Series comparison

-[Qemu-devel] [PULL 0/5] target-arm queue
+[PULL 0/3] target-arm queue
-A last arm pullreq before rc0. This is mostly bug fixes,
+Only thing for Arm for rc1 is RTH's fix for the KVM SVE probe code.
 though you could call adding the missing local timer
 support to bcm2836_control a new feature I suppose --
 in any case it's a small and localised change.
-thanks
 -- PMM
-The following changes since commit 7074ab12c81a1b2b1e0e1c40983f56b2c5ccc494:
+The following changes since commit 4e06b3fc1b5e1ec03f22190eabe56891dc9c2236:
-  Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-03-14 16:19:37 +0000)
+  Merge tag 'pull-hex-20220731' of https://github.com/quic/qemu into staging (2022-07-31 21:38:54 -0700)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190315
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220801
-for you to fetch changes up to 5de56742a3c91de3d646326bec43a989bba83ca4:
+for you to fetch changes up to 5265d24c981dfdda8d29b44f7e84a514da75eedc:
-  target/arm: Check access permission to ADDVL/ADDPL/RDVL (2019-03-15 11:12:29 +0000)
+  target/arm: Move sve probe inside kvm >= 4.15 branch (2022-08-01 16:21:18 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * Add missing SVE-enabled check to ADDVL/ADDPL/RDVL
+ * Fix KVM SVE ID register probe code
  * virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
  * virt-acpi-build: Fix SMMUv3 GSIV values
  * Allow EL0 to write to arch timer registers, not just read them
  * bcm2836_control: Implement local timer
 ----------------------------------------------------------------
-Amir Charif (1):
+Richard Henderson (3):
-      target/arm: Check access permission to ADDVL/ADDPL/RDVL
+      target/arm: Use kvm_arm_sve_supported in kvm_arm_get_host_cpu_features
       target/arm: Set KVM_ARM_VCPU_SVE while probing the host
       target/arm: Move sve probe inside kvm >= 4.15 branch
-Dongjiu Geng (1):
+ target/arm/kvm64.c | 45 ++++++++++++++++++++++-----------------------
-      target/arm: change arch timer registers access permission
+file changed, 22 insertions(+), 23 deletions(-)
 Eric Auger (1):
       hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values
 Wei Yang (1):
       hw/arm/virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
 Zoltán Baldaszti (1):
       hw/intc/bcm2836_control: Implement local timer
  include/hw/intc/bcm2836_control.h |   9 ++++
  hw/arm/virt-acpi-build.c          |   6 +--
  hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++++++++++-
  target/arm/helper.c               |  30 +++++------
  target/arm/translate-sve.c        |  22 ++++++---
 files changed, 140 insertions(+), 28 deletions(-)

-[Qemu-devel] [PULL 2/5] hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values
+[PULL 1/3] target/arm: Use kvm_arm_sve_supported in kvm_arm_get_host_cpu_features
-From: Eric Auger <eric.auger@redhat.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The GSIV numbers of the SPI based interrupts is not correct as
+Indication for support for SVE will not depend on whether we
-ARM_SPI_BASE was not added to the irqmap[VIRT_SMMU] value. So
+perform the query on the main kvm_state or the temp vcpu.
 this may collide with VIRTIO_MMIO irq window.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190312091031.5185-1-eric.auger@redhat.com
+Message-id: 20220726045828.53697-2-richard.henderson@linaro.org
-Reviewed-by: Shannon Zhao <shannon.zhaosl@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt-acpi-build.c | 2 +-
+ target/arm/kvm64.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
+--- a/target/arm/kvm64.c
-+++ b/hw/arm/virt-acpi-build.c
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-     its->identifiers[0] = 0; /* MADT translation_id */
+         }
+     }
-     if (vms->iommu == VIRT_IOMMU_SMMUV3) {
--        int irq =  vms->irqmap[VIRT_SMMU];
+-    sve_supported = ioctl(fdarray[0], KVM_CHECK_EXTENSION, KVM_CAP_ARM_SVE) > 0;
-+        int irq =  vms->irqmap[VIRT_SMMU] + ARM_SPI_BASE;
++    sve_supported = kvm_arm_sve_supported();
-         /* SMMUv3 node */
+     /* Add feature bits that can't appear until after VCPU init. */
-         smmu_offset = iort_node_offset + node_size;
+     if (sve_supported) {
 --
-.20.1
+.25.1

