Series comparison

-[Qemu-devel] [PULL 00/16] target-arm queue
+[PULL 0/7] target-arm queue
-target-arm queue for 3.1: mostly bug fixes, but the "turn on
+Hi; this pull request has a collection of bug fixes for rc0.
-EL2 support for Cortex-A7 and -A15" is technically enabling
+The big one is the trusted firmware boot regression fix.
 of a new feature... I think this is OK since we're only at rc1,
 and it's easy to revert that feature bit flip if necessary.
 thanks
 -- PMM
+The following changes since commit ece5f8374d0416a339f0c0a9399faa2c42d4ad6f:
-The following changes since commit 5704c36d25ee84e7129722cb0db53df9faefe943:
+  Merge tag 'linux-user-for-7.2-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-11-03 10:55:05 -0400)
   Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181112-pull-request' into staging (2018-11-12 15:55:40 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181112
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20221104
-for you to fetch changes up to 1a4c1a6dbf60aebddd07753f1013ea896c06ad29:
+for you to fetch changes up to cead7fa4c06087c86c67c5ce815cc1ff0bfeac3a:
-  target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature (2018-11-12 16:52:29 +0000)
+  target/arm: Two fixes for secure ptw (2022-11-04 10:58:58 +0000)
 ----------------------------------------------------------------
-target/arm queue:
+target-arm queue:
- * Remove no-longer-needed workaround for small SAU regions for v8M
+ * Fix regression booting Trusted Firmware
- * Remove antique TODO comment
+ * Honor HCR_E2H and HCR_TGE in ats_write64()
- * MAINTAINERS: Add an entry for the 'collie' machine
+ * Copy the entire vector in DO_ZIP
- * hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
+ * Fix Privileged Access Never (PAN) for aarch32
- * Fix infinite recursion in tlbi_aa64_vmalle1_write()
+ * Make TLBIOS and TLBIRANGE ops trap on HCR_EL2.TTLB
- * ARM KVM: fix various bugs in handling of guest debugging
+ * Set SCR_EL3.HXEn when direct booting kernel
- * Correctly implement handling of HCR_EL2.{VI, VF}
+ * Set SME and SVE EL3 vector lengths when direct booting kernel
  * Hyp mode R14 is shared with User and System
  * Give Cortex-A15 and -A7 the EL2 feature
 ----------------------------------------------------------------
-Alex Bennée (6):
+Ake Koomsin (1):
-      target/arm64: properly handle DBGVR RESS bits
+      target/arm: Honor HCR_E2H and HCR_TGE in ats_write64()
       target/arm64: hold BQL when calling do_interrupt()
       target/arm64: kvm debug set target_el when passing exception to guest
       tests/guest-debug: fix scoping of failcount
       arm: use symbolic MDCR_TDE in arm_debug_target_el
       arm: fix aa64_generate_debug_exceptions to work with EL2
-Eric Auger (1):
+Peter Maydell (3):
-      hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
+      hw/arm/boot: Set SME and SVE EL3 vector lengths when booting kernel
       hw/arm/boot: Set SCR_EL3.HXEn when booting kernel
       target/arm: Make TLBIOS and TLBIRANGE ops trap on HCR_EL2.TTLB
-Peter Maydell (7):
+Richard Henderson (2):
-      target/arm: Remove workaround for small SAU regions
+      target/arm: Copy the entire vector in DO_ZIP
-      target/arm: Remove antique TODO comment
+      target/arm: Two fixes for secure ptw
       Revert "target/arm: Implement HCR.VI and VF"
       target/arm: Track the state of our irq lines from the GIC explicitly
       target/arm: Correctly implement handling of HCR_EL2.{VI, VF}
       target/arm: Hyp mode R14 is shared with User and System
       target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature
-Richard Henderson (1):
+Timofey Kutergin (1):
-      target/arm: Fix typo in tlbi_aa64_vmalle1_write
+      target/arm: Fix Privileged Access Never (PAN) for aarch32
-Thomas Huth (1):
+ hw/arm/boot.c           |  5 ++++
-      MAINTAINERS: Add an entry for the 'collie' machine
+ target/arm/helper.c     | 64 +++++++++++++++++++++++++++++--------------------
+ target/arm/ptw.c        | 50 ++++++++++++++++++++++++++++----------
- target/arm/cpu.h                  |  44 +++++++++++------
+ target/arm/sve_helper.c |  4 ++--
- target/arm/internals.h            |  34 +++++++++++++
+files changed, 83 insertions(+), 40 deletions(-)
  hw/arm/sysbus-fdt.c               |  12 +++--
  target/arm/cpu.c                  |  66 ++++++++++++++++++++++++-
  target/arm/helper.c               | 101 +++++++++++++-------------------------
  target/arm/kvm32.c                |   4 +-
  target/arm/kvm64.c                |  20 +++++++-
  target/arm/machine.c              |  51 +++++++++++++++++++
  target/arm/op_helper.c            |   4 +-
  MAINTAINERS                       |   7 +++
  tests/guest-debug/test-gdbstub.py |   1 +
 files changed, 248 insertions(+), 96 deletions(-)

-[Qemu-devel] [PULL 16/16] target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature
+[PULL 1/7] hw/arm/boot: Set SME and SVE EL3 vector lengths when booting kernel
-The Cortex-A15 and Cortex-A7 both have EL2; now we've implemented
+When we direct boot a kernel on a CPU which emulates EL3, we need
-it properly we can enable the feature bit.
+to set up the EL3 system registers as the Linux kernel documentation
 specifies:
  https://www.kernel.org/doc/Documentation/arm64/booting.rst
 For SVE and SME this includes:
     - ZCR_EL3.LEN must be initialised to the same value for all CPUs the
       kernel is executed on.
     - SMCR_EL3.LEN must be initialised to the same value for all CPUs the
       kernel will execute on.
 Although we are technically compliant with this, the "same value" we
 currently use by default is the reset value of 0.  This will end up
 forcing the guest kernel's SVE and SME vector length to be only the
 smallest supported length.
 Initialize the vector length fields to their maximum possible value,
 which is 0xf. If the implementation doesn't actually support that
 vector length then the effective vector length will be constrained
 down to the maximum supported value at point of use.
 This allows the guest to use all the vector lengths the emulated CPU
 supports (by programming the _EL2 and _EL1 versions of these
 registers.)
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Message-id: 20221027140207.413084-2-peter.maydell@linaro.org
 Message-id: 20181109173553.22341-3-peter.maydell@linaro.org
 ---
- target/arm/cpu.c | 2 ++
+ hw/arm/boot.c | 2 ++
 file changed, 2 insertions(+)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
+--- a/hw/arm/boot.c
-+++ b/target/arm/cpu.c
++++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
-     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
+                     }
-     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
+                     if (cpu_isar_feature(aa64_sve, cpu)) {
-     set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+                         env->cp15.cptr_el[3] |= R_CPTR_EL3_EZ_MASK;
-+    set_feature(&cpu->env, ARM_FEATURE_EL2);
++                        env->vfp.zcr_el[3] = 0xf;
-     set_feature(&cpu->env, ARM_FEATURE_EL3);
+                     }
-     cpu->kvm_target = QEMU_KVM_ARM_TARGET_CORTEX_A7;
+                     if (cpu_isar_feature(aa64_sme, cpu)) {
-     cpu->midr = 0x410fc075;
+                         env->cp15.cptr_el[3] |= R_CPTR_EL3_ESM_MASK;
-@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
+                         env->cp15.scr_el3 |= SCR_ENTP2;
-     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
++                        env->vfp.smcr_el[3] = 0xf;
-     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
+                     }
-     set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+                     /* AArch64 kernels never boot in secure mode */
-+    set_feature(&cpu->env, ARM_FEATURE_EL2);
+                     assert(!info->secure_boot);
      set_feature(&cpu->env, ARM_FEATURE_EL3);
      cpu->kvm_target = QEMU_KVM_ARM_TARGET_CORTEX_A15;
      cpu->midr = 0x412fc0f1;
 --
-.19.1
+.25.1

-[Qemu-devel] [PULL 15/16] target/arm: Hyp mode R14 is shared with User and System
+[PULL 2/7] hw/arm/boot: Set SCR_EL3.HXEn when booting kernel
-Hyp mode is an exception to the general rule that each AArch32
+When we direct boot a kernel on a CPU which emulates EL3, we need to
-mode has its own r13, r14 and SPSR -- it has a banked r13 and
+set up the EL3 system registers as the Linux kernel documentation
-SPSR but shares its r14 with User and System mode. We were
+specifies:
-incorrectly implementing it as banked, which meant that on
+     https://www.kernel.org/doc/Documentation/arm64/booting.rst
 entry to Hyp mode r14 was 0 rather than the USR/SYS r14.
-We provide a new function r14_bank_number() which is like
+For CPUs with FEAT_HCX support this includes:
-the existing bank_number() but provides the index into
+    - SCR_EL3.HXEn (bit 38) must be initialised to 0b1.
 env->banked_r14[]; bank_number() provides the index to use
 for env->banked_r13[] and env->banked_cpsr[].
-All the points in the code that were using bank_number()
+but we forgot to do this when implementing FEAT_HCX, which would mean
-to index into env->banked_r14[] are updated for consintency:
+that a guest trying to access the HCRX_EL2 register would crash.
  * switch_mode() -- this is the only place where we fix
    an actual bug
  * aarch64_sync_32_to_64() and aarch64_sync_64_to_32():
    no behavioural change as we already special-cased Hyp R14
  * kvm32.c: no behavioural change since the guest can't ever
    be in Hyp mode, but conceptually the right thing to do
  * msr_banked()/mrs_banked(): we can never get to the case
    that accesses banked_r14[] with tgtmode == ARM_CPU_MODE_HYP,
    so no behavioural change
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Message-id: 20221027140207.413084-3-peter.maydell@linaro.org
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20181109173553.22341-2-peter.maydell@linaro.org
 ---
- target/arm/internals.h | 16 ++++++++++++++++
+ hw/arm/boot.c | 3 +++
- target/arm/helper.c    | 29 +++++++++++++++--------------
+file changed, 3 insertions(+)
  target/arm/kvm32.c     |  4 ++--
  target/arm/op_helper.c |  4 ++--
 files changed, 35 insertions(+), 18 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/hw/arm/boot.c
-+++ b/target/arm/internals.h
++++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ static inline int bank_number(int mode)
+@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
-     g_assert_not_reached();
+                         env->cp15.scr_el3 |= SCR_ENTP2;
- }
+                         env->vfp.smcr_el[3] = 0xf;
+                     }
-+/**
++                    if (cpu_isar_feature(aa64_hcx, cpu)) {
-+ * r14_bank_number: Map CPU mode onto register bank for r14
++                        env->cp15.scr_el3 |= SCR_HXEN;
-+ *
++                    }
-+ * Given an AArch32 CPU mode, return the index into the saved register
+                     /* AArch64 kernels never boot in secure mode */
-+ * banks to use for the R14 (LR) in that mode. This is the same as
+                     assert(!info->secure_boot);
-+ * bank_number(), except for the special case of Hyp mode, where
+                     /* This hook is only supported for AArch32 currently:
 + * R14 is shared with USR and SYS, unlike its R13 and SPSR.
 + * This should be used as the index into env->banked_r14[], and
 + * bank_number() used for the index into env->banked_r13[] and
 + * env->banked_spsr[].
 + */
 +static inline int r14_bank_number(int mode)
 +{
 +    return (mode == ARM_CPU_MODE_HYP) ? BANK_USRSYS : bank_number(mode);
 +}
 +
  void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
  void arm_translate_init(void);
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void switch_mode(CPUARMState *env, int mode)
      i = bank_number(old_mode);
      env->banked_r13[i] = env->regs[13];
 -    env->banked_r14[i] = env->regs[14];
      env->banked_spsr[i] = env->spsr;
      i = bank_number(mode);
      env->regs[13] = env->banked_r13[i];
 -    env->regs[14] = env->banked_r14[i];
      env->spsr = env->banked_spsr[i];
 +
 +    env->banked_r14[r14_bank_number(old_mode)] = env->regs[14];
 +    env->regs[14] = env->banked_r14[r14_bank_number(mode)];
  }
  /* Physical Interrupt Target EL Lookup Table
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
          if (mode == ARM_CPU_MODE_HYP) {
              env->xregs[14] = env->regs[14];
          } else {
 -            env->xregs[14] = env->banked_r14[bank_number(ARM_CPU_MODE_USR)];
 +            env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)];
          }
      }
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
          env->xregs[16] = env->regs[14];
          env->xregs[17] = env->regs[13];
      } else {
 -        env->xregs[16] = env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)];
 +        env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)];
          env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)];
      }
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
          env->xregs[18] = env->regs[14];
          env->xregs[19] = env->regs[13];
      } else {
 -        env->xregs[18] = env->banked_r14[bank_number(ARM_CPU_MODE_SVC)];
 +        env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)];
          env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)];
      }
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
          env->xregs[20] = env->regs[14];
          env->xregs[21] = env->regs[13];
      } else {
 -        env->xregs[20] = env->banked_r14[bank_number(ARM_CPU_MODE_ABT)];
 +        env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)];
          env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)];
      }
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
          env->xregs[22] = env->regs[14];
          env->xregs[23] = env->regs[13];
      } else {
 -        env->xregs[22] = env->banked_r14[bank_number(ARM_CPU_MODE_UND)];
 +        env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)];
          env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)];
      }
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
              env->xregs[i] = env->fiq_regs[i - 24];
          }
          env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)];
 -        env->xregs[30] = env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)];
 +        env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)];
      }
      env->pc = env->regs[15];
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
          if (mode == ARM_CPU_MODE_HYP) {
              env->regs[14] = env->xregs[14];
          } else {
 -            env->banked_r14[bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
 +            env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
          }
      }
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
          env->regs[14] = env->xregs[16];
          env->regs[13] = env->xregs[17];
      } else {
 -        env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
 +        env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
          env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17];
      }
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
          env->regs[14] = env->xregs[18];
          env->regs[13] = env->xregs[19];
      } else {
 -        env->banked_r14[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
 +        env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
          env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19];
      }
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
          env->regs[14] = env->xregs[20];
          env->regs[13] = env->xregs[21];
      } else {
 -        env->banked_r14[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
 +        env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
          env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21];
      }
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
          env->regs[14] = env->xregs[22];
          env->regs[13] = env->xregs[23];
      } else {
 -        env->banked_r14[bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
 +        env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
          env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23];
      }
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
              env->fiq_regs[i - 24] = env->xregs[i];
          }
          env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29];
 -        env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
 +        env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
      }
      env->regs[15] = env->pc;
 diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm32.c
 +++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
          memcpy(env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
      }
      env->banked_r13[bn] = env->regs[13];
 -    env->banked_r14[bn] = env->regs[14];
      env->banked_spsr[bn] = env->spsr;
 +    env->banked_r14[r14_bank_number(mode)] = env->regs[14];
      /* Now we can safely copy stuff down to the kernel */
      for (i = 0; i < ARRAY_SIZE(regs); i++) {
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
          memcpy(env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
      }
      env->regs[13] = env->banked_r13[bn];
 -    env->regs[14] = env->banked_r14[bn];
      env->spsr = env->banked_spsr[bn];
 +    env->regs[14] = env->banked_r14[r14_bank_number(mode)];
      /* VFP registers */
      r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(msr_banked)(CPUARMState *env, uint32_t value, uint32_t tgtmode,
          env->banked_r13[bank_number(tgtmode)] = value;
          break;
      case 14:
 -        env->banked_r14[bank_number(tgtmode)] = value;
 +        env->banked_r14[r14_bank_number(tgtmode)] = value;
          break;
      case 8 ... 12:
          switch (tgtmode) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(mrs_banked)(CPUARMState *env, uint32_t tgtmode, uint32_t regno)
      case 13:
          return env->banked_r13[bank_number(tgtmode)];
      case 14:
 -        return env->banked_r14[bank_number(tgtmode)];
 +        return env->banked_r14[r14_bank_number(tgtmode)];
      case 8 ... 12:
          switch (tgtmode) {
          case ARM_CPU_MODE_USR:
 --
-.19.1
+.25.1

