Series comparison

-[PULL 0/6] target-arm queue
+[PULL 0/2] target-arm queue
-A few patches for the rc today...
+This bug seemed worth fixing for 8.0 since we need an rc4 anyway:
 we were using uninitialized data for the guarded bit when
 combining stage 1 and stage 2 attrs.
-The following changes since commit 109918d24a3bb9ed3d05beb34ea4ac6be443c138:
+thanks
 -- PMM
-  Merge remote-tracking branch 'remotes/nvme/tags/nvme-fixes-for-6.0-pull-request' into staging (2021-04-05 22:15:38 +0100)
+The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6:
   Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210406
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410
-for you to fetch changes up to 49bc76550c37f4a2b92a05cb3e6989a739d56ac9:
+for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308:
-  Remove myself as i.mx31 maintainer (2021-04-06 11:49:15 +0100)
+  target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100)
 ----------------------------------------------------------------
-target-arm queue:
+target-arm: Fix bug where we weren't initializing
- * ppc/e500 and arm/virt: only add valid dynamic sysbus devices to the
+            guarded bit state when combining S1/S2 attrs
    platform bus
  * update i.mx31 maintainer list
  * Revert "target/arm: Make number of counters in PMCR follow the CPU"
 ----------------------------------------------------------------
-Chubb, Peter (Data61, Eveleigh) (1):
+Richard Henderson (2):
-      Remove myself as i.mx31 maintainer
+      target/arm: PTE bit GP only applies to stage1
       target/arm: Copy guarded bit in combine_cacheattrs
-Peter Maydell (5):
+ target/arm/ptw.c | 11 ++++++-----
-      include/hw/boards.h: Document machine_class_allow_dynamic_sysbus_dev()
+file changed, 6 insertions(+), 5 deletions(-)
       machine: Provide a function to check the dynamic sysbus allowlist
       hw/arm/virt: Only try to add valid dynamic sysbus devices to platform bus
       hw/ppc/e500plat: Only try to add valid dynamic sysbus devices to platform bus
       Revert "target/arm: Make number of counters in PMCR follow the CPU"
  include/hw/boards.h  | 39 +++++++++++++++++++++++++++++++++++++++
  target/arm/cpu.h     |  1 -
  hw/arm/virt.c        |  8 ++++++--
  hw/core/machine.c    | 21 ++++++++++++++++-----
  hw/ppc/e500plat.c    |  8 ++++++--
  target/arm/cpu64.c   |  3 ---
  target/arm/cpu_tcg.c |  5 -----
  target/arm/helper.c  | 29 ++++++++++++-----------------
  target/arm/kvm64.c   |  2 --
  MAINTAINERS          |  1 -
 files changed, 79 insertions(+), 38 deletions(-)

-[PULL 1/6] include/hw/boards.h: Document machine_class_allow_dynamic_sysbus_dev()
+Deleted patch
-The function machine_class_allow_dynamic_sysbus_dev() is currently
-undocumented; add a doc comment.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20210325153310.9131-2-peter.maydell@linaro.org
----
- include/hw/boards.h | 15 +++++++++++++++
-file changed, 15 insertions(+)
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
-                                const CpuInstanceProperties *props,
-                                Error **errp);
-+/**
-+ * machine_class_allow_dynamic_sysbus_dev: Add type to list of valid devices
-+ * @mc: Machine class
-+ * @type: type to allow (should be a subtype of TYPE_SYS_BUS_DEVICE)
-+ *
-+ * Add the QOM type @type to the list of devices of which are subtypes
-+ * of TYPE_SYS_BUS_DEVICE but which are still permitted to be dynamically
-+ * created (eg by the user on the command line with -device).
-+ * By default if the user tries to create any devices on the command line
-+ * that are subtypes of TYPE_SYS_BUS_DEVICE they will get an error message;
-+ * for the special cases which are permitted for this machine model, the
-+ * machine model class init code must call this function to add them
-+ * to the list of specifically permitted devices.
-+ */
- void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type);
-+
- /*
-  * Checks that backend isn't used, preps it for exclusive usage and
-  * returns migratable MemoryRegion provided by backend.
---
-.20.1

