Series comparison

-[PULL 0/6] target-arm queue
+[PULL 00/25] target-arm queue
-A few patches for the rc today...
+target-arm queue, mostly SME preliminaries.
-The following changes since commit 109918d24a3bb9ed3d05beb34ea4ac6be443c138:
+In the unlikely event we don't land the rest of SME before freeze
 for 7.1 we can revert the docs/property changes included here.
-  Merge remote-tracking branch 'remotes/nvme/tags/nvme-fixes-for-6.0-pull-request' into staging (2021-04-05 22:15:38 +0100)
+-- PMM
 The following changes since commit 097ccbbbaf2681df1e65542e5b7d2b2d0c66e2bc:
   Merge tag 'qemu-sparc-20220626' of https://github.com/mcayland/qemu into staging (2022-06-27 05:21:05 +0530)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210406
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220627
-for you to fetch changes up to 49bc76550c37f4a2b92a05cb3e6989a739d56ac9:
+for you to fetch changes up to 59e1b8a22ea9f947d038ccac784de1020f266e14:
-  Remove myself as i.mx31 maintainer (2021-04-06 11:49:15 +0100)
+  target/arm: Check V7VE as well as LPAE in arm_pamax (2022-06-27 11:18:17 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * ppc/e500 and arm/virt: only add valid dynamic sysbus devices to the
+ * sphinx: change default language to 'en'
-   platform bus
+ * Diagnose attempts to emulate EL3 in hvf as well as kvm
- * update i.mx31 maintainer list
+ * More SME groundwork patches
- * Revert "target/arm: Make number of counters in PMCR follow the CPU"
+ * virt: Fix calculation of physical address space size
    for v7VE CPUs (eg cortex-a15)
 ----------------------------------------------------------------
-Chubb, Peter (Data61, Eveleigh) (1):
+Alexander Graf (2):
-      Remove myself as i.mx31 maintainer
+      accel: Introduce current_accel_name()
       target/arm: Catch invalid kvm state also for hvf
-Peter Maydell (5):
+Martin Liška (1):
-      include/hw/boards.h: Document machine_class_allow_dynamic_sysbus_dev()
+      sphinx: change default language to 'en'
       machine: Provide a function to check the dynamic sysbus allowlist
       hw/arm/virt: Only try to add valid dynamic sysbus devices to platform bus
       hw/ppc/e500plat: Only try to add valid dynamic sysbus devices to platform bus
       Revert "target/arm: Make number of counters in PMCR follow the CPU"
- include/hw/boards.h  | 39 +++++++++++++++++++++++++++++++++++++++
+Richard Henderson (22):
- target/arm/cpu.h     |  1 -
+      target/arm: Implement TPIDR2_EL0
- hw/arm/virt.c        |  8 ++++++--
+      target/arm: Add SMEEXC_EL to TB flags
- hw/core/machine.c    | 21 ++++++++++++++++-----
+      target/arm: Add syn_smetrap
- hw/ppc/e500plat.c    |  8 ++++++--
+      target/arm: Add ARM_CP_SME
- target/arm/cpu64.c   |  3 ---
+      target/arm: Add SVCR
- target/arm/cpu_tcg.c |  5 -----
+      target/arm: Add SMCR_ELx
- target/arm/helper.c  | 29 ++++++++++++-----------------
+      target/arm: Add SMIDR_EL1, SMPRI_EL1, SMPRIMAP_EL2
- target/arm/kvm64.c   |  2 --
+      target/arm: Add PSTATE.{SM,ZA} to TB flags
- MAINTAINERS          |  1 -
+      target/arm: Add the SME ZA storage to CPUARMState
-files changed, 79 insertions(+), 38 deletions(-)
+      target/arm: Implement SMSTART, SMSTOP
       target/arm: Move error for sve%d property to arm_cpu_sve_finalize
       target/arm: Create ARMVQMap
       target/arm: Generalize cpu_arm_{get,set}_vq
       target/arm: Generalize cpu_arm_{get, set}_default_vec_len
       target/arm: Move arm_cpu_*_finalize to internals.h
       target/arm: Unexport aarch64_add_*_properties
       target/arm: Add cpu properties for SME
       target/arm: Introduce sve_vqm1_for_el_sm
       target/arm: Add SVL to TB flags
       target/arm: Move pred_{full, gvec}_reg_{offset, size} to translate-a64.h
       target/arm: Extend arm_pamax to more than aarch64
       target/arm: Check V7VE as well as LPAE in arm_pamax
+ docs/conf.py                     |   2 +-
+ docs/system/arm/cpu-features.rst |  56 ++++++++++
+ include/qemu/accel.h             |   1 +
+ target/arm/cpregs.h              |   5 +
+ target/arm/cpu.h                 | 103 ++++++++++++++-----
+ target/arm/helper-sme.h          |  21 ++++
+ target/arm/helper.h              |   1 +
+ target/arm/internals.h           |   4 +
+ target/arm/syndrome.h            |  14 +++
+ target/arm/translate-a64.h       |  38 +++++++
+ target/arm/translate.h           |   6 ++
+ accel/accel-common.c             |   8 ++
+ hw/arm/virt.c                    |  10 +-
+ softmmu/vl.c                     |   3 +-
+ target/arm/cpu.c                 |  32 ++++--
+ target/arm/cpu64.c               | 205 ++++++++++++++++++++++++++++---------
+ target/arm/helper.c              | 213 +++++++++++++++++++++++++++++++++++++--
+ target/arm/kvm64.c               |   2 +-
+ target/arm/machine.c             |  34 +++++++
+ target/arm/ptw.c                 |  26 +++--
+ target/arm/sme_helper.c          |  61 +++++++++++
+ target/arm/translate-a64.c       |  46 +++++++++
+ target/arm/translate-sve.c       |  36 -------
+ target/arm/meson.build           |   1 +
+files changed, 782 insertions(+), 146 deletions(-)
+ create mode 100644 target/arm/helper-sme.h
+ create mode 100644 target/arm/sme_helper.c

-[PULL 6/6] Remove myself as i.mx31 maintainer
+[PULL 01/25] sphinx: change default language to 'en'
-From: "Chubb, Peter (Data61, Eveleigh)" <Peter.Chubb@data61.csiro.au>
+From: Martin Liška <mliska@suse.cz>
-Remove Peter Chubb as i/MX31 maintainer.
+Fixes the following Sphinx warning (treated as error) starting
 with 5.0 release:
-I'm leaving my current job and will no longer have access to the
+Warning, treated as error:
-hardware to test or maintain this port.
+Invalid configuration value found: 'language = None'. Update your configuration to a valid langauge code. Falling back to 'en' (English).
-Signed-off-by: Peter Chubb <peter.chubb@data61.csiro.au>
+Signed-off-by: Martin Liska <mliska@suse.cz>
 Message-id: e91e51ee-48ac-437e-6467-98b56ee40042@suse.cz
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS | 1 -
+ docs/conf.py | 2 +-
-file changed, 1 deletion(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/docs/conf.py b/docs/conf.py
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/docs/conf.py
-+++ b/MAINTAINERS
++++ b/docs/conf.py
-@@ -XXX,XX +XXX,XX @@ F: include/hw/misc/imx25_ccm.h
+@@ -XXX,XX +XXX,XX @@
- F: include/hw/watchdog/wdt_imx2.h
+ #
+ # This is also used if you do content translation via gettext catalogs.
- i.MX31 (kzm)
+ # Usually you set "language" from the command line for these cases.
--M: Peter Chubb <peter.chubb@nicta.com.au>
+-language = None
- M: Peter Maydell <peter.maydell@linaro.org>
++language = 'en'
- L: qemu-arm@nongnu.org
- S: Odd Fixes
+ # List of patterns, relative to source directory, that match files and
  # directories to ignore when looking for source files.
 --
-.20.1
+.25.1

-New patch
+[PULL 02/25] accel: Introduce current_accel_name()
+From: Alexander Graf <agraf@csgraf.de>
+We need to fetch the name of the current accelerator in flexible error
+messages more going forward. Let's create a helper that gives it to us
+without casting in the target code.
+Signed-off-by: Alexander Graf <agraf@csgraf.de>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620192242.70573-1-agraf@csgraf.de
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ include/qemu/accel.h | 1 +
+ accel/accel-common.c | 8 ++++++++
+ softmmu/vl.c         | 3 +--
+files changed, 10 insertions(+), 2 deletions(-)
+diff --git a/include/qemu/accel.h b/include/qemu/accel.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/accel.h
++++ b/include/qemu/accel.h
+@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
+ AccelClass *accel_find(const char *opt_name);
+ AccelState *current_accel(void);
++const char *current_accel_name(void);
+ void accel_init_interfaces(AccelClass *ac);
+diff --git a/accel/accel-common.c b/accel/accel-common.c
+index XXXXXXX..XXXXXXX 100644
+--- a/accel/accel-common.c
++++ b/accel/accel-common.c
+@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
+     return ac;
+ }
++/* Return the name of the current accelerator */
++const char *current_accel_name(void)
++{
++    AccelClass *ac = ACCEL_GET_CLASS(current_accel());
++
++    return ac->name;
++}
++
+ static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
+ {
+     CPUClass *cc = CPU_CLASS(klass);
+diff --git a/softmmu/vl.c b/softmmu/vl.c
+index XXXXXXX..XXXXXXX 100644
+--- a/softmmu/vl.c
++++ b/softmmu/vl.c
+@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
+     }
+     if (init_failed && !qtest_chrdev) {
+-        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
+-        error_report("falling back to %s", ac->name);
++        error_report("falling back to %s", current_accel_name());
+     }
+     if (icount_enabled() && !tcg_enabled()) {
+--
+.25.1

-New patch
+[PULL 03/25] target/arm: Catch invalid kvm state also for hvf
+From: Alexander Graf <agraf@csgraf.de>
+Some features such as running in EL3 or running M profile code are
+incompatible with virtualization as QEMU implements it today. To prevent
+users from picking invalid configurations on other virt solutions like
+Hvf, let's run the same checks there too.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1073
+Signed-off-by: Alexander Graf <agraf@csgraf.de>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620192242.70573-2-agraf@csgraf.de
+[PMM: Allow qtest accelerator too; tweak comment]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.c | 16 ++++++++++++----
+file changed, 12 insertions(+), 4 deletions(-)
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/boards.h"
+ #endif
+ #include "sysemu/tcg.h"
++#include "sysemu/qtest.h"
+ #include "sysemu/hw_accel.h"
+ #include "kvm_arm.h"
+ #include "disas/capstone.h"
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
+         }
+     }
+-    if (kvm_enabled()) {
++    if (!tcg_enabled() && !qtest_enabled()) {
+         /*
++         * We assume that no accelerator except TCG (and the "not really an
++         * accelerator" qtest) can handle these features, because Arm hardware
++         * virtualization can't virtualize them.
++         *
+          * Catch all the cases which might cause us to create more than one
+          * address space for the CPU (otherwise we will assert() later in
+          * cpu_address_space_init()).
+          */
+         if (arm_feature(env, ARM_FEATURE_M)) {
+             error_setg(errp,
+-                       "Cannot enable KVM when using an M-profile guest CPU");
++                       "Cannot enable %s when using an M-profile guest CPU",
++                       current_accel_name());
+             return;
+         }
+         if (cpu->has_el3) {
+             error_setg(errp,
+-                       "Cannot enable KVM when guest CPU has EL3 enabled");
++                       "Cannot enable %s when guest CPU has EL3 enabled",
++                       current_accel_name());
+             return;
+         }
+         if (cpu->tag_memory) {
+             error_setg(errp,
+-                       "Cannot enable KVM when guest CPUs has MTE enabled");
++                       "Cannot enable %s when guest CPUs has MTE enabled",
++                       current_accel_name());
+             return;
+         }
+     }
+--
+.25.1

-New patch
+[PULL 04/25] target/arm: Implement TPIDR2_EL0
+From: Richard Henderson <richard.henderson@linaro.org>
+This register is part of SME, but isn't closely related to the
+rest of the extension.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-2-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h    |  1 +
+ target/arm/helper.c | 32 ++++++++++++++++++++++++++++++++
+files changed, 33 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+             };
+             uint64_t tpidr_el[4];
+         };
++        uint64_t tpidr2_el0;
+         /* The secure banks of these registers don't map anywhere */
+         uint64_t tpidrurw_s;
+         uint64_t tpidrprw_s;
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_reginfo[] = {
+       .writefn = zcr_write, .raw_writefn = raw_write },
+ };
++#ifdef TARGET_AARCH64
++static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
++                                    bool isread)
++{
++    int el = arm_current_el(env);
++
++    if (el == 0) {
++        uint64_t sctlr = arm_sctlr(env, el);
++        if (!(sctlr & SCTLR_EnTP2)) {
++            return CP_ACCESS_TRAP;
++        }
++    }
++    /* TODO: FEAT_FGT */
++    if (el < 3
++        && arm_feature(env, ARM_FEATURE_EL3)
++        && !(env->cp15.scr_el3 & SCR_ENTP2)) {
++        return CP_ACCESS_TRAP_EL3;
++    }
++    return CP_ACCESS_OK;
++}
++
++static const ARMCPRegInfo sme_reginfo[] = {
++    { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
++      .access = PL0_RW, .accessfn = access_tpidr2,
++      .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) },
++};
++#endif /* TARGET_AARCH64 */
++
+ void hw_watchpoint_update(ARMCPU *cpu, int n)
+ {
+     CPUARMState *env = &cpu->env;
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
+     }
+ #ifdef TARGET_AARCH64
++    if (cpu_isar_feature(aa64_sme, cpu)) {
++        define_arm_cp_regs(cpu, sme_reginfo);
++    }
+     if (cpu_isar_feature(aa64_pauth, cpu)) {
+         define_arm_cp_regs(cpu, pauth_reginfo);
+     }
+--
+.25.1

-New patch
+[PULL 05/25] target/arm: Add SMEEXC_EL to TB flags
+From: Richard Henderson <richard.henderson@linaro.org>
+This is CheckSMEAccess, which is the basis for a set of
+related tests for various SME cpregs and instructions.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-3-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h           |  2 ++
+ target/arm/translate.h     |  1 +
+ target/arm/helper.c        | 52 ++++++++++++++++++++++++++++++++++++++
+ target/arm/translate-a64.c |  1 +
+files changed, 56 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env);
+ int fp_exception_el(CPUARMState *env, int cur_el);
+ int sve_exception_el(CPUARMState *env, int cur_el);
++int sme_exception_el(CPUARMState *env, int cur_el);
+ /**
+  * sve_vqm1_for_el:
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, ATA, 15, 1)
+ FIELD(TBFLAG_A64, TCMA, 16, 2)
+ FIELD(TBFLAG_A64, MTE_ACTIVE, 18, 1)
+ FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
++FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
+ /*
+  * Helpers for using the above.
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+     bool ns;        /* Use non-secure CPREG bank on access */
+     int fp_excp_el; /* FP exception EL or 0 if enabled */
+     int sve_excp_el; /* SVE exception EL or 0 if enabled */
++    int sme_excp_el; /* SME exception EL or 0 if enabled */
+     int vl;          /* current vector length in bytes */
+     bool vfp_enabled; /* FP enabled via FPSCR.EN */
+     int vec_len;
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
+     return 0;
+ }
++/*
++ * Return the exception level to which exceptions should be taken for SME.
++ * C.f. the ARM pseudocode function CheckSMEAccess.
++ */
++int sme_exception_el(CPUARMState *env, int el)
++{
++#ifndef CONFIG_USER_ONLY
++    if (el <= 1 && !el_is_in_host(env, el)) {
++        switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, SMEN)) {
++        case 1:
++            if (el != 0) {
++                break;
++            }
++            /* fall through */
++        case 0:
++        case 2:
++            return 1;
++        }
++    }
++
++    if (el <= 2 && arm_is_el2_enabled(env)) {
++        /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */
++        if (env->cp15.hcr_el2 & HCR_E2H) {
++            switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, SMEN)) {
++            case 1:
++                if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) {
++                    break;
++                }
++                /* fall through */
++            case 0:
++            case 2:
++                return 2;
++            }
++        } else {
++            if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TSM)) {
++                return 2;
++            }
++        }
++    }
++
++    /* CPTR_EL3.  Since ESM is negative we must check for EL3.  */
++    if (arm_feature(env, ARM_FEATURE_EL3)
++        && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
++        return 3;
++    }
++#endif
++    return 0;
++}
++
+ /*
+  * Given that SVE is enabled, return the vector length for EL.
+  */
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
+         }
+         DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
+     }
++    if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
++        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
++    }
+     sctlr = regime_sctlr(env, stage1);
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
+     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
+     dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
+     dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
++    dc->sme_excp_el = EX_TBFLAG_A64(tb_flags, SMEEXC_EL);
+     dc->vl = (EX_TBFLAG_A64(tb_flags, VL) + 1) * 16;
+     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
+     dc->bt = EX_TBFLAG_A64(tb_flags, BT);
+--
+.25.1

-New patch
+[PULL 06/25] target/arm: Add syn_smetrap
+From: Richard Henderson <richard.henderson@linaro.org>
+This will be used for raising various traps for SME.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-4-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/syndrome.h | 14 ++++++++++++++
+file changed, 14 insertions(+)
+diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/syndrome.h
++++ b/target/arm/syndrome.h
+@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
+     EC_AA64_SMC               = 0x17,
+     EC_SYSTEMREGISTERTRAP     = 0x18,
+     EC_SVEACCESSTRAP          = 0x19,
++    EC_SMETRAP                = 0x1d,
+     EC_INSNABORT              = 0x20,
+     EC_INSNABORT_SAME_EL      = 0x21,
+     EC_PCALIGNMENT            = 0x22,
+@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
+     EC_AA64_BKPT              = 0x3c,
+ };
++typedef enum {
++    SME_ET_AccessTrap,
++    SME_ET_Streaming,
++    SME_ET_NotStreaming,
++    SME_ET_InactiveZA,
++} SMEExceptionType;
++
+ #define ARM_EL_EC_SHIFT 26
+ #define ARM_EL_IL_SHIFT 25
+ #define ARM_EL_ISV_SHIFT 24
+@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_sve_access_trap(void)
+     return EC_SVEACCESSTRAP << ARM_EL_EC_SHIFT;
+ }
++static inline uint32_t syn_smetrap(SMEExceptionType etype, bool is_16bit)
++{
++    return (EC_SMETRAP << ARM_EL_EC_SHIFT)
++        | (is_16bit ? 0 : ARM_EL_IL) | etype;
++}
++
+ static inline uint32_t syn_pactrap(void)
+ {
+     return EC_PACTRAP << ARM_EL_EC_SHIFT;
+--
+.25.1

-New patch
+[PULL 07/25] target/arm: Add ARM_CP_SME
+From: Richard Henderson <richard.henderson@linaro.org>
+This will be used for controlling access to SME cpregs.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-5-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpregs.h        |  5 +++++
+ target/arm/translate-a64.c | 18 ++++++++++++++++++
+files changed, 23 insertions(+)
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpregs.h
++++ b/target/arm/cpregs.h
+@@ -XXX,XX +XXX,XX @@ enum {
+     ARM_CP_EL3_NO_EL2_UNDEF      = 1 << 16,
+     ARM_CP_EL3_NO_EL2_KEEP       = 1 << 17,
+     ARM_CP_EL3_NO_EL2_C_NZ       = 1 << 18,
++    /*
++     * Flag: Access check for this sysreg is constrained by the
++     * ARM pseudocode function CheckSMEAccess().
++     */
++    ARM_CP_SME                   = 1 << 19,
+ };
+ /*
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
+     return fp_access_check(s);
+ }
++/*
++ * Check that SME access is enabled, raise an exception if not.
++ * Note that this function corresponds to CheckSMEAccess and is
++ * only used directly for cpregs.
++ */
++static bool sme_access_check(DisasContext *s)
++{
++    if (s->sme_excp_el) {
++        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
++                              syn_smetrap(SME_ET_AccessTrap, false),
++                              s->sme_excp_el);
++        return false;
++    }
++    return true;
++}
++
+ /*
+  * This utility function is for doing register extension with an
+  * optional shift. You will likely want to pass a temporary for the
+@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
+         return;
+     } else if ((ri->type & ARM_CP_SVE) && !sve_access_check(s)) {
+         return;
++    } else if ((ri->type & ARM_CP_SME) && !sme_access_check(s)) {
++        return;
+     }
+     if ((tb_cflags(s->base.tb) & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
+--
+.25.1

-New patch
+[PULL 08/25] target/arm: Add SVCR
+From: Richard Henderson <richard.henderson@linaro.org>
+This cpreg is used to access two new bits of PSTATE
+that are not visible via any other mechanism.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-6-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h    |  6 ++++++
+ target/arm/helper.c | 13 +++++++++++++
+files changed, 19 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+      *  nRW (also known as M[4]) is kept, inverted, in env->aarch64
+      *  DAIF (exception masks) are kept in env->daif
+      *  BTYPE is kept in env->btype
++     *  SM and ZA are kept in env->svcr
+      *  all other bits are stored in their correct places in env->pstate
+      */
+     uint32_t pstate;
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+     uint32_t condexec_bits; /* IT bits.  cpsr[15:10,26:25].  */
+     uint32_t btype;  /* BTI branch type.  spsr[11:10].  */
+     uint64_t daif; /* exception masks, in the bits they are in PSTATE */
++    uint64_t svcr; /* PSTATE.{SM,ZA} in the bits they are in SVCR */
+     uint64_t elr_el[4]; /* AArch64 exception link regs  */
+     uint64_t sp_el[4]; /* AArch64 banked stack pointers */
+@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
+ #define PSTATE_MODE_EL1t 4
+ #define PSTATE_MODE_EL0t 0
++/* PSTATE bits that are accessed via SVCR and not stored in SPSR_ELx. */
++FIELD(SVCR, SM, 0, 1)
++FIELD(SVCR, ZA, 1, 1)
++
+ /* Write a new value to v7m.exception, thus transitioning into or out
+  * of Handler mode; this may result in a change of active stack pointer.
+  */
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
+     return CP_ACCESS_OK;
+ }
++static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
++                       uint64_t value)
++{
++    value &= R_SVCR_SM_MASK | R_SVCR_ZA_MASK;
++    /* TODO: Side effects. */
++    env->svcr = value;
++}
++
+ static const ARMCPRegInfo sme_reginfo[] = {
+     { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
+       .access = PL0_RW, .accessfn = access_tpidr2,
+       .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) },
++    { .name = "SVCR", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 2,
++      .access = PL0_RW, .type = ARM_CP_SME,
++      .fieldoffset = offsetof(CPUARMState, svcr),
++      .writefn = svcr_write, .raw_writefn = raw_write },
+ };
+ #endif /* TARGET_AARCH64 */
+--
+.25.1