-[Qemu-devel] [PULL 02/16] target/arm: Remove antique TODO comment
+[PULL 3/7] target/arm: Make TLBIOS and TLBIRANGE ops trap on HCR_EL2.TTLB
-Remove a TODO comment about implementing the vectored interrupt
+The HCR_EL2.TTLB bit is supposed to trap all EL1 execution of TLB
-controller. We have had an implementation of that for a decade;
+maintenance instructions.  However we have added new TLB insns for
-it's in hw/intc/pl190.c.
+FEAT_TLBIOS and FEAT_TLBIRANGE, and forgot to set their accessfn to
 access_ttlb.  Add the missing accessfns.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181106164118.16184-1-peter.maydell@linaro.org
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 ---
- target/arm/helper.c | 1 -
+ target/arm/helper.c | 36 ++++++++++++++++++------------------
-file changed, 1 deletion(-)
+file changed, 18 insertions(+), 18 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch32(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pauth_reginfo[] = {
-         return;
+ static const ARMCPRegInfo tlbirange_reginfo[] = {
-     }
+     { .name = "TLBI_RVAE1IS", .state = ARM_CP_STATE_AA64,
+       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 1,
--    /* TODO: Vectored interrupt controller.  */
+-      .access = PL1_W, .type = ARM_CP_NO_RAW,
-     switch (cs->exception_index) {
++      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
-     case EXCP_UDEF:
+       .writefn = tlbi_aa64_rvae1is_write },
-         new_mode = ARM_CPU_MODE_UND;
+     { .name = "TLBI_RVAAE1IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 3,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae1is_write },
     { .name = "TLBI_RVALE1IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 5,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae1is_write },
      { .name = "TLBI_RVAALE1IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 7,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae1is_write },
      { .name = "TLBI_RVAE1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae1is_write },
      { .name = "TLBI_RVAAE1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 3,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae1is_write },
     { .name = "TLBI_RVALE1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 5,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae1is_write },
      { .name = "TLBI_RVAALE1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 7,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae1is_write },
      { .name = "TLBI_RVAE1", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae1_write },
      { .name = "TLBI_RVAAE1", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 3,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae1_write },
     { .name = "TLBI_RVALE1", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 5,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae1_write },
      { .name = "TLBI_RVAALE1", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 7,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_rvae1_write },
      { .name = "TLBI_RIPAS2E1IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 2,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbirange_reginfo[] = {
  static const ARMCPRegInfo tlbios_reginfo[] = {
      { .name = "TLBI_VMALLE1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 0,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_vmalle1is_write },
      { .name = "TLBI_VAE1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 1,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_vae1is_write },
      { .name = "TLBI_ASIDE1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 2,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_vmalle1is_write },
      { .name = "TLBI_VAAE1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 3,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_vae1is_write },
      { .name = "TLBI_VALE1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 5,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_vae1is_write },
      { .name = "TLBI_VAALE1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 7,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
        .writefn = tlbi_aa64_vae1is_write },
      { .name = "TLBI_ALLE2OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 0,
 --
-.19.1
+.25.1

-[Qemu-devel] [PULL 12/16] Revert "target/arm: Implement HCR.VI and VF"
+[PULL 4/7] target/arm: Fix Privileged Access Never (PAN) for aarch32
-This reverts commit 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f.
+From: Timofey Kutergin <tkutergin@gmail.com>
-The implementation of HCR.VI and VF in that commit is not
+When we implemented the PAN support we theoretically wanted
-correct -- they do not track the overall "is there a pending
+to support it for both AArch32 and AArch64, but in practice
-VIRQ or VFIQ" status, but whether there is a pending interrupt
+several bugs made it essentially unusable with an AArch32
-due to "this mechanism", ie the hypervisor having set the VI/VF
+guest. Fix all those problems:
 bits. The overall pending state for VIRQ and VFIQ is effectively
 the logical OR of the inbound lines from the GIC with the
 VI and VF bits. Commit 8a0fc3a29fc231 would result in pending
 VIRQ/VFIQ possibly being lost when the hypervisor wrote to HCR.
-As a preliminary to implementing the HCR.VI/VF feature properly,
+    - Use CPSR.PAN to check for PAN state in aarch32 mode
-revert the broken one entirely.
+    - throw permission fault during address translation when PAN is
       enabled and kernel tries to access user acessible page
     - ignore SCTLR_XP bit for armv7 and armv8 (conflicts with SCTLR_SPAN).
+Signed-off-by: Timofey Kutergin <tkutergin@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20221027112619.2205229-1-tkutergin@gmail.com
+[PMM: tweak commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20181109134731.11605-2-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 47 ++++-----------------------------------------
+ target/arm/helper.c | 13 +++++++++++--
-file changed, 4 insertions(+), 43 deletions(-)
+ target/arm/ptw.c    | 35 ++++++++++++++++++++++++++++++-----
 files changed, 41 insertions(+), 7 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
- static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+ }
  #endif
 +static bool arm_pan_enabled(CPUARMState *env)
 +{
 +    if (is_a64(env)) {
 +        return env->pstate & PSTATE_PAN;
 +    } else {
 +        return env->uncached_cpsr & CPSR_PAN;
 +    }
 +}
 +
  ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
  {
-     ARMCPU *cpu = arm_env_get_cpu(env);
+     ARMMMUIdx idx;
--    CPUState *cs = ENV_GET_CPU(env);
+@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
-     uint64_t valid_mask = HCR_MASK;
+         }
+         break;
-     if (arm_feature(env, ARM_FEATURE_EL3)) {
+     case 1:
-@@ -XXX,XX +XXX,XX @@ static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
+-        if (env->pstate & PSTATE_PAN) {
-     /* Clear RES0 bits.  */
++        if (arm_pan_enabled(env)) {
-     value &= valid_mask;
+             idx = ARMMMUIdx_E10_1_PAN;
+         } else {
--    /*
+             idx = ARMMMUIdx_E10_1;
--     * VI and VF are kept in cs->interrupt_request. Modifying that
+@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
--     * requires that we have the iothread lock, which is done by
+     case 2:
--     * marking the reginfo structs as ARM_CP_IO.
+         /* Note that TGE does not apply at EL2.  */
--     * Note that if a write to HCR pends a VIRQ or VFIQ it is never
+         if (arm_hcr_el2_eff(env) & HCR_E2H) {
--     * possible for it to be taken immediately, because VIRQ and
+-            if (env->pstate & PSTATE_PAN) {
--     * VFIQ are masked unless running at EL0 or EL1, and HCR
++            if (arm_pan_enabled(env)) {
--     * can only be written at EL2.
+                 idx = ARMMMUIdx_E20_2_PAN;
--     */
+             } else {
--    g_assert(qemu_mutex_iothread_locked());
+                 idx = ARMMMUIdx_E20_2;
--    if (value & HCR_VI) {
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
--        cs->interrupt_request |= CPU_INTERRUPT_VIRQ;
+index XXXXXXX..XXXXXXX 100644
--    } else {
+--- a/target/arm/ptw.c
--        cs->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
++++ b/target/arm/ptw.c
--    }
+@@ -XXX,XX +XXX,XX @@ static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
--    if (value & HCR_VF) {
+  * @mmu_idx:     MMU index indicating required translation regime
--        cs->interrupt_request |= CPU_INTERRUPT_VFIQ;
+  * @ap:          The 3-bit access permissions (AP[2:0])
--    } else {
+  * @domain_prot: The 2-bit domain access permissions
--        cs->interrupt_request &= ~CPU_INTERRUPT_VFIQ;
++ * @is_user: TRUE if accessing from PL0
--    }
+  */
--    value &= ~(HCR_VI | HCR_VF);
+-static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
 -                         int ap, int domain_prot)
 +static int ap_to_rw_prot_is_user(CPUARMState *env, ARMMMUIdx mmu_idx,
 +                         int ap, int domain_prot, bool is_user)
  {
 -    bool is_user = regime_is_user(env, mmu_idx);
 -
-     /* These bits change the MMU setup:
+     if (domain_prot == 3) {
-      * HCR_VM enables stage 2 translation
+         return PAGE_READ | PAGE_WRITE;
-      * HCR_PTW forbids certain page-table setups
+     }
-@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@ static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
-     hcr_write(env, NULL, value);
+     }
  }
--static uint64_t hcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
++/*
--{
++ * Translate section/page access permissions to page R/W protection flags
--    /* The VI and VF bits live in cs->interrupt_request */
++ * @env:         CPUARMState
--    uint64_t ret = env->cp15.hcr_el2 & ~(HCR_VI | HCR_VF);
++ * @mmu_idx:     MMU index indicating required translation regime
--    CPUState *cs = ENV_GET_CPU(env);
++ * @ap:          The 3-bit access permissions (AP[2:0])
--
++ * @domain_prot: The 2-bit domain access permissions
--    if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
++ */
--        ret |= HCR_VI;
++static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
--    }
++                         int ap, int domain_prot)
--    if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
++{
--        ret |= HCR_VF;
++   return ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot,
--    }
++                                regime_is_user(env, mmu_idx));
--    return ret;
++}
--}
++
--
+ /*
- static const ARMCPRegInfo el2_cp_reginfo[] = {
+  * Translate section/page access permissions to page R/W protection flags.
-     { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
+  * @ap:      The 2-bit simple AP (AP[2:1])
--      .type = ARM_CP_IO,
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
-       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
+     hwaddr phys_addr;
-       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
+     uint32_t dacr;
--      .writefn = hcr_write, .readfn = hcr_read },
+     bool ns;
-+      .writefn = hcr_write },
++    int user_prot;
-     { .name = "HCR", .state = ARM_CP_STATE_AA32,
--      .type = ARM_CP_ALIAS | ARM_CP_IO,
+     /* Pagetable walk.  */
-+      .type = ARM_CP_ALIAS,
+     /* Lookup l1 descriptor.  */
-       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
-       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
+                 goto do_fault;
--      .writefn = hcr_writelow, .readfn = hcr_read },
+             }
-+      .writefn = hcr_writelow },
+             result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
-     { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
++            user_prot = simple_ap_to_rw_prot_is_user(ap >> 1, 1);
-       .type = ARM_CP_ALIAS,
+         } else {
-       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
+             result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
++            user_prot = ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot, 1);
+         }
- static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
+         if (result->f.prot && !xn) {
-     { .name = "HCR2", .state = ARM_CP_STATE_AA32,
+             result->f.prot |= PAGE_EXEC;
--      .type = ARM_CP_ALIAS | ARM_CP_IO,
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
-+      .type = ARM_CP_ALIAS,
+             fi->type = ARMFault_Permission;
-       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
+             goto do_fault;
-       .access = PL2_RW,
+         }
-       .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
++        if (regime_is_pan(env, mmu_idx) &&
 +            !regime_is_user(env, mmu_idx) &&
 +            user_prot &&
 +            access_type != MMU_INST_FETCH) {
 +            /* Privileged Access Never fault */
 +            fi->type = ARMFault_Permission;
 +            goto do_fault;
 +        }
      }
      if (ns) {
          /* The NS bit will (as required by the architecture) have no effect if
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
      if (regime_using_lpae_format(env, mmu_idx)) {
          return get_phys_addr_lpae(env, ptw, address, access_type, false,
                                    result, fi);
 -    } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
 +    } else if (arm_feature(env, ARM_FEATURE_V7) ||
 +               regime_sctlr(env, mmu_idx) & SCTLR_XP) {
          return get_phys_addr_v6(env, ptw, address, access_type, result, fi);
      } else {
          return get_phys_addr_v5(env, ptw, address, access_type, result, fi);
 --
-.19.1
+.25.1

