Series comparison

-[Qemu-devel] [PULL 0/5] target-arm queue
+[PULL 00/14] target-arm queue
-A last arm pullreq before rc0. This is mostly bug fixes,
+arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length
-though you could call adding the missing local timer
+patches, which are somewhere between a bugfix and a new feature.
 support to bcm2836_control a new feature I suppose --
 in any case it's a small and localised change.
 thanks
 -- PMM
-The following changes since commit 7074ab12c81a1b2b1e0e1c40983f56b2c5ccc494:
+The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:
-  Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-03-14 16:19:37 +0000)
+  Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190315
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727
-for you to fetch changes up to 5de56742a3c91de3d646326bec43a989bba83ca4:
+for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:
-  target/arm: Check access permission to ADDVL/ADDPL/RDVL (2019-03-15 11:12:29 +0000)
+  hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * Add missing SVE-enabled check to ADDVL/ADDPL/RDVL
+ * hw/arm/smmuv3: Check 31st bit to see if CD is valid
- * virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
+ * qemu-options.hx: Fix formatting of -machine memory-backend option
- * virt-acpi-build: Fix SMMUv3 GSIV values
+ * hw: aspeed_gpio: Fix memory size
- * Allow EL0 to write to arch timer registers, not just read them
+ * hw/arm/nseries: Display hexadecimal value with '0x' prefix
- * bcm2836_control: Implement local timer
+ * Add sve-default-vector-length cpu property
  * docs: Update path that mentions deprecated.rst
  * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
  * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
  * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
  * target/arm: Report M-profile alignment faults correctly to the guest
  * target/arm: Add missing 'return's after calling v7m_exception_taken()
  * target/arm: Enforce that M-profile SP low 2 bits are always zero
 ----------------------------------------------------------------
-Amir Charif (1):
+Joe Komlodi (1):
-      target/arm: Check access permission to ADDVL/ADDPL/RDVL
+      hw/arm/smmuv3: Check 31st bit to see if CD is valid
-Dongjiu Geng (1):
+Joel Stanley (1):
-      target/arm: change arch timer registers access permission
+      hw: aspeed_gpio: Fix memory size
-Eric Auger (1):
+Mao Zhongyi (1):
-      hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values
+      docs: Update path that mentions deprecated.rst
-Wei Yang (1):
+Peter Maydell (7):
-      hw/arm/virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
+      qemu-options.hx: Fix formatting of -machine memory-backend option
       target/arm: Enforce that M-profile SP low 2 bits are always zero
       target/arm: Add missing 'return's after calling v7m_exception_taken()
       target/arm: Report M-profile alignment faults correctly to the guest
       hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
       hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
       hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
-Zoltán Baldaszti (1):
+Philippe Mathieu-Daudé (1):
-      hw/intc/bcm2836_control: Implement local timer
+      hw/arm/nseries: Display hexadecimal value with '0x' prefix
- include/hw/intc/bcm2836_control.h |   9 ++++
+Richard Henderson (3):
- hw/arm/virt-acpi-build.c          |   6 +--
+      target/arm: Correctly bound length in sve_zcr_get_valid_len
- hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++++++++++-
+      target/arm: Export aarch64_sve_zcr_get_valid_len
- target/arm/helper.c               |  30 +++++------
+      target/arm: Add sve-default-vector-length cpu property
  target/arm/translate-sve.c        |  22 ++++++---
 files changed, 140 insertions(+), 28 deletions(-)
+ docs/system/arm/cpu-features.rst | 15 ++++++++++
+ configure                        |  2 +-
+ hw/arm/smmuv3-internal.h         |  2 +-
+ target/arm/cpu.h                 |  5 ++++
+ target/arm/internals.h           | 10 +++++++
+ hw/arm/nseries.c                 |  2 +-
+ hw/gpio/aspeed_gpio.c            |  3 +-
+ hw/intc/armv7m_nvic.c            | 40 +++++++++++++++++++--------
+ target/arm/cpu.c                 | 14 ++++++++--
+ target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++++++++++
+ target/arm/gdbstub.c             |  4 +++
+ target/arm/helper.c              |  8 ++++--
+ target/arm/m_helper.c            | 24 ++++++++++++----
+ target/arm/translate.c           |  3 ++
+ target/i386/cpu.c                |  2 +-
+ MAINTAINERS                      |  2 +-
+ qemu-options.hx                  | 30 +++++++++++---------
+files changed, 183 insertions(+), 43 deletions(-)

-New patch
+[PULL 01/14] hw/arm/smmuv3: Check 31st bit to see if CD is valid
+From: Joe Komlodi <joe.komlodi@xilinx.com>
+The bit to see if a CD is valid is the last bit of the first word of the CD.
+Signed-off-by: Joe Komlodi <joe.komlodi@xilinx.com>
+Message-id: 1626728232-134665-2-git-send-email-joe.komlodi@xilinx.com
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/smmuv3-internal.h | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/smmuv3-internal.h
++++ b/hw/arm/smmuv3-internal.h
+@@ -XXX,XX +XXX,XX @@ static inline int pa_range(STE *ste)
+ /* CD fields */
+-#define CD_VALID(x)   extract32((x)->word[0], 30, 1)
++#define CD_VALID(x)   extract32((x)->word[0], 31, 1)
+ #define CD_ASID(x)    extract32((x)->word[1], 16, 16)
+ #define CD_TTB(x, sel)                                      \
+     ({                                                      \
+--
+.20.1

-New patch
+[PULL 02/14] qemu-options.hx: Fix formatting of -machine memory-backend option
+The documentation of the -machine memory-backend has some minor
+formatting errors:
+ * Misindentation of the initial line meant that the whole option
+   section is incorrectly indented in the HTML output compared to
+   the other -machine options
+ * The examples weren't indented, which meant that they were formatted
+   as plain run-on text including outputting the "::" as text.
+ * The a) b) list has no rst-format markup so it is rendered as
+   a single run-on paragraph
+Fix the formatting.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Igor Mammedov <imammedo@redhat.com>
+Message-id: 20210719105257.3599-1-peter.maydell@linaro.org
+---
+ qemu-options.hx | 30 +++++++++++++++++-------------
+file changed, 17 insertions(+), 13 deletions(-)
+diff --git a/qemu-options.hx b/qemu-options.hx
+index XXXXXXX..XXXXXXX 100644
+--- a/qemu-options.hx
++++ b/qemu-options.hx
+@@ -XXX,XX +XXX,XX @@ SRST
+         Enables or disables ACPI Heterogeneous Memory Attribute Table
+         (HMAT) support. The default is off.
+-     ``memory-backend='id'``
++    ``memory-backend='id'``
+         An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.
+         Allows to use a memory backend as main RAM.
+         For example:
+         ::
+-        -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
+-        -machine memory-backend=pc.ram
+-        -m 512M
++
++            -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
++            -machine memory-backend=pc.ram
++            -m 512M
+         Migration compatibility note:
+-        a) as backend id one shall use value of 'default-ram-id', advertised by
+-        machine type (available via ``query-machines`` QMP command), if migration
+-        to/from old QEMU (<5.0) is expected.
+-        b) for machine types 4.0 and older, user shall
+-        use ``x-use-canonical-path-for-ramblock-id=off`` backend option
+-        if migration to/from old QEMU (<5.0) is expected.
++
++        * as backend id one shall use value of 'default-ram-id', advertised by
++          machine type (available via ``query-machines`` QMP command), if migration
++          to/from old QEMU (<5.0) is expected.
++        * for machine types 4.0 and older, user shall
++          use ``x-use-canonical-path-for-ramblock-id=off`` backend option
++          if migration to/from old QEMU (<5.0) is expected.
++
+         For example:
+         ::
+-        -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
+-        -machine memory-backend=pc.ram
+-        -m 512M
++
++            -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
++            -machine memory-backend=pc.ram
++            -m 512M
+ ERST
+ HXCOMM Deprecated by -machine
+--
+.20.1

-New patch
+[PULL 03/14] target/arm: Enforce that M-profile SP low 2 bits are always zero
+For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
+RES0H, which is to say that they must be hardwired to zero so that
+guest attempts to write non-zero values to them are ignored.
+Implement this behaviour by masking out the low bits:
+ * for writes to r13 by the gdbstub
+ * for writes to any of the various flavours of SP via MSR
+ * for writes to r13 via store_reg() in generated code
+Note that all the direct uses of cpu_R[] in translate.c are in places
+where the register is definitely not r13 (usually because that has
+been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
+UNDEF).
+All the other writes to regs[13] in C code are either:
+ * A-profile only code
+ * writes of values we can guarantee to be aligned, such as
+   - writes of previous-SP-value plus or minus a 4-aligned constant
+   - writes of the value in an SP limit register (which we already
+     enforce to be aligned)
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
+---
+ target/arm/gdbstub.c   |  4 ++++
+ target/arm/m_helper.c  | 14 ++++++++------
+ target/arm/translate.c |  3 +++
+files changed, 15 insertions(+), 6 deletions(-)
+diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/gdbstub.c
++++ b/target/arm/gdbstub.c
+@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
+     if (n < 16) {
+         /* Core integer register.  */
++        if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
++            /* M profile SP low bits are always 0 */
++            tmp &= ~3;
++        }
+         env->regs[n] = tmp;
+         return 4;
+     }
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/m_helper.c
++++ b/target/arm/m_helper.c
+@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+             if (!env->v7m.secure) {
+                 return;
+             }
+-            env->v7m.other_ss_msp = val;
++            env->v7m.other_ss_msp = val & ~3;
+             return;
+         case 0x89: /* PSP_NS */
+             if (!env->v7m.secure) {
+                 return;
+             }
+-            env->v7m.other_ss_psp = val;
++            env->v7m.other_ss_psp = val & ~3;
+             return;
+         case 0x8a: /* MSPLIM_NS */
+             if (!env->v7m.secure) {
+@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+             limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
++            val &= ~0x3;
++
+             if (val < limit) {
+                 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
+             }
+@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
+         break;
+     case 8: /* MSP */
+         if (v7m_using_psp(env)) {
+-            env->v7m.other_sp = val;
++            env->v7m.other_sp = val & ~3;
+         } else {
+-            env->regs[13] = val;
++            env->regs[13] = val & ~3;
+         }
+         break;
+     case 9: /* PSP */
+         if (v7m_using_psp(env)) {
+-            env->regs[13] = val;
++            env->regs[13] = val & ~3;
+         } else {
+-            env->v7m.other_sp = val;
++            env->v7m.other_sp = val & ~3;
+         }
+         break;
+     case 10: /* MSPLIM */
+diff --git a/target/arm/translate.c b/target/arm/translate.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.c
++++ b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
+          */
+         tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
+         s->base.is_jmp = DISAS_JUMP;
++    } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
++        /* For M-profile SP bits [1:0] are always zero */
++        tcg_gen_andi_i32(var, var, ~3);
+     }
+     tcg_gen_mov_i32(cpu_R[reg], var);
+     tcg_temp_free_i32(var);
+--
+.20.1

