thanks

Richard Henderson (19):

target/arm: Improve masking of HCR/HCR2 RES0 bits

target/arm: Add HCR_EL2 bit definitions from ARMv8.6

target/arm: Disable has_el2 and has_el3 for user-only

target/arm: Remove EL2 and EL3 setup from user-only

target/arm: Improve masking in arm_hcr_el2_eff

target/arm: Honor the HCR_EL2.{TVM,TRVM} bits

target/arm: Honor the HCR_EL2.TSW bit

target/arm: Honor the HCR_EL2.TACR bit

target/arm: Honor the HCR_EL2.TPCP bit

target/arm: Honor the HCR_EL2.TPU bit

target/arm: Honor the HCR_EL2.TTLB bit

tests/tcg/aarch64: Add newline in pauth-1 printf

target/arm: Replicate TBI/TBID bits for single range regimes

target/arm: Optimize cpu_mmu_index

target/arm: Introduce core_to_aa64_mmu_idx

target/arm: Apply TBI to ESR_ELx in helper_exception_return

target/arm: Move helper_dc_zva to helper-a64.c

target/arm: Use DEF_HELPER_FLAGS for helper_dc_zva

target/arm: Clean address for DC ZVA

include/hw/arm/xlnx-versal.h | 6 +

target/arm/cpu.h | 30 ++--

target/arm/helper-a64.h | 1 +

target/arm/helper.h | 1 -

target/arm/internals.h | 6 +

hw/arm/cubieboard.c | 29 +++-

hw/arm/gumstix.c | 16 +-

hw/arm/mainstone.c | 8 +-

hw/arm/musicpal.c | 10 --

hw/arm/omap_sx1.c | 11 +-

hw/arm/pxa2xx.c | 17 +-

hw/arm/smmu-common.c | 20 +--

hw/arm/spitz.c | 8 +-

hw/arm/strongarm.c | 18 ++-

hw/arm/xlnx-versal-virt.c | 28 ++++

hw/arm/xlnx-versal.c | 24 +++

hw/arm/z2.c | 8 +-

hw/timer/cadence_ttc.c | 18 ++-

target/arm/cpu.c | 13 +-

target/arm/cpu64.c | 2 +

target/arm/helper-a64.c | 114 ++++++++++++-

target/arm/helper.c | 373 ++++++++++++++++++++++++++++++-------------

target/arm/op_helper.c | 93 -----------

target/arm/translate-a64.c | 4 +-

tests/tcg/aarch64/pauth-1.c | 2 +-

25 files changed, 551 insertions(+), 309 deletions(-)

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add support for the Versal LPD ADMAs.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>

Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

include/hw/arm/xlnx-versal.h | 6 ++++++

hw/arm/xlnx-versal.c | 24 ++++++++++++++++++++++++

2 files changed, 30 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h

index XXXXXXX..XXXXXXX 100644

--- a/include/hw/arm/xlnx-versal.h

+++ b/include/hw/arm/xlnx-versal.h

@@ -XXX,XX +XXX,XX @@

#define XLNX_VERSAL_NR_ACPUS 2

#define XLNX_VERSAL_NR_UARTS 2

#define XLNX_VERSAL_NR_GEMS 2

+#define XLNX_VERSAL_NR_ADMAS 8

#define XLNX_VERSAL_NR_IRQS 192

typedef struct Versal {

@@ -XXX,XX +XXX,XX @@ typedef struct Versal {

struct {

SysBusDevice *uart[XLNX_VERSAL_NR_UARTS];

SysBusDevice *gem[XLNX_VERSAL_NR_GEMS];

+ SysBusDevice *adma[XLNX_VERSAL_NR_ADMAS];

} iou;

} lpd;

@@ -XXX,XX +XXX,XX @@ typedef struct Versal {

#define VERSAL_GEM0_WAKE_IRQ_0 57

#define VERSAL_GEM1_IRQ_0 58

#define VERSAL_GEM1_WAKE_IRQ_0 59

+#define VERSAL_ADMA_IRQ_0 60

/* Architecturally reserved IRQs suitable for virtualization. */

#define VERSAL_RSVD_IRQ_FIRST 111

@@ -XXX,XX +XXX,XX @@ typedef struct Versal {

#define MM_GEM1 0xff0d0000U

#define MM_GEM1_SIZE 0x10000

+#define MM_ADMA_CH0 0xffa80000U

+#define MM_ADMA_CH0_SIZE 0x10000

+

#define MM_OCM 0xfffc0000U

#define MM_OCM_SIZE 0x40000

diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal.c

+++ b/hw/arm/xlnx-versal.c

@@ -XXX,XX +XXX,XX @@ static void versal_create_gems(Versal *s, qemu_irq *pic)

}

}

+static void versal_create_admas(Versal *s, qemu_irq *pic)

+{

+ int i;

+

+ for (i = 0; i < ARRAY_SIZE(s->lpd.iou.adma); i++) {

+ char *name = g_strdup_printf("adma%d", i);

+ DeviceState *dev;

+ MemoryRegion *mr;

+

+ dev = qdev_create(NULL, "xlnx.zdma");

+ s->lpd.iou.adma[i] = SYS_BUS_DEVICE(dev);

+ object_property_add_child(OBJECT(s), name, OBJECT(dev), &error_fatal);

+ qdev_init_nofail(dev);

+

+ mr = sysbus_mmio_get_region(s->lpd.iou.adma[i], 0);

+ memory_region_add_subregion(&s->mr_ps,

+ MM_ADMA_CH0 + i * MM_ADMA_CH0_SIZE, mr);

+

+ sysbus_connect_irq(s->lpd.iou.adma[i], 0, pic[VERSAL_ADMA_IRQ_0 + i]);

+ g_free(name);

+ }

+}

+

/* This takes the board allocated linear DDR memory and creates aliases

* for each split DDR range/aperture on the Versal address map.

