Series comparison

-[PULL 00/16] target-arm queue
+[PULL 00/21] target-arm queue
-Patches for rc1: nothing major, just some minor bugfixes and
+Hi; here's the latest batch of arm changes. The big thing
-code cleanups.
+in here is the SMMUv3 changes to add stage-2 translation support.
+thanks
 -- PMM
-The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
+The following changes since commit aa9bbd865502ed517624ab6fe7d4b5d89ca95e43:
-  Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
+  Merge tag 'pull-ppc-20230528' of https://gitlab.com/danielhb/qemu into staging (2023-05-29 14:31:52 -0700)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230530
-for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
+for you to fetch changes up to b03d0d4f531a8b867e0aac1fab0b876903015680:
-  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
+  docs: sbsa: correct graphics card name (2023-05-30 13:32:46 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/Kconfig: ARM_V7M depends on PTIMER
+ * fsl-imx6: Add SNVS support for i.MX6 boards
- * Minor coding style fixes
+ * smmuv3: Add support for stage 2 translations
- * docs: add some notes on the sbsa-ref machine
+ * hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop
- * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+ * hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
- * target/arm: Fix neon VTBL/VTBX for len > 1
+ * cleanups for recent Kconfig changes
- * hw/arm/armsse: Correct expansion MPC interrupt lines
+ * target/arm: Explicitly select short-format FSR for M-profile
- * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+ * tests/qtest: Run arm-specific tests only if the required machine is available
- * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+ * hw/arm/sbsa-ref: add GIC node into DT
- * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
+ * docs: sbsa: correct graphics card name
- * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
+ * Update copyright dates to 2023
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Alex Bennée (1):
+Clément Chigot (1):
-      docs: add some notes on the sbsa-ref machine
+      hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
-AlexChen (1):
+Enze Li (1):
-      ssi: Fix bad printf format specifiers
+      Update copyright dates to 2023
-Andrew Jones (1):
+Fabiano Rosas (3):
-      hw/arm/Kconfig: ARM_V7M depends on PTIMER
+      target/arm: Explain why we need to select ARM_V7M
       arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
       arm/Kconfig: Make TCG dependence explicit
-Havard Skinnemoen (1):
+Marcin Juszkiewicz (2):
-      tests/qtest/npcm7xx_rng-test: count runs properly
+      hw/arm/sbsa-ref: add GIC node into DT
       docs: sbsa: correct graphics card name
-Peter Maydell (2):
+Mostafa Saleh (10):
-      hw/arm/nseries: Check return value from load_image_targphys()
+      hw/arm/smmuv3: Add missing fields for IDR0
-      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
+      hw/arm/smmuv3: Update translation config to hold stage-2
       hw/arm/smmuv3: Refactor stage-1 PTW
       hw/arm/smmuv3: Add page table walk for stage-2
       hw/arm/smmuv3: Parse STE config for stage-2
       hw/arm/smmuv3: Make TLB lookup work for stage-2
       hw/arm/smmuv3: Add VMID to TLB tagging
       hw/arm/smmuv3: Add CMDs related to stage-2
       hw/arm/smmuv3: Add stage-2 support in iova notifier
       hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2
-Philippe Mathieu-Daudé (6):
+Peter Maydell (1):
-      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+      target/arm: Explicitly select short-format FSR for M-profile
       hw/arm/armsse: Correct expansion MPC interrupt lines
       hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
       hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
       hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
       hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
-Richard Henderson (1):
+Thomas Huth (1):
-      target/arm: Fix neon VTBL/VTBX for len > 1
+      tests/qtest: Run arm-specific tests only if the required machine is available
-Xinhao Zhang (3):
+Tommy Wu (1):
-      target/arm: add spaces around operator
+      hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.
       target/arm: Don't use '#' flag of printf format
       target/arm: add space before the open parenthesis '('
- docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
+Vitaly Cheptsov (1):
- docs/system/target-arm.rst         |  1 +
+      fsl-imx6: Add SNVS support for i.MX6 boards
  include/hw/misc/stm32f2xx_syscfg.h |  2 --
  target/arm/helper.h                |  2 +-
  hw/arm/armsse.c                    |  3 +-
  hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
  hw/arm/nseries.c                   | 26 ++++++++----------
  hw/arm/stm32f205_soc.c             |  1 -
  hw/misc/stm32f2xx_syscfg.c         |  2 --
  hw/ssi/imx_spi.c                   |  2 +-
  hw/ssi/xilinx_spi.c                |  2 +-
  target/arm/arch_dump.c             |  8 +++---
  target/arm/arm-semi.c              |  8 +++---
  target/arm/helper.c                |  2 +-
  target/arm/op_helper.c             | 23 +++++++++-------
  target/arm/translate-a64.c         |  4 +--
  target/arm/translate.c             |  2 +-
  tests/qtest/npcm7xx_rng-test.c     |  2 +-
  hw/arm/Kconfig                     |  3 +-
  target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
 files changed, 123 insertions(+), 98 deletions(-)
  create mode 100644 docs/system/arm/sbsa.rst
+ docs/conf.py                                |   2 +-
+ docs/system/arm/sbsa.rst                    |   2 +-
+ configs/devices/aarch64-softmmu/default.mak |   6 +
+ configs/devices/arm-softmmu/default.mak     |  40 ++++
+ hw/arm/smmu-internal.h                      |  37 +++
+ hw/arm/smmuv3-internal.h                    |  12 +-
+ include/hw/arm/fsl-imx6.h                   |   2 +
+ include/hw/arm/smmu-common.h                |  45 +++-
+ include/hw/arm/smmuv3.h                     |   4 +
+ include/qemu/help-texts.h                   |   2 +-
+ hw/arm/fsl-imx6.c                           |   8 +
+ hw/arm/sbsa-ref.c                           |  19 +-
+ hw/arm/smmu-common.c                        | 209 ++++++++++++++--
+ hw/arm/smmuv3.c                             | 357 ++++++++++++++++++++++++----
+ hw/arm/xlnx-zynqmp.c                        |   2 +-
+ hw/dma/xilinx_axidma.c                      |  11 +-
+ target/arm/tcg/tlb_helper.c                 |  13 +-
+ hw/arm/Kconfig                              | 123 ++++++----
+ hw/arm/trace-events                         |  14 +-
+ target/arm/Kconfig                          |   3 +
+ tests/qtest/meson.build                     |   7 +-
+files changed, 773 insertions(+), 145 deletions(-)

-[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
+[PULL 01/21] fsl-imx6: Add SNVS support for i.MX6 boards
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Vitaly Cheptsov <cheptsov@ispras.ru>
-We don't need to fill the full pic[] array if we only use
+SNVS is supported on both i.MX6 and i.MX6UL and is needed
-few of the interrupt lines. Directly call qdev_get_gpio_in()
+to support shutdown on the board.
 when necessary.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Cc: Peter Maydell <peter.maydell@linaro.org> (odd fixer:SABRELITE / i.MX6)
-Message-id: 20201107193403.436146-6-f4bug@amsat.org
+Cc: Jean-Christophe Dubois <jcd@tribudubois.net> (reviewer:SABRELITE / i.MX6)
 Cc: qemu-arm@nongnu.org (open list:SABRELITE / i.MX6)
 Cc: qemu-devel@nongnu.org (open list:All patches CC here)
 Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>
 Message-id: 20230515095015.66860-1-cheptsov@ispras.ru
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/musicpal.c | 25 +++++++++++++------------
+ include/hw/arm/fsl-imx6.h | 2 ++
-file changed, 13 insertions(+), 12 deletions(-)
+ hw/arm/fsl-imx6.c         | 8 ++++++++
 files changed, 10 insertions(+)
-diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/musicpal.c
+--- a/include/hw/arm/fsl-imx6.h
-+++ b/hw/arm/musicpal.c
++++ b/include/hw/arm/fsl-imx6.h
-@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
+@@ -XXX,XX +XXX,XX @@
- static void musicpal_init(MachineState *machine)
+ #include "hw/cpu/a9mpcore.h"
- {
+ #include "hw/misc/imx6_ccm.h"
-     ARMCPU *cpu;
+ #include "hw/misc/imx6_src.h"
--    qemu_irq pic[32];
++#include "hw/misc/imx7_snvs.h"
-     DeviceState *dev;
+ #include "hw/watchdog/wdt_imx2.h"
-+    DeviceState *pic;
+ #include "hw/char/imx_serial.h"
-     DeviceState *uart_orgate;
+ #include "hw/timer/imx_gpt.h"
-     DeviceState *i2c_dev;
+@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
-     DeviceState *lcd_dev;
+     A9MPPrivState  a9mpcore;
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
+     IMX6CCMState   ccm;
-                            &error_fatal);
+     IMX6SRCState   src;
-     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
++    IMX7SNVSState  snvs;
+     IMXSerialState uart[FSL_IMX6_NUM_UARTS];
--    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+     IMXGPTState    gpt;
-+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+     IMXEPITState   epit[FSL_IMX6_NUM_EPITS];
-                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
+diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
--    for (i = 0; i < 32; i++) {
+index XXXXXXX..XXXXXXX 100644
--        pic[i] = qdev_get_gpio_in(dev, i);
+--- a/hw/arm/fsl-imx6.c
--    }
++++ b/hw/arm/fsl-imx6.c
--    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
--                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
--                          pic[MP_TIMER4_IRQ], NULL);
+     object_initialize_child(obj, "src", &s->src, TYPE_IMX6_SRC);
-+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
-+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
++    object_initialize_child(obj, "snvs", &s->snvs, TYPE_IMX7_SNVS);
-+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
++
-+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+     for (i = 0; i < FSL_IMX6_NUM_UARTS; i++) {
-+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
+         snprintf(name, NAME_SIZE, "uart%d", i + 1);
+         object_initialize_child(obj, name, &s->uart[i], TYPE_IMX_SERIAL);
-     /* Logically OR both UART IRQs together */
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
-     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+                        qdev_get_gpio_in(DEVICE(&s->a9mpcore),
-     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+                                         FSL_IMX6_ENET_MAC_1588_IRQ));
-     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
--    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
++    /*
-+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
++     * SNVS
-+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
++     */
++    sysbus_realize(SYS_BUS_DEVICE(&s->snvs), &error_abort);
-     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->snvs), 0, FSL_IMX6_SNVSHP_ADDR);
-                    qdev_get_gpio_in(uart_orgate, 0),
++
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
+     /*
-                              OBJECT(get_system_memory()), &error_fatal);
+      * Watchdog
-     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
+      */
      sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
 -    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
 +                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
      sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
      sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
      dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
 -                               pic[MP_GPIO_IRQ]);
 +                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
      i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
      i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                               NULL);
      sysbus_realize_and_unref(s, &error_fatal);
      sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
 -    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
 +    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
      musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
      arm_load_kernel(cpu, machine, &musicpal_binfo);
 --
-.20.1
+.34.1

-New patch
+[PULL 02/21] hw/arm/smmuv3: Add missing fields for IDR0
+From: Mostafa Saleh <smostafa@google.com>
+In preparation for adding stage-2 support.
+Add IDR0 fields related to stage-2.
+VMID16: 16-bit VMID supported.
+S2P: Stage-2 translation supported.
+They are described in 6.3.1 SMMU_IDR0.
+No functional change intended.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Message-id: 20230516203327.2051088-2-smostafa@google.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ hw/arm/smmuv3-internal.h | 2 ++
+file changed, 2 insertions(+)
+diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/smmuv3-internal.h
++++ b/hw/arm/smmuv3-internal.h
+@@ -XXX,XX +XXX,XX @@ typedef enum SMMUTranslationStatus {
+ /* MMIO Registers */
+ REG32(IDR0,                0x0)
++    FIELD(IDR0, S2P,         0 , 1)
+     FIELD(IDR0, S1P,         1 , 1)
+     FIELD(IDR0, TTF,         2 , 2)
+     FIELD(IDR0, COHACC,      4 , 1)
+     FIELD(IDR0, ASID16,      12, 1)
++    FIELD(IDR0, VMID16,      18, 1)
+     FIELD(IDR0, TTENDIAN,    21, 2)
+     FIELD(IDR0, STALL_MODEL, 24, 2)
+     FIELD(IDR0, TERM_MODEL,  26, 1)
+--
+.34.1

-New patch
+[PULL 03/21] hw/arm/smmuv3: Update translation config to hold stage-2
+From: Mostafa Saleh <smostafa@google.com>
+In preparation for adding stage-2 support, add a S2 config
+struct(SMMUS2Cfg), composed of the following fields and embedded in
+the main SMMUTransCfg:
+ -tsz: Size of IPA input region (S2T0SZ)
+ -sl0: Start level of translation (S2SL0)
+ -affd: AF Fault Disable (S2AFFD)
+ -record_faults: Record fault events (S2R)
+ -granule_sz: Granule page shift (based on S2TG)
+ -vmid: Virtual Machine ID (S2VMID)
+ -vttb: Address of translation table base (S2TTB)
+ -eff_ps: Effective PA output range (based on S2PS)
+They will be used in the next patches in stage-2 address translation.
+The fields in SMMUS2Cfg, are reordered to make the shared and stage-1
+fields next to each other, this reordering didn't change the struct
+size (104 bytes before and after).
+Stage-1 only fields: aa64, asid, tt, ttb, tbi, record_faults, oas.
+oas is stage-1 output address size. However, it is used to check
+input address in case stage-1 is unimplemented or bypassed according
+to SMMUv3 manual IHI0070.E "3.4. Address sizes"
+Shared fields: stage, disabled, bypassed, aborted, iotlb_*.
+No functional change intended.
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Message-id: 20230516203327.2051088-3-smostafa@google.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/hw/arm/smmu-common.h | 22 +++++++++++++++++++---
+file changed, 19 insertions(+), 3 deletions(-)
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/arm/smmu-common.h
++++ b/include/hw/arm/smmu-common.h
+@@ -XXX,XX +XXX,XX @@ typedef struct SMMUTLBEntry {
+     uint8_t granule;
+ } SMMUTLBEntry;
++/* Stage-2 configuration. */
++typedef struct SMMUS2Cfg {
++    uint8_t tsz;            /* Size of IPA input region (S2T0SZ) */
++    uint8_t sl0;            /* Start level of translation (S2SL0) */
++    bool affd;              /* AF Fault Disable (S2AFFD) */
++    bool record_faults;     /* Record fault events (S2R) */
++    uint8_t granule_sz;     /* Granule page shift (based on S2TG) */
++    uint8_t eff_ps;         /* Effective PA output range (based on S2PS) */
++    uint16_t vmid;          /* Virtual Machine ID (S2VMID) */
++    uint64_t vttb;          /* Address of translation table base (S2TTB) */
++} SMMUS2Cfg;
++
+ /*
+  * Generic structure populated by derived SMMU devices
+  * after decoding the configuration information and used as
+  * input to the page table walk
+  */
+ typedef struct SMMUTransCfg {
++    /* Shared fields between stage-1 and stage-2. */
+     int stage;                 /* translation stage */
+-    bool aa64;                 /* arch64 or aarch32 translation table */
+     bool disabled;             /* smmu is disabled */
+     bool bypassed;             /* translation is bypassed */
+     bool aborted;              /* translation is aborted */
++    uint32_t iotlb_hits;       /* counts IOTLB hits */
++    uint32_t iotlb_misses;     /* counts IOTLB misses*/
++    /* Used by stage-1 only. */
++    bool aa64;                 /* arch64 or aarch32 translation table */
+     bool record_faults;        /* record fault events */
+     uint64_t ttb;              /* TT base address */
+     uint8_t oas;               /* output address width */
+     uint8_t tbi;               /* Top Byte Ignore */
+     uint16_t asid;
+     SMMUTransTableInfo tt[2];
+-    uint32_t iotlb_hits;       /* counts IOTLB hits for this asid */
+-    uint32_t iotlb_misses;     /* counts IOTLB misses for this asid */
++    /* Used by stage-2 only. */
++    struct SMMUS2Cfg s2cfg;
+ } SMMUTransCfg;
+ typedef struct SMMUDevice {
+--
+.34.1

-[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
+[PULL 04/21] hw/arm/smmuv3: Refactor stage-1 PTW
-Checks for UNDEF cases should go before the "is VFP enabled?" access
+From: Mostafa Saleh <smostafa@google.com>
 check, except in special cases. Move a stray UNDEF check in the VTBL
 trans function up above the access check.
+In preparation for adding stage-2 support, rename smmu_ptw_64 to
+smmu_ptw_64_s1 and refactor some of the code so it can be reused in
+stage-2 page table walk.
+Remove AA64 check from PTW as decode_cd already ensures that AA64 is
+used, otherwise it faults with C_BAD_CD.
+A stage member is added to SMMUPTWEventInfo to differentiate
+between stage-1 and stage-2 ptw faults.
+Add stage argument to trace_smmu_ptw_level be consistent with other
+trace events.
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Message-id: 20230516203327.2051088-4-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
 ---
- target/arm/translate-neon.c.inc | 8 ++++----
+ include/hw/arm/smmu-common.h | 16 +++++++++++++---
-file changed, 4 insertions(+), 4 deletions(-)
+ hw/arm/smmu-common.c         | 27 ++++++++++-----------------
  hw/arm/smmuv3.c              |  2 ++
  hw/arm/trace-events          |  2 +-
 files changed, 26 insertions(+), 21 deletions(-)
-diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-neon.c.inc
+--- a/include/hw/arm/smmu-common.h
-+++ b/target/arm/translate-neon.c.inc
++++ b/include/hw/arm/smmu-common.h
-@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
+@@ -XXX,XX +XXX,XX @@
-         return false;
+ #include "hw/pci/pci.h"
  #include "qom/object.h"
 -#define SMMU_PCI_BUS_MAX      256
 -#define SMMU_PCI_DEVFN_MAX    256
 -#define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
 +#define SMMU_PCI_BUS_MAX                    256
 +#define SMMU_PCI_DEVFN_MAX                  256
 +#define SMMU_PCI_DEVFN(sid)                 (sid & 0xFF)
 +
 +/* VMSAv8-64 Translation constants and functions */
 +#define VMSA_LEVELS                         4
 +
 +#define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
 +#define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
 +                                             (VMSA_LEVELS - (lvl)))
 +#define VMSA_IDXMSK(isz, strd, lvl)         ((1ULL << \
 +                                             VMSA_BIT_LVL(isz, strd, lvl)) - 1)
  /*
   * Page table walk error types
@@ -XXX,XX +XXX,XX @@ typedef enum {
  } SMMUPTWEventType;
  typedef struct SMMUPTWEventInfo {
 +    int stage;
      SMMUPTWEventType type;
      dma_addr_t addr; /* fetched address that induced an abort, if any */
  } SMMUPTWEventInfo;
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
  }
  /**
 - * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
 + * smmu_ptw_64_s1 - VMSAv8-64 Walk of the page tables for a given IOVA
   * @cfg: translation config
   * @iova: iova to translate
   * @perm: access type
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
   * Upon success, @tlbe is filled with translated_addr and entry
   * permission rights.
   */
 -static int smmu_ptw_64(SMMUTransCfg *cfg,
 -                       dma_addr_t iova, IOMMUAccessFlags perm,
 -                       SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 +static int smmu_ptw_64_s1(SMMUTransCfg *cfg,
 +                          dma_addr_t iova, IOMMUAccessFlags perm,
 +                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
  {
      dma_addr_t baseaddr, indexmask;
      int stage = cfg->stage;
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
      }
--    if (!vfp_access_check(s)) {
+     granule_sz = tt->granule_sz;
--        return true;
+-    stride = granule_sz - 3;
 +    stride = VMSA_STRIDE(granule_sz);
      inputsize = 64 - tt->tsz;
      level = 4 - (inputsize - 4) / stride;
 -    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
 +    indexmask = VMSA_IDXMSK(inputsize, stride, level);
      baseaddr = extract64(tt->ttb, 0, 48);
      baseaddr &= ~indexmask;
 -    while (level <= 3) {
 +    while (level < VMSA_LEVELS) {
          uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
          uint64_t mask = subpage_size - 1;
          uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
          if (get_pte(baseaddr, offset, &pte, info)) {
                  goto error;
          }
 -        trace_smmu_ptw_level(level, iova, subpage_size,
 +        trace_smmu_ptw_level(stage, level, iova, subpage_size,
                               baseaddr, offset, pte);
          if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
      info->type = SMMU_PTW_ERR_TRANSLATION;
  error:
 +    info->stage = 1;
      tlbe->entry.perm = IOMMU_NONE;
      return -EINVAL;
  }
@@ -XXX,XX +XXX,XX @@ error:
  int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
               SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
  {
 -    if (!cfg->aa64) {
 -        /*
 -         * This code path is not entered as we check this while decoding
 -         * the configuration data in the derived SMMU model.
 -         */
 -        g_assert_not_reached();
 -    }
 -
-     if ((a->vn + a->len + 1) > 32) {
+-    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
-         /*
++    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
-          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
+ }
-@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
-         return false;
+ /**
-     }
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
+index XXXXXXX..XXXXXXX 100644
-+    if (!vfp_access_check(s)) {
+--- a/hw/arm/smmuv3.c
-+        return true;
++++ b/hw/arm/smmuv3.c
-+    }
+@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
-+
+     cached_entry = g_new0(SMMUTLBEntry, 1);
-     desc = tcg_const_i32((a->vn << 2) | a->len);
-     def = tcg_temp_new_i64();
+     if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) {
-     if (a->op) {
++        /* All faults from PTW has S2 field. */
 +        event.u.f_walk_eabt.s2 = (ptw_info.stage == 2);
          g_free(cached_entry);
          switch (ptw_info.type) {
          case SMMU_PTW_ERR_WALK_EABT:
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
  # smmu-common.c
  smmu_add_mr(const char *name) "%s"
 -smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
 +smmu_ptw_level(int stage, int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
  smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
  smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
  smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
 --
-.20.1
+.34.1

