Series comparison

-[PULL 00/23] target-arm queue
+[PULL 00/11] target-arm queue
-The following changes since commit eae587e8e3694b1aceab23239493fb4c7e1a80f5:
+target-arm queue: two bug fixes, plus the KVM/SVE patchset,
 which is a new feature but one which was in my pre-softfreeze
 pullreq (it just had to be dropped due to an unexpected test failure.)
-  Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2021-09-13' into staging (2021-09-13 11:00:30 +0100)
+thanks
 -- PMM
 The following changes since commit b7c9a7f353c0e260519bf735ff0d4aa01e72784b:
   Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging (2019-10-31 15:57:30 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210913
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191101-1
-for you to fetch changes up to 9a2b2ecf4d25a3943918c95d2db4508b304161b5:
+for you to fetch changes up to d9ae7624b659362cb2bb2b04fee53bf50829ca56:
-  hw/arm/mps2.c: Mark internal-only I2C buses as 'full' (2021-09-13 17:09:28 +0100)
+  target/arm: Allow reading flags from FPSCR for M-profile (2019-11-01 08:49:10 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * mark MPS2/MPS3 board-internal i2c buses as 'full' so that command
+ * Support SVE in KVM guests
-   line user-created devices are not plugged into them
+ * Don't UNDEF on M-profile 'vmrs apsr_nzcv, fpscr'
- * Take an exception if PSTATE.IL is set
+ * Update hflags after boot.c modifies CPU state
  * Support an emulated ITS in the virt board
  * Add support for kudo-bmc board
  * Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
  * cadence_uart: Fix clock handling issues that prevented
    u-boot from running
 ----------------------------------------------------------------
-Bin Meng (6):
+Andrew Jones (9):
-      hw/misc: zynq_slcr: Correctly compute output clocks in the reset exit phase
+      target/arm/monitor: Introduce qmp_query_cpu_model_expansion
-      hw/char: cadence_uart: Disable transmit when input clock is disabled
+      tests: arm: Introduce cpu feature tests
-      hw/char: cadence_uart: Move clock/reset check to uart_can_receive()
+      target/arm: Allow SVE to be disabled via a CPU property
-      hw/char: cadence_uart: Convert to memop_with_attrs() ops
+      target/arm/cpu64: max cpu: Introduce sve<N> properties
-      hw/char: cadence_uart: Ignore access when unclocked or in reset for uart_{read, write}()
+      target/arm/kvm64: Add kvm_arch_get/put_sve
-      hw/char: cadence_uart: Log a guest error when device is unclocked or in reset
+      target/arm/kvm64: max cpu: Enable SVE when available
       target/arm/kvm: scratch vcpu: Preserve input kvm_vcpu_init features
       target/arm/cpu64: max cpu: Support sve properties with KVM
       target/arm/kvm: host cpu: Add support for sve<N> properties
-Chris Rauer (1):
+Christophe Lyon (1):
-      hw/arm: Add support for kudo-bmc board.
+      target/arm: Allow reading flags from FPSCR for M-profile
-Marc Zyngier (1):
+Edgar E. Iglesias (1):
-      hw/arm/virt: KVM: Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
+      hw/arm/boot: Rebuild hflags when modifying CPUState at boot
-Peter Maydell (5):
+ tests/Makefile.include         |   5 +-
-      target/arm: Take an exception if PSTATE.IL is set
+ qapi/machine-target.json       |   6 +-
-      qdev: Support marking individual buses as 'full'
+ include/qemu/bitops.h          |   1 +
-      hw/arm/mps2-tz.c: Add extra data parameter to MakeDevFn
+ target/arm/cpu.h               |  21 ++
-      hw/arm/mps2-tz.c: Mark internal-only I2C buses as 'full'
+ target/arm/kvm_arm.h           |  39 +++
-      hw/arm/mps2.c: Mark internal-only I2C buses as 'full'
+ hw/arm/boot.c                  |   1 +
  target/arm/cpu.c               |  25 +-
  target/arm/cpu64.c             | 364 +++++++++++++++++++++++++--
  target/arm/helper.c            |  10 +-
  target/arm/kvm.c               |  25 +-
  target/arm/kvm32.c             |   6 +-
  target/arm/kvm64.c             | 325 +++++++++++++++++++++---
  target/arm/monitor.c           | 158 ++++++++++++
  target/arm/translate-vfp.inc.c |   5 +-
  tests/arm-cpu-features.c       | 551 +++++++++++++++++++++++++++++++++++++++++
  docs/arm-cpu-features.rst      | 317 ++++++++++++++++++++++++
 files changed, 1795 insertions(+), 64 deletions(-)
  create mode 100644 tests/arm-cpu-features.c
  create mode 100644 docs/arm-cpu-features.rst
-Richard Henderson (1):
-      target/arm: Merge disas_a64_insn into aarch64_tr_translate_insn
-Shashi Mallela (9):
-      hw/intc: GICv3 ITS initial framework
-      hw/intc: GICv3 ITS register definitions added
-      hw/intc: GICv3 ITS command queue framework
-      hw/intc: GICv3 ITS Command processing
-      hw/intc: GICv3 ITS Feature enablement
-      hw/intc: GICv3 redistributor ITS processing
-      tests/data/acpi/virt: Add IORT files for ITS
-      hw/arm/virt: add ITS support in virt GIC
-      tests/data/acpi/virt: Update IORT files for ITS
- docs/system/arm/nuvoton.rst            |    1 +
- hw/intc/gicv3_internal.h               |  188 ++++-
- include/hw/arm/virt.h                  |    2 +
- include/hw/intc/arm_gicv3_common.h     |   13 +
- include/hw/intc/arm_gicv3_its_common.h |   32 +-
- include/hw/qdev-core.h                 |   24 +
- target/arm/cpu.h                       |    1 +
- target/arm/kvm_arm.h                   |    4 +-
- target/arm/syndrome.h                  |    5 +
- target/arm/translate.h                 |    2 +
- hw/arm/mps2-tz.c                       |   92 ++-
- hw/arm/mps2.c                          |   12 +-
- hw/arm/npcm7xx_boards.c                |   34 +
- hw/arm/virt.c                          |   29 +-
- hw/char/cadence_uart.c                 |   61 +-
- hw/intc/arm_gicv3.c                    |   14 +
- hw/intc/arm_gicv3_common.c             |   13 +
- hw/intc/arm_gicv3_cpuif.c              |    7 +-
- hw/intc/arm_gicv3_dist.c               |    5 +-
- hw/intc/arm_gicv3_its.c                | 1322 ++++++++++++++++++++++++++++++++
- hw/intc/arm_gicv3_its_common.c         |    7 +-
- hw/intc/arm_gicv3_its_kvm.c            |    2 +-
- hw/intc/arm_gicv3_redist.c             |  153 +++-
- hw/misc/zynq_slcr.c                    |   31 +-
- softmmu/qdev-monitor.c                 |    7 +-
- target/arm/helper-a64.c                |    1 +
- target/arm/helper.c                    |    8 +
- target/arm/kvm.c                       |    7 +-
- target/arm/translate-a64.c             |  255 +++---
- target/arm/translate.c                 |   21 +
- hw/intc/meson.build                    |    1 +
- tests/data/acpi/virt/IORT              |  Bin 0 -> 124 bytes
- tests/data/acpi/virt/IORT.memhp        |  Bin 0 -> 124 bytes
- tests/data/acpi/virt/IORT.numamem      |  Bin 0 -> 124 bytes
- tests/data/acpi/virt/IORT.pxb          |  Bin 0 -> 124 bytes
-files changed, 2144 insertions(+), 210 deletions(-)
- create mode 100644 hw/intc/arm_gicv3_its.c
- create mode 100644 tests/data/acpi/virt/IORT
- create mode 100644 tests/data/acpi/virt/IORT.memhp
- create mode 100644 tests/data/acpi/virt/IORT.numamem
- create mode 100644 tests/data/acpi/virt/IORT.pxb

-[PULL 01/23] hw/misc: zynq_slcr: Correctly compute output clocks in the reset exit phase
+Deleted patch
-From: Bin Meng <bmeng.cn@gmail.com>
-As of today, when booting upstream U-Boot for Xilinx Zynq, the UART
-does not receive anything. Debugging shows that the UART input clock
-frequency is zero which prevents the UART from receiving anything as
-per the logic in uart_receive().
