++++++--------
 1 file changed, 24 insertions(+), 8 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     ARMCPU *cpu = env_archcpu(env);
     int i = ri->crm;
 
-    /* Bits [63:49] are hardwired to the value of bit [48]; that is, the
-     * register reads and behaves as if values written are sign extended.
+    /*
      * Bits [1:0] are RES0.
+     *
+     * It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA)
+     * are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if
+     * they contain the value written.  It is CONSTRAINED UNPREDICTABLE
+     * whether the RESS bits are ignored when comparing an address.
+     *
+     * Therefore we are allowed to compare the entire register, which lets
+     * us avoid considering whether or not FEAT_LVA is actually enabled.
      */
-    value = sextract64(value, 0, 49) & ~3ULL;
+    value &= ~3ULL;
 
     raw_write(env, ri, value);
     hw_watchpoint_update(cpu, i);
@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update(ARMCPU *cpu, int n)
     case 0: /* unlinked address match */
     case 1: /* linked address match */
     {
-        /* Bits [63:49] are hardwired to the value of bit [48]; that is,
-         * we behave as if the register was sign extended. Bits [1:0] are
-         * RES0. The BAS field is used to allow setting breakpoints on 16
-         * bit wide instructions; it is CONSTRAINED UNPREDICTABLE whether
+        /*
+         * Bits [1:0] are RES0.
+         *
+         * It is IMPLEMENTATION DEFINED whether bits [63:49]
+         * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
+         * of the VA field ([48] or [52] for FEAT_LVA), or whether the
+         * value is read as written.  It is CONSTRAINED UNPREDICTABLE
+         * whether the RESS bits are ignored when comparing an address.
+         * Therefore we are allowed to compare the entire register, which
+         * lets us avoid considering whether FEAT_LVA is actually enabled.
+         *
+         * The BAS field is used to allow setting breakpoints on 16-bit
+         * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
          * a bp will fire if the addresses covered by the bp and the addresses
          * covered by the insn overlap but the insn doesn't start at the
          * start of the bp address range. We choose to require the insn and
@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update(ARMCPU *cpu, int n)
          * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
          */
         int bas = extract64(bcr, 5, 4);
-        addr = sextract64(bvr, 0, 49) & ~3ULL;
+        addr = bvr & ~3ULL;
         if (bas == 0) {
             return;
         }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This feature is relatively small, as it applies only to
64k pages and thus requires no additional changes to the
table descriptor walking algorithm, only a change to the
minimum TSZ (which is the inverse of the maximum virtual
address space size).

Note that this feature widens VBAR_ELx, but we already
treat the register as being 64 bits wide.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/cpu-param.h        | 2 +-
 target/arm/cpu.h              | 5 +++++
 target/arm/cpu64.c            | 1 +
 target/arm/helper.c           | 9 ++++++++-
 5 files changed, 16 insertions(+), 2 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

This feature widens physical addresses (and intermediate physical
addresses for 2-stage translation) from 48 to 52 bits, when using
64k pages.  The only thing left at this point is to handle the
extra bits in the TTBR and in the table descriptors.

Note that PAR_EL1 and HPFAR_EL2 are nominally extended, but we don't
mask out the high bits when writing to those registers, so no changes
are required there.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst |  1 +
 target/arm/cpu-param.h        |  2 +-
 target/arm/cpu64.c            |  2 +-
 target/arm/helper.c           | 19 ++++++++++++++++---
 4 files changed, 19 insertions(+), 5 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

With FEAT_LPA2, rather than introducing translation level 4,
we introduce level -1, below the current level 0.  Extend
arm_fi_to_lfsc to handle these faults.