-New patch
+[PULL 05/21] hw/arm/smmuv3: Add page table walk for stage-2
+From: Mostafa Saleh <smostafa@google.com>
 In preparation for adding stage-2 support, add Stage-2 PTW code.
 Only Aarch64 format is supported as stage-1.
 Nesting stage-1 and stage-2 is not supported right now.
 HTTU is not supported, SW is expected to maintain the Access flag.
 This is described in the SMMUv3 manual(IHI 0070.E.a)
 "5.2. Stream Table Entry" in "[181] S2AFFD".
 This flag determines the behavior on access of a stage-2 page whose
 descriptor has AF == 0:
 - 0b0: An Access flag fault occurs (stall not supported).
 - 0b1: An Access flag fault never occurs.
 An Access fault takes priority over a Permission fault.
 There are 3 address size checks for stage-2 according to
 (IHI 0070.E.a) in "3.4. Address sizes".
 - As nesting is not supported, input address is passed directly to
 stage-2, and is checked against IAS.
 We use cfg->oas to hold the OAS when stage-1 is not used, this is set
 in the next patch.
 This check is done outside of smmu_ptw_64_s2 as it is not part of
 stage-2(it throws stage-1 fault), and the stage-2 function shouldn't
 change it's behavior when nesting is supported.
 When nesting is supported and we figure out how to combine TLB for
 stage-1 and stage-2 we can move this check into the stage-1 function
 as described in ARM DDI0487I.a in pseudocode
 aarch64/translation/vmsa_translation/AArch64.S1Translate
 aarch64/translation/vmsa_translation/AArch64.S1DisabledOutput
 - Input to stage-2 is checked against s2t0sz, and throws stage-2
 transaltion fault if exceeds it.
 - Output of stage-2 is checked against effective PA output range.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-5-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/smmu-internal.h |  35 ++++++++++
  hw/arm/smmu-common.c   | 142 ++++++++++++++++++++++++++++++++++++++++-
 files changed, 176 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-internal.h
 +++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@
  #define PTE_APTABLE(pte) \
      (extract64(pte, 61, 2))
 +#define PTE_AF(pte) \
 +    (extract64(pte, 10, 1))
  /*
   * TODO: At the moment all transactions are considered as privileged (EL1)
   * as IOMMU translation callback does not pass user/priv attributes.
@@ -XXX,XX +XXX,XX @@
  #define is_permission_fault(ap, perm) \
      (((perm) & IOMMU_WO) && ((ap) & 0x2))
 +#define is_permission_fault_s2(s2ap, perm) \
 +    (!(((s2ap) & (perm)) == (perm)))
 +
  #define PTE_AP_TO_PERM(ap) \
      (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
@@ -XXX,XX +XXX,XX @@ uint64_t iova_level_offset(uint64_t iova, int inputsize,
              MAKE_64BIT_MASK(0, gsz - 3);
  }
 +/* FEAT_LPA2 and FEAT_TTST are not implemented. */
 +static inline int get_start_level(int sl0 , int granule_sz)
 +{
 +    /* ARM DDI0487I.a: Table D8-12. */
 +    if (granule_sz == 12) {
 +        return 2 - sl0;
 +    }
 +    /* ARM DDI0487I.a: Table D8-22 and Table D8-31. */
 +    return 3 - sl0;
 +}
 +
 +/*
 + * Index in a concatenated first level stage-2 page table.
 + * ARM DDI0487I.a: D8.2.2 Concatenated translation tables.
 + */
 +static inline int pgd_concat_idx(int start_level, int granule_sz,
 +                                 dma_addr_t ipa)
 +{
 +    uint64_t ret;
 +    /*
 +     * Get the number of bits handled by next levels, then any extra bits in
 +     * the address should index the concatenated tables. This relation can be
 +     * deduced from tables in ARM DDI0487I.a: D8.2.7-9
 +     */
 +    int shift =  level_shift(start_level - 1, granule_sz);
 +
 +    ret = ipa >> shift;
 +    return ret;
 +}
 +
  #define SMMU_IOTLB_ASID(key) ((key).asid)
  typedef struct SMMUIOTLBPageInvInfo {
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ error:
      return -EINVAL;
  }
 +/**
 + * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa
 + * for stage-2.
 + * @cfg: translation config
 + * @ipa: ipa to translate
 + * @perm: access type
 + * @tlbe: SMMUTLBEntry (out)
 + * @info: handle to an error info
 + *
 + * Return 0 on success, < 0 on error. In case of error, @info is filled
 + * and tlbe->perm is set to IOMMU_NONE.
 + * Upon success, @tlbe is filled with translated_addr and entry
 + * permission rights.
 + */
 +static int smmu_ptw_64_s2(SMMUTransCfg *cfg,
 +                          dma_addr_t ipa, IOMMUAccessFlags perm,
 +                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 +{
 +    const int stage = 2;
 +    int granule_sz = cfg->s2cfg.granule_sz;
 +    /* ARM DDI0487I.a: Table D8-7. */
 +    int inputsize = 64 - cfg->s2cfg.tsz;
 +    int level = get_start_level(cfg->s2cfg.sl0, granule_sz);
 +    int stride = VMSA_STRIDE(granule_sz);
 +    int idx = pgd_concat_idx(level, granule_sz, ipa);
 +    /*
 +     * Get the ttb from concatenated structure.
 +     * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte))
 +     */
 +    uint64_t baseaddr = extract64(cfg->s2cfg.vttb, 0, 48) + (1 << stride) *
 +                                  idx * sizeof(uint64_t);
 +    dma_addr_t indexmask = VMSA_IDXMSK(inputsize, stride, level);
 +
 +    baseaddr &= ~indexmask;
 +
 +    /*
 +     * On input, a stage 2 Translation fault occurs if the IPA is outside the
 +     * range configured by the relevant S2T0SZ field of the STE.
 +     */
 +    if (ipa >= (1ULL << inputsize)) {
 +        info->type = SMMU_PTW_ERR_TRANSLATION;
 +        goto error;
 +    }
 +
 +    while (level < VMSA_LEVELS) {
 +        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
 +        uint64_t mask = subpage_size - 1;
 +        uint32_t offset = iova_level_offset(ipa, inputsize, level, granule_sz);
 +        uint64_t pte, gpa;
 +        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
 +        uint8_t s2ap;
 +
 +        if (get_pte(baseaddr, offset, &pte, info)) {
 +                goto error;
 +        }
 +        trace_smmu_ptw_level(stage, level, ipa, subpage_size,
 +                             baseaddr, offset, pte);
 +        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
 +            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
 +                                       pte_addr, offset, pte);
 +            break;
 +        }
 +
 +        if (is_table_pte(pte, level)) {
 +            baseaddr = get_table_pte_address(pte, granule_sz);
 +            level++;
 +            continue;
 +        } else if (is_page_pte(pte, level)) {
 +            gpa = get_page_pte_address(pte, granule_sz);
 +            trace_smmu_ptw_page_pte(stage, level, ipa,
 +                                    baseaddr, pte_addr, pte, gpa);
 +        } else {
 +            uint64_t block_size;
 +
 +            gpa = get_block_pte_address(pte, level, granule_sz,
 +                                        &block_size);
 +            trace_smmu_ptw_block_pte(stage, level, baseaddr,
 +                                     pte_addr, pte, ipa, gpa,
 +                                     block_size >> 20);
 +        }
 +
 +        /*
 +         * If S2AFFD and PTE.AF are 0 => fault. (5.2. Stream Table Entry)
 +         * An Access fault takes priority over a Permission fault.
 +         */
 +        if (!PTE_AF(pte) && !cfg->s2cfg.affd) {
 +            info->type = SMMU_PTW_ERR_ACCESS;
 +            goto error;
 +        }
 +
 +        s2ap = PTE_AP(pte);
 +        if (is_permission_fault_s2(s2ap, perm)) {
 +            info->type = SMMU_PTW_ERR_PERMISSION;
 +            goto error;
 +        }
 +
 +        /*
 +         * The address output from the translation causes a stage 2 Address
 +         * Size fault if it exceeds the effective PA output range.
 +         */
 +        if (gpa >= (1ULL << cfg->s2cfg.eff_ps)) {
 +            info->type = SMMU_PTW_ERR_ADDR_SIZE;
 +            goto error;
 +        }
 +
 +        tlbe->entry.translated_addr = gpa;
 +        tlbe->entry.iova = ipa & ~mask;
 +        tlbe->entry.addr_mask = mask;
 +        tlbe->entry.perm = s2ap;
 +        tlbe->level = level;
 +        tlbe->granule = granule_sz;
 +        return 0;
 +    }
 +    info->type = SMMU_PTW_ERR_TRANSLATION;
 +
 +error:
 +    info->stage = 2;
 +    tlbe->entry.perm = IOMMU_NONE;
 +    return -EINVAL;
 +}
 +
  /**
   * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
   *
@@ -XXX,XX +XXX,XX @@ error:
  int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
               SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
  {
 -    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
 +    if (cfg->stage == 1) {
 +        return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
 +    } else if (cfg->stage == 2) {
 +        /*
 +         * If bypassing stage 1(or unimplemented), the input address is passed
 +         * directly to stage 2 as IPA. If the input address of a transaction
 +         * exceeds the size of the IAS, a stage 1 Address Size fault occurs.
 +         * For AA64, IAS = OAS according to (IHI 0070.E.a) "3.4 Address sizes"
 +         */
 +        if (iova >= (1ULL << cfg->oas)) {
 +            info->type = SMMU_PTW_ERR_ADDR_SIZE;
 +            info->stage = 1;
 +            tlbe->entry.perm = IOMMU_NONE;
 +            return -EINVAL;
 +        }
 +
 +        return smmu_ptw_64_s2(cfg, iova, perm, tlbe, info);
 +    }
 +
 +    g_assert_not_reached();
  }
  /**
 --
 .34.1

-[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
+[PULL 06/21] hw/arm/smmuv3: Parse STE config for stage-2
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-The helper function did not get updated when we reorganized
+Parse stage-2 configuration from STE and populate it in SMMUS2Cfg.
-the vector register file for SVE.  Since then, the neon dregs
+Validity of field values are checked when possible.
-are non-sequential and cannot be simply indexed.
+Only AA64 tables are supported and Small Translation Tables (STT) are
-At the same time, make the helper function operate on 64-bit
+not supported.
-quantities so that we do not have to call it twice.
+According to SMMUv3 UM(IHI0070E) "5.2 Stream Table Entry": All fields
-Fixes: c39c2b9043e
+with an S2 prefix (with the exception of S2VMID) are IGNORED when
-Reported-by: Ard Biesheuvel <ardb@kernel.org>
+stage-2 bypasses translation (Config[1] == 0).
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-[PMM: use aa32_vfp_dreg() rather than opencoding]
+Which means that VMID can be used(for TLB tagging) even if stage-2 is
-Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
+bypassed, so we parse it unconditionally when S2P exists. Otherwise
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+it is set to -1.(only S1P)
 As stall is not supported, if S2S is set the translation would abort.
 For S2R, we reuse the same code used for stage-1 with flag
 record_faults. However when nested translation is supported we would
 need to separate stage-1 and stage-2 faults.
 Fix wrong shift in STE_S2HD, STE_S2HA, STE_S2S.
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 20230516203327.2051088-6-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h             |  2 +-
+ hw/arm/smmuv3-internal.h     |  10 +-
- target/arm/op_helper.c          | 23 +++++++++--------
+ include/hw/arm/smmu-common.h |   1 +
- target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
+ include/hw/arm/smmuv3.h      |   3 +
-files changed, 29 insertions(+), 40 deletions(-)
+ hw/arm/smmuv3.c              | 181 +++++++++++++++++++++++++++++++++--
+files changed, 185 insertions(+), 10 deletions(-)
-diff --git a/target/arm/helper.h b/target/arm/helper.h
 diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/hw/arm/smmuv3-internal.h
-+++ b/target/arm/helper.h
++++ b/hw/arm/smmuv3-internal.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
+@@ -XXX,XX +XXX,XX @@ typedef struct CD {
- DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
+ #define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
- DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
+ #define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
- DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
+ #define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
--DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+-#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
-+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
+-#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
+-#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
- DEF_HELPER_3(shl_cc, i32, env, i32, i32)
++#define STE_S2ENDI(x)      extract32((x)->word[5], 20, 1)
- DEF_HELPER_3(shr_cc, i32, env, i32, i32)
++#define STE_S2AFFD(x)      extract32((x)->word[5], 21, 1)
-diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
++#define STE_S2HD(x)        extract32((x)->word[5], 23, 1)
 +#define STE_S2HA(x)        extract32((x)->word[5], 24, 1)
 +#define STE_S2S(x)         extract32((x)->word[5], 25, 1)
 +#define STE_S2R(x)         extract32((x)->word[5], 26, 1)
 +
  #define STE_CTXPTR(x)                                           \
      ({                                                          \
          unsigned long addr;                                     \
 diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/op_helper.c
+--- a/include/hw/arm/smmu-common.h
-+++ b/target/arm/op_helper.c
++++ b/include/hw/arm/smmu-common.h
-@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
+@@ -XXX,XX +XXX,XX @@
-     cpu_loop_exit_restore(cs, ra);
  /* VMSAv8-64 Translation constants and functions */
  #define VMSA_LEVELS                         4
 +#define VMSA_MAX_S2_CONCAT                  16
  #define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
  #define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
 diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/smmuv3.h
 +++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@ struct SMMUv3Class {
  #define TYPE_ARM_SMMUV3   "arm-smmuv3"
  OBJECT_DECLARE_TYPE(SMMUv3State, SMMUv3Class, ARM_SMMUV3)
 +#define STAGE1_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S1P)
 +#define STAGE2_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S2P)
 +
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
  #include "smmuv3-internal.h"
  #include "smmu-internal.h"
 +#define PTW_RECORD_FAULT(cfg)   (((cfg)->stage == 1) ? (cfg)->record_faults : \
 +                                 (cfg)->s2cfg.record_faults)
 +
  /**
   * smmuv3_trigger_irq - pulse @irq if enabled and update
   * GERROR register in case of GERROR interrupt
@@ -XXX,XX +XXX,XX @@ static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
      return 0;
  }
--uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
++/*
--                          uint32_t maxindex)
++ * Max valid value is 39 when SMMU_IDR3.STT == 0.
-+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
++ * In architectures after SMMUv3.0:
-+                          uint64_t ireg, uint64_t def)
++ * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this
 + *   field is MAX(16, 64-IAS)
 + * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field
 + *   is (64-IAS).
 + * As we only support AA64, IAS = OAS.
 + */
 +static bool s2t0sz_valid(SMMUTransCfg *cfg)
 +{
 +    if (cfg->s2cfg.tsz > 39) {
 +        return false;
 +    }
 +
 +    if (cfg->s2cfg.granule_sz == 16) {
 +        return (cfg->s2cfg.tsz >= 64 - oas2bits(SMMU_IDR5_OAS));
 +    }
 +
 +    return (cfg->s2cfg.tsz >= MAX(64 - oas2bits(SMMU_IDR5_OAS), 16));
 +}
 +
 +/*
 + * Return true if s2 page table config is valid.
 + * This checks with the configured start level, ias_bits and granularity we can
 + * have a valid page table as described in ARM ARM D8.2 Translation process.
 + * The idea here is to see for the highest possible number of IPA bits, how
 + * many concatenated tables we would need, if it is more than 16, then this is
 + * not possible.
 + */
 +static bool s2_pgtable_config_valid(uint8_t sl0, uint8_t t0sz, uint8_t gran)
 +{
 +    int level = get_start_level(sl0, gran);
 +    uint64_t ipa_bits = 64 - t0sz;
 +    uint64_t max_ipa = (1ULL << ipa_bits) - 1;
 +    int nr_concat = pgd_concat_idx(level, gran, max_ipa) + 1;
 +
 +    return nr_concat <= VMSA_MAX_S2_CONCAT;
 +}
 +
 +static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
 +{
 +    cfg->stage = 2;
 +
 +    if (STE_S2AA64(ste) == 0x0) {
 +        qemu_log_mask(LOG_UNIMP,
 +                      "SMMUv3 AArch32 tables not supported\n");
 +        g_assert_not_reached();
 +    }
 +
 +    switch (STE_S2TG(ste)) {
 +    case 0x0: /* 4KB */
 +        cfg->s2cfg.granule_sz = 12;
 +        break;
 +    case 0x1: /* 64KB */
 +        cfg->s2cfg.granule_sz = 16;
 +        break;
 +    case 0x2: /* 16KB */
 +        cfg->s2cfg.granule_sz = 14;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste));
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.vttb = STE_S2TTB(ste);
 +
 +    cfg->s2cfg.sl0 = STE_S2SL0(ste);
 +    /* FEAT_TTST not supported. */
 +    if (cfg->s2cfg.sl0 == 0x3) {
 +        qemu_log_mask(LOG_UNIMP, "SMMUv3 S2SL0 = 0x3 has no meaning!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* For AA64, The effective S2PS size is capped to the OAS. */
 +    cfg->s2cfg.eff_ps = oas2bits(MIN(STE_S2PS(ste), SMMU_IDR5_OAS));
 +    /*
 +     * It is ILLEGAL for the address in S2TTB to be outside the range
 +     * described by the effective S2PS value.
 +     */
 +    if (cfg->s2cfg.vttb & ~(MAKE_64BIT_MASK(0, cfg->s2cfg.eff_ps))) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 S2TTB too large 0x%lx, effective PS %d bits\n",
 +                      cfg->s2cfg.vttb,  cfg->s2cfg.eff_ps);
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.tsz = STE_S2T0SZ(ste);
 +
 +    if (!s2t0sz_valid(cfg)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 bad STE S2T0SZ = %d\n",
 +                      cfg->s2cfg.tsz);
 +        goto bad_ste;
 +    }
 +
 +    if (!s2_pgtable_config_valid(cfg->s2cfg.sl0, cfg->s2cfg.tsz,
 +                                    cfg->s2cfg.granule_sz)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 STE stage 2 config not valid!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* Only LE supported(IDR0.TTENDIAN). */
 +    if (STE_S2ENDI(ste)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 STE_S2ENDI only supports LE!\n");
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.affd = STE_S2AFFD(ste);
 +
 +    cfg->s2cfg.record_faults = STE_S2R(ste);
 +    /* As stall is not supported. */
 +    if (STE_S2S(ste)) {
 +        qemu_log_mask(LOG_UNIMP, "SMMUv3 Stall not implemented!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* This is still here as stage 2 has not been fully enabled yet. */
 +    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
 +    goto bad_ste;
 +
 +    return 0;
 +
 +bad_ste:
 +    return -EINVAL;
 +}
 +
  /* Returns < 0 in case of invalid STE, 0 otherwise */
  static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
                        STE *ste, SMMUEventInfo *event)
  {
--    uint32_t val, shift;
+     uint32_t config;
--    uint64_t *table = vn;
++    int ret;
-+    uint64_t tmp, val = 0;
-+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+     if (!STE_VALID(ste)) {
-+    uint32_t base_reg = desc >> 2;
+         if (!event->inval_ste_allowed) {
-+    uint32_t shift, index, reg;
+@@ -XXX,XX +XXX,XX @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
+         return 0;
 -    val = 0;
 -    for (shift = 0; shift < 32; shift += 8) {
 -        uint32_t index = (ireg >> shift) & 0xff;
 +    for (shift = 0; shift < 64; shift += 8) {
 +        index = (ireg >> shift) & 0xff;
          if (index < maxindex) {
 -            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
 -            val |= tmp << shift;
 +            reg = base_reg + (index >> 3);
 +            tmp = *aa32_vfp_dreg(env, reg);
 +            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
          } else {
 -            val |= def & (0xff << shift);
 +            tmp = def & (0xffull << shift);
          }
 +        val |= tmp;
      }
-     return val;
- }
+-    if (STE_CFG_S2_ENABLED(config)) {
-diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
+-        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
-index XXXXXXX..XXXXXXX 100644
++    /*
---- a/target/arm/translate-neon.c.inc
++     * If a stage is enabled in SW while not advertised, throw bad ste
-+++ b/target/arm/translate-neon.c.inc
++     * according to user manual(IHI0070E) "5.2 Stream Table Entry".
-@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
++     */
++    if (!STAGE1_SUPPORTED(s) && STE_CFG_S1_ENABLED(config)) {
- static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
++        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S1 used but not supported.\n");
- {
+         goto bad_ste;
 -    int n;
 -    TCGv_i32 tmp, tmp2, tmp3, tmp4;
 -    TCGv_ptr ptr1;
 +    TCGv_i64 val, def;
 +    TCGv_i32 desc;
      if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
          return true;
      }
++    if (!STAGE2_SUPPORTED(s) && STE_CFG_S2_ENABLED(config)) {
--    n = a->len + 1;
++        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S2 used but not supported.\n");
--    if ((a->vn + n) > 32) {
++        goto bad_ste;
-+    if ((a->vn + a->len + 1) > 32) {
++    }
-         /*
++
-          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
++    if (STAGE2_SUPPORTED(s)) {
-          * helper function running off the end of the register file.
++        /* VMID is considered even if s2 is disabled. */
-          */
++        cfg->s2cfg.vmid = STE_S2VMID(ste);
-         return false;
++    } else {
-     }
++        /* Default to -1 */
--    n <<= 3;
++        cfg->s2cfg.vmid = -1;
--    tmp = tcg_temp_new_i32();
++    }
--    if (a->op) {
++
--        read_neon_element32(tmp, a->vd, 0, MO_32);
++    if (STE_CFG_S2_ENABLED(config)) {
--    } else {
++        /*
--        tcg_gen_movi_i32(tmp, 0);
++         * Stage-1 OAS defaults to OAS even if not enabled as it would be used
--    }
++         * in input address check for stage-2.
--    tmp2 = tcg_temp_new_i32();
++         */
--    read_neon_element32(tmp2, a->vm, 0, MO_32);
++        cfg->oas = oas2bits(SMMU_IDR5_OAS);
--    ptr1 = vfp_reg_ptr(true, a->vn);
++        ret = decode_ste_s2_cfg(cfg, ste);
--    tmp4 = tcg_const_i32(n);
++        if (ret) {
--    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
++            goto bad_ste;
++        }
-+    desc = tcg_const_i32((a->vn << 2) | a->len);
++    }
-+    def = tcg_temp_new_i64();
-     if (a->op) {
+     if (STE_S1CDMAX(ste) != 0) {
--        read_neon_element32(tmp, a->vd, 1, MO_32);
+         qemu_log_mask(LOG_UNIMP,
-+        read_neon_element64(def, a->vd, 0, MO_64);
+@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
-     } else {
+     if (cached_entry) {
--        tcg_gen_movi_i32(tmp, 0);
+         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
-+        tcg_gen_movi_i64(def, 0);
+             status = SMMU_TRANS_ERROR;
-     }
+-            if (cfg->record_faults) {
--    tmp3 = tcg_temp_new_i32();
++            /*
--    read_neon_element32(tmp3, a->vm, 1, MO_32);
++             * We know that the TLB only contains either stage-1 or stage-2 as
--    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
++             * nesting is not supported. So it is sufficient to check the
--    tcg_temp_free_i32(tmp);
++             * translation stage to know the TLB stage for now.
--    tcg_temp_free_i32(tmp4);
++             */
--    tcg_temp_free_ptr(ptr1);
++            event.u.f_walk_eabt.s2 = (cfg->stage == 2);
-+    val = tcg_temp_new_i64();
++            if (PTW_RECORD_FAULT(cfg)) {
-+    read_neon_element64(val, a->vm, 0, MO_64);
+                 event.type = SMMU_EVT_F_PERMISSION;
+                 event.u.f_permission.addr = addr;
--    write_neon_element32(tmp2, a->vd, 0, MO_32);
+                 event.u.f_permission.rnw = flag & 0x1;
--    write_neon_element32(tmp3, a->vd, 1, MO_32);
+@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
--    tcg_temp_free_i32(tmp2);
+             event.u.f_walk_eabt.addr2 = ptw_info.addr;
--    tcg_temp_free_i32(tmp3);
+             break;
-+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+         case SMMU_PTW_ERR_TRANSLATION:
-+    write_neon_element64(val, a->vd, 0, MO_64);
+-            if (cfg->record_faults) {
-+
++            if (PTW_RECORD_FAULT(cfg)) {
-+    tcg_temp_free_i64(def);
+                 event.type = SMMU_EVT_F_TRANSLATION;
-+    tcg_temp_free_i64(val);
+                 event.u.f_translation.addr = addr;
-+    tcg_temp_free_i32(desc);
+                 event.u.f_translation.rnw = flag & 0x1;
-     return true;
+             }
- }
+             break;
+         case SMMU_PTW_ERR_ADDR_SIZE:
 -            if (cfg->record_faults) {
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_ADDR_SIZE;
                  event.u.f_addr_size.addr = addr;
                  event.u.f_addr_size.rnw = flag & 0x1;
              }
              break;
          case SMMU_PTW_ERR_ACCESS:
 -            if (cfg->record_faults) {
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_ACCESS;
                  event.u.f_access.addr = addr;
                  event.u.f_access.rnw = flag & 0x1;
              }
              break;
          case SMMU_PTW_ERR_PERMISSION:
 -            if (cfg->record_faults) {
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_PERMISSION;
                  event.u.f_permission.addr = addr;
                  event.u.f_permission.rnw = flag & 0x1;
 --
-.20.1
+.34.1