-[PULL 2/6] machine: Provide a function to check the dynamic sysbus allowlist
+[PULL 1/2] target/arm: PTE bit GP only applies to stage1
-Provide a new function dynamic_sysbus_dev_allowed() which checks the
+From: Richard Henderson <richard.henderson@linaro.org>
 per-machine list of permitted dynamic sysbus devices and returns a
 boolean result indicating whether the device is allowed.  We can use
 this in the implementation of validate_sysbus_device(), but we will
 also need it so that machine hotplug callbacks can validate devices
 rather than assuming that any sysbus device might be hotpluggable
 into the platform bus.
+Only perform the extract of GP during the stage1 walk.
+Reported-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20210325153310.9131-3-peter.maydell@linaro.org
 ---
- include/hw/boards.h | 24 ++++++++++++++++++++++++
+ target/arm/ptw.c | 10 +++++-----
- hw/core/machine.c   | 21 ++++++++++++++++-----
+file changed, 5 insertions(+), 5 deletions(-)
 files changed, 40 insertions(+), 5 deletions(-)
-diff --git a/include/hw/boards.h b/include/hw/boards.h
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
+--- a/target/arm/ptw.c
-+++ b/include/hw/boards.h
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-  */
+         result->f.attrs.secure = false;
- void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type);
+     }
-+/**
+-    /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB.  */
-+ * device_is_dynamic_sysbus: test whether device is a dynamic sysbus device
+-    if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
-+ * @mc: Machine class
+-        result->f.guarded = extract64(attrs, 50, 1); /* GP */
-+ * @dev: device to check
+-    }
-+ *
+-
-+ * Returns: true if @dev is a sysbus device on the machine's list
+     if (regime_is_stage2(mmu_idx)) {
-+ * of dynamically pluggable sysbus devices; otherwise false.
+         result->cacheattrs.is_s2_format = true;
-+ *
+         result->cacheattrs.attrs = extract32(attrs, 2, 4);
-+ * This function checks whether @dev is a valid dynamic sysbus device,
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-+ * by first confirming that it is a sysbus device and then checking it
+         assert(attrindx <= 7);
-+ * against the list of permitted dynamic sysbus devices which has been
+         result->cacheattrs.is_s2_format = false;
-+ * set up by the machine using machine_class_allow_dynamic_sysbus_dev().
+         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
 + *
 + * It is valid to call this with something that is not a subclass of
 + * TYPE_SYS_BUS_DEVICE; the function will return false in this case.
 + * This allows hotplug callback functions to be written as:
 + *     if (device_is_dynamic_sysbus(mc, dev)) {
 + *         handle dynamic sysbus case;
 + *     } else if (some other kind of hotplug) {
 + *         handle that;
 + *     }
 + */
 +bool device_is_dynamic_sysbus(MachineClass *mc, DeviceState *dev);
 +
- /*
++        /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
-  * Checks that backend isn't used, preps it for exclusive usage and
++        if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
-  * returns migratable MemoryRegion provided by backend.
++            result->f.guarded = extract64(attrs, 50, 1); /* GP */
-diff --git a/hw/core/machine.c b/hw/core/machine.c
++        }
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -XXX,XX +XXX,XX @@ void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type)
      QAPI_LIST_PREPEND(mc->allowed_dynamic_sysbus_devices, g_strdup(type));
  }
 -static void validate_sysbus_device(SysBusDevice *sbdev, void *opaque)
 +bool device_is_dynamic_sysbus(MachineClass *mc, DeviceState *dev)
  {
 -    MachineState *machine = opaque;
 -    MachineClass *mc = MACHINE_GET_CLASS(machine);
      bool allowed = false;
      strList *wl;
 +    Object *obj = OBJECT(dev);
 +
 +    if (!object_dynamic_cast(obj, TYPE_SYS_BUS_DEVICE)) {
 +        return false;
 +    }
      for (wl = mc->allowed_dynamic_sysbus_devices;
           !allowed && wl;
           wl = wl->next) {
 -        allowed |= !!object_dynamic_cast(OBJECT(sbdev), wl->value);
 +        allowed |= !!object_dynamic_cast(obj, wl->value);
      }
--    if (!allowed) {
+     /*
 +    return allowed;
 +}
 +
 +static void validate_sysbus_device(SysBusDevice *sbdev, void *opaque)
 +{
 +    MachineState *machine = opaque;
 +    MachineClass *mc = MACHINE_GET_CLASS(machine);
 +
 +    if (!device_is_dynamic_sysbus(mc, DEVICE(sbdev))) {
          error_report("Option '-device %s' cannot be handled by this machine",
                       object_class_get_name(object_get_class(OBJECT(sbdev))));
          exit(1);
 --
-.20.1
+.34.1

-[PULL 3/6] hw/arm/virt: Only try to add valid dynamic sysbus devices to platform bus
+Deleted patch
-The virt machine device plug callback currently calls
-platform_bus_link_device() for any sysbus device.  This is overly
-broad, because platform_bus_link_device() will unconditionally grab
-the IRQs and MMIOs of the device it is passed, whether it was
-intended for the platform bus or not.  Restrict hotpluggability of
-sysbus devices to only those devices on the dynamic sysbus
-allowlist.
-We were mostly getting away with this because the board creates the
-platform bus as the last device it creates, and so the hotplug
-callback did not do anything for all the sysbus devices created by
-the board itself.  However if the user plugged in a device which
-itself uses a sysbus device internally we would have mishandled this
-and probably asserted.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20210325153310.9131-4-peter.maydell@linaro.org
----
- hw/arm/virt.c | 8 ++++++--
-file changed, 6 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
-     VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);
-     if (vms->platform_bus_dev) {
--        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
-+        MachineClass *mc = MACHINE_GET_CLASS(vms);
-+
-+        if (device_is_dynamic_sysbus(mc, dev)) {
-             platform_bus_link_device(PLATFORM_BUS_DEVICE(vms->platform_bus_dev),
-                                      SYS_BUS_DEVICE(dev));
-         }
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_unplug_cb(HotplugHandler *hotplug_dev,
- static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
-                                                         DeviceState *dev)
- {
--    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE) ||
-+    MachineClass *mc = MACHINE_GET_CLASS(machine);
-+
-+    if (device_is_dynamic_sysbus(mc, dev) ||
-        (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM))) {
-         return HOTPLUG_HANDLER(machine);
-     }
---
-.20.1