Assert that this new translation level does not leak into
fault types for which it is not defined, which allows some
masking of fi->level to be removed.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 35 +++++++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
     case ARMFault_None:
         return 0;
     case ARMFault_AddressSize:
-        fsc = fi->level & 3;
+        assert(fi->level >= -1 && fi->level <= 3);
+        if (fi->level < 0) {
+            fsc = 0b101001;
+        } else {
+            fsc = fi->level;
+        }
         break;
     case ARMFault_AccessFlag:
-        fsc = (fi->level & 3) | (0x2 << 2);
+        assert(fi->level >= 0 && fi->level <= 3);
+        fsc = 0b001000 | fi->level;
         break;
     case ARMFault_Permission:
-        fsc = (fi->level & 3) | (0x3 << 2);
+        assert(fi->level >= 0 && fi->level <= 3);
+        fsc = 0b001100 | fi->level;
         break;
     case ARMFault_Translation:
-        fsc = (fi->level & 3) | (0x1 << 2);
+        assert(fi->level >= -1 && fi->level <= 3);
+        if (fi->level < 0) {
+            fsc = 0b101011;
+        } else {
+            fsc = 0b000100 | fi->level;
+        }
         break;
     case ARMFault_SyncExternal:
         fsc = 0x10 | (fi->ea << 12);
         break;
     case ARMFault_SyncExternalOnWalk:
-        fsc = (fi->level & 3) | (0x5 << 2) | (fi->ea << 12);
+        assert(fi->level >= -1 && fi->level <= 3);
+        if (fi->level < 0) {
+            fsc = 0b010011;
+        } else {
+            fsc = 0b010100 | fi->level;
+        }
+        fsc |= fi->ea << 12;
         break;
     case ARMFault_SyncParity:
         fsc = 0x18;
         break;
     case ARMFault_SyncParityOnWalk:
-        fsc = (fi->level & 3) | (0x7 << 2);
+        assert(fi->level >= -1 && fi->level <= 3);
+        if (fi->level < 0) {
+            fsc = 0b011011;
+        } else {
+            fsc = 0b011100 | fi->level;
+        }
         break;
     case ARMFault_AsyncParity:
         fsc = 0x19;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Merge tlbi_aa64_range_get_length and tlbi_aa64_range_get_base,
returning a structure containing both results.  Pass in the
ARMMMUIdx, rather than the digested two_ranges boolean.

This is in preparation for FEAT_LPA2, where the interpretation
of 'value' depends on the effective value of DS for the regime.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 58 +++++++++++++++++++--------------------------
 1 file changed, 24 insertions(+), 34 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 }
 
 #ifdef TARGET_AARCH64
-static uint64_t tlbi_aa64_range_get_length(CPUARMState *env,
-                                           uint64_t value)
-{
-    unsigned int page_shift;
-    unsigned int page_size_granule;
-    uint64_t num;
-    uint64_t scale;
-    uint64_t exponent;
+typedef struct {
+    uint64_t base;
     uint64_t length;
+} TLBIRange;
+
+static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
+                                     uint64_t value)
+{
+    unsigned int page_size_granule, page_shift, num, scale, exponent;
+    TLBIRange ret = { };
 
-    num = extract64(value, 39, 5);
-    scale = extract64(value, 44, 2);
     page_size_granule = extract64(value, 46, 2);
 
     if (page_size_granule == 0) {
         qemu_log_mask(LOG_GUEST_ERROR, "Invalid page size granule %d\n",
                       page_size_granule);
-        return 0;
+        return ret;
     }
 
     page_shift = (page_size_granule - 1) * 2 + 12;
-
+    num = extract64(value, 39, 5);
+    scale = extract64(value, 44, 2);
     exponent = (5 * scale) + 1;
-    length = (num + 1) << (exponent + page_shift);
 
-    return length;
-}
+    ret.length = (num + 1) << (exponent + page_shift);
 
-static uint64_t tlbi_aa64_range_get_base(CPUARMState *env, uint64_t value,
-                                        bool two_ranges)
-{
-    /* TODO: ARMv8.7 FEAT_LPA2 */
-    uint64_t pageaddr;
-
-    if (two_ranges) {
-        pageaddr = sextract64(value, 0, 37) << TARGET_PAGE_BITS;
+    if (regime_has_2_ranges(mmuidx)) {
+        ret.base = sextract64(value, 0, 37) << TARGET_PAGE_BITS;
     } else {
-        pageaddr = extract64(value, 0, 37) << TARGET_PAGE_BITS;
+        ret.base = extract64(value, 0, 37) << TARGET_PAGE_BITS;
     }
 
