Series comparison

-[PULL 00/33] target-arm queue
+[PULL 00/17] target-arm queue
-Arm pullreq: Rémi's ARMv8.4-SEL2 support is the big thing here.
+Hi; here's a target-arm pullreq for rc0; these are all bugfixes
 and similar minor stuff.
 thanks
 -- PMM
-The following changes since commit f1fcb6851aba6dd9838886dc179717a11e344a1c:
+The following changes since commit 0462a32b4f63b2448b4a196381138afd50719dc4:
-  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2021-01-19' into staging (2021-01-19 11:57:07 +0000)
+  Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging (2025-03-14 09:31:13 +0800)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210119
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250314-1
-for you to fetch changes up to 6d39956891b3d1857af84f72f0230a6d99eb3b6a:
+for you to fetch changes up to a019e15edfd62beae1e2f6adc0fa7415ba20b14c:
-  docs: Build and install all the docs in a single manual (2021-01-19 14:38:53 +0000)
+  meson.build: Set RUST_BACKTRACE for all tests (2025-03-14 12:54:33 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Implement IMPDEF pauth algorithm
+ * Correctly handle corner cases of guest attempting an exception
- * Support ARMv8.4-SEL2
+   return to AArch32 when target EL is AArch64 only
- * Fix bug where we were truncating predicate vector lengths in SVE insns
+ * MAINTAINERS: Fix status for Arm boards I "maintain"
- * Implement new pvpanic-pci device
+ * tests/functional: Bump up arm_replay timeout
- * npcm7xx_adc-test: Fix memleak in adc_qom_set
+ * Revert "hw/char/pl011: Warn when using disabled receiver"
- * target/arm/m_helper: Silence GCC 10 maybe-uninitialized error
+ * util/cacheflush: Make first DSB unconditional on aarch64
- * docs: Build and install all the docs in a single manual
+ * target/arm: Fix SVE/SME access check logic
  * meson.build: Set RUST_BACKTRACE for all tests
 ----------------------------------------------------------------
-Gan Qixin (1):
+Joe Komlodi (1):
-      npcm7xx_adc-test: Fix memleak in adc_qom_set
+      util/cacheflush: Make first DSB unconditional on aarch64
-Mihai Carabas (4):
+Paolo Bonzini (1):
-      hw/misc/pvpanic: split-out generic and bus dependent code
+      Revert "hw/char/pl011: Warn when using disabled receiver"
       hw/misc/pvpanic: add PCI interface support
       pvpanic : update pvpanic spec document
       tests/qtest: add a test case for pvpanic-pci
-Peter Maydell (1):
+Peter Maydell (13):
-      docs: Build and install all the docs in a single manual
+      target/arm: Move A32_BANKED_REG_{GET,SET} macros to cpregs.h
       target/arm: Un-inline access_secure_reg()
       linux-user/aarch64: Remove unused get/put_user macros
       linux-user/arm: Remove unused get_put_user macros
       target/arm: Move arm_cpu_data_is_big_endian() etc to internals.h
       target/arm: Move arm_current_el() and arm_el_is_aa64() to internals.h
       target/arm: SCR_EL3.RW should be treated as 1 if EL2 doesn't support AArch32
       target/arm: HCR_EL2.RW should be RAO/WI if EL1 doesn't support AArch32
       target/arm: Add cpu local variable to exception_return helper
       target/arm: Forbid return to AArch32 when CPU is AArch64-only
       MAINTAINERS: Fix status for Arm boards I "maintain"
       tests/functional: Bump up arm_replay timeout
       meson.build: Set RUST_BACKTRACE for all tests
-Philippe Mathieu-Daudé (1):
+Richard Henderson (2):
-      target/arm/m_helper: Silence GCC 10 maybe-uninitialized error
+      target/arm: Make DisasContext.{fp, sve}_access_checked tristate
       target/arm: Simplify pstate_sm check in sve_access_check
-Richard Henderson (7):
+ MAINTAINERS                         |  14 ++--
-      target/arm: Implement an IMPDEF pauth algorithm
+ meson.build                         |   9 ++-
-      target/arm: Add cpu properties to control pauth
+ target/arm/cpregs.h                 |  28 +++++++
-      target/arm: Use object_property_add_bool for "sve" property
+ target/arm/cpu.h                    | 153 +-----------------------------------
-      target/arm: Introduce PREDDESC field definitions
+ target/arm/internals.h              | 135 +++++++++++++++++++++++++++++++
-      target/arm: Update PFIRST, PNEXT for pred_desc
+ target/arm/tcg/translate-a64.h      |   2 +-
-      target/arm: Update ZIP, UZP, TRN for pred_desc
+ target/arm/tcg/translate.h          |  10 ++-
-      target/arm: Update REV, PUNPK for pred_desc
+ hw/char/pl011.c                     |  19 ++---
+ hw/intc/arm_gicv3_cpuif.c           |   1 +
-Rémi Denis-Courmont (19):
+ linux-user/aarch64/cpu_loop.c       |  48 -----------
-      target/arm: remove redundant tests
+ linux-user/arm/cpu_loop.c           |  43 +---------
-      target/arm: add arm_is_el2_enabled() helper
+ target/arm/arch_dump.c              |   1 +
-      target/arm: use arm_is_el2_enabled() where applicable
+ target/arm/helper.c                 |  16 +++-
-      target/arm: use arm_hcr_el2_eff() where applicable
+ target/arm/tcg/helper-a64.c         |  12 ++-
-      target/arm: factor MDCR_EL2 common handling
+ target/arm/tcg/hflags.c             |   9 +++
-      target/arm: Define isar_feature function to test for presence of SEL2
+ target/arm/tcg/translate-a64.c      |  37 ++++-----
-      target/arm: add 64-bit S-EL2 to EL exception table
+ util/cacheflush.c                   |   4 +-
-      target/arm: add MMU stage 1 for Secure EL2
+ .gitlab-ci.d/buildtest-template.yml |   1 -
-      target/arm: add ARMv8.4-SEL2 system registers
+files changed, 257 insertions(+), 285 deletions(-)
       target/arm: handle VMID change in secure state
       target/arm: do S1_ptw_translate() before address space lookup
       target/arm: translate NS bit in page-walks
       target/arm: generalize 2-stage page-walk condition
       target/arm: secure stage 2 translation regime
       target/arm: set HPFAR_EL2.NS on secure stage 2 faults
       target/arm: revector to run-time pick target EL
       target/arm: Implement SCR_EL2.EEL2
       target/arm: enable Secure EL2 in max CPU
       target/arm: refactor vae1_tlbmask()
  docs/conf.py                     |  46 ++++-
  docs/devel/conf.py               |  15 --
  docs/index.html.in               |  17 --
  docs/interop/conf.py             |  28 ---
  docs/meson.build                 |  64 +++---
  docs/specs/conf.py               |  16 --
  docs/specs/pci-ids.txt           |   1 +
  docs/specs/pvpanic.txt           |  13 +-
  docs/system/arm/cpu-features.rst |  21 ++
  docs/system/conf.py              |  28 ---
  docs/tools/conf.py               |  37 ----
  docs/user/conf.py                |  15 --
  include/hw/misc/pvpanic.h        |  24 ++-
  include/hw/pci/pci.h             |   1 +
  include/qemu/xxhash.h            |  98 +++++++++
  target/arm/cpu-param.h           |   2 +-
  target/arm/cpu.h                 | 107 ++++++++--
  target/arm/internals.h           |  45 +++++
  hw/misc/pvpanic-isa.c            |  94 +++++++++
  hw/misc/pvpanic-pci.c            |  95 +++++++++
  hw/misc/pvpanic.c                |  85 +-------
  target/arm/cpu.c                 |  23 ++-
  target/arm/cpu64.c               |  65 ++++--
  target/arm/helper-a64.c          |   8 +-
  target/arm/helper.c              | 414 ++++++++++++++++++++++++++-------------
  target/arm/m_helper.c            |   2 +-
  target/arm/monitor.c             |   1 +
  target/arm/op_helper.c           |   4 +-
  target/arm/pauth_helper.c        |  27 ++-
  target/arm/sve_helper.c          |  33 ++--
  target/arm/tlb_helper.c          |   3 +
  target/arm/translate-a64.c       |   4 +
  target/arm/translate-sve.c       |  31 ++-
  target/arm/translate.c           |  36 +++-
  tests/qtest/arm-cpu-features.c   |  13 ++
  tests/qtest/npcm7xx_adc-test.c   |   1 +
  tests/qtest/pvpanic-pci-test.c   |  62 ++++++
  .gitlab-ci.yml                   |   4 +-
  hw/i386/Kconfig                  |   2 +-
  hw/misc/Kconfig                  |  12 +-
  hw/misc/meson.build              |   4 +-
  tests/qtest/meson.build          |   3 +-
 files changed, 1080 insertions(+), 524 deletions(-)
  delete mode 100644 docs/devel/conf.py
  delete mode 100644 docs/index.html.in
  delete mode 100644 docs/interop/conf.py
  delete mode 100644 docs/specs/conf.py
  delete mode 100644 docs/system/conf.py
  delete mode 100644 docs/tools/conf.py
  delete mode 100644 docs/user/conf.py
  create mode 100644 hw/misc/pvpanic-isa.c
  create mode 100644 hw/misc/pvpanic-pci.c
  create mode 100644 tests/qtest/pvpanic-pci-test.c

-[PULL 02/33] target/arm: Add cpu properties to control pauth
+[PULL 01/17] target/arm: Move A32_BANKED_REG_{GET, SET} macros to cpregs.h
-From: Richard Henderson <richard.henderson@linaro.org>
+The A32_BANKED_REG_{GET,SET} macros are only used inside target/arm;
 move their definitions to cpregs.h. There's no need to have them
 defined in all the code that includes cpu.h.
-The crypto overhead of emulating pauth can be significant for
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-some workloads.  Add two boolean properties that allows the
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-feature to be turned off, on with the architected algorithm,
+---
-or on with an implementation defined algorithm.
+ target/arm/cpregs.h | 28 ++++++++++++++++++++++++++++
  target/arm/cpu.h    | 27 ---------------------------
 files changed, 28 insertions(+), 27 deletions(-)
-We need two intermediate booleans to control the state while
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
 parsing properties lest we clobber ID_AA64ISAR1 into an invalid
 intermediate state.
 Tested-by: Mark Rutland <mark.rutland@arm.com>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210111235740.462469-3-richard.henderson@linaro.org
 [PMM: fixed docs typo, tweaked text to clarify that the impdef
 algorithm is specific to QEMU]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  docs/system/arm/cpu-features.rst | 21 +++++++++++++++++
  target/arm/cpu.h                 | 10 ++++++++
  target/arm/cpu.c                 | 13 +++++++++++
  target/arm/cpu64.c               | 40 ++++++++++++++++++++++++++++----
  target/arm/monitor.c             |  1 +
  tests/qtest/arm-cpu-features.c   | 13 +++++++++++
 files changed, 94 insertions(+), 4 deletions(-)
 diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/cpu-features.rst
+--- a/target/arm/cpregs.h
-+++ b/docs/system/arm/cpu-features.rst
++++ b/target/arm/cpregs.h
-@@ -XXX,XX +XXX,XX @@ the list of KVM VCPU features and their descriptions.
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_cpreg_traps_in_nv(const ARMCPRegInfo *ri)
-                            influence the guest scheduler behavior and/or be
+     return ri->opc1 == 4 || ri->opc1 == 5;
-                            exposed to the guest userspace.
+ }
-+TCG VCPU Features
++/* Macros for accessing a specified CP register bank */
-+=================
++#define A32_BANKED_REG_GET(_env, _regname, _secure)                     \
 +    ((_secure) ? (_env)->cp15._regname##_s : (_env)->cp15._regname##_ns)
 +
-+TCG VCPU features are CPU features that are specific to TCG.
++#define A32_BANKED_REG_SET(_env, _regname, _secure, _val)       \
-+Below is the list of TCG VCPU features and their descriptions.
++    do {                                                        \
 +        if (_secure) {                                          \
 +            (_env)->cp15._regname##_s = (_val);                 \
 +        } else {                                                \
 +            (_env)->cp15._regname##_ns = (_val);                \
 +        }                                                       \
 +    } while (0)
 +
-+  pauth                    Enable or disable `FEAT_Pauth`, pointer
++/*
-+                           authentication.  By default, the feature is
++ * Macros for automatically accessing a specific CP register bank depending on
-+                           enabled with `-cpu max`.
++ * the current secure state of the system.  These macros are not intended for
 + * supporting instruction translation reads/writes as these are dependent
 + * solely on the SCR.NS bit and not the mode.
 + */
 +#define A32_BANKED_CURRENT_REG_GET(_env, _regname)                          \
 +    A32_BANKED_REG_GET((_env), _regname,                                    \
 +                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)))
 +
-+  pauth-impdef             When `FEAT_Pauth` is enabled, either the
++#define A32_BANKED_CURRENT_REG_SET(_env, _regname, _val)                    \
-+                           *impdef* (Implementation Defined) algorithm
++    A32_BANKED_REG_SET((_env), _regname,                                    \
-+                           is enabled or the *architected* QARMA algorithm
++                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)), \
-+                           is enabled.  By default the impdef algorithm
++                       (_val))
 +                           is disabled, and QARMA is enabled.
 +
-+                           The architected QARMA algorithm has good
+ #endif /* TARGET_ARM_CPREGS_H */
 +                           cryptographic properties, but can be quite slow
 +                           to emulate.  The impdef algorithm used by QEMU
 +                           is non-cryptographic but significantly faster.
 +
  SVE CPU Properties
  ==================
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+@@ -XXX,XX +XXX,XX @@ static inline bool access_secure_reg(CPUARMState *env)
- #ifdef TARGET_AARCH64
+     return ret;
  # define ARM_MAX_VQ    16
  void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
 +void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
  #else
  # define ARM_MAX_VQ    1
  static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
 +static inline void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp) { }
  #endif
  typedef struct ARMVectorReg {
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      uint64_t reset_cbar;
      uint32_t reset_auxcr;
      bool reset_hivecs;
 +
 +    /*
 +     * Intermediate values used during property parsing.
 +     * Once finalized, the values should be read from ID_AA64ISAR1.
 +     */
 +    bool prop_pauth;
 +    bool prop_pauth_impdef;
 +
      /* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */
      uint32_t dcz_blocksize;
      uint64_t rvbar;
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
              error_propagate(errp, local_err);
              return;
          }
 +
 +        /*
 +         * KVM does not support modifications to this feature.
 +         * We have not registered the cpu properties when KVM
 +         * is in use, so the user will not be able to set them.
 +         */
 +        if (!kvm_enabled()) {
 +            arm_cpu_pauth_finalize(cpu, &local_err);
 +            if (local_err != NULL) {
 +                error_propagate(errp, local_err);
 +                return;
 +            }
 +        }
      }
      if (kvm_enabled()) {
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/kvm.h"
  #include "kvm_arm.h"
  #include "qapi/visitor.h"
 +#include "hw/qdev-properties.h"
 +
  #ifndef CONFIG_USER_ONLY
  static uint64_t a57_a53_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
      }
  }
-+void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
+-/* Macros for accessing a specified CP register bank */
-+{
+-#define A32_BANKED_REG_GET(_env, _regname, _secure)    \
-+    int arch_val = 0, impdef_val = 0;
+-    ((_secure) ? (_env)->cp15._regname##_s : (_env)->cp15._regname##_ns)
-+    uint64_t t;
+-
-+
+-#define A32_BANKED_REG_SET(_env, _regname, _secure, _val)   \
-+    /* TODO: Handle HaveEnhancedPAC, HaveEnhancedPAC2, HaveFPAC. */
+-    do {                                                \
-+    if (cpu->prop_pauth) {
+-        if (_secure) {                                   \
-+        if (cpu->prop_pauth_impdef) {
+-            (_env)->cp15._regname##_s = (_val);            \
-+            impdef_val = 1;
+-        } else {                                        \
-+        } else {
+-            (_env)->cp15._regname##_ns = (_val);           \
-+            arch_val = 1;
+-        }                                               \
-+        }
+-    } while (0)
-+    } else if (cpu->prop_pauth_impdef) {
+-
-+        error_setg(errp, "cannot enable pauth-impdef without pauth");
+-/* Macros for automatically accessing a specific CP register bank depending on
-+        error_append_hint(errp, "Add pauth=on to the CPU property list.\n");
+- * the current secure state of the system.  These macros are not intended for
-+    }
+- * supporting instruction translation reads/writes as these are dependent
-+
+- * solely on the SCR.NS bit and not the mode.
-+    t = cpu->isar.id_aa64isar1;
+- */
-+    t = FIELD_DP64(t, ID_AA64ISAR1, APA, arch_val);
+-#define A32_BANKED_CURRENT_REG_GET(_env, _regname)        \
-+    t = FIELD_DP64(t, ID_AA64ISAR1, GPA, arch_val);
+-    A32_BANKED_REG_GET((_env), _regname,                \
-+    t = FIELD_DP64(t, ID_AA64ISAR1, API, impdef_val);
+-                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)))
-+    t = FIELD_DP64(t, ID_AA64ISAR1, GPI, impdef_val);
+-
-+    cpu->isar.id_aa64isar1 = t;
+-#define A32_BANKED_CURRENT_REG_SET(_env, _regname, _val)                       \
-+}
+-    A32_BANKED_REG_SET((_env), _regname,                                    \
-+
+-                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)), \
-+static Property arm_cpu_pauth_property =
+-                       (_val))
-+    DEFINE_PROP_BOOL("pauth", ARMCPU, prop_pauth, true);
+-
-+static Property arm_cpu_pauth_impdef_property =
+ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
-+    DEFINE_PROP_BOOL("pauth-impdef", ARMCPU, prop_pauth_impdef, false);
+                                  uint32_t cur_el, bool secure);
-+
  /* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
   * otherwise, a CPU with as many features enabled as our emulation supports.
   * The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          t = FIELD_DP64(t, ID_AA64ISAR1, DPB, 2);
          t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 1);
          t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 1);
 -        t = FIELD_DP64(t, ID_AA64ISAR1, APA, 1); /* PAuth, architected only */
 -        t = FIELD_DP64(t, ID_AA64ISAR1, API, 0);
 -        t = FIELD_DP64(t, ID_AA64ISAR1, GPA, 1);
 -        t = FIELD_DP64(t, ID_AA64ISAR1, GPI, 0);
          t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);
          t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);
          t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 1);
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
          cpu->dcz_blocksize = 7; /*  512 bytes */
  #endif
 +
 +        /* Default to PAUTH on, with the architected algorithm. */
 +        qdev_property_add_static(DEVICE(obj), &arm_cpu_pauth_property);
 +        qdev_property_add_static(DEVICE(obj), &arm_cpu_pauth_impdef_property);
      }
      aarch64_add_sve_properties(obj);
 diff --git a/target/arm/monitor.c b/target/arm/monitor.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/monitor.c
 +++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ static const char *cpu_model_advertised_features[] = {
      "sve640", "sve768", "sve896", "sve1024", "sve1152", "sve1280",
      "sve1408", "sve1536", "sve1664", "sve1792", "sve1920", "sve2048",
      "kvm-no-adjvtime", "kvm-steal-time",
 +    "pauth", "pauth-impdef",
      NULL
  };
 diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/arm-cpu-features.c
 +++ b/tests/qtest/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void sve_tests_sve_off_kvm(const void *data)
      qtest_quit(qts);
  }
 +static void pauth_tests_default(QTestState *qts, const char *cpu_type)
 +{
 +    assert_has_feature_enabled(qts, cpu_type, "pauth");
 +    assert_has_feature_disabled(qts, cpu_type, "pauth-impdef");
 +    assert_set_feature(qts, cpu_type, "pauth", false);
 +    assert_set_feature(qts, cpu_type, "pauth", true);
 +    assert_set_feature(qts, cpu_type, "pauth-impdef", true);
 +    assert_set_feature(qts, cpu_type, "pauth-impdef", false);
 +    assert_error(qts, cpu_type, "cannot enable pauth-impdef without pauth",
 +                 "{ 'pauth': false, 'pauth-impdef': true }");
 +}
 +
  static void test_query_cpu_model_expansion(const void *data)
  {
      QTestState *qts;
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
          assert_has_feature_enabled(qts, "cortex-a57", "aarch64");
          sve_tests_default(qts, "max");
 +        pauth_tests_default(qts, "max");
          /* Test that features that depend on KVM generate errors without. */
          assert_error(qts, "max",
 --
-.20.1
+.43.0

-[PULL 05/33] target/arm: add arm_is_el2_enabled() helper
+[PULL 02/17] target/arm: Un-inline access_secure_reg()
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+We would like to move arm_el_is_aa64() to internals.h; however, it is
 used by access_secure_reg().  Make that function not be inline, so
 that it can stay in cpu.h.
-This checks if EL2 is enabled (meaning EL2 registers take effects) in
+access_secure_reg() is used only in two places:
-the current security context.
+ * in hflags.c
  * in the user-mode arm emulators, to decide whether to store
    the TLS value in the secure or non-secure banked field
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+The second of these is not on a super-hot path that would care about
 the inlining (and incidentally will always use the NS banked field
 because our user-mode CPUs never set ARM_FEATURE_EL3); put the
 definition of access_secure_reg() in hflags.c, near its only use
 inside target/arm.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-2-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h | 17 +++++++++++++++++
+ target/arm/cpu.h        | 12 +++---------
-file changed, 17 insertions(+)
+ target/arm/tcg/hflags.c |  9 +++++++++
 files changed, 12 insertions(+), 9 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
-     return arm_is_secure_below_el3(env);
+     return aa64;
  }
+-/* Function for determining whether guest cp register reads and writes should
 +/*
-+ * Return true if the current security state has AArch64 EL2 or AArch32 Hyp.
++ * Function for determining whether guest cp register reads and writes should
-+ * This corresponds to the pseudocode EL2Enabled()
+  * access the secure or non-secure bank of a cp register.  When EL3 is
-+ */
+  * operating in AArch32 state, the NS-bit determines whether the secure
-+static inline bool arm_is_el2_enabled(CPUARMState *env)
+  * instance of a cp register should be used. When EL3 is AArch64 (or if
   * it doesn't exist at all) then there is no register banking, and all
   * accesses are to the non-secure version.
   */
 -static inline bool access_secure_reg(CPUARMState *env)
 -{
 -    bool ret = (arm_feature(env, ARM_FEATURE_EL3) &&
 -                !arm_el_is_aa64(env, 3) &&
 -                !(env->cp15.scr_el3 & SCR_NS));
 -
 -    return ret;
 -}
 +bool access_secure_reg(CPUARMState *env);
  uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
                                   uint32_t cur_el, bool secure);
 diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/hflags.c
 +++ b/target/arm/tcg/hflags.c
@@ -XXX,XX +XXX,XX @@ static bool aprofile_require_alignment(CPUARMState *env, int el, uint64_t sctlr)
  #endif
  }
 +bool access_secure_reg(CPUARMState *env)
 +{
-+    if (arm_feature(env, ARM_FEATURE_EL2)) {
++    bool ret = (arm_feature(env, ARM_FEATURE_EL3) &&
-+        return !arm_is_secure_below_el3(env);
++                !arm_el_is_aa64(env, 3) &&
-+    }
++                !(env->cp15.scr_el3 & SCR_NS));
-+    return false;
++
 +    return ret;
 +}
 +
- #else
+ static CPUARMTBFlags rebuild_hflags_common(CPUARMState *env, int fp_el,
- static inline bool arm_is_secure_below_el3(CPUARMState *env)
+                                            ARMMMUIdx mmu_idx,
- {
+                                            CPUARMTBFlags flags)
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)
  {
      return false;
  }
 +
 +static inline bool arm_is_el2_enabled(CPUARMState *env)
 +{
 +    return false;
 +}
  #endif
  /**
 --
-.20.1
+.43.0

-[PULL 32/33] target/arm/m_helper: Silence GCC 10 maybe-uninitialized error
+[PULL 03/17] linux-user/aarch64: Remove unused get/put_user macros
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+At the top of linux-user/aarch64/cpu_loop.c we define a set of
 macros for reading and writing data and code words, but we never
 use these macros. Delete them.
-When building with GCC 10.2 configured with --extra-cflags=-Os, we get:
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  linux-user/aarch64/cpu_loop.c | 48 -----------------------------------
 file changed, 48 deletions(-)
-  target/arm/m_helper.c: In function ‘arm_v7m_cpu_do_interrupt’:
+diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
   target/arm/m_helper.c:1811:16: error: ‘restore_s16_s31’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
 |             if (restore_s16_s31) {
         |                ^
   target/arm/m_helper.c:1350:10: note: ‘restore_s16_s31’ was declared here
 |     bool restore_s16_s31;
         |          ^~~~~~~~~~~~~~~
   cc1: all warnings being treated as errors
 Initialize the 'restore_s16_s31' variable to silence the warning.
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20210119062739.589049-1-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/m_helper.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/linux-user/aarch64/cpu_loop.c
-+++ b/target/arm/m_helper.c
++++ b/linux-user/aarch64/cpu_loop.c
-@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
+@@ -XXX,XX +XXX,XX @@
-     bool exc_secure = false;
+ #include "target/arm/syndrome.h"
-     bool return_to_secure;
+ #include "target/arm/cpu-features.h"
-     bool ftype;
--    bool restore_s16_s31;
+-#define get_user_code_u32(x, gaddr, env)                \
-+    bool restore_s16_s31 = false;
+-    ({ abi_long __r = get_user_u32((x), (gaddr));       \
+-        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
-     /*
+-            (x) = bswap32(x);                           \
-      * If we're not in Handler mode then jumps to magic exception-exit
+-        }                                               \
 -        __r;                                            \
 -    })
 -
 -#define get_user_code_u16(x, gaddr, env)                \
 -    ({ abi_long __r = get_user_u16((x), (gaddr));       \
 -        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
 -            (x) = bswap16(x);                           \
 -        }                                               \
 -        __r;                                            \
 -    })
 -
 -#define get_user_data_u32(x, gaddr, env)                \
 -    ({ abi_long __r = get_user_u32((x), (gaddr));       \
 -        if (!__r && arm_cpu_bswap_data(env)) {          \
 -            (x) = bswap32(x);                           \
 -        }                                               \
 -        __r;                                            \
 -    })
 -
 -#define get_user_data_u16(x, gaddr, env)                \
 -    ({ abi_long __r = get_user_u16((x), (gaddr));       \
 -        if (!__r && arm_cpu_bswap_data(env)) {          \
 -            (x) = bswap16(x);                           \
 -        }                                               \
 -        __r;                                            \
 -    })
 -
 -#define put_user_data_u32(x, gaddr, env)                \
 -    ({ typeof(x) __x = (x);                             \
 -        if (arm_cpu_bswap_data(env)) {                  \
 -            __x = bswap32(__x);                         \
 -        }                                               \
 -        put_user_u32(__x, (gaddr));                     \
 -    })
 -
 -#define put_user_data_u16(x, gaddr, env)                \
 -    ({ typeof(x) __x = (x);                             \
 -        if (arm_cpu_bswap_data(env)) {                  \
 -            __x = bswap16(__x);                         \
 -        }                                               \
 -        put_user_u16(__x, (gaddr));                     \
 -    })
 -
  /* AArch64 main loop */
  void cpu_loop(CPUARMState *env)
  {
 --
-.20.1
+.43.0

-[PULL 10/33] target/arm: add 64-bit S-EL2 to EL exception table
+[PULL 04/17] linux-user/arm: Remove unused get_put_user macros
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+In linux-user/arm/cpu_loop.c we define a full set of get/put
 macros for both code and data (since the endianness handling
 is different between the two). However the only one we actually
 use is get_user_code_u32(). Remove the rest.
-With the ARMv8.4-SEL2 extension, EL2 is a legal exception level in
+We leave a comment noting how data-side accesses should be handled
-secure mode, though it can only be AArch64.
+for big-endian, because that's a subtle point and we just removed the
 macros that were effectively documenting it.
-This patch adds the target EL for exceptions from 64-bit S-EL2.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  linux-user/arm/cpu_loop.c | 43 ++++-----------------------------------
 file changed, 4 insertions(+), 39 deletions(-)
-It also fixes the target EL to EL2 when HCR.{A,F,I}MO are set in secure
+diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
 mode. Those values were never used in practice as the effective value of
 HCR was always 0 in secure mode.
 Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210112104511.36576-7-remi.denis.courmont@huawei.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.c    | 10 +++++-----
  target/arm/op_helper.c |  4 ++--
 files changed, 7 insertions(+), 7 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/linux-user/arm/cpu_loop.c
-+++ b/target/arm/helper.c
++++ b/linux-user/arm/cpu_loop.c
-@@ -XXX,XX +XXX,XX @@ static const int8_t target_el_table[2][2][2][2][2][4] = {
+@@ -XXX,XX +XXX,XX @@
-       {{/* 0   1   1   0 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},
+         __r;                                            \
-        {/* 0   1   1   1 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},},},},
+     })
-     {{{{/* 1   0   0   0 */{ 1,  1,  2, -1 },{ 1,  1, -1,  1 },},
--       {/* 1   0   0   1 */{ 2,  2,  2, -1 },{ 1,  1, -1,  1 },},},
+-#define get_user_code_u16(x, gaddr, env)                \
--      {{/* 1   0   1   0 */{ 1,  1,  1, -1 },{ 1,  1, -1,  1 },},
+-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
--       {/* 1   0   1   1 */{ 2,  2,  2, -1 },{ 1,  1, -1,  1 },},},},
+-        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
-+       {/* 1   0   0   1 */{ 2,  2,  2, -1 },{ 2,  2, -1,  1 },},},
+-            (x) = bswap16(x);                           \
-+      {{/* 1   0   1   0 */{ 1,  1,  1, -1 },{ 1,  1,  1,  1 },},
+-        }                                               \
-+       {/* 1   0   1   1 */{ 2,  2,  2, -1 },{ 2,  2,  2,  1 },},},},
+-        __r;                                            \
-      {{{/* 1   1   0   0 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},
+-    })
-        {/* 1   1   0   1 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},},
+-
--      {{/* 1   1   1   0 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},
+-#define get_user_data_u32(x, gaddr, env)                \
--       {/* 1   1   1   1 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},},},},
+-    ({ abi_long __r = get_user_u32((x), (gaddr));       \
-+      {{/* 1   1   1   0 */{ 3,  3,  3, -1 },{ 3,  3,  3,  3 },},
+-        if (!__r && arm_cpu_bswap_data(env)) {          \
-+       {/* 1   1   1   1 */{ 3,  3,  3, -1 },{ 3,  3,  3,  3 },},},},},
+-            (x) = bswap32(x);                           \
- };
+-        }                                               \
 -        __r;                                            \
 -    })
 -
 -#define get_user_data_u16(x, gaddr, env)                \
 -    ({ abi_long __r = get_user_u16((x), (gaddr));       \
 -        if (!__r && arm_cpu_bswap_data(env)) {          \
 -            (x) = bswap16(x);                           \
 -        }                                               \
 -        __r;                                            \
 -    })
 -
 -#define put_user_data_u32(x, gaddr, env)                \
 -    ({ typeof(x) __x = (x);                             \
 -        if (arm_cpu_bswap_data(env)) {                  \
 -            __x = bswap32(__x);                         \
 -        }                                               \
 -        put_user_u32(__x, (gaddr));                     \
 -    })
 -
 -#define put_user_data_u16(x, gaddr, env)                \
 -    ({ typeof(x) __x = (x);                             \
 -        if (arm_cpu_bswap_data(env)) {                  \
 -            __x = bswap16(__x);                         \
 -        }                                               \
 -        put_user_u16(__x, (gaddr));                     \
 -    })
 +/*
 + * Note that if we need to do data accesses here, they should do a
 + * bswap if arm_cpu_bswap_data() returns true.
 + */
  /*
-diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
+  * Similar to code in accel/tcg/user-exec.c, but outside the execution loop.
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome,
          target_el = exception_target_el(env);
          break;
      case CP_ACCESS_TRAP_EL2:
 -        /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
 +        /* Requesting a trap to EL2 when we're in EL3 is
           * a bug in the access function.
           */
 -        assert(!arm_is_secure(env) && arm_current_el(env) != 3);
 +        assert(arm_current_el(env) != 3);
          target_el = 2;
          break;
      case CP_ACCESS_TRAP_EL3:
 --
-.20.1
+.43.0

-[PULL 01/33] target/arm: Implement an IMPDEF pauth algorithm
+[PULL 05/17] target/arm: Move arm_cpu_data_is_big_endian() etc to internals.h
-From: Richard Henderson <richard.henderson@linaro.org>
+The arm_cpu_data_is_big_endian() and related functions are now used
 only in target/arm; they can be moved to internals.h.
-Without hardware acceleration, a cryptographically strong
+The motivation here is that we would like to move arm_current_el()
-algorithm is too expensive for pauth_computepac.
+to internals.h.
-Even with hardware accel, we are not currently expecting
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-to link the linux-user binaries to any crypto libraries,
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-and doing so would generally make the --static build fail.
+---
  target/arm/cpu.h       | 48 ------------------------------------------
  target/arm/internals.h | 48 ++++++++++++++++++++++++++++++++++++++++++
 files changed, 48 insertions(+), 48 deletions(-)
-So choose XXH64 as a reasonably quick and decent hash.
-Tested-by: Mark Rutland <mark.rutland@arm.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210111235740.462469-2-richard.henderson@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/qemu/xxhash.h     | 98 +++++++++++++++++++++++++++++++++++++++
- target/arm/cpu.h          | 15 ++++--
- target/arm/pauth_helper.c | 27 +++++++++--
-files changed, 131 insertions(+), 9 deletions(-)
-diff --git a/include/qemu/xxhash.h b/include/qemu/xxhash.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/xxhash.h
-+++ b/include/qemu/xxhash.h
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t qemu_xxhash6(uint64_t ab, uint64_t cd, uint32_t e,
-     return qemu_xxhash7(ab, cd, e, f, 0);
- }
-+/*
-+ * Component parts of the XXH64 algorithm from
-+ * https://github.com/Cyan4973/xxHash/blob/v0.8.0/xxhash.h
-+ *
-+ * The complete algorithm looks like
-+ *
-+ *  i = 0;
-+ *  if (len >= 32) {
-+ *      v1 = seed + XXH_PRIME64_1 + XXH_PRIME64_2;
-+ *      v2 = seed + XXH_PRIME64_2;
-+ *      v3 = seed + 0;
-+ *      v4 = seed - XXH_PRIME64_1;
-+ *      do {
-+ *          v1 = XXH64_round(v1, get64bits(input + i));
-+ *          v2 = XXH64_round(v2, get64bits(input + i + 8));
-+ *          v3 = XXH64_round(v3, get64bits(input + i + 16));
-+ *          v4 = XXH64_round(v4, get64bits(input + i + 24));
-+ *      } while ((i += 32) <= len);
-+ *      h64 = XXH64_mergerounds(v1, v2, v3, v4);
-+ *  } else {
-+ *      h64 = seed + XXH_PRIME64_5;
-+ *  }
-+ *  h64 += len;
-+ *
-+ *  for (; i + 8 <= len; i += 8) {
-+ *      h64 ^= XXH64_round(0, get64bits(input + i));
-+ *      h64 = rol64(h64, 27) * XXH_PRIME64_1 + XXH_PRIME64_4;
-+ *  }
-+ *  for (; i + 4 <= len; i += 4) {
-+ *      h64 ^= get32bits(input + i) * PRIME64_1;
-+ *      h64 = rol64(h64, 23) * XXH_PRIME64_2 + XXH_PRIME64_3;
-+ *  }
-+ *  for (; i < len; i += 1) {
-+ *      h64 ^= get8bits(input + i) * XXH_PRIME64_5;
-+ *      h64 = rol64(h64, 11) * XXH_PRIME64_1;
-+ *  }
-+ *
-+ *  return XXH64_avalanche(h64)
-+ *
-+ * Exposing the pieces instead allows for simplified usage when
-+ * the length is a known constant and the inputs are in registers.
-+ */
-+#define XXH_PRIME64_1   0x9E3779B185EBCA87ULL
-+#define XXH_PRIME64_2   0xC2B2AE3D27D4EB4FULL
-+#define XXH_PRIME64_3   0x165667B19E3779F9ULL
-+#define XXH_PRIME64_4   0x85EBCA77C2B2AE63ULL
-+#define XXH_PRIME64_5   0x27D4EB2F165667C5ULL
-+
-+static inline uint64_t XXH64_round(uint64_t acc, uint64_t input)
-+{
-+    return rol64(acc + input * XXH_PRIME64_2, 31) * XXH_PRIME64_1;
-+}
-+
-+static inline uint64_t XXH64_mergeround(uint64_t acc, uint64_t val)
-+{
-+    return (acc ^ XXH64_round(0, val)) * XXH_PRIME64_1 + XXH_PRIME64_4;
-+}
-+
-+static inline uint64_t XXH64_mergerounds(uint64_t v1, uint64_t v2,
-+                                         uint64_t v3, uint64_t v4)
-+{
-+    uint64_t h64;
-+
-+    h64 = rol64(v1, 1) + rol64(v2, 7) + rol64(v3, 12) + rol64(v4, 18);
-+    h64 = XXH64_mergeround(h64, v1);
-+    h64 = XXH64_mergeround(h64, v2);
-+    h64 = XXH64_mergeround(h64, v3);
-+    h64 = XXH64_mergeround(h64, v4);
-+
-+    return h64;
-+}
-+
-+static inline uint64_t XXH64_avalanche(uint64_t h64)
-+{
-+    h64 ^= h64 >> 33;
-+    h64 *= XXH_PRIME64_2;
-+    h64 ^= h64 >> 29;
-+    h64 *= XXH_PRIME64_3;
-+    h64 ^= h64 >> 32;
-+    return h64;
-+}
-+
-+static inline uint64_t qemu_xxhash64_4(uint64_t a, uint64_t b,
-+                                       uint64_t c, uint64_t d)
-+{
-+    uint64_t v1 = QEMU_XXHASH_SEED + XXH_PRIME64_1 + XXH_PRIME64_2;
-+    uint64_t v2 = QEMU_XXHASH_SEED + XXH_PRIME64_2;
-+    uint64_t v3 = QEMU_XXHASH_SEED + 0;
-+    uint64_t v4 = QEMU_XXHASH_SEED - XXH_PRIME64_1;
-+
-+    v1 = XXH64_round(v1, a);
-+    v2 = XXH64_round(v2, b);
-+    v3 = XXH64_round(v3, c);
-+    v4 = XXH64_round(v4, d);
-+
-+    return XXH64_avalanche(XXH64_mergerounds(v1, v2, v3, v4));
-+}
-+
- #endif /* QEMU_XXHASH_H */
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fcma(const ARMISARegisters *id)
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_sctlr_b(CPUARMState *env)
- static inline bool isar_feature_aa64_pauth(const ARMISARegisters *id)
- {
+ uint64_t arm_sctlr(CPUARMState *env, int el);
-     /*
--     * Note that while QEMU will only implement the architected algorithm
+-static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
--     * QARMA, and thus APA+GPA, the host cpu for kvm may use implementation
+-                                                  bool sctlr_b)
--     * defined algorithms, and thus API+GPI, and this predicate controls
+-{
--     * migration of the 128-bit keys.
+-#ifdef CONFIG_USER_ONLY
-+     * Return true if any form of pauth is enabled, as this
+-    /*
-+     * predicate controls migration of the 128-bit keys.
+-     * In system mode, BE32 is modelled in line with the
-      */
+-     * architecture (as word-invariant big-endianness), where loads
-     return (id->id_aa64isar1 &
+-     * and stores are done little endian but from addresses which
-             (FIELD_DP64(0, ID_AA64ISAR1, APA, 0xf) |
+-     * are adjusted by XORing with the appropriate constant. So the
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_pauth(const ARMISARegisters *id)
+-     * endianness to use for the raw data access is not affected by
-              FIELD_DP64(0, ID_AA64ISAR1, GPI, 0xf))) != 0;
+-     * SCTLR.B.
 -     * In user mode, however, we model BE32 as byte-invariant
 -     * big-endianness (because user-only code cannot tell the
 -     * difference), and so we need to use a data access endianness
 -     * that depends on SCTLR.B.
 -     */
 -    if (sctlr_b) {
 -        return true;
 -    }
 -#endif
 -    /* In 32bit endianness is determined by looking at CPSR's E bit */
 -    return env->uncached_cpsr & CPSR_E;
 -}
 -
 -static inline bool arm_cpu_data_is_big_endian_a64(int el, uint64_t sctlr)
 -{
 -    return sctlr & (el ? SCTLR_EE : SCTLR_E0E);
 -}
 -
 -/* Return true if the processor is in big-endian mode. */
 -static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
 -{
 -    if (!is_a64(env)) {
 -        return arm_cpu_data_is_big_endian_a32(env, arm_sctlr_b(env));
 -    } else {
 -        int cur_el = arm_current_el(env);
 -        uint64_t sctlr = arm_sctlr(env, cur_el);
 -        return arm_cpu_data_is_big_endian_a64(cur_el, sctlr);
 -    }
 -}
 -
  #include "exec/cpu-all.h"
  /*
@@ -XXX,XX +XXX,XX @@ static inline bool bswap_code(bool sctlr_b)
  #endif
  }
-+static inline bool isar_feature_aa64_pauth_arch(const ARMISARegisters *id)
+-#ifdef CONFIG_USER_ONLY
 -static inline bool arm_cpu_bswap_data(CPUARMState *env)
 -{
 -    return TARGET_BIG_ENDIAN ^ arm_cpu_data_is_big_endian(env);
 -}
 -#endif
 -
  void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
                            uint64_t *cs_base, uint32_t *flags);
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
      return arm_rmode_to_sf_map[rmode];
  }
 +static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
 +                                                  bool sctlr_b)
 +{
++#ifdef CONFIG_USER_ONLY
 +    /*
-+     * Return true if pauth is enabled with the architected QARMA algorithm.
++     * In system mode, BE32 is modelled in line with the
-+     * QEMU will always set APA+GPA to the same value.
++     * architecture (as word-invariant big-endianness), where loads
 +     * and stores are done little endian but from addresses which
 +     * are adjusted by XORing with the appropriate constant. So the
 +     * endianness to use for the raw data access is not affected by
 +     * SCTLR.B.
 +     * In user mode, however, we model BE32 as byte-invariant
 +     * big-endianness (because user-only code cannot tell the
 +     * difference), and so we need to use a data access endianness
 +     * that depends on SCTLR.B.
 +     */
-+    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, APA) != 0;
++    if (sctlr_b) {
 +        return true;
 +    }
 +#endif
 +    /* In 32bit endianness is determined by looking at CPSR's E bit */
 +    return env->uncached_cpsr & CPSR_E;
 +}
 +
- static inline bool isar_feature_aa64_sb(const ARMISARegisters *id)
++static inline bool arm_cpu_data_is_big_endian_a64(int el, uint64_t sctlr)
  {
      return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, SB) != 0;
 diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/pauth_helper.c
 +++ b/target/arm/pauth_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/cpu_ldst.h"
  #include "exec/helper-proto.h"
  #include "tcg/tcg-gvec-desc.h"
 +#include "qemu/xxhash.h"
  static uint64_t pac_cell_shuffle(uint64_t i)
@@ -XXX,XX +XXX,XX @@ static uint64_t tweak_inv_shuffle(uint64_t i)
      return o;
  }
 -static uint64_t pauth_computepac(uint64_t data, uint64_t modifier,
 -                                 ARMPACKey key)
 +static uint64_t pauth_computepac_architected(uint64_t data, uint64_t modifier,
 +                                             ARMPACKey key)
  {
      static const uint64_t RC[5] = {
 x0000000000000000ull,
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_computepac(uint64_t data, uint64_t modifier,
      return workingval;
  }
 +static uint64_t pauth_computepac_impdef(uint64_t data, uint64_t modifier,
 +                                        ARMPACKey key)
 +{
-+    return qemu_xxhash64_4(data, modifier, key.lo, key.hi);
++    return sctlr & (el ? SCTLR_EE : SCTLR_E0E);
 +}
 +
-+static uint64_t pauth_computepac(CPUARMState *env, uint64_t data,
++/* Return true if the processor is in big-endian mode. */
-+                                 uint64_t modifier, ARMPACKey key)
++static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
 +{
-+    if (cpu_isar_feature(aa64_pauth_arch, env_archcpu(env))) {
++    if (!is_a64(env)) {
-+        return pauth_computepac_architected(data, modifier, key);
++        return arm_cpu_data_is_big_endian_a32(env, arm_sctlr_b(env));
 +    } else {
-+        return pauth_computepac_impdef(data, modifier, key);
++        int cur_el = arm_current_el(env);
 +        uint64_t sctlr = arm_sctlr(env, cur_el);
 +        return arm_cpu_data_is_big_endian_a64(cur_el, sctlr);
 +    }
 +}
 +
- static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
++#ifdef CONFIG_USER_ONLY
-                              ARMPACKey *key, bool data)
++static inline bool arm_cpu_bswap_data(CPUARMState *env)
 +{
 +    return TARGET_BIG_ENDIAN ^ arm_cpu_data_is_big_endian(env);
 +}
 +#endif
 +
  static inline void aarch64_save_sp(CPUARMState *env, int el)
  {
-@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
+     if (env->pstate & PSTATE_SP) {
      bot_bit = 64 - param.tsz;
      ext_ptr = deposit64(ptr, bot_bit, top_bit - bot_bit, ext);
 -    pac = pauth_computepac(ext_ptr, modifier, *key);
 +    pac = pauth_computepac(env, ext_ptr, modifier, *key);
      /*
       * Check if the ptr has good extension bits and corrupt the
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
      uint64_t pac, orig_ptr, test;
      orig_ptr = pauth_original_ptr(ptr, param);
 -    pac = pauth_computepac(orig_ptr, modifier, *key);
 +    pac = pauth_computepac(env, orig_ptr, modifier, *key);
      bot_bit = 64 - param.tsz;
      top_bit = 64 - 8 * param.tbi;
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(pacga)(CPUARMState *env, uint64_t x, uint64_t y)
      uint64_t pac;
      pauth_check_trap(env, arm_current_el(env), GETPC());
 -    pac = pauth_computepac(x, y, env->keys.apga);
 +    pac = pauth_computepac(env, x, y, env->keys.apga);
      return pac & 0xffffffff00000000ull;
  }
 --
-.20.1
+.43.0