-[PULL 4/6] hw/ppc/e500plat: Only try to add valid dynamic sysbus devices to platform bus
+Deleted patch
-The e500plat machine device plug callback currently calls
-platform_bus_link_device() for any sysbus device.  This is overly
-broad, because platform_bus_link_device() will unconditionally grab
-the IRQs and MMIOs of the device it is passed, whether it was
-intended for the platform bus or not.  Restrict hotpluggability of
-sysbus devices to only those devices on the dynamic sysbus allowlist.
-We were mostly getting away with this because the board creates the
-platform bus as the last device it creates, and so the hotplug
-callback did not do anything for all the sysbus devices created by
-the board itself.  However if the user plugged in a device which
-itself uses a sysbus device internally we would have mishandled this
-and probably asserted. An example of this is:
- qemu-system-ppc64 -M ppce500 -device macio-oldworld
-This isn't a sensible command because the macio-oldworld device
-is really specific to the 'g3beige' machine, but we now fail
-with a reasonable error message rather than asserting:
-qemu-system-ppc64: Device heathrow is not supported by this machine yet.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Acked-by: David Gibson <david@gibson.dropbear.id.au>
-Message-id: 20210325153310.9131-5-peter.maydell@linaro.org
----
- hw/ppc/e500plat.c | 8 ++++++--
-file changed, 6 insertions(+), 2 deletions(-)
-diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ppc/e500plat.c
-+++ b/hw/ppc/e500plat.c
-@@ -XXX,XX +XXX,XX @@ static void e500plat_machine_device_plug_cb(HotplugHandler *hotplug_dev,
-     PPCE500MachineState *pms = PPCE500_MACHINE(hotplug_dev);
-     if (pms->pbus_dev) {
--        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
-+        MachineClass *mc = MACHINE_GET_CLASS(pms);
-+
-+        if (device_is_dynamic_sysbus(mc, dev)) {
-             platform_bus_link_device(pms->pbus_dev, SYS_BUS_DEVICE(dev));
-         }
-     }
-@@ -XXX,XX +XXX,XX @@ static
- HotplugHandler *e500plat_machine_get_hotpug_handler(MachineState *machine,
-                                                     DeviceState *dev)
- {
--    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
-+    MachineClass *mc = MACHINE_GET_CLASS(machine);
-+
-+    if (device_is_dynamic_sysbus(mc, dev)) {
-         return HOTPLUG_HANDLER(machine);
-     }
---
-.20.1