-    return pageaddr;
+    return ret;
 }
 
 static void do_rvae_write(CPUARMState *env, uint64_t value,
                           int idxmap, bool synced)
 {
     ARMMMUIdx one_idx = ARM_MMU_IDX_A | ctz32(idxmap);
-    bool two_ranges = regime_has_2_ranges(one_idx);
-    uint64_t baseaddr, length;
+    TLBIRange range;
     int bits;
 
-    baseaddr = tlbi_aa64_range_get_base(env, value, two_ranges);
-    length = tlbi_aa64_range_get_length(env, value);
-    bits = tlbbits_for_regime(env, one_idx, baseaddr);
+    range = tlbi_aa64_get_range(env, one_idx, value);
+    bits = tlbbits_for_regime(env, one_idx, range.base);
 
     if (synced) {
         tlb_flush_range_by_mmuidx_all_cpus_synced(env_cpu(env),
-                                                  baseaddr,
-                                                  length,
+                                                  range.base,
+                                                  range.length,
                                                   idxmap,
                                                   bits);
     } else {
-        tlb_flush_range_by_mmuidx(env_cpu(env), baseaddr,
-                                  length, idxmap, bits);
+        tlb_flush_range_by_mmuidx(env_cpu(env), range.base,
+                                  range.length, idxmap, bits);
     }
 }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The shift of the BaseADDR field depends on the translation
granule in use.

Fixes: 84940ed8255 ("target/arm: Add support for FEAT_TLBIRANGE")
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
     ret.length = (num + 1) << (exponent + page_shift);
 
     if (regime_has_2_ranges(mmuidx)) {
-        ret.base = sextract64(value, 0, 37) << TARGET_PAGE_BITS;
+        ret.base = sextract64(value, 0, 37);
     } else {
-        ret.base = extract64(value, 0, 37) << TARGET_PAGE_BITS;
+        ret.base = extract64(value, 0, 37);
     }
+    ret.base <<= page_shift;
 
     return ret;
 }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

For FEAT_LPA2, we will need other ARMVAParameters, which themselves
depend on the translation granule in use.  We might as well validate
that the given TG matches; the architecture "does not require that
the instruction invalidates any entries" if this is not true.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
                                      uint64_t value)
 {
     unsigned int page_size_granule, page_shift, num, scale, exponent;
+    /* Extract one bit to represent the va selector in use. */
+    uint64_t select = sextract64(value, 36, 1);
+    ARMVAParameters param = aa64_va_parameters(env, select, mmuidx, true);
     TLBIRange ret = { };
 
     page_size_granule = extract64(value, 46, 2);
 
-    if (page_size_granule == 0) {
-        qemu_log_mask(LOG_GUEST_ERROR, "Invalid page size granule %d\n",
+    /* The granule encoded in value must match the granule in use. */
+    if (page_size_granule != (param.using64k ? 3 : param.using16k ? 2 : 1)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "Invalid tlbi page size granule %d\n",
                       page_size_granule);
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
 
     ret.length = (num + 1) << (exponent + page_shift);
 
-    if (regime_has_2_ranges(mmuidx)) {
+    if (param.select) {
         ret.base = sextract64(value, 0, 37);
     } else {
         ret.base = extract64(value, 0, 37);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We support 16k pages, but do not advertize that in ID_AA64MMFR0.