-[PULL 03/33] target/arm: Use object_property_add_bool for "sve" property
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-The interface for object_property_add_bool is simpler,
-making the code easier to understand.
-Reviewed-by: Andrew Jones <drjones@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210111235740.462469-4-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu64.c | 24 ++++++++++--------------
-file changed, 10 insertions(+), 14 deletions(-)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
-     cpu->sve_max_vq = max_vq;
- }
-+/*
-+ * Note that cpu_arm_get/set_sve_vq cannot use the simpler
-+ * object_property_add_bool interface because they make use
-+ * of the contents of "name" to determine which bit on which
-+ * to operate.
-+ */
- static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
-                                void *opaque, Error **errp)
- {
-@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
-     set_bit(vq - 1, cpu->sve_vq_init);
- }
--static void cpu_arm_get_sve(Object *obj, Visitor *v, const char *name,
--                            void *opaque, Error **errp)
-+static bool cpu_arm_get_sve(Object *obj, Error **errp)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
--    bool value = cpu_isar_feature(aa64_sve, cpu);
--
--    visit_type_bool(v, name, &value, errp);
-+    return cpu_isar_feature(aa64_sve, cpu);
- }
--static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
--                            void *opaque, Error **errp)
-+static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
--    bool value;
-     uint64_t t;
--    if (!visit_type_bool(v, name, &value, errp)) {
--        return;
--    }
--
-     if (value && kvm_enabled() && !kvm_arm_sve_supported()) {
-         error_setg(errp, "'sve' feature not supported by KVM on this host");
-         return;
-@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
- {
-     uint32_t vq;
--    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
--                        cpu_arm_set_sve, NULL, NULL);
-+    object_property_add_bool(obj, "sve", cpu_arm_get_sve, cpu_arm_set_sve);
-     for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
-         char name[8];
---
-.20.1

-[PULL 04/33] target/arm: remove redundant tests
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-In this context, the HCR value is the effective value, and thus is
-zero in secure mode. The tests for HCR.{F,I}MO are sufficient.
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-1-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.c    |  8 ++++----
- target/arm/helper.c | 10 ++++------
-files changed, 8 insertions(+), 10 deletions(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
-         break;
-     case EXCP_VFIQ:
--        if (secure || !(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) {
--            /* VFIQs are only taken when hypervized and non-secure.  */
-+        if (!(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) {
-+            /* VFIQs are only taken when hypervized.  */
-             return false;
-         }
-         return !(env->daif & PSTATE_F);
-     case EXCP_VIRQ:
--        if (secure || !(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) {
--            /* VIRQs are only taken when hypervized and non-secure.  */
-+        if (!(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) {
-+            /* VIRQs are only taken when hypervized.  */
-             return false;
-         }
-         return !(env->daif & PSTATE_I);
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
- static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
- {
-     CPUState *cs = env_cpu(env);
--    uint64_t hcr_el2 = arm_hcr_el2_eff(env);
-+    bool el1 = arm_current_el(env) == 1;
-+    uint64_t hcr_el2 = el1 ? arm_hcr_el2_eff(env) : 0;
-     uint64_t ret = 0;
--    bool allow_virt = (arm_current_el(env) == 1 &&
--                       (!arm_is_secure_below_el3(env) ||
--                        (env->cp15.scr_el3 & SCR_EEL2)));
--    if (allow_virt && (hcr_el2 & HCR_IMO)) {
-+    if (hcr_el2 & HCR_IMO) {
-         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
-             ret |= CPSR_I;
-         }
-@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-         }
-     }
--    if (allow_virt && (hcr_el2 & HCR_FMO)) {
-+    if (hcr_el2 & HCR_FMO) {
-         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
-             ret |= CPSR_F;
-         }
---
-.20.1

-[PULL 18/33] target/arm: set HPFAR_EL2.NS on secure stage 2 faults
+[PULL 06/17] target/arm: Move arm_current_el() and arm_el_is_aa64() to internals.h
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+The functions arm_current_el() and arm_el_is_aa64() are used only in
+target/arm and in hw/intc/arm_gicv3_cpuif.c.  They're functions that
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+query internal state of the CPU.  Move them out of cpu.h and into
 internals.h.
 This means we need to include internals.h in arm_gicv3_cpuif.c, but
 this is justifiable because that file is implementing the GICv3 CPU
 interface, which really is part of the CPU proper; we just ended up
 implementing it in code in hw/intc/ for historical reasons.
 The motivation for this move is that we'd like to change
 arm_el_is_aa64() to add a condition that uses cpu_isar_feature();
 but we don't want to include cpu-features.h in cpu.h.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-15-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h        | 2 ++
+ target/arm/cpu.h          | 66 --------------------------------------
- target/arm/internals.h  | 2 ++
+ target/arm/internals.h    | 67 +++++++++++++++++++++++++++++++++++++++
- target/arm/helper.c     | 6 ++++++
+ hw/intc/arm_gicv3_cpuif.c |  1 +
- target/arm/tlb_helper.c | 3 +++
+ target/arm/arch_dump.c    |  1 +
-files changed, 13 insertions(+)
+files changed, 69 insertions(+), 66 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
+@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space);
- #define HCR_TWEDEN    (1ULL << 59)
+ uint64_t arm_hcr_el2_eff(CPUARMState *env);
- #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
+ uint64_t arm_hcrx_el2_eff(CPUARMState *env);
-+#define HPFAR_NS      (1ULL << 63)
+-/* Return true if the specified exception level is running in AArch64 state. */
-+
+-static inline bool arm_el_is_aa64(CPUARMState *env, int el)
- #define SCR_NS                (1U << 0)
+-{
- #define SCR_IRQ               (1U << 1)
+-    /* This isn't valid for EL0 (if we're in EL0, is_a64() is what you want,
- #define SCR_FIQ               (1U << 2)
+-     * and if we're not in EL0 then the state of EL0 isn't well defined.)
 -     */
 -    assert(el >= 1 && el <= 3);
 -    bool aa64 = arm_feature(env, ARM_FEATURE_AARCH64);
 -
 -    /* The highest exception level is always at the maximum supported
 -     * register width, and then lower levels have a register width controlled
 -     * by bits in the SCR or HCR registers.
 -     */
 -    if (el == 3) {
 -        return aa64;
 -    }
 -
 -    if (arm_feature(env, ARM_FEATURE_EL3) &&
 -        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
 -        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
 -    }
 -
 -    if (el == 2) {
 -        return aa64;
 -    }
 -
 -    if (arm_is_el2_enabled(env)) {
 -        aa64 = aa64 && (env->cp15.hcr_el2 & HCR_RW);
 -    }
 -
 -    return aa64;
 -}
 -
  /*
   * Function for determining whether guest cp register reads and writes should
   * access the secure or non-secure bank of a cp register.  When EL3 is
@@ -XXX,XX +XXX,XX @@ static inline bool arm_v7m_is_handler_mode(CPUARMState *env)
      return env->v7m.exception != 0;
  }
 -/* Return the current Exception Level (as per ARMv8; note that this differs
 - * from the ARMv7 Privilege Level).
 - */
 -static inline int arm_current_el(CPUARMState *env)
 -{
 -    if (arm_feature(env, ARM_FEATURE_M)) {
 -        return arm_v7m_is_handler_mode(env) ||
 -            !(env->v7m.control[env->v7m.secure] & 1);
 -    }
 -
 -    if (is_a64(env)) {
 -        return extract32(env->pstate, 2, 2);
 -    }
 -
 -    switch (env->uncached_cpsr & 0x1f) {
 -    case ARM_CPU_MODE_USR:
 -        return 0;
 -    case ARM_CPU_MODE_HYP:
 -        return 2;
 -    case ARM_CPU_MODE_MON:
 -        return 3;
 -    default:
 -        if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
 -            /* If EL3 is 32-bit then all secure privileged modes run in
 -             * EL3
 -             */
 -            return 3;
 -        }
 -
 -        return 1;
 -    }
 -}
 -
  /**
   * write_list_to_cpustate
   * @cpu: ARMCPU
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMFaultType {
+@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
-  * @s2addr: Address that caused a fault at stage 2
+     return arm_rmode_to_sf_map[rmode];
   * @stage2: True if we faulted at stage 2
   * @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk
 + * @s1ns: True if we faulted on a non-secure IPA while in secure state
   * @ea: True if we should set the EA (external abort type) bit in syndrome
   */
  typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
@@ -XXX,XX +XXX,XX @@ struct ARMMMUFaultInfo {
      int domain;
      bool stage2;
      bool s1ptw;
 +    bool s1ns;
      bool ea;
  };
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
                  target_el = 3;
              } else {
                  env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4;
 +                if (arm_is_secure_below_el3(env) && fi.s1ns) {
 +                    env->cp15.hpfar_el2 |= HPFAR_NS;
 +                }
                  target_el = 2;
              }
              take_exc = true;
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
              fi->s2addr = addr;
              fi->stage2 = true;
              fi->s1ptw = true;
 +            fi->s1ns = !*is_secure;
              return ~0;
          }
          if ((arm_hcr_el2_eff(env) & HCR_PTW) &&
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
              fi->s2addr = addr;
              fi->stage2 = true;
              fi->s1ptw = true;
 +            fi->s1ns = !*is_secure;
              return ~0;
          }
@@ -XXX,XX +XXX,XX @@ do_fault:
      /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
      fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2 ||
                                 mmu_idx == ARMMMUIdx_Stage2_S);
 +    fi->s1ns = mmu_idx == ARMMMUIdx_Stage2;
      return true;
  }
-diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
++/* Return true if the specified exception level is running in AArch64 state. */
-index XXXXXXX..XXXXXXX 100644
++static inline bool arm_el_is_aa64(CPUARMState *env, int el)
---- a/target/arm/tlb_helper.c
++{
-+++ b/target/arm/tlb_helper.c
++    /*
-@@ -XXX,XX +XXX,XX @@ static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,
++     * This isn't valid for EL0 (if we're in EL0, is_a64() is what you want,
-     if (fi->stage2) {
++     * and if we're not in EL0 then the state of EL0 isn't well defined.)
-         target_el = 2;
++     */
-         env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
++    assert(el >= 1 && el <= 3);
-+        if (arm_is_secure_below_el3(env) && fi->s1ns) {
++    bool aa64 = arm_feature(env, ARM_FEATURE_AARCH64);
-+            env->cp15.hpfar_el2 |= HPFAR_NS;
++
 +    /*
 +     * The highest exception level is always at the maximum supported
 +     * register width, and then lower levels have a register width controlled
 +     * by bits in the SCR or HCR registers.
 +     */
 +    if (el == 3) {
 +        return aa64;
 +    }
 +
 +    if (arm_feature(env, ARM_FEATURE_EL3) &&
 +        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
 +        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
 +    }
 +
 +    if (el == 2) {
 +        return aa64;
 +    }
 +
 +    if (arm_is_el2_enabled(env)) {
 +        aa64 = aa64 && (env->cp15.hcr_el2 & HCR_RW);
 +    }
 +
 +    return aa64;
 +}
 +
 +/*
 + * Return the current Exception Level (as per ARMv8; note that this differs
 + * from the ARMv7 Privilege Level).
 + */
 +static inline int arm_current_el(CPUARMState *env)
 +{
 +    if (arm_feature(env, ARM_FEATURE_M)) {
 +        return arm_v7m_is_handler_mode(env) ||
 +            !(env->v7m.control[env->v7m.secure] & 1);
 +    }
 +
 +    if (is_a64(env)) {
 +        return extract32(env->pstate, 2, 2);
 +    }
 +
 +    switch (env->uncached_cpsr & 0x1f) {
 +    case ARM_CPU_MODE_USR:
 +        return 0;
 +    case ARM_CPU_MODE_HYP:
 +        return 2;
 +    case ARM_CPU_MODE_MON:
 +        return 3;
 +    default:
 +        if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
 +            /* If EL3 is 32-bit then all secure privileged modes run in EL3 */
 +            return 3;
 +        }
-     }
++
-     same_el = (arm_current_el(env) == target_el);
++        return 1;
++    }
 +}
 +
  static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
                                                    bool sctlr_b)
  {
 diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_cpuif.c
 +++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "target/arm/cpregs.h"
  #include "target/arm/cpu-features.h"
 +#include "target/arm/internals.h"
  #include "system/tcg.h"
  #include "system/qtest.h"
 diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arch_dump.c
 +++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@
  #include "elf.h"
  #include "system/dump.h"
  #include "cpu-features.h"
 +#include "internals.h"
  /* struct user_pt_regs from arch/arm64/include/uapi/asm/ptrace.h */
  struct aarch64_user_regs {
 --
-.20.1
+.43.0

-[PULL 20/33] target/arm: Implement SCR_EL2.EEL2
+[PULL 07/17] target/arm: SCR_EL3.RW should be treated as 1 if EL2 doesn't support AArch32
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+The definition of SCR_EL3.RW says that its effective value is 1 if:
  - EL2 is implemented and does not support AArch32, and SCR_EL3.NS is 1
  - the effective value of SCR_EL3.{EEL2,NS} is {1,0} (i.e. we are
    Secure and Secure EL2 is disabled)
-This adds handling for the SCR_EL3.EEL2 bit.
+We implement the second of these in arm_el_is_aa64(), but forgot the
 first.
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+Provide a new function arm_scr_rw_eff() to return the effective
-Message-id: 20210112104511.36576-17-remi.denis.courmont@huawei.com
+value of SCR_EL3.RW, and use it in arm_el_is_aa64() and the other
-[PMM: Applied fixes for review issues noted by RTH:
+places that currently look directly at the bit value.
- - check for FEATURE_AARCH64 before checking sel2 isar feature
- - correct the commit message subject line]
+(scr_write() enforces that the RW bit is RAO/WI if neither EL1 nor
 EL2 have AArch32 support, but if EL1 does but EL2 does not then the
 bit must still be writeable.)
 This will mean that if code at EL3 attempts to perform an exception
 return to AArch32 EL2 when EL2 is AArch64-only we will correctly
 handle this as an illegal exception return: it will be caught by the
 "return to an EL which is configured for a different register width"
 check in HELPER(exception_return).
 We do already have some CPU types which don't implement AArch32
 above EL0, so this is technically a bug; it doesn't seem worth
 backporting to stable because no sensible guest code will be
 deliberately attempting to set the RW bit to a value corresponding
 to an unimplemented execution state and then checking that we
 did the right thing.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h       |  8 ++++++--
+ target/arm/internals.h | 26 +++++++++++++++++++++++---
- target/arm/cpu.c       |  2 +-
+ target/arm/helper.c    |  4 ++--
- target/arm/helper.c    | 19 ++++++++++++++++---
+files changed, 25 insertions(+), 5 deletions(-)
  target/arm/translate.c | 15 +++++++++++++--
 files changed, 36 insertions(+), 8 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/internals.h
-+++ b/target/arm/cpu.h
++++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)
+@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
- static inline bool arm_is_el2_enabled(CPUARMState *env)
+     return arm_rmode_to_sf_map[rmode];
  }
 +/* Return the effective value of SCR_EL3.RW */
 +static inline bool arm_scr_rw_eff(CPUARMState *env)
 +{
 +    /*
 +     * SCR_EL3.RW has an effective value of 1 if:
 +     *  - we are NS and EL2 is implemented but doesn't support AArch32
 +     *  - we are S and EL2 is enabled (in which case it must be AArch64)
 +     */
 +    ARMCPU *cpu = env_archcpu(env);
 +
 +    if (env->cp15.scr_el3 & SCR_RW) {
 +        return true;
 +    }
 +    if (env->cp15.scr_el3 & SCR_NS) {
 +        return arm_feature(env, ARM_FEATURE_EL2) &&
 +            !cpu_isar_feature(aa64_aa32_el2, cpu);
 +    } else {
 +        return env->cp15.scr_el3 & SCR_EEL2;
 +    }
 +}
 +
  /* Return true if the specified exception level is running in AArch64 state. */
  static inline bool arm_el_is_aa64(CPUARMState *env, int el)
  {
-     if (arm_feature(env, ARM_FEATURE_EL2)) {
--        return !arm_is_secure_below_el3(env);
-+        if (arm_is_secure_below_el3(env)) {
-+            return (env->cp15.scr_el3 & SCR_EEL2) != 0;
-+        }
-+        return true;
-     }
-     return false;
- }
 @@ -XXX,XX +XXX,XX @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
          return aa64;
      }
--    if (arm_feature(env, ARM_FEATURE_EL3)) {
+-    if (arm_feature(env, ARM_FEATURE_EL3) &&
-+    if (arm_feature(env, ARM_FEATURE_EL3) &&
+-        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
-+        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
+-        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
-         aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
++    if (arm_feature(env, ARM_FEATURE_EL3)) {
 +        aa64 = aa64 && arm_scr_rw_eff(env);
      }
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+     if (el == 2) {
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
               * masked from Secure state. The HCR and SCR settings
               * don't affect the masking logic, only the interrupt routing.
               */
 -            if (target_el == 3 || !secure) {
 +            if (target_el == 3 || !secure || (env->cp15.scr_el3 & SCR_EEL2)) {
                  unmasked = true;
              }
          } else {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
+@@ -XXX,XX +XXX,XX @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
-         return CP_ACCESS_OK;
+     uint64_t hcr_el2;
-     }
-     if (arm_is_secure_below_el3(env)) {
+     if (arm_feature(env, ARM_FEATURE_EL3)) {
-+        if (env->cp15.scr_el3 & SCR_EEL2) {
+-        rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
-+            return CP_ACCESS_TRAP_EL2;
++        rw = arm_scr_rw_eff(env);
-+        }
+     } else {
-         return CP_ACCESS_TRAP_EL3;
+         /*
-     }
+          * Either EL2 is the highest EL (and so the EL2 register width
-     /* This will be EL1 NS and EL2 NS, which just UNDEF */
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
-@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-         if (cpu_isar_feature(aa64_pauth, cpu)) {
+         switch (new_el) {
-             valid_mask |= SCR_API | SCR_APK;
+         case 3:
-         }
+-            is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0;
-+        if (cpu_isar_feature(aa64_sel2, cpu)) {
++            is_aa64 = arm_scr_rw_eff(env);
-+            valid_mask |= SCR_EEL2;
+             break;
-+        }
+         case 2:
-         if (cpu_isar_feature(aa64_mte, cpu)) {
+             hcr = arm_hcr_el2_eff(env);
              valid_mask |= SCR_ATA;
          }
@@ -XXX,XX +XXX,XX @@ static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                   bool isread)
  {
      if (ri->opc2 & 4) {
 -        /* The ATS12NSO* operations must trap to EL3 if executed in
 +        /* The ATS12NSO* operations must trap to EL3 or EL2 if executed in
           * Secure EL1 (which can only happen if EL3 is AArch64).
           * They are simply UNDEF if executed from NS EL1.
           * They function normally from EL2 or EL3.
           */
          if (arm_current_el(env) == 1) {
              if (arm_is_secure_below_el3(env)) {
 +                if (env->cp15.scr_el3 & SCR_EEL2) {
 +                    return CP_ACCESS_TRAP_UNCATEGORIZED_EL2;
 +                }
                  return CP_ACCESS_TRAP_UNCATEGORIZED_EL3;
              }
              return CP_ACCESS_TRAP_UNCATEGORIZED;
@@ -XXX,XX +XXX,XX @@ static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
  static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                       bool isread)
  {
 -    if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) {
 +    if (arm_current_el(env) == 3 &&
 +        !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) {
          return CP_ACCESS_TRAP;
      }
      return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                     bool isread)
  {
      /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2.
 -     * At Secure EL1 it traps to EL3.
 +     * At Secure EL1 it traps to EL3 or EL2.
       */
      if (arm_current_el(env) == 3) {
          return CP_ACCESS_OK;
      }
      if (arm_is_secure_below_el3(env)) {
 +        if (env->cp15.scr_el3 & SCR_EEL2) {
 +            return CP_ACCESS_TRAP_EL2;
 +        }
          return CP_ACCESS_TRAP_EL3;
      }
      /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */
 diff --git a/target/arm/translate.c b/target/arm/translate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.c
 +++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
          }
          if (s->current_el == 1) {
              /* If we're in Secure EL1 (which implies that EL3 is AArch64)
 -             * then accesses to Mon registers trap to EL3
 +             * then accesses to Mon registers trap to Secure EL2, if it exists,
 +             * otherwise EL3.
               */
 -            TCGv_i32 tcg_el = tcg_const_i32(3);
 +            TCGv_i32 tcg_el;
 +
 +            if (arm_dc_feature(s, ARM_FEATURE_AARCH64) &&
 +                dc_isar_feature(aa64_sel2, s)) {
 +                /* Target EL is EL<3 minus SCR_EL3.EEL2> */
 +                tcg_el = load_cpu_field(cp15.scr_el3);
 +                tcg_gen_sextract_i32(tcg_el, tcg_el, ctz32(SCR_EEL2), 1);
 +                tcg_gen_addi_i32(tcg_el, tcg_el, 3);
 +            } else {
 +                tcg_el = tcg_const_i32(3);
 +            }
              gen_exception_el(s, EXCP_UDEF, syn_uncategorized(), tcg_el);
              tcg_temp_free_i32(tcg_el);
 --
-.20.1
+.43.0

-[PULL 15/33] target/arm: translate NS bit in page-walks
+[PULL 08/17] target/arm: HCR_EL2.RW should be RAO/WI if EL1 doesn't support AArch32
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+When EL1 doesn't support AArch32, the HCR_EL2.RW bit is supposed to
 be RAO/WI. Enforce the RAO/WI behaviour.
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+Note that we handle "reset value should honour RES1 bits" in the same
 way that SCR_EL3 does, via a reset function.
 We do already have some CPU types which don't implement AArch32
 above EL0, so this is technically a bug; it doesn't seem worth
 backporting to stable because no sensible guest code will be
 deliberately attempting to set the RW bit to a value corresponding
 to an unimplemented execution state and then checking that we
 did the right thing.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-12-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.c | 12 ++++++++++++
 file changed, 12 insertions(+)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
+@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
-             fi->s1ptw = true;
+     /* Clear RES0 bits.  */
-             return ~0;
+     value &= valid_mask;
-         }
 +    /* RW is RAO/WI if EL1 is AArch64 only */
 +    if (!cpu_isar_feature(aa64_aa32_el1, cpu)) {
 +        value |= HCR_RW;
 +    }
 +
-+        if (arm_is_secure_below_el3(env)) {
+     /*
-+            /* Check if page table walk is to secure or non-secure PA space. */
+      * These bits change the MMU setup:
-+            if (*is_secure) {
+      * HCR_VM enables stage 2 translation
-+                *is_secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
+@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
-+            } else {
+     do_hcr_write(env, value, MAKE_64BIT_MASK(32, 32));
-+                *is_secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
+ }
-+            }
-+        } else {
++static void hcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
-+            assert(!*is_secure);
++{
-+        }
++    /* hcr_write will set the RES1 bits on an AArch64-only CPU */
 +    hcr_write(env, ri, 0);
 +}
 +
-         addr = s2pa;
+ /*
-     }
+  * Return the effective value of HCR_EL2, at the given security state.
-     return addr;
+  * Bits that are not included here:
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
        .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
        .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
        .nv2_redirect_offset = 0x78,
 +      .resetfn = hcr_reset,
        .writefn = hcr_write, .raw_writefn = raw_write },
      { .name = "HCR", .state = ARM_CP_STATE_AA32,
        .type = ARM_CP_ALIAS | ARM_CP_IO,
 --
-.20.1
+.43.0

-[PULL 07/33] target/arm: use arm_hcr_el2_eff() where applicable
+[PULL 09/17] target/arm: Add cpu local variable to exception_return helper
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+We already call env_archcpu() multiple times within the
 exception_return helper function, and we're about to want to
 add another use of the ARMCPU pointer. Add a local variable
 cpu so we can call env_archcpu() just once.
-This will simplify accessing HCR conditionally in secure state.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  target/arm/tcg/helper-a64.c | 7 ++++---
 file changed, 4 insertions(+), 3 deletions(-)
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20210112104511.36576-4-remi.denis.courmont@huawei.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.c | 31 ++++++++++++++++++-------------
 file changed, 18 insertions(+), 13 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/tcg/helper-a64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/tcg/helper-a64.c
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult aa64_cacheop_pou_access(CPUARMState *env,
+@@ -XXX,XX +XXX,XX @@ static void cpsr_write_from_spsr_elx(CPUARMState *env,
- static int vae1_tlbmask(CPUARMState *env)
+ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
  {
--    /* Since we exclude secure first, we may read HCR_EL2 directly. */
++    ARMCPU *cpu = env_archcpu(env);
--    if (arm_is_secure_below_el3(env)) {
+     int cur_el = arm_current_el(env);
--        return ARMMMUIdxBit_SE10_1 |
+     unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
--               ARMMMUIdxBit_SE10_1_PAN |
+     uint32_t spsr = env->banked_spsr[spsr_idx];
--               ARMMMUIdxBit_SE10_0;
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
 -    } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE))
 -               == (HCR_E2H | HCR_TGE)) {
 +    uint64_t hcr = arm_hcr_el2_eff(env);
 +
 +    if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
          return ARMMMUIdxBit_E20_2 |
                 ARMMMUIdxBit_E20_2_PAN |
                 ARMMMUIdxBit_E20_0;
 +    } else if (arm_is_secure_below_el3(env)) {
 +        return ARMMMUIdxBit_SE10_1 |
 +               ARMMMUIdxBit_SE10_1_PAN |
 +               ARMMMUIdxBit_SE10_0;
      } else {
          return ARMMMUIdxBit_E10_1 |
                 ARMMMUIdxBit_E10_1_PAN |
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
  static inline bool regime_translation_disabled(CPUARMState *env,
                                                 ARMMMUIdx mmu_idx)
  {
 +    uint64_t hcr_el2;
 +
      if (arm_feature(env, ARM_FEATURE_M)) {
          switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] &
                  (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
@@ -XXX,XX +XXX,XX @@ static inline bool regime_translation_disabled(CPUARMState *env,
          }
      }
-+    hcr_el2 = arm_hcr_el2_eff(env);
+     bql_lock();
-+
+-    arm_call_pre_el_change_hook(env_archcpu(env));
-     if (mmu_idx == ARMMMUIdx_Stage2) {
++    arm_call_pre_el_change_hook(cpu);
-         /* HCR.DC means HCR.VM behaves as 1 */
+     bql_unlock();
--        return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0;
-+        return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
+     if (!return_to_aa64) {
-     }
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
+         int tbii;
--    if (env->cp15.hcr_el2 & HCR_TGE) {
-+    if (hcr_el2 & HCR_TGE) {
+         env->aarch64 = true;
-         /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
+-        spsr &= aarch64_pstate_valid_mask(&env_archcpu(env)->isar);
-         if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) {
++        spsr &= aarch64_pstate_valid_mask(&cpu->isar);
-             return true;
+         pstate_write(env, spsr);
-         }
+         if (!arm_singlestep_active(env)) {
-     }
+             env->pstate &= ~PSTATE_SS;
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
--    if ((env->cp15.hcr_el2 & HCR_DC) && arm_mmu_idx_is_stage1_of_2(mmu_idx)) {
+     aarch64_sve_change_el(env, cur_el, new_el, return_to_aa64);
-+    if ((hcr_el2 & HCR_DC) && arm_mmu_idx_is_stage1_of_2(mmu_idx)) {
-         /* HCR.DC means SCTLR_EL1.M behaves as 0 */
+     bql_lock();
-         return true;
+-    arm_call_el_change_hook(env_archcpu(env));
-     }
++    arm_call_el_change_hook(cpu);
-@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
+     bql_unlock();
-             fi->s1ptw = true;
-             return ~0;
+     return;
          }
 -        if ((env->cp15.hcr_el2 & HCR_PTW) && (cacheattrs.attrs & 0xf0) == 0) {
 +        if ((arm_hcr_el2_eff(env) & HCR_PTW) &&
 +            (cacheattrs.attrs & 0xf0) == 0) {
              /*
               * PTW set and S1 walk touched S2 Device memory:
               * generate Permission fault.
@@ -XXX,XX +XXX,XX @@ static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
      uint8_t hihint = 0, lohint = 0;
      if (hiattr != 0) { /* normal memory */
 -        if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
 +        if (arm_hcr_el2_eff(env) & HCR_CD) { /* cache disabled */
              hiattr = loattr = 1; /* non-cacheable */
          } else {
              if (hiattr != 1) { /* Write-through or write-back */
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
              }
              /* Combine the S1 and S2 cache attributes. */
 -            if (env->cp15.hcr_el2 & HCR_DC) {
 +            if (arm_hcr_el2_eff(env) & HCR_DC) {
                  /*
                   * HCR.DC forces the first stage attributes to
                   *  Normal Non-Shareable,
 --
-.20.1
+.43.0

-[PULL 06/33] target/arm: use arm_is_el2_enabled() where applicable
+[PULL 10/17] target/arm: Forbid return to AArch32 when CPU is AArch64-only
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+In the Arm ARM, rule R_TYTWB states that returning to AArch32
 is an illegal exception return if:
  * AArch32 is not supported at any exception level
  * the target EL is configured for AArch64 via SCR_EL3.RW
    or HCR_EL2.RW or via CPU state at reset
-Do not assume that EL2 is available in and only in non-secure context.
+We check the second of these, but not the first (which can only be
-That equivalence is broken by ARMv8.4-SEL2.
+relevant for the case of a return to EL0, because if AArch32 is not
 supported at one of the higher ELs then the RW bits will have an
 effective value of 1 and the the "configured for AArch64" condition
 will hold also).
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
+Add the missing condition. Although this is technically a bug
 (because we have one AArch64-only CPU: a64fx) it isn't worth
 backporting to stable because no sensible guest code will
 deliberately try to return to a nonexistent execution state
 to check that it gets an illegal exception return.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-3-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h        |  4 ++--
+ target/arm/tcg/helper-a64.c | 5 +++++
- target/arm/helper-a64.c |  8 +-------
+file changed, 5 insertions(+)
  target/arm/helper.c     | 33 +++++++++++++--------------------
 files changed, 16 insertions(+), 29 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/target/arm/tcg/helper-a64.c
-+++ b/target/arm/cpu.h
++++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
          return aa64;
      }
 -    if (arm_feature(env, ARM_FEATURE_EL2) && !arm_is_secure_below_el3(env)) {
 +    if (arm_is_el2_enabled(env)) {
          aa64 = aa64 && (env->cp15.hcr_el2 & HCR_RW);
      }
@@ -XXX,XX +XXX,XX @@ static inline int arm_debug_target_el(CPUARMState *env)
      bool secure = arm_is_secure(env);
      bool route_to_el2 = false;
 -    if (arm_feature(env, ARM_FEATURE_EL2) && !secure) {
 +    if (arm_is_el2_enabled(env)) {
          route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
                         env->cp15.mdcr_el2 & MDCR_TDE;
      }
 diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper-a64.c
 +++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
      if (new_el == -1) {
          goto illegal_return;
      }
 -    if (new_el > cur_el
 -        || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
 +    if (new_el > cur_el || (new_el == 2 && !arm_is_el2_enabled(env))) {
          /* Disallow return to an EL which is unimplemented or higher
           * than the current one.
           */
 @@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
          goto illegal_return;
      }
--    if (new_el == 2 && arm_is_secure_below_el3(env)) {
++    if (!return_to_aa64 && !cpu_isar_feature(aa64_aa32, cpu)) {
--        /* Return to the non-existent secure-EL2 */
++        /* Return to AArch32 when CPU is AArch64-only */
--        goto illegal_return;
++        goto illegal_return;
--    }
++    }
--
++
      if (new_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
          goto illegal_return;
      }
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
- {
-     if (arm_feature(env, ARM_FEATURE_V8)) {
-         /* Check if CPACR accesses are to be trapped to EL2 */
--        if (arm_current_el(env) == 1 &&
--            (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) {
-+        if (arm_current_el(env) == 1 && arm_is_el2_enabled(env) &&
-+            (env->cp15.cptr_el[2] & CPTR_TCPAC)) {
-             return CP_ACCESS_TRAP_EL2;
-         /* Check if CPACR accesses are to be trapped to EL3 */
-         } else if (arm_current_el(env) < 3 &&
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
-                                         bool isread)
- {
-     unsigned int cur_el = arm_current_el(env);
--    bool secure = arm_is_secure(env);
-+    bool has_el2 = arm_is_el2_enabled(env);
-     uint64_t hcr = arm_hcr_el2_eff(env);
-     switch (cur_el) {
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
-             }
-         } else {
-             /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */
--            if (arm_feature(env, ARM_FEATURE_EL2) &&
--                timeridx == GTIMER_PHYS && !secure &&
-+            if (has_el2 && timeridx == GTIMER_PHYS &&
-                 !extract32(env->cp15.cnthctl_el2, 1, 1)) {
-                 return CP_ACCESS_TRAP_EL2;
-             }
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
-     case 1:
-         /* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */
--        if (arm_feature(env, ARM_FEATURE_EL2) &&
--            timeridx == GTIMER_PHYS && !secure &&
-+        if (has_el2 && timeridx == GTIMER_PHYS &&
-             (hcr & HCR_E2H
-              ? !extract32(env->cp15.cnthctl_el2, 10, 1)
-              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
-                                       bool isread)
- {
-     unsigned int cur_el = arm_current_el(env);
--    bool secure = arm_is_secure(env);
-+    bool has_el2 = arm_is_el2_enabled(env);
-     uint64_t hcr = arm_hcr_el2_eff(env);
-     switch (cur_el) {
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
-         /* fall through */
-     case 1:
--        if (arm_feature(env, ARM_FEATURE_EL2) &&
--            timeridx == GTIMER_PHYS && !secure) {
-+        if (has_el2 && timeridx == GTIMER_PHYS) {
-             if (hcr & HCR_E2H) {
-                 /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PTEN. */
-                 if (!extract32(env->cp15.cnthctl_el2, 11, 1)) {
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo strongarm_cp_reginfo[] = {
- static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri)
- {
--    ARMCPU *cpu = env_archcpu(env);
-     unsigned int cur_el = arm_current_el(env);
--    bool secure = arm_is_secure(env);
--    if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
-+    if (arm_is_el2_enabled(env) && cur_el == 1) {
-         return env->cp15.vpidr_el2;
-     }
-     return raw_read(env, ri);
-@@ -XXX,XX +XXX,XX @@ static uint64_t mpidr_read_val(CPUARMState *env)
- static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
- {
-     unsigned int cur_el = arm_current_el(env);
--    bool secure = arm_is_secure(env);
--    if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
-+    if (arm_is_el2_enabled(env) && cur_el == 1) {
-         return env->cp15.vmpidr_el2;
-     }
-     return mpidr_read_val(env);
-@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff(CPUARMState *env)
- {
-     uint64_t ret = env->cp15.hcr_el2;
--    if (arm_is_secure_below_el3(env)) {
-+    if (!arm_is_el2_enabled(env)) {
-         /*
-          * "This register has no effect if EL2 is not enabled in the
-          * current Security state".  This is ARMv8.4-SecEL2 speak for
-@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
-     /* CPTR_EL2.  Since TZ and TFP are positive,
-      * they will be zero when EL2 is not present.
-      */
--    if (el <= 2 && !arm_is_secure_below_el3(env)) {
-+    if (el <= 2 && arm_is_el2_enabled(env)) {
-         if (env->cp15.cptr_el[2] & CPTR_TZ) {
-             return 2;
-         }
-@@ -XXX,XX +XXX,XX @@ static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type)
-         }
-         return 0;
-     case ARM_CPU_MODE_HYP:
--        return !arm_feature(env, ARM_FEATURE_EL2)
--            || arm_current_el(env) < 2 || arm_is_secure_below_el3(env);
-+        return !arm_is_el2_enabled(env) || arm_current_el(env) < 2;
-     case ARM_CPU_MODE_MON:
-         return arm_current_el(env) < 3;
-     default:
-@@ -XXX,XX +XXX,XX @@ int fp_exception_el(CPUARMState *env, int cur_el)
-     /* CPTR_EL2 : present in v7VE or v8 */
-     if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
--        && !arm_is_secure_below_el3(env)) {
-+        && arm_is_el2_enabled(env)) {
-         /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
-         return 2;
-     }
 --
-.20.1
+.43.0

-[PULL 08/33] target/arm: factor MDCR_EL2 common handling
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-This adds a common helper to compute the effective value of MDCR_EL2.
-That is the actual value if EL2 is enabled in the current security
-context, or 0 elsewise.
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-5-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 38 ++++++++++++++++++++++----------------
-file changed, 22 insertions(+), 16 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
-     return CP_ACCESS_TRAP_UNCATEGORIZED;
- }
-+static uint64_t arm_mdcr_el2_eff(CPUARMState *env)
-+{
-+    return arm_is_el2_enabled(env) ? env->cp15.mdcr_el2 : 0;
-+}
-+
- /* Check for traps to "powerdown debug" registers, which are controlled
-  * by MDCR.TDOSA
-  */
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
-                                    bool isread)
- {
-     int el = arm_current_el(env);
--    bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) ||
--        (env->cp15.mdcr_el2 & MDCR_TDE) ||
-+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
-+    bool mdcr_el2_tdosa = (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TDE) ||
-         (arm_hcr_el2_eff(env) & HCR_TGE);
--    if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) {
-+    if (el < 2 && mdcr_el2_tdosa) {
-         return CP_ACCESS_TRAP_EL2;
-     }
-     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
-                                   bool isread)
- {
-     int el = arm_current_el(env);
--    bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) ||
--        (env->cp15.mdcr_el2 & MDCR_TDE) ||
-+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
-+    bool mdcr_el2_tdra = (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE) ||
-         (arm_hcr_el2_eff(env) & HCR_TGE);
--    if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) {
-+    if (el < 2 && mdcr_el2_tdra) {
-         return CP_ACCESS_TRAP_EL2;
-     }
-     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
-                                   bool isread)
- {
-     int el = arm_current_el(env);
--    bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) ||
--        (env->cp15.mdcr_el2 & MDCR_TDE) ||
-+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
-+    bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) ||
-         (arm_hcr_el2_eff(env) & HCR_TGE);
--    if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) {
-+    if (el < 2 && mdcr_el2_tda) {
-         return CP_ACCESS_TRAP_EL2;
-     }
-     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri,
-                                  bool isread)
- {
-     int el = arm_current_el(env);
-+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
--    if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
--        && !arm_is_secure_below_el3(env)) {
-+    if (el < 2 && (mdcr_el2 & MDCR_TPM)) {
-         return CP_ACCESS_TRAP_EL2;
-     }
-     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
-      * trapping to EL2 or EL3 for other accesses.
-      */
-     int el = arm_current_el(env);
-+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
-     if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) {
-         return CP_ACCESS_TRAP;
-     }
--    if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
--        && !arm_is_secure_below_el3(env)) {
-+    if (el < 2 && (mdcr_el2 & MDCR_TPM)) {
-         return CP_ACCESS_TRAP_EL2;
-     }
-     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
-@@ -XXX,XX +XXX,XX @@ static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
-     bool enabled, prohibited, filtered;
-     bool secure = arm_is_secure(env);
-     int el = arm_current_el(env);
--    uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN;
-+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
-+    uint8_t hpmn = mdcr_el2 & MDCR_HPMN;
-     if (!arm_feature(env, ARM_FEATURE_PMU)) {
-         return false;
-@@ -XXX,XX +XXX,XX @@ static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
-             (counter < hpmn || counter == 31)) {
-         e = env->cp15.c9_pmcr & PMCRE;
-     } else {
--        e = env->cp15.mdcr_el2 & MDCR_HPME;
-+        e = mdcr_el2 & MDCR_HPME;
-     }
-     enabled = e && (env->cp15.c9_pmcnten & (1 << counter));
-     if (!secure) {
-         if (el == 2 && (counter < hpmn || counter == 31)) {
--            prohibited = env->cp15.mdcr_el2 & MDCR_HPMD;
-+            prohibited = mdcr_el2 & MDCR_HPMD;
-         } else {
-             prohibited = false;
-         }
---
-.20.1

-[PULL 09/33] target/arm: Define isar_feature function to test for presence of SEL2
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-6-remi.denis.courmont@huawei.com
-[PMM: tweaked commit message to match reduced scope of patch
- following rebase]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_sve(const ARMISARegisters *id)
-     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SVE) != 0;
- }
-+static inline bool isar_feature_aa64_sel2(const ARMISARegisters *id)
-+{
-+    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SEL2) != 0;
-+}
-+
- static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
- {
-     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
---
-.20.1