-[PULL 5/6] Revert "target/arm: Make number of counters in PMCR follow the CPU"
+Deleted patch
-This reverts commit f7fb73b8cdd3f77e26f9fcff8cf24ff1b58d200f.
-This change turned out to be a bit half-baked, and doesn't
-work with KVM, which fails with the error:
-   "qemu-system-aarch64: Failed to retrieve host CPU features"
-because KVM does not allow accessing of the PMCR_EL0 value in
-the scratch "query CPU ID registers" VM unless we have first
-set the KVM_ARM_VCPU_PMU_V3 feature on the VM.
-Revert the change for 6.0.
-Reported-by: Zenghui Yu <yuzenghui@huawei.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Tested-by: Zenghui Yu <yuzenghui@huawei.com>
-Message-id: 20210331154822.23332-1-peter.maydell@linaro.org
----
- target/arm/cpu.h     |  1 -
- target/arm/cpu64.c   |  3 ---
- target/arm/cpu_tcg.c |  5 -----
- target/arm/helper.c  | 29 ++++++++++++-----------------
- target/arm/kvm64.c   |  2 --
-files changed, 12 insertions(+), 28 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
-         uint64_t id_aa64mmfr2;
-         uint64_t id_aa64dfr0;
-         uint64_t id_aa64dfr1;
--        uint64_t reset_pmcr_el0;
-     } isar;
-     uint64_t midr;
-     uint32_t revidr;
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
-     cpu->gic_num_lrs = 4;
-     cpu->gic_vpribits = 5;
-     cpu->gic_vprebits = 5;
--    cpu->isar.reset_pmcr_el0 = 0x41013000;
-     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
- }
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
-     cpu->gic_num_lrs = 4;
-     cpu->gic_vpribits = 5;
-     cpu->gic_vprebits = 5;
--    cpu->isar.reset_pmcr_el0 = 0x41033000;
-     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
- }
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
-     cpu->gic_num_lrs = 4;
-     cpu->gic_vpribits = 5;
-     cpu->gic_vprebits = 5;
--    cpu->isar.reset_pmcr_el0 = 0x41023000;
-     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
- }
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
-     cpu->ccsidr[1] = 0x2007e01a; /* 16k L1 icache. */
-     cpu->ccsidr[2] = 0xf0000000; /* No L2 icache. */
-     cpu->reset_auxcr = 2;
--    cpu->isar.reset_pmcr_el0 = 0x41002000;
-     define_arm_cp_regs(cpu, cortexa8_cp_reginfo);
- }
-@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
-     cpu->clidr = (1 << 27) | (1 << 24) | 3;
-     cpu->ccsidr[0] = 0xe00fe019; /* 16k L1 dcache. */
-     cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */
--    cpu->isar.reset_pmcr_el0 = 0x41093000;
-     define_arm_cp_regs(cpu, cortexa9_cp_reginfo);
- }
-@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
-     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
-     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
-     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
--    cpu->isar.reset_pmcr_el0 = 0x41072000;
-     define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */
- }
-@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
-     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
-     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
-     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
--    cpu->isar.reset_pmcr_el0 = 0x410F3000;
-     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
- }
-@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
-     cpu->isar.id_isar6 = 0x0;
-     cpu->mp_is_up = true;
-     cpu->pmsav7_dregion = 16;
--    cpu->isar.reset_pmcr_el0 = 0x41151800;
-     define_arm_cp_regs(cpu, cortexr5_cp_reginfo);
- }
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
- #endif
- #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
-+#define PMCR_NUM_COUNTERS 4 /* QEMU IMPDEF choice */
- #ifndef CONFIG_USER_ONLY
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
- static inline uint32_t pmu_num_counters(CPUARMState *env)
- {
--    ARMCPU *cpu = env_archcpu(env);
--
--    return (cpu->isar.reset_pmcr_el0 & PMCRN_MASK) >> PMCRN_SHIFT;
-+  return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
- }
- /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
-       .resetvalue = 0,
-       .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
- #endif
-+    /* The only field of MDCR_EL2 that has a defined architectural reset value
-+     * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N.
-+     */
-+    { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
-+      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
-+      .access = PL2_RW, .resetvalue = PMCR_NUM_COUNTERS,
-+      .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), },
-     { .name = "HPFAR", .state = ARM_CP_STATE_AA32,
-       .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
-       .access = PL2_RW, .accessfn = access_el3_aa32ns,
-@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
-      * field as main ID register, and we implement four counters in
-      * addition to the cycle count register.
-      */
--    unsigned int i, pmcrn = pmu_num_counters(&cpu->env);
-+    unsigned int i, pmcrn = PMCR_NUM_COUNTERS;
-     ARMCPRegInfo pmcr = {
-         .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
-         .access = PL0_RW,
-@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
-         .access = PL0_RW, .accessfn = pmreg_access,
-         .type = ARM_CP_IO,
-         .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
--        .resetvalue = cpu->isar.reset_pmcr_el0,
-+        .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT) |
-+                      PMCRLC,
-         .writefn = pmcr_write, .raw_writefn = raw_write,
-     };
--
-     define_one_arm_cp_reg(cpu, &pmcr);
-     define_one_arm_cp_reg(cpu, &pmcr64);
-     for (i = 0; i < pmcrn; i++) {
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-               .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
-             REGINFO_SENTINEL
-         };
--        /*
--         * The only field of MDCR_EL2 that has a defined architectural reset
--         * value is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N.
--         */
--        ARMCPRegInfo mdcr_el2 = {
--            .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
--            .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
--            .access = PL2_RW, .resetvalue = pmu_num_counters(env),
--            .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2),
--        };
--        define_one_arm_cp_reg(cpu, &mdcr_el2);
-         define_arm_cp_regs(cpu, vpidr_regs);
-         define_arm_cp_regs(cpu, el2_cp_reginfo);
-         if (arm_feature(env, ARM_FEATURE_V8)) {
-diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/kvm64.c
-+++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-                               ARM64_SYS_REG(3, 0, 0, 7, 1));
-         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr2,
-                               ARM64_SYS_REG(3, 0, 0, 7, 2));
--        err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
--                              ARM64_SYS_REG(3, 3, 9, 12, 0));
-         /*
-          * Note that if AArch32 support is not present in the host,
---
-.20.1