The value 0 in the TGRAN*_2 fields indicates that stage2 lookups defer
to the same support as stage1 lookups.  This setting is deprecated, so
indicate support for all stage2 page sizes directly.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220301215958.157011-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 
     t = cpu->isar.id_aa64mmfr0;
     t = FIELD_DP64(t, ID_AA64MMFR0, PARANGE, 6); /* FEAT_LPA: 52 bits */
+    t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN16, 1);   /* 16k pages supported */
+    t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN16_2, 2); /* 16k stage2 supported */
+    t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN64_2, 2); /* 64k stage2 supported */
+    t = FIELD_DP64(t, ID_AA64MMFR0, TGRAN4_2, 2);  /*  4k stage2 supported */
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This feature widens physical addresses (and intermediate physical
addresses for 2-stage translation) from 48 to 52 bits, when using
4k or 16k pages.

This introduces the DS bit to TCR_ELx, which is RES0 unless the
page size is enabled and supports LPA2, resulting in the effective
value of DS for a given table walk.  The DS bit changes the format
of the page table descriptor slightly, moving the PS field out to
TCR so that all pages have the same sharability and repurposing
those bits of the page table descriptor for the highest bits of
the output address.

Do not yet enable FEAT_LPA2; we need extra plumbing to avoid
tickling an old kernel bug.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220301215958.157011-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst |   1 +
 target/arm/cpu.h              |  22 ++++++++
 target/arm/internals.h        |   2 +
 target/arm/helper.c           | 102 +++++++++++++++++++++++++++++-----
 4 files changed, 112 insertions(+), 15 deletions(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_JSCVT (JavaScript conversion instructions)
 - FEAT_LOR (Limited ordering regions)
 - FEAT_LPA (Large Physical Address space)
+- FEAT_LPA2 (Large Physical and virtual Address space v2)
 - FEAT_LRCPC (Load-acquire RCpc instructions)
 - FEAT_LRCPC2 (Load-acquire RCpc instructions v2)
 - FEAT_LSE (Large System Extensions)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_i8mm(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, I8MM) != 0;
 }
 
+static inline bool isar_feature_aa64_tgran4_lpa2(const ARMISARegisters *id)
+{
+    return FIELD_SEX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4) >= 1;
+}
+
+static inline bool isar_feature_aa64_tgran4_2_lpa2(const ARMISARegisters *id)
+{
+    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN4_2);
+    return t >= 3 || (t == 0 && isar_feature_aa64_tgran4_lpa2(id));
+}
+
+static inline bool isar_feature_aa64_tgran16_lpa2(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16) >= 2;
+}
+
+static inline bool isar_feature_aa64_tgran16_2_lpa2(const ARMISARegisters *id)
+{
+    unsigned t = FIELD_EX64(id->id_aa64mmfr0, ID_AA64MMFR0, TGRAN16_2);
+    return t >= 3 || (t == 0 && isar_feature_aa64_tgran16_lpa2(id));
+}
+
 static inline bool isar_feature_aa64_ccidx(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, CCIDX) != 0;
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t aarch64_pstate_valid_mask(const ARMISARegisters *id)
 typedef struct ARMVAParameters {
     unsigned tsz    : 8;
     unsigned ps     : 3;
+    unsigned sh     : 2;
     unsigned select : 1;
     bool tbi        : 1;
     bool epd        : 1;
@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
     bool using16k   : 1;
     bool using64k   : 1;
     bool tsz_oob    : 1;  /* tsz has been clamped to legal range */
+    bool ds         : 1;
 } ARMVAParameters;
 
 ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static TLBIRange tlbi_aa64_get_range(CPUARMState *env, ARMMMUIdx mmuidx,
     } else {
         ret.base = extract64(value, 0, 37);
     }
+    if (param.ds) {
+        /*
+         * With DS=1, BaseADDR is always shifted 16 so that it is able
+         * to address all 52 va bits.  The input address is perforce
+         * aligned on a 64k boundary regardless of translation granule.
+         */
+        page_shift = 16;
+    }
     ret.base <<= page_shift;
 
     return ret;
@@ -XXX,XX +XXX,XX @@ static bool check_s2_mmu_setup(ARMCPU *cpu, bool is_aa64, int level,
     const int grainsize = stride + 3;
     int startsizecheck;
 