-From zynq_slcr_reset_exit() comment, it intends to compute output
-clocks according to ps_clk and registers. zynq_slcr_compute_clocks()
-is called to accomplish the task, inside which device_is_in_reset()
-is called to actually make the attempt in vain.
-Rework reset_hold() and reset_exit() so that in the reset exit phase,
-the logic can really compute output clocks in reset_exit().
-With this change, upstream U-Boot boots properly again with:
-$ qemu-system-arm -M xilinx-zynq-a9 -m 1G -display none -serial null -serial stdio \
-    -device loader,file=u-boot-dtb.bin,addr=0x4000000,cpu-num=0
-Fixes: 38867cb7ec90 ("hw/misc/zynq_slcr: add clock generation for uarts")
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Message-id: 20210901124521.30599-2-bmeng.cn@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/misc/zynq_slcr.c | 31 ++++++++++++++++++-------------
-file changed, 18 insertions(+), 13 deletions(-)
-diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/zynq_slcr.c
-+++ b/hw/misc/zynq_slcr.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t zynq_slcr_compute_clock(const uint64_t periods[],
-     zynq_slcr_compute_clock((plls), (state)->regs[reg], \
-                             reg ## _ ## enable_field ## _SHIFT)
-+static void zynq_slcr_compute_clocks_internal(ZynqSLCRState *s, uint64_t ps_clk)
-+{
-+    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
-+    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
-+    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
-+
-+    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
-+
-+    /* compute uartX reference clocks */
-+    clock_set(s->uart0_ref_clk,
-+              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
-+    clock_set(s->uart1_ref_clk,
-+              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
-+}
-+
- /**
-  * Compute and set the ouputs clocks periods.
-  * But do not propagate them further. Connected clocks
-@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_compute_clocks(ZynqSLCRState *s)
-         ps_clk = 0;
-     }
--    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
--    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
--    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
--
--    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
--
--    /* compute uartX reference clocks */
--    clock_set(s->uart0_ref_clk,
--              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
--    clock_set(s->uart1_ref_clk,
--              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
-+    zynq_slcr_compute_clocks_internal(s, ps_clk);
- }
- /**
-@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_hold(Object *obj)
-     ZynqSLCRState *s = ZYNQ_SLCR(obj);
-     /* will disable all output clocks */
--    zynq_slcr_compute_clocks(s);
-+    zynq_slcr_compute_clocks_internal(s, 0);
-     zynq_slcr_propagate_clocks(s);
- }
-@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_exit(Object *obj)
-     ZynqSLCRState *s = ZYNQ_SLCR(obj);
-     /* will compute output clocks according to ps_clk and registers */
--    zynq_slcr_compute_clocks(s);
-+    zynq_slcr_compute_clocks_internal(s, clock_get(s->ps_clk));
-     zynq_slcr_propagate_clocks(s);
- }
---
-.20.1

-[PULL 02/23] hw/char: cadence_uart: Disable transmit when input clock is disabled
+Deleted patch
-From: Bin Meng <bmeng.cn@gmail.com>
-At present when input clock is disabled, any character transmitted
-to tx fifo can still show on the serial line, which is wrong.
-Fixes: b636db306e06 ("hw/char/cadence_uart: add clock support")
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Message-id: 20210901124521.30599-3-bmeng.cn@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/char/cadence_uart.c | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cadence_uart.c
-+++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
- static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
-                                int size)
- {
-+    /* ignore characters when unclocked or in reset */
-+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+        return;
-+    }
-+
-     if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
-         return;
-     }
---
-.20.1

-[PULL 12/23] hw/intc: GICv3 ITS Command processing
+[PULL 01/11] target/arm/monitor: Introduce qmp_query_cpu_model_expansion
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-Added ITS command queue handling for MAPTI,MAPI commands,handled ITS
+Add support for the query-cpu-model-expansion QMP command to Arm. We
-translation which triggers an LPI via INT command as well as write
+do this selectively, only exposing CPU properties which represent
-to GITS_TRANSLATER register,defined enum to differentiate between ITS
+optional CPU features which the user may want to enable/disable.
-command interrupt trigger and GITS_TRANSLATER based interrupt trigger.
+Additionally we restrict the list of queryable cpu models to 'max',
-Each of these commands make use of other functionalities implemented to
+'host', or the current type when KVM is in use. And, finally, we only
-get device table entry,collection table entry or interrupt translation
+implement expansion type 'full', as Arm does not yet have a "base"
-table entry required for their processing.
+CPU type. More details and example queries are described in a new
+document (docs/arm-cpu-features.rst).
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Note, certainly more features may be added to the list of advertised
-Message-id: 20210910143951.92242-5-shashi.mallela@linaro.org
+features, e.g. 'vfp' and 'neon'. The only requirement is that we can
 detect invalid configurations and emit failures at QMP query time.