*/

@@ -XXX,XX +XXX,XX @@ static void versal_realize(DeviceState *dev, Error **errp)

versal_create_apu_gic(s, pic);

versal_create_uarts(s, pic);

versal_create_gems(s, pic);

+ versal_create_admas(s, pic);

versal_map_ddr(s);

versal_unimp(s);

--

2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Generate xlnx-versal-virt zdma FDT nodes.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>

Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>

Reviewed-by: KONRAD Frederic <frederic.konrad@adacore.com>

Reviewed-by: Luc Michel <luc.michel@greensocs.com>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/xlnx-versal-virt.c | 28 ++++++++++++++++++++++++++++

1 file changed, 28 insertions(+)

diff --git a/hw/arm/xlnx-versal-virt.c b/hw/arm/xlnx-versal-virt.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/xlnx-versal-virt.c

+++ b/hw/arm/xlnx-versal-virt.c

@@ -XXX,XX +XXX,XX @@ static void fdt_add_gem_nodes(VersalVirt *s)

}

}

+static void fdt_add_zdma_nodes(VersalVirt *s)

+{

+ const char clocknames[] = "clk_main\0clk_apb";

+ const char compat[] = "xlnx,zynqmp-dma-1.0";

+ int i;

+

+ for (i = XLNX_VERSAL_NR_ADMAS - 1; i >= 0; i--) {

+ uint64_t addr = MM_ADMA_CH0 + MM_ADMA_CH0_SIZE * i;

+ char *name = g_strdup_printf("/dma@%" PRIx64, addr);

+

+ qemu_fdt_add_subnode(s->fdt, name);

+

+ qemu_fdt_setprop_cell(s->fdt, name, "xlnx,bus-width", 64);

+ qemu_fdt_setprop_cells(s->fdt, name, "clocks",

+ s->phandle.clk_25Mhz, s->phandle.clk_25Mhz);

+ qemu_fdt_setprop(s->fdt, name, "clock-names",

+ clocknames, sizeof(clocknames));

+ qemu_fdt_setprop_cells(s->fdt, name, "interrupts",

+ GIC_FDT_IRQ_TYPE_SPI, VERSAL_ADMA_IRQ_0 + i,

+ GIC_FDT_IRQ_FLAGS_LEVEL_HI);

+ qemu_fdt_setprop_sized_cells(s->fdt, name, "reg",

+ 2, addr, 2, 0x1000);

+ qemu_fdt_setprop(s->fdt, name, "compatible", compat, sizeof(compat));

+ g_free(name);

+ }

+}

+

static void fdt_nop_memory_nodes(void *fdt, Error **errp)

{

Error *err = NULL;

@@ -XXX,XX +XXX,XX @@ static void versal_virt_init(MachineState *machine)

fdt_add_uart_nodes(s);

fdt_add_gic_nodes(s);

fdt_add_timer_nodes(s);

+ fdt_add_zdma_nodes(s);

fdt_add_cpu_nodes(s, psci_conduit);

fdt_add_clk_node(s, "/clk125", 125000000, s->phandle.clk_125Mhz);

fdt_add_clk_node(s, "/clk25", 25000000, s->phandle.clk_25Mhz);

--

2.20.1

The ARMv8.2-TTCNP extension allows an implementation to optimize by

sharing TLB entries between multiple cores, provided that software

declares that it's ready to deal with this by setting a CnP bit in

the TTBRn_ELx. It is mandatory from ARMv8.2 onward.

For QEMU's TLB implementation, sharing TLB entries between different

cores would not really benefit us and would be a lot of work to

implement. So we implement this extension in the "trivial" manner:

we allow the guest to set and read back the CnP bit, but don't change

our behaviour (this is an architecturally valid implementation

choice).