-    /* Negative levels are never allowed.  */
-    if (level < 0) {
+    /*
+     * Negative levels are usually not allowed...
+     * Except for FEAT_LPA2, 4k page table, 52-bit address space, which
+     * begins with level -1.  Note that previous feature tests will have
+     * eliminated this combination if it is not enabled.
+     */
+    if (level < (inputsize == 52 && stride == 9 ? -1 : 0)) {
         return false;
     }
 
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                    ARMMMUIdx mmu_idx, bool data)
 {
     uint64_t tcr = regime_tcr(env, mmu_idx)->raw_tcr;
-    bool epd, hpd, using16k, using64k, tsz_oob;
-    int select, tsz, tbi, max_tsz, min_tsz, ps;
+    bool epd, hpd, using16k, using64k, tsz_oob, ds;
+    int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
+    ARMCPU *cpu = env_archcpu(env);
 
     if (!regime_has_2_ranges(mmu_idx)) {
         select = 0;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
             hpd = extract32(tcr, 24, 1);
         }
         epd = false;
+        sh = extract32(tcr, 12, 2);
         ps = extract32(tcr, 16, 3);
+        ds = extract64(tcr, 32, 1);
     } else {
         /*
          * Bit 55 is always between the two regions, and is canonical for
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         if (!select) {
             tsz = extract32(tcr, 0, 6);
             epd = extract32(tcr, 7, 1);
+            sh = extract32(tcr, 12, 2);
             using64k = extract32(tcr, 14, 1);
             using16k = extract32(tcr, 15, 1);
             hpd = extract64(tcr, 41, 1);
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
             using64k = tg == 3;
             tsz = extract32(tcr, 16, 6);
             epd = extract32(tcr, 23, 1);
+            sh = extract32(tcr, 28, 2);
             hpd = extract64(tcr, 42, 1);
         }
         ps = extract64(tcr, 32, 3);
+        ds = extract64(tcr, 59, 1);
     }
 
-    if (cpu_isar_feature(aa64_st, env_archcpu(env))) {
+    if (cpu_isar_feature(aa64_st, cpu)) {
         max_tsz = 48 - using64k;
     } else {
         max_tsz = 39;
     }
 
+    /*
+     * DS is RES0 unless FEAT_LPA2 is supported for the given page size;
+     * adjust the effective value of DS, as documented.
+     */
     min_tsz = 16;
     if (using64k) {
-        if (cpu_isar_feature(aa64_lva, env_archcpu(env))) {
+        if (cpu_isar_feature(aa64_lva, cpu)) {
+            min_tsz = 12;
+        }
+        ds = false;
+    } else if (ds) {
+        switch (mmu_idx) {
+        case ARMMMUIdx_Stage2:
+        case ARMMMUIdx_Stage2_S:
+            if (using16k) {
+                ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu);
+            } else {
+                ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu);
+            }
+            break;
+        default:
+            if (using16k) {
+                ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu);
+            } else {
+                ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu);
+            }
+            break;
+        }
+        if (ds) {
             min_tsz = 12;
         }
     }
-    /* TODO: FEAT_LPA2 */
 
     if (tsz > max_tsz) {
         tsz = max_tsz;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
     return (ARMVAParameters) {
         .tsz = tsz,
         .ps = ps,
+        .sh = sh,
         .select = select,
         .tbi = tbi,
         .epd = epd,
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         .using16k = using16k,
         .using64k = using64k,
         .tsz_oob = tsz_oob,
+        .ds = ds,
     };
 }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
          * VTCR_EL2.SL0 field (whose interpretation depends on the page size)
          */
         uint32_t sl0 = extract32(tcr->raw_tcr, 6, 2);
+        uint32_t sl2 = extract64(tcr->raw_tcr, 33, 1);
         uint32_t startlevel;
         bool ok;
 