-[PULL 04/16] target/arm: Don't use '#' flag of printf format
+[PULL 07/21] hw/arm/smmuv3: Make TLB lookup work for stage-2
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
+From: Mostafa Saleh <smostafa@google.com>
-Fix code style. Don't use '#' flag of printf format ('%#') in
+Right now, either stage-1 or stage-2 are supported, this simplifies
-format strings, use '0x' prefix instead
+how we can deal with TLBs.
 This patch makes TLB lookup work if stage-2 is enabled instead of
 stage-1.
 TLB lookup is done before a PTW, if a valid entry is found we won't
 do the PTW.
 To be able to do TLB lookup, we need the correct tagging info, as
 granularity and input size, so we get this based on the supported
 translation stage. The TLB entries are added correctly from each
 stage PTW.
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+When nested translation is supported, this would need to change, for
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
+example if we go with a combined TLB implementation, we would need to
-Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
+use the min of the granularities in TLB.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 As stage-2 shouldn't be tagged by ASID, it will be set to -1 if S1P
 is not enabled.
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-7-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 4 ++--
+ hw/arm/smmuv3.c | 44 +++++++++++++++++++++++++++++++++-----------
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 33 insertions(+), 11 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/hw/arm/smmuv3.c
-+++ b/target/arm/translate-a64.c
++++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
+@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
-                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
+     STE ste;
-                 break;
+     CD cd;
-             default:
--                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
++    /* ASID defaults to -1 (if s1 is not supported). */
-+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
++    cfg->asid = -1;
-                         __func__, insn, fpopcode, s->pc_curr);
++
-                 g_assert_not_reached();
+     ret = smmu_find_ste(s, sid, &ste, event);
-             }
+     if (ret) {
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
+         return ret;
-     case 0x7f: /* FSQRT (vector) */
+@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
-         break;
+         .addr_mask = ~(hwaddr)0,
-     default:
+         .perm = IOMMU_NONE,
--        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+     };
-+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
++    /*
-         g_assert_not_reached();
++     * Combined attributes used for TLB lookup, as only one stage is supported,
 +     * it will hold attributes based on the enabled stage.
 +     */
 +    SMMUTransTableInfo tt_combined;
      qemu_mutex_lock(&s->mutex);
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
          goto epilogue;
      }
+-    tt = select_tt(cfg, addr);
+-    if (!tt) {
+-        if (cfg->record_faults) {
+-            event.type = SMMU_EVT_F_TRANSLATION;
+-            event.u.f_translation.addr = addr;
+-            event.u.f_translation.rnw = flag & 0x1;
++    if (cfg->stage == 1) {
++        /* Select stage1 translation table. */
++        tt = select_tt(cfg, addr);
++        if (!tt) {
++            if (cfg->record_faults) {
++                event.type = SMMU_EVT_F_TRANSLATION;
++                event.u.f_translation.addr = addr;
++                event.u.f_translation.rnw = flag & 0x1;
++            }
++            status = SMMU_TRANS_ERROR;
++            goto epilogue;
+         }
+-        status = SMMU_TRANS_ERROR;
+-        goto epilogue;
+-    }
++        tt_combined.granule_sz = tt->granule_sz;
++        tt_combined.tsz = tt->tsz;
+-    page_mask = (1ULL << (tt->granule_sz)) - 1;
++    } else {
++        /* Stage2. */
++        tt_combined.granule_sz = cfg->s2cfg.granule_sz;
++        tt_combined.tsz = cfg->s2cfg.tsz;
++    }
++    /*
++     * TLB lookup looks for granule and input size for a translation stage,
++     * as only one stage is supported right now, choose the right values
++     * from the configuration.
++     */
++    page_mask = (1ULL << tt_combined.granule_sz) - 1;
+     aligned_addr = addr & ~page_mask;
+-    cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr);
++    cached_entry = smmu_iotlb_lookup(bs, cfg, &tt_combined, aligned_addr);
+     if (cached_entry) {
+         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
+             status = SMMU_TRANS_ERROR;
 --
-.20.1
+.34.1

-[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
+[PULL 08/21] hw/arm/smmuv3: Add VMID to TLB tagging
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Mostafa Saleh <smostafa@google.com>
-The MusicPal board code connects both of the IRQ outputs of the UART
+Allow TLB to be tagged with VMID.
-to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
-to the same input is not valid as it produces subtly wrong behaviour
+If stage-1 is only supported, VMID is set to -1 and ignored from STE
-(for instance if both the IRQ lines are high, and then one goes
+and CMD_TLBI_NH* cmds.
-low, the INTC input will see this as a high-to-low transition
-even though the second IRQ line should still be holding it high).
+Update smmu_iotlb_insert trace event to have vmid.
-This kind of wiring needs an explicitly created OR gate; add one.
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Inspired-by: Peter Maydell <peter.maydell@linaro.org>
+Tested-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Message-id: 20201107193403.436146-5-f4bug@amsat.org
+Message-id: 20230516203327.2051088-8-smostafa@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/musicpal.c | 17 +++++++++++++----
+ hw/arm/smmu-internal.h       |  2 ++
- hw/arm/Kconfig    |  1 +
+ include/hw/arm/smmu-common.h |  5 +++--
-files changed, 14 insertions(+), 4 deletions(-)
+ hw/arm/smmu-common.c         | 36 ++++++++++++++++++++++--------------
+ hw/arm/smmuv3.c              | 12 +++++++++---
-diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
+ hw/arm/trace-events          |  6 +++---
-index XXXXXXX..XXXXXXX 100644
+files changed, 39 insertions(+), 22 deletions(-)
---- a/hw/arm/musicpal.c
-+++ b/hw/arm/musicpal.c
+diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
-@@ -XXX,XX +XXX,XX @@
+index XXXXXXX..XXXXXXX 100644
- #include "ui/console.h"
+--- a/hw/arm/smmu-internal.h
- #include "hw/i2c/i2c.h"
++++ b/hw/arm/smmu-internal.h
- #include "hw/irq.h"
+@@ -XXX,XX +XXX,XX @@ static inline int pgd_concat_idx(int start_level, int granule_sz,
-+#include "hw/or-irq.h"
+ }
- #include "hw/audio/wm8750.h"
- #include "sysemu/block-backend.h"
+ #define SMMU_IOTLB_ASID(key) ((key).asid)
- #include "sysemu/runstate.h"
++#define SMMU_IOTLB_VMID(key) ((key).vmid)
-@@ -XXX,XX +XXX,XX @@
- #define MP_TIMER4_IRQ           7
+ typedef struct SMMUIOTLBPageInvInfo {
- #define MP_EHCI_IRQ             8
+     int asid;
- #define MP_ETH_IRQ              9
++    int vmid;
--#define MP_UART1_IRQ            11
+     uint64_t iova;
--#define MP_UART2_IRQ            11
+     uint64_t mask;
-+#define MP_UART_SHARED_IRQ      11
+ } SMMUIOTLBPageInvInfo;
- #define MP_GPIO_IRQ             12
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
- #define MP_RTC_IRQ              28
+index XXXXXXX..XXXXXXX 100644
- #define MP_AUDIO_IRQ            30
+--- a/include/hw/arm/smmu-common.h
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
++++ b/include/hw/arm/smmu-common.h
-     ARMCPU *cpu;
+@@ -XXX,XX +XXX,XX @@ typedef struct SMMUPciBus {
-     qemu_irq pic[32];
+ typedef struct SMMUIOTLBKey {
-     DeviceState *dev;
+     uint64_t iova;
-+    DeviceState *uart_orgate;
+     uint16_t asid;
-     DeviceState *i2c_dev;
++    uint16_t vmid;
-     DeviceState *lcd_dev;
+     uint8_t tg;
-     DeviceState *key_dev;
+     uint8_t level;
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
+ } SMMUIOTLBKey;
-                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
+@@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid);
-                           pic[MP_TIMER4_IRQ], NULL);
+ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
+                                 SMMUTransTableInfo *tt, hwaddr iova);
--    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+ void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *entry);
-+    /* Logically OR both UART IRQs together */
+-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
-+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
++SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
-+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+                                 uint8_t tg, uint8_t level);
-+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+ void smmu_iotlb_inv_all(SMMUState *s);
-+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
 -void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
 +void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                           uint8_t tg, uint64_t num_pages, uint8_t ttl);
  /* Unmap the range of all the notifiers registered to any IOMMU mr */
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static guint smmu_iotlb_key_hash(gconstpointer v)
      /* Jenkins hash */
      a = b = c = JHASH_INITVAL + sizeof(*key);
 -    a += key->asid + key->level + key->tg;
 +    a += key->asid + key->vmid + key->level + key->tg;
      b += extract64(key->iova, 0, 32);
      c += extract64(key->iova, 32, 32);
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
      SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2;
      return (k1->asid == k2->asid) && (k1->iova == k2->iova) &&
 -           (k1->level == k2->level) && (k1->tg == k2->tg);
 +           (k1->level == k2->level) && (k1->tg == k2->tg) &&
 +           (k1->vmid == k2->vmid);
  }
 -SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
 +SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                  uint8_t tg, uint8_t level)
  {
 -    SMMUIOTLBKey key = {.asid = asid, .iova = iova, .tg = tg, .level = level};
 +    SMMUIOTLBKey key = {.asid = asid, .vmid = vmid, .iova = iova,
 +                        .tg = tg, .level = level};
      return key;
  }
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
          uint64_t mask = subpage_size - 1;
          SMMUIOTLBKey key;
 -        key = smmu_get_iotlb_key(cfg->asid, iova & ~mask, tg, level);
 +        key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid,
 +                                 iova & ~mask, tg, level);
          entry = g_hash_table_lookup(bs->iotlb, &key);
          if (entry) {
              break;
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
      if (entry) {
          cfg->iotlb_hits++;
 -        trace_smmu_iotlb_lookup_hit(cfg->asid, iova,
 +        trace_smmu_iotlb_lookup_hit(cfg->asid, cfg->s2cfg.vmid, iova,
                                      cfg->iotlb_hits, cfg->iotlb_misses,
 * cfg->iotlb_hits /
                                      (cfg->iotlb_hits + cfg->iotlb_misses));
      } else {
          cfg->iotlb_misses++;
 -        trace_smmu_iotlb_lookup_miss(cfg->asid, iova,
 +        trace_smmu_iotlb_lookup_miss(cfg->asid, cfg->s2cfg.vmid, iova,
                                       cfg->iotlb_hits, cfg->iotlb_misses,
 * cfg->iotlb_hits /
                                       (cfg->iotlb_hits + cfg->iotlb_misses));
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new)
          smmu_iotlb_inv_all(bs);
      }
 -    *key = smmu_get_iotlb_key(cfg->asid, new->entry.iova, tg, new->level);
 -    trace_smmu_iotlb_insert(cfg->asid, new->entry.iova, tg, new->level);
 +    *key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
 +                              tg, new->level);
 +    trace_smmu_iotlb_insert(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
 +                            tg, new->level);
      g_hash_table_insert(bs->iotlb, key, new);
  }
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
      return SMMU_IOTLB_ASID(*iotlb_key) == asid;
  }
 -
 -static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
 +static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                                gpointer user_data)
  {
      SMMUTLBEntry *iter = (SMMUTLBEntry *)value;
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
      if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) {
          return false;
      }
 +    if (info->vmid >= 0 && info->vmid != SMMU_IOTLB_VMID(iotlb_key)) {
 +        return false;
 +    }
      return ((info->iova & ~entry->addr_mask) == entry->iova) ||
             ((entry->iova & ~info->mask) == info->iova);
  }
 -void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
 +void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                           uint8_t tg, uint64_t num_pages, uint8_t ttl)
  {
      /* if tg is not set we use 4KB range invalidation */
      uint8_t granule = tg ? tg * 2 + 10 : 12;
      if (ttl && (num_pages == 1) && (asid >= 0)) {
 -        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
 +        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, iova, tg, ttl);
          if (g_hash_table_remove(s->iotlb, &key)) {
              return;
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
      SMMUIOTLBPageInvInfo info = {
          .asid = asid, .iova = iova,
 +        .vmid = vmid,
          .mask = (num_pages * 1 << granule) - 1};
      g_hash_table_foreach_remove(s->iotlb,
 -                                smmu_hash_remove_by_asid_iova,
 +                                smmu_hash_remove_by_asid_vmid_iova,
                                  &info);
  }
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
  {
      dma_addr_t end, addr = CMD_ADDR(cmd);
      uint8_t type = CMD_TYPE(cmd);
 -    uint16_t vmid = CMD_VMID(cmd);
 +    int vmid = -1;
      uint8_t scale = CMD_SCALE(cmd);
      uint8_t num = CMD_NUM(cmd);
      uint8_t ttl = CMD_TTL(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
      uint64_t num_pages;
      uint8_t granule;
      int asid = -1;
 +    SMMUv3State *smmuv3 = ARM_SMMUV3(s);
 +
-+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
++    /* Only consider VMID if stage-2 is supported. */
-+                   qdev_get_gpio_in(uart_orgate, 0),
++    if (STAGE2_SUPPORTED(smmuv3)) {
-                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
++        vmid = CMD_VMID(cmd);
--    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
++    }
-+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
-+                   qdev_get_gpio_in(uart_orgate, 1),
+     if (type == SMMU_CMD_TLBI_NH_VA) {
-                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
+         asid = CMD_ASID(cmd);
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
-     /* Register flash */
+     if (!tg) {
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
-index XXXXXXX..XXXXXXX 100644
+         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
---- a/hw/arm/Kconfig
+-        smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl);
-+++ b/hw/arm/Kconfig
++        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
-@@ -XXX,XX +XXX,XX @@ config MUSCA
+         return;
+     }
- config MUSICPAL
-     bool
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
-+    select OR_IRQ
+         num_pages = (mask + 1) >> granule;
-     select BITBANG_I2C
+         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-     select MARVELL_88W8618
+         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
-     select PTIMER
+-        smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
 +        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
          addr += mask + 1;
      }
  }
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_iotlb_inv_all(void) "IOTLB invalidate all"
  smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
  smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
  smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
 -smmu_iotlb_lookup_hit(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 -smmu_iotlb_lookup_miss(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 -smmu_iotlb_insert(uint16_t asid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d addr=0x%"PRIx64" tg=%d level=%d"
 +smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 +smmu_iotlb_lookup_miss(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 +smmu_iotlb_insert(uint16_t asid, uint16_t vmid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d vmid=%d addr=0x%"PRIx64" tg=%d level=%d"
  # smmuv3.c
  smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
 --
-.20.1
+.34.1

-[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+[PULL 09/21] hw/arm/smmuv3: Add CMDs related to stage-2
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+From: Mostafa Saleh <smostafa@google.com>
-When using a Cortex-A15, the Virt machine does not use any
+CMD_TLBI_S2_IPA: As S1+S2 is not enabled, for now this can be the
-MPCore peripherals. Remove the dependency.
+same as CMD_TLBI_NH_VAA.
-Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
+CMD_TLBI_S12_VMALL: Added new function to invalidate TLB by VMID.
-Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+For stage-1 only commands, add a check to throw CERROR_ILL if used
-Message-id: 20201107114852.271922-1-philmd@redhat.com
+when stage-1 is not supported.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-9-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Kconfig | 1 -
+ include/hw/arm/smmu-common.h |  1 +
-file changed, 1 deletion(-)
+ hw/arm/smmu-common.c         | 16 +++++++++++
+ hw/arm/smmuv3.c              | 55 ++++++++++++++++++++++++++++++------
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+ hw/arm/trace-events          |  4 ++-
-index XXXXXXX..XXXXXXX 100644
+files changed, 67 insertions(+), 9 deletions(-)
---- a/hw/arm/Kconfig
-+++ b/hw/arm/Kconfig
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
-@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+index XXXXXXX..XXXXXXX 100644
-     imply VFIO_PLATFORM
+--- a/include/hw/arm/smmu-common.h
-     imply VFIO_XGMAC
++++ b/include/hw/arm/smmu-common.h
-     imply TPM_TIS_SYSBUS
+@@ -XXX,XX +XXX,XX @@ SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
--    select A15MPCORE
+                                 uint8_t tg, uint8_t level);
-     select ACPI
+ void smmu_iotlb_inv_all(SMMUState *s);
-     select ARM_SMMUV3
+ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
-     select GPIO_KEY
++void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid);
  void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                           uint8_t tg, uint64_t num_pages, uint8_t ttl);
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
      return SMMU_IOTLB_ASID(*iotlb_key) == asid;
  }
 +
 +static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value,
 +                                         gpointer user_data)
 +{
 +    uint16_t vmid = *(uint16_t *)user_data;
 +    SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;
 +
 +    return SMMU_IOTLB_VMID(*iotlb_key) == vmid;
 +}
 +
  static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                                gpointer user_data)
  {
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
      g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
  }
 +inline void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid)
 +{
 +    trace_smmu_iotlb_inv_vmid(vmid);
 +    g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid);
 +}
 +
  /* VMSAv8-64 Translation */
  /**
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
      }
  }
 -static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
 +static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
  {
      dma_addr_t end, addr = CMD_ADDR(cmd);
      uint8_t type = CMD_TYPE(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
      }
      if (!tg) {
 -        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
 +        trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
          smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
          smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
          return;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
          uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
          num_pages = (mask + 1) >> granule;
 -        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
 +        trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
          smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
          smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
          addr += mask + 1;
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
          {
              uint16_t asid = CMD_ASID(&cmd);
 +            if (!STAGE1_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +
              trace_smmuv3_cmdq_tlbi_nh_asid(asid);
              smmu_inv_notifiers_all(&s->smmu_state);
              smmu_iotlb_inv_asid(bs, asid);
              break;
          }
          case SMMU_CMD_TLBI_NH_ALL:
 +            if (!STAGE1_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            QEMU_FALLTHROUGH;
          case SMMU_CMD_TLBI_NSNH_ALL:
              trace_smmuv3_cmdq_tlbi_nh();
              smmu_inv_notifiers_all(&s->smmu_state);
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
              break;
          case SMMU_CMD_TLBI_NH_VAA:
          case SMMU_CMD_TLBI_NH_VA:
 -            smmuv3_s1_range_inval(bs, &cmd);
 +            if (!STAGE1_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            smmuv3_range_inval(bs, &cmd);
 +            break;
 +        case SMMU_CMD_TLBI_S12_VMALL:
 +        {
 +            uint16_t vmid = CMD_VMID(&cmd);
 +
 +            if (!STAGE2_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +
 +            trace_smmuv3_cmdq_tlbi_s12_vmid(vmid);
 +            smmu_inv_notifiers_all(&s->smmu_state);
 +            smmu_iotlb_inv_vmid(bs, vmid);
 +            break;
 +        }
 +        case SMMU_CMD_TLBI_S2_IPA:
 +            if (!STAGE2_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            /*
 +             * As currently only either s1 or s2 are supported
 +             * we can reuse same function for s2.
 +             */
 +            smmuv3_range_inval(bs, &cmd);
              break;
          case SMMU_CMD_TLBI_EL3_ALL:
          case SMMU_CMD_TLBI_EL3_VA:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
          case SMMU_CMD_TLBI_EL2_ASID:
          case SMMU_CMD_TLBI_EL2_VA:
          case SMMU_CMD_TLBI_EL2_VAA:
 -        case SMMU_CMD_TLBI_S12_VMALL:
 -        case SMMU_CMD_TLBI_S2_IPA:
          case SMMU_CMD_ATC_INV:
          case SMMU_CMD_PRI_RESP:
          case SMMU_CMD_RESUME:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
              break;
          default:
              cmd_error = SMMU_CERROR_ILL;
 -            qemu_log_mask(LOG_GUEST_ERROR,
 -                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
              break;
          }
          qemu_mutex_unlock(&s->mutex);
          if (cmd_error) {
 +            if (cmd_error == SMMU_CERROR_ILL) {
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "Illegal command type: %d\n", CMD_TYPE(&cmd));
 +            }
              break;
          }
          /*
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, ui
  smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
  smmu_iotlb_inv_all(void) "IOTLB invalidate all"
  smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
 +smmu_iotlb_inv_vmid(uint16_t vmid) "IOTLB invalidate vmid=%d"
  smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
  smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
  smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_cfgi_ste_range(int start, int end) "start=0x%x - end=0x%x"
  smmuv3_cmdq_cfgi_cd(uint32_t sid) "sid=0x%x"
  smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
  smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
 -smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
 +smmuv3_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
  smmuv3_cmdq_tlbi_nh(void) ""
  smmuv3_cmdq_tlbi_nh_asid(uint16_t asid) "asid=%d"
 +smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
  smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
  smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
  smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
 --
-.20.1
+.34.1

-[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
+[PULL 10/21] hw/arm/smmuv3: Add stage-2 support in iova notifier
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Mostafa Saleh <smostafa@google.com>
-We can use one MPC per SRAM bank, but we currently only wire the
+In smmuv3_notify_iova, read the granule based on translation stage
-IRQ from the first expansion MPC to the IRQ splitter. Fix that.
+and use VMID if valid value is sent.
-Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20201107193403.436146-2-f4bug@amsat.org
+Tested-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-10-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/armsse.c | 3 ++-
+ hw/arm/smmuv3.c     | 39 ++++++++++++++++++++++++++-------------
-file changed, 2 insertions(+), 1 deletion(-)
+ hw/arm/trace-events |  2 +-
 files changed, 27 insertions(+), 14 deletions(-)
-diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/armsse.c
+--- a/hw/arm/smmuv3.c
-+++ b/hw/arm/armsse.c
++++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ epilogue:
-                                         qdev_get_gpio_in(dev_splitter, 0));
+  * @mr: IOMMU mr region handle
-             qdev_connect_gpio_out(dev_splitter, 0,
+  * @n: notifier to be called
-                                   qdev_get_gpio_in_named(dev_secctl,
+  * @asid: address space ID or negative value if we don't care
--                                                         "mpc_status", 0));
++ * @vmid: virtual machine ID or negative value if we don't care
-+                                                         "mpc_status",
+  * @iova: iova
-+                                                         i - IOTS_NUM_EXP_MPC));
+  * @tg: translation granule (if communicated through range invalidation)
   * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
   */
  static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
                                 IOMMUNotifier *n,
 -                               int asid, dma_addr_t iova,
 -                               uint8_t tg, uint64_t num_pages)
 +                               int asid, int vmid,
 +                               dma_addr_t iova, uint8_t tg,
 +                               uint64_t num_pages)
  {
      SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
      IOMMUTLBEvent event;
      uint8_t granule;
 +    SMMUv3State *s = sdev->smmu;
      if (!tg) {
          SMMUEventInfo event = {.inval_ste_allowed = true};
@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
              return;
          }
-         qdev_connect_gpio_out(dev_splitter, 1,
+-        tt = select_tt(cfg, iova);
 -        if (!tt) {
 +        if (vmid >= 0 && cfg->s2cfg.vmid != vmid) {
              return;
          }
 -        granule = tt->granule_sz;
 +
 +        if (STAGE1_SUPPORTED(s)) {
 +            tt = select_tt(cfg, iova);
 +            if (!tt) {
 +                return;
 +            }
 +            granule = tt->granule_sz;
 +        } else {
 +            granule = cfg->s2cfg.granule_sz;
 +        }
 +
      } else {
          granule = tg * 2 + 10;
      }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
      memory_region_notify_iommu_one(n, &event);
  }
 -/* invalidate an asid/iova range tuple in all mr's */
 -static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
 -                                      uint8_t tg, uint64_t num_pages)
 +/* invalidate an asid/vmid/iova range tuple in all mr's */
 +static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid,
 +                                      dma_addr_t iova, uint8_t tg,
 +                                      uint64_t num_pages)
  {
      SMMUDevice *sdev;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
          IOMMUMemoryRegion *mr = &sdev->iommu;
          IOMMUNotifier *n;
 -        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova,
 -                                        tg, num_pages);
 +        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid,
 +                                        iova, tg, num_pages);
          IOMMU_NOTIFIER_FOREACH(n, mr) {
 -            smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages);
 +            smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages);
          }
      }
  }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
      if (!tg) {
          trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
 -        smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
 +        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1);
          smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
          num_pages = (mask + 1) >> granule;
          trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
 -        smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
 +        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages);
          smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
          addr += mask + 1;
      }
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
  smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
  smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
  smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
 -smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
 +smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint16_t vmid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d vmid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
 --
-.20.1
+.34.1