The only code path which looks at the TTBRn_ELx values for the

long-descriptor format where the CnP bit is defined is already doing

enough masking to not get confused when the CnP bit at the bottom of

the register is set, so we can simply add a comment noting why we're

relying on that mask.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200225193822.18874-1-peter.maydell@linaro.org

---

target/arm/cpu.c | 1 +

target/arm/cpu64.c | 2 ++

target/arm/helper.c | 4 ++++

3 files changed, 7 insertions(+)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)

t = cpu->isar.id_mmfr4;

t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */

t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */

+ t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */

cpu->isar.id_mmfr4 = t;

}

#endif

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu64.c

+++ b/target/arm/cpu64.c

@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)

t = cpu->isar.id_aa64mmfr2;

t = FIELD_DP64(t, ID_AA64MMFR2, UAO, 1);

+ t = FIELD_DP64(t, ID_AA64MMFR2, CNP, 1); /* TTCNP */

cpu->isar.id_aa64mmfr2 = t;

/* Replicate the same data to the 32-bit id registers. */

@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)

u = cpu->isar.id_mmfr4;

u = FIELD_DP32(u, ID_MMFR4, HPDS, 1); /* AA32HPD */

u = FIELD_DP32(u, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */

+ u = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */

cpu->isar.id_mmfr4 = u;

u = cpu->isar.id_aa64dfr0;

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,

/* Now we can extract the actual base address from the TTBR */

descaddr = extract64(ttbr, 0, 48);

+ /*

+ * We rely on this masking to clear the RES0 bits at the bottom of the TTBR

+ * and also to mask out CnP (bit 0) which could validly be non-zero.

+ */

descaddr &= ~indexmask;

/* The address field in the descriptor goes up to bit 39 for ARMv7

--

2.20.1

From: Eric Auger <eric.auger@redhat.com>

Make sure a null SMMUPciBus is returned in case we were

not able to identify a pci bus matching the @bus_num.

This matches the fix done on intel iommu in commit:

a2e1cd41ccfe796529abfd1b6aeb1dd4393762a2

Signed-off-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Peter Xu <peterx@redhat.com>

Message-Id: <20200226172628.17449-1-eric.auger@redhat.com>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/smmu-common.c | 1 +

1 file changed, 1 insertion(+)

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/smmu-common.c

+++ b/hw/arm/smmu-common.c

@@ -XXX,XX +XXX,XX @@ SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num)

return smmu_pci_bus;

}

}

+ smmu_pci_bus = NULL;

}

return smmu_pci_bus;

}

--

2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The smmu_find_smmu_pcibus() function was introduced (in commit

cac994ef43b) in a code format that could return an incorrect

pointer, which was then fixed by the previous commit.

We could have avoided this by writing the if() statement

differently. Do it now, in case this function is re-used.

The code is easier to review (harder to miss bugs).

Acked-by: Eric Auger <eric.auger@redhat.com>

Reviewed-by: Peter Xu <peterx@redhat.com>

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/smmu-common.c | 25 +++++++++++++------------

1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/smmu-common.c

+++ b/hw/arm/smmu-common.c

@@ -XXX,XX +XXX,XX @@ inline int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,

SMMUPciBus *smmu_find_smmu_pcibus(SMMUState *s, uint8_t bus_num)

{

SMMUPciBus *smmu_pci_bus = s->smmu_pcibus_by_bus_num[bus_num];

+ GHashTableIter iter;

- if (!smmu_pci_bus) {

- GHashTableIter iter;

-

- g_hash_table_iter_init(&iter, s->smmu_pcibus_by_busptr);

- while (g_hash_table_iter_next(&iter, NULL, (void **)&smmu_pci_bus)) {

- if (pci_bus_num(smmu_pci_bus->bus) == bus_num) {

- s->smmu_pcibus_by_bus_num[bus_num] = smmu_pci_bus;

- return smmu_pci_bus;

- }

- }

- smmu_pci_bus = NULL;

+ if (smmu_pci_bus) {

+ return smmu_pci_bus;

}

- return smmu_pci_bus;

+

+ g_hash_table_iter_init(&iter, s->smmu_pcibus_by_busptr);

+ while (g_hash_table_iter_next(&iter, NULL, (void **)&smmu_pci_bus)) {

+ if (pci_bus_num(smmu_pci_bus->bus) == bus_num) {

+ s->smmu_pcibus_by_bus_num[bus_num] = smmu_pci_bus;

+ return smmu_pci_bus;

+ }

+ }

+

+ return NULL;

}

static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

As the Connex and Verdex machines only boot in little-endian,

we can simplify the code.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/gumstix.c | 16 ++--------------

1 file changed, 2 insertions(+), 14 deletions(-)

diff --git a/hw/arm/gumstix.c b/hw/arm/gumstix.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/gumstix.c

+++ b/hw/arm/gumstix.c

@@ -XXX,XX +XXX,XX @@ static void connex_init(MachineState *machine)

{

PXA2xxState *cpu;

DriveInfo *dinfo;

- int be;

MemoryRegion *address_space_mem = get_system_memory();

uint32_t connex_rom = 0x01000000;

@@ -XXX,XX +XXX,XX @@ static void connex_init(MachineState *machine)

exit(1);

}

-#ifdef TARGET_WORDS_BIGENDIAN

- be = 1;

-#else

- be = 0;

-#endif

if (!pflash_cfi01_register(0x00000000, "connext.rom", connex_rom,

dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,

- sector_len, 2, 0, 0, 0, 0, be)) {

+ sector_len, 2, 0, 0, 0, 0, 0)) {

error_report("Error registering flash memory");

exit(1);

}

@@ -XXX,XX +XXX,XX @@ static void verdex_init(MachineState *machine)

{

PXA2xxState *cpu;

DriveInfo *dinfo;

- int be;

MemoryRegion *address_space_mem = get_system_memory();

uint32_t verdex_rom = 0x02000000;