-New patch
+[PULL 04/14] target/arm: Add missing 'return's after calling v7m_exception_taken()
+In do_v7m_exception_exit(), we perform various checks as part of
+performing the exception return.  If one of these checks fails, the
+architecture requires that we take an appropriate exception on the
+existing stackframe.  We implement this by calling
+v7m_exception_taken() to set up to take the new exception, and then
+immediately returning from do_v7m_exception_exit() without proceeding
+any further with the unstack-and-exception-return process.
+In a couple of checks that are new in v8.1M, we forgot the "return"
+statement, with the effect that if bad code in the guest tripped over
+these checks we would set up to take a UsageFault exception but then
+blunder on trying to also unstack and return from the original
+exception, with the probable result that the guest would crash.
+Add the missing return statements.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-3-peter.maydell@linaro.org
+---
+ target/arm/m_helper.c | 2 ++
+file changed, 2 insertions(+)
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/m_helper.c
++++ b/target/arm/m_helper.c
+@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+                         "stackframe: NSACR prevents clearing FPU registers\n");
+                     v7m_exception_taken(cpu, excret, true, false);
++                    return;
+                 } else if (!cpacr_pass) {
+                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                             exc_secure);
+@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
+                         "stackframe: CPACR prevents clearing FPU registers\n");
+                     v7m_exception_taken(cpu, excret, true, false);
++                    return;
+                 }
+             }
+             /* Clear s0..s15, FPSCR and VPR */
+--
+.20.1

-New patch
+[PULL 05/14] target/arm: Report M-profile alignment faults correctly to the guest
+For M-profile, we weren't reporting alignment faults triggered by the
+generic TCG code correctly to the guest.  These get passed into
+arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile
+style exception.fsr value of 1.  We didn't check for this, and so
+they fell through into the default of "assume this is an MPU fault"
+and were reported to the guest as a data access violation MPU fault.
+Report these alignment faults as UsageFaults which set the UNALIGNED
+bit in the UFSR.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-4-peter.maydell@linaro.org
+---
+ target/arm/m_helper.c | 8 ++++++++
+file changed, 8 insertions(+)
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/m_helper.c
++++ b/target/arm/m_helper.c
+@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+         env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
+         break;
+     case EXCP_UNALIGNED:
++        /* Unaligned faults reported by M-profile aware code */
+         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
+         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
+         break;
+@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+             }
+             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
+             break;
++        case 0x1: /* Alignment fault reported by generic code */
++            qemu_log_mask(CPU_LOG_INT,
++                          "...really UsageFault with UFSR.UNALIGNED\n");
++            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
++            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
++                                    env->v7m.secure);
++            break;
+         default:
+             /*
+              * All other FSR values are either MPU faults or "can't happen
+--
+.20.1

-New patch
+[PULL 06/14] hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
+The ISCR.ISRPENDING bit is set when an external interrupt is pending.
+This is true whether that external interrupt is enabled or not.
+This means that we can't use 's->vectpending == 0' as a shortcut to
+"ISRPENDING is zero", because s->vectpending indicates only the
+highest priority pending enabled interrupt.
+Remove the incorrect optimization so that if there is no pending
+enabled interrupt we fall through to scanning through the whole
+interrupt array.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
+---
+ hw/intc/armv7m_nvic.c | 9 ++++-----
+file changed, 4 insertions(+), 5 deletions(-)
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/armv7m_nvic.c
++++ b/hw/intc/armv7m_nvic.c
+@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)
+ {
+     int irq;
+-    /* We can shortcut if the highest priority pending interrupt
+-     * happens to be external or if there is nothing pending.
++    /*
++     * We can shortcut if the highest priority pending interrupt
++     * happens to be external; if not we need to check the whole
++     * vectors[] array.
+      */
+     if (s->vectpending > NVIC_FIRST_IRQ) {
+         return true;
+     }
+-    if (s->vectpending == 0) {
+-        return false;
+-    }
+     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
+         if (s->vectors[irq].pending) {
+--
+.20.1

-New patch
+[PULL 07/14] hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
+The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of
+the register.  We were incorrectly masking it to 8 bits, so it would
+report the wrong value if the pending exception was greater than 256.
+Fix the bug.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
+---
+ hw/intc/armv7m_nvic.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/armv7m_nvic.c
++++ b/hw/intc/armv7m_nvic.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+         /* VECTACTIVE */
+         val = cpu->env.v7m.exception;
+         /* VECTPENDING */
+-        val |= (s->vectpending & 0xff) << 12;
++        val |= (s->vectpending & 0x1ff) << 12;
+         /* ISRPENDING - set if any external IRQ is pending */
+         if (nvic_isrpending(s)) {
+             val |= (1 << 22);
+--
+.20.1

-New patch
+[PULL 08/14] hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
+In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if
+the register is accessed NonSecure and the highest priority pending
+enabled exception (that would be returned in the VECTPENDING field)
+targets Secure, then the VECTPENDING field must read 1 rather than
+the exception number of the pending exception. Implement this.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
+---
+ hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++-------
+file changed, 24 insertions(+), 7 deletions(-)
+diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/intc/armv7m_nvic.c
++++ b/hw/intc/armv7m_nvic.c
+@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
+     nvic_irq_update(s);
+ }
++static bool vectpending_targets_secure(NVICState *s)
++{
++    /* Return true if s->vectpending targets Secure state */
++    if (s->vectpending_is_s_banked) {
++        return true;
++    }
++    return !exc_is_banked(s->vectpending) &&
++        exc_targets_secure(s, s->vectpending);
++}
++
+ void armv7m_nvic_get_pending_irq_info(void *opaque,
+                                       int *pirq, bool *ptargets_secure)
+ {
+@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
+     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
+-    if (s->vectpending_is_s_banked) {
+-        targets_secure = true;
+-    } else {
+-        targets_secure = !exc_is_banked(pending) &&
+-            exc_targets_secure(s, pending);
+-    }
++    targets_secure = vectpending_targets_secure(s);
+     trace_nvic_get_pending_irq_info(pending, targets_secure);
+@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
+         /* VECTACTIVE */
+         val = cpu->env.v7m.exception;
+         /* VECTPENDING */
+-        val |= (s->vectpending & 0x1ff) << 12;
++        if (s->vectpending) {
++            /*
++             * From v8.1M VECTPENDING must read as 1 if accessed as
++             * NonSecure and the highest priority pending and enabled
++             * exception targets Secure.
++             */
++            int vp = s->vectpending;
++            if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) &&
++                vectpending_targets_secure(s)) {
++                vp = 1;
++            }
++            val |= (vp & 0x1ff) << 12;
++        }
+         /* ISRPENDING - set if any external IRQ is pending */
+         if (nvic_isrpending(s)) {
+             val |= (1 << 22);
+--
+.20.1

-New patch
+[PULL 09/14] docs: Update path that mentions deprecated.rst
+From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
+Missed in commit f3478392 "docs: Move deprecation, build
+and license info out of system/"
+Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configure         | 2 +-
+ target/i386/cpu.c | 2 +-
+ MAINTAINERS       | 2 +-
+files changed, 3 insertions(+), 3 deletions(-)
+diff --git a/configure b/configure
+index XXXXXXX..XXXXXXX 100755
+--- a/configure
++++ b/configure
+@@ -XXX,XX +XXX,XX @@ fi
+ if test -n "${deprecated_features}"; then
+     echo "Warning, deprecated features enabled."
+-    echo "Please see docs/system/deprecated.rst"
++    echo "Please see docs/about/deprecated.rst"
+     echo "  features: ${deprecated_features}"
+ fi
+diff --git a/target/i386/cpu.c b/target/i386/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/i386/cpu.c
++++ b/target/i386/cpu.c
+@@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = {
+  * none", but this is just for compatibility while libvirt isn't
+  * adapted to resolve CPU model versions before creating VMs.
+  * See "Runnability guarantee of CPU models" at
+- * docs/system/deprecated.rst.
++ * docs/about/deprecated.rst.
+  */
+ X86CPUVersion default_cpu_version = 1;
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/*
+ Incompatible changes
+ R: libvir-list@redhat.com
+-F: docs/system/deprecated.rst
++F: docs/about/deprecated.rst
+ Build System
+ ------------
+--
+.20.1