-New patch
+[PULL 09/25] target/arm: Add SMCR_ELx
+From: Richard Henderson <richard.henderson@linaro.org>
+These cpregs control the streaming vector length and whether the
+full a64 instruction set is allowed while in streaming mode.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-7-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h    |  8 ++++++--
+ target/arm/helper.c | 41 +++++++++++++++++++++++++++++++++++++++++
+files changed, 47 insertions(+), 2 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+         float_status standard_fp_status;
+         float_status standard_fp_status_f16;
+-        /* ZCR_EL[1-3] */
+-        uint64_t zcr_el[4];
++        uint64_t zcr_el[4];   /* ZCR_EL[1-3] */
++        uint64_t smcr_el[4];  /* SMCR_EL[1-3] */
+     } vfp;
+     uint64_t exclusive_addr;
+     uint64_t exclusive_val;
+@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
+ FIELD(SVCR, SM, 0, 1)
+ FIELD(SVCR, ZA, 1, 1)
++/* Fields for SMCR_ELx. */
++FIELD(SMCR, LEN, 0, 4)
++FIELD(SMCR, FA64, 31, 1)
++
+ /* Write a new value to v7m.exception, thus transitioning into or out
+  * of Handler mode; this may result in a change of active stack pointer.
+  */
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
+          */
+         { K(3, 0,  1, 2, 0), K(3, 4,  1, 2, 0), K(3, 5, 1, 2, 0),
+           "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve },
++        { K(3, 0,  1, 2, 6), K(3, 4,  1, 2, 6), K(3, 5, 1, 2, 6),
++          "SMCR_EL1", "SMCR_EL2", "SMCR_EL12", isar_feature_aa64_sme },
+         { K(3, 0,  5, 6, 0), K(3, 4,  5, 6, 0), K(3, 5, 5, 6, 0),
+           "TFSR_EL1", "TFSR_EL2", "TFSR_EL12", isar_feature_aa64_mte },
+@@ -XXX,XX +XXX,XX @@ static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+     env->svcr = value;
+ }
++static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
++                       uint64_t value)
++{
++    int cur_el = arm_current_el(env);
++    int old_len = sve_vqm1_for_el(env, cur_el);
++    int new_len;
++
++    QEMU_BUILD_BUG_ON(ARM_MAX_VQ > R_SMCR_LEN_MASK + 1);
++    value &= R_SMCR_LEN_MASK | R_SMCR_FA64_MASK;
++    raw_write(env, ri, value);
++
++    /*
++     * Note that it is CONSTRAINED UNPREDICTABLE what happens to ZA storage
++     * when SVL is widened (old values kept, or zeros).  Choose to keep the
++     * current values for simplicity.  But for QEMU internals, we must still
++     * apply the narrower SVL to the Zregs and Pregs -- see the comment
++     * above aarch64_sve_narrow_vq.
++     */
++    new_len = sve_vqm1_for_el(env, cur_el);
++    if (new_len < old_len) {
++        aarch64_sve_narrow_vq(env, new_len + 1);
++    }
++}
++
+ static const ARMCPRegInfo sme_reginfo[] = {
+     { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
+       .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
+       .access = PL0_RW, .type = ARM_CP_SME,
+       .fieldoffset = offsetof(CPUARMState, svcr),
+       .writefn = svcr_write, .raw_writefn = raw_write },
++    { .name = "SMCR_EL1", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 6,
++      .access = PL1_RW, .type = ARM_CP_SME,
++      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[1]),
++      .writefn = smcr_write, .raw_writefn = raw_write },
++    { .name = "SMCR_EL2", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 6,
++      .access = PL2_RW, .type = ARM_CP_SME,
++      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[2]),
++      .writefn = smcr_write, .raw_writefn = raw_write },
++    { .name = "SMCR_EL3", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 6,
++      .access = PL3_RW, .type = ARM_CP_SME,
++      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]),
++      .writefn = smcr_write, .raw_writefn = raw_write },
+ };
+ #endif /* TARGET_AARCH64 */
+--
+.25.1

-New patch
+[PULL 10/25] target/arm: Add SMIDR_EL1, SMPRI_EL1, SMPRIMAP_EL2
+From: Richard Henderson <richard.henderson@linaro.org>
+Implement the streaming mode identification register, and the
+two streaming priority registers.  For QEMU, they are all RES0.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-8-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/helper.c | 33 +++++++++++++++++++++++++++++++++
+file changed, 33 insertions(+)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
+     return CP_ACCESS_OK;
+ }
++static CPAccessResult access_esm(CPUARMState *env, const ARMCPRegInfo *ri,
++                                 bool isread)
++{
++    /* TODO: FEAT_FGT for SMPRI_EL1 but not SMPRIMAP_EL2 */
++    if (arm_current_el(env) < 3
++        && arm_feature(env, ARM_FEATURE_EL3)
++        && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
++        return CP_ACCESS_TRAP_EL3;
++    }
++    return CP_ACCESS_OK;
++}
++
+ static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                        uint64_t value)
+ {
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
+       .access = PL3_RW, .type = ARM_CP_SME,
+       .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]),
+       .writefn = smcr_write, .raw_writefn = raw_write },
++    { .name = "SMIDR_EL1", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 6,
++      .access = PL1_R, .accessfn = access_aa64_tid1,
++      /*
++       * IMPLEMENTOR = 0 (software)
++       * REVISION    = 0 (implementation defined)
++       * SMPS        = 0 (no streaming execution priority in QEMU)
++       * AFFINITY    = 0 (streaming sve mode not shared with other PEs)
++       */
++      .type = ARM_CP_CONST, .resetvalue = 0, },
++    /*
++     * Because SMIDR_EL1.SMPS is 0, SMPRI_EL1 and SMPRIMAP_EL2 are RES 0.
++     */
++    { .name = "SMPRI_EL1", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 4,
++      .access = PL1_RW, .accessfn = access_esm,
++      .type = ARM_CP_CONST, .resetvalue = 0 },
++    { .name = "SMPRIMAP_EL2", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 5,
++      .access = PL2_RW, .accessfn = access_esm,
++      .type = ARM_CP_CONST, .resetvalue = 0 },
+ };
+ #endif /* TARGET_AARCH64 */
+--
+.25.1

-New patch
+[PULL 11/25] target/arm: Add PSTATE.{SM,ZA} to TB flags
+From: Richard Henderson <richard.henderson@linaro.org>
+These are required to determine if various insns
+are allowed to issue.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-9-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h           | 2 ++
+ target/arm/translate.h     | 4 ++++
+ target/arm/helper.c        | 4 ++++
+ target/arm/translate-a64.c | 2 ++
+files changed, 12 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, TCMA, 16, 2)
+ FIELD(TBFLAG_A64, MTE_ACTIVE, 18, 1)
+ FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
+ FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
++FIELD(TBFLAG_A64, PSTATE_SM, 22, 1)
++FIELD(TBFLAG_A64, PSTATE_ZA, 23, 1)
+ /*
+  * Helpers for using the above.
+diff --git a/target/arm/translate.h b/target/arm/translate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate.h
++++ b/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+     bool align_mem;
+     /* True if PSTATE.IL is set */
+     bool pstate_il;
++    /* True if PSTATE.SM is set. */
++    bool pstate_sm;
++    /* True if PSTATE.ZA is set. */
++    bool pstate_za;
+     /* True if MVE insns are definitely not predicated by VPR or LTPSIZE */
+     bool mve_no_pred;
+     /*
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
+     }
+     if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
+         DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
++        if (FIELD_EX64(env->svcr, SVCR, SM)) {
++            DP_TBFLAG_A64(flags, PSTATE_SM, 1);
++        }
++        DP_TBFLAG_A64(flags, PSTATE_ZA, FIELD_EX64(env->svcr, SVCR, ZA));
+     }
+     sctlr = regime_sctlr(env, stage1);
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
+     dc->ata = EX_TBFLAG_A64(tb_flags, ATA);
+     dc->mte_active[0] = EX_TBFLAG_A64(tb_flags, MTE_ACTIVE);
+     dc->mte_active[1] = EX_TBFLAG_A64(tb_flags, MTE0_ACTIVE);
++    dc->pstate_sm = EX_TBFLAG_A64(tb_flags, PSTATE_SM);
++    dc->pstate_za = EX_TBFLAG_A64(tb_flags, PSTATE_ZA);
+     dc->vec_len = 0;
+     dc->vec_stride = 0;
+     dc->cp_regs = arm_cpu->cp_regs;
+--
+.25.1

-New patch
+[PULL 12/25] target/arm: Add the SME ZA storage to CPUARMState
+From: Richard Henderson <richard.henderson@linaro.org>
+Place this late in the resettable section of the structure,
+to keep the most common element offsets from being > 64k.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-10-richard.henderson@linaro.org
+[PMM: expanded comment on zarray[] format]
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h     | 22 ++++++++++++++++++++++
+ target/arm/machine.c | 34 ++++++++++++++++++++++++++++++++++
+files changed, 56 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+     } keys;
+     uint64_t scxtnum_el[4];
++
++    /*
++     * SME ZA storage -- 256 x 256 byte array, with bytes in host word order,
++     * as we do with vfp.zregs[].  This corresponds to the architectural ZA
++     * array, where ZA[N] is in the least-significant bytes of env->zarray[N].
++     * When SVL is less than the architectural maximum, the accessible
++     * storage is restricted, such that if the SVL is X bytes the guest can
++     * see only the bottom X elements of zarray[], and only the least
++     * significant X bytes of each element of the array. (In other words,
++     * the observable part is always square.)
++     *
++     * The ZA storage can also be considered as a set of square tiles of
++     * elements of different sizes. The mapping from tiles to the ZA array
++     * is architecturally defined, such that for tiles of elements of esz
++     * bytes, the Nth row (or "horizontal slice") of tile T is in
++     * ZA[T + N * esz]. Note that this means that each tile is not contiguous
++     * in the ZA storage, because its rows are striped through the ZA array.
++     *
++     * Because this is so large, keep this toward the end of the reset area,
++     * to keep the offsets into the rest of the structure smaller.
++     */
++    ARMVectorReg zarray[ARM_MAX_VQ * 16];
+ #endif
+ #if defined(CONFIG_USER_ONLY)
+diff --git a/target/arm/machine.c b/target/arm/machine.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/machine.c
++++ b/target/arm/machine.c
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sve = {
+         VMSTATE_END_OF_LIST()
+     }
+ };
++
++static const VMStateDescription vmstate_vreg = {
++    .name = "vreg",
++    .version_id = 1,
++    .minimum_version_id = 1,
++    .fields = (VMStateField[]) {
++        VMSTATE_UINT64_ARRAY(d, ARMVectorReg, ARM_MAX_VQ * 2),
++        VMSTATE_END_OF_LIST()
++    }
++};
++
++static bool za_needed(void *opaque)
++{
++    ARMCPU *cpu = opaque;
++
++    /*
++     * When ZA storage is disabled, its contents are discarded.
++     * It will be zeroed when ZA storage is re-enabled.
++     */
++    return FIELD_EX64(cpu->env.svcr, SVCR, ZA);
++}
++
++static const VMStateDescription vmstate_za = {
++    .name = "cpu/sme",
++    .version_id = 1,
++    .minimum_version_id = 1,
++    .needed = za_needed,
++    .fields = (VMStateField[]) {
++        VMSTATE_STRUCT_ARRAY(env.zarray, ARMCPU, ARM_MAX_VQ * 16, 0,
++                             vmstate_vreg, ARMVectorReg),
++        VMSTATE_END_OF_LIST()
++    }
++};
+ #endif /* AARCH64 */
+ static bool serror_needed(void *opaque)
+@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_arm_cpu = {
+         &vmstate_m_security,
+ #ifdef TARGET_AARCH64
+         &vmstate_sve,
++        &vmstate_za,
+ #endif
+         &vmstate_serror,
+         &vmstate_irq_line_state,
+--
+.25.1

-New patch
+[PULL 13/25] target/arm: Implement SMSTART, SMSTOP
+From: Richard Henderson <richard.henderson@linaro.org>
+These two instructions are aliases of MSR (immediate).
+Use the two helpers to properly implement svcr_write.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-11-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h           |  1 +
+ target/arm/helper-sme.h    | 21 +++++++++++++
+ target/arm/helper.h        |  1 +
+ target/arm/helper.c        |  6 ++--
+ target/arm/sme_helper.c    | 61 ++++++++++++++++++++++++++++++++++++++
+ target/arm/translate-a64.c | 24 +++++++++++++++
+ target/arm/meson.build     |  1 +
+files changed, 112 insertions(+), 3 deletions(-)
+ create mode 100644 target/arm/helper-sme.h
+ create mode 100644 target/arm/sme_helper.c
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
+                            int new_el, bool el0_a64);
+ void aarch64_add_sve_properties(Object *obj);
+ void aarch64_add_pauth_properties(Object *obj);
++void arm_reset_sve_state(CPUARMState *env);
+ /*
+  * SVE registers are encoded in KVM's memory in an endianness-invariant format.
+diff --git a/target/arm/helper-sme.h b/target/arm/helper-sme.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/target/arm/helper-sme.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ *  AArch64 SME specific helper definitions
++ *
++ *  Copyright (c) 2022 Linaro, Ltd
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
++ */
++
++DEF_HELPER_FLAGS_2(set_pstate_sm, TCG_CALL_NO_RWG, void, env, i32)
++DEF_HELPER_FLAGS_2(set_pstate_za, TCG_CALL_NO_RWG, void, env, i32)
+diff --git a/target/arm/helper.h b/target/arm/helper.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.h
++++ b/target/arm/helper.h
+@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_6(gvec_bfmlal_idx, TCG_CALL_NO_RWG,
+ #ifdef TARGET_AARCH64
+ #include "helper-a64.h"
+ #include "helper-sve.h"
++#include "helper-sme.h"
+ #endif
+ #include "helper-mve.h"
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_esm(CPUARMState *env, const ARMCPRegInfo *ri,
+ static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                        uint64_t value)
+ {
+-    value &= R_SVCR_SM_MASK | R_SVCR_ZA_MASK;
+-    /* TODO: Side effects. */
+-    env->svcr = value;
++    helper_set_pstate_sm(env, FIELD_EX64(value, SVCR, SM));
++    helper_set_pstate_za(env, FIELD_EX64(value, SVCR, ZA));
++    arm_rebuild_hflags(env);
+ }
+ static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+diff --git a/target/arm/sme_helper.c b/target/arm/sme_helper.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/target/arm/sme_helper.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * ARM SME Operations
++ *
++ * Copyright (c) 2022 Linaro, Ltd.
++ *
++ * This library is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU Lesser General Public
++ * License as published by the Free Software Foundation; either
++ * version 2.1 of the License, or (at your option) any later version.
++ *
++ * This library is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * Lesser General Public License for more details.
++ *
++ * You should have received a copy of the GNU Lesser General Public
++ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
++ */
++
++#include "qemu/osdep.h"
++#include "cpu.h"
++#include "internals.h"
++#include "exec/helper-proto.h"
++
++/* ResetSVEState */
++void arm_reset_sve_state(CPUARMState *env)
++{
++    memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
++    /* Recall that FFR is stored as pregs[16]. */
++    memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
++    vfp_set_fpcr(env, 0x0800009f);
++}
++
++void helper_set_pstate_sm(CPUARMState *env, uint32_t i)
++{
++    if (i == FIELD_EX64(env->svcr, SVCR, SM)) {
++        return;
++    }
++    env->svcr ^= R_SVCR_SM_MASK;
++    arm_reset_sve_state(env);
++}
++
++void helper_set_pstate_za(CPUARMState *env, uint32_t i)
++{
++    if (i == FIELD_EX64(env->svcr, SVCR, ZA)) {
++        return;
++    }
++    env->svcr ^= R_SVCR_ZA_MASK;
++
++    /*
++     * ResetSMEState.
++     *
++     * SetPSTATE_ZA zeros on enable and disable.  We can zero this only
++     * on enable: while disabled, the storage is inaccessible and the
++     * value does not matter.  We're not saving the storage in vmstate
++     * when disabled either.
++     */
++    if (i) {
++        memset(env->zarray, 0, sizeof(env->zarray));
++    }
++}
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.c
++++ b/target/arm/translate-a64.c
+@@ -XXX,XX +XXX,XX @@ static void handle_msr_i(DisasContext *s, uint32_t insn,
+         }
+         break;
++    case 0x1b: /* SVCR* */
++        if (!dc_isar_feature(aa64_sme, s) || crm < 2 || crm > 7) {
++            goto do_unallocated;
++        }
++        if (sme_access_check(s)) {
++            bool i = crm & 1;
++            bool changed = false;
++
++            if ((crm & 2) && i != s->pstate_sm) {
++                gen_helper_set_pstate_sm(cpu_env, tcg_constant_i32(i));
++                changed = true;
++            }
++            if ((crm & 4) && i != s->pstate_za) {
++                gen_helper_set_pstate_za(cpu_env, tcg_constant_i32(i));
++                changed = true;
++            }
++            if (changed) {
++                gen_rebuild_hflags(s);
++            } else {
++                s->base.is_jmp = DISAS_NEXT;
++            }
++        }
++        break;
++
+     default:
+     do_unallocated:
+         unallocated_encoding(s);
+diff --git a/target/arm/meson.build b/target/arm/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/meson.build
++++ b/target/arm/meson.build
+@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
+   'mte_helper.c',
+   'pauth_helper.c',
+   'sve_helper.c',
++  'sme_helper.c',
+   'translate-a64.c',
+   'translate-sve.c',
+ ))
+--
+.25.1

-New patch
+[PULL 14/25] target/arm: Move error for sve%d property to arm_cpu_sve_finalize
+From: Richard Henderson <richard.henderson@linaro.org>
+Keep all of the error messages together.  This does mean that
+when setting many sve length properties we'll only generate
+one error, but we only really need one.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-12-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu64.c | 15 +++++++--------
+file changed, 7 insertions(+), 8 deletions(-)
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu64.c
++++ b/target/arm/cpu64.c
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
+                                   "using only sve<N> properties.\n");
+             } else {
+                 error_setg(errp, "cannot enable sve%d", vq * 128);
+-                error_append_hint(errp, "This CPU does not support "
+-                                  "the vector length %d-bits.\n", vq * 128);
++                if (vq_supported) {
++                    error_append_hint(errp, "This CPU does not support "
++                                      "the vector length %d-bits.\n", vq * 128);
++                } else {
++                    error_append_hint(errp, "SVE not supported by KVM "
++                                      "on this host\n");
++                }
+             }
+             return;
+         } else {
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
+         return;
+     }
+-    if (value && kvm_enabled() && !kvm_arm_sve_supported()) {
+-        error_setg(errp, "cannot enable %s", name);
+-        error_append_hint(errp, "SVE not supported by KVM on this host\n");
+-        return;
+-    }
+-
+     cpu->sve_vq_map = deposit32(cpu->sve_vq_map, vq - 1, 1, value);
+     cpu->sve_vq_init |= 1 << (vq - 1);
+ }
+--
+.25.1