@@ -XXX,XX +XXX,XX @@ static void verdex_init(MachineState *machine)

exit(1);

}

-#ifdef TARGET_WORDS_BIGENDIAN

- be = 1;

-#else

- be = 0;

-#endif

if (!pflash_cfi01_register(0x00000000, "verdex.rom", verdex_rom,

dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,

- sector_len, 2, 0, 0, 0, 0, be)) {

+ sector_len, 2, 0, 0, 0, 0, 0)) {

error_report("Error registering flash memory");

exit(1);

}

--

2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

We only build the little-endian softmmu configurations. Checking

for big endian is pointless, remove the unused code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/mainstone.c | 8 +-------

1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/hw/arm/mainstone.c b/hw/arm/mainstone.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/mainstone.c

+++ b/hw/arm/mainstone.c

@@ -XXX,XX +XXX,XX @@ static void mainstone_common_init(MemoryRegion *address_space_mem,

DeviceState *mst_irq;

DriveInfo *dinfo;

int i;

- int be;

MemoryRegion *rom = g_new(MemoryRegion, 1);

/* Setup CPU & memory */

@@ -XXX,XX +XXX,XX @@ static void mainstone_common_init(MemoryRegion *address_space_mem,

memory_region_set_readonly(rom, true);

memory_region_add_subregion(address_space_mem, 0, rom);

-#ifdef TARGET_WORDS_BIGENDIAN

- be = 1;

-#else

- be = 0;

-#endif

/* There are two 32MiB flash devices on the board */

for (i = 0; i < 2; i ++) {

dinfo = drive_get(IF_PFLASH, 0, i);

@@ -XXX,XX +XXX,XX @@ static void mainstone_common_init(MemoryRegion *address_space_mem,

i ? "mainstone.flash1" : "mainstone.flash0",

MAINSTONE_FLASH,

dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,

- sector_len, 4, 0, 0, 0, 0, be)) {

+ sector_len, 4, 0, 0, 0, 0, 0)) {

error_report("Error registering flash memory");

exit(1);

}

--

2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

We only build the little-endian softmmu configurations. Checking

for big endian is pointless, remove the unused code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/omap_sx1.c | 11 ++---------

1 file changed, 2 insertions(+), 9 deletions(-)

diff --git a/hw/arm/omap_sx1.c b/hw/arm/omap_sx1.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/omap_sx1.c

+++ b/hw/arm/omap_sx1.c

@@ -XXX,XX +XXX,XX @@ static void sx1_init(MachineState *machine, const int version)

DriveInfo *dinfo;

int fl_idx;

uint32_t flash_size = flash0_size;

- int be;

if (machine->ram_size != mc->default_ram_size) {

char *sz = size_to_str(mc->default_ram_size);

@@ -XXX,XX +XXX,XX @@ static void sx1_init(MachineState *machine, const int version)

OMAP_CS2_BASE, &cs[3]);

fl_idx = 0;

-#ifdef TARGET_WORDS_BIGENDIAN

- be = 1;

-#else

- be = 0;

-#endif

-

if ((dinfo = drive_get(IF_PFLASH, 0, fl_idx)) != NULL) {

if (!pflash_cfi01_register(OMAP_CS0_BASE,

"omap_sx1.flash0-1", flash_size,

blk_by_legacy_dinfo(dinfo),

- sector_size, 4, 0, 0, 0, 0, be)) {

+ sector_size, 4, 0, 0, 0, 0, 0)) {

fprintf(stderr, "qemu: Error registering flash memory %d.\n",

fl_idx);

}

@@ -XXX,XX +XXX,XX @@ static void sx1_init(MachineState *machine, const int version)

if (!pflash_cfi01_register(OMAP_CS1_BASE,

"omap_sx1.flash1-1", flash1_size,

blk_by_legacy_dinfo(dinfo),

- sector_size, 4, 0, 0, 0, 0, be)) {

+ sector_size, 4, 0, 0, 0, 0, 0)) {

fprintf(stderr, "qemu: Error registering flash memory %d.\n",

fl_idx);

}

--

2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

We only build the little-endian softmmu configurations. Checking

for big endian is pointless, remove the unused code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/z2.c | 8 +-------

1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/hw/arm/z2.c b/hw/arm/z2.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/z2.c

+++ b/hw/arm/z2.c

@@ -XXX,XX +XXX,XX @@ static void z2_init(MachineState *machine)

uint32_t sector_len = 0x10000;

PXA2xxState *mpu;

DriveInfo *dinfo;

- int be;

void *z2_lcd;

I2CBus *bus;

DeviceState *wm;

@@ -XXX,XX +XXX,XX @@ static void z2_init(MachineState *machine)

/* Setup CPU & memory */

mpu = pxa270_init(address_space_mem, z2_binfo.ram_size, machine->cpu_type);

-#ifdef TARGET_WORDS_BIGENDIAN

- be = 1;

-#else

- be = 0;

-#endif

dinfo = drive_get(IF_PFLASH, 0, 0);

if (!pflash_cfi01_register(Z2_FLASH_BASE, "z2.flash0", Z2_FLASH_SIZE,

dinfo ? blk_by_legacy_dinfo(dinfo) : NULL,

- sector_len, 4, 0, 0, 0, 0, be)) {

+ sector_len, 4, 0, 0, 0, 0, 0)) {

error_report("Error registering flash memory");

exit(1);

}

--

2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

We only build the little-endian softmmu configurations. Checking

for big endian is pointless, remove the unused code.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/musicpal.c | 10 ----------

1 file changed, 10 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/musicpal.c

+++ b/hw/arm/musicpal.c

@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)

* 0xFF800000 (if there is 8 MB flash). So remap flash access if the

* image is smaller than 32 MB.