-[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+[PULL 11/21] hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Mostafa Saleh <smostafa@google.com>
-The system configuration controller (SYSCFG) doesn't have
+As everything is in place, we can use a new system property to
-any output IRQ (and the INTC input #71 belongs to the UART6).
+advertise which stage is supported and remove bad_ste from STE
-Remove the invalid code.
+stage2 config.
-Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
+The property added arm-smmuv3.stage can have 3 values:
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+- "1": Stage-1 only is advertised.
-Message-id: 20201107193403.436146-3-f4bug@amsat.org
+- "2": Stage-2 only is advertised.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 If not passed or an unsupported value is passed, it will default to
 stage-1.
 Advertise VMID16.
 Don't try to decode CD, if stage-2 is configured.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-11-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/misc/stm32f2xx_syscfg.h | 2 --
+ include/hw/arm/smmuv3.h |  1 +
- hw/arm/stm32f205_soc.c             | 1 -
+ hw/arm/smmuv3.c         | 32 ++++++++++++++++++++++----------
- hw/misc/stm32f2xx_syscfg.c         | 2 --
+files changed, 23 insertions(+), 10 deletions(-)
 files changed, 5 deletions(-)
-diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
+diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/stm32f2xx_syscfg.h
+--- a/include/hw/arm/smmuv3.h
-+++ b/include/hw/misc/stm32f2xx_syscfg.h
++++ b/include/hw/arm/smmuv3.h
-@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
+@@ -XXX,XX +XXX,XX @@ struct SMMUv3State {
-     uint32_t syscfg_exticr3;
-     uint32_t syscfg_exticr4;
+     qemu_irq     irq[4];
-     uint32_t syscfg_cmpcr;
+     QemuMutex mutex;
 +    char *stage;
  };
  typedef enum {
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "hw/sysbus.h"
  #include "migration/vmstate.h"
 +#include "hw/qdev-properties.h"
  #include "hw/qdev-core.h"
  #include "hw/pci/pci.h"
  #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
  static void smmuv3_init_regs(SMMUv3State *s)
  {
 -    /**
 -     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
 -     *       multi-level stream table
 -     */
 -    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
 +    /* Based on sys property, the stages supported in smmu will be advertised.*/
 +    if (s->stage && !strcmp("2", s->stage)) {
 +        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
 +    } else {
 +        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
 +    }
 +
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
 +    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, VMID16, 1); /* 16-bit VMID */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
      /* terminated transaction will always be aborted/error returned */
@@ -XXX,XX +XXX,XX @@ static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
          goto bad_ste;
      }
 -    /* This is still here as stage 2 has not been fully enabled yet. */
 -    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
 -    goto bad_ste;
 -
--    qemu_irq irq;
+     return 0;
  bad_ste:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
          return ret;
      }
 -    if (cfg->aborted || cfg->bypassed) {
 +    if (cfg->aborted || cfg->bypassed || (cfg->stage == 2)) {
          return 0;
      }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3 = {
      }
  };
- #endif /* HW_STM32F2XX_SYSCFG_H */
++static Property smmuv3_properties[] = {
-diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
++    /*
-index XXXXXXX..XXXXXXX 100644
++     * Stages of translation advertised.
---- a/hw/arm/stm32f205_soc.c
++     * "1": Stage 1
-+++ b/hw/arm/stm32f205_soc.c
++     * "2": Stage 2
-@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
++     * Defaults to stage 1
-     }
++     */
-     busdev = SYS_BUS_DEVICE(dev);
++    DEFINE_PROP_STRING("stage", SMMUv3State, stage),
-     sysbus_mmio_map(busdev, 0, 0x40013800);
++    DEFINE_PROP_END_OF_LIST()
--    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
++};
++
-     /* Attach UART (uses USART registers) and USART controllers */
+ static void smmuv3_instance_init(Object *obj)
      for (i = 0; i < STM_NUM_USARTS; i++) {
 diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/stm32f2xx_syscfg.c
 +++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
  {
-     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
+     /* Nothing much to do here as of now */
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
--    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
+                                        &c->parent_phases);
--
+     c->parent_realize = dc->realize;
-     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
+     dc->realize = smmu_realize;
-                           TYPE_STM32F2XX_SYSCFG, 0x400);
++    device_class_set_props(dc, smmuv3_properties);
-     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
+ }
  static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
 --
-.20.1
+.34.1

-[PULL 03/16] target/arm: add spaces around operator
+[PULL 12/21] hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
+From: Tommy Wu <tommy.wu@sifive.com>
-Fix code style. Operator needs spaces both sides.
+When we receive a packet from the xilinx_axienet and then try to s2mem
 through the xilinx_axidma, if the descriptor ring buffer is full in the
 xilinx axidma driver, we’ll assert the DMASR.HALTED in the
 function : stream_process_s2mem and return 0. In the end, we’ll be stuck in
 an infinite loop in axienet_eth_rx_notify.
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+This patch checks the DMASR.HALTED state when we try to push data
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
+from xilinx axi-enet to xilinx axi-dma. When the DMASR.HALTED is asserted,
-Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
+we will not keep pushing the data and then prevent the infinte loop.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
 Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Message-id: 20230519062137.1251741-1-tommy.wu@sifive.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/arch_dump.c | 8 ++++----
+ hw/dma/xilinx_axidma.c | 11 ++++++++---
- target/arm/arm-semi.c  | 8 ++++----
+file changed, 8 insertions(+), 3 deletions(-)
  target/arm/helper.c    | 2 +-
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
+diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arch_dump.c
+--- a/hw/dma/xilinx_axidma.c
-+++ b/target/arm/arch_dump.c
++++ b/hw/dma/xilinx_axidma.c
-@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+@@ -XXX,XX +XXX,XX @@ static inline int stream_idle(struct Stream *s)
+     return !!(s->regs[R_DMASR] & DMASR_IDLE);
-     for (i = 0; i < 32; ++i) {
+ }
-         uint64_t *q = aa64_vfp_qreg(env, i);
--        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
++static inline int stream_halted(struct Stream *s)
--        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
++{
-+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
++    return !!(s->regs[R_DMASR] & DMASR_HALTED);
-+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
++}
 +
  static void stream_reset(struct Stream *s)
  {
      s->regs[R_DMASR] = DMASR_HALTED;  /* starts up halted.  */
@@ -XXX,XX +XXX,XX @@ static void stream_process_mem2s(struct Stream *s, StreamSink *tx_data_dev,
      uint64_t addr;
      bool eop;
 -    if (!stream_running(s) || stream_idle(s)) {
 +    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
          return;
      }
-     if (s->dump_info.d_endian == ELFDATA2MSB) {
+@@ -XXX,XX +XXX,XX @@ static size_t stream_process_s2mem(struct Stream *s, unsigned char *buf,
-@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+     unsigned int rxlen;
-          */
+     size_t pos = 0;
-         for (i = 0; i < 32; ++i) {
-             uint64_t tmp = note.vfp.vregs[2*i];
+-    if (!stream_running(s) || stream_idle(s)) {
--            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
++    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
--            note.vfp.vregs[2*i+1] = tmp;
+         return 0;
 +            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
 +            note.vfp.vregs[2 * i + 1] = tmp;
          }
      }
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
+@@ -XXX,XX +XXX,XX @@ xilinx_axidma_data_stream_can_push(StreamSink *obj,
-index XXXXXXX..XXXXXXX 100644
+     XilinxAXIDMAStreamSink *ds = XILINX_AXI_DMA_DATA_STREAM(obj);
---- a/target/arm/arm-semi.c
+     struct Stream *s = &ds->dma->streams[1];
-+++ b/target/arm/arm-semi.c
-@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
+-    if (!stream_running(s) || stream_idle(s)) {
-         if (use_gdb_syscalls()) {
++    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
-             arm_semi_open_guestfd = guestfd;
+         ds->dma->notify = notify;
-             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
+         ds->dma->notify_opaque = notify_opaque;
--                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+         return false;
 +                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
          } else {
              ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
              if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
 -                                  arg0, (int)arg1+1);
 +                                  arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(3);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
 -                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
 +                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
          } else {
              char *s2;
              s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
 -                                   arg0, (int)arg1+1);
 +                                   arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
      uint32_t sum;
      sum = do_usad(a, b);
      sum += do_usad(a >> 8, b >> 8);
 -    sum += do_usad(a >> 16, b >>16);
 +    sum += do_usad(a >> 16, b >> 16);
      sum += do_usad(a >> 24, b >> 24);
      return sum;
  }
 --
-.20.1
+.34.1

-[PULL 05/16] target/arm: add space before the open parenthesis '('
+[PULL 13/21] hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
+From: Clément Chigot <chigot@adacore.com>
-Fix code style. Space required before the open parenthesis '('.
+When passing --smp with a number lower than XLNX_ZYNQMP_NUM_APU_CPUS,
 the expression (ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS) will result
 in a positive number as ms->smp.cpus is a unsigned int.
 This will raise the following error afterwards, as Qemu will try to
 instantiate some additional RPUs.
   | $ qemu-system-aarch64 --smp 1 -M xlnx-zcu102
   | **
   | ERROR:../src/tcg/tcg.c:777:tcg_register_thread:
   |   assertion failed: (n < tcg_max_ctxs)
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
+Signed-off-by: Clément Chigot <chigot@adacore.com>
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
+Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
+Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20230524143714.565792-1-chigot@adacore.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 2 +-
+ hw/arm/xlnx-zynqmp.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/hw/arm/xlnx-zynqmp.c
-+++ b/target/arm/translate.c
++++ b/hw/arm/xlnx-zynqmp.c
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(MachineState *ms, XlnxZynqMPState *s,
-             - Hardware watchpoints.
+                                    const char *boot_cpu, Error **errp)
-            Hardware breakpoints have already been handled and skip this code.
+ {
-          */
+     int i;
--        switch(dc->base.is_jmp) {
+-    int num_rpus = MIN(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS,
-+        switch (dc->base.is_jmp) {
++    int num_rpus = MIN((int)(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS),
-         case DISAS_NEXT:
+                        XLNX_ZYNQMP_NUM_RPU_CPUS);
-         case DISAS_TOO_MANY:
-             gen_goto_tb(dc, 1, dc->base.pc_next);
+     if (num_rpus <= 0) {
 --
-.20.1
+.34.1

-New patch
+[PULL 14/21] tests/qtest: Run arm-specific tests only if the required machine is available
+From: Thomas Huth <thuth@redhat.com>
+pflash-cfi02-test.c always uses the "musicpal" machine for testing,
+test-arm-mptimer.c always uses the "vexpress-a9" machine, and
+microbit-test.c requires the "microbit" machine, so we should only
+run these tests if the machines have been enabled in the configuration.
+Signed-off-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Fabiano Rosas <farosas@suse.de>
+Message-id: 20230524080600.1618137-1-thuth@redhat.com
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ tests/qtest/meson.build | 7 ++++---
+file changed, 4 insertions(+), 3 deletions(-)
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/meson.build
++++ b/tests/qtest/meson.build
+@@ -XXX,XX +XXX,XX @@ qtests_arm = \
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
+-  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
++  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') and
++   config_all_devices.has_key('CONFIG_MUSICPAL') ? ['pflash-cfi02-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed : []) + \
+   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
+   (config_all_devices.has_key('CONFIG_GENERIC_LOADER') ? ['hexloader-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \
++  (config_all_devices.has_key('CONFIG_VEXPRESS') ? ['test-arm-mptimer'] : []) + \
++  (config_all_devices.has_key('CONFIG_MICROBIT') ? ['microbit-test'] : []) + \
+   ['arm-cpu-features',
+-   'microbit-test',
+-   'test-arm-mptimer',
+    'boot-serial-test']
+ # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional
+--
+.34.1

-[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
+[PULL 15/21] target/arm: Explicitly select short-format FSR for M-profile
-The nseries machines have a codepath that allows them to load a
+For M-profile, there is no guest-facing A-profile format FSR, but we
-secondary bootloader.  This code wasn't checking that the
+still use the env->exception.fsr field to pass fault information from
-load_image_targphys() succeeded.  Check the return value and report
+the point where a fault is raised to the code in
-the error to the user.
+arm_v7m_cpu_do_interrupt() which interprets it and sets the M-profile
 specific fault status registers.  So it doesn't matter whether we
 fill in env->exception.fsr in the short format or the LPAE format, as
 long as both sides agree.  As it happens arm_v7m_cpu_do_interrupt()
 assumes short-form.
-While we're in the vicinity, fix the comment style of the
+In compute_fsr_fsc() we weren't explicitly choosing short-form for
-comment documenting what this image load is doing.
+M-profile, but instead relied on it falling out in the wash because
 arm_s1_regime_using_lpae_format() would be false.  This was broken in
 commit 452c67a4 when we added v8R support, because we said "PMSAv8 is
 always LPAE format" (as it is for v8R), forgetting that we were
 implicitly using this code path on M-profile. At that point we would
 hit a g_assert_not_reached():
  ERROR:../../target/arm/internals.h:549:arm_fi_to_lfsc: code should not be reached
-Fixes: Coverity CID 1192904
+#7  0x0000555555e055f7 in arm_fi_to_lfsc (fi=0x7fffecff9a90) at ../../target/arm/internals.h:549
 #8  0x0000555555e05a27 in compute_fsr_fsc (env=0x555557356670, fi=0x7fffecff9a90, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff9a1c)
     at ../../target/arm/tlb_helper.c:95
 #9  0x0000555555e05b62 in arm_deliver_fault (cpu=0x555557354800, addr=268961344, access_type=MMU_INST_FETCH, mmu_idx=1, fi=0x7fffecff9a90)
     at ../../target/arm/tlb_helper.c:132
 #10 0x0000555555e06095 in arm_cpu_tlb_fill (cs=0x555557354800, address=268961344, size=1, access_type=MMU_INST_FETCH, mmu_idx=1, probe=false, retaddr=0)
     at ../../target/arm/tlb_helper.c:260
 The specific assertion changed when commit fcc7404eff24b4c added
 "assert not M-profile" to arm_is_secure_below_el3(), because the
 conditions being checked in compute_fsr_fsc() include
 arm_el_is_aa64(), which will end up calling arm_is_secure_below_el3()
 and asserting before we try to call arm_fi_to_lfsc():
 #7  0x0000555555efaf43 in arm_is_secure_below_el3 (env=0x5555574665a0) at ../../target/arm/cpu.h:2396
 #8  0x0000555555efb103 in arm_is_el2_enabled (env=0x5555574665a0) at ../../target/arm/cpu.h:2448
 #9  0x0000555555efb204 in arm_el_is_aa64 (env=0x5555574665a0, el=1) at ../../target/arm/cpu.h:2509
 #10 0x0000555555efbdfd in compute_fsr_fsc (env=0x5555574665a0, fi=0x7fffecff99e0, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff996c)
 Avoid the assertion and the incorrect FSR format selection by
 explicitly making M-profile use the short-format in this function.
 Fixes: 452c67a42704 ("target/arm: Enable TTBCR_EAE for ARMv8-R AArch32")a
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1658
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
+Message-id: 20230523131726.866635-1-peter.maydell@linaro.org
 ---
- hw/arm/nseries.c | 15 +++++++++++----
+ target/arm/tcg/tlb_helper.c | 13 +++++++++++--
-file changed, 11 insertions(+), 4 deletions(-)
+file changed, 11 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/nseries.c
+--- a/target/arm/tcg/tlb_helper.c
-+++ b/hw/arm/nseries.c
++++ b/target/arm/tcg/tlb_helper.c
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
-         /* No, wait, better start at the ROM.  */
+     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
-         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
+     uint32_t fsr, fsc;
--        /* This is intended for loading the `secondary.bin' program from
+-    if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
-+        /*
+-        arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
-+         * This is intended for loading the `secondary.bin' program from
++    /*
-          * Nokia images (the NOLO bootloader).  The entry point seems
++     * For M-profile there is no guest-facing FSR. We compute a
-          * to be at OMAP2_Q2_BASE + 0x400000.
++     * short-form value for env->exception.fsr which we will then
-          *
++     * examine in arm_v7m_cpu_do_interrupt(). In theory we could
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
++     * use the LPAE format instead as long as both bits of code agree
-          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
++     * (and arm_fi_to_lfsc() handled the M-profile specific
-          *
++     * ARMFault_QEMU_NSCExec and ARMFault_QEMU_SFault cases).
-          * The code above is for loading the `zImage' file from Nokia
++     */
--         * images.  */
++    if (!arm_feature(env, ARM_FEATURE_M) &&
--        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
++        (target_el == 2 || arm_el_is_aa64(env, target_el) ||
--                            machine->ram_size - 0x400000);
++         arm_s1_regime_using_lpae_format(env, arm_mmu_idx))) {
-+         * images.
+         /*
-+         */
+          * LPAE format fault status register : bottom 6 bits are
-+        if (load_image_targphys(option_rom[0].name,
+          * status code in the same form as needed for syndrome
 +                                OMAP2_Q2_BASE + 0x400000,
 +                                machine->ram_size - 0x400000) < 0) {
 +            error_report("Failed to load secondary bootloader %s",
 +                         option_rom[0].name);
 +            exit(EXIT_FAILURE);
 +        }
          n800_setup_nolo_tags(nolo_tags);
          cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
 --
-.20.1
+.34.1

-[PULL 06/16] docs: add some notes on the sbsa-ref machine
+[PULL 16/21] target/arm: Explain why we need to select ARM_V7M
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Fabiano Rosas <farosas@suse.de>
-We should at least document what this machine is about.
+We currently need to select ARM_V7M unconditionally when TCG is
 present in the build because some translate.c helpers and the whole of
 m_helpers.c are not yet under CONFIG_ARM_V7M.
-Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
+Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Cc: Leif Lindholm <leif@nuviainc.com>
+Message-id: 20230523180525.29994-2-farosas@suse.de
 Cc: Shashi Mallela <shashi.mallela@linaro.org>
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 [PMM: fixed filename mismatch]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
+ target/arm/Kconfig | 3 +++
- docs/system/target-arm.rst |  1 +
+file changed, 3 insertions(+)
 files changed, 33 insertions(+)
  create mode 100644 docs/system/arm/sbsa.rst
-diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
+diff --git a/target/arm/Kconfig b/target/arm/Kconfig
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/target/arm/Kconfig
---- /dev/null
++++ b/target/arm/Kconfig
 +++ b/docs/system/arm/sbsa.rst
 @@ -XXX,XX +XXX,XX @@
-+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+ config ARM
-+==================================================================
+     bool
      select ARM_COMPATIBLE_SEMIHOSTING if TCG
 +
-+While the `virt` board is a generic board platform that doesn't match
++    # We need to select this until we move m_helper.c and the
-+any real hardware the `sbsa-ref` board intends to look like real
++    # translate.c v7m helpers under ARM_V7M.
-+hardware. The `Server Base System Architecture
+     select ARM_V7M if TCG
-+<https://developer.arm.com/documentation/den0029/latest>` defines a
-+minimum base line of hardware support and importantly how the firmware
+ config AARCH64
 +reports that to any operating system. It is a static system that
 +reports a very minimal DT to the firmware for non-discoverable
 +information about components affected by the qemu command line (i.e.
 +cpus and memory). As a result it must have a firmware specifically
 +built to expect a certain hardware layout (as you would in a real
 +machine).
 +
 +It is intended to be a machine for developing firmware and testing
 +standards compliance with operating systems.
 +
 +Supported devices
 +"""""""""""""""""
 +
 +The sbsa-ref board supports:
 +
 +  - A configurable number of AArch64 CPUs
 +  - GIC version 3
 +  - System bus AHCI controller
 +  - System bus EHCI controller
 +  - CDROM and hard disc on AHCI bus
 +  - E1000E ethernet card on PCIe bus
 +  - VGA display adaptor on PCIe bus
 +  - A generic SBSA watchdog device
 +
 diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/target-arm.rst
 +++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
     arm/mps2
     arm/musca
     arm/realview
 +   arm/sbsa
     arm/versatile
     arm/vexpress
     arm/aspeed
 --
-.20.1
+.34.1

-New patch
+[PULL 17/21] arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
+From: Fabiano Rosas <farosas@suse.de>
+When we moved the arm default CONFIGs into Kconfig and removed them
+from default.mak, we made it harder to identify which CONFIGs are
+selected by default in case users want to disable them.
+Bring back the default entries into default.mak, but keep them
+commented out. This way users can keep their workflows of editing
+default.mak to remove build options without needing to search through
+Kconfig.
+Reported-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20230523180525.29994-3-farosas@suse.de
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ configs/devices/aarch64-softmmu/default.mak |  6 ++++
+ configs/devices/arm-softmmu/default.mak     | 40 +++++++++++++++++++++
+files changed, 46 insertions(+)
+diff --git a/configs/devices/aarch64-softmmu/default.mak b/configs/devices/aarch64-softmmu/default.mak
+index XXXXXXX..XXXXXXX 100644
+--- a/configs/devices/aarch64-softmmu/default.mak
++++ b/configs/devices/aarch64-softmmu/default.mak
+@@ -XXX,XX +XXX,XX @@
+ # We support all the 32 bit boards so need all their config
+ include ../arm-softmmu/default.mak
++
++# These are selected by default when TCG is enabled, uncomment them to
++# keep out of the build.
++# CONFIG_XLNX_ZYNQMP_ARM=n
++# CONFIG_XLNX_VERSAL=n
++# CONFIG_SBSA_REF=n
+diff --git a/configs/devices/arm-softmmu/default.mak b/configs/devices/arm-softmmu/default.mak
+index XXXXXXX..XXXXXXX 100644
+--- a/configs/devices/arm-softmmu/default.mak
++++ b/configs/devices/arm-softmmu/default.mak
+@@ -XXX,XX +XXX,XX @@
+ # CONFIG_TEST_DEVICES=n
+ CONFIG_ARM_VIRT=y
++
++# These are selected by default when TCG is enabled, uncomment them to
++# keep out of the build.
++# CONFIG_CUBIEBOARD=n
++# CONFIG_EXYNOS4=n
++# CONFIG_HIGHBANK=n
++# CONFIG_INTEGRATOR=n
++# CONFIG_FSL_IMX31=n
++# CONFIG_MUSICPAL=n
++# CONFIG_MUSCA=n
++# CONFIG_CHEETAH=n
++# CONFIG_SX1=n
++# CONFIG_NSERIES=n
++# CONFIG_STELLARIS=n
++# CONFIG_STM32VLDISCOVERY=n
++# CONFIG_REALVIEW=n
++# CONFIG_VERSATILE=n
++# CONFIG_VEXPRESS=n
++# CONFIG_ZYNQ=n
++# CONFIG_MAINSTONE=n
++# CONFIG_GUMSTIX=n
++# CONFIG_SPITZ=n
++# CONFIG_TOSA=n
++# CONFIG_Z2=n
++# CONFIG_NPCM7XX=n
++# CONFIG_COLLIE=n
++# CONFIG_ASPEED_SOC=n
++# CONFIG_NETDUINO2=n
++# CONFIG_NETDUINOPLUS2=n
++# CONFIG_OLIMEX_STM32_H405=n
++# CONFIG_MPS2=n
++# CONFIG_RASPI=n
++# CONFIG_DIGIC=n
++# CONFIG_SABRELITE=n
++# CONFIG_EMCRAFT_SF2=n
++# CONFIG_MICROBIT=n
++# CONFIG_FSL_IMX25=n
++# CONFIG_FSL_IMX7=n
++# CONFIG_FSL_IMX6UL=n
++# CONFIG_ALLWINNER_H3=n
+--
+.34.1