-[Qemu-devel] [PULL 11/16] arm: fix aa64_generate_debug_exceptions to work with EL2
+[PULL 5/7] target/arm: Copy the entire vector in DO_ZIP
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-The test was incomplete and incorrectly caused debug exceptions to be
+With odd_ofs set, we weren't copying enough data.
 generated when returning to EL2 after a failed attempt to single-step
 an EL1 instruction. Fix this while cleaning up the function a little.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Fixes: 09eb6d7025d1 ("target/arm: Move sve zip high_ofs into simd_data")
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reported-by: Idan Horowitz <idan.horowitz@gmail.com>
-Message-id: 20181109152119.9242-8-alex.bennee@linaro.org
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20221031054144.3574-1-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h | 39 ++++++++++++++++++++++++---------------
+ target/arm/sve_helper.c | 4 ++--
-file changed, 24 insertions(+), 15 deletions(-)
+file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/sve_helper.c
-+++ b/target/arm/cpu.h
++++ b/target/arm/sve_helper.c
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *vn, void *vm, uint32_t desc)       \
-     return (cpu->clidr & R_V7M_CLIDR_CTYPE_ALL_MASK) != 0;
+     /* We produce output faster than we consume input.               \
- }
+        Therefore we must be mindful of possible overlap.  */         \
+     if (unlikely((vn - vd) < (uintptr_t)oprsz)) {                    \
-+/* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
+-        vn = memcpy(&tmp_n, vn, oprsz_2);                            \
- static inline bool aa64_generate_debug_exceptions(CPUARMState *env)
++        vn = memcpy(&tmp_n, vn, oprsz);                              \
- {
+     }                                                                \
--    if (arm_is_secure(env)) {
+     if (unlikely((vm - vd) < (uintptr_t)oprsz)) {                    \
--        /* MDCR_EL3.SDD disables debug events from Secure state */
+-        vm = memcpy(&tmp_m, vm, oprsz_2);                            \
--        if (extract32(env->cp15.mdcr_el3, 16, 1) != 0
++        vm = memcpy(&tmp_m, vm, oprsz);                              \
--            || arm_current_el(env) == 3) {
+     }                                                                \
--            return false;
+     for (i = 0; i < oprsz_2; i += sizeof(TYPE)) {                    \
--        }
+         *(TYPE *)(vd + H(2 * i + 0)) = *(TYPE *)(vn + odd_ofs + H(i)); \
 +    int cur_el = arm_current_el(env);
 +    int debug_el;
 +
 +    if (cur_el == 3) {
 +        return false;
      }
 -    if (arm_current_el(env) == arm_debug_target_el(env)) {
 -        if ((extract32(env->cp15.mdscr_el1, 13, 1) == 0)
 -            || (env->daif & PSTATE_D)) {
 -            return false;
 -        }
 +    /* MDCR_EL3.SDD disables debug events from Secure state */
 +    if (arm_is_secure_below_el3(env)
 +        && extract32(env->cp15.mdcr_el3, 16, 1)) {
 +        return false;
      }
 -    return true;
 +
 +    /*
 +     * Same EL to same EL debug exceptions need MDSCR_KDE enabled
 +     * while not masking the (D)ebug bit in DAIF.
 +     */
 +    debug_el = arm_debug_target_el(env);
 +
 +    if (cur_el == debug_el) {
 +        return extract32(env->cp15.mdscr_el1, 13, 1)
 +            && !(env->daif & PSTATE_D);
 +    }
 +
 +    /* Otherwise the debug target needs to be a higher EL */
 +    return debug_el > cur_el;
  }
  static inline bool aa32_generate_debug_exceptions(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static inline bool aa32_generate_debug_exceptions(CPUARMState *env)
   * since the pseudocode has it at all callsites except for the one in
   * CheckSoftwareStep(), where it is elided because both branches would
   * always return the same value.
 - *
 - * Parts of the pseudocode relating to EL2 and EL3 are omitted because we
 - * don't yet implement those exception levels or their associated trap bits.
   */
  static inline bool arm_generate_debug_exceptions(CPUARMState *env)
  {
 --
-.19.1
+.25.1

-[Qemu-devel] [PULL 01/16] target/arm: Remove workaround for small SAU regions
+[PULL 6/7] target/arm: Honor HCR_E2H and HCR_TGE in ats_write64()
-Before we supported direct execution from MMIO regions, we
+From: Ake Koomsin <ake@igel.co.jp>
 implemented workarounds in commit 720424359917887c926a33d2
 which let us avoid doing so, even if the SAU or MPU region
 was less than page-sized.
-Once we implemented execute-from-MMIO, we removed part
+We need to check HCR_E2H and HCR_TGE to select the right MMU index for
-of those workarounds in commit d4b6275df320cee76; but
+the correct translation regime.
 we forgot the one in get_phys_addr_pmsav8() which
 suppressed use of small SAU regions in executable regions.
 Remove that workaround now.
+To check for EL2&0 translation regime:
+- For S1E0*, S1E1* and S12E* ops, check both HCR_E2H and HCR_TGE
+- For S1E2* ops, check only HCR_E2H
+Signed-off-by: Ake Koomsin <ake@igel.co.jp>
+Message-id: 20221101064250.12444-1-ake@igel.co.jp
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181106163801.14474-1-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 12 ------------
+ target/arm/helper.c | 15 +++++++++------
-file changed, 12 deletions(-)
+file changed, 9 insertions(+), 6 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
+@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
+     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
-     ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr,
+     ARMMMUIdx mmu_idx;
-                             txattrs, prot, &mpu_is_subpage, fi, NULL);
+     int secure = arm_is_secure_below_el3(env);
--    /*
++    uint64_t hcr_el2 = arm_hcr_el2_eff(env);
--     * TODO: this is a temporary hack to ignore the fact that the SAU region
++    bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
--     * is smaller than a page if this is an executable region. We never
--     * supported small MPU regions, but we did (accidentally) allow small
+     switch (ri->opc2 & 6) {
--     * SAU regions, and if we now made small SAU regions not be executable
+     case 0:
--     * then this would break previously working guest code. We can't
+         switch (ri->opc1) {
--     * remove this until/unless we implement support for execution from
+         case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */
--     * small regions.
+             if (ri->crm == 9 && (env->pstate & PSTATE_PAN)) {
--     */
+-                mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
--    if (*prot & PAGE_EXEC) {
++                mmu_idx = regime_e20 ?
--        sattrs.subpage = false;
++                          ARMMMUIdx_E20_2_PAN : ARMMMUIdx_Stage1_E1_PAN;
--    }
+             } else {
-     *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE;
+-                mmu_idx = ARMMMUIdx_Stage1_E1;
-     return ret;
++                mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_Stage1_E1;
- }
+             }
              break;
          case 4: /* AT S1E2R, AT S1E2W */
 -            mmu_idx = ARMMMUIdx_E2;
 +            mmu_idx = hcr_el2 & HCR_E2H ? ARMMMUIdx_E20_2 : ARMMMUIdx_E2;
              break;
          case 6: /* AT S1E3R, AT S1E3W */
              mmu_idx = ARMMMUIdx_E3;
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
          }
          break;
      case 2: /* AT S1E0R, AT S1E0W */
 -        mmu_idx = ARMMMUIdx_Stage1_E0;
 +        mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_Stage1_E0;
          break;
      case 4: /* AT S12E1R, AT S12E1W */
 -        mmu_idx = ARMMMUIdx_E10_1;
 +        mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_E10_1;
          break;
      case 6: /* AT S12E0R, AT S12E0W */
 -        mmu_idx = ARMMMUIdx_E10_0;
 +        mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_E10_0;
          break;
      default:
          g_assert_not_reached();
 --
-.19.1
+.25.1

-[Qemu-devel] [PULL 03/16] MAINTAINERS: Add an entry for the 'collie' machine
+Deleted patch
-From: Thomas Huth <thuth@redhat.com>
-There is no active maintainer, but since Peter is picking up
-patches via qemu-arm@nongnu.org, I think we could at least use
-"Odd Fixes" as status here.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 1541528230-31817-1-git-send-email-thuth@redhat.com
-[PMM: Also add myself as an M: contact]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- MAINTAINERS | 7 +++++++
-file changed, 7 insertions(+)
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: hw/*/pxa2xx*
- F: hw/misc/mst_fpga.c
- F: include/hw/arm/pxa.h
-+Sharp SL-5500 (Collie) PDA
-+M: Peter Maydell <peter.maydell@linaro.org>
-+L: qemu-arm@nongnu.org
-+S: Odd Fixes
-+F: hw/arm/collie.c
-+F: hw/arm/strongarm*
-+
- Stellaris
- M: Peter Maydell <peter.maydell@linaro.org>
- L: qemu-arm@nongnu.org
---
-.19.1

-[Qemu-devel] [PULL 04/16] hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
+Deleted patch
-From: Eric Auger <eric.auger@redhat.com>
-Commit af7d64ede0b9 (hw/arm/sysbus-fdt: Allow device matching with DT
-compatible value) introduced a match_fn callback which gets called
-for each registered combo to check whether a sysbus device can be
-dynamically instantiated. However the callback gets called even if
-the device type does not match the binding combo typename field.
-This causes an assert when passing "-device ramfb" to the qemu
-command line as vfio_platform_match() gets called on a non
-vfio-platform device.
-To fix this regression, let's change the add_fdt_node() logic so
-that we first check the type and if the match_fn callback is defined,
-then we also call it.
-Binding combos only requesting a type check do not define the
-match_fn callback.
-Fixes: af7d64ede0b9 (hw/arm/sysbus-fdt: Allow device matching with
-DT compatible value)
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
-Reported-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
-Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
-Message-id: 20181106184212.29377-1-eric.auger@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/sysbus-fdt.c | 12 +++++++-----
-file changed, 7 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/sysbus-fdt.c b/hw/arm/sysbus-fdt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/sysbus-fdt.c
-+++ b/hw/arm/sysbus-fdt.c
-@@ -XXX,XX +XXX,XX @@ static bool type_match(SysBusDevice *sbdev, const BindingEntry *entry)
-     return !strcmp(object_get_typename(OBJECT(sbdev)), entry->typename);
- }
--#define TYPE_BINDING(type, add_fn) {(type), NULL, (add_fn), type_match}
-+#define TYPE_BINDING(type, add_fn) {(type), NULL, (add_fn), NULL}
- /* list of supported dynamic sysbus bindings */
- static const BindingEntry bindings[] = {
-@@ -XXX,XX +XXX,XX @@ static void add_fdt_node(SysBusDevice *sbdev, void *opaque)
-     for (i = 0; i < ARRAY_SIZE(bindings); i++) {
-         const BindingEntry *iter = &bindings[i];
--        if (iter->match_fn(sbdev, iter)) {
--            ret = iter->add_fn(sbdev, opaque);
--            assert(!ret);
--            return;
-+        if (type_match(sbdev, iter)) {
-+            if (!iter->match_fn || iter->match_fn(sbdev, iter)) {
-+                ret = iter->add_fn(sbdev, opaque);
-+                assert(!ret);
-+                return;
-+            }
-         }
-     }
-     error_report("Device %s can not be dynamically instantiated",
---
-.19.1

-[Qemu-devel] [PULL 05/16] target/arm: Fix typo in tlbi_aa64_vmalle1_write
+[PULL 7/7] target/arm: Two fixes for secure ptw
 From: Richard Henderson <richard.henderson@linaro.org>
-This would cause an infinite recursion or loop.
+Reversed the sense of non-secure in get_phys_addr_lpae,
 and failed to initialize attrs.secure for ARMMMUIdx_Phys_S.
+Fixes: 48da29e4 ("target/arm: Add ptw_idx to S1Translate")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1293
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Message-id: 20181110121711.15257-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 2 +-
+ target/arm/ptw.c | 15 ++++++++-------
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 8 insertions(+), 7 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/ptw.c
-+++ b/target/arm/helper.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vmalle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     CPUState *cs = ENV_GET_CPU(env);
+     descaddr |= (address >> (stride * (4 - level))) & indexmask;
+     descaddr &= ~7ULL;
-     if (tlb_force_broadcast(env)) {
+     nstable = extract32(tableattrs, 4, 1);
--        tlbi_aa64_vmalle1_write(env, NULL, value);
+-    if (!nstable) {
-+        tlbi_aa64_vmalle1is_write(env, NULL, value);
++    if (nstable) {
-         return;
+         /*
           * Stage2_S -> Stage2 or Phys_S -> Phys_NS
           * Assert that the non-secure idx are even, and relative order.
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
      bool is_secure = ptw->in_secure;
      ARMMMUIdx s1_mmu_idx;
 +    /*
 +     * The page table entries may downgrade secure to non-secure, but
 +     * cannot upgrade an non-secure translation regime's attributes
 +     * to secure.
 +     */
 +    result->f.attrs.secure = is_secure;
 +
      switch (mmu_idx) {
      case ARMMMUIdx_Phys_S:
      case ARMMMUIdx_Phys_NS:
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
          break;
      }
+-    /*
+-     * The page table entries may downgrade secure to non-secure, but
+-     * cannot upgrade an non-secure translation regime's attributes
+-     * to secure.
+-     */
+-    result->f.attrs.secure = is_secure;
+     result->f.attrs.user = regime_is_user(env, mmu_idx);
+     /*
 --
-.19.1
+.25.1