-[Qemu-devel] [PULL 3/5] target/arm: change arch timer registers access permission
+[PULL 10/14] target/arm: Correctly bound length in sve_zcr_get_valid_len
-From: Dongjiu Geng <gengdongjiu@huawei.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Some generic arch timer registers are Config-RW in the EL0,
+Currently, our only caller is sve_zcr_len_for_el, which has
-which means the EL0 exception level can have write permission
+already masked the length extracted from ZCR_ELx, so the
-if it is appropriately configured.
+masking done here is a nop.  But we will shortly have uses
 from other locations, where the length will be unmasked.
-When VM access registers, QEMU firstly checks whether they have RW
+Saturate the length to ARM_MAX_VQ instead of truncating to
-permission, then check whether it is appropriately configured.
+the low 4 bits.
 If they are defined to read only in EL0, even though they have been
 appropriately configured, they still do not have write permission.
 So need to add the write permission according to ARMV8 spec when
 define it.
-Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 1552395177-12608-1-git-send-email-gengdongjiu@huawei.com
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210723203344.968563-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 30 +++++++++++++++---------------
+ target/arm/helper.c | 4 +++-
-file changed, 15 insertions(+), 15 deletions(-)
+file changed, 3 insertions(+), 1 deletion(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
-     /* per-timer control */
+ {
-     { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
+     uint32_t end_len;
-       .secure = ARM_CP_SECSTATE_NS,
--      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+-    end_len = start_len &= 0xf;
-+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
++    start_len = MIN(start_len, ARM_MAX_VQ - 1);
-       .accessfn = gt_ptimer_access,
++    end_len = start_len;
-       .fieldoffset = offsetoflow32(CPUARMState,
++
-                                    cp15.c14_timer[GTIMER_PHYS].ctl),
+     if (!test_bit(start_len, cpu->sve_vq_map)) {
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
+         end_len = find_last_bit(cpu->sve_vq_map, start_len);
-     { .name = "CNTP_CTL_S",
+         assert(end_len < start_len);
        .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
        .secure = ARM_CP_SECSTATE_S,
 -      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
        .accessfn = gt_ptimer_access,
        .fieldoffset = offsetoflow32(CPUARMState,
                                     cp15.c14_timer[GTIMER_SEC].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
 -      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_ptimer_access,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
        .resetvalue = 0,
        .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
      },
      { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
 -      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
        .accessfn = gt_vtimer_access,
        .fieldoffset = offsetoflow32(CPUARMState,
                                     cp15.c14_timer[GTIMER_VIRT].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
 -      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_vtimer_access,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
        .resetvalue = 0,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      /* TimerValue views: a 32 bit downcounting view of the underlying state */
      { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
        .secure = ARM_CP_SECSTATE_NS,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_ptimer_access,
        .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
      },
      { .name = "CNTP_TVAL_S",
        .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
        .secure = ARM_CP_SECSTATE_S,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_ptimer_access,
        .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
      },
      { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
        .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
      },
      { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_vtimer_access,
        .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
      },
      { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
        .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
      },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      /* Comparison value, indicating when the timer goes off */
      { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
        .secure = ARM_CP_SECSTATE_NS,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
        .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
        .secure = ARM_CP_SECSTATE_S,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
        .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_IO,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
        .resetvalue = 0, .accessfn = gt_ptimer_access,
        .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
      },
      { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
        .accessfn = gt_vtimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_IO,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
        .resetvalue = 0, .accessfn = gt_vtimer_access,
 --
 .20.1

-[Qemu-devel] [PULL 5/5] target/arm: Check access permission to ADDVL/ADDPL/RDVL
+[PULL 11/14] target/arm: Export aarch64_sve_zcr_get_valid_len
-From: Amir Charif <amir.charif@cea.fr>
+From: Richard Henderson <richard.henderson@linaro.org>
-These instructions do not trap when SVE is disabled in EL0,
+Rename from sve_zcr_get_valid_len and make accessible
-causing them to be executed with wrong size information.
+from outside of helper.c.
-Signed-off-by: Amir Charif <amir.charif@cea.fr>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 1552579248-31025-1-git-send-email-amir.charif@cea.fr
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: added 'target/arm' prefix to subject]
+Message-id: 20210723203344.968563-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-sve.c | 22 ++++++++++++++--------
+ target/arm/internals.h | 10 ++++++++++
-file changed, 14 insertions(+), 8 deletions(-)
+ target/arm/helper.c    |  4 ++--
 files changed, 12 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
+--- a/target/arm/internals.h
-+++ b/target/arm/translate-sve.c
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static bool trans_INDEX_rr(DisasContext *s, arg_INDEX_rr *a)
+@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void);
+ void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
- static bool trans_ADDVL(DisasContext *s, arg_ADDVL *a)
+ #endif /* CONFIG_TCG */
 +/**
 + * aarch64_sve_zcr_get_valid_len:
 + * @cpu: cpu context
 + * @start_len: maximum len to consider
 + *
 + * Return the maximum supported sve vector length <= @start_len.
 + * Note that both @start_len and the return value are in units
 + * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
 + */
 +uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
  enum arm_fprounding {
      FPROUNDING_TIEEVEN,
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
      return 0;
  }
 -static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 +uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
  {
--    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
+     uint32_t end_len;
--    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
--    tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
+@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
-+    if (sve_access_check(s)) {
+         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
-+        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
+     }
-+        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
-+        tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
+-    return sve_zcr_get_valid_len(cpu, zcr_len);
-+    }
++    return aarch64_sve_zcr_get_valid_len(cpu, zcr_len);
      return true;
  }
- static bool trans_ADDPL(DisasContext *s, arg_ADDPL *a)
+ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
  {
 -    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
 -    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
 -    tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
 +    if (sve_access_check(s)) {
 +        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
 +        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
 +        tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
 +    }
      return true;
  }
  static bool trans_RDVL(DisasContext *s, arg_RDVL *a)
  {
 -    TCGv_i64 reg = cpu_reg(s, a->rd);
 -    tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
 +    if (sve_access_check(s)) {
 +        TCGv_i64 reg = cpu_reg(s, a->rd);
 +        tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
 +    }
      return true;
  }
 --
 .20.1