-[PULL 5/6] Revert "target/arm: Make number of counters in PMCR follow the CPU"
+[PULL 15/25] target/arm: Create ARMVQMap
-This reverts commit f7fb73b8cdd3f77e26f9fcff8cf24ff1b58d200f.
+From: Richard Henderson <richard.henderson@linaro.org>
-This change turned out to be a bit half-baked, and doesn't
+Pull the three sve_vq_* values into a structure.
-work with KVM, which fails with the error:
+This will be reused for SME.
    "qemu-system-aarch64: Failed to retrieve host CPU features"
-because KVM does not allow accessing of the PMCR_EL0 value in
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-the scratch "query CPU ID registers" VM unless we have first
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-set the KVM_ARM_VCPU_PMU_V3 feature on the VM.
+Message-id: 20220620175235.60881-13-richard.henderson@linaro.org
 Revert the change for 6.0.
 Reported-by: Zenghui Yu <yuzenghui@huawei.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Tested-by: Zenghui Yu <yuzenghui@huawei.com>
-Message-id: 20210331154822.23332-1-peter.maydell@linaro.org
 ---
- target/arm/cpu.h     |  1 -
+ target/arm/cpu.h    | 29 ++++++++++++++---------------
- target/arm/cpu64.c   |  3 ---
+ target/arm/cpu64.c  | 22 +++++++++++-----------
- target/arm/cpu_tcg.c |  5 -----
+ target/arm/helper.c |  2 +-
- target/arm/helper.c  | 29 ++++++++++++-----------------
+ target/arm/kvm64.c  |  2 +-
- target/arm/kvm64.c   |  2 --
+files changed, 27 insertions(+), 28 deletions(-)
 files changed, 12 insertions(+), 28 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+@@ -XXX,XX +XXX,XX @@ typedef enum ARMPSCIState {
-         uint64_t id_aa64mmfr2;
-         uint64_t id_aa64dfr0;
+ typedef struct ARMISARegisters ARMISARegisters;
-         uint64_t id_aa64dfr1;
--        uint64_t reset_pmcr_el0;
++/*
-     } isar;
++ * In map, each set bit is a supported vector length of (bit-number + 1) * 16
-     uint64_t midr;
++ * bytes, i.e. each bit number + 1 is the vector length in quadwords.
-     uint32_t revidr;
++ *
 + * While processing properties during initialization, corresponding init bits
 + * are set for bits in sve_vq_map that have been set by properties.
 + *
 + * Bits set in supported represent valid vector lengths for the CPU type.
 + */
 +typedef struct {
 +    uint32_t map, init, supported;
 +} ARMVQMap;
 +
  /**
   * ARMCPU:
   * @env: #CPUARMState
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
      uint32_t sve_default_vq;
  #endif
 -    /*
 -     * In sve_vq_map each set bit is a supported vector length of
 -     * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
 -     * length in quadwords.
 -     *
 -     * While processing properties during initialization, corresponding
 -     * sve_vq_init bits are set for bits in sve_vq_map that have been
 -     * set by properties.
 -     *
 -     * Bits set in sve_vq_supported represent valid vector lengths for
 -     * the CPU type.
 -     */
 -    uint32_t sve_vq_map;
 -    uint32_t sve_vq_init;
 -    uint32_t sve_vq_supported;
 +    ARMVQMap sve_vq;
      /* Generic timer counter frequency, in Hz */
      uint64_t gt_cntfrq_hz;
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
-     cpu->gic_num_lrs = 4;
+      * any of the above.  Finally, if SVE is not disabled, then at least one
-     cpu->gic_vpribits = 5;
+      * vector length must be enabled.
-     cpu->gic_vprebits = 5;
+      */
--    cpu->isar.reset_pmcr_el0 = 0x41013000;
+-    uint32_t vq_map = cpu->sve_vq_map;
-     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
+-    uint32_t vq_init = cpu->sve_vq_init;
 +    uint32_t vq_map = cpu->sve_vq.map;
 +    uint32_t vq_init = cpu->sve_vq.init;
      uint32_t vq_supported;
      uint32_t vq_mask = 0;
      uint32_t tmp, vq, max_vq = 0;
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
       */
      if (kvm_enabled()) {
          if (kvm_arm_sve_supported()) {
 -            cpu->sve_vq_supported = kvm_arm_sve_get_vls(CPU(cpu));
 -            vq_supported = cpu->sve_vq_supported;
 +            cpu->sve_vq.supported = kvm_arm_sve_get_vls(CPU(cpu));
 +            vq_supported = cpu->sve_vq.supported;
          } else {
              assert(!cpu_isar_feature(aa64_sve, cpu));
              vq_supported = 0;
          }
      } else {
 -        vq_supported = cpu->sve_vq_supported;
 +        vq_supported = cpu->sve_vq.supported;
      }
      /*
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
      /* From now on sve_max_vq is the actual maximum supported length. */
      cpu->sve_max_vq = max_vq;
 -    cpu->sve_vq_map = vq_map;
 +    cpu->sve_vq.map = vq_map;
  }
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
+ static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
-     cpu->gic_num_lrs = 4;
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
-     cpu->gic_vpribits = 5;
+     if (!cpu_isar_feature(aa64_sve, cpu)) {
-     cpu->gic_vprebits = 5;
+         value = false;
--    cpu->isar.reset_pmcr_el0 = 0x41033000;
+     } else {
-     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
+-        value = extract32(cpu->sve_vq_map, vq - 1, 1);
 +        value = extract32(cpu->sve_vq.map, vq - 1, 1);
      }
      visit_type_bool(v, name, &value, errp);
  }
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
+         return;
-     cpu->gic_num_lrs = 4;
+     }
-     cpu->gic_vpribits = 5;
-     cpu->gic_vprebits = 5;
+-    cpu->sve_vq_map = deposit32(cpu->sve_vq_map, vq - 1, 1, value);
--    cpu->isar.reset_pmcr_el0 = 0x41023000;
+-    cpu->sve_vq_init |= 1 << (vq - 1);
-     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
++    cpu->sve_vq.map = deposit32(cpu->sve_vq.map, vq - 1, 1, value);
 +    cpu->sve_vq.init |= 1 << (vq - 1);
  }
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
+ static bool cpu_arm_get_sve(Object *obj, Error **errp)
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
---- a/target/arm/cpu_tcg.c
+     cpu->dcz_blocksize = 7; /*  512 bytes */
-+++ b/target/arm/cpu_tcg.c
+ #endif
-@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
-     cpu->ccsidr[1] = 0x2007e01a; /* 16k L1 icache. */
+-    cpu->sve_vq_supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
-     cpu->ccsidr[2] = 0xf0000000; /* No L2 icache. */
++    cpu->sve_vq.supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
-     cpu->reset_auxcr = 2;
--    cpu->isar.reset_pmcr_el0 = 0x41002000;
+     aarch64_add_pauth_properties(obj);
-     define_arm_cp_regs(cpu, cortexa8_cp_reginfo);
+     aarch64_add_sve_properties(obj);
- }
+@@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj)
-@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
+     /* The A64FX supports only 128, 256 and 512 bit vector lengths */
-     cpu->clidr = (1 << 27) | (1 << 24) | 3;
+     aarch64_add_sve_properties(obj);
-     cpu->ccsidr[0] = 0xe00fe019; /* 16k L1 dcache. */
+-    cpu->sve_vq_supported = (1 << 0)  /* 128bit */
-     cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */
++    cpu->sve_vq.supported = (1 << 0)  /* 128bit */
--    cpu->isar.reset_pmcr_el0 = 0x41093000;
+                           | (1 << 1)  /* 256bit */
-     define_arm_cp_regs(cpu, cortexa9_cp_reginfo);
+                           | (1 << 3); /* 512bit */
  }
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
      cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
      cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
      cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
 -    cpu->isar.reset_pmcr_el0 = 0x41072000;
      define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */
  }
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
      cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
      cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
      cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
 -    cpu->isar.reset_pmcr_el0 = 0x410F3000;
      define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
  }
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
      cpu->isar.id_isar6 = 0x0;
      cpu->mp_is_up = true;
      cpu->pmsav7_dregion = 16;
 -    cpu->isar.reset_pmcr_el0 = 0x41151800;
      define_arm_cp_regs(cpu, cortexr5_cp_reginfo);
  }
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
- #endif
+         len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
+     }
- #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
-+#define PMCR_NUM_COUNTERS 4 /* QEMU IMPDEF choice */
+-    len = 31 - clz32(cpu->sve_vq_map & MAKE_64BIT_MASK(0, len + 1));
++    len = 31 - clz32(cpu->sve_vq.map & MAKE_64BIT_MASK(0, len + 1));
- #ifndef CONFIG_USER_ONLY
+     return len;
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
  static inline uint32_t pmu_num_counters(CPUARMState *env)
  {
 -    ARMCPU *cpu = env_archcpu(env);
 -
 -    return (cpu->isar.reset_pmcr_el0 & PMCRN_MASK) >> PMCRN_SHIFT;
 +  return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
  }
- /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
-       .resetvalue = 0,
-       .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
- #endif
-+    /* The only field of MDCR_EL2 that has a defined architectural reset value
-+     * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N.
-+     */
-+    { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
-+      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
-+      .access = PL2_RW, .resetvalue = PMCR_NUM_COUNTERS,
-+      .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), },
-     { .name = "HPFAR", .state = ARM_CP_STATE_AA32,
-       .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
-       .access = PL2_RW, .accessfn = access_el3_aa32ns,
-@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
-      * field as main ID register, and we implement four counters in
-      * addition to the cycle count register.
-      */
--    unsigned int i, pmcrn = pmu_num_counters(&cpu->env);
-+    unsigned int i, pmcrn = PMCR_NUM_COUNTERS;
-     ARMCPRegInfo pmcr = {
-         .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
-         .access = PL0_RW,
-@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
-         .access = PL0_RW, .accessfn = pmreg_access,
-         .type = ARM_CP_IO,
-         .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
--        .resetvalue = cpu->isar.reset_pmcr_el0,
-+        .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT) |
-+                      PMCRLC,
-         .writefn = pmcr_write, .raw_writefn = raw_write,
-     };
--
-     define_one_arm_cp_reg(cpu, &pmcr);
-     define_one_arm_cp_reg(cpu, &pmcr64);
-     for (i = 0; i < pmcrn; i++) {
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-               .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
-             REGINFO_SENTINEL
-         };
--        /*
--         * The only field of MDCR_EL2 that has a defined architectural reset
--         * value is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N.
--         */
--        ARMCPRegInfo mdcr_el2 = {
--            .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
--            .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
--            .access = PL2_RW, .resetvalue = pmu_num_counters(env),
--            .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2),
--        };
--        define_one_arm_cp_reg(cpu, &mdcr_el2);
-         define_arm_cp_regs(cpu, vpidr_regs);
-         define_arm_cp_regs(cpu, el2_cp_reginfo);
-         if (arm_feature(env, ARM_FEATURE_V8)) {
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
+@@ -XXX,XX +XXX,XX @@ uint32_t kvm_arm_sve_get_vls(CPUState *cs)
-                               ARM64_SYS_REG(3, 0, 0, 7, 1));
+ static int kvm_arm_sve_set_vls(CPUState *cs)
-         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr2,
+ {
-                               ARM64_SYS_REG(3, 0, 0, 7, 2));
+     ARMCPU *cpu = ARM_CPU(cs);
--        err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
+-    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq_map };
--                              ARM64_SYS_REG(3, 3, 9, 12, 0));
++    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq.map };
+     struct kvm_one_reg reg = {
-         /*
+         .id = KVM_REG_ARM64_SVE_VLS,
-          * Note that if AArch32 support is not present in the host,
+         .addr = (uint64_t)&vls[0],
 --
-.20.1
+.25.1

-New patch
+[PULL 16/25] target/arm: Generalize cpu_arm_{get,set}_vq
+From: Richard Henderson <richard.henderson@linaro.org>
+Rename from cpu_arm_{get,set}_sve_vq, and take the
+ARMVQMap as the opaque parameter.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-14-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu64.c | 29 +++++++++++++++--------------
+file changed, 15 insertions(+), 14 deletions(-)
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu64.c
++++ b/target/arm/cpu64.c
+@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
+ }
+ /*
+- * Note that cpu_arm_get/set_sve_vq cannot use the simpler
+- * object_property_add_bool interface because they make use
+- * of the contents of "name" to determine which bit on which
+- * to operate.
++ * Note that cpu_arm_{get,set}_vq cannot use the simpler
++ * object_property_add_bool interface because they make use of the
++ * contents of "name" to determine which bit on which to operate.
+  */
+-static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
+-                               void *opaque, Error **errp)
++static void cpu_arm_get_vq(Object *obj, Visitor *v, const char *name,
++                           void *opaque, Error **errp)
+ {
+     ARMCPU *cpu = ARM_CPU(obj);
++    ARMVQMap *vq_map = opaque;
+     uint32_t vq = atoi(&name[3]) / 128;
+     bool value;
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
+     if (!cpu_isar_feature(aa64_sve, cpu)) {
+         value = false;
+     } else {
+-        value = extract32(cpu->sve_vq.map, vq - 1, 1);
++        value = extract32(vq_map->map, vq - 1, 1);
+     }
+     visit_type_bool(v, name, &value, errp);
+ }
+-static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
+-                               void *opaque, Error **errp)
++static void cpu_arm_set_vq(Object *obj, Visitor *v, const char *name,
++                           void *opaque, Error **errp)
+ {
+-    ARMCPU *cpu = ARM_CPU(obj);
++    ARMVQMap *vq_map = opaque;
+     uint32_t vq = atoi(&name[3]) / 128;
+     bool value;
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
+         return;
+     }
+-    cpu->sve_vq.map = deposit32(cpu->sve_vq.map, vq - 1, 1, value);
+-    cpu->sve_vq.init |= 1 << (vq - 1);
++    vq_map->map = deposit32(vq_map->map, vq - 1, 1, value);
++    vq_map->init |= 1 << (vq - 1);
+ }
+ static bool cpu_arm_get_sve(Object *obj, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
+ void aarch64_add_sve_properties(Object *obj)
+ {
++    ARMCPU *cpu = ARM_CPU(obj);
+     uint32_t vq;
+     object_property_add_bool(obj, "sve", cpu_arm_get_sve, cpu_arm_set_sve);
+@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
+     for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
+         char name[8];
+         sprintf(name, "sve%d", vq * 128);
+-        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
+-                            cpu_arm_set_sve_vq, NULL, NULL);
++        object_property_add(obj, name, "bool", cpu_arm_get_vq,
++                            cpu_arm_set_vq, NULL, &cpu->sve_vq);
+     }
+ #ifdef CONFIG_USER_ONLY
+--
+.25.1

-New patch
+[PULL 17/25] target/arm: Generalize cpu_arm_{get, set}_default_vec_len
+From: Richard Henderson <richard.henderson@linaro.org>
+Rename from cpu_arm_{get,set}_sve_default_vec_len,
+and take the pointer to default_vq from opaque.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-15-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu64.c | 27 ++++++++++++++-------------
+file changed, 14 insertions(+), 13 deletions(-)
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu64.c
++++ b/target/arm/cpu64.c
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
+ #ifdef CONFIG_USER_ONLY
+ /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+-static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
+-                                            const char *name, void *opaque,
+-                                            Error **errp)
++static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
++                                        const char *name, void *opaque,
++                                        Error **errp)
+ {
+-    ARMCPU *cpu = ARM_CPU(obj);
++    uint32_t *ptr_default_vq = opaque;
+     int32_t default_len, default_vq, remainder;
+     if (!visit_type_int32(v, name, &default_len, errp)) {
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
+     /* Undocumented, but the kernel allows -1 to indicate "maximum". */
+     if (default_len == -1) {
+-        cpu->sve_default_vq = ARM_MAX_VQ;
++        *ptr_default_vq = ARM_MAX_VQ;
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
+         return;
+     }
+-    cpu->sve_default_vq = default_vq;
++    *ptr_default_vq = default_vq;
+ }
+-static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
+-                                            const char *name, void *opaque,
+-                                            Error **errp)
++static void cpu_arm_get_default_vec_len(Object *obj, Visitor *v,
++                                        const char *name, void *opaque,
++                                        Error **errp)
+ {
+-    ARMCPU *cpu = ARM_CPU(obj);
+-    int32_t value = cpu->sve_default_vq * 16;
++    uint32_t *ptr_default_vq = opaque;
++    int32_t value = *ptr_default_vq * 16;
+     visit_type_int32(v, name, &value, errp);
+ }
+@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
+ #ifdef CONFIG_USER_ONLY
+     /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+     object_property_add(obj, "sve-default-vector-length", "int32",
+-                        cpu_arm_get_sve_default_vec_len,
+-                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
++                        cpu_arm_get_default_vec_len,
++                        cpu_arm_set_default_vec_len, NULL,
++                        &cpu->sve_default_vq);
+ #endif
+ }
+--
+.25.1

-New patch
+[PULL 18/25] target/arm: Move arm_cpu_*_finalize to internals.h
+From: Richard Henderson <richard.henderson@linaro.org>
+Drop the aa32-only inline fallbacks,
+and just use a couple of ifdefs.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-16-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h       | 6 ------
+ target/arm/internals.h | 3 +++
+ target/arm/cpu.c       | 2 ++
+files changed, 5 insertions(+), 6 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct {
+ #ifdef TARGET_AARCH64
+ # define ARM_MAX_VQ    16
+-void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
+-void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
+-void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
+ #else
+ # define ARM_MAX_VQ    1
+-static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
+-static inline void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp) { }
+-static inline void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp) { }
+ #endif
+ typedef struct ARMVectorReg {
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg);
+ int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
+ int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
+ int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
++void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
++void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
++void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
+ #endif
+ #ifdef CONFIG_USER_ONLY
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
+ {
+     Error *local_err = NULL;
++#ifdef TARGET_AARCH64
+     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+         arm_cpu_sve_finalize(cpu, &local_err);
+         if (local_err != NULL) {
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
+             return;
+         }
+     }
++#endif
+     if (kvm_enabled()) {
+         kvm_arm_steal_time_finalize(cpu, &local_err);
+--
+.25.1

-[PULL 4/6] hw/ppc/e500plat: Only try to add valid dynamic sysbus devices to platform bus
+[PULL 19/25] target/arm: Unexport aarch64_add_*_properties
-The e500plat machine device plug callback currently calls
+From: Richard Henderson <richard.henderson@linaro.org>
 platform_bus_link_device() for any sysbus device.  This is overly
 broad, because platform_bus_link_device() will unconditionally grab
 the IRQs and MMIOs of the device it is passed, whether it was
 intended for the platform bus or not.  Restrict hotpluggability of
 sysbus devices to only those devices on the dynamic sysbus allowlist.
-We were mostly getting away with this because the board creates the
+These functions are not used outside cpu64.c,
-platform bus as the last device it creates, and so the hotplug
+so make them static.
 callback did not do anything for all the sysbus devices created by
 the board itself.  However if the user plugged in a device which
 itself uses a sysbus device internally we would have mishandled this
 and probably asserted. An example of this is:
  qemu-system-ppc64 -M ppce500 -device macio-oldworld
-This isn't a sensible command because the macio-oldworld device
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-is really specific to the 'g3beige' machine, but we now fail
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-with a reasonable error message rather than asserting:
+Message-id: 20220620175235.60881-17-richard.henderson@linaro.org
-qemu-system-ppc64: Device heathrow is not supported by this machine yet.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/cpu.h   | 3 ---
  target/arm/cpu64.c | 4 ++--
 files changed, 2 insertions(+), 5 deletions(-)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Acked-by: David Gibson <david@gibson.dropbear.id.au>
 Message-id: 20210325153310.9131-5-peter.maydell@linaro.org
 ---
  hw/ppc/e500plat.c | 8 ++++++--
 file changed, 6 insertions(+), 2 deletions(-)
 diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ppc/e500plat.c
+--- a/target/arm/cpu.h
-+++ b/hw/ppc/e500plat.c
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static void e500plat_machine_device_plug_cb(HotplugHandler *hotplug_dev,
+@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
-     PPCE500MachineState *pms = PPCE500_MACHINE(hotplug_dev);
+ void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
+ void aarch64_sve_change_el(CPUARMState *env, int old_el,
-     if (pms->pbus_dev) {
+                            int new_el, bool el0_a64);
--        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+-void aarch64_add_sve_properties(Object *obj);
-+        MachineClass *mc = MACHINE_GET_CLASS(pms);
+-void aarch64_add_pauth_properties(Object *obj);
-+
+ void arm_reset_sve_state(CPUARMState *env);
-+        if (device_is_dynamic_sysbus(mc, dev)) {
-             platform_bus_link_device(pms->pbus_dev, SYS_BUS_DEVICE(dev));
+ /*
-         }
+@@ -XXX,XX +XXX,XX @@ static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
-     }
+ static inline void aarch64_sve_change_el(CPUARMState *env, int o,
-@@ -XXX,XX +XXX,XX @@ static
+                                          int n, bool a)
- HotplugHandler *e500plat_machine_get_hotpug_handler(MachineState *machine,
+ { }
-                                                     DeviceState *dev)
+-static inline void aarch64_add_sve_properties(Object *obj) { }
  #endif
  void aarch64_sync_32_to_64(CPUARMState *env);
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_default_vec_len(Object *obj, Visitor *v,
  }
  #endif
 -void aarch64_add_sve_properties(Object *obj)
 +static void aarch64_add_sve_properties(Object *obj)
  {
--    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+     ARMCPU *cpu = ARM_CPU(obj);
-+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+     uint32_t vq;
-+
+@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pauth_property =
-+    if (device_is_dynamic_sysbus(mc, dev)) {
+ static Property arm_cpu_pauth_impdef_property =
-         return HOTPLUG_HANDLER(machine);
+     DEFINE_PROP_BOOL("pauth-impdef", ARMCPU, prop_pauth_impdef, false);
-     }
 -void aarch64_add_pauth_properties(Object *obj)
 +static void aarch64_add_pauth_properties(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
 --
-.20.1
+.25.1