 For 'vfp' and 'neon' this will require some refactoring to share a
 validation function between the QMP query and the CPU realize
 functions.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
 Message-id: 20191031142734.8590-2-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/gicv3_internal.h           |  12 +
+ qapi/machine-target.json  |   6 +-
- include/hw/intc/arm_gicv3_common.h |   2 +
+ target/arm/monitor.c      | 146 ++++++++++++++++++++++++++++++++++++++
- hw/intc/arm_gicv3_its.c            | 365 ++++++++++++++++++++++++++++-
+ docs/arm-cpu-features.rst | 137 +++++++++++++++++++++++++++++++++++
-files changed, 378 insertions(+), 1 deletion(-)
+files changed, 286 insertions(+), 3 deletions(-)
+ create mode 100644 docs/arm-cpu-features.rst
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
 diff --git a/qapi/machine-target.json b/qapi/machine-target.json
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/qapi/machine-target.json
-+++ b/hw/intc/gicv3_internal.h
++++ b/qapi/machine-target.json
-@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
+@@ -XXX,XX +XXX,XX @@
- #define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
+ ##
- #define SIZE_MASK                 0x1f
+ { 'struct': 'CpuModelExpansionInfo',
+   'data': { 'model': 'CpuModelInfo' },
-+/* MAPI command fields */
+-  'if': 'defined(TARGET_S390X) || defined(TARGET_I386)' }
-+#define EVENTID_MASK              ((1ULL << 32) - 1)
++  'if': 'defined(TARGET_S390X) || defined(TARGET_I386) || defined(TARGET_ARM)' }
-+
-+/* MAPTI command fields */
+ ##
-+#define pINTID_SHIFT                 32
+ # @query-cpu-model-expansion:
-+#define pINTID_MASK               MAKE_64BIT_MASK(32, 32)
+@@ -XXX,XX +XXX,XX @@
-+
+ #   query-cpu-model-expansion while using these is not advised.
- #define DEVID_SHIFT                  32
+ #
- #define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
+ # Some architectures may not support all expansion types. s390x supports
+-# "full" and "static".
-@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
++# "full" and "static". Arm only supports "full".
-  *   Values:  |  vPEID    |  ICID   |
+ #
  # Returns: a CpuModelExpansionInfo. Returns an error if expanding CPU models is
  #          not supported, if the model cannot be expanded, if the model contains
@@ -XXX,XX +XXX,XX @@
    'data': { 'type': 'CpuModelExpansionType',
              'model': 'CpuModelInfo' },
    'returns': 'CpuModelExpansionInfo',
 -  'if': 'defined(TARGET_S390X) || defined(TARGET_I386)' }
 +  'if': 'defined(TARGET_S390X) || defined(TARGET_I386) || defined(TARGET_ARM)' }
  ##
  # @CpuDefinitionInfo:
 diff --git a/target/arm/monitor.c b/target/arm/monitor.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/monitor.c
 +++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@
   */
- #define ITS_ITT_ENTRY_SIZE            0xC
-+#define ITE_ENTRY_INTTYPE_SHIFT        1
+ #include "qemu/osdep.h"
-+#define ITE_ENTRY_INTID_SHIFT          2
++#include "hw/boards.h"
-+#define ITE_ENTRY_INTID_MASK         MAKE_64BIT_MASK(2, 24)
+ #include "kvm_arm.h"
-+#define ITE_ENTRY_INTSP_SHIFT          26
++#include "qapi/error.h"
-+#define ITE_ENTRY_ICID_MASK          MAKE_64BIT_MASK(0, 16)
++#include "qapi/visitor.h"
++#include "qapi/qobject-input-visitor.h"
- /* 16 bits EventId */
++#include "qapi/qapi-commands-machine-target.h"
- #define ITS_IDBITS                   GICD_TYPER_IDBITS
+ #include "qapi/qapi-commands-misc-target.h"
-diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
++#include "qapi/qmp/qerror.h"
-index XXXXXXX..XXXXXXX 100644
++#include "qapi/qmp/qdict.h"
---- a/include/hw/intc/arm_gicv3_common.h
++#include "qom/qom-qobject.h"
-+++ b/include/hw/intc/arm_gicv3_common.h
-@@ -XXX,XX +XXX,XX @@
+ static GICCapability *gic_cap_new(int version)
- #define GICV3_MAXIRQ 1020
+ {
- #define GICV3_MAXSPI (GICV3_MAXIRQ - GIC_INTERNAL)
+@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
-+#define GICV3_LPI_INTID_START 8192
+     return head;
-+
+ }
- #define GICV3_REDIST_SIZE 0x20000
++
  /* Number of SGI target-list bits */
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its.c
 +++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
      void (*parent_reset)(DeviceState *dev);
  };
 +/*
-+ * This is an internal enum used to distinguish between LPI triggered
++ * These are cpu model features we want to advertise. The order here
-+ * via command queue and LPI triggered via gits_translater write.
++ * matters as this is the order in which qmp_query_cpu_model_expansion
 + * will attempt to set them. If there are dependencies between features,
 + * then the order that considers those dependencies must be used.