*/

-#ifdef TARGET_WORDS_BIGENDIAN

- pflash_cfi02_register(0x100000000ULL - MP_FLASH_SIZE_MAX,

- "musicpal.flash", flash_size,

- blk, 0x10000,

- MP_FLASH_SIZE_MAX / flash_size,

- 2, 0x00BF, 0x236D, 0x0000, 0x0000,

- 0x5555, 0x2AAA, 1);

-#else

pflash_cfi02_register(0x100000000ULL - MP_FLASH_SIZE_MAX,

"musicpal.flash", flash_size,

blk, 0x10000,

MP_FLASH_SIZE_MAX / flash_size,

2, 0x00BF, 0x236D, 0x0000, 0x0000,

0x5555, 0x2AAA, 0);

-#endif

-

}

sysbus_create_simple(TYPE_MV88W8618_FLASHCFG, MP_FLASHCFG_BASE, NULL);

--

2.20.1

From: Pan Nengyuan <pannengyuan@huawei.com>

There are some memleaks when we call 'device_list_properties'. This patch move timer_new from init into realize to fix it.

Reported-by: Euler Robot <euler.robot@huawei.com>

Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>

Message-id: 20200227025055.14341-3-pannengyuan@huawei.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/pxa2xx.c | 17 +++++++++++------

1 file changed, 11 insertions(+), 6 deletions(-)

diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/pxa2xx.c

+++ b/hw/arm/pxa2xx.c

@@ -XXX,XX +XXX,XX @@ static void pxa2xx_rtc_init(Object *obj)

s->last_rtcpicr = 0;

s->last_hz = s->last_sw = s->last_pi = qemu_clock_get_ms(rtc_clock);

+ sysbus_init_irq(dev, &s->rtc_irq);

+

+ memory_region_init_io(&s->iomem, obj, &pxa2xx_rtc_ops, s,

+ "pxa2xx-rtc", 0x10000);

+ sysbus_init_mmio(dev, &s->iomem);

+}

+

+static void pxa2xx_rtc_realize(DeviceState *dev, Error **errp)

+{

+ PXA2xxRTCState *s = PXA2XX_RTC(dev);

s->rtc_hz = timer_new_ms(rtc_clock, pxa2xx_rtc_hz_tick, s);

s->rtc_rdal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal1_tick, s);

s->rtc_rdal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_rdal2_tick, s);

s->rtc_swal1 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal1_tick, s);

s->rtc_swal2 = timer_new_ms(rtc_clock, pxa2xx_rtc_swal2_tick, s);

s->rtc_pi = timer_new_ms(rtc_clock, pxa2xx_rtc_pi_tick, s);

-

- sysbus_init_irq(dev, &s->rtc_irq);

-

- memory_region_init_io(&s->iomem, obj, &pxa2xx_rtc_ops, s,

- "pxa2xx-rtc", 0x10000);

- sysbus_init_mmio(dev, &s->iomem);

}

static int pxa2xx_rtc_pre_save(void *opaque)

@@ -XXX,XX +XXX,XX @@ static void pxa2xx_rtc_sysbus_class_init(ObjectClass *klass, void *data)

dc->desc = "PXA2xx RTC Controller";

dc->vmsd = &vmstate_pxa2xx_rtc_regs;

+ dc->realize = pxa2xx_rtc_realize;

}

static const TypeInfo pxa2xx_rtc_sysbus_info = {

--

2.20.1

From: Pan Nengyuan <pannengyuan@huawei.com>

There are some memleaks when we call 'device_list_properties'. This patch move timer_new from init into realize to fix it.

Reported-by: Euler Robot <euler.robot@huawei.com>

Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>

Message-id: 20200227025055.14341-4-pannengyuan@huawei.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/spitz.c | 8 +++++++-

1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/spitz.c

+++ b/hw/arm/spitz.c

@@ -XXX,XX +XXX,XX @@ static void spitz_keyboard_init(Object *obj)

spitz_keyboard_pre_map(s);

- s->kbdtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, spitz_keyboard_tick, s);

qdev_init_gpio_in(dev, spitz_keyboard_strobe, SPITZ_KEY_STROBE_NUM);

qdev_init_gpio_out(dev, s->sense, SPITZ_KEY_SENSE_NUM);

}

+static void spitz_keyboard_realize(DeviceState *dev, Error **errp)

+{

+ SpitzKeyboardState *s = SPITZ_KEYBOARD(dev);

+ s->kbdtimer = timer_new_ns(QEMU_CLOCK_VIRTUAL, spitz_keyboard_tick, s);

+}

+

/* LCD backlight controller */

#define LCDTG_RESCTL    0x00

@@ -XXX,XX +XXX,XX @@ static void spitz_keyboard_class_init(ObjectClass *klass, void *data)

DeviceClass *dc = DEVICE_CLASS(klass);

dc->vmsd = &vmstate_spitz_kbd;

+ dc->realize = spitz_keyboard_realize;

}

static const TypeInfo spitz_keyboard_info = {

--

2.20.1

From: Pan Nengyuan <pannengyuan@huawei.com>

There are some memleaks when we call 'device_list_properties'. This patch move timer_new from init into realize to fix it.