-[Qemu-devel] [PULL 06/16] target/arm64: properly handle DBGVR RESS bits
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-This only fails with some (broken) versions of gdb but we should
-treat the top bits of DBGBVR as RESS. Properly sign extend QEMU's
-reference copy of dbgbvr and also update the register descriptions in
-the comment.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181109152119.9242-2-alex.bennee@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/kvm64.c | 17 +++++++++++++++--
-file changed, 15 insertions(+), 2 deletions(-)
-diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm64.c
-+++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_init_debug(CPUState *cs)
-  * capable of fancier matching but that will require exposing that
-  * fanciness to GDB's interface
-  *
-- * D7.3.2 DBGBCR<n>_EL1, Debug Breakpoint Control Registers
-+ * DBGBCR<n>_EL1, Debug Breakpoint Control Registers
-  *
-  *  31  24 23  20 19   16 15 14  13  12   9 8   5 4    3 2   1  0
-  * +------+------+-------+-----+----+------+-----+------+-----+---+
-@@ -XXX,XX +XXX,XX @@ static void kvm_arm_init_debug(CPUState *cs)
-  * SSC/HMC/PMC: Security, Higher and Priv access control (Table D-12)
-  * BAS: Byte Address Select (RES1 for AArch64)
-  * E: Enable bit
-+ *
-+ * DBGBVR<n>_EL1, Debug Breakpoint Value Registers
-+ *
-+ *  63  53 52       49 48       2  1 0
-+ * +------+-----------+----------+-----+
-+ * | RESS | VA[52:49] | VA[48:2] | 0 0 |
-+ * +------+-----------+----------+-----+
-+ *
-+ * Depending on the addressing mode bits the top bits of the register
-+ * are a sign extension of the highest applicable VA bit. Some
-+ * versions of GDB don't do it correctly so we ensure they are correct
-+ * here so future PC comparisons will work properly.
-  */
-+
- static int insert_hw_breakpoint(target_ulong addr)
- {
-     HWBreakpoint brk = {
-         .bcr = 0x1,                             /* BCR E=1, enable */
--        .bvr = addr
-+        .bvr = sextract64(addr, 0, 53)
-     };
-     if (cur_hw_bps >= max_hw_bps) {
---
-.19.1

-[Qemu-devel] [PULL 07/16] target/arm64: hold BQL when calling do_interrupt()
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-Fix the assertion failure when running interrupts.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181109152119.9242-3-alex.bennee@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/kvm64.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm64.c
-+++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
-     cs->exception_index = EXCP_BKPT;
-     env->exception.syndrome = debug_exit->hsr;
-     env->exception.vaddress = debug_exit->far;
-+    qemu_mutex_lock_iothread();
-     cc->do_interrupt(cs);
-+    qemu_mutex_unlock_iothread();
-     return false;
- }
---
-.19.1

-[Qemu-devel] [PULL 08/16] target/arm64: kvm debug set target_el when passing exception to guest
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-When we are debugging the guest all exceptions come our way but might
-be for the guest's own debug exceptions. We use the ->do_interrupt()
-infrastructure to inject the exception into the guest. However, we are
-missing a full setup of the exception structure, causing an assert
-later down the line.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181109152119.9242-4-alex.bennee@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/kvm64.c | 1 +
-file changed, 1 insertion(+)
-diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm64.c
-+++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
-     cs->exception_index = EXCP_BKPT;
-     env->exception.syndrome = debug_exit->hsr;
-     env->exception.vaddress = debug_exit->far;
-+    env->exception.target_el = 1;
-     qemu_mutex_lock_iothread();
-     cc->do_interrupt(cs);
-     qemu_mutex_unlock_iothread();
---
-.19.1

-[Qemu-devel] [PULL 09/16] tests/guest-debug: fix scoping of failcount
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-You should declare you are using a global version of a variable before
-you attempt to modify it in a function.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181109152119.9242-5-alex.bennee@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/guest-debug/test-gdbstub.py | 1 +
-file changed, 1 insertion(+)
-diff --git a/tests/guest-debug/test-gdbstub.py b/tests/guest-debug/test-gdbstub.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/guest-debug/test-gdbstub.py
-+++ b/tests/guest-debug/test-gdbstub.py
-@@ -XXX,XX +XXX,XX @@ def report(cond, msg):
-         print ("PASS: %s" % (msg))
-     else:
-         print ("FAIL: %s" % (msg))
-+        global failcount
-         failcount += 1
---
-.19.1

-[Qemu-devel] [PULL 10/16] arm: use symbolic MDCR_TDE in arm_debug_target_el
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-We already have this symbol defined so lets use it.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20181109152119.9242-7-alex.bennee@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline int arm_debug_target_el(CPUARMState *env)
-     if (arm_feature(env, ARM_FEATURE_EL2) && !secure) {
-         route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
--                       env->cp15.mdcr_el2 & (1 << 8);
-+                       env->cp15.mdcr_el2 & MDCR_TDE;
-     }
-     if (route_to_el2) {
---
-.19.1

-[Qemu-devel] [PULL 13/16] target/arm: Track the state of our irq lines from the GIC explicitly
+Deleted patch
-Currently we track the state of the four irq lines from the GIC
-only via the cs->interrupt_request or KVM irq state. That means
-that we assume that an interrupt is asserted if and only if the
-external line is set. This assumption is incorrect for VIRQ
-and VFIQ, because the HCR_EL2.{VI,VF} bits allow assertion
-of VIRQ and VFIQ separately from the state of the external line.
-To handle this, start tracking the state of the external lines
-explicitly in a CPU state struct field, as is common practice
-for devices.
-The complicated part of this is dealing with inbound migration
-from an older QEMU which didn't have this state. We assume in
-that case that the older QEMU did not implement the HCR_EL2.{VI,VF}
-bits as generating interrupts, and so the line state matches
-the current state in cs->interrupt_request. (This is not quite
-true between commit 8a0fc3a29fc2315325400c7 and its revert, but
-that commit is broken and never made it into any released QEMU
-version.)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20181109134731.11605-3-peter.maydell@linaro.org
----
- target/arm/cpu.h     |  3 +++
- target/arm/cpu.c     | 16 ++++++++++++++
- target/arm/machine.c | 51 ++++++++++++++++++++++++++++++++++++++++++++
-files changed, 70 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-         uint64_t esr;
-     } serror;
-+    /* State of our input IRQ/FIQ/VIRQ/VFIQ lines */
-+    uint32_t irq_line_state;
-+
-     /* Thumb-2 EE state.  */
-     uint32_t teecr;
-     uint32_t teehbr;
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_irq(void *opaque, int irq, int level)
-         [ARM_CPU_VFIQ] = CPU_INTERRUPT_VFIQ
-     };
-+    if (level) {
-+        env->irq_line_state |= mask[irq];
-+    } else {
-+        env->irq_line_state &= ~mask[irq];
-+    }
-+
-     switch (irq) {
-     case ARM_CPU_VIRQ:
-     case ARM_CPU_VFIQ:
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_kvm_set_irq(void *opaque, int irq, int level)
-     ARMCPU *cpu = opaque;
-     CPUState *cs = CPU(cpu);
-     int kvm_irq = KVM_ARM_IRQ_TYPE_CPU << KVM_ARM_IRQ_TYPE_SHIFT;
-+    uint32_t linestate_bit;
-     switch (irq) {
-     case ARM_CPU_IRQ:
-         kvm_irq |= KVM_ARM_IRQ_CPU_IRQ;
-+        linestate_bit = CPU_INTERRUPT_HARD;
-         break;
-     case ARM_CPU_FIQ:
-         kvm_irq |= KVM_ARM_IRQ_CPU_FIQ;
-+        linestate_bit = CPU_INTERRUPT_FIQ;
-         break;
-     default:
-         g_assert_not_reached();
-     }
-+
-+    if (level) {
-+        env->irq_line_state |= linestate_bit;
-+    } else {
-+        env->irq_line_state &= ~linestate_bit;
-+    }
-+
-     kvm_irq |= cs->cpu_index << KVM_ARM_IRQ_VCPU_SHIFT;
-     kvm_set_irq(kvm_state, kvm_irq, level ? 1 : 0);
- #endif
-diff --git a/target/arm/machine.c b/target/arm/machine.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/machine.c
-+++ b/target/arm/machine.c
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_serror = {
-     }
- };
-+static bool irq_line_state_needed(void *opaque)
-+{
-+    return true;
-+}
-+
-+static const VMStateDescription vmstate_irq_line_state = {
-+    .name = "cpu/irq-line-state",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .needed = irq_line_state_needed,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_UINT32(env.irq_line_state, ARMCPU),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
- static bool m_needed(void *opaque)
- {
-     ARMCPU *cpu = opaque;
-@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
-     return 0;
- }
-+static int cpu_pre_load(void *opaque)
-+{
-+    ARMCPU *cpu = opaque;
-+    CPUARMState *env = &cpu->env;
-+
-+    /*
-+     * Pre-initialize irq_line_state to a value that's never valid as
-+     * real data, so cpu_post_load() can tell whether we've seen the
-+     * irq-line-state subsection in the incoming migration state.
-+     */
-+    env->irq_line_state = UINT32_MAX;
-+
-+    return 0;
-+}
-+
- static int cpu_post_load(void *opaque, int version_id)
- {
-     ARMCPU *cpu = opaque;
-+    CPUARMState *env = &cpu->env;
-     int i, v;
-+    /*
-+     * Handle migration compatibility from old QEMU which didn't
-+     * send the irq-line-state subsection. A QEMU without it did not
-+     * implement the HCR_EL2.{VI,VF} bits as generating interrupts,
-+     * so for TCG the line state matches the bits set in cs->interrupt_request.
-+     * For KVM the line state is not stored in cs->interrupt_request
-+     * and so this will leave irq_line_state as 0, but this is OK because
-+     * we only need to care about it for TCG.
-+     */
-+    if (env->irq_line_state == UINT32_MAX) {
-+        CPUState *cs = CPU(cpu);
-+
-+        env->irq_line_state = cs->interrupt_request &
-+            (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIQ |
-+             CPU_INTERRUPT_VIRQ | CPU_INTERRUPT_VFIQ);
-+    }
-+
-     /* Update the values list from the incoming migration data.
-      * Anything in the incoming data which we don't know about is
-      * a migration failure; anything we know about but the incoming
-@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_arm_cpu = {
-     .version_id = 22,
-     .minimum_version_id = 22,
-     .pre_save = cpu_pre_save,
-+    .pre_load = cpu_pre_load,
-     .post_load = cpu_post_load,
-     .fields = (VMStateField[]) {
-         VMSTATE_UINT32_ARRAY(env.regs, ARMCPU, 16),
-@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_arm_cpu = {
-         &vmstate_sve,
- #endif
-         &vmstate_serror,
-+        &vmstate_irq_line_state,
-         NULL
-     }
- };
---
-.19.1