-[Qemu-devel] [PULL 1/5] hw/intc/bcm2836_control: Implement local timer
+[PULL 12/14] target/arm: Add sve-default-vector-length cpu property
-From: Zoltán Baldaszti <bztemail@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The BCM2836 control logic module includes a simple
+Mirror the behavour of /proc/sys/abi/sve_default_vector_length
-"local timer" which is a programmable down-counter that
+under the real linux kernel.  We have no way of passing along
-can generates an interrupt. Implement this functionality.
+a real default across exec like the kernel can, but this is a
 decent way of adjusting the startup vector length of a process.
-Signed-off-by: Zoltán Baldaszti <bztemail@gmail.com>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482
-[PMM: wrote commit message; wrapped long line; tweaked
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
  some comments to match the final version of the code]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20210723203344.968563-4-richard.henderson@linaro.org
+[PMM: tweaked docs formatting, document -1 special-case,
+ added fixup patch from RTH mentioning QEMU's maximum veclen.]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/intc/bcm2836_control.h |   9 +++
+ docs/system/arm/cpu-features.rst | 15 ++++++++
- hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++-
+ target/arm/cpu.h                 |  5 +++
-files changed, 108 insertions(+), 2 deletions(-)
+ target/arm/cpu.c                 | 14 ++++++--
  target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++
 files changed, 92 insertions(+), 2 deletions(-)
-diff --git a/include/hw/intc/bcm2836_control.h b/include/hw/intc/bcm2836_control.h
+diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/bcm2836_control.h
+--- a/docs/system/arm/cpu-features.rst
-+++ b/include/hw/intc/bcm2836_control.h
++++ b/docs/system/arm/cpu-features.rst
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
-  * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
+ lengths is to explicitly enable each desired length.  Therefore only
-  * Written by Andrew Baumann
+ example's (1), (4), and (6) exhibit recommended uses of the properties.
-  *
-+ * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
++SVE User-mode Default Vector Length Property
-+ * Added basic IRQ_TIMER interrupt support
++--------------------------------------------
 + *
   * This code is licensed under the GNU GPLv2 and later.
   */
@@ -XXX,XX +XXX,XX @@
  #define BCM2836_CONTROL_H
  #include "hw/sysbus.h"
 +#include "qemu/timer.h"
  /* 4 mailboxes per core, for 16 total */
  #define BCM2836_NCORES 4
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836ControlState {
      bool gpu_irq, gpu_fiq;
      uint8_t timerirqs[BCM2836_NCORES];
 +    /* local timer */
 +    QEMUTimer timer;
 +    uint32_t local_timer_control;
 +    uint8_t route_localtimer;
 +
-     /* interrupt source registers, post-routing (also input-derived; visible) */
++For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is
-     uint32_t irqsrc[BCM2836_NCORES];
++defined to mirror the Linux kernel parameter file
-     uint32_t fiqsrc[BCM2836_NCORES];
++``/proc/sys/abi/sve_default_vector_length``.  The default length, ``N``,
-diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
++is in units of bytes and must be between 16 and 8192.
 +If not specified, the default vector length is 64.
 +
 +If the default length is larger than the maximum vector length enabled,
 +the actual vector length will be reduced.  Note that the maximum vector
 +length supported by QEMU is 256.
 +
 +If this property is set to ``-1`` then the default vector length
 +is set to the maximum possible length.
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/bcm2836_control.c
+--- a/target/arm/cpu.h
-+++ b/hw/intc/bcm2836_control.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
-  * This code is licensed under the GNU GPLv2 and later.
+     /* Used to set the maximum vector length the cpu will support.  */
-  *
+     uint32_t sve_max_vq;
-  * At present, only implements interrupt routing, and mailboxes (i.e.,
-- * not local timer, PMU interrupt, or AXI counters).
++#ifdef CONFIG_USER_ONLY
-+ * not PMU interrupt, or AXI counters).
++    /* Used to set the default vector length at process start. */
-+ *
++    uint32_t sve_default_vq;
-+ * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
++#endif
   *
   * Ref:
   * https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2836/QA7_rev3.4.pdf
@@ -XXX,XX +XXX,XX @@
  #include "qemu/log.h"
  #define REG_GPU_ROUTE           0x0c
 +#define REG_LOCALTIMERROUTING   0x24
 +#define REG_LOCALTIMERCONTROL   0x34
 +#define REG_LOCALTIMERACK       0x38
  #define REG_TIMERCONTROL        0x40
  #define REG_MBOXCONTROL         0x50
  #define REG_IRQSRC              0x60
@@ -XXX,XX +XXX,XX @@
  #define IRQ_TIMER       11
  #define IRQ_MAX         IRQ_TIMER
 +#define LOCALTIMER_FREQ      38400000
 +#define LOCALTIMER_INTFLAG   (1 << 31)
 +#define LOCALTIMER_RELOAD    (1 << 30)
 +#define LOCALTIMER_INTENABLE (1 << 29)
 +#define LOCALTIMER_ENABLE    (1 << 28)
 +#define LOCALTIMER_VALUE(x)  ((x) & 0xfffffff)
 +
- static void deliver_local(BCM2836ControlState *s, uint8_t core, uint8_t irq,
+     /*
-                           uint32_t controlreg, uint8_t controlidx)
+      * In sve_vq_map each set bit is a supported vector length of
- {
+      * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_update(BCM2836ControlState *s)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-         s->fiqsrc[s->route_gpu_fiq] |= (uint32_t)1 << IRQ_GPU;
+index XXXXXXX..XXXXXXX 100644
-     }
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
          env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
          /* with reasonable vector length */
          if (cpu_isar_feature(aa64_sve, cpu)) {
 -            env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3);
 +            env->vfp.zcr_el[1] =
 +                aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
          }
          /*
           * Enable TBI0 but not TBI1.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
      QLIST_INIT(&cpu->pre_el_change_hooks);
      QLIST_INIT(&cpu->el_change_hooks);
 -#ifndef CONFIG_USER_ONLY
 +#ifdef CONFIG_USER_ONLY
 +# ifdef TARGET_AARCH64
 +    /*
-+     * handle the control module 'local timer' interrupt for one of the
++     * The linux kernel defaults to 512-bit vectors, when sve is supported.
-+     * cores' IRQ/FIQ;  this is distinct from the per-CPU timer
++     * See documentation for /proc/sys/abi/sve_default_vector_length, and
-+     * interrupts handled below.
++     * our corresponding sve-default-vector-length cpu property.
 +     */
-+    if ((s->local_timer_control & LOCALTIMER_INTENABLE) &&
++    cpu->sve_default_vq = 4;
-+        (s->local_timer_control & LOCALTIMER_INTFLAG)) {
++# endif
-+        if (s->route_localtimer & 4) {
++#else
-+            s->fiqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
+     /* Our inbound IRQ and FIQ lines */
-+        } else {
+     if (kvm_enabled()) {
-+            s->irqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
+         /* VIRQ and VFIQ are unused with KVM but we add them to maintain
-+        }
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
      cpu->isar.id_aa64pfr0 = t;
  }
 +#ifdef CONFIG_USER_ONLY
 +/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
 +static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
 +                                            const char *name, void *opaque,
 +                                            Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    int32_t default_len, default_vq, remainder;
 +
 +    if (!visit_type_int32(v, name, &default_len, errp)) {
 +        return;
 +    }
 +
-     for (i = 0; i < BCM2836_NCORES; i++) {
++    /* Undocumented, but the kernel allows -1 to indicate "maximum". */
-         /* handle local timer interrupts for this core */
++    if (default_len == -1) {
-         if (s->timerirqs[i]) {
++        cpu->sve_default_vq = ARM_MAX_VQ;
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_set_gpu_fiq(void *opaque, int irq, int level)
++        return;
-     bcm2836_control_update(s);
++    }
  }
 +static void bcm2836_control_local_timer_set_next(void *opaque)
 +{
 +    BCM2836ControlState *s = opaque;
 +    uint64_t next_event;
 +
-+    assert(LOCALTIMER_VALUE(s->local_timer_control) > 0);
++    default_vq = default_len / 16;
 +    remainder = default_len % 16;
 +
-+    next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
++    /*
-+        muldiv64(LOCALTIMER_VALUE(s->local_timer_control),
++     * Note that the 512 max comes from include/uapi/asm/sve_context.h
-+            NANOSECONDS_PER_SECOND, LOCALTIMER_FREQ);
++     * and is the maximum architectural width of ZCR_ELx.LEN.
-+    timer_mod(&s->timer, next_event);
++     */
 +    if (remainder || default_vq < 1 || default_vq > 512) {
 +        error_setg(errp, "cannot set sve-default-vector-length");
 +        if (remainder) {
 +            error_append_hint(errp, "Vector length not a multiple of 16\n");
 +        } else if (default_vq < 1) {
 +            error_append_hint(errp, "Vector length smaller than 16\n");
 +        } else {
 +            error_append_hint(errp, "Vector length larger than %d\n",
 +                              512 * 16);
 +        }
 +        return;
 +    }
 +
 +    cpu->sve_default_vq = default_vq;
 +}
 +
-+static void bcm2836_control_local_timer_tick(void *opaque)
++static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
 +                                            const char *name, void *opaque,
 +                                            Error **errp)
 +{
-+    BCM2836ControlState *s = opaque;
++    ARMCPU *cpu = ARM_CPU(obj);
 +    int32_t value = cpu->sve_default_vq * 16;
 +
-+    bcm2836_control_local_timer_set_next(s);
++    visit_type_int32(v, name, &value, errp);
 +}
 +#endif
 +
-+    s->local_timer_control |= LOCALTIMER_INTFLAG;
+ void aarch64_add_sve_properties(Object *obj)
-+    bcm2836_control_update(s);
+ {
-+}
+     uint32_t vq;
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
          object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
                              cpu_arm_set_sve_vq, NULL, NULL);
      }
 +
-+static void bcm2836_control_local_timer_control(void *opaque, uint32_t val)
++#ifdef CONFIG_USER_ONLY
-+{
++    /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
-+    BCM2836ControlState *s = opaque;
++    object_property_add(obj, "sve-default-vector-length", "int32",
-+
++                        cpu_arm_get_sve_default_vec_len,
-+    s->local_timer_control = val;
++                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
-+    if (val & LOCALTIMER_ENABLE) {
++#endif
 +        bcm2836_control_local_timer_set_next(s);
 +    } else {
 +        timer_del(&s->timer);
 +    }
 +}
 +
 +static void bcm2836_control_local_timer_ack(void *opaque, uint32_t val)
 +{
 +    BCM2836ControlState *s = opaque;
 +
 +    if (val & LOCALTIMER_INTFLAG) {
 +        s->local_timer_control &= ~LOCALTIMER_INTFLAG;
 +    }
 +    if ((val & LOCALTIMER_RELOAD) &&
 +        (s->local_timer_control & LOCALTIMER_ENABLE)) {
 +            bcm2836_control_local_timer_set_next(s);
 +    }
 +}
 +
  static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
  {
      BCM2836ControlState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
          assert(s->route_gpu_fiq < BCM2836_NCORES
                 && s->route_gpu_irq < BCM2836_NCORES);
          return ((uint32_t)s->route_gpu_fiq << 2) | s->route_gpu_irq;
 +    } else if (offset == REG_LOCALTIMERROUTING) {
 +        return s->route_localtimer;
 +    } else if (offset == REG_LOCALTIMERCONTROL) {
 +        return s->local_timer_control;
 +    } else if (offset == REG_LOCALTIMERACK) {
 +        return 0;
      } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
          return s->timercontrol[(offset - REG_TIMERCONTROL) >> 2];
      } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_write(void *opaque, hwaddr offset,
      if (offset == REG_GPU_ROUTE) {
          s->route_gpu_irq = val & 0x3;
          s->route_gpu_fiq = (val >> 2) & 0x3;
 +    } else if (offset == REG_LOCALTIMERROUTING) {
 +        s->route_localtimer = val & 7;
 +    } else if (offset == REG_LOCALTIMERCONTROL) {
 +        bcm2836_control_local_timer_control(s, val);
 +    } else if (offset == REG_LOCALTIMERACK) {
 +        bcm2836_control_local_timer_ack(s, val);
      } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
          s->timercontrol[(offset - REG_TIMERCONTROL) >> 2] = val & 0xff;
      } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_reset(DeviceState *d)
      s->route_gpu_irq = s->route_gpu_fiq = 0;
 +    timer_del(&s->timer);
 +    s->route_localtimer = 0;
 +    s->local_timer_control = 0;
 +
      for (i = 0; i < BCM2836_NCORES; i++) {
          s->timercontrol[i] = 0;
          s->mailboxcontrol[i] = 0;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_init(Object *obj)
      /* outputs to CPU cores */
      qdev_init_gpio_out_named(dev, s->irq, "irq", BCM2836_NCORES);
      qdev_init_gpio_out_named(dev, s->fiq, "fiq", BCM2836_NCORES);
 +
 +    /* create a qemu virtual timer */
 +    timer_init_ns(&s->timer, QEMU_CLOCK_VIRTUAL,
 +                  bcm2836_control_local_timer_tick, s);
  }
- static const VMStateDescription vmstate_bcm2836_control = {
+ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
      .name = TYPE_BCM2836_CONTROL,
 -    .version_id = 1,
 +    .version_id = 2,
      .minimum_version_id = 1,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32_ARRAY(mailboxes, BCM2836ControlState,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_bcm2836_control = {
          VMSTATE_UINT32_ARRAY(timercontrol, BCM2836ControlState, BCM2836_NCORES),
          VMSTATE_UINT32_ARRAY(mailboxcontrol, BCM2836ControlState,
                               BCM2836_NCORES),
 +        VMSTATE_TIMER_V(timer, BCM2836ControlState, 2),
 +        VMSTATE_UINT32_V(local_timer_control, BCM2836ControlState, 2),
 +        VMSTATE_UINT8_V(route_localtimer, BCM2836ControlState, 2),
          VMSTATE_END_OF_LIST()
      }
  };
 --
 .20.1

-[Qemu-devel] [PULL 2/5] hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values
+[PULL 13/14] hw/arm/nseries: Display hexadecimal value with '0x' prefix
-From: Eric Auger <eric.auger@redhat.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The GSIV numbers of the SPI based interrupts is not correct as
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-ARM_SPI_BASE was not added to the irqmap[VIRT_SMMU] value. So
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-this may collide with VIRTIO_MMIO irq window.
+Message-id: 20210726150953.1218690-1-f4bug@amsat.org
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 20190312091031.5185-1-eric.auger@redhat.com
 Reviewed-by: Shannon Zhao <shannon.zhaosl@gmail.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt-acpi-build.c | 2 +-
+ hw/arm/nseries.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
+diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
+--- a/hw/arm/nseries.c
-+++ b/hw/arm/virt-acpi-build.c
++++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ static uint32_t mipid_txrx(void *opaque, uint32_t cmd, int len)
-     its->identifiers[0] = 0; /* MADT translation_id */
+     default:
+     bad_cmd:
-     if (vms->iommu == VIRT_IOMMU_SMMUV3) {
+         qemu_log_mask(LOG_GUEST_ERROR,
--        int irq =  vms->irqmap[VIRT_SMMU];
+-                      "%s: unknown command %02x\n", __func__, s->cmd);
-+        int irq =  vms->irqmap[VIRT_SMMU] + ARM_SPI_BASE;
++                      "%s: unknown command 0x%02x\n", __func__, s->cmd);
+         break;
-         /* SMMUv3 node */
+     }
-         smmu_offset = iort_node_offset + node_size;
 --
 .20.1