-[Qemu-devel] [PULL 3/5] target/arm: change arch timer registers access permission
+[PULL 2/3] target/arm: Set KVM_ARM_VCPU_SVE while probing the host
-From: Dongjiu Geng <gengdongjiu@huawei.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Some generic arch timer registers are Config-RW in the EL0,
+Because we weren't setting this flag, our probe of ID_AA64ZFR0
-which means the EL0 exception level can have write permission
+was always returning zero.  This also obviates the adjustment
-if it is appropriately configured.
+of ID_AA64PFR0, which had sanitized the SVE field.
-When VM access registers, QEMU firstly checks whether they have RW
+The effects of the bug are not visible, because the only thing that
-permission, then check whether it is appropriately configured.
+ID_AA64ZFR0 is used for within qemu at present is tcg translation.
-If they are defined to read only in EL0, even though they have been
+The other tests for SVE within KVM are via ID_AA64PFR0.SVE.
 appropriately configured, they still do not have write permission.
 So need to add the write permission according to ARMV8 spec when
 define it.
-Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com>
+Reported-by: Zenghui Yu <yuzenghui@huawei.com>
-Message-id: 1552395177-12608-1-git-send-email-gengdongjiu@huawei.com
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220726045828.53697-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 30 +++++++++++++++---------------
+ target/arm/kvm64.c | 27 +++++++++++++--------------
-file changed, 15 insertions(+), 15 deletions(-)
+file changed, 13 insertions(+), 14 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/kvm64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-     /* per-timer control */
+     bool sve_supported;
-     { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
+     bool pmu_supported = false;
-       .secure = ARM_CP_SECSTATE_NS,
+     uint64_t features = 0;
--      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+-    uint64_t t;
-+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
+     int err;
-       .accessfn = gt_ptimer_access,
-       .fieldoffset = offsetoflow32(CPUARMState,
+     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
-                                    cp15.c14_timer[GTIMER_PHYS].ctl),
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
+     struct kvm_vcpu_init init = { .target = -1, };
-     { .name = "CNTP_CTL_S",
-       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
+     /*
-       .secure = ARM_CP_SECSTATE_S,
+-     * Ask for Pointer Authentication if supported. We can't play the
--      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+-     * SVE trick of synthesising the ID reg as KVM won't tell us
-+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
+-     * whether we have the architected or IMPDEF version of PAuth, so
-       .accessfn = gt_ptimer_access,
+-     * we have to use the actual ID regs.
-       .fieldoffset = offsetoflow32(CPUARMState,
++     * Ask for SVE if supported, so that we can query ID_AA64ZFR0,
-                                    cp15.c14_timer[GTIMER_SEC].ctl),
++     * which is otherwise RAZ.
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
++     */
-     },
++    sve_supported = kvm_arm_sve_supported();
-     { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
++    if (sve_supported) {
-       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
++        init.features[0] |= 1 << KVM_ARM_VCPU_SVE;
--      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
++    }
-+      .type = ARM_CP_IO, .access = PL0_RW,
++
-       .accessfn = gt_ptimer_access,
++    /*
-       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
++     * Ask for Pointer Authentication if supported, so that we get
-       .resetvalue = 0,
++     * the unsanitized field values for AA64ISAR1_EL1.
-       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
+      */
-     },
+     if (kvm_arm_pauth_supported()) {
-     { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
+         init.features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS |
--      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
+         }
-       .accessfn = gt_vtimer_access,
+     }
-       .fieldoffset = offsetoflow32(CPUARMState,
-                                    cp15.c14_timer[GTIMER_VIRT].ctl),
+-    sve_supported = kvm_arm_sve_supported();
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
+-
-     },
+-    /* Add feature bits that can't appear until after VCPU init. */
-     { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
+     if (sve_supported) {
-       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
+-        t = ahcf->isar.id_aa64pfr0;
--      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
+-        t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-+      .type = ARM_CP_IO, .access = PL0_RW,
+-        ahcf->isar.id_aa64pfr0 = t;
-       .accessfn = gt_vtimer_access,
+-
-       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
+         /*
-       .resetvalue = 0,
+          * There is a range of kernels between kernel commit 73433762fcae
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
+          * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
-     /* TimerValue views: a 32 bit downcounting view of the underlying state */
+          * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
-     { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
+-         * SVE support, so we only read it here, rather than together with all
-       .secure = ARM_CP_SECSTATE_NS,
+-         * the other ID registers earlier.
--      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
++         * SVE support, which resulted in an error rather than RAZ.
-+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
++         * So only read the register if we set KVM_ARM_VCPU_SVE above.
-       .accessfn = gt_ptimer_access,
+          */
-       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
+         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
-     },
+                               ARM64_SYS_REG(3, 0, 0, 4, 4));
      { .name = "CNTP_TVAL_S",
        .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
        .secure = ARM_CP_SECSTATE_S,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_ptimer_access,
        .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
      },
      { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
        .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
      },
      { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_vtimer_access,
        .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
      },
      { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
        .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
      },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      /* Comparison value, indicating when the timer goes off */
      { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
        .secure = ARM_CP_SECSTATE_NS,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
        .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
        .secure = ARM_CP_SECSTATE_S,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
        .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_IO,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
        .resetvalue = 0, .accessfn = gt_ptimer_access,
        .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
      },
      { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
        .accessfn = gt_vtimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_IO,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
        .resetvalue = 0, .accessfn = gt_vtimer_access,
 --
-.20.1
+.25.1