-        if (!aarch64 || stride == 9) {
+        /* SL2 is RES0 unless DS=1 & 4kb granule. */
+        if (param.ds && stride == 9 && sl2) {
+            if (sl0 != 0) {
+                level = 0;
+                fault_type = ARMFault_Translation;
+                goto do_fault;
+            }
+            startlevel = -1;
+        } else if (!aarch64 || stride == 9) {
             /* AArch32 or 4KB pages */
             startlevel = 2 - sl0;
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
      * for both v7 and v8.  However, for v8 the SBZ bits [47:40] must be 0
      * or an AddressSize fault is raised.  So for v8 we extract those SBZ
      * bits as part of the address, which will be checked via outputsize.
-     * For AArch64, the address field always goes up to bit 47 (with extra
-     * bits for FEAT_LPA placed elsewhere).  AArch64 implies v8.
+     * For AArch64, the address field goes up to bit 47, or 49 with FEAT_LPA2;
+     * the highest bits of a 52-bit output are placed elsewhere.
      */
-    if (arm_feature(env, ARM_FEATURE_V8)) {
+    if (param.ds) {
+        descaddrmask = MAKE_64BIT_MASK(0, 50);
+    } else if (arm_feature(env, ARM_FEATURE_V8)) {
         descaddrmask = MAKE_64BIT_MASK(0, 48);
     } else {
         descaddrmask = MAKE_64BIT_MASK(0, 40);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
 
         /*
          * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
-         * of descriptor.  Otherwise, if descaddr is out of range, raise
-         * AddressSizeFault.
+         * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
+         * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
+         * raise AddressSizeFault.
          */
         if (outputsize > 48) {
-            descaddr |= extract64(descriptor, 12, 4) << 48;
+            if (param.ds) {
+                descaddr |= extract64(descriptor, 8, 2) << 50;
+            } else {
+                descaddr |= extract64(descriptor, 12, 4) << 48;
+            }
         } else if (descaddr >> outputsize) {
             fault_type = ARMFault_AddressSize;
             goto do_fault;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
         assert(attrindx <= 7);
         cacheattrs->attrs = extract64(mair, attrindx * 8, 8);
     }
-    cacheattrs->shareability = extract32(attrs, 6, 2);
+
+    /*
+     * For FEAT_LPA2 and effective DS, the SH field in the attributes
+     * was re-purposed for output address bits.  The SH attribute in
+     * that case comes from TCR_ELx, which we extracted earlier.
+     */
+    if (param.ds) {
+        cacheattrs->shareability = param.sh;
+    } else {
+        cacheattrs->shareability = extract32(attrs, 6, 2);
+    }
 
     *phys_ptr = descaddr;
     *page_size_ptr = page_size;
-- 
2.25.1

When we're using KVM, the PSCI implementation is provided by the
kernel, but QEMU has to tell the guest about it via the device tree.
Currently we look at the KVM_CAP_ARM_PSCI_0_2 capability to determine
if the kernel is providing at least PSCI 0.2, but if the kernel
provides a newer version than that we will still only tell the guest
it has PSCI 0.2.  (This is fairly harmless; it just means the guest
won't use newer parts of the PSCI API.)

The kernel exposes the specific PSCI version it is implementing via
the ONE_REG API; use this to report in the dtb that the PSCI
implementation is 1.0-compatible if appropriate.  (The device tree
binding currently only distinguishes "pre-0.2", "0.2-compatible" and
"1.0-compatible".)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Akihiko Odaki <akihiko.odaki@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20220224134655.1207865-1-peter.maydell@linaro.org
---
 target/arm/kvm-consts.h |  1 +
 hw/arm/boot.c           |  5 ++---
 target/arm/kvm64.c      | 12 ++++++++++++
 3 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/target/arm/kvm-consts.h b/target/arm/kvm-consts.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm-consts.h
+++ b/target/arm/kvm-consts.h
@@ -XXX,XX +XXX,XX @@ MISMATCH_CHECK(QEMU_PSCI_1_0_FN_PSCI_FEATURES, PSCI_1_0_FN_PSCI_FEATURES);
 