-[Qemu-devel] [PULL 14/16] target/arm: Correctly implement handling of HCR_EL2.{VI, VF}
+Deleted patch
-In commit 8a0fc3a29fc2315325400 we tried to implement HCR_EL2.{VI,VF},
-but we got it wrong and had to revert it.
-In that commit we implemented them as simply tracking whether there
-is a pending virtual IRQ or virtual FIQ. This is not correct -- these
-bits cause a software-generated VIRQ/VFIQ, which is distinct from
-whether there is a hardware-generated VIRQ/VFIQ caused by the
-external interrupt controller. So we need to track separately
-the HCR_EL2 bit state and the external virq/vfiq line state, and
-OR the two together to get the actual pending VIRQ/VFIQ state.
-Fixes: 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20181109134731.11605-4-peter.maydell@linaro.org
----
- target/arm/internals.h | 18 ++++++++++++++++
- target/arm/cpu.c       | 48 +++++++++++++++++++++++++++++++++++++++++-
- target/arm/helper.c    | 20 ++++++++++++++++--
-files changed, 83 insertions(+), 3 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static inline const char *aarch32_mode_name(uint32_t psr)
-     return cpu_mode_names[psr & 0xf];
- }
-+/**
-+ * arm_cpu_update_virq: Update CPU_INTERRUPT_VIRQ bit in cs->interrupt_request
-+ *
-+ * Update the CPU_INTERRUPT_VIRQ bit in cs->interrupt_request, following
-+ * a change to either the input VIRQ line from the GIC or the HCR_EL2.VI bit.
-+ * Must be called with the iothread lock held.
-+ */
-+void arm_cpu_update_virq(ARMCPU *cpu);
-+
-+/**
-+ * arm_cpu_update_vfiq: Update CPU_INTERRUPT_VFIQ bit in cs->interrupt_request
-+ *
-+ * Update the CPU_INTERRUPT_VFIQ bit in cs->interrupt_request, following
-+ * a change to either the input VFIQ line from the GIC or the HCR_EL2.VF bit.
-+ * Must be called with the iothread lock held.
-+ */
-+void arm_cpu_update_vfiq(ARMCPU *cpu);
-+
- #endif
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
- }
- #endif
-+void arm_cpu_update_virq(ARMCPU *cpu)
-+{
-+    /*
-+     * Update the interrupt level for VIRQ, which is the logical OR of
-+     * the HCR_EL2.VI bit and the input line level from the GIC.
-+     */
-+    CPUARMState *env = &cpu->env;
-+    CPUState *cs = CPU(cpu);
-+
-+    bool new_state = (env->cp15.hcr_el2 & HCR_VI) ||
-+        (env->irq_line_state & CPU_INTERRUPT_VIRQ);
-+
-+    if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VIRQ) != 0)) {
-+        if (new_state) {
-+            cpu_interrupt(cs, CPU_INTERRUPT_VIRQ);
-+        } else {
-+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VIRQ);
-+        }
-+    }
-+}
-+
-+void arm_cpu_update_vfiq(ARMCPU *cpu)
-+{
-+    /*
-+     * Update the interrupt level for VFIQ, which is the logical OR of
-+     * the HCR_EL2.VF bit and the input line level from the GIC.
-+     */
-+    CPUARMState *env = &cpu->env;
-+    CPUState *cs = CPU(cpu);
-+
-+    bool new_state = (env->cp15.hcr_el2 & HCR_VF) ||
-+        (env->irq_line_state & CPU_INTERRUPT_VFIQ);
-+
-+    if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VFIQ) != 0)) {
-+        if (new_state) {
-+            cpu_interrupt(cs, CPU_INTERRUPT_VFIQ);
-+        } else {
-+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VFIQ);
-+        }
-+    }
-+}
-+
- #ifndef CONFIG_USER_ONLY
- static void arm_cpu_set_irq(void *opaque, int irq, int level)
- {
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_irq(void *opaque, int irq, int level)
-     switch (irq) {
-     case ARM_CPU_VIRQ:
-+        assert(arm_feature(env, ARM_FEATURE_EL2));
-+        arm_cpu_update_virq(cpu);
-+        break;
-     case ARM_CPU_VFIQ:
-         assert(arm_feature(env, ARM_FEATURE_EL2));
--        /* fall through */
-+        arm_cpu_update_vfiq(cpu);
-+        break;
-     case ARM_CPU_IRQ:
-     case ARM_CPU_FIQ:
-         if (level) {
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-         tlb_flush(CPU(cpu));
-     }
-     env->cp15.hcr_el2 = value;
-+
-+    /*
-+     * Updates to VI and VF require us to update the status of
-+     * virtual interrupts, which are the logical OR of these bits
-+     * and the state of the input lines from the GIC. (This requires
-+     * that we have the iothread lock, which is done by marking the
-+     * reginfo structs as ARM_CP_IO.)
-+     * Note that if a write to HCR pends a VIRQ or VFIQ it is never
-+     * possible for it to be taken immediately, because VIRQ and
-+     * VFIQ are masked unless running at EL0 or EL1, and HCR
-+     * can only be written at EL2.
-+     */
-+    g_assert(qemu_mutex_iothread_locked());
-+    arm_cpu_update_virq(cpu);
-+    arm_cpu_update_vfiq(cpu);
- }
- static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
- static const ARMCPRegInfo el2_cp_reginfo[] = {
-     { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
-+      .type = ARM_CP_IO,
-       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
-       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
-       .writefn = hcr_write },
-     { .name = "HCR", .state = ARM_CP_STATE_AA32,
--      .type = ARM_CP_ALIAS,
-+      .type = ARM_CP_ALIAS | ARM_CP_IO,
-       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
-       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
-       .writefn = hcr_writelow },
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
- static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
-     { .name = "HCR2", .state = ARM_CP_STATE_AA32,
--      .type = ARM_CP_ALIAS,
-+      .type = ARM_CP_ALIAS | ARM_CP_IO,
-       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
-       .access = PL2_RW,
-       .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
---
-.19.1

target-arm queue for 3.1: mostly bug fixes, but the "turn on
EL2 support for Cortex-A7 and -A15" is technically enabling
of a new feature... I think this is OK since we're only at rc1,
and it's easy to revert that feature bit flip if necessary.

thanks
-- PMM

The following changes since commit 5704c36d25ee84e7129722cb0db53df9faefe943:

Merge remote-tracking branch 'remotes/kraxel/tags/fixes-31-20181112-pull-request' into staging (2018-11-12 15:55:40 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181112

for you to fetch changes up to 1a4c1a6dbf60aebddd07753f1013ea896c06ad29:

target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature (2018-11-12 16:52:29 +0000)

----------------------------------------------------------------
target/arm queue:
 * Remove no-longer-needed workaround for small SAU regions for v8M
 * Remove antique TODO comment
 * MAINTAINERS: Add an entry for the 'collie' machine
 * hw/arm/sysbus-fdt: Only call match_fn callback if the type matches
 * Fix infinite recursion in tlbi_aa64_vmalle1_write()
 * ARM KVM: fix various bugs in handling of guest debugging
 * Correctly implement handling of HCR_EL2.{VI, VF}
 * Hyp mode R14 is shared with User and System
 * Give Cortex-A15 and -A7 the EL2 feature

----------------------------------------------------------------
Alex Bennée (6):
      target/arm64: properly handle DBGVR RESS bits
      target/arm64: hold BQL when calling do_interrupt()
      target/arm64: kvm debug set target_el when passing exception to guest
      tests/guest-debug: fix scoping of failcount
      arm: use symbolic MDCR_TDE in arm_debug_target_el
      arm: fix aa64_generate_debug_exceptions to work with EL2

Eric Auger (1):
      hw/arm/sysbus-fdt: Only call match_fn callback if the type matches

Peter Maydell (7):
      target/arm: Remove workaround for small SAU regions
      target/arm: Remove antique TODO comment
      Revert "target/arm: Implement HCR.VI and VF"
      target/arm: Track the state of our irq lines from the GIC explicitly
      target/arm: Correctly implement handling of HCR_EL2.{VI, VF}
      target/arm: Hyp mode R14 is shared with User and System
      target/arm/cpu: Give Cortex-A15 and -A7 the EL2 feature

Richard Henderson (1):
      target/arm: Fix typo in tlbi_aa64_vmalle1_write

Thomas Huth (1):
      MAINTAINERS: Add an entry for the 'collie' machine

Before we supported direct execution from MMIO regions, we
implemented workarounds in commit 720424359917887c926a33d2
which let us avoid doing so, even if the SAU or MPU region
was less than page-sized.

Once we implemented execute-from-MMIO, we removed part
of those workarounds in commit d4b6275df320cee76; but
we forgot the one in get_phys_addr_pmsav8() which
suppressed use of small SAU regions in executable regions.
Remove that workaround now.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181106163801.14474-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 12 ------------
 1 file changed, 12 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_pmsav8(CPUARMState *env, uint32_t address,
 
     ret = pmsav8_mpu_lookup(env, address, access_type, mmu_idx, phys_ptr,
                             txattrs, prot, &mpu_is_subpage, fi, NULL);
-    /*
-     * TODO: this is a temporary hack to ignore the fact that the SAU region
-     * is smaller than a page if this is an executable region. We never
-     * supported small MPU regions, but we did (accidentally) allow small
-     * SAU regions, and if we now made small SAU regions not be executable
-     * then this would break previously working guest code. We can't
-     * remove this until/unless we implement support for execution from
-     * small regions.
-     */
-    if (*prot & PAGE_EXEC) {
-        sattrs.subpage = false;
-    }
     *page_size = sattrs.subpage || mpu_is_subpage ? 1 : TARGET_PAGE_SIZE;
     return ret;
 }
-- 
2.19.1

From: Eric Auger <eric.auger@redhat.com>

Commit af7d64ede0b9 (hw/arm/sysbus-fdt: Allow device matching with DT
compatible value) introduced a match_fn callback which gets called
for each registered combo to check whether a sysbus device can be
dynamically instantiated. However the callback gets called even if
the device type does not match the binding combo typename field.
This causes an assert when passing "-device ramfb" to the qemu
command line as vfio_platform_match() gets called on a non
vfio-platform device.

To fix this regression, let's change the add_fdt_node() logic so
that we first check the type and if the match_fn callback is defined,
then we also call it.

Binding combos only requesting a type check do not define the
match_fn callback.

Fixes: af7d64ede0b9 (hw/arm/sysbus-fdt: Allow device matching with
DT compatible value)

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Alex Williamson <alex.williamson@redhat.com>
Tested-by: Geert Uytterhoeven <geert+renesas@glider.be>
Message-id: 20181106184212.29377-1-eric.auger@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sysbus-fdt.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/hw/arm/sysbus-fdt.c b/hw/arm/sysbus-fdt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sysbus-fdt.c
+++ b/hw/arm/sysbus-fdt.c
@@ -XXX,XX +XXX,XX @@ static bool type_match(SysBusDevice *sbdev, const BindingEntry *entry)
     return !strcmp(object_get_typename(OBJECT(sbdev)), entry->typename);
 }
 
-#define TYPE_BINDING(type, add_fn) {(type), NULL, (add_fn), type_match}
+#define TYPE_BINDING(type, add_fn) {(type), NULL, (add_fn), NULL}
 
 /* list of supported dynamic sysbus bindings */
 static const BindingEntry bindings[] = {
@@ -XXX,XX +XXX,XX @@ static void add_fdt_node(SysBusDevice *sbdev, void *opaque)
     for (i = 0; i < ARRAY_SIZE(bindings); i++) {
         const BindingEntry *iter = &bindings[i];
 
-        if (iter->match_fn(sbdev, iter)) {
-            ret = iter->add_fn(sbdev, opaque);
-            assert(!ret);
-            return;
+        if (type_match(sbdev, iter)) {
+            if (!iter->match_fn || iter->match_fn(sbdev, iter)) {
+                ret = iter->add_fn(sbdev, opaque);
+                assert(!ret);
+                return;
+            }
         }
     }
     error_report("Device %s can not be dynamically instantiated",
-- 
2.19.1

From: Alex Bennée <alex.bennee@linaro.org>

This only fails with some (broken) versions of gdb but we should
treat the top bits of DBGBVR as RESS. Properly sign extend QEMU's
reference copy of dbgbvr and also update the register descriptions in
the comment.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181109152119.9242-2-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_init_debug(CPUState *cs)
  * capable of fancier matching but that will require exposing that
  * fanciness to GDB's interface
  *
- * D7.3.2 DBGBCR<n>_EL1, Debug Breakpoint Control Registers
+ * DBGBCR<n>_EL1, Debug Breakpoint Control Registers
  *
  *  31  24 23  20 19   16 15 14  13  12   9 8   5 4    3 2   1  0
  * +------+------+-------+-----+----+------+-----+------+-----+---+
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_init_debug(CPUState *cs)
  * SSC/HMC/PMC: Security, Higher and Priv access control (Table D-12)
  * BAS: Byte Address Select (RES1 for AArch64)
  * E: Enable bit
+ *
+ * DBGBVR<n>_EL1, Debug Breakpoint Value Registers
+ *
+ *  63  53 52       49 48       2  1 0
+ * +------+-----------+----------+-----+
+ * | RESS | VA[52:49] | VA[48:2] | 0 0 |
+ * +------+-----------+----------+-----+
+ *
+ * Depending on the addressing mode bits the top bits of the register
+ * are a sign extension of the highest applicable VA bit. Some
+ * versions of GDB don't do it correctly so we ensure they are correct
+ * here so future PC comparisons will work properly.
  */
+
 static int insert_hw_breakpoint(target_ulong addr)
 {
     HWBreakpoint brk = {
         .bcr = 0x1,                             /* BCR E=1, enable */
-        .bvr = addr
+        .bvr = sextract64(addr, 0, 53)
     };
 
     if (cur_hw_bps >= max_hw_bps) {
-- 
2.19.1

From: Alex Bennée <alex.bennee@linaro.org>

When we are debugging the guest all exceptions come our way but might
be for the guest's own debug exceptions. We use the ->do_interrupt()
infrastructure to inject the exception into the guest. However, we are
missing a full setup of the exception structure, causing an assert
later down the line.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181109152119.9242-4-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_handle_debug(CPUState *cs, struct kvm_debug_exit_arch *debug_exit)
     cs->exception_index = EXCP_BKPT;
     env->exception.syndrome = debug_exit->hsr;
     env->exception.vaddress = debug_exit->far;
+    env->exception.target_el = 1;
     qemu_mutex_lock_iothread();
     cc->do_interrupt(cs);
     qemu_mutex_unlock_iothread();
-- 
2.19.1

From: Alex Bennée <alex.bennee@linaro.org>

The test was incomplete and incorrectly caused debug exceptions to be
generated when returning to EL2 after a failed attempt to single-step
an EL1 instruction. Fix this while cleaning up the function a little.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20181109152119.9242-8-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 39 ++++++++++++++++++++++++---------------
 1 file changed, 24 insertions(+), 15 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_v7m_csselr_razwi(ARMCPU *cpu)
     return (cpu->clidr & R_V7M_CLIDR_CTYPE_ALL_MASK) != 0;
 }
 
+/* See AArch64.GenerateDebugExceptionsFrom() in ARM ARM pseudocode */
 static inline bool aa64_generate_debug_exceptions(CPUARMState *env)
 {
-    if (arm_is_secure(env)) {
-        /* MDCR_EL3.SDD disables debug events from Secure state */
-        if (extract32(env->cp15.mdcr_el3, 16, 1) != 0
-            || arm_current_el(env) == 3) {
-            return false;
-        }
+    int cur_el = arm_current_el(env);
+    int debug_el;
+
+    if (cur_el == 3) {
+        return false;
     }
 
-    if (arm_current_el(env) == arm_debug_target_el(env)) {
-        if ((extract32(env->cp15.mdscr_el1, 13, 1) == 0)
-            || (env->daif & PSTATE_D)) {
-            return false;
-        }
+    /* MDCR_EL3.SDD disables debug events from Secure state */
+    if (arm_is_secure_below_el3(env)
+        && extract32(env->cp15.mdcr_el3, 16, 1)) {
+        return false;
     }
-    return true;
+
+    /*
+     * Same EL to same EL debug exceptions need MDSCR_KDE enabled
+     * while not masking the (D)ebug bit in DAIF.
+     */
+    debug_el = arm_debug_target_el(env);
+
+    if (cur_el == debug_el) {
+        return extract32(env->cp15.mdscr_el1, 13, 1)
+            && !(env->daif & PSTATE_D);
+    }
+
+    /* Otherwise the debug target needs to be a higher EL */
+    return debug_el > cur_el;
 }
 
 static inline bool aa32_generate_debug_exceptions(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static inline bool aa32_generate_debug_exceptions(CPUARMState *env)
  * since the pseudocode has it at all callsites except for the one in
  * CheckSoftwareStep(), where it is elided because both branches would
  * always return the same value.
- *
- * Parts of the pseudocode relating to EL2 and EL3 are omitted because we
- * don't yet implement those exception levels or their associated trap bits.
  */
 static inline bool arm_generate_debug_exceptions(CPUARMState *env)
 {
-- 
2.19.1

This reverts commit 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f.