-[Qemu-devel] [PULL 1/5] hw/intc/bcm2836_control: Implement local timer
+[PULL 3/3] target/arm: Move sve probe inside kvm >= 4.15 branch
-From: Zoltán Baldaszti <bztemail@gmail.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-The BCM2836 control logic module includes a simple
+The test for the IF block indicates no ID registers are exposed, much
-"local timer" which is a programmable down-counter that
+less host support for SVE.  Move the SVE probe into the ELSE block.
 can generates an interrupt. Implement this functionality.
-Signed-off-by: Zoltán Baldaszti <bztemail@gmail.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-[PMM: wrote commit message; wrapped long line; tweaked
+Message-id: 20220726045828.53697-4-richard.henderson@linaro.org
  some comments to match the final version of the code]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/intc/bcm2836_control.h |   9 +++
+ target/arm/kvm64.c | 22 +++++++++++-----------
- hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++-
+file changed, 11 insertions(+), 11 deletions(-)
 files changed, 108 insertions(+), 2 deletions(-)
-diff --git a/include/hw/intc/bcm2836_control.h b/include/hw/intc/bcm2836_control.h
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/bcm2836_control.h
+--- a/target/arm/kvm64.c
-+++ b/include/hw/intc/bcm2836_control.h
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-  * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
+             err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
-  * Written by Andrew Baumann
+                                   ARM64_SYS_REG(3, 3, 9, 12, 0));
-  *
+         }
-+ * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
+-    }
-+ * Added basic IRQ_TIMER interrupt support
-+ *
+-    if (sve_supported) {
-  * This code is licensed under the GNU GPLv2 and later.
+-        /*
-  */
+-         * There is a range of kernels between kernel commit 73433762fcae
+-         * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
-@@ -XXX,XX +XXX,XX @@
+-         * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
- #define BCM2836_CONTROL_H
+-         * SVE support, which resulted in an error rather than RAZ.
+-         * So only read the register if we set KVM_ARM_VCPU_SVE above.
- #include "hw/sysbus.h"
+-         */
-+#include "qemu/timer.h"
+-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
+-                              ARM64_SYS_REG(3, 0, 0, 4, 4));
- /* 4 mailboxes per core, for 16 total */
++        if (sve_supported) {
- #define BCM2836_NCORES 4
++            /*
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836ControlState {
++             * There is a range of kernels between kernel commit 73433762fcae
-     bool gpu_irq, gpu_fiq;
++             * and f81cb2c3ad41 which have a bug where the kernel doesn't
-     uint8_t timerirqs[BCM2836_NCORES];
++             * expose SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has
++             * enabled SVE support, which resulted in an error rather than RAZ.
-+    /* local timer */
++             * So only read the register if we set KVM_ARM_VCPU_SVE above.
-+    QEMUTimer timer;
++             */
-+    uint32_t local_timer_control;
++            err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
-+    uint8_t route_localtimer;
++                                  ARM64_SYS_REG(3, 0, 0, 4, 4));
-+
++        }
      /* interrupt source registers, post-routing (also input-derived; visible) */
      uint32_t irqsrc[BCM2836_NCORES];
      uint32_t fiqsrc[BCM2836_NCORES];
 diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/bcm2836_control.c
 +++ b/hw/intc/bcm2836_control.c
@@ -XXX,XX +XXX,XX @@
   * This code is licensed under the GNU GPLv2 and later.
   *
   * At present, only implements interrupt routing, and mailboxes (i.e.,
 - * not local timer, PMU interrupt, or AXI counters).
 + * not PMU interrupt, or AXI counters).
 + *
 + * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
   *
   * Ref:
   * https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2836/QA7_rev3.4.pdf
@@ -XXX,XX +XXX,XX @@
  #include "qemu/log.h"
  #define REG_GPU_ROUTE           0x0c
 +#define REG_LOCALTIMERROUTING   0x24
 +#define REG_LOCALTIMERCONTROL   0x34
 +#define REG_LOCALTIMERACK       0x38
  #define REG_TIMERCONTROL        0x40
  #define REG_MBOXCONTROL         0x50
  #define REG_IRQSRC              0x60
@@ -XXX,XX +XXX,XX @@
  #define IRQ_TIMER       11
  #define IRQ_MAX         IRQ_TIMER
 +#define LOCALTIMER_FREQ      38400000
 +#define LOCALTIMER_INTFLAG   (1 << 31)
 +#define LOCALTIMER_RELOAD    (1 << 30)
 +#define LOCALTIMER_INTENABLE (1 << 29)
 +#define LOCALTIMER_ENABLE    (1 << 28)
 +#define LOCALTIMER_VALUE(x)  ((x) & 0xfffffff)
 +
  static void deliver_local(BCM2836ControlState *s, uint8_t core, uint8_t irq,
                            uint32_t controlreg, uint8_t controlidx)
  {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_update(BCM2836ControlState *s)
          s->fiqsrc[s->route_gpu_fiq] |= (uint32_t)1 << IRQ_GPU;
      }
-+    /*