-[PULL 11/33] target/arm: add MMU stage 1 for Secure EL2
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-This adds the MMU indices for EL2 stage 1 in secure state.
-To keep code contained, which is largelly identical between secure and
-non-secure modes, the MMU indices are reassigned. The new assignments
-provide a systematic pattern with a non-secure bit.
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-8-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu-param.h     |   2 +-
- target/arm/cpu.h           |  35 ++++++----
- target/arm/internals.h     |  12 ++++
- target/arm/helper.c        | 127 ++++++++++++++++++++++++-------------
- target/arm/translate-a64.c |   4 ++
-files changed, 123 insertions(+), 57 deletions(-)
-diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu-param.h
-+++ b/target/arm/cpu-param.h
-@@ -XXX,XX +XXX,XX @@
- # define TARGET_PAGE_BITS_MIN  10
- #endif
--#define NB_MMU_MODES 11
-+#define NB_MMU_MODES 15
- #endif
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
- #define ARM_MMU_IDX_NOTLB 0x20  /* does not have a TLB */
- #define ARM_MMU_IDX_M     0x40  /* M profile */
-+/* Meanings of the bits for A profile mmu idx values */
-+#define ARM_MMU_IDX_A_NS     0x8
-+
- /* Meanings of the bits for M profile mmu idx values */
- #define ARM_MMU_IDX_M_PRIV   0x1
- #define ARM_MMU_IDX_M_NEGPRI 0x2
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
-     /*
-      * A-profile.
-      */
--    ARMMMUIdx_E10_0      =  0 | ARM_MMU_IDX_A,
--    ARMMMUIdx_E20_0      =  1 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_SE10_0     =  0 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_SE20_0     =  1 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_SE10_1     =  2 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_SE20_2     =  3 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_SE10_1_PAN =  4 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_SE20_2_PAN =  5 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_SE2        =  6 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_SE3        =  7 | ARM_MMU_IDX_A,
--    ARMMMUIdx_E10_1      =  2 | ARM_MMU_IDX_A,
--    ARMMMUIdx_E10_1_PAN  =  3 | ARM_MMU_IDX_A,
--
--    ARMMMUIdx_E2         =  4 | ARM_MMU_IDX_A,
--    ARMMMUIdx_E20_2      =  5 | ARM_MMU_IDX_A,
--    ARMMMUIdx_E20_2_PAN  =  6 | ARM_MMU_IDX_A,
--
--    ARMMMUIdx_SE10_0     = 7 | ARM_MMU_IDX_A,
--    ARMMMUIdx_SE10_1     = 8 | ARM_MMU_IDX_A,
--    ARMMMUIdx_SE10_1_PAN = 9 | ARM_MMU_IDX_A,
--    ARMMMUIdx_SE3        = 10 | ARM_MMU_IDX_A,
-+    ARMMMUIdx_E10_0     = ARMMMUIdx_SE10_0 | ARM_MMU_IDX_A_NS,
-+    ARMMMUIdx_E20_0     = ARMMMUIdx_SE20_0 | ARM_MMU_IDX_A_NS,
-+    ARMMMUIdx_E10_1     = ARMMMUIdx_SE10_1 | ARM_MMU_IDX_A_NS,
-+    ARMMMUIdx_E20_2     = ARMMMUIdx_SE20_2 | ARM_MMU_IDX_A_NS,
-+    ARMMMUIdx_E10_1_PAN = ARMMMUIdx_SE10_1_PAN | ARM_MMU_IDX_A_NS,
-+    ARMMMUIdx_E20_2_PAN = ARMMMUIdx_SE20_2_PAN | ARM_MMU_IDX_A_NS,
-+    ARMMMUIdx_E2        = ARMMMUIdx_SE2 | ARM_MMU_IDX_A_NS,
-     /*
-      * These are not allocated TLBs and are used only for AT system
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
-     TO_CORE_BIT(E20_2),
-     TO_CORE_BIT(E20_2_PAN),
-     TO_CORE_BIT(SE10_0),
-+    TO_CORE_BIT(SE20_0),
-     TO_CORE_BIT(SE10_1),
-+    TO_CORE_BIT(SE20_2),
-     TO_CORE_BIT(SE10_1_PAN),
-+    TO_CORE_BIT(SE20_2_PAN),
-+    TO_CORE_BIT(SE2),
-     TO_CORE_BIT(SE3),
-     TO_CORE_BIT(MUser),
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_has_2_ranges(ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_SE10_0:
-     case ARMMMUIdx_SE10_1:
-     case ARMMMUIdx_SE10_1_PAN:
-+    case ARMMMUIdx_SE20_0:
-+    case ARMMMUIdx_SE20_2:
-+    case ARMMMUIdx_SE20_2_PAN:
-         return true;
-     default:
-         return false;
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_SE10_0:
-     case ARMMMUIdx_SE10_1:
-     case ARMMMUIdx_SE10_1_PAN:
-+    case ARMMMUIdx_SE20_0:
-+    case ARMMMUIdx_SE20_2:
-+    case ARMMMUIdx_SE20_2_PAN:
-+    case ARMMMUIdx_SE2:
-     case ARMMMUIdx_MSPrivNegPri:
-     case ARMMMUIdx_MSUserNegPri:
-     case ARMMMUIdx_MSPriv:
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_E10_1_PAN:
-     case ARMMMUIdx_E20_2_PAN:
-     case ARMMMUIdx_SE10_1_PAN:
-+    case ARMMMUIdx_SE20_2_PAN:
-         return true;
-     default:
-         return false;
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
- static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
- {
-     switch (mmu_idx) {
-+    case ARMMMUIdx_SE20_0:
-+    case ARMMMUIdx_SE20_2:
-+    case ARMMMUIdx_SE20_2_PAN:
-     case ARMMMUIdx_E20_0:
-     case ARMMMUIdx_E20_2:
-     case ARMMMUIdx_E20_2_PAN:
-     case ARMMMUIdx_Stage2:
-+    case ARMMMUIdx_SE2:
-     case ARMMMUIdx_E2:
-         return 2;
-     case ARMMMUIdx_SE3:
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static int gt_phys_redir_timeridx(CPUARMState *env)
-     case ARMMMUIdx_E20_0:
-     case ARMMMUIdx_E20_2:
-     case ARMMMUIdx_E20_2_PAN:
-+    case ARMMMUIdx_SE20_0:
-+    case ARMMMUIdx_SE20_2:
-+    case ARMMMUIdx_SE20_2_PAN:
-         return GTIMER_HYP;
-     default:
-         return GTIMER_PHYS;
-@@ -XXX,XX +XXX,XX @@ static int gt_virt_redir_timeridx(CPUARMState *env)
-     case ARMMMUIdx_E20_0:
-     case ARMMMUIdx_E20_2:
-     case ARMMMUIdx_E20_2_PAN:
-+    case ARMMMUIdx_SE20_0:
-+    case ARMMMUIdx_SE20_2:
-+    case ARMMMUIdx_SE20_2_PAN:
-         return GTIMER_HYPVIRT;
-     default:
-         return GTIMER_VIRT;
-@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-             mmu_idx = ARMMMUIdx_SE3;
-             break;
-         case 2:
--            g_assert(!secure);  /* TODO: ARMv8.4-SecEL2 */
-+            g_assert(!secure);  /* ARMv8.4-SecEL2 is 64-bit only */
-             /* fall through */
-         case 1:
-             if (ri->crm == 9 && (env->uncached_cpsr & CPSR_PAN)) {
-@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
-             }
-             break;
-         case 4: /* AT S1E2R, AT S1E2W */
--            mmu_idx = ARMMMUIdx_E2;
-+            mmu_idx = secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2;
-             break;
-         case 6: /* AT S1E3R, AT S1E3W */
-             mmu_idx = ARMMMUIdx_SE3;
-@@ -XXX,XX +XXX,XX @@ static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
-      */
-     if (extract64(raw_read(env, ri) ^ value, 48, 16) &&
-         (arm_hcr_el2_eff(env) & HCR_E2H)) {
--        tlb_flush_by_mmuidx(env_cpu(env),
--                            ARMMMUIdxBit_E20_2 |
--                            ARMMMUIdxBit_E20_2_PAN |
--                            ARMMMUIdxBit_E20_0);
-+        uint16_t mask = ARMMMUIdxBit_E20_2 |
-+                        ARMMMUIdxBit_E20_2_PAN |
-+                        ARMMMUIdxBit_E20_0;
-+
-+        if (arm_is_secure_below_el3(env)) {
-+            mask >>= ARM_MMU_IDX_A_NS;
-+        }
-+
-+        tlb_flush_by_mmuidx(env_cpu(env), mask);
-     }
-     raw_write(env, ri, value);
- }
-@@ -XXX,XX +XXX,XX @@ static int vae1_tlbmask(CPUARMState *env)
-     uint64_t hcr = arm_hcr_el2_eff(env);
-     if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
--        return ARMMMUIdxBit_E20_2 |
--               ARMMMUIdxBit_E20_2_PAN |
--               ARMMMUIdxBit_E20_0;
-+        uint16_t mask = ARMMMUIdxBit_E20_2 |
-+                        ARMMMUIdxBit_E20_2_PAN |
-+                        ARMMMUIdxBit_E20_0;
-+
-+        if (arm_is_secure_below_el3(env)) {
-+            mask >>= ARM_MMU_IDX_A_NS;
-+        }
-+
-+        return mask;
-     } else if (arm_is_secure_below_el3(env)) {
-         return ARMMMUIdxBit_SE10_1 |
-                ARMMMUIdxBit_SE10_1_PAN |
-@@ -XXX,XX +XXX,XX @@ static int tlbbits_for_regime(CPUARMState *env, ARMMMUIdx mmu_idx,
- static int vae1_tlbbits(CPUARMState *env, uint64_t addr)
- {
-+    uint64_t hcr = arm_hcr_el2_eff(env);
-     ARMMMUIdx mmu_idx;
-     /* Only the regime of the mmu_idx below is significant. */
--    if (arm_is_secure_below_el3(env)) {
--        mmu_idx = ARMMMUIdx_SE10_0;
--    } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE))
--               == (HCR_E2H | HCR_TGE)) {
-+    if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
-         mmu_idx = ARMMMUIdx_E20_0;
-     } else {
-         mmu_idx = ARMMMUIdx_E10_0;
-     }
-+
-+    if (arm_is_secure_below_el3(env)) {
-+        mmu_idx &= ~ARM_MMU_IDX_A_NS;
-+    }
-+
-     return tlbbits_for_regime(env, mmu_idx, addr);
- }
-@@ -XXX,XX +XXX,XX @@ static int alle1_tlbmask(CPUARMState *env)
- static int e2_tlbmask(CPUARMState *env)
- {
--    /* TODO: ARMv8.4-SecEL2 */
--    return ARMMMUIdxBit_E20_0 |
--           ARMMMUIdxBit_E20_2 |
--           ARMMMUIdxBit_E20_2_PAN |
--           ARMMMUIdxBit_E2;
-+    if (arm_is_secure_below_el3(env)) {
-+        return ARMMMUIdxBit_SE20_0 |
-+               ARMMMUIdxBit_SE20_2 |
-+               ARMMMUIdxBit_SE20_2_PAN |
-+               ARMMMUIdxBit_SE2;
-+    } else {
-+        return ARMMMUIdxBit_E20_0 |
-+               ARMMMUIdxBit_E20_2 |
-+               ARMMMUIdxBit_E20_2_PAN |
-+               ARMMMUIdxBit_E2;
-+    }
- }
- static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
- {
-     CPUState *cs = env_cpu(env);
-     uint64_t pageaddr = sextract64(value << 12, 0, 56);
--    int bits = tlbbits_for_regime(env, ARMMMUIdx_E2, pageaddr);
-+    bool secure = arm_is_secure_below_el3(env);
-+    int mask = secure ? ARMMMUIdxBit_SE2 : ARMMMUIdxBit_E2;
-+    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_E2 : ARMMMUIdx_SE2,
-+                                  pageaddr);
--    tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr,
--                                                  ARMMMUIdxBit_E2, bits);
-+    tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
- }
- static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
-@@ -XXX,XX +XXX,XX @@ uint64_t arm_sctlr(CPUARMState *env, int el)
-     /* Only EL0 needs to be adjusted for EL1&0 or EL2&0. */
-     if (el == 0) {
-         ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0);
--        el = (mmu_idx == ARMMMUIdx_E20_0 ? 2 : 1);
-+        el = (mmu_idx == ARMMMUIdx_E20_0 || mmu_idx == ARMMMUIdx_SE20_0)
-+             ? 2 : 1;
-     }
-     return env->cp15.sctlr_el[el];
- }
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
-     switch (mmu_idx) {
-     case ARMMMUIdx_SE10_0:
-     case ARMMMUIdx_E20_0:
-+    case ARMMMUIdx_SE20_0:
-     case ARMMMUIdx_Stage1_E0:
-     case ARMMMUIdx_MUser:
-     case ARMMMUIdx_MSUser:
-@@ -XXX,XX +XXX,XX @@ int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_E10_0:
-     case ARMMMUIdx_E20_0:
-     case ARMMMUIdx_SE10_0:
-+    case ARMMMUIdx_SE20_0:
-         return 0;
-     case ARMMMUIdx_E10_1:
-     case ARMMMUIdx_E10_1_PAN:
-@@ -XXX,XX +XXX,XX @@ int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_E2:
-     case ARMMMUIdx_E20_2:
-     case ARMMMUIdx_E20_2_PAN:
-+    case ARMMMUIdx_SE2:
-+    case ARMMMUIdx_SE20_2:
-+    case ARMMMUIdx_SE20_2_PAN:
-         return 2;
-     case ARMMMUIdx_SE3:
-         return 3;
-@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
- ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
- {
-+    ARMMMUIdx idx;
-+    uint64_t hcr;
-+
-     if (arm_feature(env, ARM_FEATURE_M)) {
-         return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
-     }
-@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
-     /* See ARM pseudo-function ELIsInHost.  */
-     switch (el) {
-     case 0:
--        if (arm_is_secure_below_el3(env)) {
--            return ARMMMUIdx_SE10_0;
-+        hcr = arm_hcr_el2_eff(env);
-+        if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
-+            idx = ARMMMUIdx_E20_0;
-+        } else {
-+            idx = ARMMMUIdx_E10_0;
-         }
--        if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)
--            && arm_el_is_aa64(env, 2)) {
--            return ARMMMUIdx_E20_0;
--        }
--        return ARMMMUIdx_E10_0;
-+        break;
-     case 1:
--        if (arm_is_secure_below_el3(env)) {
--            if (env->pstate & PSTATE_PAN) {
--                return ARMMMUIdx_SE10_1_PAN;
--            }
--            return ARMMMUIdx_SE10_1;
--        }
-         if (env->pstate & PSTATE_PAN) {
--            return ARMMMUIdx_E10_1_PAN;
-+            idx = ARMMMUIdx_E10_1_PAN;
-+        } else {
-+            idx = ARMMMUIdx_E10_1;
-         }
--        return ARMMMUIdx_E10_1;
-+        break;
-     case 2:
--        /* TODO: ARMv8.4-SecEL2 */
-         /* Note that TGE does not apply at EL2.  */
--        if ((env->cp15.hcr_el2 & HCR_E2H) && arm_el_is_aa64(env, 2)) {
-+        if (arm_hcr_el2_eff(env) & HCR_E2H) {
-             if (env->pstate & PSTATE_PAN) {
--                return ARMMMUIdx_E20_2_PAN;
-+                idx = ARMMMUIdx_E20_2_PAN;
-+            } else {
-+                idx = ARMMMUIdx_E20_2;
-             }
--            return ARMMMUIdx_E20_2;
-+        } else {
-+            idx = ARMMMUIdx_E2;
-         }
--        return ARMMMUIdx_E2;
-+        break;
-     case 3:
-         return ARMMMUIdx_SE3;
-     default:
-         g_assert_not_reached();
-     }
-+
-+    if (arm_is_secure_below_el3(env)) {
-+        idx &= ~ARM_MMU_IDX_A_NS;
-+    }
-+
-+    return idx;
- }
- ARMMMUIdx arm_mmu_idx(CPUARMState *env)
-@@ -XXX,XX +XXX,XX @@ static uint32_t rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
-             break;
-         case ARMMMUIdx_E20_2:
-         case ARMMMUIdx_E20_2_PAN:
--            /* TODO: ARMv8.4-SecEL2 */
-+        case ARMMMUIdx_SE20_2:
-+        case ARMMMUIdx_SE20_2_PAN:
-             /*
-              * Note that EL20_2 is gated by HCR_EL2.E2H == 1, but EL20_0 is
-              * gated by HCR_EL2.<E2H,TGE> == '11', and so is LDTR.
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static int get_a64_user_mem_index(DisasContext *s)
-         case ARMMMUIdx_SE10_1_PAN:
-             useridx = ARMMMUIdx_SE10_0;
-             break;
-+        case ARMMMUIdx_SE20_2:
-+        case ARMMMUIdx_SE20_2_PAN:
-+            useridx = ARMMMUIdx_SE20_0;
-+            break;
-         default:
-             g_assert_not_reached();
-         }
---
-.20.1

-[PULL 12/33] target/arm: add ARMv8.4-SEL2 system registers
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-9-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h    |  7 +++++++
- target/arm/helper.c | 24 ++++++++++++++++++++++++
-files changed, 31 insertions(+)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
-     uint32_t base_mask;
- } TCR;
-+#define VTCR_NSW (1u << 29)
-+#define VTCR_NSA (1u << 30)
-+#define VSTCR_SW VTCR_NSW
-+#define VSTCR_SA VTCR_NSA
-+
- /* Define a maximum sized vector register.
-  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
-  * For 64-bit, this is a 2048-bit SVE register.
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
-             uint64_t ttbr1_el[4];
-         };
-         uint64_t vttbr_el2; /* Virtualization Translation Table Base.  */
-+        uint64_t vsttbr_el2; /* Secure Virtualization Translation Table. */
-         /* MMU translation table base control. */
-         TCR tcr_el[4];
-         TCR vtcr_el2; /* Virtualization Translation Control.  */
-+        TCR vstcr_el2; /* Secure Virtualization Translation Control. */
-         uint32_t c2_data; /* MPU data cacheable bits.  */
-         uint32_t c2_insn; /* MPU instruction cacheable bits.  */
-         union { /* MMU domain access control register
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
-     REGINFO_SENTINEL
- };
-+static CPAccessResult sel2_access(CPUARMState *env, const ARMCPRegInfo *ri,
-+                                  bool isread)
-+{
-+    if (arm_current_el(env) == 3 || arm_is_secure_below_el3(env)) {
-+        return CP_ACCESS_OK;
-+    }
-+    return CP_ACCESS_TRAP_UNCATEGORIZED;
-+}
-+
-+static const ARMCPRegInfo el2_sec_cp_reginfo[] = {
-+    { .name = "VSTTBR_EL2", .state = ARM_CP_STATE_AA64,
-+      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 0,
-+      .access = PL2_RW, .accessfn = sel2_access,
-+      .fieldoffset = offsetof(CPUARMState, cp15.vsttbr_el2) },
-+    { .name = "VSTCR_EL2", .state = ARM_CP_STATE_AA64,
-+      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 2,
-+      .access = PL2_RW, .accessfn = sel2_access,
-+      .fieldoffset = offsetof(CPUARMState, cp15.vstcr_el2) },
-+    REGINFO_SENTINEL
-+};
-+
- static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
-                                    bool isread)
- {
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-         if (arm_feature(env, ARM_FEATURE_V8)) {
-             define_arm_cp_regs(cpu, el2_v8_cp_reginfo);
-         }
-+        if (cpu_isar_feature(aa64_sel2, cpu)) {
-+            define_arm_cp_regs(cpu, el2_sec_cp_reginfo);
-+        }
-         /* RVBAR_EL2 is only implemented if EL2 is the highest EL */
-         if (!arm_feature(env, ARM_FEATURE_EL3)) {
-             ARMCPRegInfo rvbar = {
---
-.20.1

-[PULL 13/33] target/arm: handle VMID change in secure state
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-The VTTBR write callback so far assumes that the underlying VM lies in
-non-secure state. This handles the secure state scenario.
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-10-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 13 +++++++++----
-file changed, 9 insertions(+), 4 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-      * the combined stage 1&2 tlbs (EL10_1 and EL10_0).
-      */
-     if (raw_read(env, ri) != value) {
--        tlb_flush_by_mmuidx(cs,
--                            ARMMMUIdxBit_E10_1 |
--                            ARMMMUIdxBit_E10_1_PAN |
--                            ARMMMUIdxBit_E10_0);
-+        uint16_t mask = ARMMMUIdxBit_E10_1 |
-+                        ARMMMUIdxBit_E10_1_PAN |
-+                        ARMMMUIdxBit_E10_0;
-+
-+        if (arm_is_secure_below_el3(env)) {
-+            mask >>= ARM_MMU_IDX_A_NS;
-+        }
-+
-+        tlb_flush_by_mmuidx(cs, mask);
-         raw_write(env, ri, value);
-     }
- }
---
-.20.1

-[PULL 14/33] target/arm: do S1_ptw_translate() before address space lookup
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-In the secure stage 2 translation regime, the VSTCR.SW and VTCR.NSW
-bits can invert the secure flag for pagetable walks. This patchset
-allows S1_ptw_translate() to change the non-secure bit.
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-11-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 9 ++++++---
-file changed, 6 insertions(+), 3 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
- /* Translate a S1 pagetable walk through S2 if needed.  */
- static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
--                               hwaddr addr, MemTxAttrs txattrs,
-+                               hwaddr addr, bool *is_secure,
-                                ARMMMUFaultInfo *fi)
- {
-     if (arm_mmu_idx_is_stage1_of_2(mmu_idx) &&
-@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
-         int s2prot;
-         int ret;
-         ARMCacheAttrs cacheattrs = {};
-+        MemTxAttrs txattrs = {};
-+
-+        assert(!*is_secure); /* TODO: S-EL2 */
-         ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, ARMMMUIdx_Stage2,
-                                  false,
-@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
-     AddressSpace *as;
-     uint32_t data;
-+    addr = S1_ptw_translate(env, mmu_idx, addr, &is_secure, fi);
-     attrs.secure = is_secure;
-     as = arm_addressspace(cs, attrs);
--    addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
-     if (fi->s1ptw) {
-         return 0;
-     }
-@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
-     AddressSpace *as;
-     uint64_t data;
-+    addr = S1_ptw_translate(env, mmu_idx, addr, &is_secure, fi);
-     attrs.secure = is_secure;
-     as = arm_addressspace(cs, attrs);
--    addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
-     if (fi->s1ptw) {
-         return 0;
-     }
---
-.20.1

-[PULL 16/33] target/arm: generalize 2-stage page-walk condition
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-The stage_1_mmu_idx() already effectively keeps track of which
-translation regimes have two stages. Don't hard-code another test.
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-13-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 13 ++++++-------
-file changed, 6 insertions(+), 7 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-                    target_ulong *page_size,
-                    ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
- {
--    if (mmu_idx == ARMMMUIdx_E10_0 ||
--        mmu_idx == ARMMMUIdx_E10_1 ||
--        mmu_idx == ARMMMUIdx_E10_1_PAN) {
-+    ARMMMUIdx s1_mmu_idx = stage_1_mmu_idx(mmu_idx);
-+
-+    if (mmu_idx != s1_mmu_idx) {
-         /* Call ourselves recursively to do the stage 1 and then stage 2
--         * translations.
-+         * translations if mmu_idx is a two-stage regime.
-          */
-         if (arm_feature(env, ARM_FEATURE_EL2)) {
-             hwaddr ipa;
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-             int ret;
-             ARMCacheAttrs cacheattrs2 = {};
--            ret = get_phys_addr(env, address, access_type,
--                                stage_1_mmu_idx(mmu_idx), &ipa, attrs,
--                                prot, page_size, fi, cacheattrs);
-+            ret = get_phys_addr(env, address, access_type, s1_mmu_idx, &ipa,
-+                                attrs, prot, page_size, fi, cacheattrs);
-             /* If S1 fails or S2 is disabled, return early.  */
-             if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2)) {
---
-.20.1

-[PULL 17/33] target/arm: secure stage 2 translation regime
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-14-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h       |  6 +++-
- target/arm/internals.h | 22 ++++++++++++
- target/arm/helper.c    | 78 +++++++++++++++++++++++++++++-------------
-files changed, 81 insertions(+), 25 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
-     ARMMMUIdx_Stage1_E0 = 0 | ARM_MMU_IDX_NOTLB,
-     ARMMMUIdx_Stage1_E1 = 1 | ARM_MMU_IDX_NOTLB,
-     ARMMMUIdx_Stage1_E1_PAN = 2 | ARM_MMU_IDX_NOTLB,
-+    ARMMMUIdx_Stage1_SE0 = 3 | ARM_MMU_IDX_NOTLB,
-+    ARMMMUIdx_Stage1_SE1 = 4 | ARM_MMU_IDX_NOTLB,
-+    ARMMMUIdx_Stage1_SE1_PAN = 5 | ARM_MMU_IDX_NOTLB,
-     /*
-      * Not allocated a TLB: used only for second stage of an S12 page
-      * table walk, or for descriptor loads during first stage of an S1
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
-      * then various TLB flush insns which currently are no-ops or flush
-      * only stage 1 MMU indexes will need to change to flush stage 2.
-      */
--    ARMMMUIdx_Stage2     = 3 | ARM_MMU_IDX_NOTLB,
-+    ARMMMUIdx_Stage2     = 6 | ARM_MMU_IDX_NOTLB,
-+    ARMMMUIdx_Stage2_S   = 7 | ARM_MMU_IDX_NOTLB,
-     /*
-      * M-profile.
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_has_2_ranges(ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_Stage1_E0:
-     case ARMMMUIdx_Stage1_E1:
-     case ARMMMUIdx_Stage1_E1_PAN:
-+    case ARMMMUIdx_Stage1_SE0:
-+    case ARMMMUIdx_Stage1_SE1:
-+    case ARMMMUIdx_Stage1_SE1_PAN:
-     case ARMMMUIdx_E10_0:
-     case ARMMMUIdx_E10_1:
-     case ARMMMUIdx_E10_1_PAN:
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_SE20_0:
-     case ARMMMUIdx_SE20_2:
-     case ARMMMUIdx_SE20_2_PAN:
-+    case ARMMMUIdx_Stage1_SE0:
-+    case ARMMMUIdx_Stage1_SE1:
-+    case ARMMMUIdx_Stage1_SE1_PAN:
-     case ARMMMUIdx_SE2:
-+    case ARMMMUIdx_Stage2_S:
-     case ARMMMUIdx_MSPrivNegPri:
-     case ARMMMUIdx_MSUserNegPri:
-     case ARMMMUIdx_MSPriv:
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
- {
-     switch (mmu_idx) {
-     case ARMMMUIdx_Stage1_E1_PAN:
-+    case ARMMMUIdx_Stage1_SE1_PAN:
-     case ARMMMUIdx_E10_1_PAN:
-     case ARMMMUIdx_E20_2_PAN:
-     case ARMMMUIdx_SE10_1_PAN:
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_E20_2:
-     case ARMMMUIdx_E20_2_PAN:
-     case ARMMMUIdx_Stage2:
-+    case ARMMMUIdx_Stage2_S:
-     case ARMMMUIdx_SE2:
-     case ARMMMUIdx_E2:
-         return 2;
-     case ARMMMUIdx_SE3:
-         return 3;
-     case ARMMMUIdx_SE10_0:
-+    case ARMMMUIdx_Stage1_SE0:
-         return arm_el_is_aa64(env, 3) ? 1 : 3;
-     case ARMMMUIdx_SE10_1:
-     case ARMMMUIdx_SE10_1_PAN:
-     case ARMMMUIdx_Stage1_E0:
-     case ARMMMUIdx_Stage1_E1:
-     case ARMMMUIdx_Stage1_E1_PAN:
-+    case ARMMMUIdx_Stage1_SE1:
-+    case ARMMMUIdx_Stage1_SE1_PAN:
-     case ARMMMUIdx_E10_0:
-     case ARMMMUIdx_E10_1:
-     case ARMMMUIdx_E10_1_PAN:
-@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
-     if (mmu_idx == ARMMMUIdx_Stage2) {
-         return &env->cp15.vtcr_el2;
-     }
-+    if (mmu_idx == ARMMMUIdx_Stage2_S) {
-+        /*
-+         * Note: Secure stage 2 nominally shares fields from VTCR_EL2, but
-+         * those are not currently used by QEMU, so just return VSTCR_EL2.
-+         */
-+        return &env->cp15.vstcr_el2;
-+    }
-     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
- }
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_mmu_idx_is_stage1_of_2(ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_Stage1_E0:
-     case ARMMMUIdx_Stage1_E1:
-     case ARMMMUIdx_Stage1_E1_PAN:
-+    case ARMMMUIdx_Stage1_SE0:
-+    case ARMMMUIdx_Stage1_SE1:
-+    case ARMMMUIdx_Stage1_SE1_PAN:
-         return true;
-     default:
-         return false;
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
-         uint32_t syn, fsr, fsc;
-         bool take_exc = false;
--        if (fi.s1ptw && current_el == 1 && !arm_is_secure(env)
-+        if (fi.s1ptw && current_el == 1
-             && arm_mmu_idx_is_stage1_of_2(mmu_idx)) {
-             /*
-              * Synchronous stage 2 fault on an access made as part of the
-@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-             /* fall through */
-         case 1:
-             if (ri->crm == 9 && (env->uncached_cpsr & CPSR_PAN)) {
--                mmu_idx = (secure ? ARMMMUIdx_SE10_1_PAN
-+                mmu_idx = (secure ? ARMMMUIdx_Stage1_SE1_PAN
-                            : ARMMMUIdx_Stage1_E1_PAN);
-             } else {
--                mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_Stage1_E1;
-+                mmu_idx = secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1;
-             }
-             break;
-         default:
-@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-             mmu_idx = ARMMMUIdx_SE10_0;
-             break;
-         case 2:
-+            g_assert(!secure);  /* ARMv8.4-SecEL2 is 64-bit only */
-             mmu_idx = ARMMMUIdx_Stage1_E0;
-             break;
-         case 1:
--            mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_Stage1_E0;
-+            mmu_idx = secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0;
-             break;
-         default:
-             g_assert_not_reached();
-@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
-         switch (ri->opc1) {
-         case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */
-             if (ri->crm == 9 && (env->pstate & PSTATE_PAN)) {
--                mmu_idx = (secure ? ARMMMUIdx_SE10_1_PAN
-+                mmu_idx = (secure ? ARMMMUIdx_Stage1_SE1_PAN
-                            : ARMMMUIdx_Stage1_E1_PAN);
-             } else {
--                mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_Stage1_E1;
-+                mmu_idx = secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1;
-             }
-             break;
-         case 4: /* AT S1E2R, AT S1E2W */
-@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
-         }
-         break;
-     case 2: /* AT S1E0R, AT S1E0W */
--        mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_Stage1_E0;
-+        mmu_idx = secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0;
-         break;
-     case 4: /* AT S12E1R, AT S12E1W */
-         mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_E10_1;
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_translation_disabled(CPUARMState *env,
-     hcr_el2 = arm_hcr_el2_eff(env);
--    if (mmu_idx == ARMMMUIdx_Stage2) {
-+    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
-         /* HCR.DC means HCR.VM behaves as 1 */
-         return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
-     }
-@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
-     if (mmu_idx == ARMMMUIdx_Stage2) {
-         return env->cp15.vttbr_el2;
-     }
-+    if (mmu_idx == ARMMMUIdx_Stage2_S) {
-+        return env->cp15.vsttbr_el2;
-+    }
-     if (ttbrn == 0) {
-         return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
-     } else {
-@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
- static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
- {
-     switch (mmu_idx) {
-+    case ARMMMUIdx_SE10_0:
-+        return ARMMMUIdx_Stage1_SE0;
-+    case ARMMMUIdx_SE10_1:
-+        return ARMMMUIdx_Stage1_SE1;
-+    case ARMMMUIdx_SE10_1_PAN:
-+        return ARMMMUIdx_Stage1_SE1_PAN;
-     case ARMMMUIdx_E10_0:
-         return ARMMMUIdx_Stage1_E0;
-     case ARMMMUIdx_E10_1:
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
-     case ARMMMUIdx_E20_0:
-     case ARMMMUIdx_SE20_0:
-     case ARMMMUIdx_Stage1_E0:
-+    case ARMMMUIdx_Stage1_SE0:
-     case ARMMMUIdx_MUser:
-     case ARMMMUIdx_MSUser:
-     case ARMMMUIdx_MUserNegPri:
-@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
-     int wxn = 0;
-     assert(mmu_idx != ARMMMUIdx_Stage2);
-+    assert(mmu_idx != ARMMMUIdx_Stage2_S);
-     user_rw = simple_ap_to_rw_prot_is_user(ap, true);
-     if (is_user) {
-@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
-         hwaddr s2pa;
-         int s2prot;
-         int ret;
-+        ARMMMUIdx s2_mmu_idx = *is_secure ? ARMMMUIdx_Stage2_S
-+                                          : ARMMMUIdx_Stage2;
-         ARMCacheAttrs cacheattrs = {};
-         MemTxAttrs txattrs = {};
--        assert(!*is_secure); /* TODO: S-EL2 */
--
--        ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, ARMMMUIdx_Stage2,
--                                 false,
-+        ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, s2_mmu_idx, false,
-                                  &s2pa, &txattrs, &s2prot, &s2size, fi,
-                                  &cacheattrs);
-         if (ret) {
-@@ -XXX,XX +XXX,XX @@ static int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx)
- {
-     if (regime_has_2_ranges(mmu_idx)) {
-         return extract64(tcr, 37, 2);
--    } else if (mmu_idx == ARMMMUIdx_Stage2) {
-+    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
-         return 0; /* VTCR_EL2 */
-     } else {
-         /* Replicate the single TBI bit so we always have 2 bits.  */
-@@ -XXX,XX +XXX,XX @@ static int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx)
- {
-     if (regime_has_2_ranges(mmu_idx)) {
-         return extract64(tcr, 51, 2);
--    } else if (mmu_idx == ARMMMUIdx_Stage2) {
-+    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
-         return 0; /* VTCR_EL2 */
-     } else {
-         /* Replicate the single TBID bit so we always have 2 bits.  */
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-         tsz = extract32(tcr, 0, 6);
-         using64k = extract32(tcr, 14, 1);
-         using16k = extract32(tcr, 15, 1);
--        if (mmu_idx == ARMMMUIdx_Stage2) {
-+        if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
-             /* VTCR_EL2 */
-             hpd = false;
-         } else {
-@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
-     int select, tsz;
-     bool epd, hpd;
-+    assert(mmu_idx != ARMMMUIdx_Stage2_S);
-+
-     if (mmu_idx == ARMMMUIdx_Stage2) {
-         /* VTCR */
-         bool sext = extract32(tcr, 4, 1);
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
-         goto do_fault;
-     }
--    if (mmu_idx != ARMMMUIdx_Stage2) {
-+    if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
-         /* The starting level depends on the virtual address size (which can
-          * be up to 48 bits) and the translation granule size. It indicates
-          * the number of strides (stride bits at a time) needed to
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
-         attrs = extract64(descriptor, 2, 10)
-             | (extract64(descriptor, 52, 12) << 10);
--        if (mmu_idx == ARMMMUIdx_Stage2) {
-+        if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
-             /* Stage 2 table descriptors do not include any attribute fields */
-             break;
-         }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
-     ap = extract32(attrs, 4, 2);
--    if (mmu_idx == ARMMMUIdx_Stage2) {
--        ns = true;
-+    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
-+        ns = mmu_idx == ARMMMUIdx_Stage2;
-         xn = extract32(attrs, 11, 2);
-         *prot = get_S2prot(env, ap, xn, s1_is_el0);
-     } else {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
-         arm_tlb_bti_gp(txattrs) = true;
-     }
--    if (mmu_idx == ARMMMUIdx_Stage2) {
-+    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
-         cacheattrs->attrs = convert_stage2_attrs(env, extract32(attrs, 0, 4));
-     } else {
-         /* Index into MAIR registers for cache attributes */
-@@ -XXX,XX +XXX,XX @@ do_fault:
-     fi->type = fault_type;
-     fi->level = level;
-     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
--    fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2);
-+    fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2 ||
-+                               mmu_idx == ARMMMUIdx_Stage2_S);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-             int s2_prot;
-             int ret;
-             ARMCacheAttrs cacheattrs2 = {};
-+            ARMMMUIdx s2_mmu_idx;
-+            bool is_el0;
-             ret = get_phys_addr(env, address, access_type, s1_mmu_idx, &ipa,
-                                 attrs, prot, page_size, fi, cacheattrs);
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-                 return ret;
-             }
-+            s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
-+            is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
-+
-             /* S1 is done. Now do S2 translation.  */
--            ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_Stage2,
--                                     mmu_idx == ARMMMUIdx_E10_0,
-+            ret = get_phys_addr_lpae(env, ipa, access_type, s2_mmu_idx, is_el0,
-                                      phys_ptr, attrs, &s2_prot,
-                                      page_size, fi, &cacheattrs2);
-             fi->s2addr = ipa;
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-                 cacheattrs->shareability = 0;
-             }
-             *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
-+
-+            /* Check if IPA translates to secure or non-secure PA space. */
-+            if (arm_is_secure_below_el3(env)) {
-+                if (attrs->secure) {
-+                    attrs->secure =
-+                        !(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));
-+                } else {
-+                    attrs->secure =
-+                        !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
-+                        || (env->cp15.vstcr_el2.raw_tcr & VSTCR_SA));
-+                }
-+            }
-             return 0;
-         } else {
-             /*
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
-          * MMU disabled.  S1 addresses within aa64 translation regimes are
-          * still checked for bounds -- see AArch64.TranslateAddressS1Off.
-          */
--        if (mmu_idx != ARMMMUIdx_Stage2) {
-+        if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
-             int r_el = regime_el(env, mmu_idx);
-             if (arm_el_is_aa64(env, r_el)) {
-                 int pamax = arm_pamax(env_archcpu(env));
---
-.20.1

-[PULL 19/33] target/arm: revector to run-time pick target EL
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-On ARMv8-A, accesses by 32-bit secure EL1 to monitor registers trap to
-the upper (64-bit) EL. With Secure EL2 support, we can no longer assume
-that that is always EL3, so make room for the value to be computed at
-run-time.
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-16-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate.c | 23 +++++++++++++++++++++--
-file changed, 21 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void unallocated_encoding(DisasContext *s)
-                        default_exception_el(s));
- }
-+static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
-+                             TCGv_i32 tcg_el)
-+{
-+    TCGv_i32 tcg_excp;
-+    TCGv_i32 tcg_syn;
-+
-+    gen_set_condexec(s);
-+    gen_set_pc_im(s, s->pc_curr);
-+    tcg_excp = tcg_const_i32(excp);
-+    tcg_syn = tcg_const_i32(syn);
-+    gen_helper_exception_with_syndrome(cpu_env, tcg_excp, tcg_syn, tcg_el);
-+    tcg_temp_free_i32(tcg_syn);
-+    tcg_temp_free_i32(tcg_excp);
-+    s->base.is_jmp = DISAS_NORETURN;
-+}
-+
- /* Force a TB lookup after an instruction that changes the CPU state.  */
- static inline void gen_lookup_tb(DisasContext *s)
- {
-@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
-             /* If we're in Secure EL1 (which implies that EL3 is AArch64)
-              * then accesses to Mon registers trap to EL3
-              */
--            exc_target = 3;
--            goto undef;
-+            TCGv_i32 tcg_el = tcg_const_i32(3);
-+
-+            gen_exception_el(s, EXCP_UDEF, syn_uncategorized(), tcg_el);
-+            tcg_temp_free_i32(tcg_el);
-+            return false;
-         }
-         break;
-     case ARM_CPU_MODE_HYP:
---
-.20.1

-[PULL 21/33] target/arm: enable Secure EL2 in max CPU
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-18-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu64.c | 1 +
-file changed, 1 insertion(+)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-         t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-         t = FIELD_DP64(t, ID_AA64PFR0, FP, 1);
-         t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 1);
-+        t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1);
-         cpu->isar.id_aa64pfr0 = t;
-         t = cpu->isar.id_aa64pfr1;
---
-.20.1

-[PULL 22/33] target/arm: refactor vae1_tlbmask()
+Deleted patch
-From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210112104511.36576-19-remi.denis.courmont@huawei.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 25 +++++++++++--------------
-file changed, 11 insertions(+), 14 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult aa64_cacheop_pou_access(CPUARMState *env,
- static int vae1_tlbmask(CPUARMState *env)
- {
-     uint64_t hcr = arm_hcr_el2_eff(env);
-+    uint16_t mask;
-     if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
--        uint16_t mask = ARMMMUIdxBit_E20_2 |
--                        ARMMMUIdxBit_E20_2_PAN |
--                        ARMMMUIdxBit_E20_0;
--
--        if (arm_is_secure_below_el3(env)) {
--            mask >>= ARM_MMU_IDX_A_NS;
--        }
--
--        return mask;
--    } else if (arm_is_secure_below_el3(env)) {
--        return ARMMMUIdxBit_SE10_1 |
--               ARMMMUIdxBit_SE10_1_PAN |
--               ARMMMUIdxBit_SE10_0;
-+        mask = ARMMMUIdxBit_E20_2 |
-+               ARMMMUIdxBit_E20_2_PAN |
-+               ARMMMUIdxBit_E20_0;
-     } else {
--        return ARMMMUIdxBit_E10_1 |
-+        mask = ARMMMUIdxBit_E10_1 |
-                ARMMMUIdxBit_E10_1_PAN |
-                ARMMMUIdxBit_E10_0;
-     }
-+
-+    if (arm_is_secure_below_el3(env)) {
-+        mask >>= ARM_MMU_IDX_A_NS;
-+    }
-+
-+    return mask;
- }
- /* Return 56 if TBI is enabled, 64 otherwise. */
---
-.20.1

-[PULL 23/33] target/arm: Introduce PREDDESC field definitions
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-SVE predicate operations cannot use the "usual" simd_desc
-encoding, because the lengths are not a multiple of 8.
-But we were abusing the SIMD_* fields to store values anyway.
-This abuse broke when SIMD_OPRSZ_BITS was modified in e2e7168a214.
-Introduce a new set of field definitions for exclusive use
-of predicates, so that it is obvious what kind of predicate
-we are manipulating.  To be used in future patches.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210113062650.593824-2-richard.henderson@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/internals.h | 9 +++++++++
-file changed, 9 insertions(+)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ void arm_log_exception(int idx);
- #define LOG2_TAG_GRANULE 4
- #define TAG_GRANULE      (1 << LOG2_TAG_GRANULE)
-+/*
-+ * SVE predicates are 1/8 the size of SVE vectors, and cannot use
-+ * the same simd_desc() encoding due to restrictions on size.
-+ * Use these instead.
-+ */
-+FIELD(PREDDESC, OPRSZ, 0, 6)
-+FIELD(PREDDESC, ESZ, 6, 2)
-+FIELD(PREDDESC, DATA, 8, 24)
-+
- /*
-  * The SVE simd_data field, for memory ops, contains either
-  * rd (5 bits) or a shift count (2 bits).
---
-.20.1

-[PULL 31/33] npcm7xx_adc-test: Fix memleak in adc_qom_set
+[PULL 11/17] MAINTAINERS: Fix status for Arm boards I "maintain"
-From: Gan Qixin <ganqixin@huawei.com>
+I'm down as the only listed maintainer for quite a lot of Arm SoC and
 board types.  In some cases this is only as the "maintainer of last
 resort" and I'm not in practice doing anything beyond patch review
 and the odd bit of tidyup.
-The adc_qom_set function didn't free "response", which caused an indirect
+Move these entries in MAINTAINERS from "Maintained" to "Odd Fixes",
-memory leak. So use qobject_unref() to fix it.
+to better represent reality.  Entries for other boards and SoCs where
 I do more actively care (or where there is a listed co-maintainer)
 remain as they are.
-ASAN shows memory leak stack:
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20250307152838.3226398-1-peter.maydell@linaro.org
 ---
  MAINTAINERS | 14 +++++++-------
 file changed, 7 insertions(+), 7 deletions(-)
-Indirect leak of 593280 byte(s) in 144 object(s) allocated from:
+diff --git a/MAINTAINERS b/MAINTAINERS
     #0 0x7f9a5e7e8d4e in __interceptor_calloc (/lib64/libasan.so.5+0x112d4e)
     #1 0x7f9a5e607a50 in g_malloc0 (/lib64/libglib-2.0.so.0+0x55a50)
     #2 0x55b1bebf636b in qdict_new ../qobject/qdict.c:30
     #3 0x55b1bec09699 in parse_object ../qobject/json-parser.c:318
     #4 0x55b1bec0b2df in parse_value ../qobject/json-parser.c:546
     #5 0x55b1bec0b6a9 in json_parser_parse ../qobject/json-parser.c:580
     #6 0x55b1bec060d1 in json_message_process_token ../qobject/json-streamer.c:92
     #7 0x55b1bec16a12 in json_lexer_feed_char ../qobject/json-lexer.c:313
     #8 0x55b1bec16fbd in json_lexer_feed ../qobject/json-lexer.c:350
     #9 0x55b1bec06453 in json_message_parser_feed ../qobject/json-streamer.c:121
     #10 0x55b1bebc2d51 in qmp_fd_receive ../tests/qtest/libqtest.c:614
     #11 0x55b1bebc2f5e in qtest_qmp_receive_dict ../tests/qtest/libqtest.c:636
     #12 0x55b1bebc2e6c in qtest_qmp_receive ../tests/qtest/libqtest.c:624
     #13 0x55b1bebc3340 in qtest_vqmp ../tests/qtest/libqtest.c:715
     #14 0x55b1bebc3942 in qtest_qmp ../tests/qtest/libqtest.c:756
     #15 0x55b1bebbd64a in adc_qom_set ../tests/qtest/npcm7xx_adc-test.c:127
     #16 0x55b1bebbd793 in adc_write_input ../tests/qtest/npcm7xx_adc-test.c:140
     #17 0x55b1bebbdf92 in test_convert_external ../tests/qtest/npcm7xx_adc-test.c:246
 Reported-by: Euler Robot <euler.robot@huawei.com>
 Signed-off-by: Gan Qixin <ganqixin@huawei.com>
 Reviewed-by: Hao Wu <wuhaotsh@google.com>
 Message-id: 20210118065627.79903-1-ganqixin@huawei.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  tests/qtest/npcm7xx_adc-test.c | 1 +
 file changed, 1 insertion(+)
 diff --git a/tests/qtest/npcm7xx_adc-test.c b/tests/qtest/npcm7xx_adc-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/npcm7xx_adc-test.c
+--- a/MAINTAINERS
-+++ b/tests/qtest/npcm7xx_adc-test.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ static void adc_qom_set(QTestState *qts, const ADC *adc,
+@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/kzm.rst
-             path, name, value);
+ Integrator CP
-     /* The qom set message returns successfully. */
+ M: Peter Maydell <peter.maydell@linaro.org>
-     g_assert_true(qdict_haskey(response, "return"));
+ L: qemu-arm@nongnu.org
-+    qobject_unref(response);
+-S: Maintained
- }
++S: Odd Fixes
+ F: hw/arm/integratorcp.c
- static void adc_write_input(QTestState *qts, const ADC *adc,
+ F: hw/misc/arm_integrator_debug.c
  F: include/hw/misc/arm_integrator_debug.h
@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/mps2.rst
  Musca
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/musca.c
  F: docs/system/arm/musca.rst
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_aarch64_raspi4.py
  Real View
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/realview*
  F: hw/cpu/realview_mpcore.c
  F: hw/intc/realview_gic.c
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_arm_collie.py
  Stellaris
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/*/stellaris*
  F: hw/display/ssd03*
  F: include/hw/input/gamepad.h
@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/stm32.rst
  Versatile Express
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/vexpress.c
  F: hw/display/sii9022.c
  F: docs/system/arm/vexpress.rst
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_arm_vexpress.py
  Versatile PB
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/*/versatile*
  F: hw/i2c/arm_sbcon_i2c.c
  F: include/hw/i2c/arm_sbcon_i2c.h
@@ -XXX,XX +XXX,XX @@ F: include/hw/hyperv/vmbus*.h
  OMAP
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/*/omap*
  F: include/hw/arm/omap.h
  F: docs/system/arm/sx1.rst
 --
-.20.1
+.43.0

-[PULL 29/33] pvpanic : update pvpanic spec document
+[PULL 13/17] Revert "hw/char/pl011: Warn when using disabled receiver"
-From: Mihai Carabas <mihai.carabas@oracle.com>
+From: Paolo Bonzini <pbonzini@redhat.com>
-Add pvpanic PCI device support details in docs/specs/pvpanic.txt.
+The guest does not control whether characters are sent on the UART.
 Sending them before the guest happens to boot will now result in a
 "guest error" log entry that is only because of timing, even if the
 guest _would_ later setup the receiver correctly.
-Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
+This reverts the bulk of commit abf2b6a028670bd2890bb3aee7e103fe53e4b0df,
-[fixed s/device/bus/ error]
+and instead adds a comment about why we don't check the enable bits.
 Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Message-id: 20250311153717.206129-1-pbonzini@redhat.com
 [PMM: expanded comment]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/specs/pvpanic.txt | 13 ++++++++++++-
+ hw/char/pl011.c | 19 ++++++++++---------
-file changed, 12 insertions(+), 1 deletion(-)
+file changed, 10 insertions(+), 9 deletions(-)
-diff --git a/docs/specs/pvpanic.txt b/docs/specs/pvpanic.txt
+diff --git a/hw/char/pl011.c b/hw/char/pl011.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/specs/pvpanic.txt
+--- a/hw/char/pl011.c
-+++ b/docs/specs/pvpanic.txt
++++ b/hw/char/pl011.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static int pl011_can_receive(void *opaque)
- PVPANIC DEVICE
+     unsigned fifo_depth = pl011_get_fifo_depth(s);
- ==============
+     unsigned fifo_available = fifo_depth - s->read_count;
--pvpanic device is a simulated ISA device, through which a guest panic
+-    if (!(s->cr & CR_UARTEN)) {
-+pvpanic device is a simulated device, through which a guest panic
+-        qemu_log_mask(LOG_GUEST_ERROR,
- event is sent to qemu, and a QMP event is generated. This allows
+-                      "PL011 receiving data on disabled UART\n");
- management apps (e.g. libvirt) to be notified and respond to the event.
+-    }
+-    if (!(s->cr & CR_RXE)) {
-@@ -XXX,XX +XXX,XX @@ The management app has the option of waiting for GUEST_PANICKED events,
+-        qemu_log_mask(LOG_GUEST_ERROR,
- and/or polling for guest-panicked RunState, to learn when the pvpanic
+-                      "PL011 receiving data on disabled RX UART\n");
- device has fired a panic event.
+-    }
+-    trace_pl011_can_receive(s->lcr, s->read_count, fifo_depth, fifo_available);
-+The pvpanic device can be implemented as an ISA device (using IOPORT) or as a
++    /*
-+PCI device.
++     * In theory we should check the UART and RX enable bits here and
-+
++     * return 0 if they are not set (so the guest can't receive data
- ISA Interface
++     * until you have enabled the UART). In practice we suspect there
- -------------
++     * is at least some guest code out there which has been tested only
++     * on QEMU and which never bothers to enable the UART because we
-@@ -XXX,XX +XXX,XX @@ bit 1: a guest panic has happened and will be handled by the guest;
++     * historically never enforced that. So we effectively keep the
-        the host should record it or report it, but should not affect
++     * UART continuously enabled regardless of the enable bits.
-        the execution of the guest.
++     */
-+PCI Interface
++    trace_pl011_can_receive(s->lcr, s->read_count, fifo_depth, fifo_available);
-+-------------
+     return fifo_available;
-+
+ }
 +The PCI interface is similar to the ISA interface except that it uses an MMIO
 +address space provided by its BAR0, 1 byte long. Any machine with a PCI bus
 +can enable a pvpanic device by adding '-device pvpanic-pci' to the command
 +line.
 +
  ACPI Interface
  --------------
 --
-.20.1
+.43.0