 + */
-+typedef enum ItsCmdType {
++static const char *cpu_model_advertised_features[] = {
-+    NONE = 0, /* internal indication for GITS_TRANSLATER write */
++    "aarch64", "pmu",
-+    CLEAR = 1,
++    NULL
-+    DISCARD = 2,
++};
-+    INT = 3,
++
-+} ItsCmdType;
++CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
-+
++                                                     CpuModelInfo *model,
-+typedef struct {
++                                                     Error **errp)
 +    uint32_t iteh;
 +    uint64_t itel;
 +} IteEntry;
 +
  static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
  {
      uint64_t result = 0;
@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
      return result;
  }
 +static bool get_cte(GICv3ITSState *s, uint16_t icid, uint64_t *cte,
 +                    MemTxResult *res)
 +{
-+    AddressSpace *as = &s->gicv3->dma_as;
++    CpuModelExpansionInfo *expansion_info;
-+    uint64_t l2t_addr;
++    const QDict *qdict_in = NULL;
-+    uint64_t value;
++    QDict *qdict_out;
-+    bool valid_l2t;
++    ObjectClass *oc;
-+    uint32_t l2t_id;
++    Object *obj;
-+    uint32_t max_l2_entries;
++    const char *name;
-+
++    int i;
-+    if (s->ct.indirect) {
++
-+        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
++    if (type != CPU_MODEL_EXPANSION_TYPE_FULL) {
-+
++        error_setg(errp, "The requested expansion type is not supported");
-+        value = address_space_ldq_le(as,
++        return NULL;
-+                                     s->ct.base_addr +
++    }
-+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
++
-+                                     MEMTXATTRS_UNSPECIFIED, res);
++    if (!kvm_enabled() && !strcmp(model->name, "host")) {
-+
++        error_setg(errp, "The CPU type '%s' requires KVM", model->name);
-+        if (*res == MEMTX_OK) {
++        return NULL;
-+            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
++    }
 +
-+            if (valid_l2t) {
++    oc = cpu_class_by_name(TYPE_ARM_CPU, model->name);
-+                max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
++    if (!oc) {
-+
++        error_setg(errp, "The CPU type '%s' is not a recognized ARM CPU type",
-+                l2t_addr = value & ((1ULL << 51) - 1);
++                   model->name);
-+
++        return NULL;
-+                *cte =  address_space_ldq_le(as, l2t_addr +
++    }
-+                                    ((icid % max_l2_entries) * GITS_CTE_SIZE),
++
-+                                    MEMTXATTRS_UNSPECIFIED, res);
++    if (kvm_enabled()) {
-+           }
++        const char *cpu_type = current_machine->cpu_type;
-+       }
++        int len = strlen(cpu_type) - strlen(ARM_CPU_TYPE_SUFFIX);
-+    } else {
++        bool supported = false;
-+        /* Flat level table */
++
-+        *cte =  address_space_ldq_le(as, s->ct.base_addr +
++        if (!strcmp(model->name, "host") || !strcmp(model->name, "max")) {
-+                                     (icid * GITS_CTE_SIZE),
++            /* These are kvmarm's recommended cpu types */
-+                                      MEMTXATTRS_UNSPECIFIED, res);
++            supported = true;
-+    }
++        } else if (strlen(model->name) == len &&
-+
++                   !strncmp(model->name, cpu_type, len)) {
-+    return (*cte & TABLE_ENTRY_VALID_MASK) != 0;
++            /* KVM is enabled and we're using this type, so it works. */
-+}
++            supported = true;
-+
++        }
-+static bool update_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
++        if (!supported) {
-+                       IteEntry ite)
++            error_setg(errp, "We cannot guarantee the CPU type '%s' works "
-+{
++                             "with KVM on this host", model->name);
-+    AddressSpace *as = &s->gicv3->dma_as;
++            return NULL;
-+    uint64_t itt_addr;
++        }
-+    MemTxResult res = MEMTX_OK;
++    }
 +
-+    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
++    if (model->props) {
-+    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
++        qdict_in = qobject_to(QDict, model->props);
-+
++        if (!qdict_in) {
-+    address_space_stq_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
++            error_setg(errp, QERR_INVALID_PARAMETER_TYPE, "props", "dict");
-+                         sizeof(uint32_t))), ite.itel, MEMTXATTRS_UNSPECIFIED,
++            return NULL;
-+                         &res);
++        }
-+
++    }
-+    if (res == MEMTX_OK) {
++
-+        address_space_stl_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
++    obj = object_new(object_class_get_name(oc));
-+                             sizeof(uint32_t))) + sizeof(uint32_t), ite.iteh,
++
-+                             MEMTXATTRS_UNSPECIFIED, &res);
++    if (qdict_in) {
-+    }
++        Visitor *visitor;
-+    if (res != MEMTX_OK) {
++        Error *err = NULL;
-+        return false;
++
-+    } else {
++        visitor = qobject_input_visitor_new(model->props);
-+        return true;
++        visit_start_struct(visitor, NULL, NULL, 0, &err);
-+    }
++        if (err) {
-+}
++            visit_free(visitor);
-+
++            object_unref(obj);
-+static bool get_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
++            error_propagate(errp, err);
-+                    uint16_t *icid, uint32_t *pIntid, MemTxResult *res)
++            return NULL;
-+{
++        }
-+    AddressSpace *as = &s->gicv3->dma_as;
++
-+    uint64_t itt_addr;
++        i = 0;
-+    bool status = false;
++        while ((name = cpu_model_advertised_features[i++]) != NULL) {
-+    IteEntry ite = {};
++            if (qdict_get(qdict_in, name)) {
-+
++                object_property_set(obj, visitor, name, &err);
-+    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
++                if (err) {
-+    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
++                    break;
 +
 +    ite.itel = address_space_ldq_le(as, itt_addr +
 +                                    (eventid * (sizeof(uint64_t) +
 +                                    sizeof(uint32_t))), MEMTXATTRS_UNSPECIFIED,
 +                                    res);
 +
 +    if (*res == MEMTX_OK) {
 +        ite.iteh = address_space_ldl_le(as, itt_addr +
 +                                        (eventid * (sizeof(uint64_t) +
 +                                        sizeof(uint32_t))) + sizeof(uint32_t),
 +                                        MEMTXATTRS_UNSPECIFIED, res);
 +
 +        if (*res == MEMTX_OK) {
 +            if (ite.itel & TABLE_ENTRY_VALID_MASK) {
 +                if ((ite.itel >> ITE_ENTRY_INTTYPE_SHIFT) &
 +                    GITS_TYPE_PHYSICAL) {
 +                    *pIntid = (ite.itel & ITE_ENTRY_INTID_MASK) >>
 +                               ITE_ENTRY_INTID_SHIFT;
 +                    *icid = ite.iteh & ITE_ENTRY_ICID_MASK;
 +                    status = true;
 +                }
 +            }
 +        }
-+    }
++
-+    return status;
++        if (!err) {
 +            visit_check_struct(visitor, &err);
 +        }
 +        visit_end_struct(visitor, NULL);
 +        visit_free(visitor);
 +        if (err) {
 +            object_unref(obj);
 +            error_propagate(errp, err);
 +            return NULL;
 +        }
 +    }
 +
 +    expansion_info = g_new0(CpuModelExpansionInfo, 1);
 +    expansion_info->model = g_malloc0(sizeof(*expansion_info->model));