+     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 +     * handle the control module 'local timer' interrupt for one of the
 +     * cores' IRQ/FIQ;  this is distinct from the per-CPU timer
 +     * interrupts handled below.
 +     */
 +    if ((s->local_timer_control & LOCALTIMER_INTENABLE) &&
 +        (s->local_timer_control & LOCALTIMER_INTFLAG)) {
 +        if (s->route_localtimer & 4) {
 +            s->fiqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
 +        } else {
 +            s->irqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
 +        }
 +    }
 +
      for (i = 0; i < BCM2836_NCORES; i++) {
          /* handle local timer interrupts for this core */
          if (s->timerirqs[i]) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_set_gpu_fiq(void *opaque, int irq, int level)
      bcm2836_control_update(s);
  }
 +static void bcm2836_control_local_timer_set_next(void *opaque)
 +{
 +    BCM2836ControlState *s = opaque;
 +    uint64_t next_event;
 +
 +    assert(LOCALTIMER_VALUE(s->local_timer_control) > 0);
 +
 +    next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
 +        muldiv64(LOCALTIMER_VALUE(s->local_timer_control),
 +            NANOSECONDS_PER_SECOND, LOCALTIMER_FREQ);
 +    timer_mod(&s->timer, next_event);
 +}
 +
 +static void bcm2836_control_local_timer_tick(void *opaque)
 +{
 +    BCM2836ControlState *s = opaque;
 +
 +    bcm2836_control_local_timer_set_next(s);
 +
 +    s->local_timer_control |= LOCALTIMER_INTFLAG;
 +    bcm2836_control_update(s);
 +}
 +
 +static void bcm2836_control_local_timer_control(void *opaque, uint32_t val)
 +{
 +    BCM2836ControlState *s = opaque;
 +
 +    s->local_timer_control = val;
 +    if (val & LOCALTIMER_ENABLE) {
 +        bcm2836_control_local_timer_set_next(s);
 +    } else {
 +        timer_del(&s->timer);
 +    }
 +}
 +
 +static void bcm2836_control_local_timer_ack(void *opaque, uint32_t val)
 +{
 +    BCM2836ControlState *s = opaque;
 +
 +    if (val & LOCALTIMER_INTFLAG) {
 +        s->local_timer_control &= ~LOCALTIMER_INTFLAG;
 +    }
 +    if ((val & LOCALTIMER_RELOAD) &&
 +        (s->local_timer_control & LOCALTIMER_ENABLE)) {
 +            bcm2836_control_local_timer_set_next(s);
 +    }
 +}
 +
  static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
  {
      BCM2836ControlState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
          assert(s->route_gpu_fiq < BCM2836_NCORES
                 && s->route_gpu_irq < BCM2836_NCORES);
          return ((uint32_t)s->route_gpu_fiq << 2) | s->route_gpu_irq;
 +    } else if (offset == REG_LOCALTIMERROUTING) {
 +        return s->route_localtimer;
 +    } else if (offset == REG_LOCALTIMERCONTROL) {
 +        return s->local_timer_control;
 +    } else if (offset == REG_LOCALTIMERACK) {
 +        return 0;
      } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
          return s->timercontrol[(offset - REG_TIMERCONTROL) >> 2];
      } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_write(void *opaque, hwaddr offset,
      if (offset == REG_GPU_ROUTE) {
          s->route_gpu_irq = val & 0x3;
          s->route_gpu_fiq = (val >> 2) & 0x3;
 +    } else if (offset == REG_LOCALTIMERROUTING) {
 +        s->route_localtimer = val & 7;
 +    } else if (offset == REG_LOCALTIMERCONTROL) {
 +        bcm2836_control_local_timer_control(s, val);
 +    } else if (offset == REG_LOCALTIMERACK) {
 +        bcm2836_control_local_timer_ack(s, val);
      } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
          s->timercontrol[(offset - REG_TIMERCONTROL) >> 2] = val & 0xff;
      } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_reset(DeviceState *d)
      s->route_gpu_irq = s->route_gpu_fiq = 0;
 +    timer_del(&s->timer);
 +    s->route_localtimer = 0;
 +    s->local_timer_control = 0;
 +
      for (i = 0; i < BCM2836_NCORES; i++) {
          s->timercontrol[i] = 0;
          s->mailboxcontrol[i] = 0;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_init(Object *obj)
      /* outputs to CPU cores */
      qdev_init_gpio_out_named(dev, s->irq, "irq", BCM2836_NCORES);
      qdev_init_gpio_out_named(dev, s->fiq, "fiq", BCM2836_NCORES);
 +
 +    /* create a qemu virtual timer */
 +    timer_init_ns(&s->timer, QEMU_CLOCK_VIRTUAL,
 +                  bcm2836_control_local_timer_tick, s);
  }
  static const VMStateDescription vmstate_bcm2836_control = {
      .name = TYPE_BCM2836_CONTROL,
 -    .version_id = 1,
 +    .version_id = 2,
      .minimum_version_id = 1,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32_ARRAY(mailboxes, BCM2836ControlState,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_bcm2836_control = {
          VMSTATE_UINT32_ARRAY(timercontrol, BCM2836ControlState, BCM2836_NCORES),
          VMSTATE_UINT32_ARRAY(mailboxcontrol, BCM2836ControlState,
                               BCM2836_NCORES),
 +        VMSTATE_TIMER_V(timer, BCM2836ControlState, 2),
 +        VMSTATE_UINT32_V(local_timer_control, BCM2836ControlState, 2),
 +        VMSTATE_UINT8_V(route_localtimer, BCM2836ControlState, 2),
          VMSTATE_END_OF_LIST()
      }
  };
 --
-.20.1
+.25.1