-[PULL 6/6] Remove myself as i.mx31 maintainer
+[PULL 2/2] target/arm: Copy guarded bit in combine_cacheattrs
-From: "Chubb, Peter (Data61, Eveleigh)" <Peter.Chubb@data61.csiro.au>
+From: Richard Henderson <richard.henderson@linaro.org>
-Remove Peter Chubb as i/MX31 maintainer.
+The guarded bit comes from the stage1 walk.
-I'm leaving my current job and will no longer have access to the
+Fixes: Coverity CID 1507929
-hardware to test or maintain this port.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Peter Chubb <peter.chubb@data61.csiro.au>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20230407185149.3253946-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS | 1 -
+ target/arm/ptw.c | 1 +
-file changed, 1 deletion(-)
+file changed, 1 insertion(+)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/target/arm/ptw.c
-+++ b/MAINTAINERS
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ F: include/hw/misc/imx25_ccm.h
+@@ -XXX,XX +XXX,XX @@ static ARMCacheAttrs combine_cacheattrs(uint64_t hcr,
- F: include/hw/watchdog/wdt_imx2.h
+     assert(!s1.is_s2_format);
- i.MX31 (kzm)
+     ret.is_s2_format = false;
--M: Peter Chubb <peter.chubb@nicta.com.au>
++    ret.guarded = s1.guarded;
- M: Peter Maydell <peter.maydell@linaro.org>
- L: qemu-arm@nongnu.org
+     if (s1.attrs == 0xf0) {
- S: Odd Fixes
+         tagged = true;
 --
-.20.1
+.34.1

A few patches for the rc today...

The following changes since commit 109918d24a3bb9ed3d05beb34ea4ac6be443c138:

Merge remote-tracking branch 'remotes/nvme/tags/nvme-fixes-for-6.0-pull-request' into staging (2021-04-05 22:15:38 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210406

for you to fetch changes up to 49bc76550c37f4a2b92a05cb3e6989a739d56ac9:

Remove myself as i.mx31 maintainer (2021-04-06 11:49:15 +0100)

----------------------------------------------------------------
target-arm queue:
 * ppc/e500 and arm/virt: only add valid dynamic sysbus devices to the
   platform bus
 * update i.mx31 maintainer list
 * Revert "target/arm: Make number of counters in PMCR follow the CPU"

----------------------------------------------------------------
Chubb, Peter (Data61, Eveleigh) (1):
      Remove myself as i.mx31 maintainer

Peter Maydell (5):
      include/hw/boards.h: Document machine_class_allow_dynamic_sysbus_dev()
      machine: Provide a function to check the dynamic sysbus allowlist
      hw/arm/virt: Only try to add valid dynamic sysbus devices to platform bus
      hw/ppc/e500plat: Only try to add valid dynamic sysbus devices to platform bus
      Revert "target/arm: Make number of counters in PMCR follow the CPU"

The function machine_class_allow_dynamic_sysbus_dev() is currently
undocumented; add a doc comment.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20210325153310.9131-2-peter.maydell@linaro.org
---
 include/hw/boards.h | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
                                const CpuInstanceProperties *props,
                                Error **errp);
 
+/**
+ * machine_class_allow_dynamic_sysbus_dev: Add type to list of valid devices
+ * @mc: Machine class
+ * @type: type to allow (should be a subtype of TYPE_SYS_BUS_DEVICE)
+ *
+ * Add the QOM type @type to the list of devices of which are subtypes
+ * of TYPE_SYS_BUS_DEVICE but which are still permitted to be dynamically
+ * created (eg by the user on the command line with -device).
+ * By default if the user tries to create any devices on the command line
+ * that are subtypes of TYPE_SYS_BUS_DEVICE they will get an error message;
+ * for the special cases which are permitted for this machine model, the
+ * machine model class init code must call this function to add them
+ * to the list of specifically permitted devices.
+ */
 void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type);
+
 /*
  * Checks that backend isn't used, preps it for exclusive usage and
  * returns migratable MemoryRegion provided by backend.
-- 
2.20.1

Provide a new function dynamic_sysbus_dev_allowed() which checks the
per-machine list of permitted dynamic sysbus devices and returns a
boolean result indicating whether the device is allowed.  We can use
this in the implementation of validate_sysbus_device(), but we will
also need it so that machine hotplug callbacks can validate devices
rather than assuming that any sysbus device might be hotpluggable
into the platform bus.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20210325153310.9131-3-peter.maydell@linaro.org
---
 include/hw/boards.h | 24 ++++++++++++++++++++++++
 hw/core/machine.c   | 21 ++++++++++++++++-----
 2 files changed, 40 insertions(+), 5 deletions(-)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
  */
 void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type);
 