 +    expansion_info->model->name = g_strdup(model->name);
 +
 +    qdict_out = qdict_new();
 +
 +    i = 0;
 +    while ((name = cpu_model_advertised_features[i++]) != NULL) {
 +        ObjectProperty *prop = object_property_find(obj, name, NULL);
 +        if (prop) {
 +            Error *err = NULL;
 +            QObject *value;
 +
 +            assert(prop->get);
 +            value = object_property_get_qobject(obj, name, &err);
 +            assert(!err);
 +
 +            qdict_put_obj(qdict_out, name, value);
 +        }
 +    }
 +
 +    if (!qdict_size(qdict_out)) {
 +        qobject_unref(qdict_out);
 +    } else {
 +        expansion_info->model->props = QOBJECT(qdict_out);
 +        expansion_info->model->has_props = true;
 +    }
 +
 +    object_unref(obj);
 +
 +    return expansion_info;
 +}
-+
+diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
-+static uint64_t get_dte(GICv3ITSState *s, uint32_t devid, MemTxResult *res)
+new file mode 100644
-+{
+index XXXXXXX..XXXXXXX
-+    AddressSpace *as = &s->gicv3->dma_as;
+--- /dev/null
-+    uint64_t l2t_addr;
++++ b/docs/arm-cpu-features.rst
-+    uint64_t value;
+@@ -XXX,XX +XXX,XX @@
-+    bool valid_l2t;
++================
-+    uint32_t l2t_id;
++ARM CPU Features
-+    uint32_t max_l2_entries;
++================
 +
-+    if (s->dt.indirect) {
++Examples of probing and using ARM CPU features
-+        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
++
-+
++Introduction
-+        value = address_space_ldq_le(as,
++============
-+                                     s->dt.base_addr +
++
-+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
++CPU features are optional features that a CPU of supporting type may
-+                                     MEMTXATTRS_UNSPECIFIED, res);
++choose to implement or not.  In QEMU, optional CPU features have
-+
++corresponding boolean CPU proprieties that, when enabled, indicate
-+        if (*res == MEMTX_OK) {
++that the feature is implemented, and, conversely, when disabled,
-+            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
++indicate that it is not implemented. An example of an ARM CPU feature
-+
++is the Performance Monitoring Unit (PMU).  CPU types such as the
-+            if (valid_l2t) {
++Cortex-A15 and the Cortex-A57, which respectively implement ARM
-+                max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
++architecture reference manuals ARMv7-A and ARMv8-A, may both optionally
-+
++implement PMUs.  For example, if a user wants to use a Cortex-A15 without
-+                l2t_addr = value & ((1ULL << 51) - 1);
++a PMU, then the `-cpu` parameter should contain `pmu=off` on the QEMU
-+
++command line, i.e. `-cpu cortex-a15,pmu=off`.
-+                value =  address_space_ldq_le(as, l2t_addr +
++
-+                                   ((devid % max_l2_entries) * GITS_DTE_SIZE),
++As not all CPU types support all optional CPU features, then whether or
-+                                   MEMTXATTRS_UNSPECIFIED, res);
++not a CPU property exists depends on the CPU type.  For example, CPUs
-+            }
++that implement the ARMv8-A architecture reference manual may optionally
-+        }
++support the AArch32 CPU feature, which may be enabled by disabling the
-+    } else {
++`aarch64` CPU property.  A CPU type such as the Cortex-A15, which does
-+        /* Flat level table */
++not implement ARMv8-A, will not have the `aarch64` CPU property.
-+        value = address_space_ldq_le(as, s->dt.base_addr +
++
-+                                     (devid * GITS_DTE_SIZE),
++QEMU's support may be limited for some CPU features, only partially
-+                                     MEMTXATTRS_UNSPECIFIED, res);
++supporting the feature or only supporting the feature under certain
-+    }
++configurations.  For example, the `aarch64` CPU feature, which, when
-+
++disabled, enables the optional AArch32 CPU feature, is only supported
-+    return value;
++when using the KVM accelerator and when running on a host CPU type that
-+}
++supports the feature.
 +
-+/*
++CPU Feature Probing
-+ * This function handles the processing of following commands based on
++===================
-+ * the ItsCmdType parameter passed:-
++
-+ * 1. triggering of lpi interrupt translation via ITS INT command
++Determining which CPU features are available and functional for a given
-+ * 2. triggering of lpi interrupt translation via gits_translater register
++CPU type is possible with the `query-cpu-model-expansion` QMP command.
-+ * 3. handling of ITS CLEAR command
++Below are some examples where `scripts/qmp/qmp-shell` (see the top comment
-+ * 4. handling of ITS DISCARD command
++block in the script for usage) is used to issue the QMP commands.
-+ */
++
-+static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
++(1) Determine which CPU features are available for the `max` CPU type
-+                            ItsCmdType cmd)
++    (Note, we started QEMU with qemu-system-aarch64, so `max` is
-+{
++     implementing the ARMv8-A reference manual in this case)::
-+    AddressSpace *as = &s->gicv3->dma_as;
++
-+    uint32_t devid, eventid;
++      (QEMU) query-cpu-model-expansion type=full model={"name":"max"}
-+    MemTxResult res = MEMTX_OK;
++      { "return": {
-+    bool dte_valid;
++        "model": { "name": "max", "props": {
-+    uint64_t dte = 0;
++        "pmu": true, "aarch64": true
-+    uint32_t max_eventid;
++      }}}}
-+    uint16_t icid = 0;
++
-+    uint32_t pIntid = 0;
++We see that the `max` CPU type has the `pmu` and `aarch64` CPU features.
-+    bool ite_valid = false;
++We also see that the CPU features are enabled, as they are all `true`.
-+    uint64_t cte = 0;
++
-+    bool cte_valid = false;
++(2) Let's try to disable the PMU::
-+    bool result = false;
++
-+
++      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"pmu":false}}
-+    if (cmd == NONE) {
++      { "return": {
-+        devid = offset;
++        "model": { "name": "max", "props": {
-+    } else {
++        "pmu": false, "aarch64": true
-+        devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
++      }}}}
 +
-+        offset += NUM_BYTES_IN_DW;
++We see it worked, as `pmu` is now `false`.
-+        value = address_space_ldq_le(as, s->cq.base_addr + offset,
++
-+                                     MEMTXATTRS_UNSPECIFIED, &res);
++(3) Let's try to disable `aarch64`, which enables the AArch32 CPU feature::
-+    }
++
-+
++      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"aarch64":false}}
-+    if (res != MEMTX_OK) {
++      {"error": {
-+        return result;
++       "class": "GenericError", "desc":
-+    }
++       "'aarch64' feature cannot be disabled unless KVM is enabled and 32-bit EL1 is supported"
-+
++      }}
-+    eventid = (value & EVENTID_MASK);
++
-+
++It looks like this feature is limited to a configuration we do not
-+    dte = get_dte(s, devid, &res);
++currently have.
 +
-+    if (res != MEMTX_OK) {
++(4) Let's try probing CPU features for the Cortex-A15 CPU type::
-+        return result;
++
-+    }
++      (QEMU) query-cpu-model-expansion type=full model={"name":"cortex-a15"}
-+    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
++      {"return": {"model": {"name": "cortex-a15", "props": {"pmu": true}}}}
 +
-+    if (dte_valid) {
++Only the `pmu` CPU feature is available.