-[Qemu-devel] [PULL 4/5] hw/arm/virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
+Deleted patch
-From: Wei Yang <richardw.yang@linux.intel.com>
-This is more proper to use PCIE_MMCFG_BUS to retrieve end_bus_number.
-Signed-off-by: Wei Yang <richardw.yang@linux.intel.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Message-id: 20190312074953.16671-1-richardw.yang@linux.intel.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/virt-acpi-build.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
-+++ b/hw/arm/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@ build_mcfg(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
-     /* Only a single allocation so no need to play with segments */
-     mcfg->allocation[0].pci_segment = cpu_to_le16(0);
-     mcfg->allocation[0].start_bus_number = 0;
--    mcfg->allocation[0].end_bus_number = (memmap[ecam_id].size
--                                          / PCIE_MMCFG_SIZE_MIN) - 1;
-+    mcfg->allocation[0].end_bus_number =
-+        PCIE_MMCFG_BUS(memmap[ecam_id].size - 1);
-     build_header(linker, table_data, (void *)(table_data->data + mcfg_start),
-                  "MCFG", table_data->len - mcfg_start, 1, NULL, NULL);
---
-.20.1

-[Qemu-devel] [PULL 5/5] target/arm: Check access permission to ADDVL/ADDPL/RDVL
+Deleted patch
-From: Amir Charif <amir.charif@cea.fr>
-These instructions do not trap when SVE is disabled in EL0,
-causing them to be executed with wrong size information.
-Signed-off-by: Amir Charif <amir.charif@cea.fr>
-Message-id: 1552579248-31025-1-git-send-email-amir.charif@cea.fr
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: added 'target/arm' prefix to subject]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-sve.c | 22 ++++++++++++++--------
-file changed, 14 insertions(+), 8 deletions(-)
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
-+++ b/target/arm/translate-sve.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_INDEX_rr(DisasContext *s, arg_INDEX_rr *a)
- static bool trans_ADDVL(DisasContext *s, arg_ADDVL *a)
- {
--    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
--    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
--    tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
-+    if (sve_access_check(s)) {
-+        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
-+        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
-+        tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
-+    }
-     return true;
- }
- static bool trans_ADDPL(DisasContext *s, arg_ADDPL *a)
- {
--    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
--    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
--    tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
-+    if (sve_access_check(s)) {
-+        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
-+        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
-+        tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
-+    }
-     return true;
- }
- static bool trans_RDVL(DisasContext *s, arg_RDVL *a)
- {
--    TCGv_i64 reg = cpu_reg(s, a->rd);
--    tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
-+    if (sve_access_check(s)) {
-+        TCGv_i64 reg = cpu_reg(s, a->rd);
-+        tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
-+    }
-     return true;
- }
---
-.20.1

A last arm pullreq before rc0. This is mostly bug fixes,
though you could call adding the missing local timer
support to bcm2836_control a new feature I suppose --
in any case it's a small and localised change.

thanks
-- PMM

The following changes since commit 7074ab12c81a1b2b1e0e1c40983f56b2c5ccc494:

Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-03-14 16:19:37 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190315

for you to fetch changes up to 5de56742a3c91de3d646326bec43a989bba83ca4:

target/arm: Check access permission to ADDVL/ADDPL/RDVL (2019-03-15 11:12:29 +0000)

----------------------------------------------------------------
target-arm queue:
 * Add missing SVE-enabled check to ADDVL/ADDPL/RDVL
 * virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
 * virt-acpi-build: Fix SMMUv3 GSIV values
 * Allow EL0 to write to arch timer registers, not just read them
 * bcm2836_control: Implement local timer

----------------------------------------------------------------
Amir Charif (1):
      target/arm: Check access permission to ADDVL/ADDPL/RDVL

Dongjiu Geng (1):
      target/arm: change arch timer registers access permission

Eric Auger (1):
      hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values

Wei Yang (1):
      hw/arm/virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number

Zoltán Baldaszti (1):
      hw/intc/bcm2836_control: Implement local timer

include/hw/intc/bcm2836_control.h |   9 ++++
 hw/arm/virt-acpi-build.c          |   6 +--
 hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++++++++++-
 target/arm/helper.c               |  30 +++++------
 target/arm/translate-sve.c        |  22 ++++++---
 5 files changed, 140 insertions(+), 28 deletions(-)

From: Zoltán Baldaszti <bztemail@gmail.com>

The BCM2836 control logic module includes a simple
"local timer" which is a programmable down-counter that
can generates an interrupt. Implement this functionality.

Signed-off-by: Zoltán Baldaszti <bztemail@gmail.com>
[PMM: wrote commit message; wrapped long line; tweaked
 some comments to match the final version of the code]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/intc/bcm2836_control.h |   9 +++
 hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++-
 2 files changed, 108 insertions(+), 2 deletions(-)

diff --git a/include/hw/intc/bcm2836_control.h b/include/hw/intc/bcm2836_control.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/bcm2836_control.h
+++ b/include/hw/intc/bcm2836_control.h
@@ -XXX,XX +XXX,XX @@
  * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
  * Written by Andrew Baumann
  *
+ * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
+ * Added basic IRQ_TIMER interrupt support
+ *
  * This code is licensed under the GNU GPLv2 and later.
  */
 
@@ -XXX,XX +XXX,XX @@
 #define BCM2836_CONTROL_H
 
 #include "hw/sysbus.h"
+#include "qemu/timer.h"
 
 /* 4 mailboxes per core, for 16 total */
 #define BCM2836_NCORES 4
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836ControlState {
     bool gpu_irq, gpu_fiq;
     uint8_t timerirqs[BCM2836_NCORES];
 