-[PULL 26/33] target/arm: Update REV, PUNPK for pred_desc
+[PULL 14/17] util/cacheflush: Make first DSB unconditional on aarch64
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Joe Komlodi <komlodi@google.com>
-Update all users of do_perm_pred2 for the new
+On ARM hosts with CTR_EL0.DIC and CTR_EL0.IDC set, this would only cause
-predicate descriptor field definitions.
+an ISB to be executed during cache maintenance, which could lead to QEMU
 executing TBs containing garbage instructions.
 This seems to be because the ISB finishes executing instructions and
 flushes the pipeline, but the ISB doesn't guarantee that writes from the
 executed instructions are committed. If a small enough TB is created, it's
 possible that the writes setting up the TB aren't committed by the time the
 TB is executed.
 This function is intended to be a port of the gcc implementation
 (https://github.com/gcc-mirror/gcc/blob/85b46d0795ac76bc192cb8f88b646a647acf98c1/libgcc/config/aarch64/sync-cache.c#L67)
 which makes the first DSB unconditional, so we can fix the synchronization
 issue by doing that as well.
 Cc: qemu-stable@nongnu.org
-Buglink: https://bugs.launchpad.net/bugs/1908551
+Fixes: 664a79735e4deb1 ("util: Specialize flush_idcache_range for aarch64")
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Joe Komlodi <komlodi@google.com>
-Message-id: 20210113062650.593824-5-richard.henderson@linaro.org
+Message-id: 20250310203622.1827940-2-komlodi@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c    |  8 ++++----
+ util/cacheflush.c | 4 +++-
- target/arm/translate-sve.c | 13 ++++---------
+file changed, 3 insertions(+), 1 deletion(-)
 files changed, 8 insertions(+), 13 deletions(-)
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+diff --git a/util/cacheflush.c b/util/cacheflush.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/sve_helper.c
+--- a/util/cacheflush.c
-+++ b/target/arm/sve_helper.c
++++ b/util/cacheflush.c
-@@ -XXX,XX +XXX,XX @@ static uint8_t reverse_bits_8(uint8_t x, int n)
+@@ -XXX,XX +XXX,XX @@ void flush_idcache_range(uintptr_t rx, uintptr_t rw, size_t len)
+         for (p = rw & -dcache_lsize; p < rw + len; p += dcache_lsize) {
- void HELPER(sve_rev_p)(void *vd, void *vn, uint32_t pred_desc)
+             asm volatile("dc\tcvau, %0" : : "r" (p) : "memory");
- {
+         }
--    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+-        asm volatile("dsb\tish" : : : "memory");
--    int esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
+     }
-+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
-+    int esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
++    /* DSB unconditionally to ensure any outstanding writes are committed. */
-     intptr_t i, oprsz_2 = oprsz / 2;
++    asm volatile("dsb\tish" : : : "memory");
++
-     if (oprsz <= 8) {
+     /*
-@@ -XXX,XX +XXX,XX @@ void HELPER(sve_rev_p)(void *vd, void *vn, uint32_t pred_desc)
+      * If CTR_EL0.DIC is enabled, Instruction cache cleaning to the Point
+      * of Unification is not required for instruction to data coherence.
  void HELPER(sve_punpk_p)(void *vd, void *vn, uint32_t pred_desc)
  {
 -    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
 -    intptr_t high = extract32(pred_desc, SIMD_DATA_SHIFT + 2, 1);
 +    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
 +    intptr_t high = FIELD_EX32(pred_desc, PREDDESC, DATA);
      uint64_t *d = vd;
      intptr_t i;
 diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-sve.c
 +++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool do_perm_pred2(DisasContext *s, arg_rr_esz *a, bool high_odd,
      TCGv_ptr t_d = tcg_temp_new_ptr();
      TCGv_ptr t_n = tcg_temp_new_ptr();
      TCGv_i32 t_desc;
 -    int desc;
 +    uint32_t desc = 0;
      tcg_gen_addi_ptr(t_d, cpu_env, pred_full_reg_offset(s, a->rd));
      tcg_gen_addi_ptr(t_n, cpu_env, pred_full_reg_offset(s, a->rn));
 -    /* Predicate sizes may be smaller and cannot use simd_desc.
 -       We cannot round up, as we do elsewhere, because we need
 -       the exact size for ZIP2 and REV.  We retain the style for
 -       the other helpers for consistency.  */
 -
 -    desc = vsz - 2;
 -    desc = deposit32(desc, SIMD_DATA_SHIFT, 2, a->esz);
 -    desc = deposit32(desc, SIMD_DATA_SHIFT + 2, 2, high_odd);
 +    desc = FIELD_DP32(desc, PREDDESC, OPRSZ, vsz);
 +    desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
 +    desc = FIELD_DP32(desc, PREDDESC, DATA, high_odd);
      t_desc = tcg_const_i32(desc);
      fn(t_d, t_n, t_desc);
 --
-.20.1
+.43.0

-[PULL 25/33] target/arm: Update ZIP, UZP, TRN for pred_desc
+[PULL 15/17] target/arm: Make DisasContext.{fp, sve}_access_checked tristate
 From: Richard Henderson <richard.henderson@linaro.org>
-Update all users of do_perm_pred3 for the new
+The check for fp_excp_el in assert_fp_access_checked is
-predicate descriptor field definitions.
+incorrect.  For SME, with StreamingMode enabled, the access
 is really against the streaming mode vectors, and access
 to the normal fp registers is allowed to be disabled.
 C.f. sme_enabled_check.
 Convert sve_access_checked to match, even though we don't
 currently check the exception state.
 Cc: qemu-stable@nongnu.org
+Fixes: 3d74825f4d6 ("target/arm: Add SME enablement checks")
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210113062650.593824-4-richard.henderson@linaro.org
+Message-id: 20250307190415.982049-2-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c    | 18 +++++++++---------
+ target/arm/tcg/translate-a64.h |  2 +-
- target/arm/translate-sve.c | 12 ++++--------
+ target/arm/tcg/translate.h     | 10 +++++++---
-files changed, 13 insertions(+), 17 deletions(-)
+ target/arm/tcg/translate-a64.c | 17 +++++++++--------
 files changed, 17 insertions(+), 12 deletions(-)
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+diff --git a/target/arm/tcg/translate-a64.h b/target/arm/tcg/translate-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/sve_helper.c
+--- a/target/arm/tcg/translate-a64.h
-+++ b/target/arm/sve_helper.c
++++ b/target/arm/tcg/translate-a64.h
-@@ -XXX,XX +XXX,XX @@ static uint64_t compress_bits(uint64_t x, int n)
+@@ -XXX,XX +XXX,XX @@ TCGv_i64 gen_mte_checkN(DisasContext *s, TCGv_i64 addr, bool is_write,
+ static inline void assert_fp_access_checked(DisasContext *s)
  void HELPER(sve_zip_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
  {
--    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+ #ifdef CONFIG_DEBUG_TCG
--    int esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
+-    if (unlikely(!s->fp_access_checked || s->fp_excp_el)) {
--    intptr_t high = extract32(pred_desc, SIMD_DATA_SHIFT + 2, 1);
++    if (unlikely(s->fp_access_checked <= 0)) {
-+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+         fprintf(stderr, "target-arm: FP access check missing for "
-+    int esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+                 "instruction 0x%08x\n", s->insn);
-+    intptr_t high = FIELD_EX32(pred_desc, PREDDESC, DATA);
+         abort();
-     uint64_t *d = vd;
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
-     intptr_t i;
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/translate.h
-@@ -XXX,XX +XXX,XX @@ void HELPER(sve_zip_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
++++ b/target/arm/tcg/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
- void HELPER(sve_uzp_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
+     bool aarch64;
      bool thumb;
      bool lse2;
 -    /* Because unallocated encodings generate different exception syndrome
 +    /*
 +     * Because unallocated encodings generate different exception syndrome
       * information from traps due to FP being disabled, we can't do a single
       * "is fp access disabled" check at a high level in the decode tree.
       * To help in catching bugs where the access check was forgotten in some
       * code path, we set this flag when the access check is done, and assert
       * that it is set at the point where we actually touch the FP regs.
 +     *   0: not checked,
 +     *   1: checked, access ok
 +     *  -1: checked, access denied
       */
 -    bool fp_access_checked;
 -    bool sve_access_checked;
 +    int8_t fp_access_checked;
 +    int8_t sve_access_checked;
      /* ARMv8 single-step state (this is distinct from the QEMU gdbstub
       * single-step support).
       */
 diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/translate-a64.c
 +++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool fp_access_check_only(DisasContext *s)
  {
--    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+     if (s->fp_excp_el) {
--    int esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
+         assert(!s->fp_access_checked);
--    int odd = extract32(pred_desc, SIMD_DATA_SHIFT + 2, 1) << esz;
+-        s->fp_access_checked = true;
-+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
++        s->fp_access_checked = -1;
-+    int esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
-+    int odd = FIELD_EX32(pred_desc, PREDDESC, DATA) << esz;
+         gen_exception_insn_el(s, 0, EXCP_UDEF,
-     uint64_t *d = vd, *n = vn, *m = vm;
+                               syn_fp_access_trap(1, 0xe, false, 0),
-     uint64_t l, h;
+                               s->fp_excp_el);
-     intptr_t i;
+         return false;
-@@ -XXX,XX +XXX,XX @@ void HELPER(sve_uzp_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
+     }
+-    s->fp_access_checked = true;
- void HELPER(sve_trn_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
++    s->fp_access_checked = 1;
- {
+     return true;
--    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
+ }
--    uintptr_t esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
--    bool odd = extract32(pred_desc, SIMD_DATA_SHIFT + 2, 1);
+@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
-+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+                               syn_sve_access_trap(), s->sve_excp_el);
-+    int esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+         goto fail_exit;
-+    int odd = FIELD_EX32(pred_desc, PREDDESC, DATA);
+     }
-     uint64_t *d = vd, *n = vn, *m = vm;
+-    s->sve_access_checked = true;
-     uint64_t mask;
++    s->sve_access_checked = 1;
-     int shr, shl;
+     return fp_access_check(s);
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
-index XXXXXXX..XXXXXXX 100644
+  fail_exit:
---- a/target/arm/translate-sve.c
+     /* Assert that we only raise one exception per instruction. */
-+++ b/target/arm/translate-sve.c
+     assert(!s->sve_access_checked);
-@@ -XXX,XX +XXX,XX @@ static bool do_perm_pred3(DisasContext *s, arg_rrr_esz *a, bool high_odd,
+-    s->sve_access_checked = true;
++    s->sve_access_checked = -1;
-     unsigned vsz = pred_full_reg_size(s);
+     return false;
+ }
--    /* Predicate sizes may be smaller and cannot use simd_desc.
--       We cannot round up, as we do elsewhere, because we need
+@@ -XXX,XX +XXX,XX @@ bool sme_enabled_check(DisasContext *s)
--       the exact size for ZIP2 and REV.  We retain the style for
+      * sme_excp_el by itself for cpregs access checks.
--       the other helpers for consistency.  */
+      */
-     TCGv_ptr t_d = tcg_temp_new_ptr();
+     if (!s->fp_excp_el || s->sme_excp_el < s->fp_excp_el) {
-     TCGv_ptr t_n = tcg_temp_new_ptr();
+-        s->fp_access_checked = true;
-     TCGv_ptr t_m = tcg_temp_new_ptr();
+-        return sme_access_check(s);
-     TCGv_i32 t_desc;
++        bool ret = sme_access_check(s);
--    int desc;
++        s->fp_access_checked = (ret ? 1 : -1);
-+    uint32_t desc = 0;
++        return ret;
+     }
--    desc = vsz - 2;
+     return fp_access_check_only(s);
--    desc = deposit32(desc, SIMD_DATA_SHIFT, 2, a->esz);
+ }
--    desc = deposit32(desc, SIMD_DATA_SHIFT + 2, 2, high_odd);
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
-+    desc = FIELD_DP32(desc, PREDDESC, OPRSZ, vsz);
+     s->insn = insn;
-+    desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
+     s->base.pc_next = pc + 4;
-+    desc = FIELD_DP32(desc, PREDDESC, DATA, high_odd);
+-    s->fp_access_checked = false;
-     tcg_gen_addi_ptr(t_d, cpu_env, pred_full_reg_offset(s, a->rd));
+-    s->sve_access_checked = false;
-     tcg_gen_addi_ptr(t_n, cpu_env, pred_full_reg_offset(s, a->rn));
++    s->fp_access_checked = 0;
 +    s->sve_access_checked = 0;
      if (s->pstate_il) {
          /*
 --
-.20.1
+.43.0

-[PULL 24/33] target/arm: Update PFIRST, PNEXT for pred_desc
+[PULL 16/17] target/arm: Simplify pstate_sm check in sve_access_check
 From: Richard Henderson <richard.henderson@linaro.org>
-These two were odd, in that do_pfirst_pnext passed the
+In StreamingMode, fp_access_checked is handled already.
-count of 64-bit words rather than bytes.  Change to pass
+We cannot fall through to fp_access_check lest we fall
-the standard pred_full_reg_size to avoid confusion.
+foul of the double-check assertion.
 Cc: qemu-stable@nongnu.org
+Fixes: 285b1d5fcef ("target/arm: Handle SME in sve_access_check")
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210113062650.593824-3-richard.henderson@linaro.org
+Message-id: 20250307190415.982049-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+[PMM: move declaration of 'ret' to top of block]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/sve_helper.c    | 7 ++++---
+ target/arm/tcg/translate-a64.c | 22 +++++++++++-----------
- target/arm/translate-sve.c | 6 +++---
+file changed, 11 insertions(+), 11 deletions(-)
 files changed, 7 insertions(+), 6 deletions(-)
-diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/sve_helper.c
+--- a/target/arm/tcg/translate-a64.c
-+++ b/target/arm/sve_helper.c
++++ b/target/arm/tcg/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static intptr_t last_active_element(uint64_t *g, intptr_t words, intptr_t esz)
+@@ -XXX,XX +XXX,XX @@ static int fp_access_check_vector_hsd(DisasContext *s, bool is_q, MemOp esz)
-     return (intptr_t)-1 << esz;
+ bool sve_access_check(DisasContext *s)
  {
      if (s->pstate_sm || !dc_isar_feature(aa64_sve, s)) {
 +        bool ret;
 +
          assert(dc_isar_feature(aa64_sme, s));
 -        if (!sme_sm_enabled_check(s)) {
 -            goto fail_exit;
 -        }
 -    } else if (s->sve_excp_el) {
 +        ret = sme_sm_enabled_check(s);
 +        s->sve_access_checked = (ret ? 1 : -1);
 +        return ret;
 +    }
 +    if (s->sve_excp_el) {
 +        /* Assert that we only raise one exception per instruction. */
 +        assert(!s->sve_access_checked);
          gen_exception_insn_el(s, 0, EXCP_UDEF,
                                syn_sve_access_trap(), s->sve_excp_el);
 -        goto fail_exit;
 +        s->sve_access_checked = -1;
 +        return false;
      }
      s->sve_access_checked = 1;
      return fp_access_check(s);
 -
 - fail_exit:
 -    /* Assert that we only raise one exception per instruction. */
 -    assert(!s->sve_access_checked);
 -    s->sve_access_checked = -1;
 -    return false;
  }
--uint32_t HELPER(sve_pfirst)(void *vd, void *vg, uint32_t words)
+ /*
 +uint32_t HELPER(sve_pfirst)(void *vd, void *vg, uint32_t pred_desc)
  {
 +    intptr_t words = DIV_ROUND_UP(FIELD_EX32(pred_desc, PREDDESC, OPRSZ), 8);
      uint32_t flags = PREDTEST_INIT;
      uint64_t *d = vd, *g = vg;
      intptr_t i = 0;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(sve_pfirst)(void *vd, void *vg, uint32_t words)
  uint32_t HELPER(sve_pnext)(void *vd, void *vg, uint32_t pred_desc)
  {
 -    intptr_t words = extract32(pred_desc, 0, SIMD_OPRSZ_BITS);
 -    intptr_t esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
 +    intptr_t words = DIV_ROUND_UP(FIELD_EX32(pred_desc, PREDDESC, OPRSZ), 8);
 +    intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
      uint32_t flags = PREDTEST_INIT;
      uint64_t *d = vd, *g = vg, esz_mask;
      intptr_t i, next;
 diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-sve.c
 +++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool do_pfirst_pnext(DisasContext *s, arg_rr_esz *a,
      TCGv_ptr t_pd = tcg_temp_new_ptr();
      TCGv_ptr t_pg = tcg_temp_new_ptr();
      TCGv_i32 t;
 -    unsigned desc;
 +    unsigned desc = 0;
 -    desc = DIV_ROUND_UP(pred_full_reg_size(s), 8);
 -    desc = deposit32(desc, SIMD_DATA_SHIFT, 2, a->esz);
 +    desc = FIELD_DP32(desc, PREDDESC, OPRSZ, pred_full_reg_size(s));
 +    desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
      tcg_gen_addi_ptr(t_pd, cpu_env, pred_full_reg_offset(s, a->rd));
      tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, a->rn));
 --
-.20.1
+.43.0

-[PULL 27/33] hw/misc/pvpanic: split-out generic and bus dependent code
+Deleted patch
-From: Mihai Carabas <mihai.carabas@oracle.com>
-To ease the PCI device addition in next patches, split the code as follows:
-- generic code (read/write/setup) is being kept in pvpanic.c
-- ISA dependent code moved to pvpanic-isa.c
-Also, rename:
-- ISA_PVPANIC_DEVICE -> PVPANIC_ISA_DEVICE.
-- TYPE_PVPANIC -> TYPE_PVPANIC_ISA.
-- MemoryRegion io -> mr.
-- pvpanic_ioport_* in pvpanic_*.
-Update the build system with the new files and config structure.
-Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/misc/pvpanic.h | 23 +++++++++-
- hw/misc/pvpanic-isa.c     | 94 +++++++++++++++++++++++++++++++++++++++
- hw/misc/pvpanic.c         | 85 +++--------------------------------
- hw/i386/Kconfig           |  2 +-
- hw/misc/Kconfig           |  6 ++-
- hw/misc/meson.build       |  3 +-
- tests/qtest/meson.build   |  2 +-
-files changed, 130 insertions(+), 85 deletions(-)
- create mode 100644 hw/misc/pvpanic-isa.c
-diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/pvpanic.h
-+++ b/include/hw/misc/pvpanic.h
-@@ -XXX,XX +XXX,XX @@
- #include "qom/object.h"
--#define TYPE_PVPANIC "pvpanic"
-+#define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
- #define PVPANIC_IOPORT_PROP "ioport"
-+/* The bit of supported pv event, TODO: include uapi header and remove this */
-+#define PVPANIC_F_PANICKED      0
-+#define PVPANIC_F_CRASHLOADED   1
-+
-+/* The pv event value */
-+#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
-+#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
-+
-+/*
-+ * PVPanicState for any device type
-+ */
-+typedef struct PVPanicState PVPanicState;
-+struct PVPanicState {
-+    MemoryRegion mr;
-+    uint8_t events;
-+};
-+
-+void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size);
-+
- static inline uint16_t pvpanic_port(void)
- {
--    Object *o = object_resolve_path_type("", TYPE_PVPANIC, NULL);
-+    Object *o = object_resolve_path_type("", TYPE_PVPANIC_ISA_DEVICE, NULL);
-     if (!o) {
-         return 0;
-     }
-diff --git a/hw/misc/pvpanic-isa.c b/hw/misc/pvpanic-isa.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/misc/pvpanic-isa.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU simulated pvpanic device.
-+ *
-+ * Copyright Fujitsu, Corp. 2013
-+ *
-+ * Authors:
-+ *     Wen Congyang <wency@cn.fujitsu.com>
-+ *     Hu Tao <hutao@cn.fujitsu.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ *
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/log.h"
-+#include "qemu/module.h"
-+#include "sysemu/runstate.h"
-+
-+#include "hw/nvram/fw_cfg.h"
-+#include "hw/qdev-properties.h"
-+#include "hw/misc/pvpanic.h"
-+#include "qom/object.h"
-+#include "hw/isa/isa.h"
-+
-+OBJECT_DECLARE_SIMPLE_TYPE(PVPanicISAState, PVPANIC_ISA_DEVICE)
-+
-+/*
-+ * PVPanicISAState for ISA device and
-+ * use ioport.
-+ */
-+struct PVPanicISAState {
-+    ISADevice parent_obj;
-+
-+    uint16_t ioport;
-+    PVPanicState pvpanic;
-+};
-+
-+static void pvpanic_isa_initfn(Object *obj)
-+{
-+    PVPanicISAState *s = PVPANIC_ISA_DEVICE(obj);
-+
-+    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 1);
-+}
-+
-+static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
-+{
-+    ISADevice *d = ISA_DEVICE(dev);
-+    PVPanicISAState *s = PVPANIC_ISA_DEVICE(dev);
-+    PVPanicState *ps = &s->pvpanic;
-+    FWCfgState *fw_cfg = fw_cfg_find();
-+    uint16_t *pvpanic_port;
-+
-+    if (!fw_cfg) {
-+        return;
-+    }
-+
-+    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
-+    *pvpanic_port = cpu_to_le16(s->ioport);
-+    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
-+                    sizeof(*pvpanic_port));
-+
-+    isa_register_ioport(d, &ps->mr, s->ioport);
-+}
-+
-+static Property pvpanic_isa_properties[] = {
-+    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicISAState, ioport, 0x505),
-+    DEFINE_PROP_UINT8("events", PVPanicISAState, pvpanic.events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
-+static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+
-+    dc->realize = pvpanic_isa_realizefn;
-+    device_class_set_props(dc, pvpanic_isa_properties);
-+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-+}
-+
-+static TypeInfo pvpanic_isa_info = {
-+    .name          = TYPE_PVPANIC_ISA_DEVICE,
-+    .parent        = TYPE_ISA_DEVICE,
-+    .instance_size = sizeof(PVPanicISAState),
-+    .instance_init = pvpanic_isa_initfn,
-+    .class_init    = pvpanic_isa_class_init,
-+};
-+
-+static void pvpanic_register_types(void)
-+{
-+    type_register_static(&pvpanic_isa_info);
-+}
-+
-+type_init(pvpanic_register_types)
-diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/pvpanic.c
-+++ b/hw/misc/pvpanic.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/misc/pvpanic.h"
- #include "qom/object.h"
--/* The bit of supported pv event, TODO: include uapi header and remove this */
--#define PVPANIC_F_PANICKED      0
--#define PVPANIC_F_CRASHLOADED   1
--
--/* The pv event value */
--#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
--#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
--
--typedef struct PVPanicState PVPanicState;
--DECLARE_INSTANCE_CHECKER(PVPanicState, ISA_PVPANIC_DEVICE,
--                         TYPE_PVPANIC)
--
- static void handle_event(int event)
- {
-     static bool logged;
-@@ -XXX,XX +XXX,XX @@ static void handle_event(int event)
-     }
- }
--#include "hw/isa/isa.h"
--
--struct PVPanicState {
--    ISADevice parent_obj;
--
--    MemoryRegion io;
--    uint16_t ioport;
--    uint8_t events;
--};
--
- /* return supported events on read */
--static uint64_t pvpanic_ioport_read(void *opaque, hwaddr addr, unsigned size)
-+static uint64_t pvpanic_read(void *opaque, hwaddr addr, unsigned size)
- {
-     PVPanicState *pvp = opaque;
-     return pvp->events;
- }
--static void pvpanic_ioport_write(void *opaque, hwaddr addr, uint64_t val,
-+static void pvpanic_write(void *opaque, hwaddr addr, uint64_t val,
-                                  unsigned size)
- {
-     handle_event(val);
- }
- static const MemoryRegionOps pvpanic_ops = {
--    .read = pvpanic_ioport_read,
--    .write = pvpanic_ioport_write,
-+    .read = pvpanic_read,
-+    .write = pvpanic_write,
-     .impl = {
-         .min_access_size = 1,
-         .max_access_size = 1,
-     },
- };
--static void pvpanic_isa_initfn(Object *obj)
-+void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size)
- {
--    PVPanicState *s = ISA_PVPANIC_DEVICE(obj);
--
--    memory_region_init_io(&s->io, OBJECT(s), &pvpanic_ops, s, "pvpanic", 1);
-+    memory_region_init_io(&s->mr, OBJECT(dev), &pvpanic_ops, s, "pvpanic", size);
- }
--
--static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
--{
--    ISADevice *d = ISA_DEVICE(dev);
--    PVPanicState *s = ISA_PVPANIC_DEVICE(dev);
--    FWCfgState *fw_cfg = fw_cfg_find();
--    uint16_t *pvpanic_port;
--
--    if (!fw_cfg) {
--        return;
--    }
--
--    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
--    *pvpanic_port = cpu_to_le16(s->ioport);
--    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
--                    sizeof(*pvpanic_port));
--
--    isa_register_ioport(d, &s->io, s->ioport);
--}
--
--static Property pvpanic_isa_properties[] = {
--    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicState, ioport, 0x505),
--    DEFINE_PROP_UINT8("events", PVPanicState, events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
--    DEFINE_PROP_END_OF_LIST(),
--};
--
--static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
--{
--    DeviceClass *dc = DEVICE_CLASS(klass);
--
--    dc->realize = pvpanic_isa_realizefn;
--    device_class_set_props(dc, pvpanic_isa_properties);
--    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
--}
--
--static TypeInfo pvpanic_isa_info = {
--    .name          = TYPE_PVPANIC,
--    .parent        = TYPE_ISA_DEVICE,
--    .instance_size = sizeof(PVPanicState),
--    .instance_init = pvpanic_isa_initfn,
--    .class_init    = pvpanic_isa_class_init,
--};
--
--static void pvpanic_register_types(void)
--{
--    type_register_static(&pvpanic_isa_info);
--}
--
--type_init(pvpanic_register_types)
-diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/i386/Kconfig
-+++ b/hw/i386/Kconfig
-@@ -XXX,XX +XXX,XX @@ config PC
-     imply ISA_DEBUG
-     imply PARALLEL
-     imply PCI_DEVICES
--    imply PVPANIC
-+    imply PVPANIC_ISA
-     imply QXL
-     imply SEV
-     imply SGA
-diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Kconfig
-+++ b/hw/misc/Kconfig
-@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSCTL
- config IOTKIT_SYSINFO
-     bool
--config PVPANIC
-+config PVPANIC_COMMON
-+    bool
-+
-+config PVPANIC_ISA
-     bool
-     depends on ISA_BUS
-+    select PVPANIC_COMMON
- config AUX
-     bool
-diff --git a/hw/misc/meson.build b/hw/misc/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/meson.build
-+++ b/hw/misc/meson.build
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_EMC141X', if_true: files('emc141x.c'))
- softmmu_ss.add(when: 'CONFIG_UNIMP', if_true: files('unimp.c'))
- softmmu_ss.add(when: 'CONFIG_EMPTY_SLOT', if_true: files('empty_slot.c'))
- softmmu_ss.add(when: 'CONFIG_LED', if_true: files('led.c'))
-+softmmu_ss.add(when: 'CONFIG_PVPANIC_COMMON', if_true: files('pvpanic.c'))
- # ARM devices
- softmmu_ss.add(when: 'CONFIG_PL310', if_true: files('arm_l2x0.c'))
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_IOTKIT_SYSINFO', if_true: files('iotkit-sysinfo.c')
- softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
- softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
--softmmu_ss.add(when: 'CONFIG_PVPANIC', if_true: files('pvpanic.c'))
-+softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
- softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
- softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
- softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
-diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/meson.build
-+++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
-   (config_host.has_key('CONFIG_LINUX') and                                                  \
-    config_all_devices.has_key('CONFIG_ISA_IPMI_BT') ? ['ipmi-bt-test'] : []) +              \
-   (config_all_devices.has_key('CONFIG_WDT_IB700') ? ['wdt_ib700-test'] : []) +              \
--  (config_all_devices.has_key('CONFIG_PVPANIC') ? ['pvpanic-test'] : []) +                  \
-+  (config_all_devices.has_key('CONFIG_PVPANIC_ISA') ? ['pvpanic-test'] : []) +              \
-   (config_all_devices.has_key('CONFIG_HDA') ? ['intel-hda-test'] : []) +                    \
-   (config_all_devices.has_key('CONFIG_I82801B11') ? ['i82801b11-test'] : []) +             \
-   (config_all_devices.has_key('CONFIG_IOH3420') ? ['ioh3420-test'] : []) +                  \
---
-.20.1

-[PULL 28/33] hw/misc/pvpanic: add PCI interface support
+Deleted patch
-From: Mihai Carabas <mihai.carabas@oracle.com>
-Add PCI interface support for PVPANIC device. Create a new file pvpanic-pci.c
-where the PCI specific routines reside and update the build system with the new
-files and config structure.
-Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
-Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-[PMM: wrapped one long line]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/specs/pci-ids.txt    |  1 +
- include/hw/misc/pvpanic.h |  1 +
- include/hw/pci/pci.h      |  1 +
- hw/misc/pvpanic-pci.c     | 95 +++++++++++++++++++++++++++++++++++++++
- hw/misc/Kconfig           |  6 +++
- hw/misc/meson.build       |  1 +
-files changed, 105 insertions(+)
- create mode 100644 hw/misc/pvpanic-pci.c
-diff --git a/docs/specs/pci-ids.txt b/docs/specs/pci-ids.txt
-index XXXXXXX..XXXXXXX 100644
---- a/docs/specs/pci-ids.txt
-+++ b/docs/specs/pci-ids.txt
-@@ -XXX,XX +XXX,XX @@ PCI devices (other than virtio):
-b36:000d  PCI xhci usb host adapter
-b36:000f  mdpy (mdev sample device), linux/samples/vfio-mdev/mdpy.c
-b36:0010  PCIe NVMe device (-device nvme)
-+1b36:0011  PCI PVPanic device (-device pvpanic-pci)
- All these devices are documented in docs/specs.
-diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/pvpanic.h
-+++ b/include/hw/misc/pvpanic.h
-@@ -XXX,XX +XXX,XX @@
- #include "qom/object.h"
- #define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
-+#define TYPE_PVPANIC_PCI_DEVICE "pvpanic-pci"
- #define PVPANIC_IOPORT_PROP "ioport"
-diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/pci/pci.h
-+++ b/include/hw/pci/pci.h
-@@ -XXX,XX +XXX,XX @@ extern bool pci_available;
- #define PCI_DEVICE_ID_REDHAT_PCIE_BRIDGE 0x000e
- #define PCI_DEVICE_ID_REDHAT_MDPY        0x000f
- #define PCI_DEVICE_ID_REDHAT_NVME        0x0010
-+#define PCI_DEVICE_ID_REDHAT_PVPANIC     0x0011
- #define PCI_DEVICE_ID_REDHAT_QXL         0x0100
- #define FMT_PCIBUS                      PRIx64
-diff --git a/hw/misc/pvpanic-pci.c b/hw/misc/pvpanic-pci.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/hw/misc/pvpanic-pci.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU simulated PCI pvpanic device.
-+ *
-+ * Copyright (C) 2020 Oracle
-+ *
-+ * Authors:
-+ *     Mihai Carabas <mihai.carabas@oracle.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ *
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qemu/log.h"
-+#include "qemu/module.h"
-+#include "sysemu/runstate.h"
-+
-+#include "hw/nvram/fw_cfg.h"
-+#include "hw/qdev-properties.h"
-+#include "migration/vmstate.h"
-+#include "hw/misc/pvpanic.h"
-+#include "qom/object.h"
-+#include "hw/pci/pci.h"
-+
-+OBJECT_DECLARE_SIMPLE_TYPE(PVPanicPCIState, PVPANIC_PCI_DEVICE)
-+
-+/*
-+ * PVPanicPCIState for PCI device
-+ */
-+typedef struct PVPanicPCIState {
-+    PCIDevice dev;
-+    PVPanicState pvpanic;
-+} PVPanicPCIState;
-+
-+static const VMStateDescription vmstate_pvpanic_pci = {
-+    .name = "pvpanic-pci",
-+    .version_id = 1,
-+    .minimum_version_id = 1,
-+    .fields = (VMStateField[]) {
-+        VMSTATE_PCI_DEVICE(dev, PVPanicPCIState),
-+        VMSTATE_END_OF_LIST()
-+    }
-+};
-+
-+static void pvpanic_pci_realizefn(PCIDevice *dev, Error **errp)
-+{
-+    PVPanicPCIState *s = PVPANIC_PCI_DEVICE(dev);
-+    PVPanicState *ps = &s->pvpanic;
-+
-+    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 2);
-+
-+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &ps->mr);
-+}
-+
-+static Property pvpanic_pci_properties[] = {
-+    DEFINE_PROP_UINT8("events", PVPanicPCIState, pvpanic.events,
-+                      PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
-+    DEFINE_PROP_END_OF_LIST(),
-+};
-+
-+static void pvpanic_pci_class_init(ObjectClass *klass, void *data)
-+{
-+    DeviceClass *dc = DEVICE_CLASS(klass);
-+    PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
-+
-+    device_class_set_props(dc, pvpanic_pci_properties);
-+
-+    pc->realize = pvpanic_pci_realizefn;
-+    pc->vendor_id = PCI_VENDOR_ID_REDHAT;
-+    pc->device_id = PCI_DEVICE_ID_REDHAT_PVPANIC;
-+    pc->revision = 1;
-+    pc->class_id = PCI_CLASS_SYSTEM_OTHER;
-+    dc->vmsd = &vmstate_pvpanic_pci;
-+
-+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-+}
-+
-+static TypeInfo pvpanic_pci_info = {
-+    .name          = TYPE_PVPANIC_PCI_DEVICE,
-+    .parent        = TYPE_PCI_DEVICE,
-+    .instance_size = sizeof(PVPanicPCIState),
-+    .class_init    = pvpanic_pci_class_init,
-+    .interfaces = (InterfaceInfo[]) {
-+        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
-+        { }
-+    }
-+};
-+
-+static void pvpanic_register_types(void)
-+{
-+    type_register_static(&pvpanic_pci_info);
-+}
-+
-+type_init(pvpanic_register_types);
-diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/Kconfig
-+++ b/hw/misc/Kconfig
-@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSINFO
- config PVPANIC_COMMON
-     bool
-+config PVPANIC_PCI
-+    bool
-+    default y if PCI_DEVICES
-+    depends on PCI
-+    select PVPANIC_COMMON
-+
- config PVPANIC_ISA
-     bool
-     depends on ISA_BUS
-diff --git a/hw/misc/meson.build b/hw/misc/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/meson.build
-+++ b/hw/misc/meson.build
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
- softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
- softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
-+softmmu_ss.add(when: 'CONFIG_PVPANIC_PCI', if_true: files('pvpanic-pci.c'))
- softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
- softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
- softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
---
-.20.1

-[PULL 30/33] tests/qtest: add a test case for pvpanic-pci
+Deleted patch
-From: Mihai Carabas <mihai.carabas@oracle.com>
-Add a test case for pvpanic-pci device. The scenario is the same as pvpapnic
-ISA device, but is using the PCI bus.
-Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
-Acked-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/qtest/pvpanic-pci-test.c | 62 ++++++++++++++++++++++++++++++++++
- tests/qtest/meson.build        |  1 +
-files changed, 63 insertions(+)
- create mode 100644 tests/qtest/pvpanic-pci-test.c
-diff --git a/tests/qtest/pvpanic-pci-test.c b/tests/qtest/pvpanic-pci-test.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/tests/qtest/pvpanic-pci-test.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QTest testcase for PV Panic PCI device
-+ *
-+ * Copyright (C) 2020 Oracle
-+ *
-+ * Authors:
-+ *     Mihai Carabas <mihai.carabas@oracle.com>
-+ *
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ * See the COPYING file in the top-level directory.
-+ *
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "libqos/libqtest.h"
-+#include "qapi/qmp/qdict.h"
-+#include "libqos/pci.h"
-+#include "libqos/pci-pc.h"
-+#include "hw/pci/pci_regs.h"
-+
-+static void test_panic(void)
-+{
-+    uint8_t val;
-+    QDict *response, *data;
-+    QTestState *qts;
-+    QPCIBus *pcibus;
-+    QPCIDevice *dev;
-+    QPCIBar bar;
-+
-+    qts = qtest_init("-device pvpanic-pci");
-+    pcibus = qpci_new_pc(qts, NULL);
-+    dev = qpci_device_find(pcibus, QPCI_DEVFN(0x4, 0x0));
-+    qpci_device_enable(dev);
-+    bar = qpci_iomap(dev, 0, NULL);
-+
-+    qpci_memread(dev, bar, 0, &val, sizeof(val));
-+    g_assert_cmpuint(val, ==, 3);
-+
-+    val = 1;
-+    qpci_memwrite(dev, bar, 0, &val, sizeof(val));
-+
-+    response = qtest_qmp_eventwait_ref(qts, "GUEST_PANICKED");
-+    g_assert(qdict_haskey(response, "data"));
-+    data = qdict_get_qdict(response, "data");
-+    g_assert(qdict_haskey(data, "action"));
-+    g_assert_cmpstr(qdict_get_str(data, "action"), ==, "pause");
-+    qobject_unref(response);
-+
-+    qtest_quit(qts);
-+}
-+
-+int main(int argc, char **argv)
-+{
-+    int ret;
-+
-+    g_test_init(&argc, &argv, NULL);
-+    qtest_add_func("/pvpanic-pci/panic", test_panic);
-+
-+    ret = g_test_run();
-+
-+    return ret;
-+}
-diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/meson.build
-+++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ endif
- qtests_pci = \
-   (config_all_devices.has_key('CONFIG_VGA') ? ['display-vga-test'] : []) +                  \
-+  (config_all_devices.has_key('CONFIG_PVPANIC_PCI') ? ['pvpanic-pci-test'] : []) +          \
-   (config_all_devices.has_key('CONFIG_IVSHMEM_DEVICE') ? ['ivshmem-test'] : [])
- qtests_i386 = \
---
-.20.1

-[PULL 33/33] docs: Build and install all the docs in a single manual
+[PULL 17/17] meson.build: Set RUST_BACKTRACE for all tests
-When we first converted our documentation to Sphinx, we split it into
+We want to capture potential Rust backtraces on panics in our test
-multiple manuals (system, interop, tools, etc), which are all built
+logs, which isn't Rust's default behaviour.  Set RUST_BACKTRACE=1 in
-separately.  The primary driver for this was wanting to be able to
+the add_test_setup environments, so that all our tests get run with
-avoid shipping the 'devel' manual to end-users.  However, this is
+this environment variable set.
 working against the grain of the way Sphinx wants to be used and
 causes some annoyances:
  * Cross-references between documents become much harder or
    possibly impossible
  * There is no single index to the whole documentation
  * Within one manual there's no links or table-of-contents info
    that lets you easily navigate to the others
  * The devel manual doesn't get published on the QEMU website
    (it would be nice to able to refer to it there)
-Merely hiding our developer documentation from end users seems like
+This makes the setting of that variable in the gitlab CI template
-it's not enough benefit for these costs.  Combine all the
+redundant, so we can remove it.
 documentation into a single manual (the same way that the readthedocs
 site builds it) and install the whole thing.  The previous manual
 divisions remain as the new top level sections in the manual.
  * The per-manual conf.py files are no longer needed
  * The man_pages[] specifications previously in each per-manual
    conf.py move to the top level conf.py
  * docs/meson.build logic is simplified as we now only need to run
    Sphinx once for the HTML and then once for the manpages5B
  * The old index.html.in that produced the top-level page with
    links to each manual is no longer needed
 Unfortunately this means that we now have to build the HTML
 documentation into docs/manual in the build tree rather than directly
 into docs/; otherwise it is too awkward to ensure we install only the
 built manual and not also the dependency info, stamp file, etc.  The
 manual still ends up in the same place in the final installed
 directory, but anybody who was consulting documentation from within
 the build tree will have to adjust where they're looking.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
-Message-id: 20210115154449.4801-1-peter.maydell@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20250310102950.3752908-1-peter.maydell@linaro.org
 ---
- docs/conf.py         | 46 ++++++++++++++++++++++++++++++-
+ meson.build                         | 9 ++++++---
- docs/devel/conf.py   | 15 -----------
+ .gitlab-ci.d/buildtest-template.yml | 1 -
- docs/index.html.in   | 17 ------------
+files changed, 6 insertions(+), 4 deletions(-)
  docs/interop/conf.py | 28 -------------------
  docs/meson.build     | 64 +++++++++++++++++---------------------------
  docs/specs/conf.py   | 16 -----------
  docs/system/conf.py  | 28 -------------------
  docs/tools/conf.py   | 37 -------------------------
  docs/user/conf.py    | 15 -----------
  .gitlab-ci.yml       |  4 +--
 files changed, 72 insertions(+), 198 deletions(-)
  delete mode 100644 docs/devel/conf.py
  delete mode 100644 docs/index.html.in
  delete mode 100644 docs/interop/conf.py
  delete mode 100644 docs/specs/conf.py
  delete mode 100644 docs/system/conf.py
  delete mode 100644 docs/tools/conf.py
  delete mode 100644 docs/user/conf.py
-diff --git a/docs/conf.py b/docs/conf.py
+diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/docs/conf.py
+--- a/meson.build
-+++ b/docs/conf.py
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ latex_documents = [
+@@ -XXX,XX +XXX,XX @@ project('qemu', ['c'], meson_version: '>=1.5.0',
- # -- Options for manual page output ---------------------------------------
+ meson.add_devenv({ 'MESON_BUILD_ROOT' : meson.project_build_root() })
- # Individual manual/conf.py can override this to create man pages
--man_pages = []
+-add_test_setup('quick', exclude_suites: ['slow', 'thorough'], is_default: true)
-+man_pages = [
+-add_test_setup('slow', exclude_suites: ['thorough'], env: ['G_TEST_SLOW=1', 'SPEED=slow'])
-+    ('interop/qemu-ga', 'qemu-ga',
+-add_test_setup('thorough', env: ['G_TEST_SLOW=1', 'SPEED=thorough'])
-+     'QEMU Guest Agent',
++add_test_setup('quick', exclude_suites: ['slow', 'thorough'], is_default: true,
-+     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8),
++               env: ['RUST_BACKTRACE=1'])
-+    ('interop/qemu-ga-ref', 'qemu-ga-ref',
++add_test_setup('slow', exclude_suites: ['thorough'],
-+     'QEMU Guest Agent Protocol Reference',
++               env: ['G_TEST_SLOW=1', 'SPEED=slow', 'RUST_BACKTRACE=1'])
-+     [], 7),
++add_test_setup('thorough',
-+    ('interop/qemu-qmp-ref', 'qemu-qmp-ref',
++               env: ['G_TEST_SLOW=1', 'SPEED=thorough', 'RUST_BACKTRACE=1'])
-+     'QEMU QMP Reference Manual',
-+     [], 7),
+ meson.add_postconf_script(find_program('scripts/symlink-install-tree.py'))
-+    ('interop/qemu-storage-daemon-qmp-ref', 'qemu-storage-daemon-qmp-ref',
-+     'QEMU Storage Daemon QMP Reference Manual',
+diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
-+     [], 7),
+index XXXXXXX..XXXXXXX 100644
-+    ('system/qemu-manpage', 'qemu',
+--- a/.gitlab-ci.d/buildtest-template.yml
-+     'QEMU User Documentation',
++++ b/.gitlab-ci.d/buildtest-template.yml
 +     ['Fabrice Bellard'], 1),
 +    ('system/qemu-block-drivers', 'qemu-block-drivers',
 +     'QEMU block drivers reference',
 +     ['Fabrice Bellard and the QEMU Project developers'], 7),
 +    ('system/qemu-cpu-models', 'qemu-cpu-models',
 +     'QEMU CPU Models',
 +     ['The QEMU Project developers'], 7),
 +    ('tools/qemu-img', 'qemu-img',
 +     'QEMU disk image utility',
 +     ['Fabrice Bellard'], 1),
 +    ('tools/qemu-nbd', 'qemu-nbd',
 +     'QEMU Disk Network Block Device Server',
 +     ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
 +    ('tools/qemu-pr-helper', 'qemu-pr-helper',
 +     'QEMU persistent reservation helper',
 +     [], 8),
 +    ('tools/qemu-storage-daemon', 'qemu-storage-daemon',
 +     'QEMU storage daemon',
 +     [], 1),
 +    ('tools/qemu-trace-stap', 'qemu-trace-stap',
 +     'QEMU SystemTap trace tool',
 +     [], 1),
 +    ('tools/virtfs-proxy-helper', 'virtfs-proxy-helper',
 +     'QEMU 9p virtfs proxy filesystem helper',
 +     ['M. Mohan Kumar'], 1),
 +    ('tools/virtiofsd', 'virtiofsd',
 +     'QEMU virtio-fs shared file system daemon',
 +     ['Stefan Hajnoczi <stefanha@redhat.com>',
 +      'Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>'], 1),
 +]
  # -- Options for Texinfo output -------------------------------------------
 diff --git a/docs/devel/conf.py b/docs/devel/conf.py
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/devel/conf.py
 +++ /dev/null
 @@ -XXX,XX +XXX,XX @@
--# -*- coding: utf-8 -*-
+   stage: test
--#
+   image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
--# QEMU documentation build configuration file for the 'devel' manual.
+   script:
--#
+-    - export RUST_BACKTRACE=1
--# This includes the top level conf file and then makes any necessary tweaks.
+     - source scripts/ci/gitlab-ci-section
--import sys
+     - section_start buildenv "Setting up to run tests"
--import os
+     - scripts/git-submodule.sh update roms/SLOF
 -
 -qemu_docdir = os.path.abspath("..")
 -parent_config = os.path.join(qemu_docdir, "conf.py")
 -exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 -
 -# This slightly misuses the 'description', but is the best way to get
 -# the manual title to appear in the sidebar.
 -html_theme_options['description'] = u'Developer''s Guide'
 diff --git a/docs/index.html.in b/docs/index.html.in
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/index.html.in
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -<!DOCTYPE html>
 -<html lang="en">
 -    <head>
 -        <meta charset="UTF-8">
 -        <title>QEMU @VERSION@ Documentation</title>
 -    </head>
 -    <body>
 -        <h1>QEMU @VERSION@ Documentation</h1>
 -        <ul>
 -            <li><a href="system/index.html">System Emulation User's Guide</a></li>
 -            <li><a href="user/index.html">User Mode Emulation User's Guide</a></li>
 -            <li><a href="tools/index.html">Tools Guide</a></li>
 -            <li><a href="interop/index.html">System Emulation Management and Interoperability Guide</a></li>
 -            <li><a href="specs/index.html">System Emulation Guest Hardware Specifications</a></li>
 -        </ul>
 -    </body>
 -</html>
 diff --git a/docs/interop/conf.py b/docs/interop/conf.py
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/interop/conf.py
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -# -*- coding: utf-8 -*-
 -#
 -# QEMU documentation build configuration file for the 'interop' manual.
 -#
 -# This includes the top level conf file and then makes any necessary tweaks.
 -import sys
 -import os
 -
 -qemu_docdir = os.path.abspath("..")
 -parent_config = os.path.join(qemu_docdir, "conf.py")
 -exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 -
 -# This slightly misuses the 'description', but is the best way to get
 -# the manual title to appear in the sidebar.
 -html_theme_options['description'] = u'System Emulation Management and Interoperability Guide'
 -
 -# One entry per manual page. List of tuples
 -# (source start file, name, description, authors, manual section).
 -man_pages = [
 -    ('qemu-ga', 'qemu-ga', u'QEMU Guest Agent',
 -     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8),
 -    ('qemu-ga-ref', 'qemu-ga-ref', 'QEMU Guest Agent Protocol Reference',
 -     [], 7),
 -    ('qemu-qmp-ref', 'qemu-qmp-ref', 'QEMU QMP Reference Manual',
 -     [], 7),
 -    ('qemu-storage-daemon-qmp-ref', 'qemu-storage-daemon-qmp-ref',
 -     'QEMU Storage Daemon QMP Reference Manual', [], 7),
 -]
 diff --git a/docs/meson.build b/docs/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/meson.build
 +++ b/docs/meson.build
@@ -XXX,XX +XXX,XX @@ if build_docs
                            meson.source_root() / 'docs/sphinx/qmp_lexer.py',
                            qapi_gen_depends ]
 -  configure_file(output: 'index.html',
 -                 input: files('index.html.in'),
 -                 configuration: {'VERSION': meson.project_version()},
 -                 install_dir: qemu_docdir)
 -  manuals = [ 'devel', 'interop', 'tools', 'specs', 'system', 'user' ]
    man_pages = {
 -    'interop' : {
          'qemu-ga.8': (have_tools ? 'man8' : ''),
          'qemu-ga-ref.7': 'man7',
          'qemu-qmp-ref.7': 'man7',
          'qemu-storage-daemon-qmp-ref.7': (have_tools ? 'man7' : ''),
 -    },
 -    'tools': {
          'qemu-img.1': (have_tools ? 'man1' : ''),
          'qemu-nbd.8': (have_tools ? 'man8' : ''),
          'qemu-pr-helper.8': (have_tools ? 'man8' : ''),
@@ -XXX,XX +XXX,XX @@ if build_docs
          'qemu-trace-stap.1': (config_host.has_key('CONFIG_TRACE_SYSTEMTAP') ? 'man1' : ''),
          'virtfs-proxy-helper.1': (have_virtfs_proxy_helper ? 'man1' : ''),
          'virtiofsd.1': (have_virtiofsd ? 'man1' : ''),
 -    },
 -    'system': {
          'qemu.1': 'man1',
          'qemu-block-drivers.7': 'man7',
          'qemu-cpu-models.7': 'man7'
 -    },
    }
    sphinxdocs = []
    sphinxmans = []
 -  foreach manual : manuals
 -    private_dir = meson.current_build_dir() / (manual + '.p')
 -    output_dir = meson.current_build_dir() / manual
 -    input_dir = meson.current_source_dir() / manual
 -    this_manual = custom_target(manual + ' manual',
 +  private_dir = meson.current_build_dir() / 'manual.p'
 +  output_dir = meson.current_build_dir() / 'manual'
 +  input_dir = meson.current_source_dir()
 +
 +  this_manual = custom_target('QEMU manual',
                  build_by_default: build_docs,
 -                output: [manual + '.stamp'],
 -                input: [files('conf.py'), files(manual / 'conf.py')],
 -                depfile: manual + '.d',
 +                output: 'docs.stamp',
 +                input: files('conf.py'),
 +                depfile: 'docs.d',
                  depend_files: sphinx_extn_depends,
                  command: [SPHINX_ARGS, '-Ddepfile=@DEPFILE@',
                            '-Ddepfile_stamp=@OUTPUT0@',
                            '-b', 'html', '-d', private_dir,
                            input_dir, output_dir])
 -    sphinxdocs += this_manual
 -    if build_docs and manual != 'devel'
 -      install_subdir(output_dir, install_dir: qemu_docdir)
 -    endif
 +  sphinxdocs += this_manual
 +  install_subdir(output_dir, install_dir: qemu_docdir, strip_directory: true)
 -    these_man_pages = []
 -    install_dirs = []
 -    foreach page, section : man_pages.get(manual, {})
 -      these_man_pages += page
 -      install_dirs += section == '' ? false : get_option('mandir') / section
 -    endforeach
 -    if these_man_pages.length() > 0
 -      sphinxmans += custom_target(manual + ' man pages',
 -                         build_by_default: build_docs,
 -                         output: these_man_pages,
 -                         input: this_manual,
 -                         install: build_docs,
 -                         install_dir: install_dirs,
 -                         command: [SPHINX_ARGS, '-b', 'man', '-d', private_dir,
 -                                   input_dir, meson.current_build_dir()])
 -    endif
 +  these_man_pages = []
 +  install_dirs = []
 +  foreach page, section : man_pages
 +    these_man_pages += page
 +    install_dirs += section == '' ? false : get_option('mandir') / section
    endforeach
 +
 +  sphinxmans += custom_target('QEMU man pages',
 +                              build_by_default: build_docs,
 +                              output: these_man_pages,
 +                              input: this_manual,
 +                              install: build_docs,
 +                              install_dir: install_dirs,
 +                              command: [SPHINX_ARGS, '-b', 'man', '-d', private_dir,
 +                                        input_dir, meson.current_build_dir()])
 +
    alias_target('sphinxdocs', sphinxdocs)
    alias_target('html', sphinxdocs)
    alias_target('man', sphinxmans)
 diff --git a/docs/specs/conf.py b/docs/specs/conf.py
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/specs/conf.py
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -# -*- coding: utf-8 -*-
 -#
 -# QEMU documentation build configuration file for the 'specs' manual.
 -#
 -# This includes the top level conf file and then makes any necessary tweaks.
 -import sys
 -import os
 -
 -qemu_docdir = os.path.abspath("..")
 -parent_config = os.path.join(qemu_docdir, "conf.py")
 -exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 -
 -# This slightly misuses the 'description', but is the best way to get
 -# the manual title to appear in the sidebar.
 -html_theme_options['description'] = \
 -    u'System Emulation Guest Hardware Specifications'
 diff --git a/docs/system/conf.py b/docs/system/conf.py
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/system/conf.py
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -# -*- coding: utf-8 -*-
 -#
 -# QEMU documentation build configuration file for the 'system' manual.
 -#
 -# This includes the top level conf file and then makes any necessary tweaks.
 -import sys
 -import os
 -
 -qemu_docdir = os.path.abspath("..")
 -parent_config = os.path.join(qemu_docdir, "conf.py")
 -exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 -
 -# This slightly misuses the 'description', but is the best way to get
 -# the manual title to appear in the sidebar.
 -html_theme_options['description'] = u'System Emulation User''s Guide'
 -
 -# One entry per manual page. List of tuples
 -# (source start file, name, description, authors, manual section).
 -man_pages = [
 -    ('qemu-manpage', 'qemu', u'QEMU User Documentation',
 -     ['Fabrice Bellard'], 1),
 -    ('qemu-block-drivers', 'qemu-block-drivers',
 -     u'QEMU block drivers reference',
 -     ['Fabrice Bellard and the QEMU Project developers'], 7),
 -    ('qemu-cpu-models', 'qemu-cpu-models',
 -     u'QEMU CPU Models',
 -     ['The QEMU Project developers'], 7)
 -]
 diff --git a/docs/tools/conf.py b/docs/tools/conf.py
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/tools/conf.py
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -# -*- coding: utf-8 -*-
 -#
 -# QEMU documentation build configuration file for the 'tools' manual.
 -#
 -# This includes the top level conf file and then makes any necessary tweaks.
 -import sys
 -import os
 -
 -qemu_docdir = os.path.abspath("..")
 -parent_config = os.path.join(qemu_docdir, "conf.py")
 -exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 -
 -# This slightly misuses the 'description', but is the best way to get
 -# the manual title to appear in the sidebar.
 -html_theme_options['description'] = \
 -    u'Tools Guide'
 -
 -# One entry per manual page. List of tuples
 -# (source start file, name, description, authors, manual section).
 -man_pages = [
 -    ('qemu-img', 'qemu-img', u'QEMU disk image utility',
 -     ['Fabrice Bellard'], 1),
 -    ('qemu-storage-daemon', 'qemu-storage-daemon', u'QEMU storage daemon',
 -     [], 1),
 -    ('qemu-nbd', 'qemu-nbd', u'QEMU Disk Network Block Device Server',
 -     ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
 -    ('qemu-pr-helper', 'qemu-pr-helper', 'QEMU persistent reservation helper',
 -     [], 8),
 -    ('qemu-trace-stap', 'qemu-trace-stap', u'QEMU SystemTap trace tool',
 -     [], 1),
 -    ('virtfs-proxy-helper', 'virtfs-proxy-helper',
 -     u'QEMU 9p virtfs proxy filesystem helper',
 -     ['M. Mohan Kumar'], 1),
 -    ('virtiofsd', 'virtiofsd', u'QEMU virtio-fs shared file system daemon',
 -     ['Stefan Hajnoczi <stefanha@redhat.com>',
 -      'Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>'], 1),
 -]
 diff --git a/docs/user/conf.py b/docs/user/conf.py
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/user/conf.py
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -# -*- coding: utf-8 -*-
 -#
 -# QEMU documentation build configuration file for the 'user' manual.
 -#
 -# This includes the top level conf file and then makes any necessary tweaks.
 -import sys
 -import os
 -
 -qemu_docdir = os.path.abspath("..")
 -parent_config = os.path.join(qemu_docdir, "conf.py")
 -exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
 -
 -# This slightly misuses the 'description', but is the best way to get
 -# the manual title to appear in the sidebar.
 -html_theme_options['description'] = u'User Mode Emulation User''s Guide'
 diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
 index XXXXXXX..XXXXXXX 100644
 --- a/.gitlab-ci.yml
 +++ b/.gitlab-ci.yml
@@ -XXX,XX +XXX,XX @@ pages:
          -t "Welcome to the QEMU sourcecode"
      - mv HTML public/src
      # Project documentation
 -    - mv build/docs/index.html public/
 -    - for i in devel interop specs system tools user ; do mv build/docs/$i public/ ; done
 +    - make -C build install DESTDIR=$(pwd)/temp-install
 +    - mv temp-install/usr/local/share/doc/qemu/* public/
    artifacts:
      paths:
        - public
 --
-.20.1
+.43.0