-[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
+[PULL 18/21] arm/Kconfig: Make TCG dependence explicit
-From: Andrew Jones <drjones@redhat.com>
+From: Fabiano Rosas <farosas@suse.de>
-commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
+Replace the 'default y if TCG' pattern with 'default y; depends on
-changed armv7m_systick to build on ptimers. Make sure we have ptimers
+TCG'.
-in the build when building armv7m_systick.
+That makes explict that there is a dependence on TCG and enabling
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+these CONFIGs via .mak files without TCG present will fail earlier.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20201104103343.30392-1-drjones@redhat.com
+Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20230523180525.29994-4-farosas@suse.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Kconfig | 1 +
+ hw/arm/Kconfig | 123 ++++++++++++++++++++++++++++++++-----------------
-file changed, 1 insertion(+)
+file changed, 82 insertions(+), 41 deletions(-)
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+ config CHEETAH
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select OMAP
+     select TSC210X
+ config CUBIEBOARD
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ALLWINNER_A10
+ config DIGIC
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select PTIMER
+     select PFLASH_CFI02
+ config EXYNOS4
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     imply I2C_DEVICES
+     select A9MPCORE
+     select I2C
+@@ -XXX,XX +XXX,XX @@ config EXYNOS4
+ config HIGHBANK
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select A9MPCORE
+     select A15MPCORE
+     select AHCI
+@@ -XXX,XX +XXX,XX @@ config HIGHBANK
+ config INTEGRATOR
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ARM_TIMER
+     select INTEGRATOR_DEBUG
+     select PL011 # UART
+@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
+ config MAINSTONE
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select PXA2XX
+     select PFLASH_CFI01
+     select SMC91C111
+ config MUSCA
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ARMSSE
+     select PL011
+     select PL031
+@@ -XXX,XX +XXX,XX @@ config MARVELL_88W8618
+ config MUSICPAL
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select OR_IRQ
+     select BITBANG_I2C
+     select MARVELL_88W8618
+@@ -XXX,XX +XXX,XX @@ config MUSICPAL
+ config NETDUINO2
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select STM32F205_SOC
+ config NETDUINOPLUS2
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select STM32F405_SOC
+ config OLIMEX_STM32_H405
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select STM32F405_SOC
+ config NSERIES
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select OMAP
+     select TMP105   # temperature sensor
+     select BLIZZARD # LCD/TV controller
+@@ -XXX,XX +XXX,XX @@ config PXA2XX
+ config GUMSTIX
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select PFLASH_CFI01
+     select SMC91C111
+     select PXA2XX
+ config TOSA
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ZAURUS  # scoop
+     select MICRODRIVE
+     select PXA2XX
+@@ -XXX,XX +XXX,XX @@ config TOSA
+ config SPITZ
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ADS7846 # touch-screen controller
+     select MAX111X # A/D converter
+     select WM8750  # audio codec
+@@ -XXX,XX +XXX,XX @@ config SPITZ
+ config Z2
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select PFLASH_CFI01
+     select WM8750
+     select PL011 # UART
+@@ -XXX,XX +XXX,XX @@ config Z2
+ config REALVIEW
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     imply PCI_DEVICES
+     imply PCI_TESTDEV
+     imply I2C_DEVICES
+@@ -XXX,XX +XXX,XX @@ config REALVIEW
+ config SBSA_REF
+     bool
+-    default y if TCG && AARCH64
++    default y
++    depends on TCG && AARCH64
+     imply PCI_DEVICES
+     select AHCI
+     select ARM_SMMUV3
+@@ -XXX,XX +XXX,XX @@ config SBSA_REF
+ config SABRELITE
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select FSL_IMX6
+     select SSI_M25P80
+ config STELLARIS
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     imply I2C_DEVICES
+     select ARM_V7M
+     select CMSDK_APB_WATCHDOG
+@@ -XXX,XX +XXX,XX @@ config STELLARIS
+ config STM32VLDISCOVERY
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select STM32F100_SOC
+ config STRONGARM
+@@ -XXX,XX +XXX,XX @@ config STRONGARM
+ config COLLIE
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select PFLASH_CFI01
+     select ZAURUS  # scoop
+     select STRONGARM
+ config SX1
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select OMAP
+ config VERSATILE
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ARM_TIMER # sp804
+     select PFLASH_CFI01
+     select LSI_SCSI_PCI
+@@ -XXX,XX +XXX,XX @@ config VERSATILE
+ config VEXPRESS
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select A9MPCORE
+     select A15MPCORE
+     select ARM_MPTIMER
+@@ -XXX,XX +XXX,XX @@ config VEXPRESS
+ config ZYNQ
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select A9MPCORE
+     select CADENCE # UART
+     select PFLASH_CFI02
 @@ -XXX,XX +XXX,XX @@ config ZYNQ
  config ARM_V7M
      bool
-+    select PTIMER
+     # currently v7M must be included in a TCG build due to translate.c
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select PTIMER
  config ALLWINNER_A10
-     bool
+@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
  config ALLWINNER_H3
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select ALLWINNER_A10_PIT
      select ALLWINNER_SUN8I_EMAC
      select ALLWINNER_I2C
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
  config RASPI
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select FRAMEBUFFER
      select PL011 # UART
      select SDHCI
@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
  config XLNX_ZYNQMP_ARM
      bool
 -    default y if TCG && AARCH64
 +    default y
 +    depends on TCG && AARCH64
      select AHCI
      select ARM_GIC
      select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_ZYNQMP_ARM
  config XLNX_VERSAL
      bool
 -    default y if TCG && AARCH64
 +    default y
 +    depends on TCG && AARCH64
      select ARM_GIC
      select PL011
      select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_VERSAL
  config NPCM7XX
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select A9MPCORE
      select ADM1272
      select ARM_GIC
@@ -XXX,XX +XXX,XX @@ config NPCM7XX
  config FSL_IMX25
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select IMX
      select IMX_FEC
@@ -XXX,XX +XXX,XX @@ config FSL_IMX25
  config FSL_IMX31
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select SERIAL
      select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
  config ASPEED_SOC
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select DS1338
      select FTGMAC100
      select I2C
@@ -XXX,XX +XXX,XX @@ config ASPEED_SOC
  config MPS2
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select ARMSSE
      select LAN9118
@@ -XXX,XX +XXX,XX @@ config MPS2
  config FSL_IMX7
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply PCI_DEVICES
      imply TEST_DEVICES
      imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config ARM_SMMUV3
  config FSL_IMX6UL
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select A15MPCORE
      select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6UL
  config MICROBIT
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select NRF51_SOC
  config NRF51_SOC
@@ -XXX,XX +XXX,XX @@ config NRF51_SOC
  config EMCRAFT_SF2
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select MSF2
      select SSI_M25P80
 --
-.20.1
+.34.1

-[PULL 02/16] ssi: Fix bad printf format specifiers
+[PULL 19/21] Update copyright dates to 2023
-From: AlexChen <alex.chen@huawei.com>
+From: Enze Li <lienze@kylinos.cn>
-We should use printf format specifier "%u" instead of "%d" for
+I noticed that in the latest version, the copyright string is still
-argument of type "unsigned int".
+, even though 2023 is halfway through.  This patch fixes that and
 fixes the documentation along with it.
-Reported-by: Euler Robot <euler.robot@huawei.com>
+Signed-off-by: Enze Li <lienze@kylinos.cn>
-Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20230525064345.1152801-1-lienze@kylinos.cn
 Message-id: 5FA280F5.8060902@huawei.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/ssi/imx_spi.c    | 2 +-
+ docs/conf.py              | 2 +-
- hw/ssi/xilinx_spi.c | 2 +-
+ include/qemu/help-texts.h | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
+diff --git a/docs/conf.py b/docs/conf.py
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/imx_spi.c
+--- a/docs/conf.py
-+++ b/hw/ssi/imx_spi.c
++++ b/docs/conf.py
-@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
+@@ -XXX,XX +XXX,XX @@
-     case ECSPI_MSGDATA:
-         return  "ECSPI_MSGDATA";
+ # General information about the project.
-     default:
+ project = u'QEMU'
--        sprintf(unknown, "%d ?", reg);
+-copyright = u'2022, The QEMU Project Developers'
-+        sprintf(unknown, "%u ?", reg);
++copyright = u'2023, The QEMU Project Developers'
-         return unknown;
+ author = u'The QEMU Project Developers'
-     }
- }
+ # The version info for the project you're documenting, acts as replacement for
-diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
+diff --git a/include/qemu/help-texts.h b/include/qemu/help-texts.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/xilinx_spi.c
+--- a/include/qemu/help-texts.h
-+++ b/hw/ssi/xilinx_spi.c
++++ b/include/qemu/help-texts.h
-@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
+@@ -XXX,XX +XXX,XX @@
-        irq chain unless things really changed.  */
+ #define QEMU_HELP_TEXTS_H
-     if (pending != s->irqline) {
-         s->irqline = pending;
+ /* Copyright string for -version arguments, About dialogs, etc */
--        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+-#define QEMU_COPYRIGHT "Copyright (c) 2003-2022 " \
-+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
++#define QEMU_COPYRIGHT "Copyright (c) 2003-2023 " \
-                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
+     "Fabrice Bellard and the QEMU Project developers"
-         qemu_set_irq(s->irq, pending);
-     }
+ /* Bug reporting information for --help arguments, About dialogs, etc */
 --
-.20.1
+.34.1

-[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+[PULL 20/21] hw/arm/sbsa-ref: add GIC node into DT
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
+Let add GIC information into DeviceTree as part of SBSA-REF versioning.
 OMAP2 chip support") takes care of creating the 3 UARTs.
-Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
+Trusted Firmware will read it and provide to next firmware level.
 extensions and attach to n8x0's UART") added n8x0_uart_setup()
 which create the UART and connects it to an IRQ output,
 overwritting the existing peripheral and its IRQ connection.
 This is incorrect.
-Fortunately we don't need to fix this, because commit 6da68df7f9b
+Bumps platform version to 0.1 one so we can check is node is present.
 ("hw/arm/nseries: Replace the bluetooth chardev with a "null"
 chardev") removed the use of this peripheral. We can simply
 remove the code.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 Message-id: 20201107193403.436146-4-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/nseries.c | 11 -----------
+ hw/arm/sbsa-ref.c | 19 ++++++++++++++++++-
-file changed, 11 deletions(-)
+file changed, 18 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/nseries.c
+--- a/hw/arm/sbsa-ref.c
-+++ b/hw/arm/nseries.c
++++ b/hw/arm/sbsa-ref.c
-@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
+@@ -XXX,XX +XXX,XX @@
-     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
+ #include "exec/hwaddr.h"
  #include "kvm_arm.h"
  #include "hw/arm/boot.h"
 +#include "hw/arm/fdt.h"
  #include "hw/arm/smmuv3.h"
  #include "hw/block/flash.h"
  #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
      return arm_cpu_mp_affinity(idx, clustersz);
  }
--static void n8x0_uart_setup(struct n800_s *s)
++static void sbsa_fdt_add_gic_node(SBSAMachineState *sms)
--{
++{
--    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
++    char *nodename;
--    /*
++
--     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
++    nodename = g_strdup_printf("/intc");
--     * here, but this code has been removed with the bluetooth backend.
++    qemu_fdt_add_subnode(sms->fdt, nodename);
--     */
++    qemu_fdt_setprop_sized_cells(sms->fdt, nodename, "reg",
--    omap_uart_attach(s->mpu->uart[BT_UART], radio);
++                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].base,
--}
++                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].size,
--
++                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].base,
- static void n8x0_usb_setup(struct n800_s *s)
++                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].size);
- {
++
-     SysBusDevice *dev;
++    g_free(nodename);
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
++}
-     n8x0_spi_setup(s);
+ /*
-     n8x0_dss_setup(s);
+  * Firmware on this machine only uses ACPI table to load OS, these limited
-     n8x0_cbus_setup(s);
+  * device tree nodes are just to let firmware know the info which varies from
--    n8x0_uart_setup(s);
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
-     if (machine_usb(machine)) {
+      *                        fw compatibility.
-         n8x0_usb_setup(s);
+      */
      qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
 -    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 0);
 +    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 1);
      if (ms->numa_state->have_numa_distance) {
          int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
          g_free(nodename);
      }
++
++    sbsa_fdt_add_gic_node(sms);
+ }
+ #define SBSA_FLASH_SECTOR_SIZE (256 * KiB)
 --
-.20.1
+.34.1

-[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
+[PULL 21/21] docs: sbsa: correct graphics card name
-From: Havard Skinnemoen <hskinnemoen@google.com>
+From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-The number of runs is equal to the number of 0-1 and 1-0 transitions,
+We moved from VGA to Bochs to have PCIe card.
 plus one. Currently, it's counting the number of times these transitions
 do _not_ happen, plus one.
-Source:
+Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
 section 2.3.4 point (3).
 Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
 Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/npcm7xx_rng-test.c | 2 +-
+ docs/system/arm/sbsa.rst | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/npcm7xx_rng-test.c
+--- a/docs/system/arm/sbsa.rst
-+++ b/tests/qtest/npcm7xx_rng-test.c
++++ b/docs/system/arm/sbsa.rst
-@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
+@@ -XXX,XX +XXX,XX @@ The sbsa-ref board supports:
-     pi = (double)nr_ones / nr_bits;
+   - System bus EHCI controller
+   - CDROM and hard disc on AHCI bus
-     for (k = 0; k < nr_bits - 1; k++) {
+   - E1000E ethernet card on PCIe bus
--        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+-  - VGA display adaptor on PCIe bus
-+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
++  - Bochs display adapter on PCIe bus
-     }
+   - A generic SBSA watchdog device
      vn_obs += 1;
 --
-.20.1
+.34.1

Patches for rc1: nothing major, just some minor bugfixes and
code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

----------------------------------------------------------------
Alex Bennée (1):
      docs: add some notes on the sbsa-ref machine

AlexChen (1):
      ssi: Fix bad printf format specifiers

Andrew Jones (1):
      hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):
      hw/arm/nseries: Check return value from load_image_targphys()
      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Philippe Mathieu-Daudé (6):
      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
      hw/arm/armsse: Correct expansion MPC interrupt lines
      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):
      target/arm: Fix neon VTBL/VTBX for len > 1

Xinhao Zhang (3):
      target/arm: add spaces around operator
      target/arm: Don't use '#' flag of printf format
      target/arm: add space before the open parenthesis '('

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/imx_spi.c    | 2 +-
 hw/ssi/xilinx_spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
     case ECSPI_MSGDATA:
         return  "ECSPI_MSGDATA";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
        irq chain unless things really changed.  */
     if (pending != s->irqline) {
         s->irqline = pending;
-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
         qemu_set_irq(s->irq, pending);
     }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 8 ++++----
 target/arm/arm-semi.c  | 8 ++++----
 target/arm/helper.c    | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     for (i = 0; i < 32; ++i) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
          */
         for (i = 0; i < 32; ++i) {
             uint64_t tmp = note.vfp.vregs[2*i];
-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-            note.vfp.vregs[2*i+1] = tmp;
+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
+            note.vfp.vregs[2 * i + 1] = tmp;
         }
     }
 
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-                                  arg0, (int)arg1+1);
+                                  arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(3);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
+                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
         } else {
             char *s2;
             s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
-                                   arg0, (int)arg1+1);
+                                   arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
     uint32_t sum;
     sum = do_usad(a, b);
     sum += do_usad(a >> 8, b >> 8);
-    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 16, b >> 16);
     sum += do_usad(a >> 24, b >> 24);
     return sum;
 }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
                 break;
             default:
-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                         __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     case 0x7f: /* FSQRT (vector) */
         break;
     default:
-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
         g_assert_not_reached();
     }
 
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             - Hardware watchpoints.
            Hardware breakpoints have already been handled and skip this code.
          */
-        switch(dc->base.is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
             gen_goto_tb(dc, 1, dc->base.pc_next);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 docs/system/arm/sbsa.rst

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+==================================================================
+
+While the `virt` board is a generic board platform that doesn't match
+any real hardware the `sbsa-ref` board intends to look like real
+hardware. The `Server Base System Architecture
+<https://developer.arm.com/documentation/den0029/latest>` defines a
+minimum base line of hardware support and importantly how the firmware
+reports that to any operating system. It is a static system that
+reports a very minimal DT to the firmware for non-discoverable
+information about components affected by the qemu command line (i.e.
+cpus and memory). As a result it must have a firmware specifically
+built to expect a certain hardware layout (as you would in a real
+machine).
+
+It is intended to be a machine for developing firmware and testing
+standards compliance with operating systems.
+
+Supported devices
+"""""""""""""""""
+
+The sbsa-ref board supports:
+
+  - A configurable number of AArch64 CPUs
+  - GIC version 3
+  - System bus AHCI controller
+  - System bus EHCI controller
+  - CDROM and hard disc on AHCI bus
+  - E1000E ethernet card on PCIe bus
+  - VGA display adaptor on PCIe bus
+  - A generic SBSA watchdog device
+
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/mps2
    arm/musca
    arm/realview
+   arm/sbsa
    arm/versatile
    arm/vexpress
    arm/aspeed
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h             |  2 +-
 target/arm/op_helper.c          | 23 +++++++++--------
 target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-                          uint32_t maxindex)
+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+                          uint64_t ireg, uint64_t def)
 {
-    uint32_t val, shift;
-    uint64_t *table = vn;
+    uint64_t tmp, val = 0;
+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+    uint32_t base_reg = desc >> 2;
+    uint32_t shift, index, reg;
 
-    val = 0;
-    for (shift = 0; shift < 32; shift += 8) {
-        uint32_t index = (ireg >> shift) & 0xff;
+    for (shift = 0; shift < 64; shift += 8) {
+        index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-            val |= tmp << shift;
+            reg = base_reg + (index >> 3);
+            tmp = *aa32_vfp_dreg(env, reg);
+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
         } else {
-            val |= def & (0xff << shift);
+            tmp = def & (0xffull << shift);
         }
+        val |= tmp;
     }
     return val;
 }
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
 
 static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
 {
-    int n;
-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-    TCGv_ptr ptr1;
+    TCGv_i64 val, def;
+    TCGv_i32 desc;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return true;
     }
 
-    n = a->len + 1;
-    if ((a->vn + n) > 32) {
+    if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
          * helper function running off the end of the register file.
          */
         return false;
     }
-    n <<= 3;
-    tmp = tcg_temp_new_i32();
-    if (a->op) {
-        read_neon_element32(tmp, a->vd, 0, MO_32);
-    } else {
-        tcg_gen_movi_i32(tmp, 0);
-    }
-    tmp2 = tcg_temp_new_i32();
-    read_neon_element32(tmp2, a->vm, 0, MO_32);
-    ptr1 = vfp_reg_ptr(true, a->vn);
-    tmp4 = tcg_const_i32(n);
-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 
+    desc = tcg_const_i32((a->vn << 2) | a->len);
+    def = tcg_temp_new_i64();
     if (a->op) {
-        read_neon_element32(tmp, a->vd, 1, MO_32);
+        read_neon_element64(def, a->vd, 0, MO_64);
     } else {
-        tcg_gen_movi_i32(tmp, 0);
+        tcg_gen_movi_i64(def, 0);
     }
-    tmp3 = tcg_temp_new_i32();
-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp4);
-    tcg_temp_free_ptr(ptr1);
+    val = tcg_temp_new_i64();
+    read_neon_element64(val, a->vm, 0, MO_64);
 
-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-    tcg_temp_free_i32(tmp2);
-    tcg_temp_free_i32(tmp3);
+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+    write_neon_element64(val, a->vd, 0, MO_64);
+
+    tcg_temp_free_i64(def);
+    tcg_temp_free_i64(val);
+    tcg_temp_free_i32(desc);
     return true;
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                                         qdev_get_gpio_in(dev_splitter, 0));
             qdev_connect_gpio_out(dev_splitter, 0,
                                   qdev_get_gpio_in_named(dev_secctl,
-                                                         "mpc_status", 0));
+                                                         "mpc_status",
+                                                         i - IOTS_NUM_EXP_MPC));
         }
 
         qdev_connect_gpio_out(dev_splitter, 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/stm32f2xx_syscfg.h | 2 --
 hw/arm/stm32f205_soc.c             | 1 -
 hw/misc/stm32f2xx_syscfg.c         | 2 --
 3 files changed, 5 deletions(-)

diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32f2xx_syscfg.h
+++ b/include/hw/misc/stm32f2xx_syscfg.h
@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
     uint32_t syscfg_exticr3;
     uint32_t syscfg_exticr4;
     uint32_t syscfg_cmpcr;
-
-    qemu_irq irq;
 };
 
 #endif /* HW_STM32F2XX_SYSCFG_H */
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, 0x40013800);
-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
 
     /* Attach UART (uses USART registers) and USART controllers */
     for (i = 0; i < STM_NUM_USARTS; i++) {
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 {
     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 
-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                           TYPE_STM32F2XX_SYSCFG, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/nseries.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
 }
 
-static void n8x0_uart_setup(struct n800_s *s)
-{
-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
-    /*
-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-     * here, but this code has been removed with the bluetooth backend.
-     */
-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-}
-
 static void n8x0_usb_setup(struct n800_s *s)
 {
     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
     n8x0_spi_setup(s);
     n8x0_dss_setup(s);
     n8x0_cbus_setup(s);
-    n8x0_uart_setup(s);
     if (machine_usb(machine)) {
         n8x0_usb_setup(s);
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 17 +++++++++++++----
 hw/arm/Kconfig    |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
+#include "hw/or-irq.h"
 #include "hw/audio/wm8750.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@
 #define MP_TIMER4_IRQ           7
 #define MP_EHCI_IRQ             8
 #define MP_ETH_IRQ              9
-#define MP_UART1_IRQ            11
-#define MP_UART2_IRQ            11
+#define MP_UART_SHARED_IRQ      11
 #define MP_GPIO_IRQ             12
 #define MP_RTC_IRQ              28
 #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
     ARMCPU *cpu;
     qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
     DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+    /* Logically OR both UART IRQs together */
+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+
+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 0),
                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 1),
                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 
     /* Register flash */
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
 
 config MUSICPAL
     bool
+    select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
     select PTIMER
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
 static void musicpal_init(MachineState *machine)
 {
     ARMCPU *cpu;
-    qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *pic;
     DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-    for (i = 0; i < 32; i++) {
-        pic[i] = qdev_get_gpio_in(dev, i);
-    }
-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                          pic[MP_TIMER4_IRQ], NULL);
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
 
     /* Logically OR both UART IRQs together */
     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
 
     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                    qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_fatal);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
 
     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-                               pic[MP_GPIO_IRQ]);
+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
 
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              NULL);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
 
     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
     arm_load_kernel(cpu, machine, &musicpal_binfo);
-- 
2.20.1

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
---
 hw/arm/nseries.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
         /* No, wait, better start at the ROM.  */
         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
 
-        /* This is intended for loading the `secondary.bin' program from
+        /*
+         * This is intended for loading the `secondary.bin' program from
          * Nokia images (the NOLO bootloader).  The entry point seems
          * to be at OMAP2_Q2_BASE + 0x400000.
          *
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
          *
          * The code above is for loading the `zImage' file from Nokia
-         * images.  */
-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                            machine->ram_size - 0x400000);
+         * images.
+         */
+        if (load_image_targphys(option_rom[0].name,
+                                OMAP2_Q2_BASE + 0x400000,
+                                machine->ram_size - 0x400000) < 0) {
+            error_report("Failed to load secondary bootloader %s",
+                         option_rom[0].name);
+            exit(EXIT_FAILURE);
+        }
 
         n800_setup_nolo_tags(nolo_tags);
         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
     pi = (double)nr_ones / nr_bits;
 
     for (k = 0; k < nr_bits - 1; k++) {
-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
     }
     vn_obs += 1;
 
-- 
2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
---
 target/arm/translate-neon.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
     if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
     desc = tcg_const_i32((a->vn << 2) | a->len);
     def = tcg_temp_new_i64();
     if (a->op) {
-- 
2.20.1

Hi; here's the latest batch of arm changes. The big thing
in here is the SMMUv3 changes to add stage-2 translation support.

thanks
-- PMM

The following changes since commit aa9bbd865502ed517624ab6fe7d4b5d89ca95e43:

Merge tag 'pull-ppc-20230528' of https://gitlab.com/danielhb/qemu into staging (2023-05-29 14:31:52 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230530

for you to fetch changes up to b03d0d4f531a8b867e0aac1fab0b876903015680:

docs: sbsa: correct graphics card name (2023-05-30 13:32:46 +0100)

----------------------------------------------------------------
target-arm queue:
 * fsl-imx6: Add SNVS support for i.MX6 boards
 * smmuv3: Add support for stage 2 translations
 * hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop
 * hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
 * cleanups for recent Kconfig changes
 * target/arm: Explicitly select short-format FSR for M-profile
 * tests/qtest: Run arm-specific tests only if the required machine is available
 * hw/arm/sbsa-ref: add GIC node into DT
 * docs: sbsa: correct graphics card name
 * Update copyright dates to 2023

----------------------------------------------------------------
Clément Chigot (1):
      hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number

Enze Li (1):
      Update copyright dates to 2023

Fabiano Rosas (3):
      target/arm: Explain why we need to select ARM_V7M
      arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
      arm/Kconfig: Make TCG dependence explicit

Marcin Juszkiewicz (2):
      hw/arm/sbsa-ref: add GIC node into DT
      docs: sbsa: correct graphics card name

Mostafa Saleh (10):
      hw/arm/smmuv3: Add missing fields for IDR0
      hw/arm/smmuv3: Update translation config to hold stage-2
      hw/arm/smmuv3: Refactor stage-1 PTW
      hw/arm/smmuv3: Add page table walk for stage-2
      hw/arm/smmuv3: Parse STE config for stage-2
      hw/arm/smmuv3: Make TLB lookup work for stage-2
      hw/arm/smmuv3: Add VMID to TLB tagging
      hw/arm/smmuv3: Add CMDs related to stage-2
      hw/arm/smmuv3: Add stage-2 support in iova notifier
      hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2

Peter Maydell (1):
      target/arm: Explicitly select short-format FSR for M-profile

Thomas Huth (1):
      tests/qtest: Run arm-specific tests only if the required machine is available

Tommy Wu (1):
      hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.