+    /* local timer */
+    QEMUTimer timer;
+    uint32_t local_timer_control;
+    uint8_t route_localtimer;
+
     /* interrupt source registers, post-routing (also input-derived; visible) */
     uint32_t irqsrc[BCM2836_NCORES];
     uint32_t fiqsrc[BCM2836_NCORES];
diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/bcm2836_control.c
+++ b/hw/intc/bcm2836_control.c
@@ -XXX,XX +XXX,XX @@
  * This code is licensed under the GNU GPLv2 and later.
  *
  * At present, only implements interrupt routing, and mailboxes (i.e.,
- * not local timer, PMU interrupt, or AXI counters).
+ * not PMU interrupt, or AXI counters).
+ *
+ * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
  *
  * Ref:
  * https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2836/QA7_rev3.4.pdf
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 
 #define REG_GPU_ROUTE           0x0c
+#define REG_LOCALTIMERROUTING   0x24
+#define REG_LOCALTIMERCONTROL   0x34
+#define REG_LOCALTIMERACK       0x38
 #define REG_TIMERCONTROL        0x40
 #define REG_MBOXCONTROL         0x50
 #define REG_IRQSRC              0x60
@@ -XXX,XX +XXX,XX @@
 #define IRQ_TIMER       11
 #define IRQ_MAX         IRQ_TIMER
 
+#define LOCALTIMER_FREQ      38400000
+#define LOCALTIMER_INTFLAG   (1 << 31)
+#define LOCALTIMER_RELOAD    (1 << 30)
+#define LOCALTIMER_INTENABLE (1 << 29)
+#define LOCALTIMER_ENABLE    (1 << 28)
+#define LOCALTIMER_VALUE(x)  ((x) & 0xfffffff)
+
 static void deliver_local(BCM2836ControlState *s, uint8_t core, uint8_t irq,
                           uint32_t controlreg, uint8_t controlidx)
 {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_update(BCM2836ControlState *s)
         s->fiqsrc[s->route_gpu_fiq] |= (uint32_t)1 << IRQ_GPU;
     }
 
+    /*
+     * handle the control module 'local timer' interrupt for one of the
+     * cores' IRQ/FIQ;  this is distinct from the per-CPU timer
+     * interrupts handled below.
+     */
+    if ((s->local_timer_control & LOCALTIMER_INTENABLE) &&
+        (s->local_timer_control & LOCALTIMER_INTFLAG)) {
+        if (s->route_localtimer & 4) {
+            s->fiqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
+        } else {
+            s->irqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
+        }
+    }
+
     for (i = 0; i < BCM2836_NCORES; i++) {
         /* handle local timer interrupts for this core */
         if (s->timerirqs[i]) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_set_gpu_fiq(void *opaque, int irq, int level)
     bcm2836_control_update(s);
 }
 
+static void bcm2836_control_local_timer_set_next(void *opaque)
+{
+    BCM2836ControlState *s = opaque;
+    uint64_t next_event;
+
+    assert(LOCALTIMER_VALUE(s->local_timer_control) > 0);
+
+    next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+        muldiv64(LOCALTIMER_VALUE(s->local_timer_control),
+            NANOSECONDS_PER_SECOND, LOCALTIMER_FREQ);
+    timer_mod(&s->timer, next_event);
+}
+
+static void bcm2836_control_local_timer_tick(void *opaque)
+{
+    BCM2836ControlState *s = opaque;
+
+    bcm2836_control_local_timer_set_next(s);
+
+    s->local_timer_control |= LOCALTIMER_INTFLAG;
+    bcm2836_control_update(s);
+}
+
+static void bcm2836_control_local_timer_control(void *opaque, uint32_t val)
+{
+    BCM2836ControlState *s = opaque;
+
+    s->local_timer_control = val;
+    if (val & LOCALTIMER_ENABLE) {
+        bcm2836_control_local_timer_set_next(s);
+    } else {
+        timer_del(&s->timer);
+    }
+}
+
+static void bcm2836_control_local_timer_ack(void *opaque, uint32_t val)
+{
+    BCM2836ControlState *s = opaque;
+
+    if (val & LOCALTIMER_INTFLAG) {
+        s->local_timer_control &= ~LOCALTIMER_INTFLAG;
+    }
+    if ((val & LOCALTIMER_RELOAD) &&
+        (s->local_timer_control & LOCALTIMER_ENABLE)) {
+            bcm2836_control_local_timer_set_next(s);
+    }
+}
+
 static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
 {
     BCM2836ControlState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
         assert(s->route_gpu_fiq < BCM2836_NCORES
                && s->route_gpu_irq < BCM2836_NCORES);
         return ((uint32_t)s->route_gpu_fiq << 2) | s->route_gpu_irq;
+    } else if (offset == REG_LOCALTIMERROUTING) {
+        return s->route_localtimer;
+    } else if (offset == REG_LOCALTIMERCONTROL) {
+        return s->local_timer_control;
+    } else if (offset == REG_LOCALTIMERACK) {
+        return 0;
     } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
         return s->timercontrol[(offset - REG_TIMERCONTROL) >> 2];
     } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_write(void *opaque, hwaddr offset,
     if (offset == REG_GPU_ROUTE) {
         s->route_gpu_irq = val & 0x3;
         s->route_gpu_fiq = (val >> 2) & 0x3;
+    } else if (offset == REG_LOCALTIMERROUTING) {
+        s->route_localtimer = val & 7;
+    } else if (offset == REG_LOCALTIMERCONTROL) {
+        bcm2836_control_local_timer_control(s, val);
+    } else if (offset == REG_LOCALTIMERACK) {
+        bcm2836_control_local_timer_ack(s, val);
     } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
         s->timercontrol[(offset - REG_TIMERCONTROL) >> 2] = val & 0xff;
     } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_reset(DeviceState *d)
 
     s->route_gpu_irq = s->route_gpu_fiq = 0;
 