-New patch
+[PULL 20/25] target/arm: Add cpu properties for SME
+From: Richard Henderson <richard.henderson@linaro.org>
+Mirror the properties for SVE.  The main difference is
+that any arbitrary set of powers of 2 may be supported,
+and not the stricter constraints that apply to SVE.
+Include a property to control FEAT_SME_FA64, as failing
+to restrict the runtime to the proper subset of insns
+could be a major point for bugs.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20220620175235.60881-18-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ docs/system/arm/cpu-features.rst |  56 +++++++++++++++
+ target/arm/cpu.h                 |   2 +
+ target/arm/internals.h           |   1 +
+ target/arm/cpu.c                 |  14 +++-
+ target/arm/cpu64.c               | 114 +++++++++++++++++++++++++++++--
+files changed, 180 insertions(+), 7 deletions(-)
+diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/arm/cpu-features.rst
++++ b/docs/system/arm/cpu-features.rst
+@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
+ lengths is to explicitly enable each desired length.  Therefore only
+ example's (1), (4), and (6) exhibit recommended uses of the properties.
++SME CPU Property Examples
++-------------------------
++
++  1) Disable SME::
++
++     $ qemu-system-aarch64 -M virt -cpu max,sme=off
++
++  2) Implicitly enable all vector lengths for the ``max`` CPU type::
++
++     $ qemu-system-aarch64 -M virt -cpu max
++
++  3) Only enable the 256-bit vector length::
++
++     $ qemu-system-aarch64 -M virt -cpu max,sme256=on
++
++  3) Enable the 256-bit and 1024-bit vector lengths::
++
++     $ qemu-system-aarch64 -M virt -cpu max,sme256=on,sme1024=on
++
++  4) Disable the 512-bit vector length.  This results in all the other
++     lengths supported by ``max`` defaulting to enabled
++     (128, 256, 1024 and 2048)::
++
++     $ qemu-system-aarch64 -M virt -cpu max,sve512=off
++
+ SVE User-mode Default Vector Length Property
+ --------------------------------------------
+@@ -XXX,XX +XXX,XX @@ length supported by QEMU is 256.
+ If this property is set to ``-1`` then the default vector length
+ is set to the maximum possible length.
++
++SME CPU Properties
++==================
++
++The SME CPU properties are much like the SVE properties: ``sme`` is
++used to enable or disable the entire SME feature, and ``sme<N>`` is
++used to enable or disable specific vector lengths.  Finally,
++``sme_fa64`` is used to enable or disable ``FEAT_SME_FA64``, which
++allows execution of the "full a64" instruction set while Streaming
++SVE mode is enabled.
++
++SME is not supported by KVM at this time.
++
++At least one vector length must be enabled when ``sme`` is enabled,
++and all vector lengths must be powers of 2.  The maximum vector
++length supported by qemu is 2048 bits.  Otherwise, there are no
++additional constraints on the set of vector lengths supported by SME.
++
++SME User-mode Default Vector Length Property
++--------------------------------------------
++
++For qemu-aarch64, the cpu propery ``sme-default-vector-length=N`` is
++defined to mirror the Linux kernel parameter file
++``/proc/sys/abi/sme_default_vector_length``.  The default length, ``N``,
++is in units of bytes and must be between 16 and 8192.
++If not specified, the default vector length is 32.
++
++As with ``sve-default-vector-length``, if the default length is larger
++than the maximum vector length enabled, the actual vector length will
++be reduced.  If this property is set to ``-1`` then the default vector
++length is set to the maximum possible length.
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
+ #ifdef CONFIG_USER_ONLY
+     /* Used to set the default vector length at process start. */
+     uint32_t sve_default_vq;
++    uint32_t sme_default_vq;
+ #endif
+     ARMVQMap sve_vq;
++    ARMVQMap sme_vq;
+     /* Generic timer counter frequency, in Hz */
+     uint64_t gt_cntfrq_hz;
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
+ int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
+ int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
+ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
++void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
+ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
+ void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
+ #endif
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
+ #ifdef CONFIG_USER_ONLY
+ # ifdef TARGET_AARCH64
+     /*
+-     * The linux kernel defaults to 512-bit vectors, when sve is supported.
+-     * See documentation for /proc/sys/abi/sve_default_vector_length, and
+-     * our corresponding sve-default-vector-length cpu property.
++     * The linux kernel defaults to 512-bit for SVE, and 256-bit for SME.
++     * These values were chosen to fit within the default signal frame.
++     * See documentation for /proc/sys/abi/{sve,sme}_default_vector_length,
++     * and our corresponding cpu property.
+      */
+     cpu->sve_default_vq = 4;
++    cpu->sme_default_vq = 2;
+ # endif
+ #else
+     /* Our inbound IRQ and FIQ lines */
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
+             return;
+         }
++        arm_cpu_sme_finalize(cpu, &local_err);
++        if (local_err != NULL) {
++            error_propagate(errp, local_err);
++            return;
++        }
++
+         arm_cpu_pauth_finalize(cpu, &local_err);
+         if (local_err != NULL) {
+             error_propagate(errp, local_err);
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu64.c
++++ b/target/arm/cpu64.c
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_vq(Object *obj, Visitor *v, const char *name,
+     ARMCPU *cpu = ARM_CPU(obj);
+     ARMVQMap *vq_map = opaque;
+     uint32_t vq = atoi(&name[3]) / 128;
++    bool sve = vq_map == &cpu->sve_vq;
+     bool value;
+-    /* All vector lengths are disabled when SVE is off. */
+-    if (!cpu_isar_feature(aa64_sve, cpu)) {
++    /* All vector lengths are disabled when feature is off. */
++    if (sve
++        ? !cpu_isar_feature(aa64_sve, cpu)
++        : !cpu_isar_feature(aa64_sme, cpu)) {
+         value = false;
+     } else {
+         value = extract32(vq_map->map, vq - 1, 1);
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
+     cpu->isar.id_aa64pfr0 = t;
+ }
++void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp)
++{
++    uint32_t vq_map = cpu->sme_vq.map;
++    uint32_t vq_init = cpu->sme_vq.init;
++    uint32_t vq_supported = cpu->sme_vq.supported;
++    uint32_t vq;
++
++    if (vq_map == 0) {
++        if (!cpu_isar_feature(aa64_sme, cpu)) {
++            cpu->isar.id_aa64smfr0 = 0;
++            return;
++        }
++
++        /* TODO: KVM will require limitations via SMCR_EL2. */
++        vq_map = vq_supported & ~vq_init;
++
++        if (vq_map == 0) {
++            vq = ctz32(vq_supported) + 1;
++            error_setg(errp, "cannot disable sme%d", vq * 128);
++            error_append_hint(errp, "All SME vector lengths are disabled.\n");
++            error_append_hint(errp, "With SME enabled, at least one "
++                              "vector length must be enabled.\n");
++            return;
++        }
++    } else {
++        if (!cpu_isar_feature(aa64_sme, cpu)) {
++            vq = 32 - clz32(vq_map);
++            error_setg(errp, "cannot enable sme%d", vq * 128);
++            error_append_hint(errp, "SME must be enabled to enable "
++                              "vector lengths.\n");
++            error_append_hint(errp, "Add sme=on to the CPU property list.\n");
++            return;
++        }
++        /* TODO: KVM will require limitations via SMCR_EL2. */
++    }
++
++    cpu->sme_vq.map = vq_map;
++}
++
++static bool cpu_arm_get_sme(Object *obj, Error **errp)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++    return cpu_isar_feature(aa64_sme, cpu);
++}
++
++static void cpu_arm_set_sme(Object *obj, bool value, Error **errp)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++    uint64_t t;
++
++    t = cpu->isar.id_aa64pfr1;
++    t = FIELD_DP64(t, ID_AA64PFR1, SME, value);
++    cpu->isar.id_aa64pfr1 = t;
++}
++
++static bool cpu_arm_get_sme_fa64(Object *obj, Error **errp)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++    return cpu_isar_feature(aa64_sme, cpu) &&
++           cpu_isar_feature(aa64_sme_fa64, cpu);
++}
++
++static void cpu_arm_set_sme_fa64(Object *obj, bool value, Error **errp)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++    uint64_t t;
++
++    t = cpu->isar.id_aa64smfr0;
++    t = FIELD_DP64(t, ID_AA64SMFR0, FA64, value);
++    cpu->isar.id_aa64smfr0 = t;
++}
++
+ #ifdef CONFIG_USER_ONLY
+-/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
++/* Mirror linux /proc/sys/abi/{sve,sme}_default_vector_length. */
+ static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
+                                         const char *name, void *opaque,
+                                         Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
+      * and is the maximum architectural width of ZCR_ELx.LEN.
+      */
+     if (remainder || default_vq < 1 || default_vq > 512) {
+-        error_setg(errp, "cannot set sve-default-vector-length");
++        ARMCPU *cpu = ARM_CPU(obj);
++        const char *which =
++            (ptr_default_vq == &cpu->sve_default_vq ? "sve" : "sme");
++
++        error_setg(errp, "cannot set %s-default-vector-length", which);
+         if (remainder) {
+             error_append_hint(errp, "Vector length not a multiple of 16\n");
+         } else if (default_vq < 1) {
+@@ -XXX,XX +XXX,XX @@ static void aarch64_add_sve_properties(Object *obj)
+ #endif
+ }
++static void aarch64_add_sme_properties(Object *obj)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++    uint32_t vq;
++
++    object_property_add_bool(obj, "sme", cpu_arm_get_sme, cpu_arm_set_sme);
++    object_property_add_bool(obj, "sme_fa64", cpu_arm_get_sme_fa64,
++                             cpu_arm_set_sme_fa64);
++
++    for (vq = 1; vq <= ARM_MAX_VQ; vq <<= 1) {
++        char name[8];
++        sprintf(name, "sme%d", vq * 128);
++        object_property_add(obj, name, "bool", cpu_arm_get_vq,
++                            cpu_arm_set_vq, NULL, &cpu->sme_vq);
++    }
++
++#ifdef CONFIG_USER_ONLY
++    /* Mirror linux /proc/sys/abi/sme_default_vector_length. */
++    object_property_add(obj, "sme-default-vector-length", "int32",
++                        cpu_arm_get_default_vec_len,
++                        cpu_arm_set_default_vec_len, NULL,
++                        &cpu->sme_default_vq);
++#endif
++}
++
+ void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
+ {
+     int arch_val = 0, impdef_val = 0;
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+ #endif
+     cpu->sve_vq.supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
++    cpu->sme_vq.supported = SVE_VQ_POW2_MAP;
+     aarch64_add_pauth_properties(obj);
+     aarch64_add_sve_properties(obj);
++    aarch64_add_sme_properties(obj);
+     object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
+                         cpu_max_set_sve_max_vq, NULL, NULL);
+     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
+--
+.25.1

-[PULL 2/6] machine: Provide a function to check the dynamic sysbus allowlist
+[PULL 21/25] target/arm: Introduce sve_vqm1_for_el_sm
-Provide a new function dynamic_sysbus_dev_allowed() which checks the
+From: Richard Henderson <richard.henderson@linaro.org>
 per-machine list of permitted dynamic sysbus devices and returns a
 boolean result indicating whether the device is allowed.  We can use
 this in the implementation of validate_sysbus_device(), but we will
 also need it so that machine hotplug callbacks can validate devices
 rather than assuming that any sysbus device might be hotpluggable
 into the platform bus.
+When Streaming SVE mode is enabled, the size is taken from
+SMCR_ELx instead of ZCR_ELx.  The format is shared, but the
+set of vector lengths is not.  Further, Streaming SVE does
+not require any particular length to be supported.
+Adjust sve_vqm1_for_el to pass the current value of PSTATE.SM
+to the new function.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-19-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20210325153310.9131-3-peter.maydell@linaro.org
 ---
- include/hw/boards.h | 24 ++++++++++++++++++++++++
+ target/arm/cpu.h    |  9 +++++++--
- hw/core/machine.c   | 21 ++++++++++++++++-----
+ target/arm/helper.c | 32 +++++++++++++++++++++++++-------
-files changed, 40 insertions(+), 5 deletions(-)
+files changed, 32 insertions(+), 9 deletions(-)
-diff --git a/include/hw/boards.h b/include/hw/boards.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
+--- a/target/arm/cpu.h
-+++ b/include/hw/boards.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int cur_el);
  int sme_exception_el(CPUARMState *env, int cur_el);
  /**
 - * sve_vqm1_for_el:
 + * sve_vqm1_for_el_sm:
   * @env: CPUARMState
   * @el: exception level
 + * @sm: streaming mode
   *
 - * Compute the current SVE vector length for @el, in units of
 + * Compute the current vector length for @el & @sm, in units of
   * Quadwords Minus 1 -- the same scale used for ZCR_ELx.LEN.
 + * If @sm, compute for SVL, otherwise NVL.
   */
- void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type);
++uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm);
 +/**
 + * device_is_dynamic_sysbus: test whether device is a dynamic sysbus device
 + * @mc: Machine class
 + * @dev: device to check
 + *
 + * Returns: true if @dev is a sysbus device on the machine's list
 + * of dynamically pluggable sysbus devices; otherwise false.
 + *
 + * This function checks whether @dev is a valid dynamic sysbus device,
 + * by first confirming that it is a sysbus device and then checking it
 + * against the list of permitted dynamic sysbus devices which has been
 + * set up by the machine using machine_class_allow_dynamic_sysbus_dev().
 + *
 + * It is valid to call this with something that is not a subclass of
 + * TYPE_SYS_BUS_DEVICE; the function will return false in this case.
 + * This allows hotplug callback functions to be written as:
 + *     if (device_is_dynamic_sysbus(mc, dev)) {
 + *         handle dynamic sysbus case;
 + *     } else if (some other kind of hotplug) {
 + *         handle that;
 + *     }
 + */
 +bool device_is_dynamic_sysbus(MachineClass *mc, DeviceState *dev);
 +
++/* Likewise, but using @sm = PSTATE.SM. */
+ uint32_t sve_vqm1_for_el(CPUARMState *env, int el);
+ static inline bool is_a64(CPUARMState *env)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ int sme_exception_el(CPUARMState *env, int el)
  /*
-  * Checks that backend isn't used, preps it for exclusive usage and
+  * Given that SVE is enabled, return the vector length for EL.
-  * returns migratable MemoryRegion provided by backend.
+  */
-diff --git a/hw/core/machine.c b/hw/core/machine.c
+-uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
-index XXXXXXX..XXXXXXX 100644
++uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm)
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -XXX,XX +XXX,XX @@ void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type)
      QAPI_LIST_PREPEND(mc->allowed_dynamic_sysbus_devices, g_strdup(type));
  }
 -static void validate_sysbus_device(SysBusDevice *sbdev, void *opaque)
 +bool device_is_dynamic_sysbus(MachineClass *mc, DeviceState *dev)
  {
--    MachineState *machine = opaque;
+     ARMCPU *cpu = env_archcpu(env);
--    MachineClass *mc = MACHINE_GET_CLASS(machine);
+-    uint32_t len = cpu->sve_max_vq - 1;
-     bool allowed = false;
++    uint64_t *cr = env->vfp.zcr_el;
-     strList *wl;
++    uint32_t map = cpu->sve_vq.map;
-+    Object *obj = OBJECT(dev);
++    uint32_t len = ARM_MAX_VQ - 1;
 +
-+    if (!object_dynamic_cast(obj, TYPE_SYS_BUS_DEVICE)) {
++    if (sm) {
-+        return false;
++        cr = env->vfp.smcr_el;
 +        map = cpu->sme_vq.map;
 +    }
-     for (wl = mc->allowed_dynamic_sysbus_devices;
+     if (el <= 1 && !el_is_in_host(env, el)) {
-          !allowed && wl;
+-        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
-          wl = wl->next) {
++        len = MIN(len, 0xf & (uint32_t)cr[1]);
 -        allowed |= !!object_dynamic_cast(OBJECT(sbdev), wl->value);
 +        allowed |= !!object_dynamic_cast(obj, wl->value);
      }
+     if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) {
--    if (!allowed) {
+-        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
-+    return allowed;
++        len = MIN(len, 0xf & (uint32_t)cr[2]);
      }
      if (arm_feature(env, ARM_FEATURE_EL3)) {
 -        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
 +        len = MIN(len, 0xf & (uint32_t)cr[3]);
      }
 -    len = 31 - clz32(cpu->sve_vq.map & MAKE_64BIT_MASK(0, len + 1));
 -    return len;
 +    map &= MAKE_64BIT_MASK(0, len + 1);
 +    if (map != 0) {
 +        return 31 - clz32(map);
 +    }
 +
 +    /* Bit 0 is always set for Normal SVE -- not so for Streaming SVE. */
 +    assert(sm);
 +    return ctz32(cpu->sme_vq.map);
 +}
 +
-+static void validate_sysbus_device(SysBusDevice *sbdev, void *opaque)
++uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
 +{
-+    MachineState *machine = opaque;
++    return sve_vqm1_for_el_sm(env, el, FIELD_EX64(env->svcr, SVCR, SM));
-+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+ }
-+
-+    if (!device_is_dynamic_sysbus(mc, DEVICE(sbdev))) {
+ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
          error_report("Option '-device %s' cannot be handled by this machine",
                       object_class_get_name(object_get_class(OBJECT(sbdev))));
          exit(1);
 --
-.20.1
+.25.1

-[PULL 1/6] include/hw/boards.h: Document machine_class_allow_dynamic_sysbus_dev()
+[PULL 22/25] target/arm: Add SVL to TB flags
-The function machine_class_allow_dynamic_sysbus_dev() is currently
+From: Richard Henderson <richard.henderson@linaro.org>
 undocumented; add a doc comment.
+We need SVL separate from VL for RDSVL et al, as well as
+ZA storage loads and stores, which do not require PSTATE.SM.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-20-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20210325153310.9131-2-peter.maydell@linaro.org
 ---
- include/hw/boards.h | 15 +++++++++++++++
+ target/arm/cpu.h           | 12 ++++++++++++
-file changed, 15 insertions(+)
+ target/arm/translate.h     |  1 +
  target/arm/helper.c        |  8 +++++++-
  target/arm/translate-a64.c |  1 +
 files changed, 21 insertions(+), 1 deletion(-)
-diff --git a/include/hw/boards.h b/include/hw/boards.h
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
+--- a/target/arm/cpu.h
-+++ b/include/hw/boards.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
-                                const CpuInstanceProperties *props,
+ FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
-                                Error **errp);
+ FIELD(TBFLAG_A64, PSTATE_SM, 22, 1)
  FIELD(TBFLAG_A64, PSTATE_ZA, 23, 1)
 +FIELD(TBFLAG_A64, SVL, 24, 4)
  /*
   * Helpers for using the above.
@@ -XXX,XX +XXX,XX @@ static inline int sve_vq(CPUARMState *env)
      return EX_TBFLAG_A64(env->hflags, VL) + 1;
  }
 +/**
-+ * machine_class_allow_dynamic_sysbus_dev: Add type to list of valid devices
++ * sme_vq
-+ * @mc: Machine class
++ * @env: the cpu context
 + * @type: type to allow (should be a subtype of TYPE_SYS_BUS_DEVICE)
 + *
-+ * Add the QOM type @type to the list of devices of which are subtypes
++ * Return the SVL cached within env->hflags, in units of quadwords.
 + * of TYPE_SYS_BUS_DEVICE but which are still permitted to be dynamically
 + * created (eg by the user on the command line with -device).
 + * By default if the user tries to create any devices on the command line
 + * that are subtypes of TYPE_SYS_BUS_DEVICE they will get an error message;
 + * for the special cases which are permitted for this machine model, the
 + * machine model class init code must call this function to add them
 + * to the list of specifically permitted devices.
 + */
- void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type);
++static inline int sme_vq(CPUARMState *env)
 +{
 +    return EX_TBFLAG_A64(env->hflags, SVL) + 1;
 +}
 +
- /*
+ static inline bool bswap_code(bool sctlr_b)
-  * Checks that backend isn't used, preps it for exclusive usage and
+ {
-  * returns migratable MemoryRegion provided by backend.
+ #ifdef CONFIG_USER_ONLY
 diff --git a/target/arm/translate.h b/target/arm/translate.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate.h
 +++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
      int sve_excp_el; /* SVE exception EL or 0 if enabled */
      int sme_excp_el; /* SME exception EL or 0 if enabled */
      int vl;          /* current vector length in bytes */
 +    int svl;         /* current streaming vector length in bytes */
      bool vfp_enabled; /* FP enabled via FPSCR.EN */
      int vec_len;
      int vec_stride;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
          DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
      }
      if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
 -        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
 +        int sme_el = sme_exception_el(env, el);
 +
 +        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_el);
 +        if (sme_el == 0) {
 +            /* Similarly, do not compute SVL if SME is disabled. */
 +            DP_TBFLAG_A64(flags, SVL, sve_vqm1_for_el_sm(env, el, true));
 +        }
          if (FIELD_EX64(env->svcr, SVCR, SM)) {
              DP_TBFLAG_A64(flags, PSTATE_SM, 1);
          }
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
      dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
      dc->sme_excp_el = EX_TBFLAG_A64(tb_flags, SMEEXC_EL);
      dc->vl = (EX_TBFLAG_A64(tb_flags, VL) + 1) * 16;
 +    dc->svl = (EX_TBFLAG_A64(tb_flags, SVL) + 1) * 16;
      dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
      dc->bt = EX_TBFLAG_A64(tb_flags, BT);
      dc->btype = EX_TBFLAG_A64(tb_flags, BTYPE);
 --
-.20.1
+.25.1

-New patch
+[PULL 23/25] target/arm: Move pred_{full, gvec}_reg_{offset, size} to translate-a64.h
+From: Richard Henderson <richard.henderson@linaro.org>
+We will need these functions in translate-sme.c.
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220620175235.60881-21-richard.henderson@linaro.org
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/translate-a64.h | 38 ++++++++++++++++++++++++++++++++++++++
+ target/arm/translate-sve.c | 36 ------------------------------------
+files changed, 38 insertions(+), 36 deletions(-)
+diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-a64.h
++++ b/target/arm/translate-a64.h
+@@ -XXX,XX +XXX,XX @@ static inline int vec_full_reg_size(DisasContext *s)
+     return s->vl;
+ }
++/*
++ * Return the offset info CPUARMState of the predicate vector register Pn.
++ * Note for this purpose, FFR is P16.
++ */
++static inline int pred_full_reg_offset(DisasContext *s, int regno)
++{
++    return offsetof(CPUARMState, vfp.pregs[regno]);
++}
++
++/* Return the byte size of the whole predicate register, VL / 64.  */
++static inline int pred_full_reg_size(DisasContext *s)
++{
++    return s->vl >> 3;
++}
++
++/*
++ * Round up the size of a register to a size allowed by
++ * the tcg vector infrastructure.  Any operation which uses this
++ * size may assume that the bits above pred_full_reg_size are zero,
++ * and must leave them the same way.
++ *
++ * Note that this is not needed for the vector registers as they
++ * are always properly sized for tcg vectors.
++ */
++static inline int size_for_gvec(int size)
++{
++    if (size <= 8) {
++        return 8;
++    } else {
++        return QEMU_ALIGN_UP(size, 16);
++    }
++}
++
++static inline int pred_gvec_reg_size(DisasContext *s)
++{
++    return size_for_gvec(pred_full_reg_size(s));
++}
++
+ bool disas_sve(DisasContext *, uint32_t);
+ void gen_gvec_rax1(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
+diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/translate-sve.c
++++ b/target/arm/translate-sve.c
+@@ -XXX,XX +XXX,XX @@ static inline int msz_dtype(DisasContext *s, int msz)
+  * Implement all of the translator functions referenced by the decoder.
+  */
+-/* Return the offset info CPUARMState of the predicate vector register Pn.
+- * Note for this purpose, FFR is P16.
+- */
+-static inline int pred_full_reg_offset(DisasContext *s, int regno)
+-{
+-    return offsetof(CPUARMState, vfp.pregs[regno]);
+-}
+-
+-/* Return the byte size of the whole predicate register, VL / 64.  */
+-static inline int pred_full_reg_size(DisasContext *s)
+-{
+-    return s->vl >> 3;
+-}
+-
+-/* Round up the size of a register to a size allowed by
+- * the tcg vector infrastructure.  Any operation which uses this
+- * size may assume that the bits above pred_full_reg_size are zero,
+- * and must leave them the same way.
+- *
+- * Note that this is not needed for the vector registers as they
+- * are always properly sized for tcg vectors.
+- */
+-static int size_for_gvec(int size)
+-{
+-    if (size <= 8) {
+-        return 8;
+-    } else {
+-        return QEMU_ALIGN_UP(size, 16);
+-    }
+-}
+-
+-static int pred_gvec_reg_size(DisasContext *s)
+-{
+-    return size_for_gvec(pred_full_reg_size(s));
+-}
+-
+ /* Invoke an out-of-line helper on 2 Zregs. */
+ static bool gen_gvec_ool_zz(DisasContext *s, gen_helper_gvec_2 *fn,
+                             int rd, int rn, int data)
+--
+.25.1