Vitaly Cheptsov (1):
      fsl-imx6: Add SNVS support for i.MX6 boards

From: Vitaly Cheptsov <cheptsov@ispras.ru>

SNVS is supported on both i.MX6 and i.MX6UL and is needed
to support shutdown on the board.

Cc: Peter Maydell <peter.maydell@linaro.org> (odd fixer:SABRELITE / i.MX6)
Cc: Jean-Christophe Dubois <jcd@tribudubois.net> (reviewer:SABRELITE / i.MX6)
Cc: qemu-arm@nongnu.org (open list:SABRELITE / i.MX6)
Cc: qemu-devel@nongnu.org (open list:All patches CC here)
Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>
Message-id: 20230515095015.66860-1-cheptsov@ispras.ru
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h | 2 ++
 hw/arm/fsl-imx6.c         | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/cpu/a9mpcore.h"
 #include "hw/misc/imx6_ccm.h"
 #include "hw/misc/imx6_src.h"
+#include "hw/misc/imx7_snvs.h"
 #include "hw/watchdog/wdt_imx2.h"
 #include "hw/char/imx_serial.h"
 #include "hw/timer/imx_gpt.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
     A9MPPrivState  a9mpcore;
     IMX6CCMState   ccm;
     IMX6SRCState   src;
+    IMX7SNVSState  snvs;
     IMXSerialState uart[FSL_IMX6_NUM_UARTS];
     IMXGPTState    gpt;
     IMXEPITState   epit[FSL_IMX6_NUM_EPITS];
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
 
     object_initialize_child(obj, "src", &s->src, TYPE_IMX6_SRC);
 
+    object_initialize_child(obj, "snvs", &s->snvs, TYPE_IMX7_SNVS);
+
     for (i = 0; i < FSL_IMX6_NUM_UARTS; i++) {
         snprintf(name, NAME_SIZE, "uart%d", i + 1);
         object_initialize_child(obj, name, &s->uart[i], TYPE_IMX_SERIAL);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                        qdev_get_gpio_in(DEVICE(&s->a9mpcore),
                                         FSL_IMX6_ENET_MAC_1588_IRQ));
 
+    /*
+     * SNVS
+     */
+    sysbus_realize(SYS_BUS_DEVICE(&s->snvs), &error_abort);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->snvs), 0, FSL_IMX6_SNVSHP_ADDR);
+
     /*
      * Watchdog
      */
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support.
Add IDR0 fields related to stage-2.

VMID16: 16-bit VMID supported.
S2P: Stage-2 translation supported.

They are described in 6.3.1 SMMU_IDR0.

No functional change intended.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-2-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef enum SMMUTranslationStatus {
 /* MMIO Registers */
 
 REG32(IDR0,                0x0)
+    FIELD(IDR0, S2P,         0 , 1)
     FIELD(IDR0, S1P,         1 , 1)
     FIELD(IDR0, TTF,         2 , 2)
     FIELD(IDR0, COHACC,      4 , 1)
     FIELD(IDR0, ASID16,      12, 1)
+    FIELD(IDR0, VMID16,      18, 1)
     FIELD(IDR0, TTENDIAN,    21, 2)
     FIELD(IDR0, STALL_MODEL, 24, 2)
     FIELD(IDR0, TERM_MODEL,  26, 1)
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, add a S2 config
struct(SMMUS2Cfg), composed of the following fields and embedded in
the main SMMUTransCfg:
 -tsz: Size of IPA input region (S2T0SZ)
 -sl0: Start level of translation (S2SL0)
 -affd: AF Fault Disable (S2AFFD)
 -record_faults: Record fault events (S2R)
 -granule_sz: Granule page shift (based on S2TG)
 -vmid: Virtual Machine ID (S2VMID)
 -vttb: Address of translation table base (S2TTB)
 -eff_ps: Effective PA output range (based on S2PS)

They will be used in the next patches in stage-2 address translation.

The fields in SMMUS2Cfg, are reordered to make the shared and stage-1
fields next to each other, this reordering didn't change the struct
size (104 bytes before and after).

Stage-1 only fields: aa64, asid, tt, ttb, tbi, record_faults, oas.
oas is stage-1 output address size. However, it is used to check
input address in case stage-1 is unimplemented or bypassed according
to SMMUv3 manual IHI0070.E "3.4. Address sizes"

Shared fields: stage, disabled, bypassed, aborted, iotlb_*.

No functional change intended.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-3-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUTLBEntry {
     uint8_t granule;
 } SMMUTLBEntry;
 
+/* Stage-2 configuration. */
+typedef struct SMMUS2Cfg {
+    uint8_t tsz;            /* Size of IPA input region (S2T0SZ) */
+    uint8_t sl0;            /* Start level of translation (S2SL0) */
+    bool affd;              /* AF Fault Disable (S2AFFD) */
+    bool record_faults;     /* Record fault events (S2R) */
+    uint8_t granule_sz;     /* Granule page shift (based on S2TG) */
+    uint8_t eff_ps;         /* Effective PA output range (based on S2PS) */
+    uint16_t vmid;          /* Virtual Machine ID (S2VMID) */
+    uint64_t vttb;          /* Address of translation table base (S2TTB) */
+} SMMUS2Cfg;
+
 /*
  * Generic structure populated by derived SMMU devices
  * after decoding the configuration information and used as
  * input to the page table walk
  */
 typedef struct SMMUTransCfg {
+    /* Shared fields between stage-1 and stage-2. */
     int stage;                 /* translation stage */
-    bool aa64;                 /* arch64 or aarch32 translation table */
     bool disabled;             /* smmu is disabled */
     bool bypassed;             /* translation is bypassed */
     bool aborted;              /* translation is aborted */
+    uint32_t iotlb_hits;       /* counts IOTLB hits */
+    uint32_t iotlb_misses;     /* counts IOTLB misses*/
+    /* Used by stage-1 only. */
+    bool aa64;                 /* arch64 or aarch32 translation table */
     bool record_faults;        /* record fault events */
     uint64_t ttb;              /* TT base address */
     uint8_t oas;               /* output address width */
     uint8_t tbi;               /* Top Byte Ignore */
     uint16_t asid;
     SMMUTransTableInfo tt[2];
-    uint32_t iotlb_hits;       /* counts IOTLB hits for this asid */
-    uint32_t iotlb_misses;     /* counts IOTLB misses for this asid */
+    /* Used by stage-2 only. */
+    struct SMMUS2Cfg s2cfg;
 } SMMUTransCfg;
 
 typedef struct SMMUDevice {
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, rename smmu_ptw_64 to
smmu_ptw_64_s1 and refactor some of the code so it can be reused in
stage-2 page table walk.

Remove AA64 check from PTW as decode_cd already ensures that AA64 is
used, otherwise it faults with C_BAD_CD.

A stage member is added to SMMUPTWEventInfo to differentiate
between stage-1 and stage-2 ptw faults.

Add stage argument to trace_smmu_ptw_level be consistent with other
trace events.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-4-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h | 16 +++++++++++++---
 hw/arm/smmu-common.c         | 27 ++++++++++-----------------
 hw/arm/smmuv3.c              |  2 ++
 hw/arm/trace-events          |  2 +-
 4 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/pci/pci.h"
 #include "qom/object.h"
 
-#define SMMU_PCI_BUS_MAX      256
-#define SMMU_PCI_DEVFN_MAX    256
-#define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
+#define SMMU_PCI_BUS_MAX                    256
+#define SMMU_PCI_DEVFN_MAX                  256
+#define SMMU_PCI_DEVFN(sid)                 (sid & 0xFF)
+
+/* VMSAv8-64 Translation constants and functions */
+#define VMSA_LEVELS                         4
+
+#define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
+#define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
+                                             (VMSA_LEVELS - (lvl)))
+#define VMSA_IDXMSK(isz, strd, lvl)         ((1ULL << \
+                                             VMSA_BIT_LVL(isz, strd, lvl)) - 1)
 
 /*
  * Page table walk error types
@@ -XXX,XX +XXX,XX @@ typedef enum {
 } SMMUPTWEventType;
 
 typedef struct SMMUPTWEventInfo {
+    int stage;
     SMMUPTWEventType type;
     dma_addr_t addr; /* fetched address that induced an abort, if any */
 } SMMUPTWEventInfo;
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
 }
 
 /**
- * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
+ * smmu_ptw_64_s1 - VMSAv8-64 Walk of the page tables for a given IOVA
  * @cfg: translation config
  * @iova: iova to translate
  * @perm: access type
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
  * Upon success, @tlbe is filled with translated_addr and entry
  * permission rights.
  */
-static int smmu_ptw_64(SMMUTransCfg *cfg,
-                       dma_addr_t iova, IOMMUAccessFlags perm,
-                       SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+static int smmu_ptw_64_s1(SMMUTransCfg *cfg,
+                          dma_addr_t iova, IOMMUAccessFlags perm,
+                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
     dma_addr_t baseaddr, indexmask;
     int stage = cfg->stage;
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
     }
 
     granule_sz = tt->granule_sz;
-    stride = granule_sz - 3;
+    stride = VMSA_STRIDE(granule_sz);
     inputsize = 64 - tt->tsz;
     level = 4 - (inputsize - 4) / stride;
-    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
+    indexmask = VMSA_IDXMSK(inputsize, stride, level);
     baseaddr = extract64(tt->ttb, 0, 48);
     baseaddr &= ~indexmask;
 
-    while (level <= 3) {
+    while (level < VMSA_LEVELS) {
         uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
         uint64_t mask = subpage_size - 1;
         uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
         if (get_pte(baseaddr, offset, &pte, info)) {
                 goto error;
         }
-        trace_smmu_ptw_level(level, iova, subpage_size,
+        trace_smmu_ptw_level(stage, level, iova, subpage_size,
                              baseaddr, offset, pte);
 
         if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
     info->type = SMMU_PTW_ERR_TRANSLATION;
 
 error:
+    info->stage = 1;
     tlbe->entry.perm = IOMMU_NONE;
     return -EINVAL;
 }
@@ -XXX,XX +XXX,XX @@ error:
 int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
              SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
-    if (!cfg->aa64) {
-        /*
-         * This code path is not entered as we check this while decoding
-         * the configuration data in the derived SMMU model.
-         */
-        g_assert_not_reached();
-    }
-
-    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
+    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
 }
 
 /**
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
     cached_entry = g_new0(SMMUTLBEntry, 1);
 
     if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) {
+        /* All faults from PTW has S2 field. */
+        event.u.f_walk_eabt.s2 = (ptw_info.stage == 2);
         g_free(cached_entry);
         switch (ptw_info.type) {
         case SMMU_PTW_ERR_WALK_EABT:
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
 
 # smmu-common.c
 smmu_add_mr(const char *name) "%s"
-smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
+smmu_ptw_level(int stage, int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
 smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
 smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
 smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, add Stage-2 PTW code.
Only Aarch64 format is supported as stage-1.

Nesting stage-1 and stage-2 is not supported right now.

HTTU is not supported, SW is expected to maintain the Access flag.
This is described in the SMMUv3 manual(IHI 0070.E.a)
"5.2. Stream Table Entry" in "[181] S2AFFD".
This flag determines the behavior on access of a stage-2 page whose
descriptor has AF == 0:
- 0b0: An Access flag fault occurs (stall not supported).
- 0b1: An Access flag fault never occurs.
An Access fault takes priority over a Permission fault.

There are 3 address size checks for stage-2 according to
(IHI 0070.E.a) in "3.4. Address sizes".
- As nesting is not supported, input address is passed directly to
stage-2, and is checked against IAS.
We use cfg->oas to hold the OAS when stage-1 is not used, this is set
in the next patch.
This check is done outside of smmu_ptw_64_s2 as it is not part of
stage-2(it throws stage-1 fault), and the stage-2 function shouldn't
change it's behavior when nesting is supported.
When nesting is supported and we figure out how to combine TLB for
stage-1 and stage-2 we can move this check into the stage-1 function
as described in ARM DDI0487I.a in pseudocode
aarch64/translation/vmsa_translation/AArch64.S1Translate
aarch64/translation/vmsa_translation/AArch64.S1DisabledOutput

- Input to stage-2 is checked against s2t0sz, and throws stage-2
transaltion fault if exceeds it.

- Output of stage-2 is checked against effective PA output range.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-5-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-internal.h |  35 ++++++++++
 hw/arm/smmu-common.c   | 142 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 176 insertions(+), 1 deletion(-)

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-internal.h
+++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@
 #define PTE_APTABLE(pte) \
     (extract64(pte, 61, 2))
 
+#define PTE_AF(pte) \
+    (extract64(pte, 10, 1))
 /*
  * TODO: At the moment all transactions are considered as privileged (EL1)
  * as IOMMU translation callback does not pass user/priv attributes.
@@ -XXX,XX +XXX,XX @@
 #define is_permission_fault(ap, perm) \
     (((perm) & IOMMU_WO) && ((ap) & 0x2))
 
+#define is_permission_fault_s2(s2ap, perm) \
+    (!(((s2ap) & (perm)) == (perm)))
+
 #define PTE_AP_TO_PERM(ap) \
     (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
 
@@ -XXX,XX +XXX,XX @@ uint64_t iova_level_offset(uint64_t iova, int inputsize,
             MAKE_64BIT_MASK(0, gsz - 3);
 }
 
+/* FEAT_LPA2 and FEAT_TTST are not implemented. */
+static inline int get_start_level(int sl0 , int granule_sz)
+{
+    /* ARM DDI0487I.a: Table D8-12. */
+    if (granule_sz == 12) {
+        return 2 - sl0;
+    }
+    /* ARM DDI0487I.a: Table D8-22 and Table D8-31. */
+    return 3 - sl0;
+}
+
+/*
+ * Index in a concatenated first level stage-2 page table.
+ * ARM DDI0487I.a: D8.2.2 Concatenated translation tables.
+ */
+static inline int pgd_concat_idx(int start_level, int granule_sz,
+                                 dma_addr_t ipa)
+{
+    uint64_t ret;
+    /*
+     * Get the number of bits handled by next levels, then any extra bits in
+     * the address should index the concatenated tables. This relation can be
+     * deduced from tables in ARM DDI0487I.a: D8.2.7-9
+     */
+    int shift =  level_shift(start_level - 1, granule_sz);
+
+    ret = ipa >> shift;
+    return ret;
+}
+
 #define SMMU_IOTLB_ASID(key) ((key).asid)
 
 typedef struct SMMUIOTLBPageInvInfo {
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ error:
     return -EINVAL;
 }
 
+/**
+ * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa
+ * for stage-2.
+ * @cfg: translation config
+ * @ipa: ipa to translate
+ * @perm: access type
+ * @tlbe: SMMUTLBEntry (out)
+ * @info: handle to an error info
+ *
+ * Return 0 on success, < 0 on error. In case of error, @info is filled
+ * and tlbe->perm is set to IOMMU_NONE.
+ * Upon success, @tlbe is filled with translated_addr and entry
+ * permission rights.
+ */
+static int smmu_ptw_64_s2(SMMUTransCfg *cfg,
+                          dma_addr_t ipa, IOMMUAccessFlags perm,
+                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+{
+    const int stage = 2;
+    int granule_sz = cfg->s2cfg.granule_sz;
+    /* ARM DDI0487I.a: Table D8-7. */
+    int inputsize = 64 - cfg->s2cfg.tsz;
+    int level = get_start_level(cfg->s2cfg.sl0, granule_sz);
+    int stride = VMSA_STRIDE(granule_sz);
+    int idx = pgd_concat_idx(level, granule_sz, ipa);
+    /*
+     * Get the ttb from concatenated structure.
+     * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte))
+     */
+    uint64_t baseaddr = extract64(cfg->s2cfg.vttb, 0, 48) + (1 << stride) *
+                                  idx * sizeof(uint64_t);
+    dma_addr_t indexmask = VMSA_IDXMSK(inputsize, stride, level);
+
+    baseaddr &= ~indexmask;
+
+    /*
+     * On input, a stage 2 Translation fault occurs if the IPA is outside the
+     * range configured by the relevant S2T0SZ field of the STE.
+     */
+    if (ipa >= (1ULL << inputsize)) {
+        info->type = SMMU_PTW_ERR_TRANSLATION;
+        goto error;
+    }
+
+    while (level < VMSA_LEVELS) {
+        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
+        uint64_t mask = subpage_size - 1;
+        uint32_t offset = iova_level_offset(ipa, inputsize, level, granule_sz);
+        uint64_t pte, gpa;
+        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
+        uint8_t s2ap;
+
+        if (get_pte(baseaddr, offset, &pte, info)) {
+                goto error;
+        }
+        trace_smmu_ptw_level(stage, level, ipa, subpage_size,
+                             baseaddr, offset, pte);
+        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
+            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
+                                       pte_addr, offset, pte);
+            break;
+        }
+
+        if (is_table_pte(pte, level)) {
+            baseaddr = get_table_pte_address(pte, granule_sz);
+            level++;
+            continue;
+        } else if (is_page_pte(pte, level)) {
+            gpa = get_page_pte_address(pte, granule_sz);
+            trace_smmu_ptw_page_pte(stage, level, ipa,
+                                    baseaddr, pte_addr, pte, gpa);
+        } else {
+            uint64_t block_size;
+
+            gpa = get_block_pte_address(pte, level, granule_sz,
+                                        &block_size);
+            trace_smmu_ptw_block_pte(stage, level, baseaddr,
+                                     pte_addr, pte, ipa, gpa,
+                                     block_size >> 20);
+        }
+
+        /*
+         * If S2AFFD and PTE.AF are 0 => fault. (5.2. Stream Table Entry)
+         * An Access fault takes priority over a Permission fault.
+         */
+        if (!PTE_AF(pte) && !cfg->s2cfg.affd) {
+            info->type = SMMU_PTW_ERR_ACCESS;
+            goto error;
+        }
+
+        s2ap = PTE_AP(pte);
+        if (is_permission_fault_s2(s2ap, perm)) {
+            info->type = SMMU_PTW_ERR_PERMISSION;
+            goto error;
+        }
+
+        /*
+         * The address output from the translation causes a stage 2 Address
+         * Size fault if it exceeds the effective PA output range.
+         */
+        if (gpa >= (1ULL << cfg->s2cfg.eff_ps)) {
+            info->type = SMMU_PTW_ERR_ADDR_SIZE;
+            goto error;
+        }
+
+        tlbe->entry.translated_addr = gpa;
+        tlbe->entry.iova = ipa & ~mask;
+        tlbe->entry.addr_mask = mask;
+        tlbe->entry.perm = s2ap;
+        tlbe->level = level;
+        tlbe->granule = granule_sz;
+        return 0;
+    }
+    info->type = SMMU_PTW_ERR_TRANSLATION;
+
+error:
+    info->stage = 2;
+    tlbe->entry.perm = IOMMU_NONE;
+    return -EINVAL;
+}
+
 /**
  * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
  *
@@ -XXX,XX +XXX,XX @@ error:
 int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
              SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
-    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
+    if (cfg->stage == 1) {
+        return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
+    } else if (cfg->stage == 2) {
+        /*
+         * If bypassing stage 1(or unimplemented), the input address is passed
+         * directly to stage 2 as IPA. If the input address of a transaction
+         * exceeds the size of the IAS, a stage 1 Address Size fault occurs.
+         * For AA64, IAS = OAS according to (IHI 0070.E.a) "3.4 Address sizes"
+         */
+        if (iova >= (1ULL << cfg->oas)) {
+            info->type = SMMU_PTW_ERR_ADDR_SIZE;
+            info->stage = 1;
+            tlbe->entry.perm = IOMMU_NONE;
+            return -EINVAL;
+        }
+
+        return smmu_ptw_64_s2(cfg, iova, perm, tlbe, info);
+    }
+
+    g_assert_not_reached();
 }
 
 /**
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Parse stage-2 configuration from STE and populate it in SMMUS2Cfg.
Validity of field values are checked when possible.

Only AA64 tables are supported and Small Translation Tables (STT) are
not supported.

According to SMMUv3 UM(IHI0070E) "5.2 Stream Table Entry": All fields
with an S2 prefix (with the exception of S2VMID) are IGNORED when
stage-2 bypasses translation (Config[1] == 0).

Which means that VMID can be used(for TLB tagging) even if stage-2 is
bypassed, so we parse it unconditionally when S2P exists. Otherwise
it is set to -1.(only S1P)

As stall is not supported, if S2S is set the translation would abort.
For S2R, we reuse the same code used for stage-1 with flag
record_faults. However when nested translation is supported we would
need to separate stage-1 and stage-2 faults.