-[Qemu-devel] [PULL 4/5] hw/arm/virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
+[PULL 14/14] hw: aspeed_gpio: Fix memory size
-From: Wei Yang <richardw.yang@linux.intel.com>
+From: Joel Stanley <joel@jms.id.au>
-This is more proper to use PCIE_MMCFG_BUS to retrieve end_bus_number.
+The macro used to calculate the maximum memory size of the MMIO region
 had a mistake, causing all GPIO models to create a mapping of 0x9D8.
 The intent was to have it be 0x9D8 - 0x800.
-Signed-off-by: Wei Yang <richardw.yang@linux.intel.com>
+This extra size doesn't matter on ast2400 and ast2500, which have a 4KB
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
+region set aside for the GPIO controller.
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Message-id: 20190312074953.16671-1-richardw.yang@linux.intel.com
+On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the
 regions would overlap. Worse was the 1.8V controller would map over the
 top of the following peripheral, which happens to be the RTC.
 The mmio region used by each device is a maximum of 2KB, so avoid the
 calculations and hard code this as the maximum.
 Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation")
 Signed-off-by: Joel Stanley <joel@jms.id.au>
 Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Message-id: 20210713065854.134634-2-joel@jms.id.au
 [PMM: fix autocorrect error in commit message]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt-acpi-build.c | 4 ++--
+ hw/gpio/aspeed_gpio.c | 3 +--
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
+diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
+--- a/hw/gpio/aspeed_gpio.c
-+++ b/hw/arm/virt-acpi-build.c
++++ b/hw/gpio/aspeed_gpio.c
-@@ -XXX,XX +XXX,XX @@ build_mcfg(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@
-     /* Only a single allocation so no need to play with segments */
+ #define GPIO_1_8V_MEM_SIZE            0x9D8
-     mcfg->allocation[0].pci_segment = cpu_to_le16(0);
+ #define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
-     mcfg->allocation[0].start_bus_number = 0;
+                                       GPIO_1_8V_REG_OFFSET) >> 2)
--    mcfg->allocation[0].end_bus_number = (memmap[ecam_id].size
+-#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
--                                          / PCIE_MMCFG_SIZE_MIN) - 1;
-+    mcfg->allocation[0].end_bus_number =
+ static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
-+        PCIE_MMCFG_BUS(memmap[ecam_id].size - 1);
+ {
+@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
-     build_header(linker, table_data, (void *)(table_data->data + mcfg_start),
+     }
-                  "MCFG", table_data->len - mcfg_start, 1, NULL, NULL);
      memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
 -            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
 +            TYPE_ASPEED_GPIO, 0x800);
      sysbus_init_mmio(sbd, &s->iomem);
  }
 --
 .20.1

A last arm pullreq before rc0. This is mostly bug fixes,
though you could call adding the missing local timer
support to bcm2836_control a new feature I suppose --
in any case it's a small and localised change.

thanks
-- PMM

The following changes since commit 7074ab12c81a1b2b1e0e1c40983f56b2c5ccc494:

Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-03-14 16:19:37 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190315

for you to fetch changes up to 5de56742a3c91de3d646326bec43a989bba83ca4:

target/arm: Check access permission to ADDVL/ADDPL/RDVL (2019-03-15 11:12:29 +0000)

----------------------------------------------------------------
target-arm queue:
 * Add missing SVE-enabled check to ADDVL/ADDPL/RDVL
 * virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
 * virt-acpi-build: Fix SMMUv3 GSIV values
 * Allow EL0 to write to arch timer registers, not just read them
 * bcm2836_control: Implement local timer

----------------------------------------------------------------
Amir Charif (1):
      target/arm: Check access permission to ADDVL/ADDPL/RDVL

Dongjiu Geng (1):
      target/arm: change arch timer registers access permission

Eric Auger (1):
      hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values

Wei Yang (1):
      hw/arm/virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number

Zoltán Baldaszti (1):
      hw/intc/bcm2836_control: Implement local timer

include/hw/intc/bcm2836_control.h |   9 ++++
 hw/arm/virt-acpi-build.c          |   6 +--
 hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++++++++++-
 target/arm/helper.c               |  30 +++++------
 target/arm/translate-sve.c        |  22 ++++++---
 5 files changed, 140 insertions(+), 28 deletions(-)

From: Zoltán Baldaszti <bztemail@gmail.com>

The BCM2836 control logic module includes a simple
"local timer" which is a programmable down-counter that
can generates an interrupt. Implement this functionality.

Signed-off-by: Zoltán Baldaszti <bztemail@gmail.com>
[PMM: wrote commit message; wrapped long line; tweaked
 some comments to match the final version of the code]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/intc/bcm2836_control.h |   9 +++
 hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++-
 2 files changed, 108 insertions(+), 2 deletions(-)

diff --git a/include/hw/intc/bcm2836_control.h b/include/hw/intc/bcm2836_control.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/bcm2836_control.h
+++ b/include/hw/intc/bcm2836_control.h
@@ -XXX,XX +XXX,XX @@
  * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
  * Written by Andrew Baumann
  *
+ * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
+ * Added basic IRQ_TIMER interrupt support
+ *
  * This code is licensed under the GNU GPLv2 and later.
  */
 
@@ -XXX,XX +XXX,XX @@
 #define BCM2836_CONTROL_H
 
 #include "hw/sysbus.h"
+#include "qemu/timer.h"
 
 /* 4 mailboxes per core, for 16 total */
 #define BCM2836_NCORES 4
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836ControlState {
     bool gpu_irq, gpu_fiq;
     uint8_t timerirqs[BCM2836_NCORES];
 
+    /* local timer */
+    QEMUTimer timer;
+    uint32_t local_timer_control;
+    uint8_t route_localtimer;
+
     /* interrupt source registers, post-routing (also input-derived; visible) */
     uint32_t irqsrc[BCM2836_NCORES];
     uint32_t fiqsrc[BCM2836_NCORES];
diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/bcm2836_control.c
+++ b/hw/intc/bcm2836_control.c
@@ -XXX,XX +XXX,XX @@
  * This code is licensed under the GNU GPLv2 and later.
  *
  * At present, only implements interrupt routing, and mailboxes (i.e.,
- * not local timer, PMU interrupt, or AXI counters).
+ * not PMU interrupt, or AXI counters).
+ *
+ * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
  *
  * Ref:
  * https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2836/QA7_rev3.4.pdf
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 
 #define REG_GPU_ROUTE           0x0c
+#define REG_LOCALTIMERROUTING   0x24
+#define REG_LOCALTIMERCONTROL   0x34
+#define REG_LOCALTIMERACK       0x38
 #define REG_TIMERCONTROL        0x40
 #define REG_MBOXCONTROL         0x50
 #define REG_IRQSRC              0x60
@@ -XXX,XX +XXX,XX @@
 #define IRQ_TIMER       11
 #define IRQ_MAX         IRQ_TIMER
 
+#define LOCALTIMER_FREQ      38400000
+#define LOCALTIMER_INTFLAG   (1 << 31)
+#define LOCALTIMER_RELOAD    (1 << 30)
+#define LOCALTIMER_INTENABLE (1 << 29)
+#define LOCALTIMER_ENABLE    (1 << 28)
+#define LOCALTIMER_VALUE(x)  ((x) & 0xfffffff)
+
 static void deliver_local(BCM2836ControlState *s, uint8_t core, uint8_t irq,
                           uint32_t controlreg, uint8_t controlidx)
 {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_update(BCM2836ControlState *s)
         s->fiqsrc[s->route_gpu_fiq] |= (uint32_t)1 << IRQ_GPU;
     }
 
+    /*
+     * handle the control module 'local timer' interrupt for one of the
+     * cores' IRQ/FIQ;  this is distinct from the per-CPU timer
+     * interrupts handled below.
+     */
+    if ((s->local_timer_control & LOCALTIMER_INTENABLE) &&
+        (s->local_timer_control & LOCALTIMER_INTFLAG)) {
+        if (s->route_localtimer & 4) {
+            s->fiqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
+        } else {
+            s->irqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
+        }
+    }
+
     for (i = 0; i < BCM2836_NCORES; i++) {
         /* handle local timer interrupts for this core */
         if (s->timerirqs[i]) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_set_gpu_fiq(void *opaque, int irq, int level)
     bcm2836_control_update(s);
 }
 
+static void bcm2836_control_local_timer_set_next(void *opaque)
+{
+    BCM2836ControlState *s = opaque;
+    uint64_t next_event;
+
+    assert(LOCALTIMER_VALUE(s->local_timer_control) > 0);
+
+    next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+        muldiv64(LOCALTIMER_VALUE(s->local_timer_control),
+            NANOSECONDS_PER_SECOND, LOCALTIMER_FREQ);
+    timer_mod(&s->timer, next_event);
+}
+
+static void bcm2836_control_local_timer_tick(void *opaque)
+{
+    BCM2836ControlState *s = opaque;
+
+    bcm2836_control_local_timer_set_next(s);
+
+    s->local_timer_control |= LOCALTIMER_INTFLAG;
+    bcm2836_control_update(s);
+}
+
+static void bcm2836_control_local_timer_control(void *opaque, uint32_t val)
+{
+    BCM2836ControlState *s = opaque;
+
+    s->local_timer_control = val;
+    if (val & LOCALTIMER_ENABLE) {
+        bcm2836_control_local_timer_set_next(s);
+    } else {
+        timer_del(&s->timer);
+    }
+}
+
+static void bcm2836_control_local_timer_ack(void *opaque, uint32_t val)
+{
+    BCM2836ControlState *s = opaque;
+
+    if (val & LOCALTIMER_INTFLAG) {
+        s->local_timer_control &= ~LOCALTIMER_INTFLAG;
+    }
+    if ((val & LOCALTIMER_RELOAD) &&
+        (s->local_timer_control & LOCALTIMER_ENABLE)) {
+            bcm2836_control_local_timer_set_next(s);
+    }
+}
+
 static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
 {
     BCM2836ControlState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
         assert(s->route_gpu_fiq < BCM2836_NCORES
                && s->route_gpu_irq < BCM2836_NCORES);
         return ((uint32_t)s->route_gpu_fiq << 2) | s->route_gpu_irq;
+    } else if (offset == REG_LOCALTIMERROUTING) {
+        return s->route_localtimer;
+    } else if (offset == REG_LOCALTIMERCONTROL) {
+        return s->local_timer_control;
+    } else if (offset == REG_LOCALTIMERACK) {
+        return 0;
     } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
         return s->timercontrol[(offset - REG_TIMERCONTROL) >> 2];
     } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_write(void *opaque, hwaddr offset,
     if (offset == REG_GPU_ROUTE) {
         s->route_gpu_irq = val & 0x3;
         s->route_gpu_fiq = (val >> 2) & 0x3;
+    } else if (offset == REG_LOCALTIMERROUTING) {
+        s->route_localtimer = val & 7;
+    } else if (offset == REG_LOCALTIMERCONTROL) {
+        bcm2836_control_local_timer_control(s, val);
+    } else if (offset == REG_LOCALTIMERACK) {
+        bcm2836_control_local_timer_ack(s, val);
     } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
         s->timercontrol[(offset - REG_TIMERCONTROL) >> 2] = val & 0xff;
     } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_reset(DeviceState *d)
 
     s->route_gpu_irq = s->route_gpu_fiq = 0;
 