Arm pullreq: Rémi's ARMv8.4-SEL2 support is the big thing here.

thanks
-- PMM

The following changes since commit f1fcb6851aba6dd9838886dc179717a11e344a1c:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2021-01-19' into staging (2021-01-19 11:57:07 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210119

for you to fetch changes up to 6d39956891b3d1857af84f72f0230a6d99eb3b6a:

docs: Build and install all the docs in a single manual (2021-01-19 14:38:53 +0000)

----------------------------------------------------------------
target-arm queue:
 * Implement IMPDEF pauth algorithm
 * Support ARMv8.4-SEL2
 * Fix bug where we were truncating predicate vector lengths in SVE insns
 * Implement new pvpanic-pci device
 * npcm7xx_adc-test: Fix memleak in adc_qom_set
 * target/arm/m_helper: Silence GCC 10 maybe-uninitialized error
 * docs: Build and install all the docs in a single manual

----------------------------------------------------------------
Gan Qixin (1):
      npcm7xx_adc-test: Fix memleak in adc_qom_set

Mihai Carabas (4):
      hw/misc/pvpanic: split-out generic and bus dependent code
      hw/misc/pvpanic: add PCI interface support
      pvpanic : update pvpanic spec document
      tests/qtest: add a test case for pvpanic-pci

Peter Maydell (1):
      docs: Build and install all the docs in a single manual

Philippe Mathieu-Daudé (1):
      target/arm/m_helper: Silence GCC 10 maybe-uninitialized error

Richard Henderson (7):
      target/arm: Implement an IMPDEF pauth algorithm
      target/arm: Add cpu properties to control pauth
      target/arm: Use object_property_add_bool for "sve" property
      target/arm: Introduce PREDDESC field definitions
      target/arm: Update PFIRST, PNEXT for pred_desc
      target/arm: Update ZIP, UZP, TRN for pred_desc
      target/arm: Update REV, PUNPK for pred_desc

Rémi Denis-Courmont (19):
      target/arm: remove redundant tests
      target/arm: add arm_is_el2_enabled() helper
      target/arm: use arm_is_el2_enabled() where applicable
      target/arm: use arm_hcr_el2_eff() where applicable
      target/arm: factor MDCR_EL2 common handling
      target/arm: Define isar_feature function to test for presence of SEL2
      target/arm: add 64-bit S-EL2 to EL exception table
      target/arm: add MMU stage 1 for Secure EL2
      target/arm: add ARMv8.4-SEL2 system registers
      target/arm: handle VMID change in secure state
      target/arm: do S1_ptw_translate() before address space lookup
      target/arm: translate NS bit in page-walks
      target/arm: generalize 2-stage page-walk condition
      target/arm: secure stage 2 translation regime
      target/arm: set HPFAR_EL2.NS on secure stage 2 faults
      target/arm: revector to run-time pick target EL
      target/arm: Implement SCR_EL2.EEL2
      target/arm: enable Secure EL2 in max CPU
      target/arm: refactor vae1_tlbmask()

From: Richard Henderson <richard.henderson@linaro.org>

Without hardware acceleration, a cryptographically strong
algorithm is too expensive for pauth_computepac.

Even with hardware accel, we are not currently expecting
to link the linux-user binaries to any crypto libraries,
and doing so would generally make the --static build fail.

So choose XXH64 as a reasonably quick and decent hash.

Tested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210111235740.462469-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qemu/xxhash.h     | 98 +++++++++++++++++++++++++++++++++++++++
 target/arm/cpu.h          | 15 ++++--
 target/arm/pauth_helper.c | 27 +++++++++--
 3 files changed, 131 insertions(+), 9 deletions(-)

diff --git a/include/qemu/xxhash.h b/include/qemu/xxhash.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/xxhash.h
+++ b/include/qemu/xxhash.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t qemu_xxhash6(uint64_t ab, uint64_t cd, uint32_t e,
     return qemu_xxhash7(ab, cd, e, f, 0);
 }
 
+/*
+ * Component parts of the XXH64 algorithm from
+ * https://github.com/Cyan4973/xxHash/blob/v0.8.0/xxhash.h
+ *
+ * The complete algorithm looks like
+ *
+ *  i = 0;
+ *  if (len >= 32) {
+ *      v1 = seed + XXH_PRIME64_1 + XXH_PRIME64_2;
+ *      v2 = seed + XXH_PRIME64_2;
+ *      v3 = seed + 0;
+ *      v4 = seed - XXH_PRIME64_1;
+ *      do {
+ *          v1 = XXH64_round(v1, get64bits(input + i));
+ *          v2 = XXH64_round(v2, get64bits(input + i + 8));
+ *          v3 = XXH64_round(v3, get64bits(input + i + 16));
+ *          v4 = XXH64_round(v4, get64bits(input + i + 24));
+ *      } while ((i += 32) <= len);
+ *      h64 = XXH64_mergerounds(v1, v2, v3, v4);
+ *  } else {
+ *      h64 = seed + XXH_PRIME64_5;
+ *  }
+ *  h64 += len;
+ *
+ *  for (; i + 8 <= len; i += 8) {
+ *      h64 ^= XXH64_round(0, get64bits(input + i));
+ *      h64 = rol64(h64, 27) * XXH_PRIME64_1 + XXH_PRIME64_4;
+ *  }
+ *  for (; i + 4 <= len; i += 4) {
+ *      h64 ^= get32bits(input + i) * PRIME64_1;
+ *      h64 = rol64(h64, 23) * XXH_PRIME64_2 + XXH_PRIME64_3;
+ *  }
+ *  for (; i < len; i += 1) {
+ *      h64 ^= get8bits(input + i) * XXH_PRIME64_5;
+ *      h64 = rol64(h64, 11) * XXH_PRIME64_1;
+ *  }
+ *
+ *  return XXH64_avalanche(h64)
+ *
+ * Exposing the pieces instead allows for simplified usage when
+ * the length is a known constant and the inputs are in registers.
+ */
+#define XXH_PRIME64_1   0x9E3779B185EBCA87ULL
+#define XXH_PRIME64_2   0xC2B2AE3D27D4EB4FULL
+#define XXH_PRIME64_3   0x165667B19E3779F9ULL
+#define XXH_PRIME64_4   0x85EBCA77C2B2AE63ULL
+#define XXH_PRIME64_5   0x27D4EB2F165667C5ULL
+
+static inline uint64_t XXH64_round(uint64_t acc, uint64_t input)
+{
+    return rol64(acc + input * XXH_PRIME64_2, 31) * XXH_PRIME64_1;
+}
+
+static inline uint64_t XXH64_mergeround(uint64_t acc, uint64_t val)
+{
+    return (acc ^ XXH64_round(0, val)) * XXH_PRIME64_1 + XXH_PRIME64_4;
+}
+
+static inline uint64_t XXH64_mergerounds(uint64_t v1, uint64_t v2,
+                                         uint64_t v3, uint64_t v4)
+{
+    uint64_t h64;
+
+    h64 = rol64(v1, 1) + rol64(v2, 7) + rol64(v3, 12) + rol64(v4, 18);
+    h64 = XXH64_mergeround(h64, v1);
+    h64 = XXH64_mergeround(h64, v2);
+    h64 = XXH64_mergeround(h64, v3);
+    h64 = XXH64_mergeround(h64, v4);
+
+    return h64;
+}
+
+static inline uint64_t XXH64_avalanche(uint64_t h64)
+{
+    h64 ^= h64 >> 33;
+    h64 *= XXH_PRIME64_2;
+    h64 ^= h64 >> 29;
+    h64 *= XXH_PRIME64_3;
+    h64 ^= h64 >> 32;
+    return h64;
+}
+
+static inline uint64_t qemu_xxhash64_4(uint64_t a, uint64_t b,
+                                       uint64_t c, uint64_t d)
+{
+    uint64_t v1 = QEMU_XXHASH_SEED + XXH_PRIME64_1 + XXH_PRIME64_2;
+    uint64_t v2 = QEMU_XXHASH_SEED + XXH_PRIME64_2;
+    uint64_t v3 = QEMU_XXHASH_SEED + 0;
+    uint64_t v4 = QEMU_XXHASH_SEED - XXH_PRIME64_1;
+
+    v1 = XXH64_round(v1, a);
+    v2 = XXH64_round(v2, b);
+    v3 = XXH64_round(v3, c);
+    v4 = XXH64_round(v4, d);
+
+    return XXH64_avalanche(XXH64_mergerounds(v1, v2, v3, v4));
+}
+
 #endif /* QEMU_XXHASH_H */
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_fcma(const ARMISARegisters *id)
 static inline bool isar_feature_aa64_pauth(const ARMISARegisters *id)
 {
     /*
-     * Note that while QEMU will only implement the architected algorithm
-     * QARMA, and thus APA+GPA, the host cpu for kvm may use implementation
-     * defined algorithms, and thus API+GPI, and this predicate controls
-     * migration of the 128-bit keys.
+     * Return true if any form of pauth is enabled, as this
+     * predicate controls migration of the 128-bit keys.
      */
     return (id->id_aa64isar1 &
             (FIELD_DP64(0, ID_AA64ISAR1, APA, 0xf) |
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_pauth(const ARMISARegisters *id)
              FIELD_DP64(0, ID_AA64ISAR1, GPI, 0xf))) != 0;
 }
 
+static inline bool isar_feature_aa64_pauth_arch(const ARMISARegisters *id)
+{
+    /*
+     * Return true if pauth is enabled with the architected QARMA algorithm.
+     * QEMU will always set APA+GPA to the same value.
+     */
+    return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, APA) != 0;
+}
+
 static inline bool isar_feature_aa64_sb(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64isar1, ID_AA64ISAR1, SB) != 0;
diff --git a/target/arm/pauth_helper.c b/target/arm/pauth_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/pauth_helper.c
+++ b/target/arm/pauth_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/cpu_ldst.h"
 #include "exec/helper-proto.h"
 #include "tcg/tcg-gvec-desc.h"
+#include "qemu/xxhash.h"
 
 
 static uint64_t pac_cell_shuffle(uint64_t i)
@@ -XXX,XX +XXX,XX @@ static uint64_t tweak_inv_shuffle(uint64_t i)
     return o;
 }
 
-static uint64_t pauth_computepac(uint64_t data, uint64_t modifier,
-                                 ARMPACKey key)
+static uint64_t pauth_computepac_architected(uint64_t data, uint64_t modifier,
+                                             ARMPACKey key)
 {
     static const uint64_t RC[5] = {
         0x0000000000000000ull,
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_computepac(uint64_t data, uint64_t modifier,
     return workingval;
 }
 
+static uint64_t pauth_computepac_impdef(uint64_t data, uint64_t modifier,
+                                        ARMPACKey key)
+{
+    return qemu_xxhash64_4(data, modifier, key.lo, key.hi);
+}
+
+static uint64_t pauth_computepac(CPUARMState *env, uint64_t data,
+                                 uint64_t modifier, ARMPACKey key)
+{
+    if (cpu_isar_feature(aa64_pauth_arch, env_archcpu(env))) {
+        return pauth_computepac_architected(data, modifier, key);
+    } else {
+        return pauth_computepac_impdef(data, modifier, key);
+    }
+}
+
 static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
                              ARMPACKey *key, bool data)
 {
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_addpac(CPUARMState *env, uint64_t ptr, uint64_t modifier,
     bot_bit = 64 - param.tsz;
     ext_ptr = deposit64(ptr, bot_bit, top_bit - bot_bit, ext);
 
-    pac = pauth_computepac(ext_ptr, modifier, *key);
+    pac = pauth_computepac(env, ext_ptr, modifier, *key);
 
     /*
      * Check if the ptr has good extension bits and corrupt the
@@ -XXX,XX +XXX,XX @@ static uint64_t pauth_auth(CPUARMState *env, uint64_t ptr, uint64_t modifier,
     uint64_t pac, orig_ptr, test;
 
     orig_ptr = pauth_original_ptr(ptr, param);
-    pac = pauth_computepac(orig_ptr, modifier, *key);
+    pac = pauth_computepac(env, orig_ptr, modifier, *key);
     bot_bit = 64 - param.tsz;
     top_bit = 64 - 8 * param.tbi;
 
@@ -XXX,XX +XXX,XX @@ uint64_t HELPER(pacga)(CPUARMState *env, uint64_t x, uint64_t y)
     uint64_t pac;
 
     pauth_check_trap(env, arm_current_el(env), GETPC());
-    pac = pauth_computepac(x, y, env->keys.apga);
+    pac = pauth_computepac(env, x, y, env->keys.apga);
 
     return pac & 0xffffffff00000000ull;
 }
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The crypto overhead of emulating pauth can be significant for
some workloads.  Add two boolean properties that allows the
feature to be turned off, on with the architected algorithm,
or on with an implementation defined algorithm.

We need two intermediate booleans to control the state while
parsing properties lest we clobber ID_AA64ISAR1 into an invalid
intermediate state.

Tested-by: Mark Rutland <mark.rutland@arm.com>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210111235740.462469-3-richard.henderson@linaro.org
[PMM: fixed docs typo, tweaked text to clarify that the impdef
algorithm is specific to QEMU]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst | 21 +++++++++++++++++
 target/arm/cpu.h                 | 10 ++++++++
 target/arm/cpu.c                 | 13 +++++++++++
 target/arm/cpu64.c               | 40 ++++++++++++++++++++++++++++----
 target/arm/monitor.c             |  1 +
 tests/qtest/arm-cpu-features.c   | 13 +++++++++++
 6 files changed, 94 insertions(+), 4 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ the list of KVM VCPU features and their descriptions.
                            influence the guest scheduler behavior and/or be
                            exposed to the guest userspace.
 
+TCG VCPU Features
+=================
+
+TCG VCPU features are CPU features that are specific to TCG.
+Below is the list of TCG VCPU features and their descriptions.
+
+  pauth                    Enable or disable `FEAT_Pauth`, pointer
+                           authentication.  By default, the feature is
+                           enabled with `-cpu max`.
+
+  pauth-impdef             When `FEAT_Pauth` is enabled, either the
+                           *impdef* (Implementation Defined) algorithm
+                           is enabled or the *architected* QARMA algorithm
+                           is enabled.  By default the impdef algorithm
+                           is disabled, and QARMA is enabled.
+
+                           The architected QARMA algorithm has good
+                           cryptographic properties, but can be quite slow
+                           to emulate.  The impdef algorithm used by QEMU
+                           is non-cryptographic but significantly faster.
+
 SVE CPU Properties
 ==================
 
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 #ifdef TARGET_AARCH64
 # define ARM_MAX_VQ    16
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
+void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
 #else
 # define ARM_MAX_VQ    1
 static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
+static inline void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp) { }
 #endif
 
 typedef struct ARMVectorReg {
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
     uint64_t reset_cbar;
     uint32_t reset_auxcr;
     bool reset_hivecs;
+
+    /*
+     * Intermediate values used during property parsing.
+     * Once finalized, the values should be read from ID_AA64ISAR1.
+     */
+    bool prop_pauth;
+    bool prop_pauth_impdef;
+
     /* DCZ blocksize, in log_2(words), ie low 4 bits of DCZID_EL0 */
     uint32_t dcz_blocksize;
     uint64_t rvbar;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
             error_propagate(errp, local_err);
             return;
         }
+
+        /*
+         * KVM does not support modifications to this feature.
+         * We have not registered the cpu properties when KVM
+         * is in use, so the user will not be able to set them.
+         */
+        if (!kvm_enabled()) {
+            arm_cpu_pauth_finalize(cpu, &local_err);
+            if (local_err != NULL) {
+                error_propagate(errp, local_err);
+                return;
+            }
+        }
     }
 
     if (kvm_enabled()) {
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/kvm.h"
 #include "kvm_arm.h"
 #include "qapi/visitor.h"
+#include "hw/qdev-properties.h"
+
 
 #ifndef CONFIG_USER_ONLY
 static uint64_t a57_a53_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
     }
 }
 
+void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
+{
+    int arch_val = 0, impdef_val = 0;
+    uint64_t t;
+
+    /* TODO: Handle HaveEnhancedPAC, HaveEnhancedPAC2, HaveFPAC. */
+    if (cpu->prop_pauth) {
+        if (cpu->prop_pauth_impdef) {
+            impdef_val = 1;
+        } else {
+            arch_val = 1;
+        }
+    } else if (cpu->prop_pauth_impdef) {
+        error_setg(errp, "cannot enable pauth-impdef without pauth");
+        error_append_hint(errp, "Add pauth=on to the CPU property list.\n");
+    }
+
+    t = cpu->isar.id_aa64isar1;
+    t = FIELD_DP64(t, ID_AA64ISAR1, APA, arch_val);
+    t = FIELD_DP64(t, ID_AA64ISAR1, GPA, arch_val);
+    t = FIELD_DP64(t, ID_AA64ISAR1, API, impdef_val);
+    t = FIELD_DP64(t, ID_AA64ISAR1, GPI, impdef_val);
+    cpu->isar.id_aa64isar1 = t;
+}
+
+static Property arm_cpu_pauth_property =
+    DEFINE_PROP_BOOL("pauth", ARMCPU, prop_pauth, true);
+static Property arm_cpu_pauth_impdef_property =
+    DEFINE_PROP_BOOL("pauth-impdef", ARMCPU, prop_pauth_impdef, false);
+
 /* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
  * otherwise, a CPU with as many features enabled as our emulation supports.
  * The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         t = FIELD_DP64(t, ID_AA64ISAR1, DPB, 2);
         t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 1);
         t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 1);
-        t = FIELD_DP64(t, ID_AA64ISAR1, APA, 1); /* PAuth, architected only */
-        t = FIELD_DP64(t, ID_AA64ISAR1, API, 0);
-        t = FIELD_DP64(t, ID_AA64ISAR1, GPA, 1);
-        t = FIELD_DP64(t, ID_AA64ISAR1, GPI, 0);
         t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);
         t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);
         t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 1);
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
         cpu->dcz_blocksize = 7; /*  512 bytes */
 #endif
+
+        /* Default to PAUTH on, with the architected algorithm. */
+        qdev_property_add_static(DEVICE(obj), &arm_cpu_pauth_property);
+        qdev_property_add_static(DEVICE(obj), &arm_cpu_pauth_impdef_property);
     }
 
     aarch64_add_sve_properties(obj);
diff --git a/target/arm/monitor.c b/target/arm/monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/monitor.c
+++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ static const char *cpu_model_advertised_features[] = {
     "sve640", "sve768", "sve896", "sve1024", "sve1152", "sve1280",
     "sve1408", "sve1536", "sve1664", "sve1792", "sve1920", "sve2048",
     "kvm-no-adjvtime", "kvm-steal-time",
+    "pauth", "pauth-impdef",
     NULL
 };
 
diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/arm-cpu-features.c
+++ b/tests/qtest/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void sve_tests_sve_off_kvm(const void *data)
     qtest_quit(qts);
 }
 
+static void pauth_tests_default(QTestState *qts, const char *cpu_type)
+{
+    assert_has_feature_enabled(qts, cpu_type, "pauth");
+    assert_has_feature_disabled(qts, cpu_type, "pauth-impdef");
+    assert_set_feature(qts, cpu_type, "pauth", false);
+    assert_set_feature(qts, cpu_type, "pauth", true);
+    assert_set_feature(qts, cpu_type, "pauth-impdef", true);
+    assert_set_feature(qts, cpu_type, "pauth-impdef", false);
+    assert_error(qts, cpu_type, "cannot enable pauth-impdef without pauth",
+                 "{ 'pauth': false, 'pauth-impdef': true }");
+}
+
 static void test_query_cpu_model_expansion(const void *data)
 {
     QTestState *qts;
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
         assert_has_feature_enabled(qts, "cortex-a57", "aarch64");
 
         sve_tests_default(qts, "max");
+        pauth_tests_default(qts, "max");
 
         /* Test that features that depend on KVM generate errors without. */
         assert_error(qts, "max",
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The interface for object_property_add_bool is simpler,
making the code easier to understand.

Reviewed-by: Andrew Jones <drjones@redhat.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210111235740.462469-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 24 ++++++++++--------------
 1 file changed, 10 insertions(+), 14 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
     cpu->sve_max_vq = max_vq;
 }
 
+/*
+ * Note that cpu_arm_get/set_sve_vq cannot use the simpler
+ * object_property_add_bool interface because they make use
+ * of the contents of "name" to determine which bit on which
+ * to operate.
+ */
 static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
                                void *opaque, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
     set_bit(vq - 1, cpu->sve_vq_init);
 }
 
-static void cpu_arm_get_sve(Object *obj, Visitor *v, const char *name,
-                            void *opaque, Error **errp)
+static bool cpu_arm_get_sve(Object *obj, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    bool value = cpu_isar_feature(aa64_sve, cpu);
-
-    visit_type_bool(v, name, &value, errp);
+    return cpu_isar_feature(aa64_sve, cpu);
 }
 
-static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
-                            void *opaque, Error **errp)
+static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    bool value;
     uint64_t t;
 
-    if (!visit_type_bool(v, name, &value, errp)) {
-        return;
-    }
-
     if (value && kvm_enabled() && !kvm_arm_sve_supported()) {
         error_setg(errp, "'sve' feature not supported by KVM on this host");
         return;
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
 {
     uint32_t vq;
 
-    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
-                        cpu_arm_set_sve, NULL, NULL);
+    object_property_add_bool(obj, "sve", cpu_arm_get_sve, cpu_arm_set_sve);
 
     for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
         char name[8];
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

In this context, the HCR value is the effective value, and thus is
zero in secure mode. The tests for HCR.{F,I}MO are sufficient.

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210112104511.36576-1-remi.denis.courmont@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c    |  8 ++++----
 target/arm/helper.c | 10 ++++------
 2 files changed, 8 insertions(+), 10 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
         break;
 
     case EXCP_VFIQ:
-        if (secure || !(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) {
-            /* VFIQs are only taken when hypervized and non-secure.  */
+        if (!(hcr_el2 & HCR_FMO) || (hcr_el2 & HCR_TGE)) {
+            /* VFIQs are only taken when hypervized.  */
             return false;
         }
         return !(env->daif & PSTATE_F);
     case EXCP_VIRQ:
-        if (secure || !(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) {
-            /* VIRQs are only taken when hypervized and non-secure.  */
+        if (!(hcr_el2 & HCR_IMO) || (hcr_el2 & HCR_TGE)) {
+            /* VIRQs are only taken when hypervized.  */
             return false;
         }
         return !(env->daif & PSTATE_I);
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void csselr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     CPUState *cs = env_cpu(env);
-    uint64_t hcr_el2 = arm_hcr_el2_eff(env);
+    bool el1 = arm_current_el(env) == 1;
+    uint64_t hcr_el2 = el1 ? arm_hcr_el2_eff(env) : 0;
     uint64_t ret = 0;
-    bool allow_virt = (arm_current_el(env) == 1 &&
-                       (!arm_is_secure_below_el3(env) ||
-                        (env->cp15.scr_el3 & SCR_EEL2)));
 
-    if (allow_virt && (hcr_el2 & HCR_IMO)) {
+    if (hcr_el2 & HCR_IMO) {
         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
             ret |= CPSR_I;
         }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
         }
     }
 
-    if (allow_virt && (hcr_el2 & HCR_FMO)) {
+    if (hcr_el2 & HCR_FMO) {
         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
             ret |= CPSR_F;
         }
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

This checks if EL2 is enabled (meaning EL2 registers take effects) in
the current security context.

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)
     return arm_is_secure_below_el3(env);
 }
 
+/*
+ * Return true if the current security state has AArch64 EL2 or AArch32 Hyp.
+ * This corresponds to the pseudocode EL2Enabled()
+ */
+static inline bool arm_is_el2_enabled(CPUARMState *env)
+{
+    if (arm_feature(env, ARM_FEATURE_EL2)) {
+        return !arm_is_secure_below_el3(env);
+    }
+    return false;
+}
+
 #else
 static inline bool arm_is_secure_below_el3(CPUARMState *env)
 {
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)
 {
     return false;
 }
+
+static inline bool arm_is_el2_enabled(CPUARMState *env)
+{
+    return false;
+}
 #endif
 
 /**
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

Do not assume that EL2 is available in and only in non-secure context.
That equivalence is broken by ARMv8.4-SEL2.

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210112104511.36576-3-remi.denis.courmont@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h        |  4 ++--
 target/arm/helper-a64.c |  8 +-------
 target/arm/helper.c     | 33 +++++++++++++--------------------
 3 files changed, 16 insertions(+), 29 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
         return aa64;
     }
 
-    if (arm_feature(env, ARM_FEATURE_EL2) && !arm_is_secure_below_el3(env)) {
+    if (arm_is_el2_enabled(env)) {
         aa64 = aa64 && (env->cp15.hcr_el2 & HCR_RW);
     }
 
@@ -XXX,XX +XXX,XX @@ static inline int arm_debug_target_el(CPUARMState *env)
     bool secure = arm_is_secure(env);
     bool route_to_el2 = false;
 
-    if (arm_feature(env, ARM_FEATURE_EL2) && !secure) {
+    if (arm_is_el2_enabled(env)) {
         route_to_el2 = env->cp15.hcr_el2 & HCR_TGE ||
                        env->cp15.mdcr_el2 & MDCR_TDE;
     }
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
     if (new_el == -1) {
         goto illegal_return;
     }
-    if (new_el > cur_el
-        || (new_el == 2 && !arm_feature(env, ARM_FEATURE_EL2))) {
+    if (new_el > cur_el || (new_el == 2 && !arm_is_el2_enabled(env))) {
         /* Disallow return to an EL which is unimplemented or higher
          * than the current one.
          */
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
         goto illegal_return;
     }
 
-    if (new_el == 2 && arm_is_secure_below_el3(env)) {
-        /* Return to the non-existent secure-EL2 */
-        goto illegal_return;
-    }
-
     if (new_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
         goto illegal_return;
     }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult cpacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     if (arm_feature(env, ARM_FEATURE_V8)) {
         /* Check if CPACR accesses are to be trapped to EL2 */
-        if (arm_current_el(env) == 1 &&
-            (env->cp15.cptr_el[2] & CPTR_TCPAC) && !arm_is_secure(env)) {
+        if (arm_current_el(env) == 1 && arm_is_el2_enabled(env) &&
+            (env->cp15.cptr_el[2] & CPTR_TCPAC)) {
             return CP_ACCESS_TRAP_EL2;
         /* Check if CPACR accesses are to be trapped to EL3 */
         } else if (arm_current_el(env) < 3 &&
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
                                         bool isread)
 {
     unsigned int cur_el = arm_current_el(env);
-    bool secure = arm_is_secure(env);
+    bool has_el2 = arm_is_el2_enabled(env);
     uint64_t hcr = arm_hcr_el2_eff(env);
 
     switch (cur_el) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
             }
         } else {
             /* If HCR_EL2.<E2H> == 0: check CNTHCTL_EL2.EL1PCEN. */
-            if (arm_feature(env, ARM_FEATURE_EL2) &&
-                timeridx == GTIMER_PHYS && !secure &&
+            if (has_el2 && timeridx == GTIMER_PHYS &&
                 !extract32(env->cp15.cnthctl_el2, 1, 1)) {
                 return CP_ACCESS_TRAP_EL2;
             }
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_counter_access(CPUARMState *env, int timeridx,
 
     case 1:
         /* Check CNTHCTL_EL2.EL1PCTEN, which changes location based on E2H. */
-        if (arm_feature(env, ARM_FEATURE_EL2) &&
-            timeridx == GTIMER_PHYS && !secure &&
+        if (has_el2 && timeridx == GTIMER_PHYS &&
             (hcr & HCR_E2H
              ? !extract32(env->cp15.cnthctl_el2, 10, 1)
              : !extract32(env->cp15.cnthctl_el2, 0, 1))) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
                                       bool isread)
 {
     unsigned int cur_el = arm_current_el(env);
-    bool secure = arm_is_secure(env);
+    bool has_el2 = arm_is_el2_enabled(env);
     uint64_t hcr = arm_hcr_el2_eff(env);
 
     switch (cur_el) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult gt_timer_access(CPUARMState *env, int timeridx,
         /* fall through */
 
     case 1:
-        if (arm_feature(env, ARM_FEATURE_EL2) &&
-            timeridx == GTIMER_PHYS && !secure) {
+        if (has_el2 && timeridx == GTIMER_PHYS) {
             if (hcr & HCR_E2H) {
                 /* If HCR_EL2.<E2H,TGE> == '10': check CNTHCTL_EL2.EL1PTEN. */
                 if (!extract32(env->cp15.cnthctl_el2, 11, 1)) {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo strongarm_cp_reginfo[] = {
 
 static uint64_t midr_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
-    ARMCPU *cpu = env_archcpu(env);
     unsigned int cur_el = arm_current_el(env);
-    bool secure = arm_is_secure(env);
 
-    if (arm_feature(&cpu->env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
+    if (arm_is_el2_enabled(env) && cur_el == 1) {
         return env->cp15.vpidr_el2;
     }
     return raw_read(env, ri);
@@ -XXX,XX +XXX,XX @@ static uint64_t mpidr_read_val(CPUARMState *env)
 static uint64_t mpidr_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     unsigned int cur_el = arm_current_el(env);
-    bool secure = arm_is_secure(env);
 
-    if (arm_feature(env, ARM_FEATURE_EL2) && !secure && cur_el == 1) {
+    if (arm_is_el2_enabled(env) && cur_el == 1) {
         return env->cp15.vmpidr_el2;
     }
     return mpidr_read_val(env);
@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff(CPUARMState *env)
 {
     uint64_t ret = env->cp15.hcr_el2;
 
-    if (arm_is_secure_below_el3(env)) {
+    if (!arm_is_el2_enabled(env)) {
         /*
          * "This register has no effect if EL2 is not enabled in the
          * current Security state".  This is ARMv8.4-SecEL2 speak for
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
     /* CPTR_EL2.  Since TZ and TFP are positive,
      * they will be zero when EL2 is not present.
      */
-    if (el <= 2 && !arm_is_secure_below_el3(env)) {
+    if (el <= 2 && arm_is_el2_enabled(env)) {
         if (env->cp15.cptr_el[2] & CPTR_TZ) {
             return 2;
         }
@@ -XXX,XX +XXX,XX @@ static int bad_mode_switch(CPUARMState *env, int mode, CPSRWriteType write_type)
         }
         return 0;
     case ARM_CPU_MODE_HYP:
-        return !arm_feature(env, ARM_FEATURE_EL2)
-            || arm_current_el(env) < 2 || arm_is_secure_below_el3(env);
+        return !arm_is_el2_enabled(env) || arm_current_el(env) < 2;
     case ARM_CPU_MODE_MON:
         return arm_current_el(env) < 3;
     default:
@@ -XXX,XX +XXX,XX @@ int fp_exception_el(CPUARMState *env, int cur_el)
 
     /* CPTR_EL2 : present in v7VE or v8 */
     if (cur_el <= 2 && extract32(env->cp15.cptr_el[2], 10, 1)
-        && !arm_is_secure_below_el3(env)) {
+        && arm_is_el2_enabled(env)) {
         /* Trap FP ops at EL2, NS-EL1 or NS-EL0 to EL2 */
         return 2;
     }
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

This will simplify accessing HCR conditionally in secure state.

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult aa64_cacheop_pou_access(CPUARMState *env,
 
 static int vae1_tlbmask(CPUARMState *env)
 {
-    /* Since we exclude secure first, we may read HCR_EL2 directly. */
-    if (arm_is_secure_below_el3(env)) {
-        return ARMMMUIdxBit_SE10_1 |
-               ARMMMUIdxBit_SE10_1_PAN |
-               ARMMMUIdxBit_SE10_0;
-    } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE))
-               == (HCR_E2H | HCR_TGE)) {
+    uint64_t hcr = arm_hcr_el2_eff(env);
+
+    if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
         return ARMMMUIdxBit_E20_2 |
                ARMMMUIdxBit_E20_2_PAN |
                ARMMMUIdxBit_E20_0;
+    } else if (arm_is_secure_below_el3(env)) {
+        return ARMMMUIdxBit_SE10_1 |
+               ARMMMUIdxBit_SE10_1_PAN |
+               ARMMMUIdxBit_SE10_0;
     } else {
         return ARMMMUIdxBit_E10_1 |
                ARMMMUIdxBit_E10_1_PAN |
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
 static inline bool regime_translation_disabled(CPUARMState *env,
                                                ARMMMUIdx mmu_idx)
 {
+    uint64_t hcr_el2;
+
     if (arm_feature(env, ARM_FEATURE_M)) {
         switch (env->v7m.mpu_ctrl[regime_is_secure(env, mmu_idx)] &
                 (R_V7M_MPU_CTRL_ENABLE_MASK | R_V7M_MPU_CTRL_HFNMIENA_MASK)) {
@@ -XXX,XX +XXX,XX @@ static inline bool regime_translation_disabled(CPUARMState *env,
         }
     }
 
+    hcr_el2 = arm_hcr_el2_eff(env);
+
     if (mmu_idx == ARMMMUIdx_Stage2) {
         /* HCR.DC means HCR.VM behaves as 1 */
-        return (env->cp15.hcr_el2 & (HCR_DC | HCR_VM)) == 0;
+        return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
     }
 
-    if (env->cp15.hcr_el2 & HCR_TGE) {
+    if (hcr_el2 & HCR_TGE) {
         /* TGE means that NS EL0/1 act as if SCTLR_EL1.M is zero */
         if (!regime_is_secure(env, mmu_idx) && regime_el(env, mmu_idx) == 1) {
             return true;
         }
     }
 
-    if ((env->cp15.hcr_el2 & HCR_DC) && arm_mmu_idx_is_stage1_of_2(mmu_idx)) {
+    if ((hcr_el2 & HCR_DC) && arm_mmu_idx_is_stage1_of_2(mmu_idx)) {
         /* HCR.DC means SCTLR_EL1.M behaves as 0 */
         return true;
     }
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
             fi->s1ptw = true;
             return ~0;
         }
-        if ((env->cp15.hcr_el2 & HCR_PTW) && (cacheattrs.attrs & 0xf0) == 0) {
+        if ((arm_hcr_el2_eff(env) & HCR_PTW) &&
+            (cacheattrs.attrs & 0xf0) == 0) {
             /*
              * PTW set and S1 walk touched S2 Device memory:
              * generate Permission fault.
@@ -XXX,XX +XXX,XX @@ static uint8_t convert_stage2_attrs(CPUARMState *env, uint8_t s2attrs)
     uint8_t hihint = 0, lohint = 0;
 
     if (hiattr != 0) { /* normal memory */
-        if ((env->cp15.hcr_el2 & HCR_CD) != 0) { /* cache disabled */
+        if (arm_hcr_el2_eff(env) & HCR_CD) { /* cache disabled */
             hiattr = loattr = 1; /* non-cacheable */
         } else {
             if (hiattr != 1) { /* Write-through or write-back */
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             }
 
             /* Combine the S1 and S2 cache attributes. */
-            if (env->cp15.hcr_el2 & HCR_DC) {
+            if (arm_hcr_el2_eff(env) & HCR_DC) {
                 /*
                  * HCR.DC forces the first stage attributes to
                  *  Normal Non-Shareable,
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

This adds a common helper to compute the effective value of MDCR_EL2.
That is the actual value if EL2 is enabled in the current security
context, or 0 elsewise.

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
     return CP_ACCESS_TRAP_UNCATEGORIZED;
 }
 
+static uint64_t arm_mdcr_el2_eff(CPUARMState *env)
+{
+    return arm_is_el2_enabled(env) ? env->cp15.mdcr_el2 : 0;
+}
+
 /* Check for traps to "powerdown debug" registers, which are controlled
  * by MDCR.TDOSA
  */
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
                                    bool isread)
 {
     int el = arm_current_el(env);
-    bool mdcr_el2_tdosa = (env->cp15.mdcr_el2 & MDCR_TDOSA) ||
-        (env->cp15.mdcr_el2 & MDCR_TDE) ||
+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
+    bool mdcr_el2_tdosa = (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TDE) ||
         (arm_hcr_el2_eff(env) & HCR_TGE);
 
-    if (el < 2 && mdcr_el2_tdosa && !arm_is_secure_below_el3(env)) {
+    if (el < 2 && mdcr_el2_tdosa) {
         return CP_ACCESS_TRAP_EL2;
     }
     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
                                   bool isread)
 {
     int el = arm_current_el(env);
-    bool mdcr_el2_tdra = (env->cp15.mdcr_el2 & MDCR_TDRA) ||
-        (env->cp15.mdcr_el2 & MDCR_TDE) ||
+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
+    bool mdcr_el2_tdra = (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE) ||
         (arm_hcr_el2_eff(env) & HCR_TGE);
 
-    if (el < 2 && mdcr_el2_tdra && !arm_is_secure_below_el3(env)) {
+    if (el < 2 && mdcr_el2_tdra) {
         return CP_ACCESS_TRAP_EL2;
     }
     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
                                   bool isread)
 {
     int el = arm_current_el(env);
-    bool mdcr_el2_tda = (env->cp15.mdcr_el2 & MDCR_TDA) ||
-        (env->cp15.mdcr_el2 & MDCR_TDE) ||
+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
+    bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) ||
         (arm_hcr_el2_eff(env) & HCR_TGE);
 
-    if (el < 2 && mdcr_el2_tda && !arm_is_secure_below_el3(env)) {
+    if (el < 2 && mdcr_el2_tda) {
         return CP_ACCESS_TRAP_EL2;
     }
     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tpm(CPUARMState *env, const ARMCPRegInfo *ri,
                                  bool isread)
 {
     int el = arm_current_el(env);
+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 
-    if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
-        && !arm_is_secure_below_el3(env)) {
+    if (el < 2 && (mdcr_el2 & MDCR_TPM)) {
         return CP_ACCESS_TRAP_EL2;
     }
     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult pmreg_access(CPUARMState *env, const ARMCPRegInfo *ri,
      * trapping to EL2 or EL3 for other accesses.
      */
     int el = arm_current_el(env);
+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 
     if (el == 0 && !(env->cp15.c9_pmuserenr & 1)) {
         return CP_ACCESS_TRAP;
     }
-    if (el < 2 && (env->cp15.mdcr_el2 & MDCR_TPM)
-        && !arm_is_secure_below_el3(env)) {
+    if (el < 2 && (mdcr_el2 & MDCR_TPM)) {
         return CP_ACCESS_TRAP_EL2;
     }
     if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TPM)) {
@@ -XXX,XX +XXX,XX @@ static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
     bool enabled, prohibited, filtered;
     bool secure = arm_is_secure(env);
     int el = arm_current_el(env);
-    uint8_t hpmn = env->cp15.mdcr_el2 & MDCR_HPMN;
+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
+    uint8_t hpmn = mdcr_el2 & MDCR_HPMN;
 
     if (!arm_feature(env, ARM_FEATURE_PMU)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool pmu_counter_enabled(CPUARMState *env, uint8_t counter)
             (counter < hpmn || counter == 31)) {
         e = env->cp15.c9_pmcr & PMCRE;
     } else {
-        e = env->cp15.mdcr_el2 & MDCR_HPME;
+        e = mdcr_el2 & MDCR_HPME;
     }
     enabled = e && (env->cp15.c9_pmcnten & (1 << counter));
 
     if (!secure) {
         if (el == 2 && (counter < hpmn || counter == 31)) {
-            prohibited = env->cp15.mdcr_el2 & MDCR_HPMD;
+            prohibited = mdcr_el2 & MDCR_HPMD;
         } else {
             prohibited = false;
         }
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210112104511.36576-6-remi.denis.courmont@huawei.com
[PMM: tweaked commit message to match reduced scope of patch
 following rebase]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_sve(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SVE) != 0;
 }
 
+static inline bool isar_feature_aa64_sel2(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, SEL2) != 0;
+}
+
 static inline bool isar_feature_aa64_vh(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, VH) != 0;
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

With the ARMv8.4-SEL2 extension, EL2 is a legal exception level in
secure mode, though it can only be AArch64.