+/**
+ * device_is_dynamic_sysbus: test whether device is a dynamic sysbus device
+ * @mc: Machine class
+ * @dev: device to check
+ *
+ * Returns: true if @dev is a sysbus device on the machine's list
+ * of dynamically pluggable sysbus devices; otherwise false.
+ *
+ * This function checks whether @dev is a valid dynamic sysbus device,
+ * by first confirming that it is a sysbus device and then checking it
+ * against the list of permitted dynamic sysbus devices which has been
+ * set up by the machine using machine_class_allow_dynamic_sysbus_dev().
+ *
+ * It is valid to call this with something that is not a subclass of
+ * TYPE_SYS_BUS_DEVICE; the function will return false in this case.
+ * This allows hotplug callback functions to be written as:
+ *     if (device_is_dynamic_sysbus(mc, dev)) {
+ *         handle dynamic sysbus case;
+ *     } else if (some other kind of hotplug) {
+ *         handle that;
+ *     }
+ */
+bool device_is_dynamic_sysbus(MachineClass *mc, DeviceState *dev);
+
 /*
  * Checks that backend isn't used, preps it for exclusive usage and
  * returns migratable MemoryRegion provided by backend.
diff --git a/hw/core/machine.c b/hw/core/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -XXX,XX +XXX,XX @@ void machine_class_allow_dynamic_sysbus_dev(MachineClass *mc, const char *type)
     QAPI_LIST_PREPEND(mc->allowed_dynamic_sysbus_devices, g_strdup(type));
 }
 
-static void validate_sysbus_device(SysBusDevice *sbdev, void *opaque)
+bool device_is_dynamic_sysbus(MachineClass *mc, DeviceState *dev)
 {
-    MachineState *machine = opaque;
-    MachineClass *mc = MACHINE_GET_CLASS(machine);
     bool allowed = false;
     strList *wl;
+    Object *obj = OBJECT(dev);
+
+    if (!object_dynamic_cast(obj, TYPE_SYS_BUS_DEVICE)) {
+        return false;
+    }
 
     for (wl = mc->allowed_dynamic_sysbus_devices;
          !allowed && wl;
          wl = wl->next) {
-        allowed |= !!object_dynamic_cast(OBJECT(sbdev), wl->value);
+        allowed |= !!object_dynamic_cast(obj, wl->value);
     }
 
-    if (!allowed) {
+    return allowed;
+}
+
+static void validate_sysbus_device(SysBusDevice *sbdev, void *opaque)
+{
+    MachineState *machine = opaque;
+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+
+    if (!device_is_dynamic_sysbus(mc, DEVICE(sbdev))) {
         error_report("Option '-device %s' cannot be handled by this machine",
                      object_class_get_name(object_get_class(OBJECT(sbdev))));
         exit(1);
-- 
2.20.1

The virt machine device plug callback currently calls
platform_bus_link_device() for any sysbus device.  This is overly
broad, because platform_bus_link_device() will unconditionally grab
the IRQs and MMIOs of the device it is passed, whether it was
intended for the platform bus or not.  Restrict hotpluggability of
sysbus devices to only those devices on the dynamic sysbus
allowlist.

We were mostly getting away with this because the board creates the
platform bus as the last device it creates, and so the hotplug
callback did not do anything for all the sysbus devices created by
the board itself.  However if the user plugged in a device which
itself uses a sysbus device internally we would have mishandled this
and probably asserted.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20210325153310.9131-4-peter.maydell@linaro.org
---
 hw/arm/virt.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_plug_cb(HotplugHandler *hotplug_dev,
     VirtMachineState *vms = VIRT_MACHINE(hotplug_dev);
 
     if (vms->platform_bus_dev) {
-        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+        MachineClass *mc = MACHINE_GET_CLASS(vms);
+
+        if (device_is_dynamic_sysbus(mc, dev)) {
             platform_bus_link_device(PLATFORM_BUS_DEVICE(vms->platform_bus_dev),
                                      SYS_BUS_DEVICE(dev));
         }
@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_unplug_cb(HotplugHandler *hotplug_dev,
 static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
                                                         DeviceState *dev)
 {
-    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE) ||
+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+
+    if (device_is_dynamic_sysbus(mc, dev) ||
        (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM))) {
         return HOTPLUG_HANDLER(machine);
     }
-- 
2.20.1

The e500plat machine device plug callback currently calls
platform_bus_link_device() for any sysbus device.  This is overly
broad, because platform_bus_link_device() will unconditionally grab
the IRQs and MMIOs of the device it is passed, whether it was
intended for the platform bus or not.  Restrict hotpluggability of
sysbus devices to only those devices on the dynamic sysbus allowlist.