+    timer_del(&s->timer);
+    s->route_localtimer = 0;
+    s->local_timer_control = 0;
+
     for (i = 0; i < BCM2836_NCORES; i++) {
         s->timercontrol[i] = 0;
         s->mailboxcontrol[i] = 0;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_init(Object *obj)
     /* outputs to CPU cores */
     qdev_init_gpio_out_named(dev, s->irq, "irq", BCM2836_NCORES);
     qdev_init_gpio_out_named(dev, s->fiq, "fiq", BCM2836_NCORES);
+
+    /* create a qemu virtual timer */
+    timer_init_ns(&s->timer, QEMU_CLOCK_VIRTUAL,
+                  bcm2836_control_local_timer_tick, s);
 }
 
 static const VMStateDescription vmstate_bcm2836_control = {
     .name = TYPE_BCM2836_CONTROL,
-    .version_id = 1,
+    .version_id = 2,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(mailboxes, BCM2836ControlState,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_bcm2836_control = {
         VMSTATE_UINT32_ARRAY(timercontrol, BCM2836ControlState, BCM2836_NCORES),
         VMSTATE_UINT32_ARRAY(mailboxcontrol, BCM2836ControlState,
                              BCM2836_NCORES),
+        VMSTATE_TIMER_V(timer, BCM2836ControlState, 2),
+        VMSTATE_UINT32_V(local_timer_control, BCM2836ControlState, 2),
+        VMSTATE_UINT8_V(route_localtimer, BCM2836ControlState, 2),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

The GSIV numbers of the SPI based interrupts is not correct as
ARM_SPI_BASE was not added to the irqmap[VIRT_SMMU] value. So
this may collide with VIRTIO_MMIO irq window.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20190312091031.5185-1-eric.auger@redhat.com
Reviewed-by: Shannon Zhao <shannon.zhaosl@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: Dongjiu Geng <gengdongjiu@huawei.com>

Some generic arch timer registers are Config-RW in the EL0,
which means the EL0 exception level can have write permission
if it is appropriately configured.

When VM access registers, QEMU firstly checks whether they have RW
permission, then check whether it is appropriately configured.
If they are defined to read only in EL0, even though they have been
appropriately configured, they still do not have write permission.
So need to add the write permission according to ARMV8 spec when
define it.

Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com>
Message-id: 1552395177-12608-1-git-send-email-gengdongjiu@huawei.com
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     /* per-timer control */
     { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
       .secure = ARM_CP_SECSTATE_NS,
-      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .fieldoffset = offsetoflow32(CPUARMState,
                                    cp15.c14_timer[GTIMER_PHYS].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     { .name = "CNTP_CTL_S",
       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
       .secure = ARM_CP_SECSTATE_S,
-      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .fieldoffset = offsetoflow32(CPUARMState,
                                    cp15.c14_timer[GTIMER_SEC].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
-      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
       .resetvalue = 0,
       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
     },
     { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
-      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
       .accessfn = gt_vtimer_access,
       .fieldoffset = offsetoflow32(CPUARMState,
                                    cp15.c14_timer[GTIMER_VIRT].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
-      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_vtimer_access,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
       .resetvalue = 0,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     /* TimerValue views: a 32 bit downcounting view of the underlying state */
     { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
       .secure = ARM_CP_SECSTATE_NS,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
     },
     { .name = "CNTP_TVAL_S",
       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
       .secure = ARM_CP_SECSTATE_S,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
     },
     { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
     },
     { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_vtimer_access,
       .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
     },
     { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
       .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
     },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     /* Comparison value, indicating when the timer goes off */
     { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
       .secure = ARM_CP_SECSTATE_NS,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
       .secure = ARM_CP_SECSTATE_S,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
       .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_IO,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .resetvalue = 0, .accessfn = gt_ptimer_access,
       .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
     },
     { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
       .accessfn = gt_vtimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_IO,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
       .resetvalue = 0, .accessfn = gt_vtimer_access,
-- 
2.20.1

From: Wei Yang <richardw.yang@linux.intel.com>

This is more proper to use PCIE_MMCFG_BUS to retrieve end_bus_number.

Signed-off-by: Wei Yang <richardw.yang@linux.intel.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20190312074953.16671-1-richardw.yang@linux.intel.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_mcfg(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     /* Only a single allocation so no need to play with segments */
     mcfg->allocation[0].pci_segment = cpu_to_le16(0);
     mcfg->allocation[0].start_bus_number = 0;
-    mcfg->allocation[0].end_bus_number = (memmap[ecam_id].size
-                                          / PCIE_MMCFG_SIZE_MIN) - 1;
+    mcfg->allocation[0].end_bus_number =
+        PCIE_MMCFG_BUS(memmap[ecam_id].size - 1);
 
     build_header(linker, table_data, (void *)(table_data->data + mcfg_start),
                  "MCFG", table_data->len - mcfg_start, 1, NULL, NULL);
-- 
2.20.1

From: Amir Charif <amir.charif@cea.fr>

These instructions do not trap when SVE is disabled in EL0,
causing them to be executed with wrong size information.

Signed-off-by: Amir Charif <amir.charif@cea.fr>
Message-id: 1552579248-31025-1-git-send-email-amir.charif@cea.fr
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: added 'target/arm' prefix to subject]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_INDEX_rr(DisasContext *s, arg_INDEX_rr *a)
 
 static bool trans_ADDVL(DisasContext *s, arg_ADDVL *a)
 {
-    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
-    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
-    tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
+    if (sve_access_check(s)) {
+        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
+        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
+        tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
+    }
     return true;
 }
 
 static bool trans_ADDPL(DisasContext *s, arg_ADDPL *a)
 {
-    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
-    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
-    tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
+    if (sve_access_check(s)) {
+        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
+        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
+        tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
+    }
     return true;
 }
 
 static bool trans_RDVL(DisasContext *s, arg_RDVL *a)
 {
-    TCGv_i64 reg = cpu_reg(s, a->rd);
-    tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
+    if (sve_access_check(s)) {
+        TCGv_i64 reg = cpu_reg(s, a->rd);
+        tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
+    }
     return true;
 }
 
-- 
2.20.1

arm pullreq for rc1. All minor bugfixes, except for the sve-default-vector-length
patches, which are somewhere between a bugfix and a new feature.

thanks
-- PMM

The following changes since commit c08ccd1b53f488ac86c1f65cf7623dc91acc249a:

Merge remote-tracking branch 'remotes/rth-gitlab/tags/pull-tcg-20210726' into staging (2021-07-27 08:35:01 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210727

for you to fetch changes up to e229a179a503f2aee43a76888cf12fbdfe8a3749:

hw: aspeed_gpio: Fix memory size (2021-07-27 11:00:00 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/smmuv3: Check 31st bit to see if CD is valid
 * qemu-options.hx: Fix formatting of -machine memory-backend option
 * hw: aspeed_gpio: Fix memory size
 * hw/arm/nseries: Display hexadecimal value with '0x' prefix
 * Add sve-default-vector-length cpu property
 * docs: Update path that mentions deprecated.rst
 * hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS
 * hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
 * hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
 * target/arm: Report M-profile alignment faults correctly to the guest
 * target/arm: Add missing 'return's after calling v7m_exception_taken()
 * target/arm: Enforce that M-profile SP low 2 bits are always zero

----------------------------------------------------------------
Joe Komlodi (1):
      hw/arm/smmuv3: Check 31st bit to see if CD is valid

Joel Stanley (1):
      hw: aspeed_gpio: Fix memory size

Mao Zhongyi (1):
      docs: Update path that mentions deprecated.rst

Peter Maydell (7):
      qemu-options.hx: Fix formatting of -machine memory-backend option
      target/arm: Enforce that M-profile SP low 2 bits are always zero
      target/arm: Add missing 'return's after calling v7m_exception_taken()
      target/arm: Report M-profile alignment faults correctly to the guest
      hw/intc/armv7m_nvic: ISCR.ISRPENDING is set for non-enabled pending interrupts
      hw/intc/armv7m_nvic: Correct size of ICSR.VECTPENDING
      hw/intc/armv7m_nvic: for v8.1M VECTPENDING hides S exceptions from NS

Philippe Mathieu-Daudé (1):
      hw/arm/nseries: Display hexadecimal value with '0x' prefix

Richard Henderson (3):
      target/arm: Correctly bound length in sve_zcr_get_valid_len
      target/arm: Export aarch64_sve_zcr_get_valid_len
      target/arm: Add sve-default-vector-length cpu property

The documentation of the -machine memory-backend has some minor
formatting errors:
 * Misindentation of the initial line meant that the whole option
   section is incorrectly indented in the HTML output compared to
   the other -machine options
 * The examples weren't indented, which meant that they were formatted
   as plain run-on text including outputting the "::" as text.
 * The a) b) list has no rst-format markup so it is rendered as
   a single run-on paragraph

Fix the formatting.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20210719105257.3599-1-peter.maydell@linaro.org
---
 qemu-options.hx | 30 +++++++++++++++++-------------
 1 file changed, 17 insertions(+), 13 deletions(-)

diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
         Enables or disables ACPI Heterogeneous Memory Attribute Table
         (HMAT) support. The default is off.
 
-     ``memory-backend='id'``
+    ``memory-backend='id'``
         An alternative to legacy ``-mem-path`` and ``mem-prealloc`` options.
         Allows to use a memory backend as main RAM.
 