The implementation of HCR.VI and VF in that commit is not
correct -- they do not track the overall "is there a pending
VIRQ or VFIQ" status, but whether there is a pending interrupt
due to "this mechanism", ie the hypervisor having set the VI/VF
bits. The overall pending state for VIRQ and VFIQ is effectively
the logical OR of the inbound lines from the GIC with the
VI and VF bits. Commit 8a0fc3a29fc231 would result in pending
VIRQ/VFIQ possibly being lost when the hypervisor wrote to HCR.

As a preliminary to implementing the HCR.VI/VF feature properly,
revert the broken one entirely.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20181109134731.11605-2-peter.maydell@linaro.org
---
 target/arm/helper.c | 47 ++++-----------------------------------------
 1 file changed, 4 insertions(+), 43 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {
 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 {
     ARMCPU *cpu = arm_env_get_cpu(env);
-    CPUState *cs = ENV_GET_CPU(env);
     uint64_t valid_mask = HCR_MASK;
 
     if (arm_feature(env, ARM_FEATURE_EL3)) {
@@ -XXX,XX +XXX,XX @@ static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
     /* Clear RES0 bits.  */
     value &= valid_mask;
 
-    /*
-     * VI and VF are kept in cs->interrupt_request. Modifying that
-     * requires that we have the iothread lock, which is done by
-     * marking the reginfo structs as ARM_CP_IO.
-     * Note that if a write to HCR pends a VIRQ or VFIQ it is never
-     * possible for it to be taken immediately, because VIRQ and
-     * VFIQ are masked unless running at EL0 or EL1, and HCR
-     * can only be written at EL2.
-     */
-    g_assert(qemu_mutex_iothread_locked());
-    if (value & HCR_VI) {
-        cs->interrupt_request |= CPU_INTERRUPT_VIRQ;
-    } else {
-        cs->interrupt_request &= ~CPU_INTERRUPT_VIRQ;
-    }
-    if (value & HCR_VF) {
-        cs->interrupt_request |= CPU_INTERRUPT_VFIQ;
-    } else {
-        cs->interrupt_request &= ~CPU_INTERRUPT_VFIQ;
-    }
-    value &= ~(HCR_VI | HCR_VF);
-
     /* These bits change the MMU setup:
      * HCR_VM enables stage 2 translation
      * HCR_PTW forbids certain page-table setups
@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
     hcr_write(env, NULL, value);
 }
 
-static uint64_t hcr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    /* The VI and VF bits live in cs->interrupt_request */
-    uint64_t ret = env->cp15.hcr_el2 & ~(HCR_VI | HCR_VF);
-    CPUState *cs = ENV_GET_CPU(env);
-
-    if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
-        ret |= HCR_VI;
-    }
-    if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
-        ret |= HCR_VF;
-    }
-    return ret;
-}
-
 static const ARMCPRegInfo el2_cp_reginfo[] = {
     { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
-      .type = ARM_CP_IO,
       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
-      .writefn = hcr_write, .readfn = hcr_read },
+      .writefn = hcr_write },
     { .name = "HCR", .state = ARM_CP_STATE_AA32,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .type = ARM_CP_ALIAS,
       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
-      .writefn = hcr_writelow, .readfn = hcr_read },
+      .writefn = hcr_writelow },
     { .name = "ELR_EL2", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS,
       .opc0 = 3, .opc1 = 4, .crn = 4, .crm = 0, .opc2 = 1,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
 
 static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
     { .name = "HCR2", .state = ARM_CP_STATE_AA32,
-      .type = ARM_CP_ALIAS | ARM_CP_IO,
+      .type = ARM_CP_ALIAS,
       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
       .access = PL2_RW,
       .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
-- 
2.19.1

Currently we track the state of the four irq lines from the GIC
only via the cs->interrupt_request or KVM irq state. That means
that we assume that an interrupt is asserted if and only if the
external line is set. This assumption is incorrect for VIRQ
and VFIQ, because the HCR_EL2.{VI,VF} bits allow assertion
of VIRQ and VFIQ separately from the state of the external line.

To handle this, start tracking the state of the external lines
explicitly in a CPU state struct field, as is common practice
for devices.

The complicated part of this is dealing with inbound migration
from an older QEMU which didn't have this state. We assume in
that case that the older QEMU did not implement the HCR_EL2.{VI,VF}
bits as generating interrupts, and so the line state matches
the current state in cs->interrupt_request. (This is not quite
true between commit 8a0fc3a29fc2315325400c7 and its revert, but
that commit is broken and never made it into any released QEMU
version.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20181109134731.11605-3-peter.maydell@linaro.org
---
 target/arm/cpu.h     |  3 +++
 target/arm/cpu.c     | 16 ++++++++++++++
 target/arm/machine.c | 51 ++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 70 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
         uint64_t esr;
     } serror;
 
+    /* State of our input IRQ/FIQ/VIRQ/VFIQ lines */
+    uint32_t irq_line_state;
+
     /* Thumb-2 EE state.  */
     uint32_t teecr;
     uint32_t teehbr;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_irq(void *opaque, int irq, int level)
         [ARM_CPU_VFIQ] = CPU_INTERRUPT_VFIQ
     };
 
+    if (level) {
+        env->irq_line_state |= mask[irq];
+    } else {
+        env->irq_line_state &= ~mask[irq];
+    }
+
     switch (irq) {
     case ARM_CPU_VIRQ:
     case ARM_CPU_VFIQ:
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_kvm_set_irq(void *opaque, int irq, int level)
     ARMCPU *cpu = opaque;
     CPUState *cs = CPU(cpu);
     int kvm_irq = KVM_ARM_IRQ_TYPE_CPU << KVM_ARM_IRQ_TYPE_SHIFT;
+    uint32_t linestate_bit;
 
     switch (irq) {
     case ARM_CPU_IRQ:
         kvm_irq |= KVM_ARM_IRQ_CPU_IRQ;
+        linestate_bit = CPU_INTERRUPT_HARD;
         break;
     case ARM_CPU_FIQ:
         kvm_irq |= KVM_ARM_IRQ_CPU_FIQ;
+        linestate_bit = CPU_INTERRUPT_FIQ;
         break;
     default:
         g_assert_not_reached();
     }
+
+    if (level) {
+        env->irq_line_state |= linestate_bit;
+    } else {
+        env->irq_line_state &= ~linestate_bit;
+    }
+
     kvm_irq |= cs->cpu_index << KVM_ARM_IRQ_VCPU_SHIFT;
     kvm_set_irq(kvm_state, kvm_irq, level ? 1 : 0);
 #endif
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_serror = {
     }
 };
 
+static bool irq_line_state_needed(void *opaque)
+{
+    return true;
+}
+
+static const VMStateDescription vmstate_irq_line_state = {
+    .name = "cpu/irq-line-state",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = irq_line_state_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(env.irq_line_state, ARMCPU),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static bool m_needed(void *opaque)
 {
     ARMCPU *cpu = opaque;
@@ -XXX,XX +XXX,XX @@ static int cpu_pre_save(void *opaque)
     return 0;
 }
 
+static int cpu_pre_load(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
+
+    /*
+     * Pre-initialize irq_line_state to a value that's never valid as
+     * real data, so cpu_post_load() can tell whether we've seen the
+     * irq-line-state subsection in the incoming migration state.
+     */
+    env->irq_line_state = UINT32_MAX;
+
+    return 0;
+}
+
 static int cpu_post_load(void *opaque, int version_id)
 {
     ARMCPU *cpu = opaque;
+    CPUARMState *env = &cpu->env;
     int i, v;
 
+    /*
+     * Handle migration compatibility from old QEMU which didn't
+     * send the irq-line-state subsection. A QEMU without it did not
+     * implement the HCR_EL2.{VI,VF} bits as generating interrupts,
+     * so for TCG the line state matches the bits set in cs->interrupt_request.
+     * For KVM the line state is not stored in cs->interrupt_request
+     * and so this will leave irq_line_state as 0, but this is OK because
+     * we only need to care about it for TCG.
+     */
+    if (env->irq_line_state == UINT32_MAX) {
+        CPUState *cs = CPU(cpu);
+
+        env->irq_line_state = cs->interrupt_request &
+            (CPU_INTERRUPT_HARD | CPU_INTERRUPT_FIQ |
+             CPU_INTERRUPT_VIRQ | CPU_INTERRUPT_VFIQ);
+    }
+
     /* Update the values list from the incoming migration data.
      * Anything in the incoming data which we don't know about is
      * a migration failure; anything we know about but the incoming
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_arm_cpu = {
     .version_id = 22,
     .minimum_version_id = 22,
     .pre_save = cpu_pre_save,
+    .pre_load = cpu_pre_load,
     .post_load = cpu_post_load,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(env.regs, ARMCPU, 16),
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_arm_cpu = {
         &vmstate_sve,
 #endif
         &vmstate_serror,
+        &vmstate_irq_line_state,
         NULL
     }
 };
-- 
2.19.1

In commit 8a0fc3a29fc2315325400 we tried to implement HCR_EL2.{VI,VF},
but we got it wrong and had to revert it.

In that commit we implemented them as simply tracking whether there
is a pending virtual IRQ or virtual FIQ. This is not correct -- these
bits cause a software-generated VIRQ/VFIQ, which is distinct from
whether there is a hardware-generated VIRQ/VFIQ caused by the
external interrupt controller. So we need to track separately
the HCR_EL2 bit state and the external virq/vfiq line state, and
OR the two together to get the actual pending VIRQ/VFIQ state.

Fixes: 8a0fc3a29fc2315325400c738f807d0d4ae0ab7f
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20181109134731.11605-4-peter.maydell@linaro.org
---
 target/arm/internals.h | 18 ++++++++++++++++
 target/arm/cpu.c       | 48 +++++++++++++++++++++++++++++++++++++++++-
 target/arm/helper.c    | 20 ++++++++++++++++--
 3 files changed, 83 insertions(+), 3 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline const char *aarch32_mode_name(uint32_t psr)
     return cpu_mode_names[psr & 0xf];
 }
 
+/**
+ * arm_cpu_update_virq: Update CPU_INTERRUPT_VIRQ bit in cs->interrupt_request
+ *
+ * Update the CPU_INTERRUPT_VIRQ bit in cs->interrupt_request, following
+ * a change to either the input VIRQ line from the GIC or the HCR_EL2.VI bit.
+ * Must be called with the iothread lock held.
+ */
+void arm_cpu_update_virq(ARMCPU *cpu);
+
+/**
+ * arm_cpu_update_vfiq: Update CPU_INTERRUPT_VFIQ bit in cs->interrupt_request
+ *
+ * Update the CPU_INTERRUPT_VFIQ bit in cs->interrupt_request, following
+ * a change to either the input VFIQ line from the GIC or the HCR_EL2.VF bit.
+ * Must be called with the iothread lock held.
+ */
+void arm_cpu_update_vfiq(ARMCPU *cpu);
+
 #endif
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool arm_v7m_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
 }
 #endif
 
+void arm_cpu_update_virq(ARMCPU *cpu)
+{
+    /*
+     * Update the interrupt level for VIRQ, which is the logical OR of
+     * the HCR_EL2.VI bit and the input line level from the GIC.
+     */
+    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+
+    bool new_state = (env->cp15.hcr_el2 & HCR_VI) ||
+        (env->irq_line_state & CPU_INTERRUPT_VIRQ);
+
+    if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VIRQ) != 0)) {
+        if (new_state) {
+            cpu_interrupt(cs, CPU_INTERRUPT_VIRQ);
+        } else {
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VIRQ);
+        }
+    }
+}
+
+void arm_cpu_update_vfiq(ARMCPU *cpu)
+{
+    /*
+     * Update the interrupt level for VFIQ, which is the logical OR of
+     * the HCR_EL2.VF bit and the input line level from the GIC.
+     */
+    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+
+    bool new_state = (env->cp15.hcr_el2 & HCR_VF) ||
+        (env->irq_line_state & CPU_INTERRUPT_VFIQ);
+
+    if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VFIQ) != 0)) {
+        if (new_state) {
+            cpu_interrupt(cs, CPU_INTERRUPT_VFIQ);
+        } else {
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VFIQ);
+        }
+    }
+}
+
 #ifndef CONFIG_USER_ONLY
 static void arm_cpu_set_irq(void *opaque, int irq, int level)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_set_irq(void *opaque, int irq, int level)
 
     switch (irq) {
     case ARM_CPU_VIRQ:
+        assert(arm_feature(env, ARM_FEATURE_EL2));
+        arm_cpu_update_virq(cpu);
+        break;
     case ARM_CPU_VFIQ:
         assert(arm_feature(env, ARM_FEATURE_EL2));
-        /* fall through */
+        arm_cpu_update_vfiq(cpu);
+        break;
     case ARM_CPU_IRQ:
     case ARM_CPU_FIQ:
         if (level) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         tlb_flush(CPU(cpu));
     }
     env->cp15.hcr_el2 = value;
+
+    /*
+     * Updates to VI and VF require us to update the status of
+     * virtual interrupts, which are the logical OR of these bits
+     * and the state of the input lines from the GIC. (This requires
+     * that we have the iothread lock, which is done by marking the
+     * reginfo structs as ARM_CP_IO.)
+     * Note that if a write to HCR pends a VIRQ or VFIQ it is never
+     * possible for it to be taken immediately, because VIRQ and
+     * VFIQ are masked unless running at EL0 or EL1, and HCR
+     * can only be written at EL2.
+     */
+    g_assert(qemu_mutex_iothread_locked());
+    arm_cpu_update_virq(cpu);
+    arm_cpu_update_vfiq(cpu);
 }
 
 static void hcr_writehigh(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
 
 static const ARMCPRegInfo el2_cp_reginfo[] = {
     { .name = "HCR_EL2", .state = ARM_CP_STATE_AA64,
+      .type = ARM_CP_IO,
       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
       .writefn = hcr_write },
     { .name = "HCR", .state = ARM_CP_STATE_AA32,
-      .type = ARM_CP_ALIAS,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
       .writefn = hcr_writelow },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
 
 static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
     { .name = "HCR2", .state = ARM_CP_STATE_AA32,
-      .type = ARM_CP_ALIAS,
+      .type = ARM_CP_ALIAS | ARM_CP_IO,
       .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
       .access = PL2_RW,
       .fieldoffset = offsetofhigh32(CPUARMState, cp15.hcr_el2),
-- 
2.19.1

Hyp mode is an exception to the general rule that each AArch32
mode has its own r13, r14 and SPSR -- it has a banked r13 and
SPSR but shares its r14 with User and System mode. We were
incorrectly implementing it as banked, which meant that on
entry to Hyp mode r14 was 0 rather than the USR/SYS r14.