Reported-by: Euler Robot <euler.robot@huawei.com>

Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>

Message-id: 20200227025055.14341-5-pannengyuan@huawei.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/strongarm.c | 18 ++++++++++++------

1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/hw/arm/strongarm.c b/hw/arm/strongarm.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/strongarm.c

+++ b/hw/arm/strongarm.c

@@ -XXX,XX +XXX,XX @@ static void strongarm_rtc_init(Object *obj)

s->last_rcnr = (uint32_t) mktimegm(&tm);

s->last_hz = qemu_clock_get_ms(rtc_clock);

- s->rtc_alarm = timer_new_ms(rtc_clock, strongarm_rtc_alarm_tick, s);

- s->rtc_hz = timer_new_ms(rtc_clock, strongarm_rtc_hz_tick, s);

-

sysbus_init_irq(dev, &s->rtc_irq);

sysbus_init_irq(dev, &s->rtc_hz_irq);

@@ -XXX,XX +XXX,XX @@ static void strongarm_rtc_init(Object *obj)

sysbus_init_mmio(dev, &s->iomem);

}

+static void strongarm_rtc_realize(DeviceState *dev, Error **errp)

+{

+ StrongARMRTCState *s = STRONGARM_RTC(dev);

+ s->rtc_alarm = timer_new_ms(rtc_clock, strongarm_rtc_alarm_tick, s);

+ s->rtc_hz = timer_new_ms(rtc_clock, strongarm_rtc_hz_tick, s);

+}

+

static int strongarm_rtc_pre_save(void *opaque)

{

StrongARMRTCState *s = opaque;

@@ -XXX,XX +XXX,XX @@ static void strongarm_rtc_sysbus_class_init(ObjectClass *klass, void *data)

dc->desc = "StrongARM RTC Controller";

dc->vmsd = &vmstate_strongarm_rtc_regs;

+ dc->realize = strongarm_rtc_realize;

}

static const TypeInfo strongarm_rtc_sysbus_info = {

@@ -XXX,XX +XXX,XX @@ static void strongarm_uart_init(Object *obj)

"uart", 0x10000);

sysbus_init_mmio(dev, &s->iomem);

sysbus_init_irq(dev, &s->irq);

-

- s->rx_timeout_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, strongarm_uart_rx_to, s);

- s->tx_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, strongarm_uart_tx, s);

}

static void strongarm_uart_realize(DeviceState *dev, Error **errp)

{

StrongARMUARTState *s = STRONGARM_UART(dev);

+ s->rx_timeout_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL,

+ strongarm_uart_rx_to,

+ s);

+ s->tx_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, strongarm_uart_tx, s);

qemu_chr_fe_set_handlers(&s->chr,

strongarm_uart_can_receive,

strongarm_uart_receive,

--

2.20.1

From: Pan Nengyuan <pannengyuan@huawei.com>

There are some memleaks when we call 'device_list_properties'. This patch move timer_new from init into realize to fix it.

Reported-by: Euler Robot <euler.robot@huawei.com>

Signed-off-by: Pan Nengyuan <pannengyuan@huawei.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Message-id: 20200227025055.14341-7-pannengyuan@huawei.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/timer/cadence_ttc.c | 18 ++++++++++++------

1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/hw/timer/cadence_ttc.c b/hw/timer/cadence_ttc.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/timer/cadence_ttc.c

+++ b/hw/timer/cadence_ttc.c

@@ -XXX,XX +XXX,XX @@ static void cadence_timer_init(uint32_t freq, CadenceTimerState *s)

static void cadence_ttc_init(Object *obj)

{

CadenceTTCState *s = CADENCE_TTC(obj);

- int i;

-

- for (i = 0; i < 3; ++i) {

- cadence_timer_init(133000000, &s->timer[i]);

- sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->timer[i].irq);

- }

memory_region_init_io(&s->iomem, obj, &cadence_ttc_ops, s,

"timer", 0x1000);

sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->iomem);

}

+static void cadence_ttc_realize(DeviceState *dev, Error **errp)

+{

+ CadenceTTCState *s = CADENCE_TTC(dev);

+ int i;

+

+ for (i = 0; i < 3; ++i) {

+ cadence_timer_init(133000000, &s->timer[i]);

+ sysbus_init_irq(SYS_BUS_DEVICE(dev), &s->timer[i].irq);

+ }

+}

+

static int cadence_timer_pre_save(void *opaque)

{

cadence_timer_sync((CadenceTimerState *)opaque);

@@ -XXX,XX +XXX,XX @@ static void cadence_ttc_class_init(ObjectClass *klass, void *data)

DeviceClass *dc = DEVICE_CLASS(klass);

dc->vmsd = &vmstate_cadence_ttc;

+ dc->realize = cadence_ttc_realize;

}

static const TypeInfo cadence_ttc_info = {

--

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Don't merely start with v8.0, handle v7VE as well. Ensure that writes

from aarch32 mode do not change bits in the other half of the register.