-[PULL 3/6] hw/arm/virt: Only try to add valid dynamic sysbus devices to platform bus
+[PULL 24/25] target/arm: Extend arm_pamax to more than aarch64
-The virt machine device plug callback currently calls
+From: Richard Henderson <richard.henderson@linaro.org>
 platform_bus_link_device() for any sysbus device.  This is overly
 broad, because platform_bus_link_device() will unconditionally grab
 the IRQs and MMIOs of the device it is passed, whether it was
 intended for the platform bus or not.  Restrict hotpluggability of
 sysbus devices to only those devices on the dynamic sysbus
 allowlist.
-We were mostly getting away with this because the board creates the
+Move the code from hw/arm/virt.c that is supposed
-platform bus as the last device it creates, and so the hotplug
+to handle v7 into the one function.
 callback did not do anything for all the sysbus devices created by
 the board itself.  However if the user plugged in a device which
 itself uses a sysbus device internally we would have mishandled this
 and probably asserted.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reported-by: He Zhe <zhe.he@windriver.com>
+Message-id: 20220619001541.131672-2-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20210325153310.9131-4-peter.maydell@linaro.org
 ---
- hw/arm/virt.c | 8 ++++++--
+ hw/arm/virt.c    | 10 +---------
-file changed, 6 insertions(+), 2 deletions(-)
+ target/arm/ptw.c | 24 ++++++++++++++++--------
 files changed, 17 insertions(+), 17 deletions(-)
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
+@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-     VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);
+         cpuobj = object_new(possible_cpus->cpus[0].type);
+         armcpu = ARM_CPU(cpuobj);
-     if (vms->platform_bus_dev) {
--        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+-        if (object_property_get_bool(cpuobj, "aarch64", NULL)) {
-+        MachineClass *mc = MACHINE_GET_CLASS(vms);
+-            pa_bits = arm_pamax(armcpu);
-+
+-        } else if (arm_feature(&armcpu->env, ARM_FEATURE_LPAE)) {
-+        if (device_is_dynamic_sysbus(mc, dev)) {
+-            /* v7 with LPAE */
-             platform_bus_link_device(PLATFORM_BUS_DEVICE(vms->platform_bus_dev),
+-            pa_bits = 40;
-                                      SYS_BUS_DEVICE(dev));
+-        } else {
-         }
+-            /* Anything else */
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_unplug_cb(HotplugHandler *hotplug_dev,
+-            pa_bits = 32;
- static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
+-        }
-                                                         DeviceState *dev)
++        pa_bits = arm_pamax(armcpu);
          object_unref(cpuobj);
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t pamax_map[] = {
  /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
  unsigned int arm_pamax(ARMCPU *cpu)
  {
--    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE) ||
+-    unsigned int parange =
-+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+-        FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
-+
++    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
-+    if (device_is_dynamic_sysbus(mc, dev) ||
++        unsigned int parange =
-        (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM))) {
++            FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
-         return HOTPLUG_HANDLER(machine);
-     }
+-    /*
 -     * id_aa64mmfr0 is a read-only register so values outside of the
 -     * supported mappings can be considered an implementation error.
 -     */
 -    assert(parange < ARRAY_SIZE(pamax_map));
 -    return pamax_map[parange];
 +        /*
 +         * id_aa64mmfr0 is a read-only register so values outside of the
 +         * supported mappings can be considered an implementation error.
 +         */
 +        assert(parange < ARRAY_SIZE(pamax_map));
 +        return pamax_map[parange];
 +    }
 +    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
 +        /* v7 with LPAE */
 +        return 40;
 +    }
 +    /* Anything else */
 +    return 32;
  }
  /*
 --
-.20.1
+.25.1

-New patch
+[PULL 25/25] target/arm: Check V7VE as well as LPAE in arm_pamax
+From: Richard Henderson <richard.henderson@linaro.org>
+In machvirt_init we create a cpu but do not fully initialize it.
+Thus the propagation of V7VE to LPAE has not been done, and we
+compute the wrong value for some v7 cpus, e.g. cortex-a15.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1078
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reported-by: He Zhe <zhe.he@windriver.com>
+Message-id: 20220619001541.131672-3-richard.henderson@linaro.org
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/ptw.c | 8 +++++++-
+file changed, 7 insertions(+), 1 deletion(-)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@ unsigned int arm_pamax(ARMCPU *cpu)
+         assert(parange < ARRAY_SIZE(pamax_map));
+         return pamax_map[parange];
+     }
+-    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
++
++    /*
++     * In machvirt_init, we call arm_pamax on a cpu that is not fully
++     * initialized, so we can't rely on the propagation done in realize.
++     */
++    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE) ||
++        arm_feature(&cpu->env, ARM_FEATURE_V7VE)) {
+         /* v7 with LPAE */
+         return 40;
+     }
+--
+.25.1

A few patches for the rc today...

The following changes since commit 109918d24a3bb9ed3d05beb34ea4ac6be443c138:

Merge remote-tracking branch 'remotes/nvme/tags/nvme-fixes-for-6.0-pull-request' into staging (2021-04-05 22:15:38 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210406

for you to fetch changes up to 49bc76550c37f4a2b92a05cb3e6989a739d56ac9:

Remove myself as i.mx31 maintainer (2021-04-06 11:49:15 +0100)

----------------------------------------------------------------
target-arm queue:
 * ppc/e500 and arm/virt: only add valid dynamic sysbus devices to the
   platform bus
 * update i.mx31 maintainer list
 * Revert "target/arm: Make number of counters in PMCR follow the CPU"

----------------------------------------------------------------
Chubb, Peter (Data61, Eveleigh) (1):
      Remove myself as i.mx31 maintainer

Peter Maydell (5):
      include/hw/boards.h: Document machine_class_allow_dynamic_sysbus_dev()
      machine: Provide a function to check the dynamic sysbus allowlist
      hw/arm/virt: Only try to add valid dynamic sysbus devices to platform bus
      hw/ppc/e500plat: Only try to add valid dynamic sysbus devices to platform bus
      Revert "target/arm: Make number of counters in PMCR follow the CPU"

The function machine_class_allow_dynamic_sysbus_dev() is currently
undocumented; add a doc comment.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20210325153310.9131-2-peter.maydell@linaro.org
---
 include/hw/boards.h | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
                                const CpuInstanceProperties *props,
                                Error **errp);
 
+/**
+ * machine_class_allow_dynamic_sysbus_dev: Add type to list of valid devices
+ * @mc: Machine class
+ * @type: type to allow (should be a subtype of TYPE_SYS_BUS_DEVICE)
+ *
+ * Add the QOM type @type to the list of devices of which are subtypes
+ * of TYPE_SYS_BUS_DEVICE but which are still permitted to be dynamically
+ * created (eg by the user on the command line with -device).
+ * By default if the user tries to create any devices on the command line
+ * that are subtypes of TYPE_SYS_BUS_DEVICE they will get an error message;
+ * for the special cases which are permitted for this machine model, the
+ * machine model class init code must call this function to add them
+ * to the list of specifically permitted devices.
+ */
 void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type);
+
 /*
  * Checks that backend isn't used, preps it for exclusive usage and
  * returns migratable MemoryRegion provided by backend.
-- 
2.20.1

Provide a new function dynamic_sysbus_dev_allowed() which checks the
per-machine list of permitted dynamic sysbus devices and returns a
boolean result indicating whether the device is allowed.  We can use
this in the implementation of validate_sysbus_device(), but we will
also need it so that machine hotplug callbacks can validate devices
rather than assuming that any sysbus device might be hotpluggable
into the platform bus.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20210325153310.9131-3-peter.maydell@linaro.org
---
 include/hw/boards.h | 24 ++++++++++++++++++++++++
 hw/core/machine.c   | 21 ++++++++++++++++-----
 2 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
  */
 void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type);
 
+/**
+ * device_is_dynamic_sysbus: test whether device is a dynamic sysbus device
+ * @mc: Machine class
+ * @dev: device to check
+ *
+ * Returns: true if @dev is a sysbus device on the machine's list
+ * of dynamically pluggable sysbus devices; otherwise false.
+ *
+ * This function checks whether @dev is a valid dynamic sysbus device,
+ * by first confirming that it is a sysbus device and then checking it
+ * against the list of permitted dynamic sysbus devices which has been
+ * set up by the machine using machine_class_allow_dynamic_sysbus_dev().
+ *
+ * It is valid to call this with something that is not a subclass of
+ * TYPE_SYS_BUS_DEVICE; the function will return false in this case.
+ * This allows hotplug callback functions to be written as:
+ *     if (device_is_dynamic_sysbus(mc, dev)) {
+ *         handle dynamic sysbus case;
+ *     } else if (some other kind of hotplug) {
+ *         handle that;
+ *     }
+ */
+bool device_is_dynamic_sysbus(MachineClass *mc, DeviceState *dev);
+
 /*
  * Checks that backend isn't used, preps it for exclusive usage and
  * returns migratable MemoryRegion provided by backend.
diff --git a/hw/core/machine.c b/hw/core/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -XXX,XX +XXX,XX @@ void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type)
     QAPI_LIST_PREPEND(mc->allowed_dynamic_sysbus_devices, g_strdup(type));
 }
 
-static void validate_sysbus_device(SysBusDevice *sbdev, void *opaque)
+bool device_is_dynamic_sysbus(MachineClass *mc, DeviceState *dev)
 {
-    MachineState *machine = opaque;
-    MachineClass *mc = MACHINE_GET_CLASS(machine);
     bool allowed = false;
     strList *wl;
+    Object *obj = OBJECT(dev);
+
+    if (!object_dynamic_cast(obj, TYPE_SYS_BUS_DEVICE)) {
+        return false;
+    }
 
     for (wl = mc->allowed_dynamic_sysbus_devices;
          !allowed && wl;
          wl = wl->next) {
-        allowed |= !!object_dynamic_cast(OBJECT(sbdev), wl->value);
+        allowed |= !!object_dynamic_cast(obj, wl->value);
     }
 
-    if (!allowed) {
+    return allowed;
+}
+
+static void validate_sysbus_device(SysBusDevice *sbdev, void *opaque)
+{
+    MachineState *machine = opaque;
+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+
+    if (!device_is_dynamic_sysbus(mc, DEVICE(sbdev))) {
         error_report("Option '-device %s' cannot be handled by this machine",
                      object_class_get_name(object_get_class(OBJECT(sbdev))));
         exit(1);
-- 
2.20.1

The virt machine device plug callback currently calls
platform_bus_link_device() for any sysbus device.  This is overly
broad, because platform_bus_link_device() will unconditionally grab
the IRQs and MMIOs of the device it is passed, whether it was
intended for the platform bus or not.  Restrict hotpluggability of
sysbus devices to only those devices on the dynamic sysbus
allowlist.

We were mostly getting away with this because the board creates the
platform bus as the last device it creates, and so the hotplug
callback did not do anything for all the sysbus devices created by
the board itself.  However if the user plugged in a device which
itself uses a sysbus device internally we would have mishandled this
and probably asserted.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20210325153310.9131-4-peter.maydell@linaro.org
---
 hw/arm/virt.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
     VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);
 
     if (vms->platform_bus_dev) {
-        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+        MachineClass *mc = MACHINE_GET_CLASS(vms);
+
+        if (device_is_dynamic_sysbus(mc, dev)) {
             platform_bus_link_device(PLATFORM_BUS_DEVICE(vms->platform_bus_dev),
                                      SYS_BUS_DEVICE(dev));
         }
@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_unplug_cb(HotplugHandler *hotplug_dev,
 static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
                                                         DeviceState *dev)
 {
-    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE) ||
+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+
+    if (device_is_dynamic_sysbus(mc, dev) ||
        (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM))) {
         return HOTPLUG_HANDLER(machine);
     }
-- 
2.20.1

The e500plat machine device plug callback currently calls
platform_bus_link_device() for any sysbus device.  This is overly
broad, because platform_bus_link_device() will unconditionally grab
the IRQs and MMIOs of the device it is passed, whether it was
intended for the platform bus or not.  Restrict hotpluggability of
sysbus devices to only those devices on the dynamic sysbus allowlist.

This isn't a sensible command because the macio-oldworld device
is really specific to the 'g3beige' machine, but we now fail
with a reasonable error message rather than asserting:
qemu-system-ppc64: Device heathrow is not supported by this machine yet.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Message-id: 20210325153310.9131-5-peter.maydell@linaro.org
---
 hw/ppc/e500plat.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/e500plat.c
+++ b/hw/ppc/e500plat.c
@@ -XXX,XX +XXX,XX @@ static void e500plat_machine_device_plug_cb(HotplugHandler *hotplug_dev,
     PPCE500MachineState *pms = PPCE500_MACHINE(hotplug_dev);
 
     if (pms->pbus_dev) {
-        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+        MachineClass *mc = MACHINE_GET_CLASS(pms);
+
+        if (device_is_dynamic_sysbus(mc, dev)) {
             platform_bus_link_device(pms->pbus_dev, SYS_BUS_DEVICE(dev));
         }
     }
@@ -XXX,XX +XXX,XX @@ static
 HotplugHandler *e500plat_machine_get_hotpug_handler(MachineState *machine,
                                                     DeviceState *dev)
 {
-    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+
+    if (device_is_dynamic_sysbus(mc, dev)) {
         return HOTPLUG_HANDLER(machine);
     }
 
-- 
2.20.1

This reverts commit f7fb73b8cdd3f77e26f9fcff8cf24ff1b58d200f.

This change turned out to be a bit half-baked, and doesn't
work with KVM, which fails with the error:
   "qemu-system-aarch64: Failed to retrieve host CPU features"

because KVM does not allow accessing of the PMCR_EL0 value in
the scratch "query CPU ID registers" VM unless we have first
set the KVM_ARM_VCPU_PMU_V3 feature on the VM.

Revert the change for 6.0.

Reported-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Zenghui Yu <yuzenghui@huawei.com>
Message-id: 20210331154822.23332-1-peter.maydell@linaro.org
---
 target/arm/cpu.h     |  1 -
 target/arm/cpu64.c   |  3 ---
 target/arm/cpu_tcg.c |  5 -----
 target/arm/helper.c  | 29 ++++++++++++-----------------
 target/arm/kvm64.c   |  2 --
 5 files changed, 12 insertions(+), 28 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
         uint64_t id_aa64mmfr2;
         uint64_t id_aa64dfr0;
         uint64_t id_aa64dfr1;
-        uint64_t reset_pmcr_el0;
     } isar;
     uint64_t midr;
     uint32_t revidr;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
     cpu->gic_num_lrs = 4;
     cpu->gic_vpribits = 5;
     cpu->gic_vprebits = 5;
-    cpu->isar.reset_pmcr_el0 = 0x41013000;
     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
     cpu->gic_num_lrs = 4;
     cpu->gic_vpribits = 5;
     cpu->gic_vprebits = 5;
-    cpu->isar.reset_pmcr_el0 = 0x41033000;
     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
     cpu->gic_num_lrs = 4;
     cpu->gic_vpribits = 5;
     cpu->gic_vprebits = 5;
-    cpu->isar.reset_pmcr_el0 = 0x41023000;
     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
     cpu->ccsidr[1] = 0x2007e01a; /* 16k L1 icache. */
     cpu->ccsidr[2] = 0xf0000000; /* No L2 icache. */
     cpu->reset_auxcr = 2;
-    cpu->isar.reset_pmcr_el0 = 0x41002000;
     define_arm_cp_regs(cpu, cortexa8_cp_reginfo);
 }
 
@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
     cpu->clidr = (1 << 27) | (1 << 24) | 3;
     cpu->ccsidr[0] = 0xe00fe019; /* 16k L1 dcache. */
     cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */
-    cpu->isar.reset_pmcr_el0 = 0x41093000;
     define_arm_cp_regs(cpu, cortexa9_cp_reginfo);
 }
 
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
-    cpu->isar.reset_pmcr_el0 = 0x41072000;
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */
 }
 
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
-    cpu->isar.reset_pmcr_el0 = 0x410F3000;
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
     cpu->isar.id_isar6 = 0x0;
     cpu->mp_is_up = true;
     cpu->pmsav7_dregion = 16;
-    cpu->isar.reset_pmcr_el0 = 0x41151800;
     define_arm_cp_regs(cpu, cortexr5_cp_reginfo);
 }
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #endif
 
 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
+#define PMCR_NUM_COUNTERS 4 /* QEMU IMPDEF choice */
 
 #ifndef CONFIG_USER_ONLY
 
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
 
 static inline uint32_t pmu_num_counters(CPUARMState *env)
 {
-    ARMCPU *cpu = env_archcpu(env);
-
-    return (cpu->isar.reset_pmcr_el0 & PMCRN_MASK) >> PMCRN_SHIFT;
+  return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
 }
 
 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .resetvalue = 0,
       .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
 #endif
+    /* The only field of MDCR_EL2 that has a defined architectural reset value
+     * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N.
+     */
+    { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
+      .access = PL2_RW, .resetvalue = PMCR_NUM_COUNTERS,
+      .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), },
     { .name = "HPFAR", .state = ARM_CP_STATE_AA32,
       .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
       .access = PL2_RW, .accessfn = access_el3_aa32ns,
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
      * field as main ID register, and we implement four counters in
      * addition to the cycle count register.
      */
-    unsigned int i, pmcrn = pmu_num_counters(&cpu->env);
+    unsigned int i, pmcrn = PMCR_NUM_COUNTERS;
     ARMCPRegInfo pmcr = {
         .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
         .access = PL0_RW,
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
         .access = PL0_RW, .accessfn = pmreg_access,
         .type = ARM_CP_IO,
         .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
-        .resetvalue = cpu->isar.reset_pmcr_el0,
+        .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT) |
+                      PMCRLC,
         .writefn = pmcr_write, .raw_writefn = raw_write,
     };
-
     define_one_arm_cp_reg(cpu, &pmcr);
     define_one_arm_cp_reg(cpu, &pmcr64);
     for (i = 0; i < pmcrn; i++) {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
             REGINFO_SENTINEL
         };
-        /*
-         * The only field of MDCR_EL2 that has a defined architectural reset
-         * value is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N.
-         */
-        ARMCPRegInfo mdcr_el2 = {
-            .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
-            .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
-            .access = PL2_RW, .resetvalue = pmu_num_counters(env),
-            .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2),
-        };
-        define_one_arm_cp_reg(cpu, &mdcr_el2);
         define_arm_cp_regs(cpu, vpidr_regs);
         define_arm_cp_regs(cpu, el2_cp_reginfo);
         if (arm_feature(env, ARM_FEATURE_V8)) {
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                               ARM64_SYS_REG(3, 0, 0, 7, 1));
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr2,
                               ARM64_SYS_REG(3, 0, 0, 7, 2));
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
-                              ARM64_SYS_REG(3, 3, 9, 12, 0));
 
         /*
          * Note that if AArch32 support is not present in the host,
-- 
2.20.1

target-arm queue, mostly SME preliminaries.

In the unlikely event we don't land the rest of SME before freeze
for 7.1 we can revert the docs/property changes included here.

-- PMM

The following changes since commit 097ccbbbaf2681df1e65542e5b7d2b2d0c66e2bc:

Merge tag 'qemu-sparc-20220626' of https://github.com/mcayland/qemu into staging (2022-06-27 05:21:05 +0530)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220627

for you to fetch changes up to 59e1b8a22ea9f947d038ccac784de1020f266e14:

target/arm: Check V7VE as well as LPAE in arm_pamax (2022-06-27 11:18:17 +0100)

----------------------------------------------------------------
target-arm queue:
 * sphinx: change default language to 'en'
 * Diagnose attempts to emulate EL3 in hvf as well as kvm
 * More SME groundwork patches
 * virt: Fix calculation of physical address space size
   for v7VE CPUs (eg cortex-a15)

----------------------------------------------------------------
Alexander Graf (2):
      accel: Introduce current_accel_name()
      target/arm: Catch invalid kvm state also for hvf

Martin Liška (1):
      sphinx: change default language to 'en'

Richard Henderson (22):
      target/arm: Implement TPIDR2_EL0
      target/arm: Add SMEEXC_EL to TB flags
      target/arm: Add syn_smetrap
      target/arm: Add ARM_CP_SME
      target/arm: Add SVCR
      target/arm: Add SMCR_ELx
      target/arm: Add SMIDR_EL1, SMPRI_EL1, SMPRIMAP_EL2
      target/arm: Add PSTATE.{SM,ZA} to TB flags
      target/arm: Add the SME ZA storage to CPUARMState
      target/arm: Implement SMSTART, SMSTOP
      target/arm: Move error for sve%d property to arm_cpu_sve_finalize
      target/arm: Create ARMVQMap
      target/arm: Generalize cpu_arm_{get,set}_vq
      target/arm: Generalize cpu_arm_{get, set}_default_vec_len
      target/arm: Move arm_cpu_*_finalize to internals.h
      target/arm: Unexport aarch64_add_*_properties
      target/arm: Add cpu properties for SME
      target/arm: Introduce sve_vqm1_for_el_sm
      target/arm: Add SVL to TB flags
      target/arm: Move pred_{full, gvec}_reg_{offset, size} to translate-a64.h
      target/arm: Extend arm_pamax to more than aarch64
      target/arm: Check V7VE as well as LPAE in arm_pamax

From: Martin Liška <mliska@suse.cz>

Fixes the following Sphinx warning (treated as error) starting
with 5.0 release:

Warning, treated as error:
Invalid configuration value found: 'language = None'. Update your configuration to a valid langauge code. Falling back to 'en' (English).