This isn't a sensible command because the macio-oldworld device
is really specific to the 'g3beige' machine, but we now fail
with a reasonable error message rather than asserting:
qemu-system-ppc64: Device heathrow is not supported by this machine yet.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Acked-by: David Gibson <david@gibson.dropbear.id.au>
Message-id: 20210325153310.9131-5-peter.maydell@linaro.org
---
 hw/ppc/e500plat.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/hw/ppc/e500plat.c b/hw/ppc/e500plat.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/e500plat.c
+++ b/hw/ppc/e500plat.c
@@ -XXX,XX +XXX,XX @@ static void e500plat_machine_device_plug_cb(HotplugHandler *hotplug_dev,
     PPCE500MachineState *pms = PPCE500_MACHINE(hotplug_dev);
 
     if (pms->pbus_dev) {
-        if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+        MachineClass *mc = MACHINE_GET_CLASS(pms);
+
+        if (device_is_dynamic_sysbus(mc, dev)) {
             platform_bus_link_device(pms->pbus_dev, SYS_BUS_DEVICE(dev));
         }
     }
@@ -XXX,XX +XXX,XX @@ static
 HotplugHandler *e500plat_machine_get_hotpug_handler(MachineState *machine,
                                                     DeviceState *dev)
 {
-    if (object_dynamic_cast(OBJECT(dev), TYPE_SYS_BUS_DEVICE)) {
+    MachineClass *mc = MACHINE_GET_CLASS(machine);
+
+    if (device_is_dynamic_sysbus(mc, dev)) {
         return HOTPLUG_HANDLER(machine);
     }
 
-- 
2.20.1

This reverts commit f7fb73b8cdd3f77e26f9fcff8cf24ff1b58d200f.

This change turned out to be a bit half-baked, and doesn't
work with KVM, which fails with the error:
   "qemu-system-aarch64: Failed to retrieve host CPU features"

because KVM does not allow accessing of the PMCR_EL0 value in
the scratch "query CPU ID registers" VM unless we have first
set the KVM_ARM_VCPU_PMU_V3 feature on the VM.

Revert the change for 6.0.

Reported-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Zenghui Yu <yuzenghui@huawei.com>
Message-id: 20210331154822.23332-1-peter.maydell@linaro.org
---
 target/arm/cpu.h     |  1 -
 target/arm/cpu64.c   |  3 ---
 target/arm/cpu_tcg.c |  5 -----
 target/arm/helper.c  | 29 ++++++++++++-----------------
 target/arm/kvm64.c   |  2 --
 5 files changed, 12 insertions(+), 28 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
         uint64_t id_aa64mmfr2;
         uint64_t id_aa64dfr0;
         uint64_t id_aa64dfr1;
-        uint64_t reset_pmcr_el0;
     } isar;
     uint64_t midr;
     uint32_t revidr;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
     cpu->gic_num_lrs = 4;
     cpu->gic_vpribits = 5;
     cpu->gic_vprebits = 5;
-    cpu->isar.reset_pmcr_el0 = 0x41013000;
     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
     cpu->gic_num_lrs = 4;
     cpu->gic_vpribits = 5;
     cpu->gic_vprebits = 5;
-    cpu->isar.reset_pmcr_el0 = 0x41033000;
     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
     cpu->gic_num_lrs = 4;
     cpu->gic_vpribits = 5;
     cpu->gic_vprebits = 5;
-    cpu->isar.reset_pmcr_el0 = 0x41023000;
     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static void cortex_a8_initfn(Object *obj)
     cpu->ccsidr[1] = 0x2007e01a; /* 16k L1 icache. */
     cpu->ccsidr[2] = 0xf0000000; /* No L2 icache. */
     cpu->reset_auxcr = 2;
-    cpu->isar.reset_pmcr_el0 = 0x41002000;
     define_arm_cp_regs(cpu, cortexa8_cp_reginfo);
 }
 
@@ -XXX,XX +XXX,XX @@ static void cortex_a9_initfn(Object *obj)
     cpu->clidr = (1 << 27) | (1 << 24) | 3;
     cpu->ccsidr[0] = 0xe00fe019; /* 16k L1 dcache. */
     cpu->ccsidr[1] = 0x200fe019; /* 16k L1 icache. */
-    cpu->isar.reset_pmcr_el0 = 0x41093000;
     define_arm_cp_regs(cpu, cortexa9_cp_reginfo);
 }
 
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
-    cpu->isar.reset_pmcr_el0 = 0x41072000;
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo); /* Same as A15 */
 }
 
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
     cpu->ccsidr[2] = 0x711fe07a; /* 4096K L2 unified cache */
-    cpu->isar.reset_pmcr_el0 = 0x410F3000;
     define_arm_cp_regs(cpu, cortexa15_cp_reginfo);
 }
 
@@ -XXX,XX +XXX,XX @@ static void cortex_r5_initfn(Object *obj)
     cpu->isar.id_isar6 = 0x0;
     cpu->mp_is_up = true;
     cpu->pmsav7_dregion = 16;
-    cpu->isar.reset_pmcr_el0 = 0x41151800;
     define_arm_cp_regs(cpu, cortexr5_cp_reginfo);
 }
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #endif
 
 #define ARM_CPU_FREQ 1000000000 /* FIXME: 1 GHz, should be configurable */
+#define PMCR_NUM_COUNTERS 4 /* QEMU IMPDEF choice */
 