-+        max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
++
-+
++A note about CPU feature dependencies
-+        ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
++-------------------------------------
 +
-+        if (res != MEMTX_OK) {
++It's possible for features to have dependencies on other features. I.e.
-+            return result;
++it may be possible to change one feature at a time without error, but
-+        }
++when attempting to change all features at once an error could occur
-+
++depending on the order they are processed.  It's also possible changing
-+        if (ite_valid) {
++all at once doesn't generate an error, because a feature's dependencies
-+            cte_valid = get_cte(s, icid, &cte, &res);
++are satisfied with other features, but the same feature cannot be changed
-+        }
++independently without error.  For these reasons callers should always
-+
++attempt to make their desired changes all at once in order to ensure the
-+        if (res != MEMTX_OK) {
++collection is valid.
-+            return result;
++
-+        }
++A note about CPU models and KVM
-+    }
++-------------------------------
 +
-+    if ((devid > s->dt.maxids.max_devids) || !dte_valid || !ite_valid ||
++Named CPU models generally do not work with KVM.  There are a few cases
-+            !cte_valid || (eventid > max_eventid)) {
++that do work, e.g. using the named CPU model `cortex-a57` with KVM on a
-+        qemu_log_mask(LOG_GUEST_ERROR,
++seattle host, but mostly if KVM is enabled the `host` CPU type must be
-+                      "%s: invalid command attributes "
++used.  This means the guest is provided all the same CPU features as the
-+                      "devid %d or eventid %d or invalid dte %d or"
++host CPU type has.  And, for this reason, the `host` CPU type should
-+                      "invalid cte %d or invalid ite %d\n",
++enable all CPU features that the host has by default.  Indeed it's even
-+                      __func__, devid, eventid, dte_valid, cte_valid,
++a bit strange to allow disabling CPU features that the host has when using
-+                      ite_valid);
++the `host` CPU type, but in the absence of CPU models it's the best we can
-+        /*
++do if we want to launch guests without all the host's CPU features enabled.
-+         * in this implementation, in case of error
++
-+         * we ignore this command and move onto the next
++Enabling KVM also affects the `query-cpu-model-expansion` QMP command.  The
-+         * command in the queue
++affect is not only limited to specific features, as pointed out in example
-+         */
++(3) of "CPU Feature Probing", but also to which CPU types may be expanded.
-+    } else {
++When KVM is enabled, only the `max`, `host`, and current CPU type may be
-+        /*
++expanded.  This restriction is necessary as it's not possible to know all
-+         * Current implementation only supports rdbase == procnum
++CPU types that may work with KVM, but it does impose a small risk of users
-+         * Hence rdbase physical address is ignored
++experiencing unexpected errors.  For example on a seattle, as mentioned
-+         */
++above, the `cortex-a57` CPU type is also valid when KVM is enabled.
-+        if (cmd == DISCARD) {
++Therefore a user could use the `host` CPU type for the current type, but
-+            IteEntry ite = {};
++then attempt to query `cortex-a57`, however that query will fail with our
-+            /* remove mapping from interrupt translation table */
++restrictions.  This shouldn't be an issue though as management layers and
-+            result = update_ite(s, eventid, dte, ite);
++users have been preferring the `host` CPU type for use with KVM for quite
-+        }
++some time.  Additionally, if the KVM-enabled QEMU instance running on a
-+    }
++seattle host is using the `cortex-a57` CPU type, then querying `cortex-a57`
-+
++will work.
-+    return result;
++
-+}
++Using CPU Features
-+
++==================
-+static bool process_mapti(GICv3ITSState *s, uint64_t value, uint32_t offset,
++
-+                          bool ignore_pInt)
++After determining which CPU features are available and supported for a
-+{
++given CPU type, then they may be selectively enabled or disabled on the
-+    AddressSpace *as = &s->gicv3->dma_as;
++QEMU command line with that CPU type::
-+    uint32_t devid, eventid;
++
-+    uint32_t pIntid = 0;
++  $ qemu-system-aarch64 -M virt -cpu max,pmu=off
-+    uint32_t max_eventid, max_Intid;
++
-+    bool dte_valid;
++The example above disables the PMU for the `max` CPU type.
-+    MemTxResult res = MEMTX_OK;
++
 +    uint16_t icid = 0;
 +    uint64_t dte = 0;
 +    IteEntry ite;
 +    uint32_t int_spurious = INTID_SPURIOUS;
 +    bool result = false;
 +
 +    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    eventid = (value & EVENTID_MASK);
 +
 +    if (!ignore_pInt) {
 +        pIntid = ((value & pINTID_MASK) >> pINTID_SHIFT);
 +    }
 +
 +    offset += NUM_BYTES_IN_DW;
 +    value = address_space_ldq_le(as, s->cq.base_addr + offset,
 +                                 MEMTXATTRS_UNSPECIFIED, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +
 +    icid = value & ICID_MASK;
 +
 +    dte = get_dte(s, devid, &res);
 +
 +    if (res != MEMTX_OK) {
 +        return result;
 +    }
 +    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
 +
 +    max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
 +
 +    if (!ignore_pInt) {
 +        max_Intid = (1ULL << (GICD_TYPER_IDBITS + 1)) - 1;
 +    }
 +
 +    if ((devid > s->dt.maxids.max_devids) || (icid > s->ct.maxids.max_collids)
 +            || !dte_valid || (eventid > max_eventid) ||
 +            (!ignore_pInt && (((pIntid < GICV3_LPI_INTID_START) ||
 +            (pIntid > max_Intid)) && (pIntid != INTID_SPURIOUS)))) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid command attributes "