Signed-off-by: Martin Liska <mliska@suse.cz>
Message-id: e91e51ee-48ac-437e-6467-98b56ee40042@suse.cz
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/conf.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@
 #
 # This is also used if you do content translation via gettext catalogs.
 # Usually you set "language" from the command line for these cases.
-language = None
+language = 'en'
 
 # List of patterns, relative to source directory, that match files and
 # directories to ignore when looking for source files.
-- 
2.25.1

From: Alexander Graf <agraf@csgraf.de>

We need to fetch the name of the current accelerator in flexible error
messages more going forward. Let's create a helper that gives it to us
without casting in the target code.

Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620192242.70573-1-agraf@csgraf.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qemu/accel.h | 1 +
 accel/accel-common.c | 8 ++++++++
 softmmu/vl.c         | 3 +--
 3 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/include/qemu/accel.h b/include/qemu/accel.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/accel.h
+++ b/include/qemu/accel.h
@@ -XXX,XX +XXX,XX @@ typedef struct AccelClass {
 
 AccelClass *accel_find(const char *opt_name);
 AccelState *current_accel(void);
+const char *current_accel_name(void);
 
 void accel_init_interfaces(AccelClass *ac);
 
diff --git a/accel/accel-common.c b/accel/accel-common.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/accel-common.c
+++ b/accel/accel-common.c
@@ -XXX,XX +XXX,XX @@ AccelClass *accel_find(const char *opt_name)
     return ac;
 }
 
+/* Return the name of the current accelerator */
+const char *current_accel_name(void)
+{
+    AccelClass *ac = ACCEL_GET_CLASS(current_accel());
+
+    return ac->name;
+}
+
 static void accel_init_cpu_int_aux(ObjectClass *klass, void *opaque)
 {
     CPUClass *cc = CPU_CLASS(klass);
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@ static void configure_accelerators(const char *progname)
     }
 
     if (init_failed && !qtest_chrdev) {
-        AccelClass *ac = ACCEL_GET_CLASS(current_accel());
-        error_report("falling back to %s", ac->name);
+        error_report("falling back to %s", current_accel_name());
     }
 
     if (icount_enabled() && !tcg_enabled()) {
-- 
2.25.1

From: Alexander Graf <agraf@csgraf.de>

Some features such as running in EL3 or running M profile code are
incompatible with virtualization as QEMU implements it today. To prevent
users from picking invalid configurations on other virt solutions like
Hvf, let's run the same checks there too.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1073
Signed-off-by: Alexander Graf <agraf@csgraf.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620192242.70573-2-agraf@csgraf.de
[PMM: Allow qtest accelerator too; tweak comment]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 16 ++++++++++++----
 1 file changed, 12 insertions(+), 4 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #endif
 #include "sysemu/tcg.h"
+#include "sysemu/qtest.h"
 #include "sysemu/hw_accel.h"
 #include "kvm_arm.h"
 #include "disas/capstone.h"
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         }
     }
 
-    if (kvm_enabled()) {
+    if (!tcg_enabled() && !qtest_enabled()) {
         /*
+         * We assume that no accelerator except TCG (and the "not really an
+         * accelerator" qtest) can handle these features, because Arm hardware
+         * virtualization can't virtualize them.
+         *
          * Catch all the cases which might cause us to create more than one
          * address space for the CPU (otherwise we will assert() later in
          * cpu_address_space_init()).
          */
         if (arm_feature(env, ARM_FEATURE_M)) {
             error_setg(errp,
-                       "Cannot enable KVM when using an M-profile guest CPU");
+                       "Cannot enable %s when using an M-profile guest CPU",
+                       current_accel_name());
             return;
         }
         if (cpu->has_el3) {
             error_setg(errp,
-                       "Cannot enable KVM when guest CPU has EL3 enabled");
+                       "Cannot enable %s when guest CPU has EL3 enabled",
+                       current_accel_name());
             return;
         }
         if (cpu->tag_memory) {
             error_setg(errp,
-                       "Cannot enable KVM when guest CPUs has MTE enabled");
+                       "Cannot enable %s when guest CPUs has MTE enabled",
+                       current_accel_name());
             return;
         }
     }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This register is part of SME, but isn't closely related to the
rest of the extension.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  1 +
 target/arm/helper.c | 32 ++++++++++++++++++++++++++++++++
 2 files changed, 33 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
             };
             uint64_t tpidr_el[4];
         };
+        uint64_t tpidr2_el0;
         /* The secure banks of these registers don't map anywhere */
         uint64_t tpidrurw_s;
         uint64_t tpidrprw_s;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo zcr_reginfo[] = {
       .writefn = zcr_write, .raw_writefn = raw_write },
 };
 
+#ifdef TARGET_AARCH64
+static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
+                                    bool isread)
+{
+    int el = arm_current_el(env);
+
+    if (el == 0) {
+        uint64_t sctlr = arm_sctlr(env, el);
+        if (!(sctlr & SCTLR_EnTP2)) {
+            return CP_ACCESS_TRAP;
+        }
+    }
+    /* TODO: FEAT_FGT */
+    if (el < 3
+        && arm_feature(env, ARM_FEATURE_EL3)
+        && !(env->cp15.scr_el3 & SCR_ENTP2)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static const ARMCPRegInfo sme_reginfo[] = {
+    { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
+      .access = PL0_RW, .accessfn = access_tpidr2,
+      .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) },
+};
+#endif /* TARGET_AARCH64 */
+
 void hw_watchpoint_update(ARMCPU *cpu, int n)
 {
     CPUARMState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     }
 
 #ifdef TARGET_AARCH64
+    if (cpu_isar_feature(aa64_sme, cpu)) {
+        define_arm_cp_regs(cpu, sme_reginfo);
+    }
     if (cpu_isar_feature(aa64_pauth, cpu)) {
         define_arm_cp_regs(cpu, pauth_reginfo);
     }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This is CheckSMEAccess, which is the basis for a set of
related tests for various SME cpregs and instructions.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           |  2 ++
 target/arm/translate.h     |  1 +
 target/arm/helper.c        | 52 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-a64.c |  1 +
 4 files changed, 56 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void aarch64_sync_64_to_32(CPUARMState *env);
 
 int fp_exception_el(CPUARMState *env, int cur_el);
 int sve_exception_el(CPUARMState *env, int cur_el);
+int sme_exception_el(CPUARMState *env, int cur_el);
 
 /**
  * sve_vqm1_for_el:
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, ATA, 15, 1)
 FIELD(TBFLAG_A64, TCMA, 16, 2)
 FIELD(TBFLAG_A64, MTE_ACTIVE, 18, 1)
 FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
+FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
 
 /*
  * Helpers for using the above.
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool ns;        /* Use non-secure CPREG bank on access */
     int fp_excp_el; /* FP exception EL or 0 if enabled */
     int sve_excp_el; /* SVE exception EL or 0 if enabled */
+    int sme_excp_el; /* SME exception EL or 0 if enabled */
     int vl;          /* current vector length in bytes */
     bool vfp_enabled; /* FP enabled via FPSCR.EN */
     int vec_len;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
     return 0;
 }
 
+/*
+ * Return the exception level to which exceptions should be taken for SME.
+ * C.f. the ARM pseudocode function CheckSMEAccess.
+ */
+int sme_exception_el(CPUARMState *env, int el)
+{
+#ifndef CONFIG_USER_ONLY
+    if (el <= 1 && !el_is_in_host(env, el)) {
+        switch (FIELD_EX64(env->cp15.cpacr_el1, CPACR_EL1, SMEN)) {
+        case 1:
+            if (el != 0) {
+                break;
+            }
+            /* fall through */
+        case 0:
+        case 2:
+            return 1;
+        }
+    }
+
+    if (el <= 2 && arm_is_el2_enabled(env)) {
+        /* CPTR_EL2 changes format with HCR_EL2.E2H (regardless of TGE). */
+        if (env->cp15.hcr_el2 & HCR_E2H) {
+            switch (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, SMEN)) {
+            case 1:
+                if (el != 0 || !(env->cp15.hcr_el2 & HCR_TGE)) {
+                    break;
+                }
+                /* fall through */
+            case 0:
+            case 2:
+                return 2;
+            }
+        } else {
+            if (FIELD_EX64(env->cp15.cptr_el[2], CPTR_EL2, TSM)) {
+                return 2;
+            }
+        }
+    }
+
+    /* CPTR_EL3.  Since ESM is negative we must check for EL3.  */
+    if (arm_feature(env, ARM_FEATURE_EL3)
+        && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
+        return 3;
+    }
+#endif
+    return 0;
+}
+
 /*
  * Given that SVE is enabled, return the vector length for EL.
  */
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
         }
         DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
     }
+    if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
+        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
+    }
 
     sctlr = regime_sctlr(env, stage1);
 
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
     dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
     dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
+    dc->sme_excp_el = EX_TBFLAG_A64(tb_flags, SMEEXC_EL);
     dc->vl = (EX_TBFLAG_A64(tb_flags, VL) + 1) * 16;
     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
     dc->bt = EX_TBFLAG_A64(tb_flags, BT);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This will be used for raising various traps for SME.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/syndrome.h | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
     EC_AA64_SMC               = 0x17,
     EC_SYSTEMREGISTERTRAP     = 0x18,
     EC_SVEACCESSTRAP          = 0x19,
+    EC_SMETRAP                = 0x1d,
     EC_INSNABORT              = 0x20,
     EC_INSNABORT_SAME_EL      = 0x21,
     EC_PCALIGNMENT            = 0x22,
@@ -XXX,XX +XXX,XX @@ enum arm_exception_class {
     EC_AA64_BKPT              = 0x3c,
 };
 
+typedef enum {
+    SME_ET_AccessTrap,
+    SME_ET_Streaming,
+    SME_ET_NotStreaming,
+    SME_ET_InactiveZA,
+} SMEExceptionType;
+
 #define ARM_EL_EC_SHIFT 26
 #define ARM_EL_IL_SHIFT 25
 #define ARM_EL_ISV_SHIFT 24
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_sve_access_trap(void)
     return EC_SVEACCESSTRAP << ARM_EL_EC_SHIFT;
 }
 
+static inline uint32_t syn_smetrap(SMEExceptionType etype, bool is_16bit)
+{
+    return (EC_SMETRAP << ARM_EL_EC_SHIFT)
+        | (is_16bit ? 0 : ARM_EL_IL) | etype;
+}
+
 static inline uint32_t syn_pactrap(void)
 {
     return EC_PACTRAP << ARM_EL_EC_SHIFT;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This will be used for controlling access to SME cpregs.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h        |  5 +++++
 target/arm/translate-a64.c | 18 ++++++++++++++++++
 2 files changed, 23 insertions(+)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@ enum {
     ARM_CP_EL3_NO_EL2_UNDEF      = 1 << 16,
     ARM_CP_EL3_NO_EL2_KEEP       = 1 << 17,
     ARM_CP_EL3_NO_EL2_C_NZ       = 1 << 18,
+    /*
+     * Flag: Access check for this sysreg is constrained by the
+     * ARM pseudocode function CheckSMEAccess().
+     */
+    ARM_CP_SME                   = 1 << 19,
 };
 
 /*
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
     return fp_access_check(s);
 }
 
+/*
+ * Check that SME access is enabled, raise an exception if not.
+ * Note that this function corresponds to CheckSMEAccess and is
+ * only used directly for cpregs.
+ */
+static bool sme_access_check(DisasContext *s)
+{
+    if (s->sme_excp_el) {
+        gen_exception_insn_el(s, s->pc_curr, EXCP_UDEF,
+                              syn_smetrap(SME_ET_AccessTrap, false),
+                              s->sme_excp_el);
+        return false;
+    }
+    return true;
+}
+
 /*
  * This utility function is for doing register extension with an
  * optional shift. You will likely want to pass a temporary for the
@@ -XXX,XX +XXX,XX @@ static void handle_sys(DisasContext *s, uint32_t insn, bool isread,
         return;
     } else if ((ri->type & ARM_CP_SVE) && !sve_access_check(s)) {
         return;
+    } else if ((ri->type & ARM_CP_SME) && !sme_access_check(s)) {
+        return;
     }
 
     if ((tb_cflags(s->base.tb) & CF_USE_ICOUNT) && (ri->type & ARM_CP_IO)) {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This cpreg is used to access two new bits of PSTATE
that are not visible via any other mechanism.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  6 ++++++
 target/arm/helper.c | 13 +++++++++++++
 2 files changed, 19 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
      *  nRW (also known as M[4]) is kept, inverted, in env->aarch64
      *  DAIF (exception masks) are kept in env->daif
      *  BTYPE is kept in env->btype
+     *  SM and ZA are kept in env->svcr
      *  all other bits are stored in their correct places in env->pstate
      */
     uint32_t pstate;
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
     uint32_t condexec_bits; /* IT bits.  cpsr[15:10,26:25].  */
     uint32_t btype;  /* BTI branch type.  spsr[11:10].  */
     uint64_t daif; /* exception masks, in the bits they are in PSTATE */
+    uint64_t svcr; /* PSTATE.{SM,ZA} in the bits they are in SVCR */
 
     uint64_t elr_el[4]; /* AArch64 exception link regs  */
     uint64_t sp_el[4]; /* AArch64 banked stack pointers */
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 #define PSTATE_MODE_EL1t 4
 #define PSTATE_MODE_EL0t 0
 
+/* PSTATE bits that are accessed via SVCR and not stored in SPSR_ELx. */
+FIELD(SVCR, SM, 0, 1)
+FIELD(SVCR, ZA, 1, 1)
+
 /* Write a new value to v7m.exception, thus transitioning into or out
  * of Handler mode; this may result in a change of active stack pointer.
  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                       uint64_t value)
+{
+    value &= R_SVCR_SM_MASK | R_SVCR_ZA_MASK;
+    /* TODO: Side effects. */
+    env->svcr = value;
+}
+
 static const ARMCPRegInfo sme_reginfo[] = {
     { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
       .access = PL0_RW, .accessfn = access_tpidr2,
       .fieldoffset = offsetof(CPUARMState, cp15.tpidr2_el0) },
+    { .name = "SVCR", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 4, .crm = 2, .opc2 = 2,
+      .access = PL0_RW, .type = ARM_CP_SME,
+      .fieldoffset = offsetof(CPUARMState, svcr),
+      .writefn = svcr_write, .raw_writefn = raw_write },
 };
 #endif /* TARGET_AARCH64 */
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

These cpregs control the streaming vector length and whether the
full a64 instruction set is allowed while in streaming mode.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  8 ++++++--
 target/arm/helper.c | 41 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         float_status standard_fp_status;
         float_status standard_fp_status_f16;
 
-        /* ZCR_EL[1-3] */
-        uint64_t zcr_el[4];
+        uint64_t zcr_el[4];   /* ZCR_EL[1-3] */
+        uint64_t smcr_el[4];  /* SMCR_EL[1-3] */
     } vfp;
     uint64_t exclusive_addr;
     uint64_t exclusive_val;
@@ -XXX,XX +XXX,XX @@ FIELD(CPTR_EL3, TCPAC, 31, 1)
 FIELD(SVCR, SM, 0, 1)
 FIELD(SVCR, ZA, 1, 1)
 
+/* Fields for SMCR_ELx. */
+FIELD(SMCR, LEN, 0, 4)
+FIELD(SMCR, FA64, 31, 1)
+
 /* Write a new value to v7m.exception, thus transitioning into or out
  * of Handler mode; this may result in a change of active stack pointer.
  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
          */
         { K(3, 0,  1, 2, 0), K(3, 4,  1, 2, 0), K(3, 5, 1, 2, 0),
           "ZCR_EL1", "ZCR_EL2", "ZCR_EL12", isar_feature_aa64_sve },
+        { K(3, 0,  1, 2, 6), K(3, 4,  1, 2, 6), K(3, 5, 1, 2, 6),
+          "SMCR_EL1", "SMCR_EL2", "SMCR_EL12", isar_feature_aa64_sme },
 
         { K(3, 0,  5, 6, 0), K(3, 4,  5, 6, 0), K(3, 5, 5, 6, 0),
           "TFSR_EL1", "TFSR_EL2", "TFSR_EL12", isar_feature_aa64_mte },
@@ -XXX,XX +XXX,XX @@ static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     env->svcr = value;
 }
 
+static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                       uint64_t value)
+{
+    int cur_el = arm_current_el(env);
+    int old_len = sve_vqm1_for_el(env, cur_el);
+    int new_len;
+
+    QEMU_BUILD_BUG_ON(ARM_MAX_VQ > R_SMCR_LEN_MASK + 1);
+    value &= R_SMCR_LEN_MASK | R_SMCR_FA64_MASK;
+    raw_write(env, ri, value);
+
+    /*
+     * Note that it is CONSTRAINED UNPREDICTABLE what happens to ZA storage
+     * when SVL is widened (old values kept, or zeros).  Choose to keep the
+     * current values for simplicity.  But for QEMU internals, we must still
+     * apply the narrower SVL to the Zregs and Pregs -- see the comment
+     * above aarch64_sve_narrow_vq.
+     */
+    new_len = sve_vqm1_for_el(env, cur_el);
+    if (new_len < old_len) {
+        aarch64_sve_narrow_vq(env, new_len + 1);
+    }
+}
+
 static const ARMCPRegInfo sme_reginfo[] = {
     { .name = "TPIDR2_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 5,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
       .access = PL0_RW, .type = ARM_CP_SME,
       .fieldoffset = offsetof(CPUARMState, svcr),
       .writefn = svcr_write, .raw_writefn = raw_write },
+    { .name = "SMCR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 6,
+      .access = PL1_RW, .type = ARM_CP_SME,
+      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[1]),
+      .writefn = smcr_write, .raw_writefn = raw_write },
+    { .name = "SMCR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 6,
+      .access = PL2_RW, .type = ARM_CP_SME,
+      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[2]),
+      .writefn = smcr_write, .raw_writefn = raw_write },
+    { .name = "SMCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 6,
+      .access = PL3_RW, .type = ARM_CP_SME,
+      .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]),
+      .writefn = smcr_write, .raw_writefn = raw_write },
 };
 #endif /* TARGET_AARCH64 */
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Implement the streaming mode identification register, and the
two streaming priority registers.  For QEMU, they are all RES0.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 33 +++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tpidr2(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
+static CPAccessResult access_esm(CPUARMState *env, const ARMCPRegInfo *ri,
+                                 bool isread)
+{
+    /* TODO: FEAT_FGT for SMPRI_EL1 but not SMPRIMAP_EL2 */
+    if (arm_current_el(env) < 3
+        && arm_feature(env, ARM_FEATURE_EL3)
+        && !FIELD_EX64(env->cp15.cptr_el[3], CPTR_EL3, ESM)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
 static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                        uint64_t value)
 {
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
       .access = PL3_RW, .type = ARM_CP_SME,
       .fieldoffset = offsetof(CPUARMState, vfp.smcr_el[3]),
       .writefn = smcr_write, .raw_writefn = raw_write },
+    { .name = "SMIDR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 1, .crn = 0, .crm = 0, .opc2 = 6,
+      .access = PL1_R, .accessfn = access_aa64_tid1,
+      /*
+       * IMPLEMENTOR = 0 (software)
+       * REVISION    = 0 (implementation defined)
+       * SMPS        = 0 (no streaming execution priority in QEMU)
+       * AFFINITY    = 0 (streaming sve mode not shared with other PEs)
+       */
+      .type = ARM_CP_CONST, .resetvalue = 0, },
+    /*
+     * Because SMIDR_EL1.SMPS is 0, SMPRI_EL1 and SMPRIMAP_EL2 are RES 0.
+     */
+    { .name = "SMPRI_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 4,
+      .access = PL1_RW, .accessfn = access_esm,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "SMPRIMAP_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 5,
+      .access = PL2_RW, .accessfn = access_esm,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
 };
 #endif /* TARGET_AARCH64 */
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

These are required to determine if various insns
are allowed to issue.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           | 2 ++
 target/arm/translate.h     | 4 ++++
 target/arm/helper.c        | 4 ++++
 target/arm/translate-a64.c | 2 ++
 4 files changed, 12 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, TCMA, 16, 2)
 FIELD(TBFLAG_A64, MTE_ACTIVE, 18, 1)
 FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
 FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
+FIELD(TBFLAG_A64, PSTATE_SM, 22, 1)
+FIELD(TBFLAG_A64, PSTATE_ZA, 23, 1)
 