         For example:
         ::
-        -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
-        -machine memory-backend=pc.ram
-        -m 512M
+
+            -object memory-backend-file,id=pc.ram,size=512M,mem-path=/hugetlbfs,prealloc=on,share=on
+            -machine memory-backend=pc.ram
+            -m 512M
 
         Migration compatibility note:
-        a) as backend id one shall use value of 'default-ram-id', advertised by
-        machine type (available via ``query-machines`` QMP command), if migration
-        to/from old QEMU (<5.0) is expected.
-        b) for machine types 4.0 and older, user shall
-        use ``x-use-canonical-path-for-ramblock-id=off`` backend option
-        if migration to/from old QEMU (<5.0) is expected.
+
+        * as backend id one shall use value of 'default-ram-id', advertised by
+          machine type (available via ``query-machines`` QMP command), if migration
+          to/from old QEMU (<5.0) is expected.
+        * for machine types 4.0 and older, user shall
+          use ``x-use-canonical-path-for-ramblock-id=off`` backend option
+          if migration to/from old QEMU (<5.0) is expected.
+
         For example:
         ::
-        -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
-        -machine memory-backend=pc.ram
-        -m 512M
+
+            -object memory-backend-ram,id=pc.ram,size=512M,x-use-canonical-path-for-ramblock-id=off
+            -machine memory-backend=pc.ram
+            -m 512M
 ERST
 
 HXCOMM Deprecated by -machine
-- 
2.20.1

For M-profile, unlike A-profile, the low 2 bits of SP are defined to be
RES0H, which is to say that they must be hardwired to zero so that
guest attempts to write non-zero values to them are ignored.

Implement this behaviour by masking out the low bits:
 * for writes to r13 by the gdbstub
 * for writes to any of the various flavours of SP via MSR
 * for writes to r13 via store_reg() in generated code

Note that all the direct uses of cpu_R[] in translate.c are in places
where the register is definitely not r13 (usually because that has
been checked for as an UNDEFINED or UNPREDICTABLE case and handled as
UNDEF).

All the other writes to regs[13] in C code are either:
 * A-profile only code
 * writes of values we can guarantee to be aligned, such as
   - writes of previous-SP-value plus or minus a 4-aligned constant
   - writes of the value in an SP limit register (which we already
     enforce to be aligned)

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-2-peter.maydell@linaro.org
---
 target/arm/gdbstub.c   |  4 ++++
 target/arm/m_helper.c  | 14 ++++++++------
 target/arm/translate.c |  3 +++
 3 files changed, 15 insertions(+), 6 deletions(-)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 
     if (n < 16) {
         /* Core integer register.  */
+        if (n == 13 && arm_feature(env, ARM_FEATURE_M)) {
+            /* M profile SP low bits are always 0 */
+            tmp &= ~3;
+        }
         env->regs[n] = tmp;
         return 4;
     }
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
             if (!env->v7m.secure) {
                 return;
             }
-            env->v7m.other_ss_msp = val;
+            env->v7m.other_ss_msp = val & ~3;
             return;
         case 0x89: /* PSP_NS */
             if (!env->v7m.secure) {
                 return;
             }
-            env->v7m.other_ss_psp = val;
+            env->v7m.other_ss_psp = val & ~3;
             return;
         case 0x8a: /* MSPLIM_NS */
             if (!env->v7m.secure) {
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
 
             limit = is_psp ? env->v7m.psplim[false] : env->v7m.msplim[false];
 
+            val &= ~0x3;
+
             if (val < limit) {
                 raise_exception_ra(env, EXCP_STKOF, 0, 1, GETPC());
             }
@@ -XXX,XX +XXX,XX @@ void HELPER(v7m_msr)(CPUARMState *env, uint32_t maskreg, uint32_t val)
         break;
     case 8: /* MSP */
         if (v7m_using_psp(env)) {
-            env->v7m.other_sp = val;
+            env->v7m.other_sp = val & ~3;
         } else {
-            env->regs[13] = val;
+            env->regs[13] = val & ~3;
         }
         break;
     case 9: /* PSP */
         if (v7m_using_psp(env)) {
-            env->regs[13] = val;
+            env->regs[13] = val & ~3;
         } else {
-            env->v7m.other_sp = val;
+            env->v7m.other_sp = val & ~3;
         }
         break;
     case 10: /* MSPLIM */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ void store_reg(DisasContext *s, int reg, TCGv_i32 var)
          */
         tcg_gen_andi_i32(var, var, s->thumb ? ~1 : ~3);
         s->base.is_jmp = DISAS_JUMP;
+    } else if (reg == 13 && arm_dc_feature(s, ARM_FEATURE_M)) {
+        /* For M-profile SP bits [1:0] are always zero */
+        tcg_gen_andi_i32(var, var, ~3);
     }
     tcg_gen_mov_i32(cpu_R[reg], var);
     tcg_temp_free_i32(var);
-- 
2.20.1

In do_v7m_exception_exit(), we perform various checks as part of
performing the exception return.  If one of these checks fails, the
architecture requires that we take an appropriate exception on the
existing stackframe.  We implement this by calling
v7m_exception_taken() to set up to take the new exception, and then
immediately returning from do_v7m_exception_exit() without proceeding
any further with the unstack-and-exception-return process.

In a couple of checks that are new in v8.1M, we forgot the "return"
statement, with the effect that if bad code in the guest tripped over
these checks we would set up to take a UsageFault exception but then
blunder on trying to also unstack and return from the original
exception, with the probable result that the guest would crash.

Add the missing return statements.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-3-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                         "stackframe: NSACR prevents clearing FPU registers\n");
                     v7m_exception_taken(cpu, excret, true, false);
+                    return;
                 } else if (!cpacr_pass) {
                     armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
                                             exc_secure);
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
                     qemu_log_mask(CPU_LOG_INT, "...taking UsageFault on existing "
                         "stackframe: CPACR prevents clearing FPU registers\n");
                     v7m_exception_taken(cpu, excret, true, false);
+                    return;
                 }
             }
             /* Clear s0..s15, FPSCR and VPR */
-- 
2.20.1

For M-profile, we weren't reporting alignment faults triggered by the
generic TCG code correctly to the guest.  These get passed into
arm_v7m_cpu_do_interrupt() as an EXCP_DATA_ABORT with an A-profile
style exception.fsr value of 1.  We didn't check for this, and so
they fell through into the default of "assume this is an MPU fault"
and were reported to the guest as a data access violation MPU fault.

Report these alignment faults as UsageFaults which set the UNALIGNED
bit in the UFSR.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-4-peter.maydell@linaro.org
---
 target/arm/m_helper.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         env->v7m.sfsr |= R_V7M_SFSR_LSERR_MASK;
         break;
     case EXCP_UNALIGNED:
+        /* Unaligned faults reported by M-profile aware code */
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE, env->v7m.secure);
         env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
         break;
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
             }
             armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_BUS, false);
             break;
+        case 0x1: /* Alignment fault reported by generic code */
+            qemu_log_mask(CPU_LOG_INT,
+                          "...really UsageFault with UFSR.UNALIGNED\n");
+            env->v7m.cfsr[env->v7m.secure] |= R_V7M_CFSR_UNALIGNED_MASK;
+            armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_USAGE,
+                                    env->v7m.secure);
+            break;
         default:
             /*
              * All other FSR values are either MPU faults or "can't happen
-- 
2.20.1

The ISCR.ISRPENDING bit is set when an external interrupt is pending.
This is true whether that external interrupt is enabled or not.
This means that we can't use 's->vectpending == 0' as a shortcut to
"ISRPENDING is zero", because s->vectpending indicates only the
highest priority pending enabled interrupt.

Remove the incorrect optimization so that if there is no pending
enabled interrupt we fall through to scanning through the whole
interrupt array.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-5-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static bool nvic_isrpending(NVICState *s)
 {
     int irq;
 
-    /* We can shortcut if the highest priority pending interrupt
-     * happens to be external or if there is nothing pending.
+    /*
+     * We can shortcut if the highest priority pending interrupt
+     * happens to be external; if not we need to check the whole
+     * vectors[] array.
      */
     if (s->vectpending > NVIC_FIRST_IRQ) {
         return true;
     }
-    if (s->vectpending == 0) {
-        return false;
-    }
 
     for (irq = NVIC_FIRST_IRQ; irq < s->num_irq; irq++) {
         if (s->vectors[irq].pending) {
-- 
2.20.1

The VECTPENDING field in the ICSR is 9 bits wide, in bits [20:12] of
the register.  We were incorrectly masking it to 8 bits, so it would
report the wrong value if the pending exception was greater than 256.
Fix the bug.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-6-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         /* VECTACTIVE */
         val = cpu->env.v7m.exception;
         /* VECTPENDING */
-        val |= (s->vectpending & 0xff) << 12;
+        val |= (s->vectpending & 0x1ff) << 12;
         /* ISRPENDING - set if any external IRQ is pending */
         if (nvic_isrpending(s)) {
             val |= (1 << 22);
-- 
2.20.1

In Arm v8.1M the VECTPENDING field in the ICSR has new behaviour: if
the register is accessed NonSecure and the highest priority pending
enabled exception (that would be returned in the VECTPENDING field)
targets Secure, then the VECTPENDING field must read 1 rather than
the exception number of the pending exception. Implement this.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210723162146.5167-7-peter.maydell@linaro.org
---
 hw/intc/armv7m_nvic.c | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque)
     nvic_irq_update(s);
 }
 
+static bool vectpending_targets_secure(NVICState *s)
+{
+    /* Return true if s->vectpending targets Secure state */
+    if (s->vectpending_is_s_banked) {
+        return true;
+    }
+    return !exc_is_banked(s->vectpending) &&
+        exc_targets_secure(s, s->vectpending);
+}
+
 void armv7m_nvic_get_pending_irq_info(void *opaque,
                                       int *pirq, bool *ptargets_secure)
 {
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
 
     assert(pending > ARMV7M_EXCP_RESET && pending < s->num_irq);
 
-    if (s->vectpending_is_s_banked) {
-        targets_secure = true;
-    } else {
-        targets_secure = !exc_is_banked(pending) &&
-            exc_targets_secure(s, pending);
-    }
+    targets_secure = vectpending_targets_secure(s);
 
     trace_nvic_get_pending_irq_info(pending, targets_secure);
 
@@ -XXX,XX +XXX,XX @@ static uint32_t nvic_readl(NVICState *s, uint32_t offset, MemTxAttrs attrs)
         /* VECTACTIVE */
         val = cpu->env.v7m.exception;
         /* VECTPENDING */
-        val |= (s->vectpending & 0x1ff) << 12;
+        if (s->vectpending) {
+            /*
+             * From v8.1M VECTPENDING must read as 1 if accessed as
+             * NonSecure and the highest priority pending and enabled
+             * exception targets Secure.
+             */
+            int vp = s->vectpending;
+            if (!attrs.secure && arm_feature(&cpu->env, ARM_FEATURE_V8_1M) &&
+                vectpending_targets_secure(s)) {
+                vp = 1;
+            }
+            val |= (vp & 0x1ff) << 12;
+        }
         /* ISRPENDING - set if any external IRQ is pending */
         if (nvic_isrpending(s)) {
             val |= (1 << 22);
-- 
2.20.1