This patch adds the target EL for exceptions from 64-bit S-EL2.

It also fixes the target EL to EL2 when HCR.{A,F,I}MO are set in secure
mode. Those values were never used in practice as the effective value of
HCR was always 0 in secure mode.

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210112104511.36576-7-remi.denis.courmont@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c    | 10 +++++-----
 target/arm/op_helper.c |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const int8_t target_el_table[2][2][2][2][2][4] = {
       {{/* 0   1   1   0 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},
        {/* 0   1   1   1 */{ 3,  3,  3, -1 },{ 3, -1, -1,  3 },},},},},
     {{{{/* 1   0   0   0 */{ 1,  1,  2, -1 },{ 1,  1, -1,  1 },},
-       {/* 1   0   0   1 */{ 2,  2,  2, -1 },{ 1,  1, -1,  1 },},},
-      {{/* 1   0   1   0 */{ 1,  1,  1, -1 },{ 1,  1, -1,  1 },},
-       {/* 1   0   1   1 */{ 2,  2,  2, -1 },{ 1,  1, -1,  1 },},},},
+       {/* 1   0   0   1 */{ 2,  2,  2, -1 },{ 2,  2, -1,  1 },},},
+      {{/* 1   0   1   0 */{ 1,  1,  1, -1 },{ 1,  1,  1,  1 },},
+       {/* 1   0   1   1 */{ 2,  2,  2, -1 },{ 2,  2,  2,  1 },},},},
      {{{/* 1   1   0   0 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},
        {/* 1   1   0   1 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},},
-      {{/* 1   1   1   0 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},
-       {/* 1   1   1   1 */{ 3,  3,  3, -1 },{ 3,  3, -1,  3 },},},},},
+      {{/* 1   1   1   0 */{ 3,  3,  3, -1 },{ 3,  3,  3,  3 },},
+       {/* 1   1   1   1 */{ 3,  3,  3, -1 },{ 3,  3,  3,  3 },},},},},
 };
 
 /*
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(access_check_cp_reg)(CPUARMState *env, void *rip, uint32_t syndrome,
         target_el = exception_target_el(env);
         break;
     case CP_ACCESS_TRAP_EL2:
-        /* Requesting a trap to EL2 when we're in EL3 or S-EL0/1 is
+        /* Requesting a trap to EL2 when we're in EL3 is
          * a bug in the access function.
          */
-        assert(!arm_is_secure(env) && arm_current_el(env) != 3);
+        assert(arm_current_el(env) != 3);
         target_el = 2;
         break;
     case CP_ACCESS_TRAP_EL3:
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

This adds the MMU indices for EL2 stage 1 in secure state.

To keep code contained, which is largelly identical between secure and
non-secure modes, the MMU indices are reassigned. The new assignments
provide a systematic pattern with a non-secure bit.

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210112104511.36576-8-remi.denis.courmont@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu-param.h     |   2 +-
 target/arm/cpu.h           |  35 ++++++----
 target/arm/internals.h     |  12 ++++
 target/arm/helper.c        | 127 ++++++++++++++++++++++++-------------
 target/arm/translate-a64.c |   4 ++
 5 files changed, 123 insertions(+), 57 deletions(-)

diff --git a/target/arm/cpu-param.h b/target/arm/cpu-param.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu-param.h
+++ b/target/arm/cpu-param.h
@@ -XXX,XX +XXX,XX @@
 # define TARGET_PAGE_BITS_MIN  10
 #endif
 
-#define NB_MMU_MODES 11
+#define NB_MMU_MODES 15
 
 #endif
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ bool write_cpustate_to_list(ARMCPU *cpu, bool kvm_sync);
 #define ARM_MMU_IDX_NOTLB 0x20  /* does not have a TLB */
 #define ARM_MMU_IDX_M     0x40  /* M profile */
 
+/* Meanings of the bits for A profile mmu idx values */
+#define ARM_MMU_IDX_A_NS     0x8
+
 /* Meanings of the bits for M profile mmu idx values */
 #define ARM_MMU_IDX_M_PRIV   0x1
 #define ARM_MMU_IDX_M_NEGPRI 0x2
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
     /*
      * A-profile.
      */
-    ARMMMUIdx_E10_0      =  0 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E20_0      =  1 | ARM_MMU_IDX_A,
+    ARMMMUIdx_SE10_0     =  0 | ARM_MMU_IDX_A,
+    ARMMMUIdx_SE20_0     =  1 | ARM_MMU_IDX_A,
+    ARMMMUIdx_SE10_1     =  2 | ARM_MMU_IDX_A,
+    ARMMMUIdx_SE20_2     =  3 | ARM_MMU_IDX_A,
+    ARMMMUIdx_SE10_1_PAN =  4 | ARM_MMU_IDX_A,
+    ARMMMUIdx_SE20_2_PAN =  5 | ARM_MMU_IDX_A,
+    ARMMMUIdx_SE2        =  6 | ARM_MMU_IDX_A,
+    ARMMMUIdx_SE3        =  7 | ARM_MMU_IDX_A,
 
-    ARMMMUIdx_E10_1      =  2 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E10_1_PAN  =  3 | ARM_MMU_IDX_A,
-
-    ARMMMUIdx_E2         =  4 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E20_2      =  5 | ARM_MMU_IDX_A,
-    ARMMMUIdx_E20_2_PAN  =  6 | ARM_MMU_IDX_A,
-
-    ARMMMUIdx_SE10_0     = 7 | ARM_MMU_IDX_A,
-    ARMMMUIdx_SE10_1     = 8 | ARM_MMU_IDX_A,
-    ARMMMUIdx_SE10_1_PAN = 9 | ARM_MMU_IDX_A,
-    ARMMMUIdx_SE3        = 10 | ARM_MMU_IDX_A,
+    ARMMMUIdx_E10_0     = ARMMMUIdx_SE10_0 | ARM_MMU_IDX_A_NS,
+    ARMMMUIdx_E20_0     = ARMMMUIdx_SE20_0 | ARM_MMU_IDX_A_NS,
+    ARMMMUIdx_E10_1     = ARMMMUIdx_SE10_1 | ARM_MMU_IDX_A_NS,
+    ARMMMUIdx_E20_2     = ARMMMUIdx_SE20_2 | ARM_MMU_IDX_A_NS,
+    ARMMMUIdx_E10_1_PAN = ARMMMUIdx_SE10_1_PAN | ARM_MMU_IDX_A_NS,
+    ARMMMUIdx_E20_2_PAN = ARMMMUIdx_SE20_2_PAN | ARM_MMU_IDX_A_NS,
+    ARMMMUIdx_E2        = ARMMMUIdx_SE2 | ARM_MMU_IDX_A_NS,
 
     /*
      * These are not allocated TLBs and are used only for AT system
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdxBit {
     TO_CORE_BIT(E20_2),
     TO_CORE_BIT(E20_2_PAN),
     TO_CORE_BIT(SE10_0),
+    TO_CORE_BIT(SE20_0),
     TO_CORE_BIT(SE10_1),
+    TO_CORE_BIT(SE20_2),
     TO_CORE_BIT(SE10_1_PAN),
+    TO_CORE_BIT(SE20_2_PAN),
+    TO_CORE_BIT(SE2),
     TO_CORE_BIT(SE3),
 
     TO_CORE_BIT(MUser),
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline bool regime_has_2_ranges(ARMMMUIdx mmu_idx)
     case ARMMMUIdx_SE10_0:
     case ARMMMUIdx_SE10_1:
     case ARMMMUIdx_SE10_1_PAN:
+    case ARMMMUIdx_SE20_0:
+    case ARMMMUIdx_SE20_2:
+    case ARMMMUIdx_SE20_2_PAN:
         return true;
     default:
         return false;
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
     case ARMMMUIdx_SE10_0:
     case ARMMMUIdx_SE10_1:
     case ARMMMUIdx_SE10_1_PAN:
+    case ARMMMUIdx_SE20_0:
+    case ARMMMUIdx_SE20_2:
+    case ARMMMUIdx_SE20_2_PAN:
+    case ARMMMUIdx_SE2:
     case ARMMMUIdx_MSPrivNegPri:
     case ARMMMUIdx_MSUserNegPri:
     case ARMMMUIdx_MSPriv:
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
     case ARMMMUIdx_E10_1_PAN:
     case ARMMMUIdx_E20_2_PAN:
     case ARMMMUIdx_SE10_1_PAN:
+    case ARMMMUIdx_SE20_2_PAN:
         return true;
     default:
         return false;
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
+    case ARMMMUIdx_SE20_0:
+    case ARMMMUIdx_SE20_2:
+    case ARMMMUIdx_SE20_2_PAN:
     case ARMMMUIdx_E20_0:
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
     case ARMMMUIdx_Stage2:
+    case ARMMMUIdx_SE2:
     case ARMMMUIdx_E2:
         return 2;
     case ARMMMUIdx_SE3:
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int gt_phys_redir_timeridx(CPUARMState *env)
     case ARMMMUIdx_E20_0:
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
+    case ARMMMUIdx_SE20_0:
+    case ARMMMUIdx_SE20_2:
+    case ARMMMUIdx_SE20_2_PAN:
         return GTIMER_HYP;
     default:
         return GTIMER_PHYS;
@@ -XXX,XX +XXX,XX @@ static int gt_virt_redir_timeridx(CPUARMState *env)
     case ARMMMUIdx_E20_0:
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
+    case ARMMMUIdx_SE20_0:
+    case ARMMMUIdx_SE20_2:
+    case ARMMMUIdx_SE20_2_PAN:
         return GTIMER_HYPVIRT;
     default:
         return GTIMER_VIRT;
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
             mmu_idx = ARMMMUIdx_SE3;
             break;
         case 2:
-            g_assert(!secure);  /* TODO: ARMv8.4-SecEL2 */
+            g_assert(!secure);  /* ARMv8.4-SecEL2 is 64-bit only */
             /* fall through */
         case 1:
             if (ri->crm == 9 && (env->uncached_cpsr & CPSR_PAN)) {
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
             }
             break;
         case 4: /* AT S1E2R, AT S1E2W */
-            mmu_idx = ARMMMUIdx_E2;
+            mmu_idx = secure ? ARMMMUIdx_SE2 : ARMMMUIdx_E2;
             break;
         case 6: /* AT S1E3R, AT S1E3W */
             mmu_idx = ARMMMUIdx_SE3;
@@ -XXX,XX +XXX,XX @@ static void vmsa_tcr_ttbr_el2_write(CPUARMState *env, const ARMCPRegInfo *ri,
      */
     if (extract64(raw_read(env, ri) ^ value, 48, 16) &&
         (arm_hcr_el2_eff(env) & HCR_E2H)) {
-        tlb_flush_by_mmuidx(env_cpu(env),
-                            ARMMMUIdxBit_E20_2 |
-                            ARMMMUIdxBit_E20_2_PAN |
-                            ARMMMUIdxBit_E20_0);
+        uint16_t mask = ARMMMUIdxBit_E20_2 |
+                        ARMMMUIdxBit_E20_2_PAN |
+                        ARMMMUIdxBit_E20_0;
+
+        if (arm_is_secure_below_el3(env)) {
+            mask >>= ARM_MMU_IDX_A_NS;
+        }
+
+        tlb_flush_by_mmuidx(env_cpu(env), mask);
     }
     raw_write(env, ri, value);
 }
@@ -XXX,XX +XXX,XX @@ static int vae1_tlbmask(CPUARMState *env)
     uint64_t hcr = arm_hcr_el2_eff(env);
 
     if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
-        return ARMMMUIdxBit_E20_2 |
-               ARMMMUIdxBit_E20_2_PAN |
-               ARMMMUIdxBit_E20_0;
+        uint16_t mask = ARMMMUIdxBit_E20_2 |
+                        ARMMMUIdxBit_E20_2_PAN |
+                        ARMMMUIdxBit_E20_0;
+
+        if (arm_is_secure_below_el3(env)) {
+            mask >>= ARM_MMU_IDX_A_NS;
+        }
+
+        return mask;
     } else if (arm_is_secure_below_el3(env)) {
         return ARMMMUIdxBit_SE10_1 |
                ARMMMUIdxBit_SE10_1_PAN |
@@ -XXX,XX +XXX,XX @@ static int tlbbits_for_regime(CPUARMState *env, ARMMMUIdx mmu_idx,
 
 static int vae1_tlbbits(CPUARMState *env, uint64_t addr)
 {
+    uint64_t hcr = arm_hcr_el2_eff(env);
     ARMMMUIdx mmu_idx;
 
     /* Only the regime of the mmu_idx below is significant. */
-    if (arm_is_secure_below_el3(env)) {
-        mmu_idx = ARMMMUIdx_SE10_0;
-    } else if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE))
-               == (HCR_E2H | HCR_TGE)) {
+    if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
         mmu_idx = ARMMMUIdx_E20_0;
     } else {
         mmu_idx = ARMMMUIdx_E10_0;
     }
+
+    if (arm_is_secure_below_el3(env)) {
+        mmu_idx &= ~ARM_MMU_IDX_A_NS;
+    }
+
     return tlbbits_for_regime(env, mmu_idx, addr);
 }
 
@@ -XXX,XX +XXX,XX @@ static int alle1_tlbmask(CPUARMState *env)
 
 static int e2_tlbmask(CPUARMState *env)
 {
-    /* TODO: ARMv8.4-SecEL2 */
-    return ARMMMUIdxBit_E20_0 |
-           ARMMMUIdxBit_E20_2 |
-           ARMMMUIdxBit_E20_2_PAN |
-           ARMMMUIdxBit_E2;
+    if (arm_is_secure_below_el3(env)) {
+        return ARMMMUIdxBit_SE20_0 |
+               ARMMMUIdxBit_SE20_2 |
+               ARMMMUIdxBit_SE20_2_PAN |
+               ARMMMUIdxBit_SE2;
+    } else {
+        return ARMMMUIdxBit_E20_0 |
+               ARMMMUIdxBit_E20_2 |
+               ARMMMUIdxBit_E20_2_PAN |
+               ARMMMUIdxBit_E2;
+    }
 }
 
 static void tlbi_aa64_alle1_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static void tlbi_aa64_vae2is_write(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     CPUState *cs = env_cpu(env);
     uint64_t pageaddr = sextract64(value << 12, 0, 56);
-    int bits = tlbbits_for_regime(env, ARMMMUIdx_E2, pageaddr);
+    bool secure = arm_is_secure_below_el3(env);
+    int mask = secure ? ARMMMUIdxBit_SE2 : ARMMMUIdxBit_E2;
+    int bits = tlbbits_for_regime(env, secure ? ARMMMUIdx_E2 : ARMMMUIdx_SE2,
+                                  pageaddr);
 
-    tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr,
-                                                  ARMMMUIdxBit_E2, bits);
+    tlb_flush_page_bits_by_mmuidx_all_cpus_synced(cs, pageaddr, mask, bits);
 }
 
 static void tlbi_aa64_vae3is_write(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ uint64_t arm_sctlr(CPUARMState *env, int el)
     /* Only EL0 needs to be adjusted for EL1&0 or EL2&0. */
     if (el == 0) {
         ARMMMUIdx mmu_idx = arm_mmu_idx_el(env, 0);
-        el = (mmu_idx == ARMMMUIdx_E20_0 ? 2 : 1);
+        el = (mmu_idx == ARMMMUIdx_E20_0 || mmu_idx == ARMMMUIdx_SE20_0)
+             ? 2 : 1;
     }
     return env->cp15.sctlr_el[el];
 }
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
     switch (mmu_idx) {
     case ARMMMUIdx_SE10_0:
     case ARMMMUIdx_E20_0:
+    case ARMMMUIdx_SE20_0:
     case ARMMMUIdx_Stage1_E0:
     case ARMMMUIdx_MUser:
     case ARMMMUIdx_MSUser:
@@ -XXX,XX +XXX,XX @@ int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
     case ARMMMUIdx_E10_0:
     case ARMMMUIdx_E20_0:
     case ARMMMUIdx_SE10_0:
+    case ARMMMUIdx_SE20_0:
         return 0;
     case ARMMMUIdx_E10_1:
     case ARMMMUIdx_E10_1_PAN:
@@ -XXX,XX +XXX,XX @@ int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx)
     case ARMMMUIdx_E2:
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
+    case ARMMMUIdx_SE2:
+    case ARMMMUIdx_SE20_2:
+    case ARMMMUIdx_SE20_2_PAN:
         return 2;
     case ARMMMUIdx_SE3:
         return 3;
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
 
 ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
 {
+    ARMMMUIdx idx;
+    uint64_t hcr;
+
     if (arm_feature(env, ARM_FEATURE_M)) {
         return arm_v7m_mmu_idx_for_secstate(env, env->v7m.secure);
     }
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_mmu_idx_el(CPUARMState *env, int el)
     /* See ARM pseudo-function ELIsInHost.  */
     switch (el) {
     case 0:
-        if (arm_is_secure_below_el3(env)) {
-            return ARMMMUIdx_SE10_0;
+        hcr = arm_hcr_el2_eff(env);
+        if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
+            idx = ARMMMUIdx_E20_0;
+        } else {
+            idx = ARMMMUIdx_E10_0;
         }
-        if ((env->cp15.hcr_el2 & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)
-            && arm_el_is_aa64(env, 2)) {
-            return ARMMMUIdx_E20_0;
-        }
-        return ARMMMUIdx_E10_0;
+        break;
     case 1:
-        if (arm_is_secure_below_el3(env)) {
-            if (env->pstate & PSTATE_PAN) {
-                return ARMMMUIdx_SE10_1_PAN;
-            }
-            return ARMMMUIdx_SE10_1;
-        }
         if (env->pstate & PSTATE_PAN) {
-            return ARMMMUIdx_E10_1_PAN;
+            idx = ARMMMUIdx_E10_1_PAN;
+        } else {
+            idx = ARMMMUIdx_E10_1;
         }
-        return ARMMMUIdx_E10_1;
+        break;
     case 2:
-        /* TODO: ARMv8.4-SecEL2 */
         /* Note that TGE does not apply at EL2.  */
-        if ((env->cp15.hcr_el2 & HCR_E2H) && arm_el_is_aa64(env, 2)) {
+        if (arm_hcr_el2_eff(env) & HCR_E2H) {
             if (env->pstate & PSTATE_PAN) {
-                return ARMMMUIdx_E20_2_PAN;
+                idx = ARMMMUIdx_E20_2_PAN;
+            } else {
+                idx = ARMMMUIdx_E20_2;
             }
-            return ARMMMUIdx_E20_2;
+        } else {
+            idx = ARMMMUIdx_E2;
         }
-        return ARMMMUIdx_E2;
+        break;
     case 3:
         return ARMMMUIdx_SE3;
     default:
         g_assert_not_reached();
     }
+
+    if (arm_is_secure_below_el3(env)) {
+        idx &= ~ARM_MMU_IDX_A_NS;
+    }
+
+    return idx;
 }
 
 ARMMMUIdx arm_mmu_idx(CPUARMState *env)
@@ -XXX,XX +XXX,XX @@ static uint32_t rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
             break;
         case ARMMMUIdx_E20_2:
         case ARMMMUIdx_E20_2_PAN:
-            /* TODO: ARMv8.4-SecEL2 */
+        case ARMMMUIdx_SE20_2:
+        case ARMMMUIdx_SE20_2_PAN:
             /*
              * Note that EL20_2 is gated by HCR_EL2.E2H == 1, but EL20_0 is
              * gated by HCR_EL2.<E2H,TGE> == '11', and so is LDTR.
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static int get_a64_user_mem_index(DisasContext *s)
         case ARMMMUIdx_SE10_1_PAN:
             useridx = ARMMMUIdx_SE10_0;
             break;
+        case ARMMMUIdx_SE20_2:
+        case ARMMMUIdx_SE20_2_PAN:
+            useridx = ARMMMUIdx_SE20_0;
+            break;
         default:
             g_assert_not_reached();
         }
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
     uint32_t base_mask;
 } TCR;
 
+#define VTCR_NSW (1u << 29)
+#define VTCR_NSA (1u << 30)
+#define VSTCR_SW VTCR_NSW
+#define VSTCR_SA VTCR_NSA
+
 /* Define a maximum sized vector register.
  * For 32-bit, this is a 128-bit NEON/AdvSIMD register.
  * For 64-bit, this is a 2048-bit SVE register.
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMState {
             uint64_t ttbr1_el[4];
         };
         uint64_t vttbr_el2; /* Virtualization Translation Table Base.  */
+        uint64_t vsttbr_el2; /* Secure Virtualization Translation Table. */
         /* MMU translation table base control. */
         TCR tcr_el[4];
         TCR vtcr_el2; /* Virtualization Translation Control.  */
+        TCR vstcr_el2; /* Secure Virtualization Translation Control. */
         uint32_t c2_data; /* MPU data cacheable bits.  */
         uint32_t c2_insn; /* MPU instruction cacheable bits.  */
         union { /* MMU domain access control register
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_v8_cp_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+static CPAccessResult sel2_access(CPUARMState *env, const ARMCPRegInfo *ri,
+                                  bool isread)
+{
+    if (arm_current_el(env) == 3 || arm_is_secure_below_el3(env)) {
+        return CP_ACCESS_OK;
+    }
+    return CP_ACCESS_TRAP_UNCATEGORIZED;
+}
+
+static const ARMCPRegInfo el2_sec_cp_reginfo[] = {
+    { .name = "VSTTBR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 0,
+      .access = PL2_RW, .accessfn = sel2_access,
+      .fieldoffset = offsetof(CPUARMState, cp15.vsttbr_el2) },
+    { .name = "VSTCR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 6, .opc2 = 2,
+      .access = PL2_RW, .accessfn = sel2_access,
+      .fieldoffset = offsetof(CPUARMState, cp15.vstcr_el2) },
+    REGINFO_SENTINEL
+};
+
 static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                    bool isread)
 {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         if (arm_feature(env, ARM_FEATURE_V8)) {
             define_arm_cp_regs(cpu, el2_v8_cp_reginfo);
         }
+        if (cpu_isar_feature(aa64_sel2, cpu)) {
+            define_arm_cp_regs(cpu, el2_sec_cp_reginfo);
+        }
         /* RVBAR_EL2 is only implemented if EL2 is the highest EL */
         if (!arm_feature(env, ARM_FEATURE_EL3)) {
             ARMCPRegInfo rvbar = {
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

The VTTBR write callback so far assumes that the underlying VM lies in
non-secure state. This handles the secure state scenario.

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void vttbr_write(CPUARMState *env, const ARMCPRegInfo *ri,
      * the combined stage 1&2 tlbs (EL10_1 and EL10_0).
      */
     if (raw_read(env, ri) != value) {
-        tlb_flush_by_mmuidx(cs,
-                            ARMMMUIdxBit_E10_1 |
-                            ARMMMUIdxBit_E10_1_PAN |
-                            ARMMMUIdxBit_E10_0);
+        uint16_t mask = ARMMMUIdxBit_E10_1 |
+                        ARMMMUIdxBit_E10_1_PAN |
+                        ARMMMUIdxBit_E10_0;
+
+        if (arm_is_secure_below_el3(env)) {
+            mask >>= ARM_MMU_IDX_A_NS;
+        }
+
+        tlb_flush_by_mmuidx(cs, mask);
         raw_write(env, ri, value);
     }
 }
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

In the secure stage 2 translation regime, the VSTCR.SW and VTCR.NSW
bits can invert the secure flag for pagetable walks. This patchset
allows S1_ptw_translate() to change the non-secure bit.

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
 
 /* Translate a S1 pagetable walk through S2 if needed.  */
 static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
-                               hwaddr addr, MemTxAttrs txattrs,
+                               hwaddr addr, bool *is_secure,
                                ARMMMUFaultInfo *fi)
 {
     if (arm_mmu_idx_is_stage1_of_2(mmu_idx) &&
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
         int s2prot;
         int ret;
         ARMCacheAttrs cacheattrs = {};
+        MemTxAttrs txattrs = {};
+
+        assert(!*is_secure); /* TODO: S-EL2 */
 
         ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, ARMMMUIdx_Stage2,
                                  false,
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUState *cs, hwaddr addr, bool is_secure,
     AddressSpace *as;
     uint32_t data;
 
+    addr = S1_ptw_translate(env, mmu_idx, addr, &is_secure, fi);
     attrs.secure = is_secure;
     as = arm_addressspace(cs, attrs);
-    addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
     if (fi->s1ptw) {
         return 0;
     }
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUState *cs, hwaddr addr, bool is_secure,
     AddressSpace *as;
     uint64_t data;
 
+    addr = S1_ptw_translate(env, mmu_idx, addr, &is_secure, fi);
     attrs.secure = is_secure;
     as = arm_addressspace(cs, attrs);
-    addr = S1_ptw_translate(env, mmu_idx, addr, attrs, fi);
     if (fi->s1ptw) {
         return 0;
     }
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
             fi->s1ptw = true;
             return ~0;
         }
+
+        if (arm_is_secure_below_el3(env)) {
+            /* Check if page table walk is to secure or non-secure PA space. */
+            if (*is_secure) {
+                *is_secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
+            } else {
+                *is_secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
+            }
+        } else {
+            assert(!*is_secure);
+        }
+
         addr = s2pa;
     }
     return addr;
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

The stage_1_mmu_idx() already effectively keeps track of which
translation regimes have two stages. Don't hard-code another test.

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                    target_ulong *page_size,
                    ARMMMUFaultInfo *fi, ARMCacheAttrs *cacheattrs)
 {
-    if (mmu_idx == ARMMMUIdx_E10_0 ||
-        mmu_idx == ARMMMUIdx_E10_1 ||
-        mmu_idx == ARMMMUIdx_E10_1_PAN) {
+    ARMMMUIdx s1_mmu_idx = stage_1_mmu_idx(mmu_idx);
+
+    if (mmu_idx != s1_mmu_idx) {
         /* Call ourselves recursively to do the stage 1 and then stage 2
-         * translations.
+         * translations if mmu_idx is a two-stage regime.
          */
         if (arm_feature(env, ARM_FEATURE_EL2)) {
             hwaddr ipa;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             int ret;
             ARMCacheAttrs cacheattrs2 = {};
 
-            ret = get_phys_addr(env, address, access_type,
-                                stage_1_mmu_idx(mmu_idx), &ipa, attrs,
-                                prot, page_size, fi, cacheattrs);
+            ret = get_phys_addr(env, address, access_type, s1_mmu_idx, &ipa,
+                                attrs, prot, page_size, fi, cacheattrs);
 
             /* If S1 fails or S2 is disabled, return early.  */
             if (ret || regime_translation_disabled(env, ARMMMUIdx_Stage2)) {
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210112104511.36576-14-remi.denis.courmont@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       |  6 +++-
 target/arm/internals.h | 22 ++++++++++++
 target/arm/helper.c    | 78 +++++++++++++++++++++++++++++-------------
 3 files changed, 81 insertions(+), 25 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
     ARMMMUIdx_Stage1_E0 = 0 | ARM_MMU_IDX_NOTLB,
     ARMMMUIdx_Stage1_E1 = 1 | ARM_MMU_IDX_NOTLB,
     ARMMMUIdx_Stage1_E1_PAN = 2 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_Stage1_SE0 = 3 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_Stage1_SE1 = 4 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_Stage1_SE1_PAN = 5 | ARM_MMU_IDX_NOTLB,
     /*
      * Not allocated a TLB: used only for second stage of an S12 page
      * table walk, or for descriptor loads during first stage of an S1
@@ -XXX,XX +XXX,XX @@ typedef enum ARMMMUIdx {
      * then various TLB flush insns which currently are no-ops or flush
      * only stage 1 MMU indexes will need to change to flush stage 2.
      */
-    ARMMMUIdx_Stage2     = 3 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_Stage2     = 6 | ARM_MMU_IDX_NOTLB,
+    ARMMMUIdx_Stage2_S   = 7 | ARM_MMU_IDX_NOTLB,
 
     /*
      * M-profile.
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline bool regime_has_2_ranges(ARMMMUIdx mmu_idx)
     case ARMMMUIdx_Stage1_E0:
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
+    case ARMMMUIdx_Stage1_SE0:
+    case ARMMMUIdx_Stage1_SE1:
+    case ARMMMUIdx_Stage1_SE1_PAN:
     case ARMMMUIdx_E10_0:
     case ARMMMUIdx_E10_1:
     case ARMMMUIdx_E10_1_PAN:
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_secure(CPUARMState *env, ARMMMUIdx mmu_idx)
     case ARMMMUIdx_SE20_0:
     case ARMMMUIdx_SE20_2:
     case ARMMMUIdx_SE20_2_PAN:
+    case ARMMMUIdx_Stage1_SE0:
+    case ARMMMUIdx_Stage1_SE1:
+    case ARMMMUIdx_Stage1_SE1_PAN:
     case ARMMMUIdx_SE2:
+    case ARMMMUIdx_Stage2_S:
     case ARMMMUIdx_MSPrivNegPri:
     case ARMMMUIdx_MSUserNegPri:
     case ARMMMUIdx_MSPriv:
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
     case ARMMMUIdx_Stage1_E1_PAN:
+    case ARMMMUIdx_Stage1_SE1_PAN:
     case ARMMMUIdx_E10_1_PAN:
     case ARMMMUIdx_E20_2_PAN:
     case ARMMMUIdx_SE10_1_PAN:
@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
     case ARMMMUIdx_E20_2:
     case ARMMMUIdx_E20_2_PAN:
     case ARMMMUIdx_Stage2:
+    case ARMMMUIdx_Stage2_S:
     case ARMMMUIdx_SE2:
     case ARMMMUIdx_E2:
         return 2;
     case ARMMMUIdx_SE3:
         return 3;
     case ARMMMUIdx_SE10_0:
+    case ARMMMUIdx_Stage1_SE0:
         return arm_el_is_aa64(env, 3) ? 1 : 3;
     case ARMMMUIdx_SE10_1:
     case ARMMMUIdx_SE10_1_PAN:
     case ARMMMUIdx_Stage1_E0:
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
+    case ARMMMUIdx_Stage1_SE1:
+    case ARMMMUIdx_Stage1_SE1_PAN:
     case ARMMMUIdx_E10_0:
     case ARMMMUIdx_E10_1:
     case ARMMMUIdx_E10_1_PAN:
@@ -XXX,XX +XXX,XX @@ static inline TCR *regime_tcr(CPUARMState *env, ARMMMUIdx mmu_idx)
     if (mmu_idx == ARMMMUIdx_Stage2) {
         return &env->cp15.vtcr_el2;
     }
+    if (mmu_idx == ARMMMUIdx_Stage2_S) {
+        /*
+         * Note: Secure stage 2 nominally shares fields from VTCR_EL2, but
+         * those are not currently used by QEMU, so just return VSTCR_EL2.
+         */
+        return &env->cp15.vstcr_el2;
+    }
     return &env->cp15.tcr_el[regime_el(env, mmu_idx)];
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool arm_mmu_idx_is_stage1_of_2(ARMMMUIdx mmu_idx)
     case ARMMMUIdx_Stage1_E0:
     case ARMMMUIdx_Stage1_E1:
     case ARMMMUIdx_Stage1_E1_PAN:
+    case ARMMMUIdx_Stage1_SE0:
+    case ARMMMUIdx_Stage1_SE1:
+    case ARMMMUIdx_Stage1_SE1_PAN:
         return true;
     default:
         return false;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
         uint32_t syn, fsr, fsc;
         bool take_exc = false;
 
-        if (fi.s1ptw && current_el == 1 && !arm_is_secure(env)
+        if (fi.s1ptw && current_el == 1
             && arm_mmu_idx_is_stage1_of_2(mmu_idx)) {
             /*
              * Synchronous stage 2 fault on an access made as part of the
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
             /* fall through */
         case 1:
             if (ri->crm == 9 && (env->uncached_cpsr & CPSR_PAN)) {
-                mmu_idx = (secure ? ARMMMUIdx_SE10_1_PAN
+                mmu_idx = (secure ? ARMMMUIdx_Stage1_SE1_PAN
                            : ARMMMUIdx_Stage1_E1_PAN);
             } else {
-                mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_Stage1_E1;
+                mmu_idx = secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1;
             }
             break;
         default:
@@ -XXX,XX +XXX,XX @@ static void ats_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
             mmu_idx = ARMMMUIdx_SE10_0;
             break;
         case 2:
+            g_assert(!secure);  /* ARMv8.4-SecEL2 is 64-bit only */
             mmu_idx = ARMMMUIdx_Stage1_E0;
             break;
         case 1:
-            mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_Stage1_E0;
+            mmu_idx = secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0;
             break;
         default:
             g_assert_not_reached();
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
         switch (ri->opc1) {
         case 0: /* AT S1E1R, AT S1E1W, AT S1E1RP, AT S1E1WP */
             if (ri->crm == 9 && (env->pstate & PSTATE_PAN)) {
-                mmu_idx = (secure ? ARMMMUIdx_SE10_1_PAN
+                mmu_idx = (secure ? ARMMMUIdx_Stage1_SE1_PAN
                            : ARMMMUIdx_Stage1_E1_PAN);
             } else {
-                mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_Stage1_E1;
+                mmu_idx = secure ? ARMMMUIdx_Stage1_SE1 : ARMMMUIdx_Stage1_E1;
             }
             break;
         case 4: /* AT S1E2R, AT S1E2W */
@@ -XXX,XX +XXX,XX @@ static void ats_write64(CPUARMState *env, const ARMCPRegInfo *ri,
         }
         break;
     case 2: /* AT S1E0R, AT S1E0W */
-        mmu_idx = secure ? ARMMMUIdx_SE10_0 : ARMMMUIdx_Stage1_E0;
+        mmu_idx = secure ? ARMMMUIdx_Stage1_SE0 : ARMMMUIdx_Stage1_E0;
         break;
     case 4: /* AT S12E1R, AT S12E1W */
         mmu_idx = secure ? ARMMMUIdx_SE10_1 : ARMMMUIdx_E10_1;
@@ -XXX,XX +XXX,XX @@ static inline bool regime_translation_disabled(CPUARMState *env,
 
     hcr_el2 = arm_hcr_el2_eff(env);
 
-    if (mmu_idx == ARMMMUIdx_Stage2) {
+    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
         /* HCR.DC means HCR.VM behaves as 1 */
         return (hcr_el2 & (HCR_DC | HCR_VM)) == 0;
     }
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
     if (mmu_idx == ARMMMUIdx_Stage2) {
         return env->cp15.vttbr_el2;
     }
+    if (mmu_idx == ARMMMUIdx_Stage2_S) {
+        return env->cp15.vsttbr_el2;
+    }
     if (ttbrn == 0) {
         return env->cp15.ttbr0_el[regime_el(env, mmu_idx)];
     } else {
@@ -XXX,XX +XXX,XX @@ static inline uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx,
 static inline ARMMMUIdx stage_1_mmu_idx(ARMMMUIdx mmu_idx)
 {
     switch (mmu_idx) {
+    case ARMMMUIdx_SE10_0:
+        return ARMMMUIdx_Stage1_SE0;
+    case ARMMMUIdx_SE10_1:
+        return ARMMMUIdx_Stage1_SE1;
+    case ARMMMUIdx_SE10_1_PAN:
+        return ARMMMUIdx_Stage1_SE1_PAN;
     case ARMMMUIdx_E10_0:
         return ARMMMUIdx_Stage1_E0;
     case ARMMMUIdx_E10_1:
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
     case ARMMMUIdx_E20_0:
     case ARMMMUIdx_SE20_0:
     case ARMMMUIdx_Stage1_E0:
+    case ARMMMUIdx_Stage1_SE0:
     case ARMMMUIdx_MUser:
     case ARMMMUIdx_MSUser:
     case ARMMMUIdx_MUserNegPri:
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
     int wxn = 0;
 
     assert(mmu_idx != ARMMMUIdx_Stage2);
+    assert(mmu_idx != ARMMMUIdx_Stage2_S);
 
     user_rw = simple_ap_to_rw_prot_is_user(ap, true);
     if (is_user) {
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
         hwaddr s2pa;
         int s2prot;
         int ret;
+        ARMMMUIdx s2_mmu_idx = *is_secure ? ARMMMUIdx_Stage2_S
+                                          : ARMMMUIdx_Stage2;
         ARMCacheAttrs cacheattrs = {};
         MemTxAttrs txattrs = {};
 
-        assert(!*is_secure); /* TODO: S-EL2 */
-
-        ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, ARMMMUIdx_Stage2,
-                                 false,
+        ret = get_phys_addr_lpae(env, addr, MMU_DATA_LOAD, s2_mmu_idx, false,
                                  &s2pa, &txattrs, &s2prot, &s2size, fi,
                                  &cacheattrs);
         if (ret) {
@@ -XXX,XX +XXX,XX @@ static int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx)
 {
     if (regime_has_2_ranges(mmu_idx)) {
         return extract64(tcr, 37, 2);
-    } else if (mmu_idx == ARMMMUIdx_Stage2) {
+    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
         return 0; /* VTCR_EL2 */
     } else {
         /* Replicate the single TBI bit so we always have 2 bits.  */
@@ -XXX,XX +XXX,XX @@ static int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx)
 {
     if (regime_has_2_ranges(mmu_idx)) {
         return extract64(tcr, 51, 2);
-    } else if (mmu_idx == ARMMMUIdx_Stage2) {
+    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
         return 0; /* VTCR_EL2 */
     } else {
         /* Replicate the single TBID bit so we always have 2 bits.  */
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         tsz = extract32(tcr, 0, 6);
         using64k = extract32(tcr, 14, 1);
         using16k = extract32(tcr, 15, 1);
-        if (mmu_idx == ARMMMUIdx_Stage2) {
+        if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
             /* VTCR_EL2 */
             hpd = false;
         } else {
@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,
     int select, tsz;
     bool epd, hpd;
 
+    assert(mmu_idx != ARMMMUIdx_Stage2_S);
+
     if (mmu_idx == ARMMMUIdx_Stage2) {
         /* VTCR */
         bool sext = extract32(tcr, 4, 1);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
         goto do_fault;
     }
 
-    if (mmu_idx != ARMMMUIdx_Stage2) {
+    if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
         /* The starting level depends on the virtual address size (which can
          * be up to 48 bits) and the translation granule size. It indicates
          * the number of strides (stride bits at a time) needed to
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
         attrs = extract64(descriptor, 2, 10)
             | (extract64(descriptor, 52, 12) << 10);
 
-        if (mmu_idx == ARMMMUIdx_Stage2) {
+        if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
             /* Stage 2 table descriptors do not include any attribute fields */
             break;
         }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
 
     ap = extract32(attrs, 4, 2);
 
-    if (mmu_idx == ARMMMUIdx_Stage2) {
-        ns = true;
+    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+        ns = mmu_idx == ARMMMUIdx_Stage2;
         xn = extract32(attrs, 11, 2);
         *prot = get_S2prot(env, ap, xn, s1_is_el0);
     } else {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
         arm_tlb_bti_gp(txattrs) = true;
     }
 
-    if (mmu_idx == ARMMMUIdx_Stage2) {
+    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
         cacheattrs->attrs = convert_stage2_attrs(env, extract32(attrs, 0, 4));
     } else {
         /* Index into MAIR registers for cache attributes */
@@ -XXX,XX +XXX,XX @@ do_fault:
     fi->type = fault_type;
     fi->level = level;
     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
-    fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2);
+    fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2 ||
+                               mmu_idx == ARMMMUIdx_Stage2_S);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             int s2_prot;
             int ret;
             ARMCacheAttrs cacheattrs2 = {};
+            ARMMMUIdx s2_mmu_idx;
+            bool is_el0;
 
             ret = get_phys_addr(env, address, access_type, s1_mmu_idx, &ipa,
                                 attrs, prot, page_size, fi, cacheattrs);
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 return ret;
             }
 
+            s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
+            is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
+
             /* S1 is done. Now do S2 translation.  */
-            ret = get_phys_addr_lpae(env, ipa, access_type, ARMMMUIdx_Stage2,
-                                     mmu_idx == ARMMMUIdx_E10_0,
+            ret = get_phys_addr_lpae(env, ipa, access_type, s2_mmu_idx, is_el0,
                                      phys_ptr, attrs, &s2_prot,
                                      page_size, fi, &cacheattrs2);
             fi->s2addr = ipa;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 cacheattrs->shareability = 0;
             }
             *cacheattrs = combine_cacheattrs(*cacheattrs, cacheattrs2);
+
+            /* Check if IPA translates to secure or non-secure PA space. */
+            if (arm_is_secure_below_el3(env)) {
+                if (attrs->secure) {
+                    attrs->secure =
+                        !(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));
+                } else {
+                    attrs->secure =
+                        !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
+                        || (env->cp15.vstcr_el2.raw_tcr & VSTCR_SA));
+                }
+            }
             return 0;
         } else {
             /*
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
          * MMU disabled.  S1 addresses within aa64 translation regimes are
          * still checked for bounds -- see AArch64.TranslateAddressS1Off.
          */
-        if (mmu_idx != ARMMMUIdx_Stage2) {
+        if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
             int r_el = regime_el(env, mmu_idx);
             if (arm_el_is_aa64(env, r_el)) {
                 int pamax = arm_pamax(env_archcpu(env));
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210112104511.36576-15-remi.denis.courmont@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h        | 2 ++
 target/arm/internals.h  | 2 ++
 target/arm/helper.c     | 6 ++++++
 target/arm/tlb_helper.c | 3 +++
 4 files changed, 13 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline void xpsr_write(CPUARMState *env, uint32_t val, uint32_t mask)
 #define HCR_TWEDEN    (1ULL << 59)
 #define HCR_TWEDEL    MAKE_64BIT_MASK(60, 4)
 
+#define HPFAR_NS      (1ULL << 63)
+
 #define SCR_NS                (1U << 0)
 #define SCR_IRQ               (1U << 1)
 #define SCR_FIQ               (1U << 2)
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFaultType {
  * @s2addr: Address that caused a fault at stage 2
  * @stage2: True if we faulted at stage 2
  * @s1ptw: True if we faulted at stage 2 while doing a stage 1 page-table walk
+ * @s1ns: True if we faulted on a non-secure IPA while in secure state
  * @ea: True if we should set the EA (external abort type) bit in syndrome
  */
 typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
@@ -XXX,XX +XXX,XX @@ struct ARMMMUFaultInfo {
     int domain;
     bool stage2;
     bool s1ptw;
+    bool s1ns;
     bool ea;
 };
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t do_ats_write(CPUARMState *env, uint64_t value,
                 target_el = 3;
             } else {
                 env->cp15.hpfar_el2 = extract64(fi.s2addr, 12, 47) << 4;
+                if (arm_is_secure_below_el3(env) && fi.s1ns) {
+                    env->cp15.hpfar_el2 |= HPFAR_NS;
+                }
                 target_el = 2;
             }
             take_exc = true;
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
             fi->s2addr = addr;
             fi->stage2 = true;
             fi->s1ptw = true;
+            fi->s1ns = !*is_secure;
             return ~0;
         }
         if ((arm_hcr_el2_eff(env) & HCR_PTW) &&
@@ -XXX,XX +XXX,XX @@ static hwaddr S1_ptw_translate(CPUARMState *env, ARMMMUIdx mmu_idx,
             fi->s2addr = addr;
             fi->stage2 = true;
             fi->s1ptw = true;
+            fi->s1ns = !*is_secure;
             return ~0;
         }
 
@@ -XXX,XX +XXX,XX @@ do_fault:
     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
     fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2 ||
                                mmu_idx == ARMMMUIdx_Stage2_S);
+    fi->s1ns = mmu_idx == ARMMMUIdx_Stage2;
     return true;
 }
 
diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tlb_helper.c
+++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,
     if (fi->stage2) {
         target_el = 2;
         env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
+        if (arm_is_secure_below_el3(env) && fi->s1ns) {
+            env->cp15.hpfar_el2 |= HPFAR_NS;
+        }
     }
     same_el = (arm_current_el(env) == target_el);
 
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

On ARMv8-A, accesses by 32-bit secure EL1 to monitor registers trap to
the upper (64-bit) EL. With Secure EL2 support, we can no longer assume
that that is always EL3, so make room for the value to be computed at
run-time.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void unallocated_encoding(DisasContext *s)
                        default_exception_el(s));
 }
 
+static void gen_exception_el(DisasContext *s, int excp, uint32_t syn,
+                             TCGv_i32 tcg_el)
+{
+    TCGv_i32 tcg_excp;
+    TCGv_i32 tcg_syn;
+
+    gen_set_condexec(s);
+    gen_set_pc_im(s, s->pc_curr);
+    tcg_excp = tcg_const_i32(excp);
+    tcg_syn = tcg_const_i32(syn);
+    gen_helper_exception_with_syndrome(cpu_env, tcg_excp, tcg_syn, tcg_el);
+    tcg_temp_free_i32(tcg_syn);
+    tcg_temp_free_i32(tcg_excp);
+    s->base.is_jmp = DISAS_NORETURN;
+}
+
 /* Force a TB lookup after an instruction that changes the CPU state.  */
 static inline void gen_lookup_tb(DisasContext *s)
 {
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
             /* If we're in Secure EL1 (which implies that EL3 is AArch64)
              * then accesses to Mon registers trap to EL3
              */
-            exc_target = 3;
-            goto undef;
+            TCGv_i32 tcg_el = tcg_const_i32(3);
+
+            gen_exception_el(s, EXCP_UDEF, syn_uncategorized(), tcg_el);
+            tcg_temp_free_i32(tcg_el);
+            return false;
         }
         break;
     case ARM_CPU_MODE_HYP:
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

This adds handling for the SCR_EL3.EEL2 bit.