+    timer_del(&s->timer);
+    s->route_localtimer = 0;
+    s->local_timer_control = 0;
+
     for (i = 0; i < BCM2836_NCORES; i++) {
         s->timercontrol[i] = 0;
         s->mailboxcontrol[i] = 0;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_init(Object *obj)
     /* outputs to CPU cores */
     qdev_init_gpio_out_named(dev, s->irq, "irq", BCM2836_NCORES);
     qdev_init_gpio_out_named(dev, s->fiq, "fiq", BCM2836_NCORES);
+
+    /* create a qemu virtual timer */
+    timer_init_ns(&s->timer, QEMU_CLOCK_VIRTUAL,
+                  bcm2836_control_local_timer_tick, s);
 }
 
 static const VMStateDescription vmstate_bcm2836_control = {
     .name = TYPE_BCM2836_CONTROL,
-    .version_id = 1,
+    .version_id = 2,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(mailboxes, BCM2836ControlState,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_bcm2836_control = {
         VMSTATE_UINT32_ARRAY(timercontrol, BCM2836ControlState, BCM2836_NCORES),
         VMSTATE_UINT32_ARRAY(mailboxcontrol, BCM2836ControlState,
                              BCM2836_NCORES),
+        VMSTATE_TIMER_V(timer, BCM2836ControlState, 2),
+        VMSTATE_UINT32_V(local_timer_control, BCM2836ControlState, 2),
+        VMSTATE_UINT8_V(route_localtimer, BCM2836ControlState, 2),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

The GSIV numbers of the SPI based interrupts is not correct as
ARM_SPI_BASE was not added to the irqmap[VIRT_SMMU] value. So
this may collide with VIRTIO_MMIO irq window.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20190312091031.5185-1-eric.auger@redhat.com
Reviewed-by: Shannon Zhao <shannon.zhaosl@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: Dongjiu Geng <gengdongjiu@huawei.com>

Some generic arch timer registers are Config-RW in the EL0,
which means the EL0 exception level can have write permission
if it is appropriately configured.

When VM access registers, QEMU firstly checks whether they have RW
permission, then check whether it is appropriately configured.
If they are defined to read only in EL0, even though they have been
appropriately configured, they still do not have write permission.
So need to add the write permission according to ARMV8 spec when
define it.

Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com>
Message-id: 1552395177-12608-1-git-send-email-gengdongjiu@huawei.com
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     /* per-timer control */
     { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
       .secure = ARM_CP_SECSTATE_NS,
-      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .fieldoffset = offsetoflow32(CPUARMState,
                                    cp15.c14_timer[GTIMER_PHYS].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     { .name = "CNTP_CTL_S",
       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
       .secure = ARM_CP_SECSTATE_S,
-      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .fieldoffset = offsetoflow32(CPUARMState,
                                    cp15.c14_timer[GTIMER_SEC].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
-      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
       .resetvalue = 0,
       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
     },
     { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
-      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
       .accessfn = gt_vtimer_access,
       .fieldoffset = offsetoflow32(CPUARMState,
                                    cp15.c14_timer[GTIMER_VIRT].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
-      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_vtimer_access,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
       .resetvalue = 0,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     /* TimerValue views: a 32 bit downcounting view of the underlying state */
     { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
       .secure = ARM_CP_SECSTATE_NS,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
     },
     { .name = "CNTP_TVAL_S",
       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
       .secure = ARM_CP_SECSTATE_S,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
     },
     { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
     },
     { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_vtimer_access,
       .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
     },
     { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
       .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
     },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     /* Comparison value, indicating when the timer goes off */
     { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
       .secure = ARM_CP_SECSTATE_NS,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
       .secure = ARM_CP_SECSTATE_S,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
       .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_IO,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .resetvalue = 0, .accessfn = gt_ptimer_access,
       .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
     },
     { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
       .accessfn = gt_vtimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_IO,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
       .resetvalue = 0, .accessfn = gt_vtimer_access,
-- 
2.20.1

From: Wei Yang <richardw.yang@linux.intel.com>

This is more proper to use PCIE_MMCFG_BUS to retrieve end_bus_number.

Signed-off-by: Wei Yang <richardw.yang@linux.intel.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20190312074953.16671-1-richardw.yang@linux.intel.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_mcfg(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     /* Only a single allocation so no need to play with segments */
     mcfg->allocation[0].pci_segment = cpu_to_le16(0);
     mcfg->allocation[0].start_bus_number = 0;
-    mcfg->allocation[0].end_bus_number = (memmap[ecam_id].size
-                                          / PCIE_MMCFG_SIZE_MIN) - 1;
+    mcfg->allocation[0].end_bus_number =
+        PCIE_MMCFG_BUS(memmap[ecam_id].size - 1);
 
     build_header(linker, table_data, (void *)(table_data->data + mcfg_start),
                  "MCFG", table_data->len - mcfg_start, 1, NULL, NULL);
-- 
2.20.1

From: Amir Charif <amir.charif@cea.fr>

These instructions do not trap when SVE is disabled in EL0,
causing them to be executed with wrong size information.