From: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>

Missed in commit f3478392 "docs: Move deprecation, build
and license info out of system/"

Signed-off-by: Mao Zhongyi <maozhongyi@cmss.chinamobile.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723065828.1336760-1-maozhongyi@cmss.chinamobile.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configure         | 2 +-
 target/i386/cpu.c | 2 +-
 MAINTAINERS       | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ fi
 
 if test -n "${deprecated_features}"; then
     echo "Warning, deprecated features enabled."
-    echo "Please see docs/system/deprecated.rst"
+    echo "Please see docs/about/deprecated.rst"
     echo "  features: ${deprecated_features}"
 fi
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -XXX,XX +XXX,XX @@ static const X86CPUDefinition builtin_x86_defs[] = {
  * none", but this is just for compatibility while libvirt isn't
  * adapted to resolve CPU model versions before creating VMs.
  * See "Runnability guarantee of CPU models" at
- * docs/system/deprecated.rst.
+ * docs/about/deprecated.rst.
  */
 X86CPUVersion default_cpu_version = 1;
 
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: contrib/gitdm/*
 
 Incompatible changes
 R: libvir-list@redhat.com
-F: docs/system/deprecated.rst
+F: docs/about/deprecated.rst
 
 Build System
 ------------
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Currently, our only caller is sve_zcr_len_for_el, which has
already masked the length extracted from ZCR_ELx, so the
masking done here is a nop.  But we will shortly have uses
from other locations, where the length will be unmasked.

Saturate the length to ARM_MAX_VQ instead of truncating to
the low 4 bits.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 {
     uint32_t end_len;
 
-    end_len = start_len &= 0xf;
+    start_len = MIN(start_len, ARM_MAX_VQ - 1);
+    end_len = start_len;
+
     if (!test_bit(start_len, cpu->sve_vq_map)) {
         end_len = find_last_bit(cpu->sve_vq_map, start_len);
         assert(end_len < start_len);
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename from sve_zcr_get_valid_len and make accessible
from outside of helper.c.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 10 ++++++++++
 target/arm/helper.c    |  4 ++--
 2 files changed, 12 insertions(+), 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_translate_init(void);
 void arm_cpu_synchronize_from_tb(CPUState *cs, const TranslationBlock *tb);
 #endif /* CONFIG_TCG */
 
+/**
+ * aarch64_sve_zcr_get_valid_len:
+ * @cpu: cpu context
+ * @start_len: maximum len to consider
+ *
+ * Return the maximum supported sve vector length <= @start_len.
+ * Note that both @start_len and the return value are in units
+ * of ZCR_ELx.LEN, so the vector bit length is (x + 1) * 128.
+ */
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len);
 
 enum arm_fprounding {
     FPROUNDING_TIEEVEN,
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
     return 0;
 }
 
-static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
+uint32_t aarch64_sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
 {
     uint32_t end_len;
 
@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
     }
 
-    return sve_zcr_get_valid_len(cpu, zcr_len);
+    return aarch64_sve_zcr_get_valid_len(cpu, zcr_len);
 }
 
 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Mirror the behavour of /proc/sys/abi/sve_default_vector_length
under the real linux kernel.  We have no way of passing along
a real default across exec like the kernel can, but this is a
decent way of adjusting the startup vector length of a process.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/482
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210723203344.968563-4-richard.henderson@linaro.org
[PMM: tweaked docs formatting, document -1 special-case,
 added fixup patch from RTH mentioning QEMU's maximum veclen.]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst | 15 ++++++++
 target/arm/cpu.h                 |  5 +++
 target/arm/cpu.c                 | 14 ++++++--
 target/arm/cpu64.c               | 60 ++++++++++++++++++++++++++++++++
 4 files changed, 92 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
 lengths is to explicitly enable each desired length.  Therefore only
 example's (1), (4), and (6) exhibit recommended uses of the properties.
 
+SVE User-mode Default Vector Length Property
+--------------------------------------------
+
+For qemu-aarch64, the cpu property ``sve-default-vector-length=N`` is
+defined to mirror the Linux kernel parameter file
+``/proc/sys/abi/sve_default_vector_length``.  The default length, ``N``,
+is in units of bytes and must be between 16 and 8192.
+If not specified, the default vector length is 64.
+
+If the default length is larger than the maximum vector length enabled,
+the actual vector length will be reduced.  Note that the maximum vector
+length supported by QEMU is 256.
+
+If this property is set to ``-1`` then the default vector length
+is set to the maximum possible length.
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     /* Used to set the maximum vector length the cpu will support.  */
     uint32_t sve_max_vq;
 
+#ifdef CONFIG_USER_ONLY
+    /* Used to set the default vector length at process start. */
+    uint32_t sve_default_vq;
+#endif
+
     /*
      * In sve_vq_map each set bit is a supported vector length of
      * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
         /* with reasonable vector length */
         if (cpu_isar_feature(aa64_sve, cpu)) {
-            env->vfp.zcr_el[1] = MIN(cpu->sve_max_vq - 1, 3);
+            env->vfp.zcr_el[1] =
+                aarch64_sve_zcr_get_valid_len(cpu, cpu->sve_default_vq - 1);
         }
         /*
          * Enable TBI0 but not TBI1.
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
     QLIST_INIT(&cpu->pre_el_change_hooks);
     QLIST_INIT(&cpu->el_change_hooks);
 
-#ifndef CONFIG_USER_ONLY
+#ifdef CONFIG_USER_ONLY
+# ifdef TARGET_AARCH64
+    /*
+     * The linux kernel defaults to 512-bit vectors, when sve is supported.
+     * See documentation for /proc/sys/abi/sve_default_vector_length, and
+     * our corresponding sve-default-vector-length cpu property.
+     */
+    cpu->sve_default_vq = 4;
+# endif
+#else
     /* Our inbound IRQ and FIQ lines */
     if (kvm_enabled()) {
         /* VIRQ and VFIQ are unused with KVM but we add them to maintain
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
     cpu->isar.id_aa64pfr0 = t;
 }
 
+#ifdef CONFIG_USER_ONLY
+/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
+                                            const char *name, void *opaque,
+                                            Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    int32_t default_len, default_vq, remainder;
+
+    if (!visit_type_int32(v, name, &default_len, errp)) {
+        return;
+    }
+
+    /* Undocumented, but the kernel allows -1 to indicate "maximum". */
+    if (default_len == -1) {
+        cpu->sve_default_vq = ARM_MAX_VQ;
+        return;
+    }
+
+    default_vq = default_len / 16;
+    remainder = default_len % 16;
+
+    /*
+     * Note that the 512 max comes from include/uapi/asm/sve_context.h
+     * and is the maximum architectural width of ZCR_ELx.LEN.
+     */
+    if (remainder || default_vq < 1 || default_vq > 512) {
+        error_setg(errp, "cannot set sve-default-vector-length");
+        if (remainder) {
+            error_append_hint(errp, "Vector length not a multiple of 16\n");
+        } else if (default_vq < 1) {
+            error_append_hint(errp, "Vector length smaller than 16\n");
+        } else {
+            error_append_hint(errp, "Vector length larger than %d\n",
+                              512 * 16);
+        }
+        return;
+    }
+
+    cpu->sve_default_vq = default_vq;
+}
+
+static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
+                                            const char *name, void *opaque,
+                                            Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    int32_t value = cpu->sve_default_vq * 16;
+
+    visit_type_int32(v, name, &value, errp);
+}
+#endif
+
 void aarch64_add_sve_properties(Object *obj)
 {
     uint32_t vq;
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
         object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
                             cpu_arm_set_sve_vq, NULL, NULL);
     }
+
+#ifdef CONFIG_USER_ONLY
+    /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+    object_property_add(obj, "sve-default-vector-length", "int32",
+                        cpu_arm_get_sve_default_vec_len,
+                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
+#endif
 }
 
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
-- 
2.20.1

From: Joel Stanley <joel@jms.id.au>

The macro used to calculate the maximum memory size of the MMIO region
had a mistake, causing all GPIO models to create a mapping of 0x9D8.
The intent was to have it be 0x9D8 - 0x800.

This extra size doesn't matter on ast2400 and ast2500, which have a 4KB
region set aside for the GPIO controller.

On the ast2600 the 3.3V and 1.8V GPIO controllers are 2KB apart, so the
regions would overlap. Worse was the 1.8V controller would map over the
top of the following peripheral, which happens to be the RTC.

The mmio region used by each device is a maximum of 2KB, so avoid the
calculations and hard code this as the maximum.

Fixes: 36d737ee82b2 ("hw/gpio: Add in AST2600 specific implementation")
Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Rashmica Gupta <rashmica.g@gmail.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20210713065854.134634-2-joel@jms.id.au
[PMM: fix autocorrect error in commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/gpio/aspeed_gpio.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/gpio/aspeed_gpio.c
+++ b/hw/gpio/aspeed_gpio.c
@@ -XXX,XX +XXX,XX @@
 #define GPIO_1_8V_MEM_SIZE            0x9D8
 #define GPIO_1_8V_REG_ARRAY_SIZE      ((GPIO_1_8V_MEM_SIZE - \
                                       GPIO_1_8V_REG_OFFSET) >> 2)
-#define GPIO_MAX_MEM_SIZE           MAX(GPIO_3_6V_MEM_SIZE, GPIO_1_8V_MEM_SIZE)
 
 static int aspeed_evaluate_irq(GPIOSets *regs, int gpio_prev_high, int gpio)
 {
@@ -XXX,XX +XXX,XX @@ static void aspeed_gpio_realize(DeviceState *dev, Error **errp)
     }
 
     memory_region_init_io(&s->iomem, OBJECT(s), &aspeed_gpio_ops, s,
-            TYPE_ASPEED_GPIO, GPIO_MAX_MEM_SIZE);
+            TYPE_ASPEED_GPIO, 0x800);
 
     sysbus_init_mmio(sbd, &s->iomem);
 }
-- 
2.20.1