We provide a new function r14_bank_number() which is like
the existing bank_number() but provides the index into
env->banked_r14[]; bank_number() provides the index to use
for env->banked_r13[] and env->banked_cpsr[].

All the points in the code that were using bank_number()
to index into env->banked_r14[] are updated for consintency:
 * switch_mode() -- this is the only place where we fix
   an actual bug
 * aarch64_sync_32_to_64() and aarch64_sync_64_to_32():
   no behavioural change as we already special-cased Hyp R14
 * kvm32.c: no behavioural change since the guest can't ever
   be in Hyp mode, but conceptually the right thing to do
 * msr_banked()/mrs_banked(): we can never get to the case
   that accesses banked_r14[] with tgtmode == ARM_CPU_MODE_HYP,
   so no behavioural change

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20181109173553.22341-2-peter.maydell@linaro.org
---
 target/arm/internals.h | 16 ++++++++++++++++
 target/arm/helper.c    | 29 +++++++++++++++--------------
 target/arm/kvm32.c     |  4 ++--
 target/arm/op_helper.c |  4 ++--
 4 files changed, 35 insertions(+), 18 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline int bank_number(int mode)
     g_assert_not_reached();
 }
 
+/**
+ * r14_bank_number: Map CPU mode onto register bank for r14
+ *
+ * Given an AArch32 CPU mode, return the index into the saved register
+ * banks to use for the R14 (LR) in that mode. This is the same as
+ * bank_number(), except for the special case of Hyp mode, where
+ * R14 is shared with USR and SYS, unlike its R13 and SPSR.
+ * This should be used as the index into env->banked_r14[], and
+ * bank_number() used for the index into env->banked_r13[] and
+ * env->banked_spsr[].
+ */
+static inline int r14_bank_number(int mode)
+{
+    return (mode == ARM_CPU_MODE_HYP) ? BANK_USRSYS : bank_number(mode);
+}
+
 void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu);
 void arm_translate_init(void);
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void switch_mode(CPUARMState *env, int mode)
 
     i = bank_number(old_mode);
     env->banked_r13[i] = env->regs[13];
-    env->banked_r14[i] = env->regs[14];
     env->banked_spsr[i] = env->spsr;
 
     i = bank_number(mode);
     env->regs[13] = env->banked_r13[i];
-    env->regs[14] = env->banked_r14[i];
     env->spsr = env->banked_spsr[i];
+
+    env->banked_r14[r14_bank_number(old_mode)] = env->regs[14];
+    env->regs[14] = env->banked_r14[r14_bank_number(mode)];
 }
 
 /* Physical Interrupt Target EL Lookup Table
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
         if (mode == ARM_CPU_MODE_HYP) {
             env->xregs[14] = env->regs[14];
         } else {
-            env->xregs[14] = env->banked_r14[bank_number(ARM_CPU_MODE_USR)];
+            env->xregs[14] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)];
         }
     }
 
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
         env->xregs[16] = env->regs[14];
         env->xregs[17] = env->regs[13];
     } else {
-        env->xregs[16] = env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)];
+        env->xregs[16] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)];
         env->xregs[17] = env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)];
     }
 
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
         env->xregs[18] = env->regs[14];
         env->xregs[19] = env->regs[13];
     } else {
-        env->xregs[18] = env->banked_r14[bank_number(ARM_CPU_MODE_SVC)];
+        env->xregs[18] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)];
         env->xregs[19] = env->banked_r13[bank_number(ARM_CPU_MODE_SVC)];
     }
 
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
         env->xregs[20] = env->regs[14];
         env->xregs[21] = env->regs[13];
     } else {
-        env->xregs[20] = env->banked_r14[bank_number(ARM_CPU_MODE_ABT)];
+        env->xregs[20] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)];
         env->xregs[21] = env->banked_r13[bank_number(ARM_CPU_MODE_ABT)];
     }
 
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
         env->xregs[22] = env->regs[14];
         env->xregs[23] = env->regs[13];
     } else {
-        env->xregs[22] = env->banked_r14[bank_number(ARM_CPU_MODE_UND)];
+        env->xregs[22] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)];
         env->xregs[23] = env->banked_r13[bank_number(ARM_CPU_MODE_UND)];
     }
 
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_32_to_64(CPUARMState *env)
             env->xregs[i] = env->fiq_regs[i - 24];
         }
         env->xregs[29] = env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)];
-        env->xregs[30] = env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)];
+        env->xregs[30] = env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)];
     }
 
     env->pc = env->regs[15];
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
         if (mode == ARM_CPU_MODE_HYP) {
             env->regs[14] = env->xregs[14];
         } else {
-            env->banked_r14[bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
+            env->banked_r14[r14_bank_number(ARM_CPU_MODE_USR)] = env->xregs[14];
         }
     }
 
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
         env->regs[14] = env->xregs[16];
         env->regs[13] = env->xregs[17];
     } else {
-        env->banked_r14[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
+        env->banked_r14[r14_bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[16];
         env->banked_r13[bank_number(ARM_CPU_MODE_IRQ)] = env->xregs[17];
     }
 
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
         env->regs[14] = env->xregs[18];
         env->regs[13] = env->xregs[19];
     } else {
-        env->banked_r14[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
+        env->banked_r14[r14_bank_number(ARM_CPU_MODE_SVC)] = env->xregs[18];
         env->banked_r13[bank_number(ARM_CPU_MODE_SVC)] = env->xregs[19];
     }
 
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
         env->regs[14] = env->xregs[20];
         env->regs[13] = env->xregs[21];
     } else {
-        env->banked_r14[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
+        env->banked_r14[r14_bank_number(ARM_CPU_MODE_ABT)] = env->xregs[20];
         env->banked_r13[bank_number(ARM_CPU_MODE_ABT)] = env->xregs[21];
     }
 
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
         env->regs[14] = env->xregs[22];
         env->regs[13] = env->xregs[23];
     } else {
-        env->banked_r14[bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
+        env->banked_r14[r14_bank_number(ARM_CPU_MODE_UND)] = env->xregs[22];
         env->banked_r13[bank_number(ARM_CPU_MODE_UND)] = env->xregs[23];
     }
 
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env)
             env->fiq_regs[i - 24] = env->xregs[i];
         }
         env->banked_r13[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[29];
-        env->banked_r14[bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
+        env->banked_r14[r14_bank_number(ARM_CPU_MODE_FIQ)] = env->xregs[30];
     }
 
     env->regs[15] = env->pc;
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         memcpy(env->usr_regs, env->regs + 8, 5 * sizeof(uint32_t));
     }
     env->banked_r13[bn] = env->regs[13];
-    env->banked_r14[bn] = env->regs[14];
     env->banked_spsr[bn] = env->spsr;
+    env->banked_r14[r14_bank_number(mode)] = env->regs[14];
 
     /* Now we can safely copy stuff down to the kernel */
     for (i = 0; i < ARRAY_SIZE(regs); i++) {
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
         memcpy(env->regs + 8, env->usr_regs, 5 * sizeof(uint32_t));
     }
     env->regs[13] = env->banked_r13[bn];
-    env->regs[14] = env->banked_r14[bn];
     env->spsr = env->banked_spsr[bn];
+    env->regs[14] = env->banked_r14[r14_bank_number(mode)];
 
     /* VFP registers */
     r.id = KVM_REG_ARM | KVM_REG_SIZE_U64 | KVM_REG_ARM_VFP;
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(msr_banked)(CPUARMState *env, uint32_t value, uint32_t tgtmode,
         env->banked_r13[bank_number(tgtmode)] = value;
         break;
     case 14:
-        env->banked_r14[bank_number(tgtmode)] = value;
+        env->banked_r14[r14_bank_number(tgtmode)] = value;
         break;
     case 8 ... 12:
         switch (tgtmode) {
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(mrs_banked)(CPUARMState *env, uint32_t tgtmode, uint32_t regno)
     case 13:
         return env->banked_r13[bank_number(tgtmode)];
     case 14:
-        return env->banked_r14[bank_number(tgtmode)];
+        return env->banked_r14[r14_bank_number(tgtmode)];
     case 8 ... 12:
         switch (tgtmode) {
         case ARM_CPU_MODE_USR:
-- 
2.19.1

The Cortex-A15 and Cortex-A7 both have EL2; now we've implemented
it properly we can enable the feature bit.

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+    set_feature(&cpu->env, ARM_FEATURE_EL2);
     set_feature(&cpu->env, ARM_FEATURE_EL3);
     cpu->kvm_target = QEMU_KVM_ARM_TARGET_CORTEX_A7;
     cpu->midr = 0x410fc075;
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
     set_feature(&cpu->env, ARM_FEATURE_DUMMY_C15_REGS);
     set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+    set_feature(&cpu->env, ARM_FEATURE_EL2);
     set_feature(&cpu->env, ARM_FEATURE_EL3);
     cpu->kvm_target = QEMU_KVM_ARM_TARGET_CORTEX_A15;
     cpu->midr = 0x412fc0f1;
-- 
2.19.1

Hi; this pull request has a collection of bug fixes for rc0.
The big one is the trusted firmware boot regression fix.

thanks
-- PMM

The following changes since commit ece5f8374d0416a339f0c0a9399faa2c42d4ad6f:

Merge tag 'linux-user-for-7.2-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-11-03 10:55:05 -0400)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20221104

for you to fetch changes up to cead7fa4c06087c86c67c5ce815cc1ff0bfeac3a:

target/arm: Two fixes for secure ptw (2022-11-04 10:58:58 +0000)

----------------------------------------------------------------
target-arm queue:
 * Fix regression booting Trusted Firmware
 * Honor HCR_E2H and HCR_TGE in ats_write64()
 * Copy the entire vector in DO_ZIP
 * Fix Privileged Access Never (PAN) for aarch32
 * Make TLBIOS and TLBIRANGE ops trap on HCR_EL2.TTLB
 * Set SCR_EL3.HXEn when direct booting kernel
 * Set SME and SVE EL3 vector lengths when direct booting kernel

----------------------------------------------------------------
Ake Koomsin (1):
      target/arm: Honor HCR_E2H and HCR_TGE in ats_write64()

Peter Maydell (3):
      hw/arm/boot: Set SME and SVE EL3 vector lengths when booting kernel
      hw/arm/boot: Set SCR_EL3.HXEn when booting kernel
      target/arm: Make TLBIOS and TLBIRANGE ops trap on HCR_EL2.TTLB

Richard Henderson (2):
      target/arm: Copy the entire vector in DO_ZIP
      target/arm: Two fixes for secure ptw

Timofey Kutergin (1):
      target/arm: Fix Privileged Access Never (PAN) for aarch32

hw/arm/boot.c           |  5 ++++
 target/arm/helper.c     | 64 +++++++++++++++++++++++++++++--------------------
 target/arm/ptw.c        | 50 ++++++++++++++++++++++++++++----------
 target/arm/sve_helper.c |  4 ++--
 4 files changed, 83 insertions(+), 40 deletions(-)

When we direct boot a kernel on a CPU which emulates EL3, we need
to set up the EL3 system registers as the Linux kernel documentation
specifies:
 https://www.kernel.org/doc/Documentation/arm64/booting.rst

For SVE and SME this includes:
    - ZCR_EL3.LEN must be initialised to the same value for all CPUs the
      kernel is executed on.
    - SMCR_EL3.LEN must be initialised to the same value for all CPUs the
      kernel will execute on.

Although we are technically compliant with this, the "same value" we
currently use by default is the reset value of 0.  This will end up
forcing the guest kernel's SVE and SME vector length to be only the
smallest supported length.

Initialize the vector length fields to their maximum possible value,
which is 0xf. If the implementation doesn't actually support that
vector length then the effective vector length will be constrained
down to the maximum supported value at point of use.