 #define QEMU_PSCI_VERSION_0_1                     0x00001
 #define QEMU_PSCI_VERSION_0_2                     0x00002
+#define QEMU_PSCI_VERSION_1_0                     0x10000
 #define QEMU_PSCI_VERSION_1_1                     0x10001
 
 MISMATCH_CHECK(QEMU_PSCI_0_2_RET_TOS_MIGRATION_NOT_REQUIRED, PSCI_0_2_TOS_MP);
diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void fdt_add_psci_node(void *fdt)
     }
 
     qemu_fdt_add_subnode(fdt, "/psci");
-    if (armcpu->psci_version == QEMU_PSCI_VERSION_0_2 ||
-        armcpu->psci_version == QEMU_PSCI_VERSION_1_1) {
-        if (armcpu->psci_version == QEMU_PSCI_VERSION_0_2) {
+    if (armcpu->psci_version >= QEMU_PSCI_VERSION_0_2) {
+        if (armcpu->psci_version < QEMU_PSCI_VERSION_1_0) {
             const char comp[] = "arm,psci-0.2\0arm,psci";
             qemu_fdt_setprop(fdt, "/psci", "compatible", comp, sizeof(comp));
         } else {
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
     uint64_t mpidr;
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
+    uint64_t psciver;
 
     if (cpu->kvm_target == QEMU_KVM_ARM_TARGET_NONE ||
         !object_dynamic_cast(OBJECT(cpu), TYPE_AARCH64_CPU)) {
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
         }
     }
 
+    /*
+     * KVM reports the exact PSCI version it is implementing via a
+     * special sysreg. If it is present, use its contents to determine
+     * what to report to the guest in the dtb (it is the PSCI version,
+     * in the same 15-bits major 16-bits minor format that PSCI_VERSION
+     * returns).
+     */
+    if (!kvm_get_one_reg(cs, KVM_REG_ARM_PSCI_VERSION, &psciver)) {
+        cpu->psci_version = psciver;
+    }
+
     /*
      * When KVM is in use, PSCI is emulated in-kernel and not by qemu.
      * Currently KVM has its own idea about MPIDR assignment, so we
-- 
2.25.1

The updateUIInfo method makes Cocoa API calls.  It also calls back
into QEMU functions like dpy_set_ui_info().  To do this safely, we
need to follow two rules:
 * Cocoa API calls are made on the Cocoa UI thread
 * When calling back into QEMU we must hold the iothread lock

Fix the places where we got this wrong, by taking the iothread lock
while executing updateUIInfo, and moving the call in cocoa_switch()
inside the dispatch_async block.

Some of the Cocoa UI methods which call updateUIInfo are invoked as
part of the initial application startup, while we're still doing the
little cross-thread dance described in the comment just above
call_qemu_main().  This meant they were calling back into the QEMU UI
layer before we'd actually finished initializing our display and
registered the DisplayChangeListener, which isn't really valid.  Once
updateUIInfo takes the iothread lock, we no longer get away with
this, because during this startup phase the iothread lock is held by
the QEMU main-loop thread which is waiting for us to finish our
display initialization.  So we must suppress updateUIInfo until
applicationDidFinishLaunching allows the QEMU main-loop thread to
continue.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Akihiko Odaki <akihiko.odaki@gmail.com>
Tested-by: Akihiko Odaki <akihiko.odaki@gmail.com>
Message-id: 20220224101330.967429-2-peter.maydell@linaro.org
---
 ui/cocoa.m | 25 ++++++++++++++++++++++---
 1 file changed, 22 insertions(+), 3 deletions(-)

diff --git a/ui/cocoa.m b/ui/cocoa.m
index XXXXXXX..XXXXXXX 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -XXX,XX +XXX,XX @@ QemuCocoaView *cocoaView;
     }
 }
 