Fix wrong shift in STE_S2HD, STE_S2HA, STE_S2S.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20230516203327.2051088-6-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h     |  10 +-
 include/hw/arm/smmu-common.h |   1 +
 include/hw/arm/smmuv3.h      |   3 +
 hw/arm/smmuv3.c              | 181 +++++++++++++++++++++++++++++++++--
 4 files changed, 185 insertions(+), 10 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef struct CD {
 #define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
 #define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
 #define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
-#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
-#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
-#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
+#define STE_S2ENDI(x)      extract32((x)->word[5], 20, 1)
+#define STE_S2AFFD(x)      extract32((x)->word[5], 21, 1)
+#define STE_S2HD(x)        extract32((x)->word[5], 23, 1)
+#define STE_S2HA(x)        extract32((x)->word[5], 24, 1)
+#define STE_S2S(x)         extract32((x)->word[5], 25, 1)
+#define STE_S2R(x)         extract32((x)->word[5], 26, 1)
+
 #define STE_CTXPTR(x)                                           \
     ({                                                          \
         unsigned long addr;                                     \
diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@
 
 /* VMSAv8-64 Translation constants and functions */
 #define VMSA_LEVELS                         4
+#define VMSA_MAX_S2_CONCAT                  16
 
 #define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
 #define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmuv3.h
+++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@ struct SMMUv3Class {
 #define TYPE_ARM_SMMUV3   "arm-smmuv3"
 OBJECT_DECLARE_TYPE(SMMUv3State, SMMUv3Class, ARM_SMMUV3)
 
+#define STAGE1_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S1P)
+#define STAGE2_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S2P)
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 #include "smmuv3-internal.h"
 #include "smmu-internal.h"
 
+#define PTW_RECORD_FAULT(cfg)   (((cfg)->stage == 1) ? (cfg)->record_faults : \
+                                 (cfg)->s2cfg.record_faults)
+
 /**
  * smmuv3_trigger_irq - pulse @irq if enabled and update
  * GERROR register in case of GERROR interrupt
@@ -XXX,XX +XXX,XX @@ static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
     return 0;
 }
 
+/*
+ * Max valid value is 39 when SMMU_IDR3.STT == 0.
+ * In architectures after SMMUv3.0:
+ * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this
+ *   field is MAX(16, 64-IAS)
+ * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field
+ *   is (64-IAS).
+ * As we only support AA64, IAS = OAS.
+ */
+static bool s2t0sz_valid(SMMUTransCfg *cfg)
+{
+    if (cfg->s2cfg.tsz > 39) {
+        return false;
+    }
+
+    if (cfg->s2cfg.granule_sz == 16) {
+        return (cfg->s2cfg.tsz >= 64 - oas2bits(SMMU_IDR5_OAS));
+    }
+
+    return (cfg->s2cfg.tsz >= MAX(64 - oas2bits(SMMU_IDR5_OAS), 16));
+}
+
+/*
+ * Return true if s2 page table config is valid.
+ * This checks with the configured start level, ias_bits and granularity we can
+ * have a valid page table as described in ARM ARM D8.2 Translation process.
+ * The idea here is to see for the highest possible number of IPA bits, how
+ * many concatenated tables we would need, if it is more than 16, then this is
+ * not possible.
+ */
+static bool s2_pgtable_config_valid(uint8_t sl0, uint8_t t0sz, uint8_t gran)
+{
+    int level = get_start_level(sl0, gran);
+    uint64_t ipa_bits = 64 - t0sz;
+    uint64_t max_ipa = (1ULL << ipa_bits) - 1;
+    int nr_concat = pgd_concat_idx(level, gran, max_ipa) + 1;
+
+    return nr_concat <= VMSA_MAX_S2_CONCAT;
+}
+
+static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
+{
+    cfg->stage = 2;
+
+    if (STE_S2AA64(ste) == 0x0) {
+        qemu_log_mask(LOG_UNIMP,
+                      "SMMUv3 AArch32 tables not supported\n");
+        g_assert_not_reached();
+    }
+
+    switch (STE_S2TG(ste)) {
+    case 0x0: /* 4KB */
+        cfg->s2cfg.granule_sz = 12;
+        break;
+    case 0x1: /* 64KB */
+        cfg->s2cfg.granule_sz = 16;
+        break;
+    case 0x2: /* 16KB */
+        cfg->s2cfg.granule_sz = 14;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste));
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.vttb = STE_S2TTB(ste);
+
+    cfg->s2cfg.sl0 = STE_S2SL0(ste);
+    /* FEAT_TTST not supported. */
+    if (cfg->s2cfg.sl0 == 0x3) {
+        qemu_log_mask(LOG_UNIMP, "SMMUv3 S2SL0 = 0x3 has no meaning!\n");
+        goto bad_ste;
+    }
+
+    /* For AA64, The effective S2PS size is capped to the OAS. */
+    cfg->s2cfg.eff_ps = oas2bits(MIN(STE_S2PS(ste), SMMU_IDR5_OAS));
+    /*
+     * It is ILLEGAL for the address in S2TTB to be outside the range
+     * described by the effective S2PS value.
+     */
+    if (cfg->s2cfg.vttb & ~(MAKE_64BIT_MASK(0, cfg->s2cfg.eff_ps))) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 S2TTB too large 0x%lx, effective PS %d bits\n",
+                      cfg->s2cfg.vttb,  cfg->s2cfg.eff_ps);
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.tsz = STE_S2T0SZ(ste);
+
+    if (!s2t0sz_valid(cfg)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 bad STE S2T0SZ = %d\n",
+                      cfg->s2cfg.tsz);
+        goto bad_ste;
+    }
+
+    if (!s2_pgtable_config_valid(cfg->s2cfg.sl0, cfg->s2cfg.tsz,
+                                    cfg->s2cfg.granule_sz)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 STE stage 2 config not valid!\n");
+        goto bad_ste;
+    }
+
+    /* Only LE supported(IDR0.TTENDIAN). */
+    if (STE_S2ENDI(ste)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 STE_S2ENDI only supports LE!\n");
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.affd = STE_S2AFFD(ste);
+
+    cfg->s2cfg.record_faults = STE_S2R(ste);
+    /* As stall is not supported. */
+    if (STE_S2S(ste)) {
+        qemu_log_mask(LOG_UNIMP, "SMMUv3 Stall not implemented!\n");
+        goto bad_ste;
+    }
+
+    /* This is still here as stage 2 has not been fully enabled yet. */
+    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
+    goto bad_ste;
+
+    return 0;
+
+bad_ste:
+    return -EINVAL;
+}
+
 /* Returns < 0 in case of invalid STE, 0 otherwise */
 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
                       STE *ste, SMMUEventInfo *event)
 {
     uint32_t config;
+    int ret;
 
     if (!STE_VALID(ste)) {
         if (!event->inval_ste_allowed) {
@@ -XXX,XX +XXX,XX @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
         return 0;
     }
 
-    if (STE_CFG_S2_ENABLED(config)) {
-        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
+    /*
+     * If a stage is enabled in SW while not advertised, throw bad ste
+     * according to user manual(IHI0070E) "5.2 Stream Table Entry".
+     */
+    if (!STAGE1_SUPPORTED(s) && STE_CFG_S1_ENABLED(config)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S1 used but not supported.\n");
         goto bad_ste;
     }
+    if (!STAGE2_SUPPORTED(s) && STE_CFG_S2_ENABLED(config)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S2 used but not supported.\n");
+        goto bad_ste;
+    }
+
+    if (STAGE2_SUPPORTED(s)) {
+        /* VMID is considered even if s2 is disabled. */
+        cfg->s2cfg.vmid = STE_S2VMID(ste);
+    } else {
+        /* Default to -1 */
+        cfg->s2cfg.vmid = -1;
+    }
+
+    if (STE_CFG_S2_ENABLED(config)) {
+        /*
+         * Stage-1 OAS defaults to OAS even if not enabled as it would be used
+         * in input address check for stage-2.
+         */
+        cfg->oas = oas2bits(SMMU_IDR5_OAS);
+        ret = decode_ste_s2_cfg(cfg, ste);
+        if (ret) {
+            goto bad_ste;
+        }
+    }
 
     if (STE_S1CDMAX(ste) != 0) {
         qemu_log_mask(LOG_UNIMP,
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
     if (cached_entry) {
         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
             status = SMMU_TRANS_ERROR;
-            if (cfg->record_faults) {
+            /*
+             * We know that the TLB only contains either stage-1 or stage-2 as
+             * nesting is not supported. So it is sufficient to check the
+             * translation stage to know the TLB stage for now.
+             */
+            event.u.f_walk_eabt.s2 = (cfg->stage == 2);
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_PERMISSION;
                 event.u.f_permission.addr = addr;
                 event.u.f_permission.rnw = flag & 0x1;
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
             event.u.f_walk_eabt.addr2 = ptw_info.addr;
             break;
         case SMMU_PTW_ERR_TRANSLATION:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_TRANSLATION;
                 event.u.f_translation.addr = addr;
                 event.u.f_translation.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_ADDR_SIZE:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_ADDR_SIZE;
                 event.u.f_addr_size.addr = addr;
                 event.u.f_addr_size.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_ACCESS:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_ACCESS;
                 event.u.f_access.addr = addr;
                 event.u.f_access.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_PERMISSION:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_PERMISSION;
                 event.u.f_permission.addr = addr;
                 event.u.f_permission.rnw = flag & 0x1;
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Right now, either stage-1 or stage-2 are supported, this simplifies
how we can deal with TLBs.
This patch makes TLB lookup work if stage-2 is enabled instead of
stage-1.
TLB lookup is done before a PTW, if a valid entry is found we won't
do the PTW.
To be able to do TLB lookup, we need the correct tagging info, as
granularity and input size, so we get this based on the supported
translation stage. The TLB entries are added correctly from each
stage PTW.

When nested translation is supported, this would need to change, for
example if we go with a combined TLB implementation, we would need to
use the min of the granularities in TLB.

As stage-2 shouldn't be tagged by ASID, it will be set to -1 if S1P
is not enabled.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-7-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c | 44 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 33 insertions(+), 11 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
     STE ste;
     CD cd;
 
+    /* ASID defaults to -1 (if s1 is not supported). */
+    cfg->asid = -1;
+
     ret = smmu_find_ste(s, sid, &ste, event);
     if (ret) {
         return ret;
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
         .addr_mask = ~(hwaddr)0,
         .perm = IOMMU_NONE,
     };
+    /*
+     * Combined attributes used for TLB lookup, as only one stage is supported,
+     * it will hold attributes based on the enabled stage.
+     */
+    SMMUTransTableInfo tt_combined;
 
     qemu_mutex_lock(&s->mutex);
 
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
         goto epilogue;
     }
 
-    tt = select_tt(cfg, addr);
-    if (!tt) {
-        if (cfg->record_faults) {
-            event.type = SMMU_EVT_F_TRANSLATION;
-            event.u.f_translation.addr = addr;
-            event.u.f_translation.rnw = flag & 0x1;
+    if (cfg->stage == 1) {
+        /* Select stage1 translation table. */
+        tt = select_tt(cfg, addr);
+        if (!tt) {
+            if (cfg->record_faults) {
+                event.type = SMMU_EVT_F_TRANSLATION;
+                event.u.f_translation.addr = addr;
+                event.u.f_translation.rnw = flag & 0x1;
+            }
+            status = SMMU_TRANS_ERROR;
+            goto epilogue;
         }
-        status = SMMU_TRANS_ERROR;
-        goto epilogue;
-    }
+        tt_combined.granule_sz = tt->granule_sz;
+        tt_combined.tsz = tt->tsz;
 
-    page_mask = (1ULL << (tt->granule_sz)) - 1;
+    } else {
+        /* Stage2. */
+        tt_combined.granule_sz = cfg->s2cfg.granule_sz;
+        tt_combined.tsz = cfg->s2cfg.tsz;
+    }
+    /*
+     * TLB lookup looks for granule and input size for a translation stage,
+     * as only one stage is supported right now, choose the right values
+     * from the configuration.
+     */
+    page_mask = (1ULL << tt_combined.granule_sz) - 1;
     aligned_addr = addr & ~page_mask;
 
-    cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr);
+    cached_entry = smmu_iotlb_lookup(bs, cfg, &tt_combined, aligned_addr);
     if (cached_entry) {
         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
             status = SMMU_TRANS_ERROR;
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Allow TLB to be tagged with VMID.

If stage-1 is only supported, VMID is set to -1 and ignored from STE
and CMD_TLBI_NH* cmds.

Update smmu_iotlb_insert trace event to have vmid.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-8-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-internal.h       |  2 ++
 include/hw/arm/smmu-common.h |  5 +++--
 hw/arm/smmu-common.c         | 36 ++++++++++++++++++++++--------------
 hw/arm/smmuv3.c              | 12 +++++++++---
 hw/arm/trace-events          |  6 +++---
 5 files changed, 39 insertions(+), 22 deletions(-)

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-internal.h
+++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@ static inline int pgd_concat_idx(int start_level, int granule_sz,
 }
 
 #define SMMU_IOTLB_ASID(key) ((key).asid)
+#define SMMU_IOTLB_VMID(key) ((key).vmid)
 
 typedef struct SMMUIOTLBPageInvInfo {
     int asid;
+    int vmid;
     uint64_t iova;
     uint64_t mask;
 } SMMUIOTLBPageInvInfo;
diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUPciBus {
 typedef struct SMMUIOTLBKey {
     uint64_t iova;
     uint16_t asid;
+    uint16_t vmid;
     uint8_t tg;
     uint8_t level;
 } SMMUIOTLBKey;
@@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid);
 SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
                                 SMMUTransTableInfo *tt, hwaddr iova);
 void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *entry);
-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
+SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level);
 void smmu_iotlb_inv_all(SMMUState *s);
 void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
-void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
+void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl);
 
 /* Unmap the range of all the notifiers registered to any IOMMU mr */
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static guint smmu_iotlb_key_hash(gconstpointer v)
 
     /* Jenkins hash */
     a = b = c = JHASH_INITVAL + sizeof(*key);
-    a += key->asid + key->level + key->tg;
+    a += key->asid + key->vmid + key->level + key->tg;
     b += extract64(key->iova, 0, 32);
     c += extract64(key->iova, 32, 32);
 
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
     SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2;
 
     return (k1->asid == k2->asid) && (k1->iova == k2->iova) &&
-           (k1->level == k2->level) && (k1->tg == k2->tg);
+           (k1->level == k2->level) && (k1->tg == k2->tg) &&
+           (k1->vmid == k2->vmid);
 }
 
-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
+SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level)
 {
-    SMMUIOTLBKey key = {.asid = asid, .iova = iova, .tg = tg, .level = level};
+    SMMUIOTLBKey key = {.asid = asid, .vmid = vmid, .iova = iova,
+                        .tg = tg, .level = level};
 
     return key;
 }
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
         uint64_t mask = subpage_size - 1;
         SMMUIOTLBKey key;
 
-        key = smmu_get_iotlb_key(cfg->asid, iova & ~mask, tg, level);
+        key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid,
+                                 iova & ~mask, tg, level);
         entry = g_hash_table_lookup(bs->iotlb, &key);
         if (entry) {
             break;
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
 
     if (entry) {
         cfg->iotlb_hits++;
-        trace_smmu_iotlb_lookup_hit(cfg->asid, iova,
+        trace_smmu_iotlb_lookup_hit(cfg->asid, cfg->s2cfg.vmid, iova,
                                     cfg->iotlb_hits, cfg->iotlb_misses,
                                     100 * cfg->iotlb_hits /
                                     (cfg->iotlb_hits + cfg->iotlb_misses));
     } else {
         cfg->iotlb_misses++;
-        trace_smmu_iotlb_lookup_miss(cfg->asid, iova,
+        trace_smmu_iotlb_lookup_miss(cfg->asid, cfg->s2cfg.vmid, iova,
                                      cfg->iotlb_hits, cfg->iotlb_misses,
                                      100 * cfg->iotlb_hits /
                                      (cfg->iotlb_hits + cfg->iotlb_misses));
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new)
         smmu_iotlb_inv_all(bs);
     }
 
-    *key = smmu_get_iotlb_key(cfg->asid, new->entry.iova, tg, new->level);
-    trace_smmu_iotlb_insert(cfg->asid, new->entry.iova, tg, new->level);
+    *key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
+                              tg, new->level);
+    trace_smmu_iotlb_insert(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
+                            tg, new->level);
     g_hash_table_insert(bs->iotlb, key, new);
 }
 
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
 
     return SMMU_IOTLB_ASID(*iotlb_key) == asid;
 }
-
-static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
+static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                               gpointer user_data)
 {
     SMMUTLBEntry *iter = (SMMUTLBEntry *)value;
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
     if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) {
         return false;
     }
+    if (info->vmid >= 0 && info->vmid != SMMU_IOTLB_VMID(iotlb_key)) {
+        return false;
+    }
     return ((info->iova & ~entry->addr_mask) == entry->iova) ||
            ((entry->iova & ~info->mask) == info->iova);
 }
 
-void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
+void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl)
 {
     /* if tg is not set we use 4KB range invalidation */
     uint8_t granule = tg ? tg * 2 + 10 : 12;
 
     if (ttl && (num_pages == 1) && (asid >= 0)) {
-        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
+        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, iova, tg, ttl);
 
         if (g_hash_table_remove(s->iotlb, &key)) {
             return;
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
 
     SMMUIOTLBPageInvInfo info = {
         .asid = asid, .iova = iova,
+        .vmid = vmid,
         .mask = (num_pages * 1 << granule) - 1};
 
     g_hash_table_foreach_remove(s->iotlb,
-                                smmu_hash_remove_by_asid_iova,
+                                smmu_hash_remove_by_asid_vmid_iova,
                                 &info);
 }
 
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
 {
     dma_addr_t end, addr = CMD_ADDR(cmd);
     uint8_t type = CMD_TYPE(cmd);
-    uint16_t vmid = CMD_VMID(cmd);
+    int vmid = -1;
     uint8_t scale = CMD_SCALE(cmd);
     uint8_t num = CMD_NUM(cmd);
     uint8_t ttl = CMD_TTL(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     uint64_t num_pages;
     uint8_t granule;
     int asid = -1;
+    SMMUv3State *smmuv3 = ARM_SMMUV3(s);
+
+    /* Only consider VMID if stage-2 is supported. */
+    if (STAGE2_SUPPORTED(smmuv3)) {
+        vmid = CMD_VMID(cmd);
+    }
 
     if (type == SMMU_CMD_TLBI_NH_VA) {
         asid = CMD_ASID(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     if (!tg) {
         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
-        smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl);
+        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
         num_pages = (mask + 1) >> granule;
         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
-        smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
+        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
     }
 }
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_iotlb_inv_all(void) "IOTLB invalidate all"
 smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
 smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
 smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
-smmu_iotlb_lookup_hit(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-smmu_iotlb_lookup_miss(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-smmu_iotlb_insert(uint16_t asid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d addr=0x%"PRIx64" tg=%d level=%d"
+smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
+smmu_iotlb_lookup_miss(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
+smmu_iotlb_insert(uint16_t asid, uint16_t vmid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d vmid=%d addr=0x%"PRIx64" tg=%d level=%d"
 
 # smmuv3.c
 smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

CMD_TLBI_S2_IPA: As S1+S2 is not enabled, for now this can be the
same as CMD_TLBI_NH_VAA.

CMD_TLBI_S12_VMALL: Added new function to invalidate TLB by VMID.

For stage-1 only commands, add a check to throw CERROR_ILL if used
when stage-1 is not supported.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-9-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h |  1 +
 hw/arm/smmu-common.c         | 16 +++++++++++
 hw/arm/smmuv3.c              | 55 ++++++++++++++++++++++++++++++------
 hw/arm/trace-events          |  4 ++-
 4 files changed, 67 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level);
 void smmu_iotlb_inv_all(SMMUState *s);
 void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
+void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid);
 void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl);
 
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
 
     return SMMU_IOTLB_ASID(*iotlb_key) == asid;
 }
+
+static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value,
+                                         gpointer user_data)
+{
+    uint16_t vmid = *(uint16_t *)user_data;
+    SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;
+
+    return SMMU_IOTLB_VMID(*iotlb_key) == vmid;
+}
+
 static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                               gpointer user_data)
 {
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
     g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
 }
 
+inline void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid)
+{
+    trace_smmu_iotlb_inv_vmid(vmid);
+    g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid);
+}
+
 /* VMSAv8-64 Translation */
 
 /**
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
     }
 }
 
-static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
+static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 {
     dma_addr_t end, addr = CMD_ADDR(cmd);
     uint8_t type = CMD_TYPE(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     }
 
     if (!tg) {
-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
+        trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
         uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
 
         num_pages = (mask + 1) >> granule;
-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
+        trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
         {
             uint16_t asid = CMD_ASID(&cmd);
 
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+
             trace_smmuv3_cmdq_tlbi_nh_asid(asid);
             smmu_inv_notifiers_all(&s->smmu_state);
             smmu_iotlb_inv_asid(bs, asid);
             break;
         }
         case SMMU_CMD_TLBI_NH_ALL:
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            QEMU_FALLTHROUGH;
         case SMMU_CMD_TLBI_NSNH_ALL:
             trace_smmuv3_cmdq_tlbi_nh();
             smmu_inv_notifiers_all(&s->smmu_state);
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
             break;
         case SMMU_CMD_TLBI_NH_VAA:
         case SMMU_CMD_TLBI_NH_VA:
-            smmuv3_s1_range_inval(bs, &cmd);
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            smmuv3_range_inval(bs, &cmd);
+            break;
+        case SMMU_CMD_TLBI_S12_VMALL:
+        {
+            uint16_t vmid = CMD_VMID(&cmd);
+
+            if (!STAGE2_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+
+            trace_smmuv3_cmdq_tlbi_s12_vmid(vmid);
+            smmu_inv_notifiers_all(&s->smmu_state);
+            smmu_iotlb_inv_vmid(bs, vmid);
+            break;
+        }
+        case SMMU_CMD_TLBI_S2_IPA:
+            if (!STAGE2_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            /*
+             * As currently only either s1 or s2 are supported
+             * we can reuse same function for s2.
+             */
+            smmuv3_range_inval(bs, &cmd);
             break;
         case SMMU_CMD_TLBI_EL3_ALL:
         case SMMU_CMD_TLBI_EL3_VA:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
         case SMMU_CMD_TLBI_EL2_ASID:
         case SMMU_CMD_TLBI_EL2_VA:
         case SMMU_CMD_TLBI_EL2_VAA:
-        case SMMU_CMD_TLBI_S12_VMALL:
-        case SMMU_CMD_TLBI_S2_IPA:
         case SMMU_CMD_ATC_INV:
         case SMMU_CMD_PRI_RESP:
         case SMMU_CMD_RESUME:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
             break;
         default:
             cmd_error = SMMU_CERROR_ILL;
-            qemu_log_mask(LOG_GUEST_ERROR,
-                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
             break;
         }
         qemu_mutex_unlock(&s->mutex);
         if (cmd_error) {
+            if (cmd_error == SMMU_CERROR_ILL) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Illegal command type: %d\n", CMD_TYPE(&cmd));
+            }
             break;
         }
         /*
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, ui
 smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
 smmu_iotlb_inv_all(void) "IOTLB invalidate all"
 smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
+smmu_iotlb_inv_vmid(uint16_t vmid) "IOTLB invalidate vmid=%d"
 smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
 smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
 smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_cfgi_ste_range(int start, int end) "start=0x%x - end=0x%x"
 smmuv3_cmdq_cfgi_cd(uint32_t sid) "sid=0x%x"
 smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
 smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
-smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
+smmuv3_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
 smmuv3_cmdq_tlbi_nh(void) ""
 smmuv3_cmdq_tlbi_nh_asid(uint16_t asid) "asid=%d"
+smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
 smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
 smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
 smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In smmuv3_notify_iova, read the granule based on translation stage
and use VMID if valid value is sent.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-10-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c     | 39 ++++++++++++++++++++++++++-------------
 hw/arm/trace-events |  2 +-
 2 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ epilogue:
  * @mr: IOMMU mr region handle
  * @n: notifier to be called
  * @asid: address space ID or negative value if we don't care
+ * @vmid: virtual machine ID or negative value if we don't care
  * @iova: iova
  * @tg: translation granule (if communicated through range invalidation)
  * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
  */
 static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
                                IOMMUNotifier *n,
-                               int asid, dma_addr_t iova,
-                               uint8_t tg, uint64_t num_pages)
+                               int asid, int vmid,
+                               dma_addr_t iova, uint8_t tg,
+                               uint64_t num_pages)
 {
     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
     IOMMUTLBEvent event;
     uint8_t granule;
+    SMMUv3State *s = sdev->smmu;
 
     if (!tg) {
         SMMUEventInfo event = {.inval_ste_allowed = true};
@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
             return;
         }
 
-        tt = select_tt(cfg, iova);
-        if (!tt) {
+        if (vmid >= 0 && cfg->s2cfg.vmid != vmid) {
             return;
         }
-        granule = tt->granule_sz;
+
+        if (STAGE1_SUPPORTED(s)) {
+            tt = select_tt(cfg, iova);
+            if (!tt) {
+                return;
+            }
+            granule = tt->granule_sz;
+        } else {
+            granule = cfg->s2cfg.granule_sz;
+        }
+
     } else {
         granule = tg * 2 + 10;
     }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
     memory_region_notify_iommu_one(n, &event);
 }
 
-/* invalidate an asid/iova range tuple in all mr's */
-static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
-                                      uint8_t tg, uint64_t num_pages)
+/* invalidate an asid/vmid/iova range tuple in all mr's */
+static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid,
+                                      dma_addr_t iova, uint8_t tg,
+                                      uint64_t num_pages)
 {
     SMMUDevice *sdev;
 
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
         IOMMUMemoryRegion *mr = &sdev->iommu;
         IOMMUNotifier *n;
 
-        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova,
-                                        tg, num_pages);
+        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid,
+                                        iova, tg, num_pages);
 
         IOMMU_NOTIFIER_FOREACH(n, mr) {
-            smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages);
+            smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 
     if (!tg) {
         trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
+        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 
         num_pages = (mask + 1) >> granule;
         trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
+        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
     }
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
 smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
 smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
 smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
-smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
+smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint16_t vmid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d vmid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
 
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

As everything is in place, we can use a new system property to
advertise which stage is supported and remove bad_ste from STE
stage2 config.