 /*
  * Helpers for using the above.
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool align_mem;
     /* True if PSTATE.IL is set */
     bool pstate_il;
+    /* True if PSTATE.SM is set. */
+    bool pstate_sm;
+    /* True if PSTATE.ZA is set. */
+    bool pstate_za;
     /* True if MVE insns are definitely not predicated by VPR or LTPSIZE */
     bool mve_no_pred;
     /*
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
     }
     if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
         DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
+        if (FIELD_EX64(env->svcr, SVCR, SM)) {
+            DP_TBFLAG_A64(flags, PSTATE_SM, 1);
+        }
+        DP_TBFLAG_A64(flags, PSTATE_ZA, FIELD_EX64(env->svcr, SVCR, ZA));
     }
 
     sctlr = regime_sctlr(env, stage1);
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->ata = EX_TBFLAG_A64(tb_flags, ATA);
     dc->mte_active[0] = EX_TBFLAG_A64(tb_flags, MTE_ACTIVE);
     dc->mte_active[1] = EX_TBFLAG_A64(tb_flags, MTE0_ACTIVE);
+    dc->pstate_sm = EX_TBFLAG_A64(tb_flags, PSTATE_SM);
+    dc->pstate_za = EX_TBFLAG_A64(tb_flags, PSTATE_ZA);
     dc->vec_len = 0;
     dc->vec_stride = 0;
     dc->cp_regs = arm_cpu->cp_regs;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Place this late in the resettable section of the structure,
to keep the most common element offsets from being > 64k.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-10-richard.henderson@linaro.org
[PMM: expanded comment on zarray[] format]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h     | 22 ++++++++++++++++++++++
 target/arm/machine.c | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 56 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
     } keys;
 
     uint64_t scxtnum_el[4];
+
+    /*
+     * SME ZA storage -- 256 x 256 byte array, with bytes in host word order,
+     * as we do with vfp.zregs[].  This corresponds to the architectural ZA
+     * array, where ZA[N] is in the least-significant bytes of env->zarray[N].
+     * When SVL is less than the architectural maximum, the accessible
+     * storage is restricted, such that if the SVL is X bytes the guest can
+     * see only the bottom X elements of zarray[], and only the least
+     * significant X bytes of each element of the array. (In other words,
+     * the observable part is always square.)
+     *
+     * The ZA storage can also be considered as a set of square tiles of
+     * elements of different sizes. The mapping from tiles to the ZA array
+     * is architecturally defined, such that for tiles of elements of esz
+     * bytes, the Nth row (or "horizontal slice") of tile T is in
+     * ZA[T + N * esz]. Note that this means that each tile is not contiguous
+     * in the ZA storage, because its rows are striped through the ZA array.
+     *
+     * Because this is so large, keep this toward the end of the reset area,
+     * to keep the offsets into the rest of the structure smaller.
+     */
+    ARMVectorReg zarray[ARM_MAX_VQ * 16];
 #endif
 
 #if defined(CONFIG_USER_ONLY)
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_sve = {
         VMSTATE_END_OF_LIST()
     }
 };
+
+static const VMStateDescription vmstate_vreg = {
+    .name = "vreg",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT64_ARRAY(d, ARMVectorReg, ARM_MAX_VQ * 2),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static bool za_needed(void *opaque)
+{
+    ARMCPU *cpu = opaque;
+
+    /*
+     * When ZA storage is disabled, its contents are discarded.
+     * It will be zeroed when ZA storage is re-enabled.
+     */
+    return FIELD_EX64(cpu->env.svcr, SVCR, ZA);
+}
+
+static const VMStateDescription vmstate_za = {
+    .name = "cpu/sme",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = za_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_STRUCT_ARRAY(env.zarray, ARMCPU, ARM_MAX_VQ * 16, 0,
+                             vmstate_vreg, ARMVectorReg),
+        VMSTATE_END_OF_LIST()
+    }
+};
 #endif /* AARCH64 */
 
 static bool serror_needed(void *opaque)
@@ -XXX,XX +XXX,XX @@ const VMStateDescription vmstate_arm_cpu = {
         &vmstate_m_security,
 #ifdef TARGET_AARCH64
         &vmstate_sve,
+        &vmstate_za,
 #endif
         &vmstate_serror,
         &vmstate_irq_line_state,
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

These two instructions are aliases of MSR (immediate).
Use the two helpers to properly implement svcr_write.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           |  1 +
 target/arm/helper-sme.h    | 21 +++++++++++++
 target/arm/helper.h        |  1 +
 target/arm/helper.c        |  6 ++--
 target/arm/sme_helper.c    | 61 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-a64.c | 24 +++++++++++++++
 target/arm/meson.build     |  1 +
 7 files changed, 112 insertions(+), 3 deletions(-)
 create mode 100644 target/arm/helper-sme.h
 create mode 100644 target/arm/sme_helper.c

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void aarch64_sve_change_el(CPUARMState *env, int old_el,
                            int new_el, bool el0_a64);
 void aarch64_add_sve_properties(Object *obj);
 void aarch64_add_pauth_properties(Object *obj);
+void arm_reset_sve_state(CPUARMState *env);
 
 /*
  * SVE registers are encoded in KVM's memory in an endianness-invariant format.
diff --git a/target/arm/helper-sme.h b/target/arm/helper-sme.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/helper-sme.h
@@ -XXX,XX +XXX,XX @@
+/*
+ *  AArch64 SME specific helper definitions
+ *
+ *  Copyright (c) 2022 Linaro, Ltd
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+DEF_HELPER_FLAGS_2(set_pstate_sm, TCG_CALL_NO_RWG, void, env, i32)
+DEF_HELPER_FLAGS_2(set_pstate_za, TCG_CALL_NO_RWG, void, env, i32)
diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_6(gvec_bfmlal_idx, TCG_CALL_NO_RWG,
 #ifdef TARGET_AARCH64
 #include "helper-a64.h"
 #include "helper-sve.h"
+#include "helper-sme.h"
 #endif
 
 #include "helper-mve.h"
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_esm(CPUARMState *env, const ARMCPRegInfo *ri,
 static void svcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
                        uint64_t value)
 {
-    value &= R_SVCR_SM_MASK | R_SVCR_ZA_MASK;
-    /* TODO: Side effects. */
-    env->svcr = value;
+    helper_set_pstate_sm(env, FIELD_EX64(value, SVCR, SM));
+    helper_set_pstate_za(env, FIELD_EX64(value, SVCR, ZA));
+    arm_rebuild_hflags(env);
 }
 
 static void smcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
diff --git a/target/arm/sme_helper.c b/target/arm/sme_helper.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/target/arm/sme_helper.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ARM SME Operations
+ *
+ * Copyright (c) 2022 Linaro, Ltd.
+ *
+ * This library is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU Lesser General Public
+ * License as published by the Free Software Foundation; either
+ * version 2.1 of the License, or (at your option) any later version.
+ *
+ * This library is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
+ * Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public
+ * License along with this library; if not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+#include "cpu.h"
+#include "internals.h"
+#include "exec/helper-proto.h"
+
+/* ResetSVEState */
+void arm_reset_sve_state(CPUARMState *env)
+{
+    memset(env->vfp.zregs, 0, sizeof(env->vfp.zregs));
+    /* Recall that FFR is stored as pregs[16]. */
+    memset(env->vfp.pregs, 0, sizeof(env->vfp.pregs));
+    vfp_set_fpcr(env, 0x0800009f);
+}
+
+void helper_set_pstate_sm(CPUARMState *env, uint32_t i)
+{
+    if (i == FIELD_EX64(env->svcr, SVCR, SM)) {
+        return;
+    }
+    env->svcr ^= R_SVCR_SM_MASK;
+    arm_reset_sve_state(env);
+}
+
+void helper_set_pstate_za(CPUARMState *env, uint32_t i)
+{
+    if (i == FIELD_EX64(env->svcr, SVCR, ZA)) {
+        return;
+    }
+    env->svcr ^= R_SVCR_ZA_MASK;
+
+    /*
+     * ResetSMEState.
+     *
+     * SetPSTATE_ZA zeros on enable and disable.  We can zero this only
+     * on enable: while disabled, the storage is inaccessible and the
+     * value does not matter.  We're not saving the storage in vmstate
+     * when disabled either.
+     */
+    if (i) {
+        memset(env->zarray, 0, sizeof(env->zarray));
+    }
+}
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_msr_i(DisasContext *s, uint32_t insn,
         }
         break;
 
+    case 0x1b: /* SVCR* */
+        if (!dc_isar_feature(aa64_sme, s) || crm < 2 || crm > 7) {
+            goto do_unallocated;
+        }
+        if (sme_access_check(s)) {
+            bool i = crm & 1;
+            bool changed = false;
+
+            if ((crm & 2) && i != s->pstate_sm) {
+                gen_helper_set_pstate_sm(cpu_env, tcg_constant_i32(i));
+                changed = true;
+            }
+            if ((crm & 4) && i != s->pstate_za) {
+                gen_helper_set_pstate_za(cpu_env, tcg_constant_i32(i));
+                changed = true;
+            }
+            if (changed) {
+                gen_rebuild_hflags(s);
+            } else {
+                s->base.is_jmp = DISAS_NEXT;
+            }
+        }
+        break;
+
     default:
     do_unallocated:
         unallocated_encoding(s);
diff --git a/target/arm/meson.build b/target/arm/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/meson.build
+++ b/target/arm/meson.build
@@ -XXX,XX +XXX,XX @@ arm_ss.add(when: 'TARGET_AARCH64', if_true: files(
   'mte_helper.c',
   'pauth_helper.c',
   'sve_helper.c',
+  'sme_helper.c',
   'translate-a64.c',
   'translate-sve.c',
 ))
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Keep all of the error messages together.  This does mean that
when setting many sve length properties we'll only generate
one error, but we only really need one.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 15 +++++++--------
 1 file changed, 7 insertions(+), 8 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
                                   "using only sve<N> properties.\n");
             } else {
                 error_setg(errp, "cannot enable sve%d", vq * 128);
-                error_append_hint(errp, "This CPU does not support "
-                                  "the vector length %d-bits.\n", vq * 128);
+                if (vq_supported) {
+                    error_append_hint(errp, "This CPU does not support "
+                                      "the vector length %d-bits.\n", vq * 128);
+                } else {
+                    error_append_hint(errp, "SVE not supported by KVM "
+                                      "on this host\n");
+                }
             }
             return;
         } else {
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    if (value && kvm_enabled() && !kvm_arm_sve_supported()) {
-        error_setg(errp, "cannot enable %s", name);
-        error_append_hint(errp, "SVE not supported by KVM on this host\n");
-        return;
-    }
-
     cpu->sve_vq_map = deposit32(cpu->sve_vq_map, vq - 1, 1, value);
     cpu->sve_vq_init |= 1 << (vq - 1);
 }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Pull the three sve_vq_* values into a structure.
This will be reused for SME.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    | 29 ++++++++++++++---------------
 target/arm/cpu64.c  | 22 +++++++++++-----------
 target/arm/helper.c |  2 +-
 target/arm/kvm64.c  |  2 +-
 4 files changed, 27 insertions(+), 28 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMPSCIState {
 
 typedef struct ARMISARegisters ARMISARegisters;
 
+/*
+ * In map, each set bit is a supported vector length of (bit-number + 1) * 16
+ * bytes, i.e. each bit number + 1 is the vector length in quadwords.
+ *
+ * While processing properties during initialization, corresponding init bits
+ * are set for bits in sve_vq_map that have been set by properties.
+ *
+ * Bits set in supported represent valid vector lengths for the CPU type.
+ */
+typedef struct {
+    uint32_t map, init, supported;
+} ARMVQMap;
+
 /**
  * ARMCPU:
  * @env: #CPUARMState
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
     uint32_t sve_default_vq;
 #endif
 
-    /*
-     * In sve_vq_map each set bit is a supported vector length of
-     * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
-     * length in quadwords.
-     *
-     * While processing properties during initialization, corresponding
-     * sve_vq_init bits are set for bits in sve_vq_map that have been
-     * set by properties.
-     *
-     * Bits set in sve_vq_supported represent valid vector lengths for
-     * the CPU type.
-     */
-    uint32_t sve_vq_map;
-    uint32_t sve_vq_init;
-    uint32_t sve_vq_supported;
+    ARMVQMap sve_vq;
 
     /* Generic timer counter frequency, in Hz */
     uint64_t gt_cntfrq_hz;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
      * any of the above.  Finally, if SVE is not disabled, then at least one
      * vector length must be enabled.
      */
-    uint32_t vq_map = cpu->sve_vq_map;
-    uint32_t vq_init = cpu->sve_vq_init;
+    uint32_t vq_map = cpu->sve_vq.map;
+    uint32_t vq_init = cpu->sve_vq.init;
     uint32_t vq_supported;
     uint32_t vq_mask = 0;
     uint32_t tmp, vq, max_vq = 0;
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
      */
     if (kvm_enabled()) {
         if (kvm_arm_sve_supported()) {
-            cpu->sve_vq_supported = kvm_arm_sve_get_vls(CPU(cpu));
-            vq_supported = cpu->sve_vq_supported;
+            cpu->sve_vq.supported = kvm_arm_sve_get_vls(CPU(cpu));
+            vq_supported = cpu->sve_vq.supported;
         } else {
             assert(!cpu_isar_feature(aa64_sve, cpu));
             vq_supported = 0;
         }
     } else {
-        vq_supported = cpu->sve_vq_supported;
+        vq_supported = cpu->sve_vq.supported;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
 
     /* From now on sve_max_vq is the actual maximum supported length. */
     cpu->sve_max_vq = max_vq;
-    cpu->sve_vq_map = vq_map;
+    cpu->sve_vq.map = vq_map;
 }
 
 static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
     if (!cpu_isar_feature(aa64_sve, cpu)) {
         value = false;
     } else {
-        value = extract32(cpu->sve_vq_map, vq - 1, 1);
+        value = extract32(cpu->sve_vq.map, vq - 1, 1);
     }
     visit_type_bool(v, name, &value, errp);
 }
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    cpu->sve_vq_map = deposit32(cpu->sve_vq_map, vq - 1, 1, value);
-    cpu->sve_vq_init |= 1 << (vq - 1);
+    cpu->sve_vq.map = deposit32(cpu->sve_vq.map, vq - 1, 1, value);
+    cpu->sve_vq.init |= 1 << (vq - 1);
 }
 
 static bool cpu_arm_get_sve(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
     cpu->dcz_blocksize = 7; /*  512 bytes */
 #endif
 
-    cpu->sve_vq_supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
+    cpu->sve_vq.supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
 
     aarch64_add_pauth_properties(obj);
     aarch64_add_sve_properties(obj);
@@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj)
 
     /* The A64FX supports only 128, 256 and 512 bit vector lengths */
     aarch64_add_sve_properties(obj);
-    cpu->sve_vq_supported = (1 << 0)  /* 128bit */
+    cpu->sve_vq.supported = (1 << 0)  /* 128bit */
                           | (1 << 1)  /* 256bit */
                           | (1 << 3); /* 512bit */
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
         len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
     }
 
-    len = 31 - clz32(cpu->sve_vq_map & MAKE_64BIT_MASK(0, len + 1));
+    len = 31 - clz32(cpu->sve_vq.map & MAKE_64BIT_MASK(0, len + 1));
     return len;
 }
 
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ uint32_t kvm_arm_sve_get_vls(CPUState *cs)
 static int kvm_arm_sve_set_vls(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
-    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq_map };
+    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = { cpu->sve_vq.map };
     struct kvm_one_reg reg = {
         .id = KVM_REG_ARM64_SVE_VLS,
         .addr = (uint64_t)&vls[0],
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename from cpu_arm_{get,set}_sve_vq, and take the
ARMVQMap as the opaque parameter.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 29 +++++++++++++++--------------
 1 file changed, 15 insertions(+), 14 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
 }
 
 /*
- * Note that cpu_arm_get/set_sve_vq cannot use the simpler
- * object_property_add_bool interface because they make use
- * of the contents of "name" to determine which bit on which
- * to operate.
+ * Note that cpu_arm_{get,set}_vq cannot use the simpler
+ * object_property_add_bool interface because they make use of the
+ * contents of "name" to determine which bit on which to operate.
  */
-static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
-                               void *opaque, Error **errp)
+static void cpu_arm_get_vq(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    ARMVQMap *vq_map = opaque;
     uint32_t vq = atoi(&name[3]) / 128;
     bool value;
 
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
     if (!cpu_isar_feature(aa64_sve, cpu)) {
         value = false;
     } else {
-        value = extract32(cpu->sve_vq.map, vq - 1, 1);
+        value = extract32(vq_map->map, vq - 1, 1);
     }
     visit_type_bool(v, name, &value, errp);
 }
 
-static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
-                               void *opaque, Error **errp)
+static void cpu_arm_set_vq(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
 {
-    ARMCPU *cpu = ARM_CPU(obj);
+    ARMVQMap *vq_map = opaque;
     uint32_t vq = atoi(&name[3]) / 128;
     bool value;
 
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
         return;
     }
 
-    cpu->sve_vq.map = deposit32(cpu->sve_vq.map, vq - 1, 1, value);
-    cpu->sve_vq.init |= 1 << (vq - 1);
+    vq_map->map = deposit32(vq_map->map, vq - 1, 1, value);
+    vq_map->init |= 1 << (vq - 1);
 }
 
 static bool cpu_arm_get_sve(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
 
 void aarch64_add_sve_properties(Object *obj)
 {
+    ARMCPU *cpu = ARM_CPU(obj);
     uint32_t vq;
 
     object_property_add_bool(obj, "sve", cpu_arm_get_sve, cpu_arm_set_sve);
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
     for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
         char name[8];
         sprintf(name, "sve%d", vq * 128);
-        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
-                            cpu_arm_set_sve_vq, NULL, NULL);
+        object_property_add(obj, name, "bool", cpu_arm_get_vq,
+                            cpu_arm_set_vq, NULL, &cpu->sve_vq);
     }
 
 #ifdef CONFIG_USER_ONLY
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Rename from cpu_arm_{get,set}_sve_default_vec_len,
and take the pointer to default_vq from opaque.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 27 ++++++++++++++-------------
 1 file changed, 14 insertions(+), 13 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
 
 #ifdef CONFIG_USER_ONLY
 /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
-static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
-                                            const char *name, void *opaque,
-                                            Error **errp)
+static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
+                                        const char *name, void *opaque,
+                                        Error **errp)
 {
-    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t *ptr_default_vq = opaque;
     int32_t default_len, default_vq, remainder;
 
     if (!visit_type_int32(v, name, &default_len, errp)) {
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
 
     /* Undocumented, but the kernel allows -1 to indicate "maximum". */
     if (default_len == -1) {
-        cpu->sve_default_vq = ARM_MAX_VQ;
+        *ptr_default_vq = ARM_MAX_VQ;
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_default_vec_len(Object *obj, Visitor *v,
         return;
     }
 
-    cpu->sve_default_vq = default_vq;
+    *ptr_default_vq = default_vq;
 }
 
-static void cpu_arm_get_sve_default_vec_len(Object *obj, Visitor *v,
-                                            const char *name, void *opaque,
-                                            Error **errp)
+static void cpu_arm_get_default_vec_len(Object *obj, Visitor *v,
+                                        const char *name, void *opaque,
+                                        Error **errp)
 {
-    ARMCPU *cpu = ARM_CPU(obj);
-    int32_t value = cpu->sve_default_vq * 16;
+    uint32_t *ptr_default_vq = opaque;
+    int32_t value = *ptr_default_vq * 16;
 
     visit_type_int32(v, name, &value, errp);
 }
@@ -XXX,XX +XXX,XX @@ void aarch64_add_sve_properties(Object *obj)
 #ifdef CONFIG_USER_ONLY
     /* Mirror linux /proc/sys/abi/sve_default_vector_length. */
     object_property_add(obj, "sve-default-vector-length", "int32",
-                        cpu_arm_get_sve_default_vec_len,
-                        cpu_arm_set_sve_default_vec_len, NULL, NULL);
+                        cpu_arm_get_default_vec_len,
+                        cpu_arm_set_default_vec_len, NULL,
+                        &cpu->sve_default_vq);
 #endif
 }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Drop the aa32-only inline fallbacks,
and just use a couple of ifdefs.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       | 6 ------
 target/arm/internals.h | 3 +++
 target/arm/cpu.c       | 2 ++
 3 files changed, 5 insertions(+), 6 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 #ifdef TARGET_AARCH64
 # define ARM_MAX_VQ    16
-void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
-void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
-void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
 #else
 # define ARM_MAX_VQ    1
-static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
-static inline void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp) { }
-static inline void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp) { }
 #endif
 
 typedef struct ARMVectorReg {
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int arm_gdb_get_svereg(CPUARMState *env, GByteArray *buf, int reg);
 int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
 int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
 int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
+void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
+void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
+void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
 #endif
 
 #ifdef CONFIG_USER_ONLY
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
 {
     Error *local_err = NULL;
 
+#ifdef TARGET_AARCH64
     if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
         arm_cpu_sve_finalize(cpu, &local_err);
         if (local_err != NULL) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
             return;
         }
     }
+#endif
 
     if (kvm_enabled()) {
         kvm_arm_steal_time_finalize(cpu, &local_err);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

These functions are not used outside cpu64.c,
so make them static.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h   | 3 ---
 target/arm/cpu64.c | 4 ++--
 2 files changed, 2 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
 void aarch64_sve_change_el(CPUARMState *env, int old_el,
                            int new_el, bool el0_a64);
-void aarch64_add_sve_properties(Object *obj);
-void aarch64_add_pauth_properties(Object *obj);
 void arm_reset_sve_state(CPUARMState *env);
 
 /*
@@ -XXX,XX +XXX,XX @@ static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
 static inline void aarch64_sve_change_el(CPUARMState *env, int o,
                                          int n, bool a)
 { }
-static inline void aarch64_add_sve_properties(Object *obj) { }
 #endif
 
 void aarch64_sync_32_to_64(CPUARMState *env);
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_default_vec_len(Object *obj, Visitor *v,
 }
 #endif
 
-void aarch64_add_sve_properties(Object *obj)
+static void aarch64_add_sve_properties(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
     uint32_t vq;
@@ -XXX,XX +XXX,XX @@ static Property arm_cpu_pauth_property =
 static Property arm_cpu_pauth_impdef_property =
     DEFINE_PROP_BOOL("pauth-impdef", ARMCPU, prop_pauth_impdef, false);
 
-void aarch64_add_pauth_properties(Object *obj)
+static void aarch64_add_pauth_properties(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Mirror the properties for SVE.  The main difference is
that any arbitrary set of powers of 2 may be supported,
and not the stricter constraints that apply to SVE.