Protect reads of aa64 id registers with ARM_FEATURE_AARCH64.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200229012811.24129-2-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/helper.c | 38 +++++++++++++++++++++++++-------------

1 file changed, 25 insertions(+), 13 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {

REGINFO_SENTINEL

};

-static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

+static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)

{

ARMCPU *cpu = env_archcpu(env);

- /* Begin with bits defined in base ARMv8.0. */

- uint64_t valid_mask = MAKE_64BIT_MASK(0, 34);

+

+ if (arm_feature(env, ARM_FEATURE_V8)) {

+ valid_mask |= MAKE_64BIT_MASK(0, 34); /* ARMv8.0 */

+ } else {

+ valid_mask |= MAKE_64BIT_MASK(0, 28); /* ARMv7VE */

+ }

if (arm_feature(env, ARM_FEATURE_EL3)) {

valid_mask &= ~HCR_HCD;

@@ -XXX,XX +XXX,XX @@ static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

*/

valid_mask &= ~HCR_TSC;

}

- if (cpu_isar_feature(aa64_vh, cpu)) {

- valid_mask |= HCR_E2H;

- }

- if (cpu_isar_feature(aa64_lor, cpu)) {

- valid_mask |= HCR_TLOR;

- }

- if (cpu_isar_feature(aa64_pauth, cpu)) {

- valid_mask |= HCR_API | HCR_APK;

+

+ if (arm_feature(env, ARM_FEATURE_AARCH64)) {

+ if (cpu_isar_feature(aa64_vh, cpu)) {

+ valid_mask |= HCR_E2H;

+ }

+ if (cpu_isar_feature(aa64_lor, cpu)) {

+ valid_mask |= HCR_TLOR;

+ }

+ if (cpu_isar_feature(aa64_pauth, cpu)) {

+ valid_mask |= HCR_API | HCR_APK;

+ }

}

/* Clear RES0 bits. */

@@ -XXX,XX +XXX,XX @@ static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

arm_cpu_update_vfiq(cpu);

}

+static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)

+{

+ do_hcr_write(env, value, 0);

+}

+

static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri,

uint64_t value)

{

/* Handle HCR2 write, i.e. write to high half of HCR_EL2 */

value = deposit64(env->cp15.hcr_el2, 32, 32, value);

- hcr_write(env, NULL, value);

+ do_hcr_write(env, value, MAKE_64BIT_MASK(0, 32));

}

static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,

@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,

{

/* Handle HCR write, i.e. write to low half of HCR_EL2 */

value = deposit64(env->cp15.hcr_el2, 0, 32, value);

- hcr_write(env, NULL, value);

+ do_hcr_write(env, value, MAKE_64BIT_MASK(32, 32));

}

/*

--

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200229012811.24129-3-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/cpu.h | 7 +++++++

1 file changed, 7 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.h

+++ b/target/arm/cpu.h

@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)

#define HCR_TERR (1ULL << 36)

#define HCR_TEA (1ULL << 37)

#define HCR_MIOCNCE (1ULL << 38)

+/* RES0 bit 39 */

#define HCR_APK (1ULL << 40)

#define HCR_API (1ULL << 41)

#define HCR_NV (1ULL << 42)

@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)

#define HCR_NV2 (1ULL << 45)

#define HCR_FWB (1ULL << 46)

#define HCR_FIEN (1ULL << 47)

+/* RES0 bit 48 */

#define HCR_TID4 (1ULL << 49)

#define HCR_TICAB (1ULL << 50)

+#define HCR_AMVOFFEN (1ULL << 51)

#define HCR_TOCU (1ULL << 52)

+#define HCR_ENSCXT (1ULL << 53)

#define HCR_TTLBIS (1ULL << 54)

#define HCR_TTLBOS (1ULL << 55)

#define HCR_ATA (1ULL << 56)

#define HCR_DCT (1ULL << 57)

+#define HCR_TID5 (1ULL << 58)

+#define HCR_TWEDEN (1ULL << 59)

+#define HCR_TWEDEL MAKE_64BIT_MASK(60, 4)

#define SCR_NS (1U << 0)

#define SCR_IRQ (1U << 1)

--

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

In arm_cpu_reset, we configure many system registers so that user-only

behaves as it should with a minimum of ifdefs. However, we do not set

all of the system registers as required for a cpu with EL2 and EL3.