The property added arm-smmuv3.stage can have 3 values:
- "1": Stage-1 only is advertised.
- "2": Stage-2 only is advertised.

If not passed or an unsupported value is passed, it will default to
stage-1.

Advertise VMID16.

Don't try to decode CD, if stage-2 is configured.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-11-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmuv3.h |  1 +
 hw/arm/smmuv3.c         | 32 ++++++++++++++++++++++----------
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmuv3.h
+++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@ struct SMMUv3State {
 
     qemu_irq     irq[4];
     QemuMutex mutex;
+    char *stage;
 };
 
 typedef enum {
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
 #include "hw/qdev-core.h"
 #include "hw/pci/pci.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
 
 static void smmuv3_init_regs(SMMUv3State *s)
 {
-    /**
-     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
-     *       multi-level stream table
-     */
-    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
+    /* Based on sys property, the stages supported in smmu will be advertised.*/
+    if (s->stage && !strcmp("2", s->stage)) {
+        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
+    } else {
+        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
+    }
+
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, VMID16, 1); /* 16-bit VMID */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
     /* terminated transaction will always be aborted/error returned */
@@ -XXX,XX +XXX,XX @@ static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
         goto bad_ste;
     }
 
-    /* This is still here as stage 2 has not been fully enabled yet. */
-    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
-    goto bad_ste;
-
     return 0;
 
 bad_ste:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
         return ret;
     }
 
-    if (cfg->aborted || cfg->bypassed) {
+    if (cfg->aborted || cfg->bypassed || (cfg->stage == 2)) {
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3 = {
     }
 };
 
+static Property smmuv3_properties[] = {
+    /*
+     * Stages of translation advertised.
+     * "1": Stage 1
+     * "2": Stage 2
+     * Defaults to stage 1
+     */
+    DEFINE_PROP_STRING("stage", SMMUv3State, stage),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void smmuv3_instance_init(Object *obj)
 {
     /* Nothing much to do here as of now */
@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
                                        &c->parent_phases);
     c->parent_realize = dc->realize;
     dc->realize = smmu_realize;
+    device_class_set_props(dc, smmuv3_properties);
 }
 
 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
-- 
2.34.1

From: Tommy Wu <tommy.wu@sifive.com>

When we receive a packet from the xilinx_axienet and then try to s2mem
through the xilinx_axidma, if the descriptor ring buffer is full in the
xilinx axidma driver, we’ll assert the DMASR.HALTED in the
function : stream_process_s2mem and return 0. In the end, we’ll be stuck in
an infinite loop in axienet_eth_rx_notify.

This patch checks the DMASR.HALTED state when we try to push data
from xilinx axi-enet to xilinx axi-dma. When the DMASR.HALTED is asserted,
we will not keep pushing the data and then prevent the infinte loop.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-id: 20230519062137.1251741-1-tommy.wu@sifive.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/dma/xilinx_axidma.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -XXX,XX +XXX,XX @@ static inline int stream_idle(struct Stream *s)
     return !!(s->regs[R_DMASR] & DMASR_IDLE);
 }
 
+static inline int stream_halted(struct Stream *s)
+{
+    return !!(s->regs[R_DMASR] & DMASR_HALTED);
+}
+
 static void stream_reset(struct Stream *s)
 {
     s->regs[R_DMASR] = DMASR_HALTED;  /* starts up halted.  */
@@ -XXX,XX +XXX,XX @@ static void stream_process_mem2s(struct Stream *s, StreamSink *tx_data_dev,
     uint64_t addr;
     bool eop;
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static size_t stream_process_s2mem(struct Stream *s, unsigned char *buf,
     unsigned int rxlen;
     size_t pos = 0;
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ xilinx_axidma_data_stream_can_push(StreamSink *obj,
     XilinxAXIDMAStreamSink *ds = XILINX_AXI_DMA_DATA_STREAM(obj);
     struct Stream *s = &ds->dma->streams[1];
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         ds->dma->notify = notify;
         ds->dma->notify_opaque = notify_opaque;
         return false;
-- 
2.34.1

From: Clément Chigot <chigot@adacore.com>

When passing --smp with a number lower than XLNX_ZYNQMP_NUM_APU_CPUS,
the expression (ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS) will result
in a positive number as ms->smp.cpus is a unsigned int.
This will raise the following error afterwards, as Qemu will try to
instantiate some additional RPUs.
  | $ qemu-system-aarch64 --smp 1 -M xlnx-zcu102
  | **
  | ERROR:../src/tcg/tcg.c:777:tcg_register_thread:
  |   assertion failed: (n < tcg_max_ctxs)

Signed-off-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20230524143714.565792-1-chigot@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zynqmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(MachineState *ms, XlnxZynqMPState *s,
                                    const char *boot_cpu, Error **errp)
 {
     int i;
-    int num_rpus = MIN(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS,
+    int num_rpus = MIN((int)(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS),
                        XLNX_ZYNQMP_NUM_RPU_CPUS);
 
     if (num_rpus <= 0) {
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

pflash-cfi02-test.c always uses the "musicpal" machine for testing,
test-arm-mptimer.c always uses the "vexpress-a9" machine, and
microbit-test.c requires the "microbit" machine, so we should only
run these tests if the machines have been enabled in the configuration.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-id: 20230524080600.1618137-1-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/meson.build | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_arm = \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
-  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
+  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') and
+   config_all_devices.has_key('CONFIG_MUSICPAL') ? ['pflash-cfi02-test'] : []) + \
   (config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed : []) + \
   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
   (config_all_devices.has_key('CONFIG_GENERIC_LOADER') ? ['hexloader-test'] : []) + \
   (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \
+  (config_all_devices.has_key('CONFIG_VEXPRESS') ? ['test-arm-mptimer'] : []) + \
+  (config_all_devices.has_key('CONFIG_MICROBIT') ? ['microbit-test'] : []) + \
   ['arm-cpu-features',
-   'microbit-test',
-   'test-arm-mptimer',
    'boot-serial-test']
 
 # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional
-- 
2.34.1

For M-profile, there is no guest-facing A-profile format FSR, but we
still use the env->exception.fsr field to pass fault information from
the point where a fault is raised to the code in
arm_v7m_cpu_do_interrupt() which interprets it and sets the M-profile
specific fault status registers.  So it doesn't matter whether we
fill in env->exception.fsr in the short format or the LPAE format, as
long as both sides agree.  As it happens arm_v7m_cpu_do_interrupt()
assumes short-form.

In compute_fsr_fsc() we weren't explicitly choosing short-form for
M-profile, but instead relied on it falling out in the wash because
arm_s1_regime_using_lpae_format() would be false.  This was broken in
commit 452c67a4 when we added v8R support, because we said "PMSAv8 is
always LPAE format" (as it is for v8R), forgetting that we were
implicitly using this code path on M-profile. At that point we would
hit a g_assert_not_reached():
 ERROR:../../target/arm/internals.h:549:arm_fi_to_lfsc: code should not be reached

#7  0x0000555555e055f7 in arm_fi_to_lfsc (fi=0x7fffecff9a90) at ../../target/arm/internals.h:549
#8  0x0000555555e05a27 in compute_fsr_fsc (env=0x555557356670, fi=0x7fffecff9a90, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff9a1c)
    at ../../target/arm/tlb_helper.c:95
#9  0x0000555555e05b62 in arm_deliver_fault (cpu=0x555557354800, addr=268961344, access_type=MMU_INST_FETCH, mmu_idx=1, fi=0x7fffecff9a90)
    at ../../target/arm/tlb_helper.c:132
#10 0x0000555555e06095 in arm_cpu_tlb_fill (cs=0x555557354800, address=268961344, size=1, access_type=MMU_INST_FETCH, mmu_idx=1, probe=false, retaddr=0)
    at ../../target/arm/tlb_helper.c:260

The specific assertion changed when commit fcc7404eff24b4c added
"assert not M-profile" to arm_is_secure_below_el3(), because the
conditions being checked in compute_fsr_fsc() include
arm_el_is_aa64(), which will end up calling arm_is_secure_below_el3()
and asserting before we try to call arm_fi_to_lfsc():

#7  0x0000555555efaf43 in arm_is_secure_below_el3 (env=0x5555574665a0) at ../../target/arm/cpu.h:2396
#8  0x0000555555efb103 in arm_is_el2_enabled (env=0x5555574665a0) at ../../target/arm/cpu.h:2448
#9  0x0000555555efb204 in arm_el_is_aa64 (env=0x5555574665a0, el=1) at ../../target/arm/cpu.h:2509
#10 0x0000555555efbdfd in compute_fsr_fsc (env=0x5555574665a0, fi=0x7fffecff99e0, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff996c)

Avoid the assertion and the incorrect FSR format selection by
explicitly making M-profile use the short-format in this function.

Fixes: 452c67a42704 ("target/arm: Enable TTBCR_EAE for ARMv8-R AArch32")a
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1658
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230523131726.866635-1-peter.maydell@linaro.org
---
 target/arm/tcg/tlb_helper.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
     uint32_t fsr, fsc;
 
-    if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
-        arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
+    /*
+     * For M-profile there is no guest-facing FSR. We compute a
+     * short-form value for env->exception.fsr which we will then
+     * examine in arm_v7m_cpu_do_interrupt(). In theory we could
+     * use the LPAE format instead as long as both bits of code agree
+     * (and arm_fi_to_lfsc() handled the M-profile specific
+     * ARMFault_QEMU_NSCExec and ARMFault_QEMU_SFault cases).
+     */
+    if (!arm_feature(env, ARM_FEATURE_M) &&
+        (target_el == 2 || arm_el_is_aa64(env, target_el) ||
+         arm_s1_regime_using_lpae_format(env, arm_mmu_idx))) {
         /*
          * LPAE format fault status register : bottom 6 bits are
          * status code in the same form as needed for syndrome
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

When we moved the arm default CONFIGs into Kconfig and removed them
from default.mak, we made it harder to identify which CONFIGs are
selected by default in case users want to disable them.

Bring back the default entries into default.mak, but keep them
commented out. This way users can keep their workflows of editing
default.mak to remove build options without needing to search through
Kconfig.

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20230523180525.29994-3-farosas@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configs/devices/aarch64-softmmu/default.mak |  6 ++++
 configs/devices/arm-softmmu/default.mak     | 40 +++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/configs/devices/aarch64-softmmu/default.mak b/configs/devices/aarch64-softmmu/default.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/devices/aarch64-softmmu/default.mak
+++ b/configs/devices/aarch64-softmmu/default.mak
@@ -XXX,XX +XXX,XX @@
 
 # We support all the 32 bit boards so need all their config
 include ../arm-softmmu/default.mak
+
+# These are selected by default when TCG is enabled, uncomment them to
+# keep out of the build.
+# CONFIG_XLNX_ZYNQMP_ARM=n
+# CONFIG_XLNX_VERSAL=n
+# CONFIG_SBSA_REF=n
diff --git a/configs/devices/arm-softmmu/default.mak b/configs/devices/arm-softmmu/default.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/devices/arm-softmmu/default.mak
+++ b/configs/devices/arm-softmmu/default.mak
@@ -XXX,XX +XXX,XX @@
 # CONFIG_TEST_DEVICES=n
 
 CONFIG_ARM_VIRT=y
+
+# These are selected by default when TCG is enabled, uncomment them to
+# keep out of the build.
+# CONFIG_CUBIEBOARD=n
+# CONFIG_EXYNOS4=n
+# CONFIG_HIGHBANK=n
+# CONFIG_INTEGRATOR=n
+# CONFIG_FSL_IMX31=n
+# CONFIG_MUSICPAL=n
+# CONFIG_MUSCA=n
+# CONFIG_CHEETAH=n
+# CONFIG_SX1=n
+# CONFIG_NSERIES=n
+# CONFIG_STELLARIS=n
+# CONFIG_STM32VLDISCOVERY=n
+# CONFIG_REALVIEW=n
+# CONFIG_VERSATILE=n
+# CONFIG_VEXPRESS=n
+# CONFIG_ZYNQ=n
+# CONFIG_MAINSTONE=n
+# CONFIG_GUMSTIX=n
+# CONFIG_SPITZ=n
+# CONFIG_TOSA=n
+# CONFIG_Z2=n
+# CONFIG_NPCM7XX=n
+# CONFIG_COLLIE=n
+# CONFIG_ASPEED_SOC=n
+# CONFIG_NETDUINO2=n
+# CONFIG_NETDUINOPLUS2=n
+# CONFIG_OLIMEX_STM32_H405=n
+# CONFIG_MPS2=n
+# CONFIG_RASPI=n
+# CONFIG_DIGIC=n
+# CONFIG_SABRELITE=n
+# CONFIG_EMCRAFT_SF2=n
+# CONFIG_MICROBIT=n
+# CONFIG_FSL_IMX25=n
+# CONFIG_FSL_IMX7=n
+# CONFIG_FSL_IMX6UL=n
+# CONFIG_ALLWINNER_H3=n
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

Replace the 'default y if TCG' pattern with 'default y; depends on
TCG'.

That makes explict that there is a dependence on TCG and enabling
these CONFIGs via .mak files without TCG present will fail earlier.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230523180525.29994-4-farosas@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Kconfig | 123 ++++++++++++++++++++++++++++++++-----------------
 1 file changed, 82 insertions(+), 41 deletions(-)

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
 
 config CHEETAH
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
     select TSC210X
 
 config CUBIEBOARD
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ALLWINNER_A10
 
 config DIGIC
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PTIMER
     select PFLASH_CFI02
 
 config EXYNOS4
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select A9MPCORE
     select I2C
@@ -XXX,XX +XXX,XX @@ config EXYNOS4
 
 config HIGHBANK
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select A15MPCORE
     select AHCI
@@ -XXX,XX +XXX,XX @@ config HIGHBANK
 
 config INTEGRATOR
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARM_TIMER
     select INTEGRATOR_DEBUG
     select PL011 # UART
@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
 
 config MAINSTONE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PXA2XX
     select PFLASH_CFI01
     select SMC91C111
 
 config MUSCA
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARMSSE
     select PL011
     select PL031
@@ -XXX,XX +XXX,XX @@ config MARVELL_88W8618
 
 config MUSICPAL
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
@@ -XXX,XX +XXX,XX @@ config MUSICPAL
 
 config NETDUINO2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F205_SOC
 
 config NETDUINOPLUS2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F405_SOC
 
 config OLIMEX_STM32_H405
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F405_SOC
 
 config NSERIES
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
     select TMP105   # temperature sensor
     select BLIZZARD # LCD/TV controller
@@ -XXX,XX +XXX,XX @@ config PXA2XX
 
 config GUMSTIX
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select SMC91C111
     select PXA2XX
 
 config TOSA
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ZAURUS  # scoop
     select MICRODRIVE
     select PXA2XX
@@ -XXX,XX +XXX,XX @@ config TOSA
 
 config SPITZ
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ADS7846 # touch-screen controller
     select MAX111X # A/D converter
     select WM8750  # audio codec
@@ -XXX,XX +XXX,XX @@ config SPITZ
 
 config Z2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select WM8750
     select PL011 # UART
@@ -XXX,XX +XXX,XX @@ config Z2
 
 config REALVIEW
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply PCI_DEVICES
     imply PCI_TESTDEV
     imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config REALVIEW
 
 config SBSA_REF
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     imply PCI_DEVICES
     select AHCI
     select ARM_SMMUV3
@@ -XXX,XX +XXX,XX @@ config SBSA_REF
 
 config SABRELITE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select FSL_IMX6
     select SSI_M25P80
 
 config STELLARIS
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select ARM_V7M
     select CMSDK_APB_WATCHDOG
@@ -XXX,XX +XXX,XX @@ config STELLARIS
 
 config STM32VLDISCOVERY
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F100_SOC
 
 config STRONGARM
@@ -XXX,XX +XXX,XX @@ config STRONGARM
 
 config COLLIE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select ZAURUS  # scoop
     select STRONGARM
 
 config SX1
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
 
 config VERSATILE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARM_TIMER # sp804
     select PFLASH_CFI01
     select LSI_SCSI_PCI
@@ -XXX,XX +XXX,XX @@ config VERSATILE
 
 config VEXPRESS
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select A15MPCORE
     select ARM_MPTIMER
@@ -XXX,XX +XXX,XX @@ config VEXPRESS
 
 config ZYNQ
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select CADENCE # UART
     select PFLASH_CFI02
@@ -XXX,XX +XXX,XX @@ config ZYNQ
 config ARM_V7M
     bool
     # currently v7M must be included in a TCG build due to translate.c
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PTIMER
 
 config ALLWINNER_A10
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
 
 config ALLWINNER_H3
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ALLWINNER_A10_PIT
     select ALLWINNER_SUN8I_EMAC
     select ALLWINNER_I2C
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
 
 config RASPI
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select FRAMEBUFFER
     select PL011 # UART
     select SDHCI
@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
 
 config XLNX_ZYNQMP_ARM
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     select AHCI
     select ARM_GIC
     select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_ZYNQMP_ARM
 
 config XLNX_VERSAL
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     select ARM_GIC
     select PL011
     select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_VERSAL
 
 config NPCM7XX
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select ADM1272
     select ARM_GIC
@@ -XXX,XX +XXX,XX @@ config NPCM7XX
 
 config FSL_IMX25
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select IMX
     select IMX_FEC
@@ -XXX,XX +XXX,XX @@ config FSL_IMX25
 
 config FSL_IMX31
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select SERIAL
     select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
 
 config ASPEED_SOC
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select DS1338
     select FTGMAC100
     select I2C
@@ -XXX,XX +XXX,XX @@ config ASPEED_SOC
 
 config MPS2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select ARMSSE
     select LAN9118
@@ -XXX,XX +XXX,XX @@ config MPS2
 
 config FSL_IMX7
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply PCI_DEVICES
     imply TEST_DEVICES
     imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config ARM_SMMUV3
 
 config FSL_IMX6UL
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select A15MPCORE
     select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6UL
 
 config MICROBIT
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select NRF51_SOC
 
 config NRF51_SOC
@@ -XXX,XX +XXX,XX @@ config NRF51_SOC
 
 config EMCRAFT_SF2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select MSF2
     select SSI_M25P80
 
-- 
2.34.1

From: Enze Li <lienze@kylinos.cn>

I noticed that in the latest version, the copyright string is still
2022, even though 2023 is halfway through.  This patch fixes that and
fixes the documentation along with it.

Signed-off-by: Enze Li <lienze@kylinos.cn>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230525064345.1152801-1-lienze@kylinos.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/conf.py              | 2 +-
 include/qemu/help-texts.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@
 
 # General information about the project.
 project = u'QEMU'
-copyright = u'2022, The QEMU Project Developers'
+copyright = u'2023, The QEMU Project Developers'
 author = u'The QEMU Project Developers'
 
 # The version info for the project you're documenting, acts as replacement for
diff --git a/include/qemu/help-texts.h b/include/qemu/help-texts.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/help-texts.h
+++ b/include/qemu/help-texts.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_HELP_TEXTS_H
 
 /* Copyright string for -version arguments, About dialogs, etc */
-#define QEMU_COPYRIGHT "Copyright (c) 2003-2022 " \
+#define QEMU_COPYRIGHT "Copyright (c) 2003-2023 " \
     "Fabrice Bellard and the QEMU Project developers"
 
 /* Bug reporting information for --help arguments, About dialogs, etc */
-- 
2.34.1

From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>

Let add GIC information into DeviceTree as part of SBSA-REF versioning.

Trusted Firmware will read it and provide to next firmware level.

Bumps platform version to 0.1 one so we can check is node is present.

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "kvm_arm.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/fdt.h"
 #include "hw/arm/smmuv3.h"
 #include "hw/block/flash.h"
 #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
     return arm_cpu_mp_affinity(idx, clustersz);
 }
 
+static void sbsa_fdt_add_gic_node(SBSAMachineState *sms)
+{
+    char *nodename;
+
+    nodename = g_strdup_printf("/intc");
+    qemu_fdt_add_subnode(sms->fdt, nodename);
+    qemu_fdt_setprop_sized_cells(sms->fdt, nodename, "reg",
+                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].base,
+                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].size,
+                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].base,
+                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].size);
+
+    g_free(nodename);
+}
 /*
  * Firmware on this machine only uses ACPI table to load OS, these limited
  * device tree nodes are just to let firmware know the info which varies from
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
      *                        fw compatibility.
      */
     qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
-    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 0);
+    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 1);
 
     if (ms->numa_state->have_numa_distance) {
         int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
 
         g_free(nodename);
     }
+
+    sbsa_fdt_add_gic_node(sms);
 }
 
 #define SBSA_FLASH_SECTOR_SIZE (256 * KiB)
-- 
2.34.1