Include a property to control FEAT_SME_FA64, as failing
to restrict the runtime to the proper subset of insns
could be a major point for bugs.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20220620175235.60881-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/cpu-features.rst |  56 +++++++++++++++
 target/arm/cpu.h                 |   2 +
 target/arm/internals.h           |   1 +
 target/arm/cpu.c                 |  14 +++-
 target/arm/cpu64.c               | 114 +++++++++++++++++++++++++++++--
 5 files changed, 180 insertions(+), 7 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ verbose command lines.  However, the recommended way to select vector
 lengths is to explicitly enable each desired length.  Therefore only
 example's (1), (4), and (6) exhibit recommended uses of the properties.
 
+SME CPU Property Examples
+-------------------------
+
+  1) Disable SME::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sme=off
+
+  2) Implicitly enable all vector lengths for the ``max`` CPU type::
+
+     $ qemu-system-aarch64 -M virt -cpu max
+
+  3) Only enable the 256-bit vector length::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sme256=on
+
+  3) Enable the 256-bit and 1024-bit vector lengths::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sme256=on,sme1024=on
+
+  4) Disable the 512-bit vector length.  This results in all the other
+     lengths supported by ``max`` defaulting to enabled
+     (128, 256, 1024 and 2048)::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve512=off
+
 SVE User-mode Default Vector Length Property
 --------------------------------------------
 
@@ -XXX,XX +XXX,XX @@ length supported by QEMU is 256.
 
 If this property is set to ``-1`` then the default vector length
 is set to the maximum possible length.
+
+SME CPU Properties
+==================
+
+The SME CPU properties are much like the SVE properties: ``sme`` is
+used to enable or disable the entire SME feature, and ``sme<N>`` is
+used to enable or disable specific vector lengths.  Finally,
+``sme_fa64`` is used to enable or disable ``FEAT_SME_FA64``, which
+allows execution of the "full a64" instruction set while Streaming
+SVE mode is enabled.
+
+SME is not supported by KVM at this time.
+
+At least one vector length must be enabled when ``sme`` is enabled,
+and all vector lengths must be powers of 2.  The maximum vector
+length supported by qemu is 2048 bits.  Otherwise, there are no
+additional constraints on the set of vector lengths supported by SME.
+
+SME User-mode Default Vector Length Property
+--------------------------------------------
+
+For qemu-aarch64, the cpu propery ``sme-default-vector-length=N`` is
+defined to mirror the Linux kernel parameter file
+``/proc/sys/abi/sme_default_vector_length``.  The default length, ``N``,
+is in units of bytes and must be between 16 and 8192.
+If not specified, the default vector length is 32.
+
+As with ``sve-default-vector-length``, if the default length is larger
+than the maximum vector length enabled, the actual vector length will
+be reduced.  If this property is set to ``-1`` then the default vector
+length is set to the maximum possible length.
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
 #ifdef CONFIG_USER_ONLY
     /* Used to set the default vector length at process start. */
     uint32_t sve_default_vq;
+    uint32_t sme_default_vq;
 #endif
 
     ARMVQMap sve_vq;
+    ARMVQMap sme_vq;
 
     /* Generic timer counter frequency, in Hz */
     uint64_t gt_cntfrq_hz;
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int arm_gdb_set_svereg(CPUARMState *env, uint8_t *buf, int reg);
 int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
 int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
+void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp);
 void arm_cpu_lpa2_finalize(ARMCPU *cpu, Error **errp);
 #endif
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_initfn(Object *obj)
 #ifdef CONFIG_USER_ONLY
 # ifdef TARGET_AARCH64
     /*
-     * The linux kernel defaults to 512-bit vectors, when sve is supported.
-     * See documentation for /proc/sys/abi/sve_default_vector_length, and
-     * our corresponding sve-default-vector-length cpu property.
+     * The linux kernel defaults to 512-bit for SVE, and 256-bit for SME.
+     * These values were chosen to fit within the default signal frame.
+     * See documentation for /proc/sys/abi/{sve,sme}_default_vector_length,
+     * and our corresponding cpu property.
      */
     cpu->sve_default_vq = 4;
+    cpu->sme_default_vq = 2;
 # endif
 #else
     /* Our inbound IRQ and FIQ lines */
@@ -XXX,XX +XXX,XX @@ void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
             return;
         }
 
+        arm_cpu_sme_finalize(cpu, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
+            return;
+        }
+
         arm_cpu_pauth_finalize(cpu, &local_err);
         if (local_err != NULL) {
             error_propagate(errp, local_err);
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_get_vq(Object *obj, Visitor *v, const char *name,
     ARMCPU *cpu = ARM_CPU(obj);
     ARMVQMap *vq_map = opaque;
     uint32_t vq = atoi(&name[3]) / 128;
+    bool sve = vq_map == &cpu->sve_vq;
     bool value;
 
-    /* All vector lengths are disabled when SVE is off. */
-    if (!cpu_isar_feature(aa64_sve, cpu)) {
+    /* All vector lengths are disabled when feature is off. */
+    if (sve
+        ? !cpu_isar_feature(aa64_sve, cpu)
+        : !cpu_isar_feature(aa64_sme, cpu)) {
         value = false;
     } else {
         value = extract32(vq_map->map, vq - 1, 1);
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, bool value, Error **errp)
     cpu->isar.id_aa64pfr0 = t;
 }
 
+void arm_cpu_sme_finalize(ARMCPU *cpu, Error **errp)
+{
+    uint32_t vq_map = cpu->sme_vq.map;
+    uint32_t vq_init = cpu->sme_vq.init;
+    uint32_t vq_supported = cpu->sme_vq.supported;
+    uint32_t vq;
+
+    if (vq_map == 0) {
+        if (!cpu_isar_feature(aa64_sme, cpu)) {
+            cpu->isar.id_aa64smfr0 = 0;
+            return;
+        }
+
+        /* TODO: KVM will require limitations via SMCR_EL2. */
+        vq_map = vq_supported & ~vq_init;
+
+        if (vq_map == 0) {
+            vq = ctz32(vq_supported) + 1;
+            error_setg(errp, "cannot disable sme%d", vq * 128);
+            error_append_hint(errp, "All SME vector lengths are disabled.\n");
+            error_append_hint(errp, "With SME enabled, at least one "
+                              "vector length must be enabled.\n");
+            return;
+        }
+    } else {
+        if (!cpu_isar_feature(aa64_sme, cpu)) {
+            vq = 32 - clz32(vq_map);
+            error_setg(errp, "cannot enable sme%d", vq * 128);
+            error_append_hint(errp, "SME must be enabled to enable "
+                              "vector lengths.\n");
+            error_append_hint(errp, "Add sme=on to the CPU property list.\n");
+            return;
+        }
+        /* TODO: KVM will require limitations via SMCR_EL2. */
+    }
+
+    cpu->sme_vq.map = vq_map;
+}
+
+static bool cpu_arm_get_sme(Object *obj, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    return cpu_isar_feature(aa64_sme, cpu);
+}
+
+static void cpu_arm_set_sme(Object *obj, bool value, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint64_t t;
+
+    t = cpu->isar.id_aa64pfr1;
+    t = FIELD_DP64(t, ID_AA64PFR1, SME, value);
+    cpu->isar.id_aa64pfr1 = t;
+}
+
+static bool cpu_arm_get_sme_fa64(Object *obj, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    return cpu_isar_feature(aa64_sme, cpu) &&
+           cpu_isar_feature(aa64_sme_fa64, cpu);
+}
+
+static void cpu_arm_set_sme_fa64(Object *obj, bool value, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint64_t t;
+
+    t = cpu->isar.id_aa64smfr0;
+    t = FIELD_DP64(t, ID_AA64SMFR0, FA64, value);
+    cpu->isar.id_aa64smfr0 = t;
+}
+
 #ifdef CONFIG_USER_ONLY
-/* Mirror linux /proc/sys/abi/sve_default_vector_length. */
+/* Mirror linux /proc/sys/abi/{sve,sme}_default_vector_length. */
 static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
                                         const char *name, void *opaque,
                                         Error **errp)
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_default_vec_len(Object *obj, Visitor *v,
      * and is the maximum architectural width of ZCR_ELx.LEN.
      */
     if (remainder || default_vq < 1 || default_vq > 512) {
-        error_setg(errp, "cannot set sve-default-vector-length");
+        ARMCPU *cpu = ARM_CPU(obj);
+        const char *which =
+            (ptr_default_vq == &cpu->sve_default_vq ? "sve" : "sme");
+
+        error_setg(errp, "cannot set %s-default-vector-length", which);
         if (remainder) {
             error_append_hint(errp, "Vector length not a multiple of 16\n");
         } else if (default_vq < 1) {
@@ -XXX,XX +XXX,XX @@ static void aarch64_add_sve_properties(Object *obj)
 #endif
 }
 
+static void aarch64_add_sme_properties(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t vq;
+
+    object_property_add_bool(obj, "sme", cpu_arm_get_sme, cpu_arm_set_sme);
+    object_property_add_bool(obj, "sme_fa64", cpu_arm_get_sme_fa64,
+                             cpu_arm_set_sme_fa64);
+
+    for (vq = 1; vq <= ARM_MAX_VQ; vq <<= 1) {
+        char name[8];
+        sprintf(name, "sme%d", vq * 128);
+        object_property_add(obj, name, "bool", cpu_arm_get_vq,
+                            cpu_arm_set_vq, NULL, &cpu->sme_vq);
+    }
+
+#ifdef CONFIG_USER_ONLY
+    /* Mirror linux /proc/sys/abi/sme_default_vector_length. */
+    object_property_add(obj, "sme-default-vector-length", "int32",
+                        cpu_arm_get_default_vec_len,
+                        cpu_arm_set_default_vec_len, NULL,
+                        &cpu->sme_default_vq);
+#endif
+}
+
 void arm_cpu_pauth_finalize(ARMCPU *cpu, Error **errp)
 {
     int arch_val = 0, impdef_val = 0;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 #endif
 
     cpu->sve_vq.supported = MAKE_64BIT_MASK(0, ARM_MAX_VQ);
+    cpu->sme_vq.supported = SVE_VQ_POW2_MAP;
 
     aarch64_add_pauth_properties(obj);
     aarch64_add_sve_properties(obj);
+    aarch64_add_sme_properties(obj);
     object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                         cpu_max_set_sve_max_vq, NULL, NULL);
     qdev_property_add_static(DEVICE(obj), &arm_cpu_lpa2_property);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

When Streaming SVE mode is enabled, the size is taken from
SMCR_ELx instead of ZCR_ELx.  The format is shared, but the
set of vector lengths is not.  Further, Streaming SVE does
not require any particular length to be supported.

Adjust sve_vqm1_for_el to pass the current value of PSTATE.SM
to the new function.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  9 +++++++--
 target/arm/helper.c | 32 +++++++++++++++++++++++++-------
 2 files changed, 32 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int cur_el);
 int sme_exception_el(CPUARMState *env, int cur_el);
 
 /**
- * sve_vqm1_for_el:
+ * sve_vqm1_for_el_sm:
  * @env: CPUARMState
  * @el: exception level
+ * @sm: streaming mode
  *
- * Compute the current SVE vector length for @el, in units of
+ * Compute the current vector length for @el & @sm, in units of
  * Quadwords Minus 1 -- the same scale used for ZCR_ELx.LEN.
+ * If @sm, compute for SVL, otherwise NVL.
  */
+uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm);
+
+/* Likewise, but using @sm = PSTATE.SM. */
 uint32_t sve_vqm1_for_el(CPUARMState *env, int el);
 
 static inline bool is_a64(CPUARMState *env)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sme_exception_el(CPUARMState *env, int el)
 /*
  * Given that SVE is enabled, return the vector length for EL.
  */
-uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
+uint32_t sve_vqm1_for_el_sm(CPUARMState *env, int el, bool sm)
 {
     ARMCPU *cpu = env_archcpu(env);
-    uint32_t len = cpu->sve_max_vq - 1;
+    uint64_t *cr = env->vfp.zcr_el;
+    uint32_t map = cpu->sve_vq.map;
+    uint32_t len = ARM_MAX_VQ - 1;
+
+    if (sm) {
+        cr = env->vfp.smcr_el;
+        map = cpu->sme_vq.map;
+    }
 
     if (el <= 1 && !el_is_in_host(env, el)) {
-        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[1]);
+        len = MIN(len, 0xf & (uint32_t)cr[1]);
     }
     if (el <= 2 && arm_feature(env, ARM_FEATURE_EL2)) {
-        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[2]);
+        len = MIN(len, 0xf & (uint32_t)cr[2]);
     }
     if (arm_feature(env, ARM_FEATURE_EL3)) {
-        len = MIN(len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
+        len = MIN(len, 0xf & (uint32_t)cr[3]);
     }
 
-    len = 31 - clz32(cpu->sve_vq.map & MAKE_64BIT_MASK(0, len + 1));
-    return len;
+    map &= MAKE_64BIT_MASK(0, len + 1);
+    if (map != 0) {
+        return 31 - clz32(map);
+    }
+
+    /* Bit 0 is always set for Normal SVE -- not so for Streaming SVE. */
+    assert(sm);
+    return ctz32(cpu->sme_vq.map);
+}
+
+uint32_t sve_vqm1_for_el(CPUARMState *env, int el)
+{
+    return sve_vqm1_for_el_sm(env, el, FIELD_EX64(env->svcr, SVCR, SM));
 }
 
 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We need SVL separate from VL for RDSVL et al, as well as
ZA storage loads and stores, which do not require PSTATE.SM.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-20-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h           | 12 ++++++++++++
 target/arm/translate.h     |  1 +
 target/arm/helper.c        |  8 +++++++-
 target/arm/translate-a64.c |  1 +
 4 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_A64, MTE0_ACTIVE, 19, 1)
 FIELD(TBFLAG_A64, SMEEXC_EL, 20, 2)
 FIELD(TBFLAG_A64, PSTATE_SM, 22, 1)
 FIELD(TBFLAG_A64, PSTATE_ZA, 23, 1)
+FIELD(TBFLAG_A64, SVL, 24, 4)
 
 /*
  * Helpers for using the above.
@@ -XXX,XX +XXX,XX @@ static inline int sve_vq(CPUARMState *env)
     return EX_TBFLAG_A64(env->hflags, VL) + 1;
 }
 
+/**
+ * sme_vq
+ * @env: the cpu context
+ *
+ * Return the SVL cached within env->hflags, in units of quadwords.
+ */
+static inline int sme_vq(CPUARMState *env)
+{
+    return EX_TBFLAG_A64(env->hflags, SVL) + 1;
+}
+
 static inline bool bswap_code(bool sctlr_b)
 {
 #ifdef CONFIG_USER_ONLY
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     int sve_excp_el; /* SVE exception EL or 0 if enabled */
     int sme_excp_el; /* SME exception EL or 0 if enabled */
     int vl;          /* current vector length in bytes */
+    int svl;         /* current streaming vector length in bytes */
     bool vfp_enabled; /* FP enabled via FPSCR.EN */
     int vec_len;
     int vec_stride;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
         DP_TBFLAG_A64(flags, SVEEXC_EL, sve_el);
     }
     if (cpu_isar_feature(aa64_sme, env_archcpu(env))) {
-        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_exception_el(env, el));
+        int sme_el = sme_exception_el(env, el);
+
+        DP_TBFLAG_A64(flags, SMEEXC_EL, sme_el);
+        if (sme_el == 0) {
+            /* Similarly, do not compute SVL if SME is disabled. */
+            DP_TBFLAG_A64(flags, SVL, sve_vqm1_for_el_sm(env, el, true));
+        }
         if (FIELD_EX64(env->svcr, SVCR, SM)) {
             DP_TBFLAG_A64(flags, PSTATE_SM, 1);
         }
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
     dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
     dc->sme_excp_el = EX_TBFLAG_A64(tb_flags, SMEEXC_EL);
     dc->vl = (EX_TBFLAG_A64(tb_flags, VL) + 1) * 16;
+    dc->svl = (EX_TBFLAG_A64(tb_flags, SVL) + 1) * 16;
     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
     dc->bt = EX_TBFLAG_A64(tb_flags, BT);
     dc->btype = EX_TBFLAG_A64(tb_flags, BTYPE);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We will need these functions in translate-sme.c.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220620175235.60881-21-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.h | 38 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-sve.c | 36 ------------------------------------
 2 files changed, 38 insertions(+), 36 deletions(-)

diff --git a/target/arm/translate-a64.h b/target/arm/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.h
+++ b/target/arm/translate-a64.h
@@ -XXX,XX +XXX,XX @@ static inline int vec_full_reg_size(DisasContext *s)
     return s->vl;
 }
 
+/*
+ * Return the offset info CPUARMState of the predicate vector register Pn.
+ * Note for this purpose, FFR is P16.
+ */
+static inline int pred_full_reg_offset(DisasContext *s, int regno)
+{
+    return offsetof(CPUARMState, vfp.pregs[regno]);
+}
+
+/* Return the byte size of the whole predicate register, VL / 64.  */
+static inline int pred_full_reg_size(DisasContext *s)
+{
+    return s->vl >> 3;
+}
+
+/*
+ * Round up the size of a register to a size allowed by
+ * the tcg vector infrastructure.  Any operation which uses this
+ * size may assume that the bits above pred_full_reg_size are zero,
+ * and must leave them the same way.
+ *
+ * Note that this is not needed for the vector registers as they
+ * are always properly sized for tcg vectors.
+ */
+static inline int size_for_gvec(int size)
+{
+    if (size <= 8) {
+        return 8;
+    } else {
+        return QEMU_ALIGN_UP(size, 16);
+    }
+}
+
+static inline int pred_gvec_reg_size(DisasContext *s)
+{
+    return size_for_gvec(pred_full_reg_size(s));
+}
+
 bool disas_sve(DisasContext *, uint32_t);
 
 void gen_gvec_rax1(unsigned vece, uint32_t rd_ofs, uint32_t rn_ofs,
diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static inline int msz_dtype(DisasContext *s, int msz)
  * Implement all of the translator functions referenced by the decoder.
  */
 
-/* Return the offset info CPUARMState of the predicate vector register Pn.
- * Note for this purpose, FFR is P16.
- */
-static inline int pred_full_reg_offset(DisasContext *s, int regno)
-{
-    return offsetof(CPUARMState, vfp.pregs[regno]);
-}
-
-/* Return the byte size of the whole predicate register, VL / 64.  */
-static inline int pred_full_reg_size(DisasContext *s)
-{
-    return s->vl >> 3;
-}
-
-/* Round up the size of a register to a size allowed by
- * the tcg vector infrastructure.  Any operation which uses this
- * size may assume that the bits above pred_full_reg_size are zero,
- * and must leave them the same way.
- *
- * Note that this is not needed for the vector registers as they
- * are always properly sized for tcg vectors.
- */
-static int size_for_gvec(int size)
-{
-    if (size <= 8) {
-        return 8;
-    } else {
-        return QEMU_ALIGN_UP(size, 16);
-    }
-}
-
-static int pred_gvec_reg_size(DisasContext *s)
-{
-    return size_for_gvec(pred_full_reg_size(s));
-}
-
 /* Invoke an out-of-line helper on 2 Zregs. */
 static bool gen_gvec_ool_zz(DisasContext *s, gen_helper_gvec_2 *fn,
                             int rd, int rn, int data)
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Move the code from hw/arm/virt.c that is supposed
to handle v7 into the one function.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reported-by: He Zhe <zhe.he@windriver.com>
Message-id: 20220619001541.131672-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c    | 10 +---------
 target/arm/ptw.c | 24 ++++++++++++++++--------
 2 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
         cpuobj = object_new(possible_cpus->cpus[0].type);
         armcpu = ARM_CPU(cpuobj);
 
-        if (object_property_get_bool(cpuobj, "aarch64", NULL)) {
-            pa_bits = arm_pamax(armcpu);
-        } else if (arm_feature(&armcpu->env, ARM_FEATURE_LPAE)) {
-            /* v7 with LPAE */
-            pa_bits = 40;
-        } else {
-            /* Anything else */
-            pa_bits = 32;
-        }
+        pa_bits = arm_pamax(armcpu);
 
         object_unref(cpuobj);
 
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t pamax_map[] = {
 /* The cpu-specific constant value of PAMax; also used by hw/arm/virt. */
 unsigned int arm_pamax(ARMCPU *cpu)
 {
-    unsigned int parange =
-        FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        unsigned int parange =
+            FIELD_EX64(cpu->isar.id_aa64mmfr0, ID_AA64MMFR0, PARANGE);
 
-    /*
-     * id_aa64mmfr0 is a read-only register so values outside of the
-     * supported mappings can be considered an implementation error.
-     */
-    assert(parange < ARRAY_SIZE(pamax_map));
-    return pamax_map[parange];
+        /*
+         * id_aa64mmfr0 is a read-only register so values outside of the
+         * supported mappings can be considered an implementation error.
+         */
+        assert(parange < ARRAY_SIZE(pamax_map));
+        return pamax_map[parange];
+    }
+    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
+        /* v7 with LPAE */
+        return 40;
+    }
+    /* Anything else */
+    return 32;
 }
 
 /*
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

In machvirt_init we create a cpu but do not fully initialize it.
Thus the propagation of V7VE to LPAE has not been done, and we
compute the wrong value for some v7 cpus, e.g. cortex-a15.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1078
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reported-by: He Zhe <zhe.he@windriver.com>
Message-id: 20220619001541.131672-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ unsigned int arm_pamax(ARMCPU *cpu)
         assert(parange < ARRAY_SIZE(pamax_map));
         return pamax_map[parange];
     }
-    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
+
+    /*
+     * In machvirt_init, we call arm_pamax on a cpu that is not fully
+     * initialized, so we can't rely on the propagation done in realize.
+     */
+    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE) ||
+        arm_feature(&cpu->env, ARM_FEATURE_V7VE)) {
         /* v7 with LPAE */
         return 40;
     }
-- 
2.25.1