Disabling EL2 and EL3 mean that we will not look at those registers,

which means that we don't have to worry about configuring them.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200229012811.24129-4-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/cpu.c | 6 ++++--

1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_reset_hivecs_property =

static Property arm_cpu_rvbar_property =

DEFINE_PROP_UINT64("rvbar", ARMCPU, rvbar, 0);

+#ifndef CONFIG_USER_ONLY

static Property arm_cpu_has_el2_property =

DEFINE_PROP_BOOL("has_el2", ARMCPU, has_el2, true);

static Property arm_cpu_has_el3_property =

DEFINE_PROP_BOOL("has_el3", ARMCPU, has_el3, true);

+#endif

static Property arm_cpu_cfgend_property =

DEFINE_PROP_BOOL("cfgend", ARMCPU, cfgend, false);

@@ -XXX,XX +XXX,XX @@ void arm_cpu_post_init(Object *obj)

qdev_property_add_static(DEVICE(obj), &arm_cpu_rvbar_property);

}

+#ifndef CONFIG_USER_ONLY

if (arm_feature(&cpu->env, ARM_FEATURE_EL3)) {

/* Add the has_el3 state CPU property only if EL3 is allowed. This will

* prevent "has_el3" from existing on CPUs which cannot support EL3.

*/

qdev_property_add_static(DEVICE(obj), &arm_cpu_has_el3_property);

-#ifndef CONFIG_USER_ONLY

object_property_add_link(obj, "secure-memory",

TYPE_MEMORY_REGION,

(Object **)&cpu->secure_memory,

qdev_prop_allow_set_link_before_realize,

OBJ_PROP_LINK_STRONG,

&error_abort);

-#endif

}

if (arm_feature(&cpu->env, ARM_FEATURE_EL2)) {

qdev_property_add_static(DEVICE(obj), &arm_cpu_has_el2_property);

}

+#endif

if (arm_feature(&cpu->env, ARM_FEATURE_PMU)) {

cpu->has_pmu = true;

--

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

We have disabled EL2 and EL3 for user-only, which means that these

registers "don't exist" and should not be set.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200229012811.24129-5-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/cpu.c | 6 ------

1 file changed, 6 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/cpu.c

+++ b/target/arm/cpu.c

@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)

/* Enable all PAC keys. */

env->cp15.sctlr_el[1] |= (SCTLR_EnIA | SCTLR_EnIB |

SCTLR_EnDA | SCTLR_EnDB);

- /* Enable all PAC instructions */

- env->cp15.hcr_el2 |= HCR_API;

- env->cp15.scr_el3 |= SCR_API;

/* and to the FP/Neon instructions */

env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 20, 2, 3);

/* and to the SVE instructions */

env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);

- env->cp15.cptr_el[3] |= CPTR_EZ;

/* with maximum vector length */

env->vfp.zcr_el[1] = cpu_isar_feature(aa64_sve, cpu) ?

cpu->sve_max_vq - 1 : 0;

- env->vfp.zcr_el[2] = env->vfp.zcr_el[1];

- env->vfp.zcr_el[3] = env->vfp.zcr_el[1];

/*

* Enable TBI0 and TBI1. While the real kernel only enables TBI0,

* turning on both here will produce smaller code and otherwise

--

2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Update the {TGE,E2H} == '11' masking to ARMv8.6.

If EL2 is configured for aarch32, disable all of

the bits that are RES0 in aarch32 mode.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20200229012811.24129-6-richard.henderson@linaro.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/helper.c | 31 +++++++++++++++++++++++++++----

1 file changed, 27 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff(CPUARMState *env)

* Since the v8.4 language applies to the entire register, and

* appears to be backward compatible, use that.

*/

- ret = 0;

- } else if (ret & HCR_TGE) {

- /* These bits are up-to-date as of ARMv8.4. */

+ return 0;

+ }

+

+ /*

+ * For a cpu that supports both aarch64 and aarch32, we can set bits

+ * in HCR_EL2 (e.g. via EL3) that are RES0 when we enter EL2 as aa32.

+ * Ignore all of the bits in HCR+HCR2 that are not valid for aarch32.

+ */

+ if (!arm_el_is_aa64(env, 2)) {

+ uint64_t aa32_valid;

+

+ /*

+ * These bits are up-to-date as of ARMv8.6.

+ * For HCR, it's easiest to list just the 2 bits that are invalid.

+ * For HCR2, list those that are valid.

+ */

+ aa32_valid = MAKE_64BIT_MASK(0, 32) & ~(HCR_RW | HCR_TDZ);

+ aa32_valid |= (HCR_CD | HCR_ID | HCR_TERR | HCR_TEA | HCR_MIOCNCE |

+ HCR_TID4 | HCR_TICAB | HCR_TOCU | HCR_TTLBIS);

+ ret &= aa32_valid;

+ }

+

+ if (ret & HCR_TGE) {

+ /* These bits are up-to-date as of ARMv8.6. */

if (ret & HCR_E2H) {

ret &= ~(HCR_VM | HCR_FMO | HCR_IMO | HCR_AMO |

HCR_BSU_MASK | HCR_DC | HCR_TWI | HCR_TWE |

HCR_TID0 | HCR_TID2 | HCR_TPCP | HCR_TPU |

- HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE);

+ HCR_TDZ | HCR_CD | HCR_ID | HCR_MIOCNCE |

+ HCR_TID4 | HCR_TICAB | HCR_TOCU | HCR_ENSCXT |

+ HCR_TTLBIS | HCR_TTLBOS | HCR_TID5);

} else {

ret |= HCR_FMO | HCR_IMO | HCR_AMO;

}