Signed-off-by: Amir Charif <amir.charif@cea.fr>
Message-id: 1552579248-31025-1-git-send-email-amir.charif@cea.fr
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: added 'target/arm' prefix to subject]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_INDEX_rr(DisasContext *s, arg_INDEX_rr *a)
 
 static bool trans_ADDVL(DisasContext *s, arg_ADDVL *a)
 {
-    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
-    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
-    tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
+    if (sve_access_check(s)) {
+        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
+        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
+        tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
+    }
     return true;
 }
 
 static bool trans_ADDPL(DisasContext *s, arg_ADDPL *a)
 {
-    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
-    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
-    tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
+    if (sve_access_check(s)) {
+        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
+        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
+        tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
+    }
     return true;
 }
 
 static bool trans_RDVL(DisasContext *s, arg_RDVL *a)
 {
-    TCGv_i64 reg = cpu_reg(s, a->rd);
-    tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
+    if (sve_access_check(s)) {
+        TCGv_i64 reg = cpu_reg(s, a->rd);
+        tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
+    }
     return true;
 }
 
-- 
2.20.1

Only thing for Arm for rc1 is RTH's fix for the KVM SVE probe code.

-- PMM

The following changes since commit 4e06b3fc1b5e1ec03f22190eabe56891dc9c2236:

Merge tag 'pull-hex-20220731' of https://github.com/quic/qemu into staging (2022-07-31 21:38:54 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220801

for you to fetch changes up to 5265d24c981dfdda8d29b44f7e84a514da75eedc:

target/arm: Move sve probe inside kvm >= 4.15 branch (2022-08-01 16:21:18 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix KVM SVE ID register probe code

----------------------------------------------------------------
Richard Henderson (3):
      target/arm: Use kvm_arm_sve_supported in kvm_arm_get_host_cpu_features
      target/arm: Set KVM_ARM_VCPU_SVE while probing the host
      target/arm: Move sve probe inside kvm >= 4.15 branch

target/arm/kvm64.c | 45 ++++++++++++++++++++++-----------------------
 1 file changed, 22 insertions(+), 23 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Because we weren't setting this flag, our probe of ID_AA64ZFR0
was always returning zero.  This also obviates the adjustment
of ID_AA64PFR0, which had sanitized the SVE field.

The effects of the bug are not visible, because the only thing that
ID_AA64ZFR0 is used for within qemu at present is tcg translation.
The other tests for SVE within KVM are via ID_AA64PFR0.SVE.

Reported-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220726045828.53697-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     bool sve_supported;
     bool pmu_supported = false;
     uint64_t features = 0;
-    uint64_t t;
     int err;
 
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     struct kvm_vcpu_init init = { .target = -1, };
 
     /*
-     * Ask for Pointer Authentication if supported. We can't play the
-     * SVE trick of synthesising the ID reg as KVM won't tell us
-     * whether we have the architected or IMPDEF version of PAuth, so
-     * we have to use the actual ID regs.
+     * Ask for SVE if supported, so that we can query ID_AA64ZFR0,
+     * which is otherwise RAZ.
+     */
+    sve_supported = kvm_arm_sve_supported();
+    if (sve_supported) {
+        init.features[0] |= 1 << KVM_ARM_VCPU_SVE;
+    }
+
+    /*
+     * Ask for Pointer Authentication if supported, so that we get
+     * the unsanitized field values for AA64ISAR1_EL1.
      */
     if (kvm_arm_pauth_supported()) {
         init.features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS |
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         }
     }
 
-    sve_supported = kvm_arm_sve_supported();
-
-    /* Add feature bits that can't appear until after VCPU init. */
     if (sve_supported) {
-        t = ahcf->isar.id_aa64pfr0;
-        t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-        ahcf->isar.id_aa64pfr0 = t;
-
         /*
          * There is a range of kernels between kernel commit 73433762fcae
          * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
          * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
-         * SVE support, so we only read it here, rather than together with all
-         * the other ID registers earlier.
+         * SVE support, which resulted in an error rather than RAZ.
+         * So only read the register if we set KVM_ARM_VCPU_SVE above.
          */
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
                               ARM64_SYS_REG(3, 0, 0, 4, 4));
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The test for the IF block indicates no ID registers are exposed, much
less host support for SVE.  Move the SVE probe into the ELSE block.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220726045828.53697-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
             err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
                                   ARM64_SYS_REG(3, 3, 9, 12, 0));
         }
-    }
 
-    if (sve_supported) {
-        /*
-         * There is a range of kernels between kernel commit 73433762fcae
-         * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
-         * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
-         * SVE support, which resulted in an error rather than RAZ.
-         * So only read the register if we set KVM_ARM_VCPU_SVE above.
-         */
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
-                              ARM64_SYS_REG(3, 0, 0, 4, 4));
+        if (sve_supported) {
+            /*
+             * There is a range of kernels between kernel commit 73433762fcae
+             * and f81cb2c3ad41 which have a bug where the kernel doesn't
+             * expose SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has
+             * enabled SVE support, which resulted in an error rather than RAZ.
+             * So only read the register if we set KVM_ARM_VCPU_SVE above.
+             */
+            err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
+                                  ARM64_SYS_REG(3, 0, 0, 4, 4));
+        }
     }
 
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
-- 
2.25.1