 #ifndef CONFIG_USER_ONLY
 
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v6_cp_reginfo[] = {
 
 static inline uint32_t pmu_num_counters(CPUARMState *env)
 {
-    ARMCPU *cpu = env_archcpu(env);
-
-    return (cpu->isar.reset_pmcr_el0 & PMCRN_MASK) >> PMCRN_SHIFT;
+  return (env->cp15.c9_pmcr & PMCRN_MASK) >> PMCRN_SHIFT;
 }
 
 /* Bits allowed to be set/cleared for PMCNTEN* and PMINTEN* */
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .resetvalue = 0,
       .writefn = gt_hyp_ctl_write, .raw_writefn = raw_write },
 #endif
+    /* The only field of MDCR_EL2 that has a defined architectural reset value
+     * is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N.
+     */
+    { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
+      .access = PL2_RW, .resetvalue = PMCR_NUM_COUNTERS,
+      .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2), },
     { .name = "HPFAR", .state = ARM_CP_STATE_AA32,
       .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
       .access = PL2_RW, .accessfn = access_el3_aa32ns,
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
      * field as main ID register, and we implement four counters in
      * addition to the cycle count register.
      */
-    unsigned int i, pmcrn = pmu_num_counters(&cpu->env);
+    unsigned int i, pmcrn = PMCR_NUM_COUNTERS;
     ARMCPRegInfo pmcr = {
         .name = "PMCR", .cp = 15, .crn = 9, .crm = 12, .opc1 = 0, .opc2 = 0,
         .access = PL0_RW,
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
         .access = PL0_RW, .accessfn = pmreg_access,
         .type = ARM_CP_IO,
         .fieldoffset = offsetof(CPUARMState, cp15.c9_pmcr),
-        .resetvalue = cpu->isar.reset_pmcr_el0,
+        .resetvalue = (cpu->midr & 0xff000000) | (pmcrn << PMCRN_SHIFT) |
+                      PMCRLC,
         .writefn = pmcr_write, .raw_writefn = raw_write,
     };
-
     define_one_arm_cp_reg(cpu, &pmcr);
     define_one_arm_cp_reg(cpu, &pmcr64);
     for (i = 0; i < pmcrn; i++) {
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
             REGINFO_SENTINEL
         };
-        /*
-         * The only field of MDCR_EL2 that has a defined architectural reset
-         * value is MDCR_EL2.HPMN which should reset to the value of PMCR_EL0.N.
-         */
-        ARMCPRegInfo mdcr_el2 = {
-            .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
-            .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
-            .access = PL2_RW, .resetvalue = pmu_num_counters(env),
-            .fieldoffset = offsetof(CPUARMState, cp15.mdcr_el2),
-        };
-        define_one_arm_cp_reg(cpu, &mdcr_el2);
         define_arm_cp_regs(cpu, vpidr_regs);
         define_arm_cp_regs(cpu, el2_cp_reginfo);
         if (arm_feature(env, ARM_FEATURE_V8)) {
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                               ARM64_SYS_REG(3, 0, 0, 7, 1));
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64mmfr2,
                               ARM64_SYS_REG(3, 0, 0, 7, 2));
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
-                              ARM64_SYS_REG(3, 3, 9, 12, 0));
 
         /*
          * Note that if AArch32 support is not present in the host,
-- 
2.20.1

This bug seemed worth fixing for 8.0 since we need an rc4 anyway:
we were using uninitialized data for the guarded bit when
combining stage 1 and stage 2 attrs.

thanks
-- PMM

The following changes since commit 08dede07030973c1053868bc64de7e10bfa02ad6:

Merge tag 'pull-ppc-20230409' of https://github.com/legoater/qemu into staging (2023-04-10 11:47:52 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230410

for you to fetch changes up to 8539dc00552e8ea60420856fc1262c8299bc6308:

target/arm: Copy guarded bit in combine_cacheattrs (2023-04-10 14:31:40 +0100)

----------------------------------------------------------------
target-arm: Fix bug where we weren't initializing
            guarded bit state when combining S1/S2 attrs

----------------------------------------------------------------
Richard Henderson (2):
      target/arm: PTE bit GP only applies to stage1
      target/arm: Copy guarded bit in combine_cacheattrs

target/arm/ptw.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Only perform the extract of GP during the stage1 walk.

Reported-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230407185149.3253946-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         result->f.attrs.secure = false;
     }
 
-    /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB.  */
-    if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
-        result->f.guarded = extract64(attrs, 50, 1); /* GP */
-    }
-
     if (regime_is_stage2(mmu_idx)) {
         result->cacheattrs.is_s2_format = true;
         result->cacheattrs.attrs = extract32(attrs, 2, 4);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         assert(attrindx <= 7);
         result->cacheattrs.is_s2_format = false;
         result->cacheattrs.attrs = extract64(mair, attrindx * 8, 8);
+
+        /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB. */
+        if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
+            result->f.guarded = extract64(attrs, 50, 1); /* GP */
+        }
     }
 
     /*
-- 
2.34.1