 +                      "devid %d or icid %d or eventid %d or pIntid %d or"
 +                      "unmapped dte %d\n", __func__, devid, icid, eventid,
 +                      pIntid, dte_valid);
 +        /*
 +         * in this implementation, in case of error
 +         * we ignore this command and move onto the next
 +         * command in the queue
 +         */
 +    } else {
 +        /* add ite entry to interrupt translation table */
 +        ite.itel = (dte_valid & TABLE_ENTRY_VALID_MASK) |
 +                    (GITS_TYPE_PHYSICAL << ITE_ENTRY_INTTYPE_SHIFT);
 +
 +        if (ignore_pInt) {
 +            ite.itel |= (eventid << ITE_ENTRY_INTID_SHIFT);
 +        } else {
 +            ite.itel |= (pIntid << ITE_ENTRY_INTID_SHIFT);
 +        }
 +        ite.itel |= (int_spurious << ITE_ENTRY_INTSP_SHIFT);
 +        ite.iteh = icid;
 +
 +        result = update_ite(s, eventid, dte, ite);
 +    }
 +
 +    return result;
 +}
 +
  static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
                         uint64_t rdbase)
  {
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
          switch (cmd) {
          case GITS_CMD_INT:
 +            res = process_its_cmd(s, data, cq_offset, INT);
              break;
          case GITS_CMD_CLEAR:
 +            res = process_its_cmd(s, data, cq_offset, CLEAR);
              break;
          case GITS_CMD_SYNC:
              /*
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
              result = process_mapc(s, cq_offset);
              break;
          case GITS_CMD_MAPTI:
 +            result = process_mapti(s, data, cq_offset, false);
              break;
          case GITS_CMD_MAPI:
 +            result = process_mapti(s, data, cq_offset, true);
              break;
          case GITS_CMD_DISCARD:
 +            result = process_its_cmd(s, data, cq_offset, DISCARD);
              break;
          case GITS_CMD_INV:
          case GITS_CMD_INVALL:
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
                                                 uint64_t data, unsigned size,
                                                 MemTxAttrs attrs)
  {
 -    return MEMTX_OK;
 +    GICv3ITSState *s = (GICv3ITSState *)opaque;
 +    bool result = true;
 +    uint32_t devid = 0;
 +
 +    switch (offset) {
 +    case GITS_TRANSLATER:
 +        if (s->ctlr & ITS_CTLR_ENABLED) {
 +            devid = attrs.requester_id;
 +            result = process_its_cmd(s, data, devid, NONE);
 +        }
 +        break;
 +    default:
 +        break;
 +    }
 +
 +    if (result) {
 +        return MEMTX_OK;
 +    } else {
 +        return MEMTX_ERROR;
 +    }
  }
  static bool its_writel(GICv3ITSState *s, hwaddr offset,
 --
 .20.1

-[PULL 09/23] hw/intc: GICv3 ITS initial framework
+[PULL 02/11] tests: arm: Introduce cpu feature tests
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-Added register definitions relevant to ITS,implemented overall
+Now that Arm CPUs have advertised features lets add tests to ensure
-ITS device framework with stubs for ITS control and translater
+we maintain their expected availability with and without KVM.
-regions read/write,extended ITS common to handle mmio init between
-existing kvm device and newer qemu device.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
 Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Neil Armstrong <narmstrong@baylibre.com>
+Message-id: 20191031142734.8590-3-drjones@redhat.com
 Message-id: 20210910143951.92242-2-shashi.mallela@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/gicv3_internal.h               |  96 +++++++++-
+ tests/Makefile.include   |   5 +-
- include/hw/intc/arm_gicv3_its_common.h |   9 +-
+ tests/arm-cpu-features.c | 253 +++++++++++++++++++++++++++++++++++++++
- hw/intc/arm_gicv3_its.c                | 241 +++++++++++++++++++++++++
+files changed, 257 insertions(+), 1 deletion(-)
- hw/intc/arm_gicv3_its_common.c         |   7 +-
+ create mode 100644 tests/arm-cpu-features.c
- hw/intc/arm_gicv3_its_kvm.c            |   2 +-
- hw/intc/meson.build                    |   1 +
+diff --git a/tests/Makefile.include b/tests/Makefile.include
 files changed, 342 insertions(+), 14 deletions(-)
  create mode 100644 hw/intc/arm_gicv3_its.c
 diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/tests/Makefile.include
-+++ b/hw/intc/gicv3_internal.h
++++ b/tests/Makefile.include
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ check-qtest-sparc64-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
- #ifndef QEMU_ARM_GICV3_INTERNAL_H
+ check-qtest-sparc64-y += tests/prom-env-test$(EXESUF)
- #define QEMU_ARM_GICV3_INTERNAL_H
+ check-qtest-sparc64-y += tests/boot-serial-test$(EXESUF)
-+#include "hw/registerfields.h"
++check-qtest-arm-y += tests/arm-cpu-features$(EXESUF)
- #include "hw/intc/arm_gicv3_common.h"
+ check-qtest-arm-y += tests/microbit-test$(EXESUF)
+ check-qtest-arm-y += tests/m25p80-test$(EXESUF)
- /* Distributor registers, as offsets from the distributor base address */
+ check-qtest-arm-y += tests/test-arm-mptimer$(EXESUF)
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ check-qtest-arm-y += tests/boot-serial-test$(EXESUF)
- #define GICD_CTLR_E1NWF             (1U << 7)
+ check-qtest-arm-y += tests/hexloader-test$(EXESUF)
- #define GICD_CTLR_RWP               (1U << 31)
+ check-qtest-arm-$(CONFIG_PFLASH_CFI02) += tests/pflash-cfi02-test$(EXESUF)
-+/* 16 bits EventId */
+-check-qtest-aarch64-y = tests/numa-test$(EXESUF)
-+#define GICD_TYPER_IDBITS            0xf
++check-qtest-aarch64-y += tests/arm-cpu-features$(EXESUF)
-+
++check-qtest-aarch64-y += tests/numa-test$(EXESUF)
- /*
+ check-qtest-aarch64-y += tests/boot-serial-test$(EXESUF)
-  * Redistributor frame offsets from RD_base
+ check-qtest-aarch64-y += tests/migration-test$(EXESUF)
-  */
+ # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make test unconditional
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ tests/test-qapi-util$(EXESUF): tests/test-qapi-util.o $(test-util-obj-y)