-- (void) updateUIInfo
+- (void) updateUIInfoLocked
 {
+    /* Must be called with the iothread lock, i.e. via updateUIInfo */
     NSSize frameSize;
     QemuUIInfo info;
 
@@ -XXX,XX +XXX,XX @@ QemuCocoaView *cocoaView;
     dpy_set_ui_info(dcl.con, &info, TRUE);
 }
 
+- (void) updateUIInfo
+{
+    if (!allow_events) {
+        /*
+         * Don't try to tell QEMU about UI information in the application
+         * startup phase -- we haven't yet registered dcl with the QEMU UI
+         * layer, and also trying to take the iothread lock would deadlock.
+         * When cocoa_display_init() does register the dcl, the UI layer
+         * will call cocoa_switch(), which will call updateUIInfo, so
+         * we don't lose any information here.
+         */
+        return;
+    }
+
+    with_iothread_lock(^{
+        [self updateUIInfoLocked];
+    });
+}
+
 - (void)viewDidMoveToWindow
 {
     [self updateUIInfo];
@@ -XXX,XX +XXX,XX @@ static void cocoa_switch(DisplayChangeListener *dcl,
 
     COCOA_DEBUG("qemu_cocoa: cocoa_switch\n");
 
-    [cocoaView updateUIInfo];
-
     // The DisplaySurface will be freed as soon as this callback returns.
     // We take a reference to the underlying pixman image here so it does
     // not disappear from under our feet; the switchSurface method will
@@ -XXX,XX +XXX,XX @@ static void cocoa_switch(DisplayChangeListener *dcl,
     pixman_image_ref(image);
 
     dispatch_async(dispatch_get_main_queue(), ^{
+        [cocoaView updateUIInfo];
         [cocoaView switchSurface:image];
     });
     [pool release];
-- 
2.25.1

In commit 6e657e64cdc478 in 2013 we added some autorelease pools to
deal with complaints from macOS when we made calls into Cocoa from
threads that didn't have automatically created autorelease pools.
Later on, macOS got stricter about forbidding cross-thread Cocoa
calls, and in commit 5588840ff77800e839d8 we restructured the code to
avoid them.  This left the autorelease pool creation in several
functions without any purpose; delete it.

We still need the pool in cocoa_refresh() for the clipboard related
code which is called directly there.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Akihiko Odaki <akihiko.odaki@gmail.com>
Tested-by: Akihiko Odaki <akihiko.odaki@gmail.com>
Message-id: 20220224101330.967429-3-peter.maydell@linaro.org
---
 ui/cocoa.m | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/ui/cocoa.m b/ui/cocoa.m
index XXXXXXX..XXXXXXX 100644
--- a/ui/cocoa.m
+++ b/ui/cocoa.m
@@ -XXX,XX +XXX,XX @@ int main (int argc, char **argv) {
 static void cocoa_update(DisplayChangeListener *dcl,
                          int x, int y, int w, int h)
 {
-    NSAutoreleasePool * pool = [[NSAutoreleasePool alloc] init];
-
     COCOA_DEBUG("qemu_cocoa: cocoa_update\n");
 
     dispatch_async(dispatch_get_main_queue(), ^{
@@ -XXX,XX +XXX,XX @@ static void cocoa_update(DisplayChangeListener *dcl,
         }
         [cocoaView setNeedsDisplayInRect:rect];
     });
-
-    [pool release];
 }
 
 static void cocoa_switch(DisplayChangeListener *dcl,
                          DisplaySurface *surface)
 {
-    NSAutoreleasePool * pool = [[NSAutoreleasePool alloc] init];
     pixman_image_t *image = surface->image;
 
     COCOA_DEBUG("qemu_cocoa: cocoa_switch\n");
@@ -XXX,XX +XXX,XX @@ static void cocoa_switch(DisplayChangeListener *dcl,
         [cocoaView updateUIInfo];
         [cocoaView switchSurface:image];
     });
-    [pool release];
 }
 
 static void cocoa_refresh(DisplayChangeListener *dcl)
-- 
2.25.1