This allows the guest to use all the vector lengths the emulated CPU
supports (by programming the _EL2 and _EL1 versions of these
registers.)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221027140207.413084-2-peter.maydell@linaro.org
---
 hw/arm/boot.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     }
                     if (cpu_isar_feature(aa64_sve, cpu)) {
                         env->cp15.cptr_el[3] |= R_CPTR_EL3_EZ_MASK;
+                        env->vfp.zcr_el[3] = 0xf;
                     }
                     if (cpu_isar_feature(aa64_sme, cpu)) {
                         env->cp15.cptr_el[3] |= R_CPTR_EL3_ESM_MASK;
                         env->cp15.scr_el3 |= SCR_ENTP2;
+                        env->vfp.smcr_el[3] = 0xf;
                     }
                     /* AArch64 kernels never boot in secure mode */
                     assert(!info->secure_boot);
-- 
2.25.1

When we direct boot a kernel on a CPU which emulates EL3, we need to
set up the EL3 system registers as the Linux kernel documentation
specifies:
     https://www.kernel.org/doc/Documentation/arm64/booting.rst

For CPUs with FEAT_HCX support this includes:
    - SCR_EL3.HXEn (bit 38) must be initialised to 0b1.

but we forgot to do this when implementing FEAT_HCX, which would mean
that a guest trying to access the HCRX_EL2 register would crash.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221027140207.413084-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                         env->cp15.scr_el3 |= SCR_ENTP2;
                         env->vfp.smcr_el[3] = 0xf;
                     }
+                    if (cpu_isar_feature(aa64_hcx, cpu)) {
+                        env->cp15.scr_el3 |= SCR_HXEN;
+                    }
                     /* AArch64 kernels never boot in secure mode */
                     assert(!info->secure_boot);
                     /* This hook is only supported for AArch32 currently:
-- 
2.25.1

The HCR_EL2.TTLB bit is supposed to trap all EL1 execution of TLB
maintenance instructions.  However we have added new TLB insns for
FEAT_TLBIOS and FEAT_TLBIRANGE, and forgot to set their accessfn to
access_ttlb.  Add the missing accessfns.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.c | 36 ++++++++++++++++++------------------
 1 file changed, 18 insertions(+), 18 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo pauth_reginfo[] = {
 static const ARMCPRegInfo tlbirange_reginfo[] = {
     { .name = "TLBI_RVAE1IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 1,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1is_write },
     { .name = "TLBI_RVAAE1IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 3,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1is_write },
    { .name = "TLBI_RVALE1IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 5,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1is_write },
     { .name = "TLBI_RVAALE1IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 7,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1is_write },
     { .name = "TLBI_RVAE1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1is_write },
     { .name = "TLBI_RVAAE1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 3,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1is_write },
    { .name = "TLBI_RVALE1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 5,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1is_write },
     { .name = "TLBI_RVAALE1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 7,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1is_write },
     { .name = "TLBI_RVAE1", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1_write },
     { .name = "TLBI_RVAAE1", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 3,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1_write },
    { .name = "TLBI_RVALE1", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 5,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1_write },
     { .name = "TLBI_RVAALE1", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 7,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_rvae1_write },
     { .name = "TLBI_RIPAS2E1IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 2,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbirange_reginfo[] = {
 static const ARMCPRegInfo tlbios_reginfo[] = {
     { .name = "TLBI_VMALLE1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 0,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_vmalle1is_write },
     { .name = "TLBI_VAE1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 1,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_vae1is_write },
     { .name = "TLBI_ASIDE1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 2,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_vmalle1is_write },
     { .name = "TLBI_VAAE1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 3,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_vae1is_write },
     { .name = "TLBI_VALE1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 5,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_vae1is_write },
     { .name = "TLBI_VAALE1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 7,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .writefn = tlbi_aa64_vae1is_write },
     { .name = "TLBI_ALLE2OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 0,
-- 
2.25.1

From: Timofey Kutergin <tkutergin@gmail.com>

When we implemented the PAN support we theoretically wanted
to support it for both AArch32 and AArch64, but in practice
several bugs made it essentially unusable with an AArch32
guest. Fix all those problems:

- Use CPSR.PAN to check for PAN state in aarch32 mode
    - throw permission fault during address translation when PAN is
      enabled and kernel tries to access user acessible page
    - ignore SCTLR_XP bit for armv7 and armv8 (conflicts with SCTLR_SPAN).

Signed-off-by: Timofey Kutergin <tkutergin@gmail.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20221027112619.2205229-1-tkutergin@gmail.com
[PMM: tweak commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 13 +++++++++++--
 target/arm/ptw.c    | 35 ++++++++++++++++++++++++++++++-----
 2 files changed, 41 insertions(+), 7 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
 }
 #endif
 
+static bool arm_pan_enabled(CPUARMState *env)
+{
+    if (is_a64(env)) {
+        return env->pstate & PSTATE_PAN;
+    } else {
+        return env->uncached_cpsr & CPSR_PAN;
+    }
+}
+
 ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
 {
     ARMMMUIdx idx;
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
         }
         break;
     case 1:
-        if (env->pstate & PSTATE_PAN) {
+        if (arm_pan_enabled(env)) {
             idx = ARMMMUIdx_E10_1_PAN;
         } else {
             idx = ARMMMUIdx_E10_1;
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
     case 2:
         /* Note that TGE does not apply at EL2.  */
         if (arm_hcr_el2_eff(env) & HCR_E2H) {
-            if (env->pstate & PSTATE_PAN) {
+            if (arm_pan_enabled(env)) {
                 idx = ARMMMUIdx_E20_2_PAN;
             } else {
                 idx = ARMMMUIdx_E20_2;
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
  * @mmu_idx:     MMU index indicating required translation regime
  * @ap:          The 3-bit access permissions (AP[2:0])
  * @domain_prot: The 2-bit domain access permissions
+ * @is_user: TRUE if accessing from PL0
  */
-static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
-                         int ap, int domain_prot)
+static int ap_to_rw_prot_is_user(CPUARMState *env, ARMMMUIdx mmu_idx,
+                         int ap, int domain_prot, bool is_user)
 {
-    bool is_user = regime_is_user(env, mmu_idx);
-
     if (domain_prot == 3) {
         return PAGE_READ | PAGE_WRITE;
     }
@@ -XXX,XX +XXX,XX @@ static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
     }
 }
 
+/*
+ * Translate section/page access permissions to page R/W protection flags
+ * @env:         CPUARMState
+ * @mmu_idx:     MMU index indicating required translation regime
+ * @ap:          The 3-bit access permissions (AP[2:0])
+ * @domain_prot: The 2-bit domain access permissions
+ */
+static int ap_to_rw_prot(CPUARMState *env, ARMMMUIdx mmu_idx,
+                         int ap, int domain_prot)
+{
+   return ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot,
+                                regime_is_user(env, mmu_idx));
+}
+
 /*
  * Translate section/page access permissions to page R/W protection flags.
  * @ap:      The 2-bit simple AP (AP[2:1])
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
     hwaddr phys_addr;
     uint32_t dacr;
     bool ns;
+    int user_prot;
 
     /* Pagetable walk.  */
     /* Lookup l1 descriptor.  */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
                 goto do_fault;
             }
             result->f.prot = simple_ap_to_rw_prot(env, mmu_idx, ap >> 1);
+            user_prot = simple_ap_to_rw_prot_is_user(ap >> 1, 1);
         } else {
             result->f.prot = ap_to_rw_prot(env, mmu_idx, ap, domain_prot);
+            user_prot = ap_to_rw_prot_is_user(env, mmu_idx, ap, domain_prot, 1);
         }
         if (result->f.prot && !xn) {
             result->f.prot |= PAGE_EXEC;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
             fi->type = ARMFault_Permission;
             goto do_fault;
         }
+        if (regime_is_pan(env, mmu_idx) &&
+            !regime_is_user(env, mmu_idx) &&
+            user_prot &&
+            access_type != MMU_INST_FETCH) {
+            /* Privileged Access Never fault */
+            fi->type = ARMFault_Permission;
+            goto do_fault;
+        }
     }
     if (ns) {
         /* The NS bit will (as required by the architecture) have no effect if
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
     if (regime_using_lpae_format(env, mmu_idx)) {
         return get_phys_addr_lpae(env, ptw, address, access_type, false,
                                   result, fi);
-    } else if (regime_sctlr(env, mmu_idx) & SCTLR_XP) {
+    } else if (arm_feature(env, ARM_FEATURE_V7) ||
+               regime_sctlr(env, mmu_idx) & SCTLR_XP) {
         return get_phys_addr_v6(env, ptw, address, access_type, result, fi);
     } else {
         return get_phys_addr_v5(env, ptw, address, access_type, result, fi);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

With odd_ofs set, we weren't copying enough data.

Fixes: 09eb6d7025d1 ("target/arm: Move sve zip high_ofs into simd_data")
Reported-by: Idan Horowitz <idan.horowitz@gmail.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20221031054144.3574-1-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(NAME)(void *vd, void *vn, void *vm, uint32_t desc)       \
     /* We produce output faster than we consume input.               \
        Therefore we must be mindful of possible overlap.  */         \
     if (unlikely((vn - vd) < (uintptr_t)oprsz)) {                    \
-        vn = memcpy(&tmp_n, vn, oprsz_2);                            \
+        vn = memcpy(&tmp_n, vn, oprsz);                              \
     }                                                                \
     if (unlikely((vm - vd) < (uintptr_t)oprsz)) {                    \
-        vm = memcpy(&tmp_m, vm, oprsz_2);                            \
+        vm = memcpy(&tmp_m, vm, oprsz);                              \
     }                                                                \
     for (i = 0; i < oprsz_2; i += sizeof(TYPE)) {                    \
         *(TYPE *)(vd + H(2 * i + 0)) = *(TYPE *)(vn + odd_ofs + H(i)); \
-- 
2.25.1

From: Ake Koomsin <ake@igel.co.jp>

We need to check HCR_E2H and HCR_TGE to select the right MMU index for
the correct translation regime.

To check for EL2&0 translation regime:
- For S1E0*, S1E1* and S12E* ops, check both HCR_E2H and HCR_TGE
- For S1E2* ops, check only HCR_E2H

Signed-off-by: Ake Koomsin <ake@igel.co.jp>
Message-id: 20221101064250.12444-1-ake@igel.co.jp
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
     MMUAccessType access_type = ri->opc2 & 1 ? MMU_DATA_STORE : MMU_DATA_LOAD;
     ARMMMUIdx mmu_idx;
     int secure = arm_is_secure_below_el3(env);
+    uint64_t hcr_el2 = arm_hcr_el2_eff(env);
+    bool regime_e20 = (hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE);
 
     switch (ri->opc2 & 6) {
     case 0:
         switch (ri->opc1) {
         case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */
             if (ri->crm == 9 && (env->pstate & PSTATE_PAN)) {
-                mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
+                mmu_idx = regime_e20 ?
+                          ARMMMUIdx_E20_2_PAN : ARMMMUIdx_Stage1_E1_PAN;
             } else {
-                mmu_idx = ARMMMUIdx_Stage1_E1;
+                mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_Stage1_E1;
             }
             break;
         case 4: /* AT S1E2R, AT S1E2W */
-            mmu_idx = ARMMMUIdx_E2;
+            mmu_idx = hcr_el2 & HCR_E2H ? ARMMMUIdx_E20_2 : ARMMMUIdx_E2;
             break;
         case 6: /* AT S1E3R, AT S1E3W */
             mmu_idx = ARMMMUIdx_E3;
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
         }
         break;
     case 2: /* AT S1E0R, AT S1E0W */
-        mmu_idx = ARMMMUIdx_Stage1_E0;
+        mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_Stage1_E0;
         break;
     case 4: /* AT S12E1R, AT S12E1W */
-        mmu_idx = ARMMMUIdx_E10_1;
+        mmu_idx = regime_e20 ? ARMMMUIdx_E20_2 : ARMMMUIdx_E10_1;
         break;
     case 6: /* AT S12E0R, AT S12E0W */
-        mmu_idx = ARMMMUIdx_E10_0;
+        mmu_idx = regime_e20 ? ARMMMUIdx_E20_0 : ARMMMUIdx_E10_0;
         break;
     default:
         g_assert_not_reached();
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reversed the sense of non-secure in get_phys_addr_lpae,
and failed to initialize attrs.secure for ARMMMUIdx_Phys_S.

Fixes: 48da29e4 ("target/arm: Add ptw_idx to S1Translate")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1293
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 15 ++++++++-------
 1 file changed, 8 insertions(+), 7 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     descaddr |= (address >> (stride * (4 - level))) & indexmask;
     descaddr &= ~7ULL;
     nstable = extract32(tableattrs, 4, 1);
-    if (!nstable) {
+    if (nstable) {
         /*
          * Stage2_S -> Stage2 or Phys_S -> Phys_NS
          * Assert that the non-secure idx are even, and relative order.
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
     bool is_secure = ptw->in_secure;
     ARMMMUIdx s1_mmu_idx;
 
+    /*
+     * The page table entries may downgrade secure to non-secure, but
+     * cannot upgrade an non-secure translation regime's attributes
+     * to secure.
+     */
+    result->f.attrs.secure = is_secure;
+
     switch (mmu_idx) {
     case ARMMMUIdx_Phys_S:
     case ARMMMUIdx_Phys_NS:
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
         break;
     }
 
-    /*
-     * The page table entries may downgrade secure to non-secure, but
-     * cannot upgrade an non-secure translation regime's attributes
-     * to secure.
-     */
-    result->f.attrs.secure = is_secure;
     result->f.attrs.user = regime_is_user(env, mmu_idx);
 
     /*
-- 
2.25.1