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>
Message-id: 20210112104511.36576-17-remi.denis.courmont@huawei.com
[PMM: Applied fixes for review issues noted by RTH:
 - check for FEATURE_AARCH64 before checking sel2 isar feature
 - correct the commit message subject line]
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       |  8 ++++++--
 target/arm/cpu.c       |  2 +-
 target/arm/helper.c    | 19 ++++++++++++++++---
 target/arm/translate.c | 15 +++++++++++++--
 4 files changed, 36 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_is_secure(CPUARMState *env)
 static inline bool arm_is_el2_enabled(CPUARMState *env)
 {
     if (arm_feature(env, ARM_FEATURE_EL2)) {
-        return !arm_is_secure_below_el3(env);
+        if (arm_is_secure_below_el3(env)) {
+            return (env->cp15.scr_el3 & SCR_EEL2) != 0;
+        }
+        return true;
     }
     return false;
 }
@@ -XXX,XX +XXX,XX @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
         return aa64;
     }
 
-    if (arm_feature(env, ARM_FEATURE_EL3)) {
+    if (arm_feature(env, ARM_FEATURE_EL3) &&
+        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
         aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
     }
 
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
              * masked from Secure state. The HCR and SCR settings
              * don't affect the masking logic, only the interrupt routing.
              */
-            if (target_el == 3 || !secure) {
+            if (target_el == 3 || !secure || (env->cp15.scr_el3 & SCR_EEL2)) {
                 unmasked = true;
             }
         } else {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
         return CP_ACCESS_OK;
     }
     if (arm_is_secure_below_el3(env)) {
+        if (env->cp15.scr_el3 & SCR_EEL2) {
+            return CP_ACCESS_TRAP_EL2;
+        }
         return CP_ACCESS_TRAP_EL3;
     }
     /* This will be EL1 NS and EL2 NS, which just UNDEF */
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_pauth, cpu)) {
             valid_mask |= SCR_API | SCR_APK;
         }
+        if (cpu_isar_feature(aa64_sel2, cpu)) {
+            valid_mask |= SCR_EEL2;
+        }
         if (cpu_isar_feature(aa64_mte, cpu)) {
             valid_mask |= SCR_ATA;
         }
@@ -XXX,XX +XXX,XX @@ static CPAccessResult ats_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                  bool isread)
 {
     if (ri->opc2 & 4) {
-        /* The ATS12NSO* operations must trap to EL3 if executed in
+        /* The ATS12NSO* operations must trap to EL3 or EL2 if executed in
          * Secure EL1 (which can only happen if EL3 is AArch64).
          * They are simply UNDEF if executed from NS EL1.
          * They function normally from EL2 or EL3.
          */
         if (arm_current_el(env) == 1) {
             if (arm_is_secure_below_el3(env)) {
+                if (env->cp15.scr_el3 & SCR_EEL2) {
+                    return CP_ACCESS_TRAP_UNCATEGORIZED_EL2;
+                }
                 return CP_ACCESS_TRAP_UNCATEGORIZED_EL3;
             }
             return CP_ACCESS_TRAP_UNCATEGORIZED;
@@ -XXX,XX +XXX,XX @@ static void ats1h_write(CPUARMState *env, const ARMCPRegInfo *ri,
 static CPAccessResult at_s1e2_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                      bool isread)
 {
-    if (arm_current_el(env) == 3 && !(env->cp15.scr_el3 & SCR_NS)) {
+    if (arm_current_el(env) == 3 &&
+        !(env->cp15.scr_el3 & (SCR_NS | SCR_EEL2))) {
         return CP_ACCESS_TRAP;
     }
     return CP_ACCESS_OK;
@@ -XXX,XX +XXX,XX @@ static CPAccessResult nsacr_access(CPUARMState *env, const ARMCPRegInfo *ri,
                                    bool isread)
 {
     /* The NSACR is RW at EL3, and RO for NS EL1 and NS EL2.
-     * At Secure EL1 it traps to EL3.
+     * At Secure EL1 it traps to EL3 or EL2.
      */
     if (arm_current_el(env) == 3) {
         return CP_ACCESS_OK;
     }
     if (arm_is_secure_below_el3(env)) {
+        if (env->cp15.scr_el3 & SCR_EEL2) {
+            return CP_ACCESS_TRAP_EL2;
+        }
         return CP_ACCESS_TRAP_EL3;
     }
     /* Accesses from EL1 NS and EL2 NS are UNDEF for write but allow reads. */
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool msr_banked_access_decode(DisasContext *s, int r, int sysm, int rn,
         }
         if (s->current_el == 1) {
             /* If we're in Secure EL1 (which implies that EL3 is AArch64)
-             * then accesses to Mon registers trap to EL3
+             * then accesses to Mon registers trap to Secure EL2, if it exists,
+             * otherwise EL3.
              */
-            TCGv_i32 tcg_el = tcg_const_i32(3);
+            TCGv_i32 tcg_el;
+
+            if (arm_dc_feature(s, ARM_FEATURE_AARCH64) &&
+                dc_isar_feature(aa64_sel2, s)) {
+                /* Target EL is EL<3 minus SCR_EL3.EEL2> */
+                tcg_el = load_cpu_field(cp15.scr_el3);
+                tcg_gen_sextract_i32(tcg_el, tcg_el, ctz32(SCR_EEL2), 1);
+                tcg_gen_addi_i32(tcg_el, tcg_el, 3);
+            } else {
+                tcg_el = tcg_const_i32(3);
+            }
 
             gen_exception_el(s, EXCP_UDEF, syn_uncategorized(), tcg_el);
             tcg_temp_free_i32(tcg_el);
-- 
2.20.1

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult aa64_cacheop_pou_access(CPUARMState *env,
 static int vae1_tlbmask(CPUARMState *env)
 {
     uint64_t hcr = arm_hcr_el2_eff(env);
+    uint16_t mask;
 
     if ((hcr & (HCR_E2H | HCR_TGE)) == (HCR_E2H | HCR_TGE)) {
-        uint16_t mask = ARMMMUIdxBit_E20_2 |
-                        ARMMMUIdxBit_E20_2_PAN |
-                        ARMMMUIdxBit_E20_0;
-
-        if (arm_is_secure_below_el3(env)) {
-            mask >>= ARM_MMU_IDX_A_NS;
-        }
-
-        return mask;
-    } else if (arm_is_secure_below_el3(env)) {
-        return ARMMMUIdxBit_SE10_1 |
-               ARMMMUIdxBit_SE10_1_PAN |
-               ARMMMUIdxBit_SE10_0;
+        mask = ARMMMUIdxBit_E20_2 |
+               ARMMMUIdxBit_E20_2_PAN |
+               ARMMMUIdxBit_E20_0;
     } else {
-        return ARMMMUIdxBit_E10_1 |
+        mask = ARMMMUIdxBit_E10_1 |
                ARMMMUIdxBit_E10_1_PAN |
                ARMMMUIdxBit_E10_0;
     }
+
+    if (arm_is_secure_below_el3(env)) {
+        mask >>= ARM_MMU_IDX_A_NS;
+    }
+
+    return mask;
 }
 
 /* Return 56 if TBI is enabled, 64 otherwise. */
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

SVE predicate operations cannot use the "usual" simd_desc
encoding, because the lengths are not a multiple of 8.
But we were abusing the SIMD_* fields to store values anyway.
This abuse broke when SIMD_OPRSZ_BITS was modified in e2e7168a214.

Introduce a new set of field definitions for exclusive use
of predicates, so that it is obvious what kind of predicate
we are manipulating.  To be used in future patches.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210113062650.593824-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_log_exception(int idx);
 #define LOG2_TAG_GRANULE 4
 #define TAG_GRANULE      (1 << LOG2_TAG_GRANULE)
 
+/*
+ * SVE predicates are 1/8 the size of SVE vectors, and cannot use
+ * the same simd_desc() encoding due to restrictions on size.
+ * Use these instead.
+ */
+FIELD(PREDDESC, OPRSZ, 0, 6)
+FIELD(PREDDESC, ESZ, 6, 2)
+FIELD(PREDDESC, DATA, 8, 24)
+
 /*
  * The SVE simd_data field, for memory ops, contains either
  * rd (5 bits) or a shift count (2 bits).
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

These two were odd, in that do_pfirst_pnext passed the
count of 64-bit words rather than bytes.  Change to pass
the standard pred_full_reg_size to avoid confusion.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210113062650.593824-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c    | 7 ++++---
 target/arm/translate-sve.c | 6 +++---
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ static intptr_t last_active_element(uint64_t *g, intptr_t words, intptr_t esz)
     return (intptr_t)-1 << esz;
 }
 
-uint32_t HELPER(sve_pfirst)(void *vd, void *vg, uint32_t words)
+uint32_t HELPER(sve_pfirst)(void *vd, void *vg, uint32_t pred_desc)
 {
+    intptr_t words = DIV_ROUND_UP(FIELD_EX32(pred_desc, PREDDESC, OPRSZ), 8);
     uint32_t flags = PREDTEST_INIT;
     uint64_t *d = vd, *g = vg;
     intptr_t i = 0;
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(sve_pfirst)(void *vd, void *vg, uint32_t words)
 
 uint32_t HELPER(sve_pnext)(void *vd, void *vg, uint32_t pred_desc)
 {
-    intptr_t words = extract32(pred_desc, 0, SIMD_OPRSZ_BITS);
-    intptr_t esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
+    intptr_t words = DIV_ROUND_UP(FIELD_EX32(pred_desc, PREDDESC, OPRSZ), 8);
+    intptr_t esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
     uint32_t flags = PREDTEST_INIT;
     uint64_t *d = vd, *g = vg, esz_mask;
     intptr_t i, next;
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool do_pfirst_pnext(DisasContext *s, arg_rr_esz *a,
     TCGv_ptr t_pd = tcg_temp_new_ptr();
     TCGv_ptr t_pg = tcg_temp_new_ptr();
     TCGv_i32 t;
-    unsigned desc;
+    unsigned desc = 0;
 
-    desc = DIV_ROUND_UP(pred_full_reg_size(s), 8);
-    desc = deposit32(desc, SIMD_DATA_SHIFT, 2, a->esz);
+    desc = FIELD_DP32(desc, PREDDESC, OPRSZ, pred_full_reg_size(s));
+    desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
 
     tcg_gen_addi_ptr(t_pd, cpu_env, pred_full_reg_offset(s, a->rd));
     tcg_gen_addi_ptr(t_pg, cpu_env, pred_full_reg_offset(s, a->rn));
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Update all users of do_perm_pred3 for the new
predicate descriptor field definitions.

Cc: qemu-stable@nongnu.org
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210113062650.593824-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c    | 18 +++++++++---------
 target/arm/translate-sve.c | 12 ++++--------
 2 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t compress_bits(uint64_t x, int n)
 
 void HELPER(sve_zip_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
-    int esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
-    intptr_t high = extract32(pred_desc, SIMD_DATA_SHIFT + 2, 1);
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    int esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+    intptr_t high = FIELD_EX32(pred_desc, PREDDESC, DATA);
     uint64_t *d = vd;
     intptr_t i;
 
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_zip_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
 
 void HELPER(sve_uzp_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
-    int esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
-    int odd = extract32(pred_desc, SIMD_DATA_SHIFT + 2, 1) << esz;
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    int esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+    int odd = FIELD_EX32(pred_desc, PREDDESC, DATA) << esz;
     uint64_t *d = vd, *n = vn, *m = vm;
     uint64_t l, h;
     intptr_t i;
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_uzp_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
 
 void HELPER(sve_trn_p)(void *vd, void *vn, void *vm, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
-    uintptr_t esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
-    bool odd = extract32(pred_desc, SIMD_DATA_SHIFT + 2, 1);
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    int esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
+    int odd = FIELD_EX32(pred_desc, PREDDESC, DATA);
     uint64_t *d = vd, *n = vn, *m = vm;
     uint64_t mask;
     int shr, shl;
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool do_perm_pred3(DisasContext *s, arg_rrr_esz *a, bool high_odd,
 
     unsigned vsz = pred_full_reg_size(s);
 
-    /* Predicate sizes may be smaller and cannot use simd_desc.
-       We cannot round up, as we do elsewhere, because we need
-       the exact size for ZIP2 and REV.  We retain the style for
-       the other helpers for consistency.  */
     TCGv_ptr t_d = tcg_temp_new_ptr();
     TCGv_ptr t_n = tcg_temp_new_ptr();
     TCGv_ptr t_m = tcg_temp_new_ptr();
     TCGv_i32 t_desc;
-    int desc;
+    uint32_t desc = 0;
 
-    desc = vsz - 2;
-    desc = deposit32(desc, SIMD_DATA_SHIFT, 2, a->esz);
-    desc = deposit32(desc, SIMD_DATA_SHIFT + 2, 2, high_odd);
+    desc = FIELD_DP32(desc, PREDDESC, OPRSZ, vsz);
+    desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
+    desc = FIELD_DP32(desc, PREDDESC, DATA, high_odd);
 
     tcg_gen_addi_ptr(t_d, cpu_env, pred_full_reg_offset(s, a->rd));
     tcg_gen_addi_ptr(t_n, cpu_env, pred_full_reg_offset(s, a->rn));
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Update all users of do_perm_pred2 for the new
predicate descriptor field definitions.

Cc: qemu-stable@nongnu.org
Buglink: https://bugs.launchpad.net/bugs/1908551
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210113062650.593824-5-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c    |  8 ++++----
 target/arm/translate-sve.c | 13 ++++---------
 2 files changed, 8 insertions(+), 13 deletions(-)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ static uint8_t reverse_bits_8(uint8_t x, int n)
 
 void HELPER(sve_rev_p)(void *vd, void *vn, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
-    int esz = extract32(pred_desc, SIMD_DATA_SHIFT, 2);
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    int esz = FIELD_EX32(pred_desc, PREDDESC, ESZ);
     intptr_t i, oprsz_2 = oprsz / 2;
 
     if (oprsz <= 8) {
@@ -XXX,XX +XXX,XX @@ void HELPER(sve_rev_p)(void *vd, void *vn, uint32_t pred_desc)
 
 void HELPER(sve_punpk_p)(void *vd, void *vn, uint32_t pred_desc)
 {
-    intptr_t oprsz = extract32(pred_desc, 0, SIMD_OPRSZ_BITS) + 2;
-    intptr_t high = extract32(pred_desc, SIMD_DATA_SHIFT + 2, 1);
+    intptr_t oprsz = FIELD_EX32(pred_desc, PREDDESC, OPRSZ);
+    intptr_t high = FIELD_EX32(pred_desc, PREDDESC, DATA);
     uint64_t *d = vd;
     intptr_t i;
 
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool do_perm_pred2(DisasContext *s, arg_rr_esz *a, bool high_odd,
     TCGv_ptr t_d = tcg_temp_new_ptr();
     TCGv_ptr t_n = tcg_temp_new_ptr();
     TCGv_i32 t_desc;
-    int desc;
+    uint32_t desc = 0;
 
     tcg_gen_addi_ptr(t_d, cpu_env, pred_full_reg_offset(s, a->rd));
     tcg_gen_addi_ptr(t_n, cpu_env, pred_full_reg_offset(s, a->rn));
 
-    /* Predicate sizes may be smaller and cannot use simd_desc.
-       We cannot round up, as we do elsewhere, because we need
-       the exact size for ZIP2 and REV.  We retain the style for
-       the other helpers for consistency.  */
-
-    desc = vsz - 2;
-    desc = deposit32(desc, SIMD_DATA_SHIFT, 2, a->esz);
-    desc = deposit32(desc, SIMD_DATA_SHIFT + 2, 2, high_odd);
+    desc = FIELD_DP32(desc, PREDDESC, OPRSZ, vsz);
+    desc = FIELD_DP32(desc, PREDDESC, ESZ, a->esz);
+    desc = FIELD_DP32(desc, PREDDESC, DATA, high_odd);
     t_desc = tcg_const_i32(desc);
 
     fn(t_d, t_n, t_desc);
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

To ease the PCI device addition in next patches, split the code as follows:
- generic code (read/write/setup) is being kept in pvpanic.c
- ISA dependent code moved to pvpanic-isa.c

Also, rename:
- ISA_PVPANIC_DEVICE -> PVPANIC_ISA_DEVICE.
- TYPE_PVPANIC -> TYPE_PVPANIC_ISA.
- MemoryRegion io -> mr.
- pvpanic_ioport_* in pvpanic_*.

Update the build system with the new files and config structure.

Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/pvpanic.h | 23 +++++++++-
 hw/misc/pvpanic-isa.c     | 94 +++++++++++++++++++++++++++++++++++++++
 hw/misc/pvpanic.c         | 85 +++--------------------------------
 hw/i386/Kconfig           |  2 +-
 hw/misc/Kconfig           |  6 ++-
 hw/misc/meson.build       |  3 +-
 tests/qtest/meson.build   |  2 +-
 7 files changed, 130 insertions(+), 85 deletions(-)
 create mode 100644 hw/misc/pvpanic-isa.c

diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/pvpanic.h
+++ b/include/hw/misc/pvpanic.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qom/object.h"
 
-#define TYPE_PVPANIC "pvpanic"
+#define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
 
 #define PVPANIC_IOPORT_PROP "ioport"
 
+/* The bit of supported pv event, TODO: include uapi header and remove this */
+#define PVPANIC_F_PANICKED      0
+#define PVPANIC_F_CRASHLOADED   1
+
+/* The pv event value */
+#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
+#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
+
+/*
+ * PVPanicState for any device type
+ */
+typedef struct PVPanicState PVPanicState;
+struct PVPanicState {
+    MemoryRegion mr;
+    uint8_t events;
+};
+
+void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size);
+
 static inline uint16_t pvpanic_port(void)
 {
-    Object *o = object_resolve_path_type("", TYPE_PVPANIC, NULL);
+    Object *o = object_resolve_path_type("", TYPE_PVPANIC_ISA_DEVICE, NULL);
     if (!o) {
         return 0;
     }
diff --git a/hw/misc/pvpanic-isa.c b/hw/misc/pvpanic-isa.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/pvpanic-isa.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU simulated pvpanic device.
+ *
+ * Copyright Fujitsu, Corp. 2013
+ *
+ * Authors:
+ *     Wen Congyang <wency@cn.fujitsu.com>
+ *     Hu Tao <hutao@cn.fujitsu.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "sysemu/runstate.h"
+
+#include "hw/nvram/fw_cfg.h"
+#include "hw/qdev-properties.h"
+#include "hw/misc/pvpanic.h"
+#include "qom/object.h"
+#include "hw/isa/isa.h"
+
+OBJECT_DECLARE_SIMPLE_TYPE(PVPanicISAState, PVPANIC_ISA_DEVICE)
+
+/*
+ * PVPanicISAState for ISA device and
+ * use ioport.
+ */
+struct PVPanicISAState {
+    ISADevice parent_obj;
+
+    uint16_t ioport;
+    PVPanicState pvpanic;
+};
+
+static void pvpanic_isa_initfn(Object *obj)
+{
+    PVPanicISAState *s = PVPANIC_ISA_DEVICE(obj);
+
+    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 1);
+}
+
+static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
+{
+    ISADevice *d = ISA_DEVICE(dev);
+    PVPanicISAState *s = PVPANIC_ISA_DEVICE(dev);
+    PVPanicState *ps = &s->pvpanic;
+    FWCfgState *fw_cfg = fw_cfg_find();
+    uint16_t *pvpanic_port;
+
+    if (!fw_cfg) {
+        return;
+    }
+
+    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
+    *pvpanic_port = cpu_to_le16(s->ioport);
+    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
+                    sizeof(*pvpanic_port));
+
+    isa_register_ioport(d, &ps->mr, s->ioport);
+}
+
+static Property pvpanic_isa_properties[] = {
+    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicISAState, ioport, 0x505),
+    DEFINE_PROP_UINT8("events", PVPanicISAState, pvpanic.events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->realize = pvpanic_isa_realizefn;
+    device_class_set_props(dc, pvpanic_isa_properties);
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+}
+
+static TypeInfo pvpanic_isa_info = {
+    .name          = TYPE_PVPANIC_ISA_DEVICE,
+    .parent        = TYPE_ISA_DEVICE,
+    .instance_size = sizeof(PVPanicISAState),
+    .instance_init = pvpanic_isa_initfn,
+    .class_init    = pvpanic_isa_class_init,
+};
+
+static void pvpanic_register_types(void)
+{
+    type_register_static(&pvpanic_isa_info);
+}
+
+type_init(pvpanic_register_types)
diff --git a/hw/misc/pvpanic.c b/hw/misc/pvpanic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/pvpanic.c
+++ b/hw/misc/pvpanic.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/misc/pvpanic.h"
 #include "qom/object.h"
 
-/* The bit of supported pv event, TODO: include uapi header and remove this */
-#define PVPANIC_F_PANICKED      0
-#define PVPANIC_F_CRASHLOADED   1
-
-/* The pv event value */
-#define PVPANIC_PANICKED        (1 << PVPANIC_F_PANICKED)
-#define PVPANIC_CRASHLOADED     (1 << PVPANIC_F_CRASHLOADED)
-
-typedef struct PVPanicState PVPanicState;
-DECLARE_INSTANCE_CHECKER(PVPanicState, ISA_PVPANIC_DEVICE,
-                         TYPE_PVPANIC)
-
 static void handle_event(int event)
 {
     static bool logged;
@@ -XXX,XX +XXX,XX @@ static void handle_event(int event)
     }
 }
 
-#include "hw/isa/isa.h"
-
-struct PVPanicState {
-    ISADevice parent_obj;
-
-    MemoryRegion io;
-    uint16_t ioport;
-    uint8_t events;
-};
-
 /* return supported events on read */
-static uint64_t pvpanic_ioport_read(void *opaque, hwaddr addr, unsigned size)
+static uint64_t pvpanic_read(void *opaque, hwaddr addr, unsigned size)
 {
     PVPanicState *pvp = opaque;
     return pvp->events;
 }
 
-static void pvpanic_ioport_write(void *opaque, hwaddr addr, uint64_t val,
+static void pvpanic_write(void *opaque, hwaddr addr, uint64_t val,
                                  unsigned size)
 {
     handle_event(val);
 }
 
 static const MemoryRegionOps pvpanic_ops = {
-    .read = pvpanic_ioport_read,
-    .write = pvpanic_ioport_write,
+    .read = pvpanic_read,
+    .write = pvpanic_write,
     .impl = {
         .min_access_size = 1,
         .max_access_size = 1,
     },
 };
 
-static void pvpanic_isa_initfn(Object *obj)
+void pvpanic_setup_io(PVPanicState *s, DeviceState *dev, unsigned size)
 {
-    PVPanicState *s = ISA_PVPANIC_DEVICE(obj);
-
-    memory_region_init_io(&s->io, OBJECT(s), &pvpanic_ops, s, "pvpanic", 1);
+    memory_region_init_io(&s->mr, OBJECT(dev), &pvpanic_ops, s, "pvpanic", size);
 }
-
-static void pvpanic_isa_realizefn(DeviceState *dev, Error **errp)
-{
-    ISADevice *d = ISA_DEVICE(dev);
-    PVPanicState *s = ISA_PVPANIC_DEVICE(dev);
-    FWCfgState *fw_cfg = fw_cfg_find();
-    uint16_t *pvpanic_port;
-
-    if (!fw_cfg) {
-        return;
-    }
-
-    pvpanic_port = g_malloc(sizeof(*pvpanic_port));
-    *pvpanic_port = cpu_to_le16(s->ioport);
-    fw_cfg_add_file(fw_cfg, "etc/pvpanic-port", pvpanic_port,
-                    sizeof(*pvpanic_port));
-
-    isa_register_ioport(d, &s->io, s->ioport);
-}
-
-static Property pvpanic_isa_properties[] = {
-    DEFINE_PROP_UINT16(PVPANIC_IOPORT_PROP, PVPanicState, ioport, 0x505),
-    DEFINE_PROP_UINT8("events", PVPanicState, events, PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
-    DEFINE_PROP_END_OF_LIST(),
-};
-
-static void pvpanic_isa_class_init(ObjectClass *klass, void *data)
-{
-    DeviceClass *dc = DEVICE_CLASS(klass);
-
-    dc->realize = pvpanic_isa_realizefn;
-    device_class_set_props(dc, pvpanic_isa_properties);
-    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
-}
-
-static TypeInfo pvpanic_isa_info = {
-    .name          = TYPE_PVPANIC,
-    .parent        = TYPE_ISA_DEVICE,
-    .instance_size = sizeof(PVPanicState),
-    .instance_init = pvpanic_isa_initfn,
-    .class_init    = pvpanic_isa_class_init,
-};
-
-static void pvpanic_register_types(void)
-{
-    type_register_static(&pvpanic_isa_info);
-}
-
-type_init(pvpanic_register_types)
diff --git a/hw/i386/Kconfig b/hw/i386/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/Kconfig
+++ b/hw/i386/Kconfig
@@ -XXX,XX +XXX,XX @@ config PC
     imply ISA_DEBUG
     imply PARALLEL
     imply PCI_DEVICES
-    imply PVPANIC
+    imply PVPANIC_ISA
     imply QXL
     imply SEV
     imply SGA
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSCTL
 config IOTKIT_SYSINFO
     bool
 
-config PVPANIC
+config PVPANIC_COMMON
+    bool
+
+config PVPANIC_ISA
     bool
     depends on ISA_BUS
+    select PVPANIC_COMMON
 
 config AUX
     bool
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_EMC141X', if_true: files('emc141x.c'))
 softmmu_ss.add(when: 'CONFIG_UNIMP', if_true: files('unimp.c'))
 softmmu_ss.add(when: 'CONFIG_EMPTY_SLOT', if_true: files('empty_slot.c'))
 softmmu_ss.add(when: 'CONFIG_LED', if_true: files('led.c'))
+softmmu_ss.add(when: 'CONFIG_PVPANIC_COMMON', if_true: files('pvpanic.c'))
 
 # ARM devices
 softmmu_ss.add(when: 'CONFIG_PL310', if_true: files('arm_l2x0.c'))
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_IOTKIT_SYSINFO', if_true: files('iotkit-sysinfo.c')
 softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
 softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
 
-softmmu_ss.add(when: 'CONFIG_PVPANIC', if_true: files('pvpanic.c'))
+softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
 softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
 softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
 softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
   (config_host.has_key('CONFIG_LINUX') and                                                  \
    config_all_devices.has_key('CONFIG_ISA_IPMI_BT') ? ['ipmi-bt-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_WDT_IB700') ? ['wdt_ib700-test'] : []) +              \
-  (config_all_devices.has_key('CONFIG_PVPANIC') ? ['pvpanic-test'] : []) +                  \
+  (config_all_devices.has_key('CONFIG_PVPANIC_ISA') ? ['pvpanic-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_HDA') ? ['intel-hda-test'] : []) +                    \
   (config_all_devices.has_key('CONFIG_I82801B11') ? ['i82801b11-test'] : []) +             \
   (config_all_devices.has_key('CONFIG_IOH3420') ? ['ioh3420-test'] : []) +                  \
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

Add PCI interface support for PVPANIC device. Create a new file pvpanic-pci.c
where the PCI specific routines reside and update the build system with the new
files and config structure.

Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Reviewed-by: Gerd Hoffmann <kraxel@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: wrapped one long line]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/specs/pci-ids.txt    |  1 +
 include/hw/misc/pvpanic.h |  1 +
 include/hw/pci/pci.h      |  1 +
 hw/misc/pvpanic-pci.c     | 95 +++++++++++++++++++++++++++++++++++++++
 hw/misc/Kconfig           |  6 +++
 hw/misc/meson.build       |  1 +
 6 files changed, 105 insertions(+)
 create mode 100644 hw/misc/pvpanic-pci.c

diff --git a/docs/specs/pci-ids.txt b/docs/specs/pci-ids.txt
index XXXXXXX..XXXXXXX 100644
--- a/docs/specs/pci-ids.txt
+++ b/docs/specs/pci-ids.txt
@@ -XXX,XX +XXX,XX @@ PCI devices (other than virtio):
 1b36:000d  PCI xhci usb host adapter
 1b36:000f  mdpy (mdev sample device), linux/samples/vfio-mdev/mdpy.c
 1b36:0010  PCIe NVMe device (-device nvme)
+1b36:0011  PCI PVPanic device (-device pvpanic-pci)
 
 All these devices are documented in docs/specs.
 
diff --git a/include/hw/misc/pvpanic.h b/include/hw/misc/pvpanic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/pvpanic.h
+++ b/include/hw/misc/pvpanic.h
@@ -XXX,XX +XXX,XX @@
 #include "qom/object.h"
 
 #define TYPE_PVPANIC_ISA_DEVICE "pvpanic"
+#define TYPE_PVPANIC_PCI_DEVICE "pvpanic-pci"
 
 #define PVPANIC_IOPORT_PROP "ioport"
 
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -XXX,XX +XXX,XX @@ extern bool pci_available;
 #define PCI_DEVICE_ID_REDHAT_PCIE_BRIDGE 0x000e
 #define PCI_DEVICE_ID_REDHAT_MDPY        0x000f
 #define PCI_DEVICE_ID_REDHAT_NVME        0x0010
+#define PCI_DEVICE_ID_REDHAT_PVPANIC     0x0011
 #define PCI_DEVICE_ID_REDHAT_QXL         0x0100
 
 #define FMT_PCIBUS                      PRIx64
diff --git a/hw/misc/pvpanic-pci.c b/hw/misc/pvpanic-pci.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/misc/pvpanic-pci.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU simulated PCI pvpanic device.
+ *
+ * Copyright (C) 2020 Oracle
+ *
+ * Authors:
+ *     Mihai Carabas <mihai.carabas@oracle.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "sysemu/runstate.h"
+
+#include "hw/nvram/fw_cfg.h"
+#include "hw/qdev-properties.h"
+#include "migration/vmstate.h"
+#include "hw/misc/pvpanic.h"
+#include "qom/object.h"
+#include "hw/pci/pci.h"
+
+OBJECT_DECLARE_SIMPLE_TYPE(PVPanicPCIState, PVPANIC_PCI_DEVICE)
+
+/*
+ * PVPanicPCIState for PCI device
+ */
+typedef struct PVPanicPCIState {
+    PCIDevice dev;
+    PVPanicState pvpanic;
+} PVPanicPCIState;
+
+static const VMStateDescription vmstate_pvpanic_pci = {
+    .name = "pvpanic-pci",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(dev, PVPanicPCIState),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void pvpanic_pci_realizefn(PCIDevice *dev, Error **errp)
+{
+    PVPanicPCIState *s = PVPANIC_PCI_DEVICE(dev);
+    PVPanicState *ps = &s->pvpanic;
+
+    pvpanic_setup_io(&s->pvpanic, DEVICE(s), 2);
+
+    pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &ps->mr);
+}
+
+static Property pvpanic_pci_properties[] = {
+    DEFINE_PROP_UINT8("events", PVPanicPCIState, pvpanic.events,
+                      PVPANIC_PANICKED | PVPANIC_CRASHLOADED),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void pvpanic_pci_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *pc = PCI_DEVICE_CLASS(klass);
+
+    device_class_set_props(dc, pvpanic_pci_properties);
+
+    pc->realize = pvpanic_pci_realizefn;
+    pc->vendor_id = PCI_VENDOR_ID_REDHAT;
+    pc->device_id = PCI_DEVICE_ID_REDHAT_PVPANIC;
+    pc->revision = 1;
+    pc->class_id = PCI_CLASS_SYSTEM_OTHER;
+    dc->vmsd = &vmstate_pvpanic_pci;
+
+    set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+}
+
+static TypeInfo pvpanic_pci_info = {
+    .name          = TYPE_PVPANIC_PCI_DEVICE,
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(PVPanicPCIState),
+    .class_init    = pvpanic_pci_class_init,
+    .interfaces = (InterfaceInfo[]) {
+        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+        { }
+    }
+};
+
+static void pvpanic_register_types(void)
+{
+    type_register_static(&pvpanic_pci_info);
+}
+
+type_init(pvpanic_register_types);
diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconfig
@@ -XXX,XX +XXX,XX @@ config IOTKIT_SYSINFO
 config PVPANIC_COMMON
     bool
 
+config PVPANIC_PCI
+    bool
+    default y if PCI_DEVICES
+    depends on PCI
+    select PVPANIC_COMMON
+
 config PVPANIC_ISA
     bool
     depends on ISA_BUS
diff --git a/hw/misc/meson.build b/hw/misc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARMSSE_CPUID', if_true: files('armsse-cpuid.c'))
 softmmu_ss.add(when: 'CONFIG_ARMSSE_MHU', if_true: files('armsse-mhu.c'))
 
 softmmu_ss.add(when: 'CONFIG_PVPANIC_ISA', if_true: files('pvpanic-isa.c'))
+softmmu_ss.add(when: 'CONFIG_PVPANIC_PCI', if_true: files('pvpanic-pci.c'))
 softmmu_ss.add(when: 'CONFIG_AUX', if_true: files('auxbus.c'))
 softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_scu.c', 'aspeed_sdmc.c', 'aspeed_xdma.c'))
 softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('msf2-sysreg.c'))
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

Add pvpanic PCI device support details in docs/specs/pvpanic.txt.

Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
[fixed s/device/bus/ error]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/specs/pvpanic.txt | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/docs/specs/pvpanic.txt b/docs/specs/pvpanic.txt
index XXXXXXX..XXXXXXX 100644
--- a/docs/specs/pvpanic.txt
+++ b/docs/specs/pvpanic.txt
@@ -XXX,XX +XXX,XX @@
 PVPANIC DEVICE
 ==============
 
-pvpanic device is a simulated ISA device, through which a guest panic
+pvpanic device is a simulated device, through which a guest panic
 event is sent to qemu, and a QMP event is generated. This allows
 management apps (e.g. libvirt) to be notified and respond to the event.
 
@@ -XXX,XX +XXX,XX @@ The management app has the option of waiting for GUEST_PANICKED events,
 and/or polling for guest-panicked RunState, to learn when the pvpanic
 device has fired a panic event.
 
+The pvpanic device can be implemented as an ISA device (using IOPORT) or as a
+PCI device.
+
 ISA Interface
 -------------
 
@@ -XXX,XX +XXX,XX @@ bit 1: a guest panic has happened and will be handled by the guest;
        the host should record it or report it, but should not affect
        the execution of the guest.
 
+PCI Interface
+-------------
+
+The PCI interface is similar to the ISA interface except that it uses an MMIO
+address space provided by its BAR0, 1 byte long. Any machine with a PCI bus
+can enable a pvpanic device by adding '-device pvpanic-pci' to the command
+line.
+
 ACPI Interface
 --------------
 
-- 
2.20.1

From: Mihai Carabas <mihai.carabas@oracle.com>

Add a test case for pvpanic-pci device. The scenario is the same as pvpapnic
ISA device, but is using the PCI bus.

Signed-off-by: Mihai Carabas <mihai.carabas@oracle.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/pvpanic-pci-test.c | 62 ++++++++++++++++++++++++++++++++++
 tests/qtest/meson.build        |  1 +
 2 files changed, 63 insertions(+)
 create mode 100644 tests/qtest/pvpanic-pci-test.c

diff --git a/tests/qtest/pvpanic-pci-test.c b/tests/qtest/pvpanic-pci-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/pvpanic-pci-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for PV Panic PCI device
+ *
+ * Copyright (C) 2020 Oracle
+ *
+ * Authors:
+ *     Mihai Carabas <mihai.carabas@oracle.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "libqos/libqtest.h"
+#include "qapi/qmp/qdict.h"
+#include "libqos/pci.h"
+#include "libqos/pci-pc.h"
+#include "hw/pci/pci_regs.h"
+
+static void test_panic(void)
+{
+    uint8_t val;
+    QDict *response, *data;
+    QTestState *qts;
+    QPCIBus *pcibus;
+    QPCIDevice *dev;
+    QPCIBar bar;
+
+    qts = qtest_init("-device pvpanic-pci");
+    pcibus = qpci_new_pc(qts, NULL);
+    dev = qpci_device_find(pcibus, QPCI_DEVFN(0x4, 0x0));
+    qpci_device_enable(dev);
+    bar = qpci_iomap(dev, 0, NULL);
+
+    qpci_memread(dev, bar, 0, &val, sizeof(val));
+    g_assert_cmpuint(val, ==, 3);
+
+    val = 1;
+    qpci_memwrite(dev, bar, 0, &val, sizeof(val));
+
+    response = qtest_qmp_eventwait_ref(qts, "GUEST_PANICKED");
+    g_assert(qdict_haskey(response, "data"));
+    data = qdict_get_qdict(response, "data");
+    g_assert(qdict_haskey(data, "action"));
+    g_assert_cmpstr(qdict_get_str(data, "action"), ==, "pause");
+    qobject_unref(response);
+
+    qtest_quit(qts);
+}
+
+int main(int argc, char **argv)
+{
+    int ret;
+
+    g_test_init(&argc, &argv, NULL);
+    qtest_add_func("/pvpanic-pci/panic", test_panic);
+
+    ret = g_test_run();
+
+    return ret;
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ endif
 
 qtests_pci = \
   (config_all_devices.has_key('CONFIG_VGA') ? ['display-vga-test'] : []) +                  \
+  (config_all_devices.has_key('CONFIG_PVPANIC_PCI') ? ['pvpanic-pci-test'] : []) +          \
   (config_all_devices.has_key('CONFIG_IVSHMEM_DEVICE') ? ['ivshmem-test'] : [])
 
 qtests_i386 = \
-- 
2.20.1

From: Gan Qixin <ganqixin@huawei.com>

The adc_qom_set function didn't free "response", which caused an indirect
memory leak. So use qobject_unref() to fix it.

ASAN shows memory leak stack:

Indirect leak of 593280 byte(s) in 144 object(s) allocated from:
    #0 0x7f9a5e7e8d4e in __interceptor_calloc (/lib64/libasan.so.5+0x112d4e)
    #1 0x7f9a5e607a50 in g_malloc0 (/lib64/libglib-2.0.so.0+0x55a50)
    #2 0x55b1bebf636b in qdict_new ../qobject/qdict.c:30
    #3 0x55b1bec09699 in parse_object ../qobject/json-parser.c:318
    #4 0x55b1bec0b2df in parse_value ../qobject/json-parser.c:546
    #5 0x55b1bec0b6a9 in json_parser_parse ../qobject/json-parser.c:580
    #6 0x55b1bec060d1 in json_message_process_token ../qobject/json-streamer.c:92
    #7 0x55b1bec16a12 in json_lexer_feed_char ../qobject/json-lexer.c:313
    #8 0x55b1bec16fbd in json_lexer_feed ../qobject/json-lexer.c:350
    #9 0x55b1bec06453 in json_message_parser_feed ../qobject/json-streamer.c:121
    #10 0x55b1bebc2d51 in qmp_fd_receive ../tests/qtest/libqtest.c:614
    #11 0x55b1bebc2f5e in qtest_qmp_receive_dict ../tests/qtest/libqtest.c:636
    #12 0x55b1bebc2e6c in qtest_qmp_receive ../tests/qtest/libqtest.c:624
    #13 0x55b1bebc3340 in qtest_vqmp ../tests/qtest/libqtest.c:715
    #14 0x55b1bebc3942 in qtest_qmp ../tests/qtest/libqtest.c:756
    #15 0x55b1bebbd64a in adc_qom_set ../tests/qtest/npcm7xx_adc-test.c:127
    #16 0x55b1bebbd793 in adc_write_input ../tests/qtest/npcm7xx_adc-test.c:140
    #17 0x55b1bebbdf92 in test_convert_external ../tests/qtest/npcm7xx_adc-test.c:246

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Gan Qixin <ganqixin@huawei.com>
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Message-id: 20210118065627.79903-1-ganqixin@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_adc-test.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/tests/qtest/npcm7xx_adc-test.c b/tests/qtest/npcm7xx_adc-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_adc-test.c
+++ b/tests/qtest/npcm7xx_adc-test.c
@@ -XXX,XX +XXX,XX @@ static void adc_qom_set(QTestState *qts, const ADC *adc,
             path, name, value);
     /* The qom set message returns successfully. */
     g_assert_true(qdict_haskey(response, "return"));
+    qobject_unref(response);
 }
 
 static void adc_write_input(QTestState *qts, const ADC *adc,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

When building with GCC 10.2 configured with --extra-cflags=-Os, we get:

target/arm/m_helper.c: In function ‘arm_v7m_cpu_do_interrupt’:
  target/arm/m_helper.c:1811:16: error: ‘restore_s16_s31’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
   1811 |             if (restore_s16_s31) {
        |                ^
  target/arm/m_helper.c:1350:10: note: ‘restore_s16_s31’ was declared here
   1350 |     bool restore_s16_s31;
        |          ^~~~~~~~~~~~~~~
  cc1: all warnings being treated as errors

Initialize the 'restore_s16_s31' variable to silence the warning.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20210119062739.589049-1-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/m_helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static void do_v7m_exception_exit(ARMCPU *cpu)
     bool exc_secure = false;
     bool return_to_secure;
     bool ftype;
-    bool restore_s16_s31;
+    bool restore_s16_s31 = false;
 
     /*
      * If we're not in Handler mode then jumps to magic exception-exit
-- 
2.20.1

When we first converted our documentation to Sphinx, we split it into
multiple manuals (system, interop, tools, etc), which are all built
separately.  The primary driver for this was wanting to be able to
avoid shipping the 'devel' manual to end-users.  However, this is
working against the grain of the way Sphinx wants to be used and
causes some annoyances:
 * Cross-references between documents become much harder or
   possibly impossible
 * There is no single index to the whole documentation
 * Within one manual there's no links or table-of-contents info
   that lets you easily navigate to the others
 * The devel manual doesn't get published on the QEMU website
   (it would be nice to able to refer to it there)

Merely hiding our developer documentation from end users seems like
it's not enough benefit for these costs.  Combine all the
documentation into a single manual (the same way that the readthedocs
site builds it) and install the whole thing.  The previous manual
divisions remain as the new top level sections in the manual.

* The per-manual conf.py files are no longer needed
 * The man_pages[] specifications previously in each per-manual
   conf.py move to the top level conf.py
 * docs/meson.build logic is simplified as we now only need to run
   Sphinx once for the HTML and then once for the manpages5B
 * The old index.html.in that produced the top-level page with
   links to each manual is no longer needed

Unfortunately this means that we now have to build the HTML
documentation into docs/manual in the build tree rather than directly
into docs/; otherwise it is too awkward to ensure we install only the
built manual and not also the dependency info, stamp file, etc.  The
manual still ends up in the same place in the final installed
directory, but anybody who was consulting documentation from within
the build tree will have to adjust where they're looking.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20210115154449.4801-1-peter.maydell@linaro.org
---
 docs/conf.py         | 46 ++++++++++++++++++++++++++++++-
 docs/devel/conf.py   | 15 -----------
 docs/index.html.in   | 17 ------------
 docs/interop/conf.py | 28 -------------------
 docs/meson.build     | 64 +++++++++++++++++---------------------------
 docs/specs/conf.py   | 16 -----------
 docs/system/conf.py  | 28 -------------------
 docs/tools/conf.py   | 37 -------------------------
 docs/user/conf.py    | 15 -----------
 .gitlab-ci.yml       |  4 +--
 10 files changed, 72 insertions(+), 198 deletions(-)
 delete mode 100644 docs/devel/conf.py
 delete mode 100644 docs/index.html.in
 delete mode 100644 docs/interop/conf.py
 delete mode 100644 docs/specs/conf.py
 delete mode 100644 docs/system/conf.py
 delete mode 100644 docs/tools/conf.py
 delete mode 100644 docs/user/conf.py

diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@ latex_documents = [
 
 # -- Options for manual page output ---------------------------------------
 # Individual manual/conf.py can override this to create man pages
-man_pages = []
+man_pages = [
+    ('interop/qemu-ga', 'qemu-ga',
+     'QEMU Guest Agent',
+     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8),
+    ('interop/qemu-ga-ref', 'qemu-ga-ref',
+     'QEMU Guest Agent Protocol Reference',
+     [], 7),
+    ('interop/qemu-qmp-ref', 'qemu-qmp-ref',
+     'QEMU QMP Reference Manual',
+     [], 7),
+    ('interop/qemu-storage-daemon-qmp-ref', 'qemu-storage-daemon-qmp-ref',
+     'QEMU Storage Daemon QMP Reference Manual',
+     [], 7),
+    ('system/qemu-manpage', 'qemu',
+     'QEMU User Documentation',
+     ['Fabrice Bellard'], 1),
+    ('system/qemu-block-drivers', 'qemu-block-drivers',
+     'QEMU block drivers reference',
+     ['Fabrice Bellard and the QEMU Project developers'], 7),
+    ('system/qemu-cpu-models', 'qemu-cpu-models',
+     'QEMU CPU Models',
+     ['The QEMU Project developers'], 7),
+    ('tools/qemu-img', 'qemu-img',
+     'QEMU disk image utility',
+     ['Fabrice Bellard'], 1),
+    ('tools/qemu-nbd', 'qemu-nbd',
+     'QEMU Disk Network Block Device Server',
+     ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
+    ('tools/qemu-pr-helper', 'qemu-pr-helper',
+     'QEMU persistent reservation helper',
+     [], 8),
+    ('tools/qemu-storage-daemon', 'qemu-storage-daemon',
+     'QEMU storage daemon',
+     [], 1),
+    ('tools/qemu-trace-stap', 'qemu-trace-stap',
+     'QEMU SystemTap trace tool',
+     [], 1),
+    ('tools/virtfs-proxy-helper', 'virtfs-proxy-helper',
+     'QEMU 9p virtfs proxy filesystem helper',
+     ['M. Mohan Kumar'], 1),
+    ('tools/virtiofsd', 'virtiofsd',
+     'QEMU virtio-fs shared file system daemon',
+     ['Stefan Hajnoczi <stefanha@redhat.com>',
+      'Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>'], 1),
+]
 
 # -- Options for Texinfo output -------------------------------------------
 
diff --git a/docs/devel/conf.py b/docs/devel/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/devel/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'devel' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = u'Developer''s Guide'
diff --git a/docs/index.html.in b/docs/index.html.in
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/index.html.in
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-<!DOCTYPE html>
-<html lang="en">
-    <head>
-        <meta charset="UTF-8">
-        <title>QEMU @VERSION@ Documentation</title>
-    </head>
-    <body>
-        <h1>QEMU @VERSION@ Documentation</h1>
-        <ul>
-            <li><a href="system/index.html">System Emulation User's Guide</a></li>
-            <li><a href="user/index.html">User Mode Emulation User's Guide</a></li>
-            <li><a href="tools/index.html">Tools Guide</a></li>
-            <li><a href="interop/index.html">System Emulation Management and Interoperability Guide</a></li>
-            <li><a href="specs/index.html">System Emulation Guest Hardware Specifications</a></li>
-        </ul>
-    </body>
-</html>
diff --git a/docs/interop/conf.py b/docs/interop/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/interop/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'interop' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = u'System Emulation Management and Interoperability Guide'
-
-# One entry per manual page. List of tuples
-# (source start file, name, description, authors, manual section).
-man_pages = [
-    ('qemu-ga', 'qemu-ga', u'QEMU Guest Agent',
-     ['Michael Roth <mdroth@linux.vnet.ibm.com>'], 8),
-    ('qemu-ga-ref', 'qemu-ga-ref', 'QEMU Guest Agent Protocol Reference',
-     [], 7),
-    ('qemu-qmp-ref', 'qemu-qmp-ref', 'QEMU QMP Reference Manual',
-     [], 7),
-    ('qemu-storage-daemon-qmp-ref', 'qemu-storage-daemon-qmp-ref',
-     'QEMU Storage Daemon QMP Reference Manual', [], 7),
-]
diff --git a/docs/meson.build b/docs/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/docs/meson.build
+++ b/docs/meson.build
@@ -XXX,XX +XXX,XX @@ if build_docs
                           meson.source_root() / 'docs/sphinx/qmp_lexer.py',
                           qapi_gen_depends ]
 
-  configure_file(output: 'index.html',
-                 input: files('index.html.in'),
-                 configuration: {'VERSION': meson.project_version()},
-                 install_dir: qemu_docdir)
-  manuals = [ 'devel', 'interop', 'tools', 'specs', 'system', 'user' ]
   man_pages = {
-    'interop' : {
         'qemu-ga.8': (have_tools ? 'man8' : ''),
         'qemu-ga-ref.7': 'man7',
         'qemu-qmp-ref.7': 'man7',
         'qemu-storage-daemon-qmp-ref.7': (have_tools ? 'man7' : ''),
-    },
-    'tools': {
         'qemu-img.1': (have_tools ? 'man1' : ''),
         'qemu-nbd.8': (have_tools ? 'man8' : ''),
         'qemu-pr-helper.8': (have_tools ? 'man8' : ''),
@@ -XXX,XX +XXX,XX @@ if build_docs
         'qemu-trace-stap.1': (config_host.has_key('CONFIG_TRACE_SYSTEMTAP') ? 'man1' : ''),
         'virtfs-proxy-helper.1': (have_virtfs_proxy_helper ? 'man1' : ''),
         'virtiofsd.1': (have_virtiofsd ? 'man1' : ''),
-    },
-    'system': {
         'qemu.1': 'man1',
         'qemu-block-drivers.7': 'man7',
         'qemu-cpu-models.7': 'man7'
-    },
   }
 
   sphinxdocs = []
   sphinxmans = []
-  foreach manual : manuals
-    private_dir = meson.current_build_dir() / (manual + '.p')
-    output_dir = meson.current_build_dir() / manual
-    input_dir = meson.current_source_dir() / manual
 
-    this_manual = custom_target(manual + ' manual',
+  private_dir = meson.current_build_dir() / 'manual.p'
+  output_dir = meson.current_build_dir() / 'manual'
+  input_dir = meson.current_source_dir()
+
+  this_manual = custom_target('QEMU manual',
                 build_by_default: build_docs,
-                output: [manual + '.stamp'],
-                input: [files('conf.py'), files(manual / 'conf.py')],
-                depfile: manual + '.d',
+                output: 'docs.stamp',
+                input: files('conf.py'),
+                depfile: 'docs.d',
                 depend_files: sphinx_extn_depends,
                 command: [SPHINX_ARGS, '-Ddepfile=@DEPFILE@',
                           '-Ddepfile_stamp=@OUTPUT0@',
                           '-b', 'html', '-d', private_dir,
                           input_dir, output_dir])
-    sphinxdocs += this_manual
-    if build_docs and manual != 'devel'
-      install_subdir(output_dir, install_dir: qemu_docdir)
-    endif
+  sphinxdocs += this_manual
+  install_subdir(output_dir, install_dir: qemu_docdir, strip_directory: true)
 
-    these_man_pages = []
-    install_dirs = []
-    foreach page, section : man_pages.get(manual, {})
-      these_man_pages += page
-      install_dirs += section == '' ? false : get_option('mandir') / section
-    endforeach
-    if these_man_pages.length() > 0
-      sphinxmans += custom_target(manual + ' man pages',
-                         build_by_default: build_docs,
-                         output: these_man_pages,
-                         input: this_manual,
-                         install: build_docs,
-                         install_dir: install_dirs,
-                         command: [SPHINX_ARGS, '-b', 'man', '-d', private_dir,
-                                   input_dir, meson.current_build_dir()])
-    endif
+  these_man_pages = []
+  install_dirs = []
+  foreach page, section : man_pages
+    these_man_pages += page
+    install_dirs += section == '' ? false : get_option('mandir') / section
   endforeach
+
+  sphinxmans += custom_target('QEMU man pages',
+                              build_by_default: build_docs,
+                              output: these_man_pages,
+                              input: this_manual,
+                              install: build_docs,
+                              install_dir: install_dirs,
+                              command: [SPHINX_ARGS, '-b', 'man', '-d', private_dir,
+                                        input_dir, meson.current_build_dir()])
+
   alias_target('sphinxdocs', sphinxdocs)
   alias_target('html', sphinxdocs)
   alias_target('man', sphinxmans)
diff --git a/docs/specs/conf.py b/docs/specs/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/specs/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'specs' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = \
-    u'System Emulation Guest Hardware Specifications'
diff --git a/docs/system/conf.py b/docs/system/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/system/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'system' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = u'System Emulation User''s Guide'
-
-# One entry per manual page. List of tuples
-# (source start file, name, description, authors, manual section).
-man_pages = [
-    ('qemu-manpage', 'qemu', u'QEMU User Documentation',
-     ['Fabrice Bellard'], 1),
-    ('qemu-block-drivers', 'qemu-block-drivers',
-     u'QEMU block drivers reference',
-     ['Fabrice Bellard and the QEMU Project developers'], 7),
-    ('qemu-cpu-models', 'qemu-cpu-models',
-     u'QEMU CPU Models',
-     ['The QEMU Project developers'], 7)
-]
diff --git a/docs/tools/conf.py b/docs/tools/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/tools/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'tools' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = \
-    u'Tools Guide'
-
-# One entry per manual page. List of tuples
-# (source start file, name, description, authors, manual section).
-man_pages = [
-    ('qemu-img', 'qemu-img', u'QEMU disk image utility',
-     ['Fabrice Bellard'], 1),
-    ('qemu-storage-daemon', 'qemu-storage-daemon', u'QEMU storage daemon',
-     [], 1),
-    ('qemu-nbd', 'qemu-nbd', u'QEMU Disk Network Block Device Server',
-     ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
-    ('qemu-pr-helper', 'qemu-pr-helper', 'QEMU persistent reservation helper',
-     [], 8),
-    ('qemu-trace-stap', 'qemu-trace-stap', u'QEMU SystemTap trace tool',
-     [], 1),
-    ('virtfs-proxy-helper', 'virtfs-proxy-helper',
-     u'QEMU 9p virtfs proxy filesystem helper',
-     ['M. Mohan Kumar'], 1),
-    ('virtiofsd', 'virtiofsd', u'QEMU virtio-fs shared file system daemon',
-     ['Stefan Hajnoczi <stefanha@redhat.com>',
-      'Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>'], 1),
-]
diff --git a/docs/user/conf.py b/docs/user/conf.py
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/user/conf.py
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-# -*- coding: utf-8 -*-
-#
-# QEMU documentation build configuration file for the 'user' manual.
-#
-# This includes the top level conf file and then makes any necessary tweaks.
-import sys
-import os
-
-qemu_docdir = os.path.abspath("..")
-parent_config = os.path.join(qemu_docdir, "conf.py")
-exec(compile(open(parent_config, "rb").read(), parent_config, 'exec'))
-
-# This slightly misuses the 'description', but is the best way to get
-# the manual title to appear in the sidebar.
-html_theme_options['description'] = u'User Mode Emulation User''s Guide'
diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index XXXXXXX..XXXXXXX 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -XXX,XX +XXX,XX @@ pages:
         -t "Welcome to the QEMU sourcecode"
     - mv HTML public/src
     # Project documentation
-    - mv build/docs/index.html public/
-    - for i in devel interop specs system tools user ; do mv build/docs/$i public/ ; done
+    - make -C build install DESTDIR=$(pwd)/temp-install
+    - mv temp-install/usr/local/share/doc/qemu/* public/
   artifacts:
     paths:
       - public
-- 
2.20.1

Hi; here's a target-arm pullreq for rc0; these are all bugfixes
and similar minor stuff.

thanks
-- PMM

The following changes since commit 0462a32b4f63b2448b4a196381138afd50719dc4:

Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging (2025-03-14 09:31:13 +0800)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250314-1

for you to fetch changes up to a019e15edfd62beae1e2f6adc0fa7415ba20b14c:

meson.build: Set RUST_BACKTRACE for all tests (2025-03-14 12:54:33 +0000)

----------------------------------------------------------------
target-arm queue:
 * Correctly handle corner cases of guest attempting an exception
   return to AArch32 when target EL is AArch64 only
 * MAINTAINERS: Fix status for Arm boards I "maintain"
 * tests/functional: Bump up arm_replay timeout
 * Revert "hw/char/pl011: Warn when using disabled receiver"
 * util/cacheflush: Make first DSB unconditional on aarch64
 * target/arm: Fix SVE/SME access check logic
 * meson.build: Set RUST_BACKTRACE for all tests

----------------------------------------------------------------
Joe Komlodi (1):
      util/cacheflush: Make first DSB unconditional on aarch64

Paolo Bonzini (1):
      Revert "hw/char/pl011: Warn when using disabled receiver"

Peter Maydell (13):
      target/arm: Move A32_BANKED_REG_{GET,SET} macros to cpregs.h
      target/arm: Un-inline access_secure_reg()
      linux-user/aarch64: Remove unused get/put_user macros
      linux-user/arm: Remove unused get_put_user macros
      target/arm: Move arm_cpu_data_is_big_endian() etc to internals.h
      target/arm: Move arm_current_el() and arm_el_is_aa64() to internals.h
      target/arm: SCR_EL3.RW should be treated as 1 if EL2 doesn't support AArch32
      target/arm: HCR_EL2.RW should be RAO/WI if EL1 doesn't support AArch32
      target/arm: Add cpu local variable to exception_return helper
      target/arm: Forbid return to AArch32 when CPU is AArch64-only
      MAINTAINERS: Fix status for Arm boards I "maintain"
      tests/functional: Bump up arm_replay timeout
      meson.build: Set RUST_BACKTRACE for all tests

Richard Henderson (2):
      target/arm: Make DisasContext.{fp, sve}_access_checked tristate
      target/arm: Simplify pstate_sm check in sve_access_check

The A32_BANKED_REG_{GET,SET} macros are only used inside target/arm;
move their definitions to cpregs.h. There's no need to have them
defined in all the code that includes cpu.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpregs.h | 28 ++++++++++++++++++++++++++++
 target/arm/cpu.h    | 27 ---------------------------
 2 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_cpreg_traps_in_nv(const ARMCPRegInfo *ri)
     return ri->opc1 == 4 || ri->opc1 == 5;
 }
 
+/* Macros for accessing a specified CP register bank */
+#define A32_BANKED_REG_GET(_env, _regname, _secure)                     \
+    ((_secure) ? (_env)->cp15._regname##_s : (_env)->cp15._regname##_ns)
+
+#define A32_BANKED_REG_SET(_env, _regname, _secure, _val)       \
+    do {                                                        \
+        if (_secure) {                                          \
+            (_env)->cp15._regname##_s = (_val);                 \
+        } else {                                                \
+            (_env)->cp15._regname##_ns = (_val);                \
+        }                                                       \
+    } while (0)
+
+/*
+ * Macros for automatically accessing a specific CP register bank depending on
+ * the current secure state of the system.  These macros are not intended for
+ * supporting instruction translation reads/writes as these are dependent
+ * solely on the SCR.NS bit and not the mode.
+ */
+#define A32_BANKED_CURRENT_REG_GET(_env, _regname)                          \
+    A32_BANKED_REG_GET((_env), _regname,                                    \
+                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)))
+
+#define A32_BANKED_CURRENT_REG_SET(_env, _regname, _val)                    \
+    A32_BANKED_REG_SET((_env), _regname,                                    \
+                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)), \
+                       (_val))
+
 #endif /* TARGET_ARM_CPREGS_H */
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool access_secure_reg(CPUARMState *env)
     return ret;
 }
 
-/* Macros for accessing a specified CP register bank */
-#define A32_BANKED_REG_GET(_env, _regname, _secure)    \
-    ((_secure) ? (_env)->cp15._regname##_s : (_env)->cp15._regname##_ns)
-
-#define A32_BANKED_REG_SET(_env, _regname, _secure, _val)   \
-    do {                                                \
-        if (_secure) {                                   \
-            (_env)->cp15._regname##_s = (_val);            \
-        } else {                                        \
-            (_env)->cp15._regname##_ns = (_val);           \
-        }                                               \
-    } while (0)
-
-/* Macros for automatically accessing a specific CP register bank depending on
- * the current secure state of the system.  These macros are not intended for
- * supporting instruction translation reads/writes as these are dependent
- * solely on the SCR.NS bit and not the mode.
- */
-#define A32_BANKED_CURRENT_REG_GET(_env, _regname)        \
-    A32_BANKED_REG_GET((_env), _regname,                \
-                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)))
-
-#define A32_BANKED_CURRENT_REG_SET(_env, _regname, _val)                       \
-    A32_BANKED_REG_SET((_env), _regname,                                    \
-                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)), \
-                       (_val))
-
 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
                                  uint32_t cur_el, bool secure);
 
-- 
2.43.0

We would like to move arm_el_is_aa64() to internals.h; however, it is
used by access_secure_reg().  Make that function not be inline, so
that it can stay in cpu.h.

access_secure_reg() is used only in two places:
 * in hflags.c
 * in the user-mode arm emulators, to decide whether to store
   the TLS value in the secure or non-secure banked field

The second of these is not on a super-hot path that would care about
the inlining (and incidentally will always use the NS banked field
because our user-mode CPUs never set ARM_FEATURE_EL3); put the
definition of access_secure_reg() in hflags.c, near its only use
inside target/arm.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h        | 12 +++---------
 target/arm/tcg/hflags.c |  9 +++++++++
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
     return aa64;
 }
 
-/* Function for determining whether guest cp register reads and writes should
+/*
+ * Function for determining whether guest cp register reads and writes should
  * access the secure or non-secure bank of a cp register.  When EL3 is
  * operating in AArch32 state, the NS-bit determines whether the secure
  * instance of a cp register should be used. When EL3 is AArch64 (or if
  * it doesn't exist at all) then there is no register banking, and all
  * accesses are to the non-secure version.
  */
-static inline bool access_secure_reg(CPUARMState *env)
-{
-    bool ret = (arm_feature(env, ARM_FEATURE_EL3) &&
-                !arm_el_is_aa64(env, 3) &&
-                !(env->cp15.scr_el3 & SCR_NS));
-
-    return ret;
-}
+bool access_secure_reg(CPUARMState *env);
 
 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
                                  uint32_t cur_el, bool secure);
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -XXX,XX +XXX,XX @@ static bool aprofile_require_alignment(CPUARMState *env, int el, uint64_t sctlr)
 #endif
 }
 
+bool access_secure_reg(CPUARMState *env)
+{
+    bool ret = (arm_feature(env, ARM_FEATURE_EL3) &&
+                !arm_el_is_aa64(env, 3) &&
+                !(env->cp15.scr_el3 & SCR_NS));
+
+    return ret;
+}
+
 static CPUARMTBFlags rebuild_hflags_common(CPUARMState *env, int fp_el,
                                            ARMMMUIdx mmu_idx,
                                            CPUARMTBFlags flags)
-- 
2.43.0

At the top of linux-user/aarch64/cpu_loop.c we define a set of
macros for reading and writing data and code words, but we never
use these macros. Delete them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/cpu_loop.c | 48 -----------------------------------
 1 file changed, 48 deletions(-)

diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -XXX,XX +XXX,XX @@
 #include "target/arm/syndrome.h"
 #include "target/arm/cpu-features.h"
 
-#define get_user_code_u32(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u32((x), (gaddr));       \
-        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
-            (x) = bswap32(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define get_user_code_u16(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
-        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
-            (x) = bswap16(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define get_user_data_u32(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u32((x), (gaddr));       \
-        if (!__r && arm_cpu_bswap_data(env)) {          \
-            (x) = bswap32(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define get_user_data_u16(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
-        if (!__r && arm_cpu_bswap_data(env)) {          \
-            (x) = bswap16(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define put_user_data_u32(x, gaddr, env)                \
-    ({ typeof(x) __x = (x);                             \
-        if (arm_cpu_bswap_data(env)) {                  \
-            __x = bswap32(__x);                         \
-        }                                               \
-        put_user_u32(__x, (gaddr));                     \
-    })
-
-#define put_user_data_u16(x, gaddr, env)                \
-    ({ typeof(x) __x = (x);                             \
-        if (arm_cpu_bswap_data(env)) {                  \
-            __x = bswap16(__x);                         \
-        }                                               \
-        put_user_u16(__x, (gaddr));                     \
-    })
-
 /* AArch64 main loop */
 void cpu_loop(CPUARMState *env)
 {
-- 
2.43.0

In linux-user/arm/cpu_loop.c we define a full set of get/put
macros for both code and data (since the endianness handling
is different between the two). However the only one we actually
use is get_user_code_u32(). Remove the rest.

We leave a comment noting how data-side accesses should be handled
for big-endian, because that's a subtle point and we just removed the
macros that were effectively documenting it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/cpu_loop.c | 43 ++++-----------------------------------
 1 file changed, 4 insertions(+), 39 deletions(-)

diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -XXX,XX +XXX,XX @@
         __r;                                            \
     })
 
-#define get_user_code_u16(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
-        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
-            (x) = bswap16(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define get_user_data_u32(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u32((x), (gaddr));       \
-        if (!__r && arm_cpu_bswap_data(env)) {          \
-            (x) = bswap32(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define get_user_data_u16(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
-        if (!__r && arm_cpu_bswap_data(env)) {          \
-            (x) = bswap16(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define put_user_data_u32(x, gaddr, env)                \
-    ({ typeof(x) __x = (x);                             \
-        if (arm_cpu_bswap_data(env)) {                  \
-            __x = bswap32(__x);                         \
-        }                                               \
-        put_user_u32(__x, (gaddr));                     \
-    })
-
-#define put_user_data_u16(x, gaddr, env)                \
-    ({ typeof(x) __x = (x);                             \
-        if (arm_cpu_bswap_data(env)) {                  \
-            __x = bswap16(__x);                         \
-        }                                               \
-        put_user_u16(__x, (gaddr));                     \
-    })
+/*
+ * Note that if we need to do data accesses here, they should do a
+ * bswap if arm_cpu_bswap_data() returns true.
+ */
 
 /*
  * Similar to code in accel/tcg/user-exec.c, but outside the execution loop.
-- 
2.43.0

The arm_cpu_data_is_big_endian() and related functions are now used
only in target/arm; they can be moved to internals.h.

The motivation here is that we would like to move arm_current_el()
to internals.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h       | 48 ------------------------------------------
 target/arm/internals.h | 48 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 48 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_sctlr_b(CPUARMState *env)
 
 uint64_t arm_sctlr(CPUARMState *env, int el);
 
-static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
-                                                  bool sctlr_b)
-{
-#ifdef CONFIG_USER_ONLY
-    /*
-     * In system mode, BE32 is modelled in line with the
-     * architecture (as word-invariant big-endianness), where loads
-     * and stores are done little endian but from addresses which
-     * are adjusted by XORing with the appropriate constant. So the
-     * endianness to use for the raw data access is not affected by
-     * SCTLR.B.
-     * In user mode, however, we model BE32 as byte-invariant
-     * big-endianness (because user-only code cannot tell the
-     * difference), and so we need to use a data access endianness
-     * that depends on SCTLR.B.
-     */
-    if (sctlr_b) {
-        return true;
-    }
-#endif
-    /* In 32bit endianness is determined by looking at CPSR's E bit */
-    return env->uncached_cpsr & CPSR_E;
-}
-
-static inline bool arm_cpu_data_is_big_endian_a64(int el, uint64_t sctlr)
-{
-    return sctlr & (el ? SCTLR_EE : SCTLR_E0E);
-}
-
-/* Return true if the processor is in big-endian mode. */
-static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
-{
-    if (!is_a64(env)) {
-        return arm_cpu_data_is_big_endian_a32(env, arm_sctlr_b(env));
-    } else {
-        int cur_el = arm_current_el(env);
-        uint64_t sctlr = arm_sctlr(env, cur_el);
-        return arm_cpu_data_is_big_endian_a64(cur_el, sctlr);
-    }
-}
-
 #include "exec/cpu-all.h"
 
 /*
@@ -XXX,XX +XXX,XX @@ static inline bool bswap_code(bool sctlr_b)
 #endif
 }
 
-#ifdef CONFIG_USER_ONLY
-static inline bool arm_cpu_bswap_data(CPUARMState *env)
-{
-    return TARGET_BIG_ENDIAN ^ arm_cpu_data_is_big_endian(env);
-}
-#endif
-
 void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
                           uint64_t *cs_base, uint32_t *flags);
 
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
     return arm_rmode_to_sf_map[rmode];
 }
 
+static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
+                                                  bool sctlr_b)
+{
+#ifdef CONFIG_USER_ONLY
+    /*
+     * In system mode, BE32 is modelled in line with the
+     * architecture (as word-invariant big-endianness), where loads
+     * and stores are done little endian but from addresses which
+     * are adjusted by XORing with the appropriate constant. So the
+     * endianness to use for the raw data access is not affected by
+     * SCTLR.B.
+     * In user mode, however, we model BE32 as byte-invariant
+     * big-endianness (because user-only code cannot tell the
+     * difference), and so we need to use a data access endianness
+     * that depends on SCTLR.B.
+     */
+    if (sctlr_b) {
+        return true;
+    }
+#endif
+    /* In 32bit endianness is determined by looking at CPSR's E bit */
+    return env->uncached_cpsr & CPSR_E;
+}
+
+static inline bool arm_cpu_data_is_big_endian_a64(int el, uint64_t sctlr)
+{
+    return sctlr & (el ? SCTLR_EE : SCTLR_E0E);
+}
+
+/* Return true if the processor is in big-endian mode. */
+static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
+{
+    if (!is_a64(env)) {
+        return arm_cpu_data_is_big_endian_a32(env, arm_sctlr_b(env));
+    } else {
+        int cur_el = arm_current_el(env);
+        uint64_t sctlr = arm_sctlr(env, cur_el);
+        return arm_cpu_data_is_big_endian_a64(cur_el, sctlr);
+    }
+}
+
+#ifdef CONFIG_USER_ONLY
+static inline bool arm_cpu_bswap_data(CPUARMState *env)
+{
+    return TARGET_BIG_ENDIAN ^ arm_cpu_data_is_big_endian(env);
+}
+#endif
+
 static inline void aarch64_save_sp(CPUARMState *env, int el)
 {
     if (env->pstate & PSTATE_SP) {
-- 
2.43.0

The functions arm_current_el() and arm_el_is_aa64() are used only in
target/arm and in hw/intc/arm_gicv3_cpuif.c.  They're functions that
query internal state of the CPU.  Move them out of cpu.h and into
internals.h.

This means we need to include internals.h in arm_gicv3_cpuif.c, but
this is justifiable because that file is implementing the GICv3 CPU
interface, which really is part of the CPU proper; we just ended up
implementing it in code in hw/intc/ for historical reasons.

The motivation for this move is that we'd like to change
arm_el_is_aa64() to add a condition that uses cpu_isar_feature();
but we don't want to include cpu-features.h in cpu.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h          | 66 --------------------------------------
 target/arm/internals.h    | 67 +++++++++++++++++++++++++++++++++++++++
 hw/intc/arm_gicv3_cpuif.c |  1 +
 target/arm/arch_dump.c    |  1 +
 4 files changed, 69 insertions(+), 66 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space);
 uint64_t arm_hcr_el2_eff(CPUARMState *env);
 uint64_t arm_hcrx_el2_eff(CPUARMState *env);
 
-/* Return true if the specified exception level is running in AArch64 state. */
-static inline bool arm_el_is_aa64(CPUARMState *env, int el)
-{
-    /* This isn't valid for EL0 (if we're in EL0, is_a64() is what you want,
-     * and if we're not in EL0 then the state of EL0 isn't well defined.)
-     */
-    assert(el >= 1 && el <= 3);
-    bool aa64 = arm_feature(env, ARM_FEATURE_AARCH64);
-
-    /* The highest exception level is always at the maximum supported
-     * register width, and then lower levels have a register width controlled
-     * by bits in the SCR or HCR registers.
-     */
-    if (el == 3) {
-        return aa64;
-    }
-
-    if (arm_feature(env, ARM_FEATURE_EL3) &&
-        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
-        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
-    }
-
-    if (el == 2) {
-        return aa64;
-    }
-
-    if (arm_is_el2_enabled(env)) {
-        aa64 = aa64 && (env->cp15.hcr_el2 & HCR_RW);
-    }
-
-    return aa64;
-}
-
 /*
  * Function for determining whether guest cp register reads and writes should
  * access the secure or non-secure bank of a cp register.  When EL3 is
@@ -XXX,XX +XXX,XX @@ static inline bool arm_v7m_is_handler_mode(CPUARMState *env)
     return env->v7m.exception != 0;
 }
 
-/* Return the current Exception Level (as per ARMv8; note that this differs
- * from the ARMv7 Privilege Level).
- */
-static inline int arm_current_el(CPUARMState *env)
-{
-    if (arm_feature(env, ARM_FEATURE_M)) {
-        return arm_v7m_is_handler_mode(env) ||
-            !(env->v7m.control[env->v7m.secure] & 1);
-    }
-
-    if (is_a64(env)) {
-        return extract32(env->pstate, 2, 2);
-    }
-
-    switch (env->uncached_cpsr & 0x1f) {
-    case ARM_CPU_MODE_USR:
-        return 0;
-    case ARM_CPU_MODE_HYP:
-        return 2;
-    case ARM_CPU_MODE_MON:
-        return 3;
-    default:
-        if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
-            /* If EL3 is 32-bit then all secure privileged modes run in
-             * EL3
-             */
-            return 3;
-        }
-
-        return 1;
-    }
-}
-
 /**
  * write_list_to_cpustate
  * @cpu: ARMCPU
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
     return arm_rmode_to_sf_map[rmode];
 }
 
+/* Return true if the specified exception level is running in AArch64 state. */
+static inline bool arm_el_is_aa64(CPUARMState *env, int el)
+{
+    /*
+     * This isn't valid for EL0 (if we're in EL0, is_a64() is what you want,
+     * and if we're not in EL0 then the state of EL0 isn't well defined.)
+     */
+    assert(el >= 1 && el <= 3);
+    bool aa64 = arm_feature(env, ARM_FEATURE_AARCH64);
+
+    /*
+     * The highest exception level is always at the maximum supported
+     * register width, and then lower levels have a register width controlled
+     * by bits in the SCR or HCR registers.
+     */
+    if (el == 3) {
+        return aa64;
+    }
+
+    if (arm_feature(env, ARM_FEATURE_EL3) &&
+        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
+        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
+    }
+
+    if (el == 2) {
+        return aa64;
+    }
+
+    if (arm_is_el2_enabled(env)) {
+        aa64 = aa64 && (env->cp15.hcr_el2 & HCR_RW);
+    }
+
+    return aa64;
+}
+
+/*
+ * Return the current Exception Level (as per ARMv8; note that this differs
+ * from the ARMv7 Privilege Level).
+ */
+static inline int arm_current_el(CPUARMState *env)
+{
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return arm_v7m_is_handler_mode(env) ||
+            !(env->v7m.control[env->v7m.secure] & 1);
+    }
+
+    if (is_a64(env)) {
+        return extract32(env->pstate, 2, 2);
+    }
+
+    switch (env->uncached_cpsr & 0x1f) {
+    case ARM_CPU_MODE_USR:
+        return 0;
+    case ARM_CPU_MODE_HYP:
+        return 2;
+    case ARM_CPU_MODE_MON:
+        return 3;
+    default:
+        if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
+            /* If EL3 is 32-bit then all secure privileged modes run in EL3 */
+            return 3;
+        }
+
+        return 1;
+    }
+}
+
 static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
                                                   bool sctlr_b)
 {
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "target/arm/cpregs.h"
 #include "target/arm/cpu-features.h"
+#include "target/arm/internals.h"
 #include "system/tcg.h"
 #include "system/qtest.h"
 
diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@
 #include "elf.h"
 #include "system/dump.h"
 #include "cpu-features.h"
+#include "internals.h"
 
 /* struct user_pt_regs from arch/arm64/include/uapi/asm/ptrace.h */
 struct aarch64_user_regs {
-- 
2.43.0

The definition of SCR_EL3.RW says that its effective value is 1 if:
 - EL2 is implemented and does not support AArch32, and SCR_EL3.NS is 1
 - the effective value of SCR_EL3.{EEL2,NS} is {1,0} (i.e. we are
   Secure and Secure EL2 is disabled)

We implement the second of these in arm_el_is_aa64(), but forgot the
first.

Provide a new function arm_scr_rw_eff() to return the effective
value of SCR_EL3.RW, and use it in arm_el_is_aa64() and the other
places that currently look directly at the bit value.

(scr_write() enforces that the RW bit is RAO/WI if neither EL1 nor
EL2 have AArch32 support, but if EL1 does but EL2 does not then the
bit must still be writeable.)

This will mean that if code at EL3 attempts to perform an exception
return to AArch32 EL2 when EL2 is AArch64-only we will correctly
handle this as an illegal exception return: it will be caught by the
"return to an EL which is configured for a different register width"
check in HELPER(exception_return).

We do already have some CPU types which don't implement AArch32
above EL0, so this is technically a bug; it doesn't seem worth
backporting to stable because no sensible guest code will be
deliberately attempting to set the RW bit to a value corresponding
to an unimplemented execution state and then checking that we
did the right thing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/internals.h | 26 +++++++++++++++++++++++---
 target/arm/helper.c    |  4 ++--
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
     return arm_rmode_to_sf_map[rmode];
 }
 
+/* Return the effective value of SCR_EL3.RW */
+static inline bool arm_scr_rw_eff(CPUARMState *env)
+{
+    /*
+     * SCR_EL3.RW has an effective value of 1 if:
+     *  - we are NS and EL2 is implemented but doesn't support AArch32
+     *  - we are S and EL2 is enabled (in which case it must be AArch64)
+     */
+    ARMCPU *cpu = env_archcpu(env);
+
+    if (env->cp15.scr_el3 & SCR_RW) {
+        return true;
+    }
+    if (env->cp15.scr_el3 & SCR_NS) {
+        return arm_feature(env, ARM_FEATURE_EL2) &&
+            !cpu_isar_feature(aa64_aa32_el2, cpu);
+    } else {
+        return env->cp15.scr_el3 & SCR_EEL2;
+    }
+}
+
 /* Return true if the specified exception level is running in AArch64 state. */
 static inline bool arm_el_is_aa64(CPUARMState *env, int el)
 {
@@ -XXX,XX +XXX,XX @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
         return aa64;
     }
 
-    if (arm_feature(env, ARM_FEATURE_EL3) &&
-        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
-        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
+    if (arm_feature(env, ARM_FEATURE_EL3)) {
+        aa64 = aa64 && arm_scr_rw_eff(env);
     }
 
     if (el == 2) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
     uint64_t hcr_el2;
 
     if (arm_feature(env, ARM_FEATURE_EL3)) {
-        rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
+        rw = arm_scr_rw_eff(env);
     } else {
         /*
          * Either EL2 is the highest EL (and so the EL2 register width
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
 
         switch (new_el) {
         case 3:
-            is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0;
+            is_aa64 = arm_scr_rw_eff(env);
             break;
         case 2:
             hcr = arm_hcr_el2_eff(env);
-- 
2.43.0

When EL1 doesn't support AArch32, the HCR_EL2.RW bit is supposed to
be RAO/WI. Enforce the RAO/WI behaviour.

Note that we handle "reset value should honour RES1 bits" in the same
way that SCR_EL3 does, via a reset function.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
     /* Clear RES0 bits.  */
     value &= valid_mask;
 
+    /* RW is RAO/WI if EL1 is AArch64 only */
+    if (!cpu_isar_feature(aa64_aa32_el1, cpu)) {
+        value |= HCR_RW;
+    }
+
     /*
      * These bits change the MMU setup:
      * HCR_VM enables stage 2 translation
@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
     do_hcr_write(env, value, MAKE_64BIT_MASK(32, 32));
 }
 
+static void hcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    /* hcr_write will set the RES1 bits on an AArch64-only CPU */
+    hcr_write(env, ri, 0);
+}
+
 /*
  * Return the effective value of HCR_EL2, at the given security state.
  * Bits that are not included here:
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
       .nv2_redirect_offset = 0x78,
+      .resetfn = hcr_reset,
       .writefn = hcr_write, .raw_writefn = raw_write },
     { .name = "HCR", .state = ARM_CP_STATE_AA32,
       .type = ARM_CP_ALIAS | ARM_CP_IO,
-- 
2.43.0

We already call env_archcpu() multiple times within the
exception_return helper function, and we're about to want to
add another use of the ARMCPU pointer. Add a local variable
cpu so we can call env_archcpu() just once.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-a64.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static void cpsr_write_from_spsr_elx(CPUARMState *env,
 
 void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
 {
+    ARMCPU *cpu = env_archcpu(env);
     int cur_el = arm_current_el(env);
     unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
     uint32_t spsr = env->banked_spsr[spsr_idx];
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
     }
 
     bql_lock();
-    arm_call_pre_el_change_hook(env_archcpu(env));
+    arm_call_pre_el_change_hook(cpu);
     bql_unlock();
 
     if (!return_to_aa64) {
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
         int tbii;
 
         env->aarch64 = true;
-        spsr &= aarch64_pstate_valid_mask(&env_archcpu(env)->isar);
+        spsr &= aarch64_pstate_valid_mask(&cpu->isar);
         pstate_write(env, spsr);
         if (!arm_singlestep_active(env)) {
             env->pstate &= ~PSTATE_SS;
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
     aarch64_sve_change_el(env, cur_el, new_el, return_to_aa64);
 
     bql_lock();
-    arm_call_el_change_hook(env_archcpu(env));
+    arm_call_el_change_hook(cpu);
     bql_unlock();
 
     return;
-- 
2.43.0

In the Arm ARM, rule R_TYTWB states that returning to AArch32
is an illegal exception return if:
 * AArch32 is not supported at any exception level
 * the target EL is configured for AArch64 via SCR_EL3.RW
   or HCR_EL2.RW or via CPU state at reset

We check the second of these, but not the first (which can only be
relevant for the case of a return to EL0, because if AArch32 is not
supported at one of the higher ELs then the RW bits will have an
effective value of 1 and the the "configured for AArch64" condition
will hold also).

Add the missing condition. Although this is technically a bug
(because we have one AArch64-only CPU: a64fx) it isn't worth
backporting to stable because no sensible guest code will
deliberately try to return to a nonexistent execution state
to check that it gets an illegal exception return.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-a64.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
         goto illegal_return;
     }
 
+    if (!return_to_aa64 && !cpu_isar_feature(aa64_aa32, cpu)) {
+        /* Return to AArch32 when CPU is AArch64-only */
+        goto illegal_return;
+    }
+
     if (new_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
         goto illegal_return;
     }
-- 
2.43.0

I'm down as the only listed maintainer for quite a lot of Arm SoC and
board types.  In some cases this is only as the "maintainer of last
resort" and I'm not in practice doing anything beyond patch review
and the odd bit of tidyup.

Move these entries in MAINTAINERS from "Maintained" to "Odd Fixes",
to better represent reality.  Entries for other boards and SoCs where
I do more actively care (or where there is a listed co-maintainer)
remain as they are.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250307152838.3226398-1-peter.maydell@linaro.org
---
 MAINTAINERS | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/kzm.rst
 Integrator CP
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c
 F: include/hw/misc/arm_integrator_debug.h
@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/mps2.rst
 Musca
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/musca.c
 F: docs/system/arm/musca.rst
 
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_aarch64_raspi4.py
 Real View
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/realview*
 F: hw/cpu/realview_mpcore.c
 F: hw/intc/realview_gic.c
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_arm_collie.py
 Stellaris
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/stellaris*
 F: hw/display/ssd03*
 F: include/hw/input/gamepad.h
@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/stm32.rst
 Versatile Express
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/vexpress.c
 F: hw/display/sii9022.c
 F: docs/system/arm/vexpress.rst
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_arm_vexpress.py
 Versatile PB
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/versatile*
 F: hw/i2c/arm_sbcon_i2c.c
 F: include/hw/i2c/arm_sbcon_i2c.h
@@ -XXX,XX +XXX,XX @@ F: include/hw/hyperv/vmbus*.h
 OMAP
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/omap*
 F: include/hw/arm/omap.h
 F: docs/system/arm/sx1.rst
-- 
2.43.0

From: Paolo Bonzini <pbonzini@redhat.com>

The guest does not control whether characters are sent on the UART.
Sending them before the guest happens to boot will now result in a
"guest error" log entry that is only because of timing, even if the
guest _would_ later setup the receiver correctly.

This reverts the bulk of commit abf2b6a028670bd2890bb3aee7e103fe53e4b0df,
and instead adds a comment about why we don't check the enable bits.

Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20250311153717.206129-1-pbonzini@redhat.com
[PMM: expanded comment]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/pl011.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -XXX,XX +XXX,XX @@ static int pl011_can_receive(void *opaque)
     unsigned fifo_depth = pl011_get_fifo_depth(s);
     unsigned fifo_available = fifo_depth - s->read_count;
 
-    if (!(s->cr & CR_UARTEN)) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "PL011 receiving data on disabled UART\n");
-    }
-    if (!(s->cr & CR_RXE)) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "PL011 receiving data on disabled RX UART\n");
-    }
-    trace_pl011_can_receive(s->lcr, s->read_count, fifo_depth, fifo_available);
+    /*
+     * In theory we should check the UART and RX enable bits here and
+     * return 0 if they are not set (so the guest can't receive data
+     * until you have enabled the UART). In practice we suspect there
+     * is at least some guest code out there which has been tested only
+     * on QEMU and which never bothers to enable the UART because we
+     * historically never enforced that. So we effectively keep the
+     * UART continuously enabled regardless of the enable bits.
+     */
 
+    trace_pl011_can_receive(s->lcr, s->read_count, fifo_depth, fifo_available);
     return fifo_available;
 }
 
-- 
2.43.0

From: Joe Komlodi <komlodi@google.com>

On ARM hosts with CTR_EL0.DIC and CTR_EL0.IDC set, this would only cause
an ISB to be executed during cache maintenance, which could lead to QEMU
executing TBs containing garbage instructions.

This seems to be because the ISB finishes executing instructions and
flushes the pipeline, but the ISB doesn't guarantee that writes from the
executed instructions are committed. If a small enough TB is created, it's
possible that the writes setting up the TB aren't committed by the time the
TB is executed.

This function is intended to be a port of the gcc implementation
(https://github.com/gcc-mirror/gcc/blob/85b46d0795ac76bc192cb8f88b646a647acf98c1/libgcc/config/aarch64/sync-cache.c#L67)
which makes the first DSB unconditional, so we can fix the synchronization
issue by doing that as well.

Cc: qemu-stable@nongnu.org
Fixes: 664a79735e4deb1 ("util: Specialize flush_idcache_range for aarch64")
Signed-off-by: Joe Komlodi <komlodi@google.com>
Message-id: 20250310203622.1827940-2-komlodi@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 util/cacheflush.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/util/cacheflush.c b/util/cacheflush.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cacheflush.c
+++ b/util/cacheflush.c
@@ -XXX,XX +XXX,XX @@ void flush_idcache_range(uintptr_t rx, uintptr_t rw, size_t len)
         for (p = rw & -dcache_lsize; p < rw + len; p += dcache_lsize) {
             asm volatile("dc\tcvau, %0" : : "r" (p) : "memory");
         }
-        asm volatile("dsb\tish" : : : "memory");
     }
 
+    /* DSB unconditionally to ensure any outstanding writes are committed. */
+    asm volatile("dsb\tish" : : : "memory");
+
     /*
      * If CTR_EL0.DIC is enabled, Instruction cache cleaning to the Point
      * of Unification is not required for instruction to data coherence.
-- 
2.43.0

From: Richard Henderson <richard.henderson@linaro.org>

The check for fp_excp_el in assert_fp_access_checked is
incorrect.  For SME, with StreamingMode enabled, the access
is really against the streaming mode vectors, and access
to the normal fp registers is allowed to be disabled.
C.f. sme_enabled_check.

Convert sve_access_checked to match, even though we don't
currently check the exception state.

Cc: qemu-stable@nongnu.org
Fixes: 3d74825f4d6 ("target/arm: Add SME enablement checks")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250307190415.982049-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.h |  2 +-
 target/arm/tcg/translate.h     | 10 +++++++---
 target/arm/tcg/translate-a64.c | 17 +++++++++--------
 3 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/target/arm/tcg/translate-a64.h b/target/arm/tcg/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.h
+++ b/target/arm/tcg/translate-a64.h
@@ -XXX,XX +XXX,XX @@ TCGv_i64 gen_mte_checkN(DisasContext *s, TCGv_i64 addr, bool is_write,
 static inline void assert_fp_access_checked(DisasContext *s)
 {
 #ifdef CONFIG_DEBUG_TCG
-    if (unlikely(!s->fp_access_checked || s->fp_excp_el)) {
+    if (unlikely(s->fp_access_checked <= 0)) {
         fprintf(stderr, "target-arm: FP access check missing for "
                 "instruction 0x%08x\n", s->insn);
         abort();
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool aarch64;
     bool thumb;
     bool lse2;
-    /* Because unallocated encodings generate different exception syndrome
+    /*
+     * Because unallocated encodings generate different exception syndrome
      * information from traps due to FP being disabled, we can't do a single
      * "is fp access disabled" check at a high level in the decode tree.
      * To help in catching bugs where the access check was forgotten in some
      * code path, we set this flag when the access check is done, and assert
      * that it is set at the point where we actually touch the FP regs.
+     *   0: not checked,
+     *   1: checked, access ok
+     *  -1: checked, access denied
      */
-    bool fp_access_checked;
-    bool sve_access_checked;
+    int8_t fp_access_checked;
+    int8_t sve_access_checked;
     /* ARMv8 single-step state (this is distinct from the QEMU gdbstub
      * single-step support).
      */
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool fp_access_check_only(DisasContext *s)
 {
     if (s->fp_excp_el) {
         assert(!s->fp_access_checked);
-        s->fp_access_checked = true;
+        s->fp_access_checked = -1;
 
         gen_exception_insn_el(s, 0, EXCP_UDEF,
                               syn_fp_access_trap(1, 0xe, false, 0),
                               s->fp_excp_el);
         return false;
     }
-    s->fp_access_checked = true;
+    s->fp_access_checked = 1;
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
                               syn_sve_access_trap(), s->sve_excp_el);
         goto fail_exit;
     }
-    s->sve_access_checked = true;
+    s->sve_access_checked = 1;
     return fp_access_check(s);
 
  fail_exit:
     /* Assert that we only raise one exception per instruction. */
     assert(!s->sve_access_checked);
-    s->sve_access_checked = true;
+    s->sve_access_checked = -1;
     return false;
 }
 
@@ -XXX,XX +XXX,XX @@ bool sme_enabled_check(DisasContext *s)
      * sme_excp_el by itself for cpregs access checks.
      */
     if (!s->fp_excp_el || s->sme_excp_el < s->fp_excp_el) {
-        s->fp_access_checked = true;
-        return sme_access_check(s);
+        bool ret = sme_access_check(s);
+        s->fp_access_checked = (ret ? 1 : -1);
+        return ret;
     }
     return fp_access_check_only(s);
 }
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     s->insn = insn;
     s->base.pc_next = pc + 4;
 
-    s->fp_access_checked = false;
-    s->sve_access_checked = false;
+    s->fp_access_checked = 0;
+    s->sve_access_checked = 0;
 
     if (s->pstate_il) {
         /*
-- 
2.43.0

From: Richard Henderson <richard.henderson@linaro.org>

In StreamingMode, fp_access_checked is handled already.
We cannot fall through to fp_access_check lest we fall
foul of the double-check assertion.

Cc: qemu-stable@nongnu.org
Fixes: 285b1d5fcef ("target/arm: Handle SME in sve_access_check")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250307190415.982049-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: move declaration of 'ret' to top of block]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static int fp_access_check_vector_hsd(DisasContext *s, bool is_q, MemOp esz)
 bool sve_access_check(DisasContext *s)
 {
     if (s->pstate_sm || !dc_isar_feature(aa64_sve, s)) {
+        bool ret;
+
         assert(dc_isar_feature(aa64_sme, s));
-        if (!sme_sm_enabled_check(s)) {
-            goto fail_exit;
-        }
-    } else if (s->sve_excp_el) {
+        ret = sme_sm_enabled_check(s);
+        s->sve_access_checked = (ret ? 1 : -1);
+        return ret;
+    }
+    if (s->sve_excp_el) {
+        /* Assert that we only raise one exception per instruction. */
+        assert(!s->sve_access_checked);
         gen_exception_insn_el(s, 0, EXCP_UDEF,
                               syn_sve_access_trap(), s->sve_excp_el);
-        goto fail_exit;
+        s->sve_access_checked = -1;
+        return false;
     }
     s->sve_access_checked = 1;
     return fp_access_check(s);
-
- fail_exit:
-    /* Assert that we only raise one exception per instruction. */
-    assert(!s->sve_access_checked);
-    s->sve_access_checked = -1;
-    return false;
 }
 
 /*
-- 
2.43.0

We want to capture potential Rust backtraces on panics in our test
logs, which isn't Rust's default behaviour.  Set RUST_BACKTRACE=1 in
the add_test_setup environments, so that all our tests get run with
this environment variable set.

This makes the setting of that variable in the gitlab CI template
redundant, so we can remove it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250310102950.3752908-1-peter.maydell@linaro.org
---
 meson.build                         | 9 ++++++---
 .gitlab-ci.d/buildtest-template.yml | 1 -
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ project('qemu', ['c'], meson_version: '>=1.5.0',
 
 meson.add_devenv({ 'MESON_BUILD_ROOT' : meson.project_build_root() })
 
-add_test_setup('quick', exclude_suites: ['slow', 'thorough'], is_default: true)
-add_test_setup('slow', exclude_suites: ['thorough'], env: ['G_TEST_SLOW=1', 'SPEED=slow'])
-add_test_setup('thorough', env: ['G_TEST_SLOW=1', 'SPEED=thorough'])
+add_test_setup('quick', exclude_suites: ['slow', 'thorough'], is_default: true,
+               env: ['RUST_BACKTRACE=1'])
+add_test_setup('slow', exclude_suites: ['thorough'],
+               env: ['G_TEST_SLOW=1', 'SPEED=slow', 'RUST_BACKTRACE=1'])
+add_test_setup('thorough',
+               env: ['G_TEST_SLOW=1', 'SPEED=thorough', 'RUST_BACKTRACE=1'])
 
 meson.add_postconf_script(find_program('scripts/symlink-install-tree.py'))
 
diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index XXXXXXX..XXXXXXX 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -XXX,XX +XXX,XX @@
   stage: test
   image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
   script:
-    - export RUST_BACKTRACE=1
     - source scripts/ci/gitlab-ci-section
     - section_start buildenv "Setting up to run tests"
     - scripts/git-submodule.sh update roms/SLOF
-- 
2.43.0