- #define GICR_WAKER_ProcessorSleep    (1U << 1)
+ tests/numa-test$(EXESUF): tests/numa-test.o
- #define GICR_WAKER_ChildrenAsleep    (1U << 2)
+ tests/vmgenid-test$(EXESUF): tests/vmgenid-test.o tests/boot-sector.o tests/acpi-utils.o
+ tests/cdrom-test$(EXESUF): tests/cdrom-test.o tests/boot-sector.o $(libqos-obj-y)
--#define GICR_PROPBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
++tests/arm-cpu-features$(EXESUF): tests/arm-cpu-features.o
--#define GICR_PROPBASER_ADDR_MASK               (0xfffffffffULL << 12)
--#define GICR_PROPBASER_SHAREABILITY_MASK       (3U << 10)
+ tests/migration/stress$(EXESUF): tests/migration/stress.o
--#define GICR_PROPBASER_CACHEABILITY_MASK       (7U << 7)
+     $(call quiet-command, $(LINKPROG) -static -O3 $(PTHREAD_LIB) -o $@ $< ,"LINK","$(TARGET_DIR)$@")
--#define GICR_PROPBASER_IDBITS_MASK             (0x1f)
+diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
 +FIELD(GICR_PROPBASER, IDBITS, 0, 5)
 +FIELD(GICR_PROPBASER, INNERCACHE, 7, 3)
 +FIELD(GICR_PROPBASER, SHAREABILITY, 10, 2)
 +FIELD(GICR_PROPBASER, PHYADDR, 12, 40)
 +FIELD(GICR_PROPBASER, OUTERCACHE, 56, 3)
 -#define GICR_PENDBASER_PTZ                     (1ULL << 62)
 -#define GICR_PENDBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
 -#define GICR_PENDBASER_ADDR_MASK               (0xffffffffULL << 16)
 -#define GICR_PENDBASER_SHAREABILITY_MASK       (3U << 10)
 -#define GICR_PENDBASER_CACHEABILITY_MASK       (7U << 7)
 +FIELD(GICR_PENDBASER, INNERCACHE, 7, 3)
 +FIELD(GICR_PENDBASER, SHAREABILITY, 10, 2)
 +FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
 +FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
 +FIELD(GICR_PENDBASER, PTZ, 62, 1)
  #define ICC_CTLR_EL1_CBPR           (1U << 0)
  #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
@@ -XXX,XX +XXX,XX @@
  #define ICH_VTR_EL2_PREBITS_SHIFT 26
  #define ICH_VTR_EL2_PRIBITS_SHIFT 29
 +/* ITS Registers */
 +
 +FIELD(GITS_BASER, SIZE, 0, 8)
 +FIELD(GITS_BASER, PAGESIZE, 8, 2)
 +FIELD(GITS_BASER, SHAREABILITY, 10, 2)
 +FIELD(GITS_BASER, PHYADDR, 12, 36)
 +FIELD(GITS_BASER, PHYADDRL_64K, 16, 32)
 +FIELD(GITS_BASER, PHYADDRH_64K, 12, 4)
 +FIELD(GITS_BASER, ENTRYSIZE, 48, 5)
 +FIELD(GITS_BASER, OUTERCACHE, 53, 3)
 +FIELD(GITS_BASER, TYPE, 56, 3)
 +FIELD(GITS_BASER, INNERCACHE, 59, 3)
 +FIELD(GITS_BASER, INDIRECT, 62, 1)
 +FIELD(GITS_BASER, VALID, 63, 1)
 +
 +FIELD(GITS_CTLR, QUIESCENT, 31, 1)
 +
 +FIELD(GITS_TYPER, PHYSICAL, 0, 1)
 +FIELD(GITS_TYPER, ITT_ENTRY_SIZE, 4, 4)
 +FIELD(GITS_TYPER, IDBITS, 8, 5)
 +FIELD(GITS_TYPER, DEVBITS, 13, 5)
 +FIELD(GITS_TYPER, SEIS, 18, 1)
 +FIELD(GITS_TYPER, PTA, 19, 1)
 +FIELD(GITS_TYPER, CIDBITS, 32, 4)
 +FIELD(GITS_TYPER, CIL, 36, 1)
 +
 +#define GITS_BASER_PAGESIZE_4K                0
 +#define GITS_BASER_PAGESIZE_16K               1
 +#define GITS_BASER_PAGESIZE_64K               2
 +
 +#define GITS_BASER_TYPE_DEVICE               1ULL
 +#define GITS_BASER_TYPE_COLLECTION           4ULL
 +
 +/**
 + * Default features advertised by this version of ITS
 + */
 +/* Physical LPIs supported */
 +#define GITS_TYPE_PHYSICAL           (1U << 0)
 +
 +/*
 + * 12 bytes Interrupt translation Table Entry size
 + * as per Table 5.3 in GICv3 spec
 + * ITE Lower 8 Bytes
 + *   Bits:    | 49 ... 26 | 25 ... 2 |   1     |   0    |
 + *   Values:  |    1023   |  IntNum  | IntType |  Valid |
 + * ITE Higher 4 Bytes
 + *   Bits:    | 31 ... 16 | 15 ...0 |
 + *   Values:  |  vPEID    |  ICID   |
 + */
 +#define ITS_ITT_ENTRY_SIZE            0xC
 +
 +/* 16 bits EventId */
 +#define ITS_IDBITS                   GICD_TYPER_IDBITS
 +
 +/* 16 bits DeviceId */
 +#define ITS_DEVBITS                   0xF
 +
 +/* 16 bits CollectionId */
 +#define ITS_CIDBITS                  0xF
 +
 +/*
 + * 8 bytes Device Table Entry size
 + * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
 + */
 +#define GITS_DTE_SIZE                 (0x8ULL)
 +
 +/*
 + * 8 bytes Collection Table Entry size
 + * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
 + */
 +#define GITS_CTE_SIZE                 (0x8ULL)
 +
  /* Special interrupt IDs */
  #define INTID_SECURE 1020
  #define INTID_NONSECURE 1021
 diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gicv3_its_common.h
 +++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/intc/arm_gicv3_common.h"
  #include "qom/object.h"
 +#define TYPE_ARM_GICV3_ITS "arm-gicv3-its"
 +
  #define ITS_CONTROL_SIZE 0x10000
  #define ITS_TRANS_SIZE   0x10000
  #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
  #define GITS_CTLR        0x0
  #define GITS_IIDR        0x4
 +#define GITS_TYPER       0x8
  #define GITS_CBASER      0x80
  #define GITS_CWRITER     0x88
  #define GITS_CREADR      0x90
  #define GITS_BASER       0x100
 +#define GITS_TRANSLATER  0x0040
 +
  struct GICv3ITSState {
      SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
      /* Registers */
      uint32_t ctlr;
      uint32_t iidr;
 +    uint64_t typer;
      uint64_t cbaser;
      uint64_t cwriter;
      uint64_t creadr;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
  typedef struct GICv3ITSState GICv3ITSState;
 -void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops);
 +void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
 +                   const MemoryRegionOps *tops);
  #define TYPE_ARM_GICV3_ITS_COMMON "arm-gicv3-its-common"
  typedef struct GICv3ITSCommonClass GICv3ITSCommonClass;
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/tests/arm-cpu-features.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * ITS emulation for a GICv3-based system
++ * Arm CPU feature test cases
 + *
-+ * Copyright Linaro.org 2021
++ * Copyright (c) 2019 Red Hat Inc.
 + * Authors:
 + *  Andrew Jones <drjones@redhat.com>
 + *
-+ * Authors:
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ *  Shashi Mallela <shashi.mallela@linaro.org>
++ * See the COPYING file in the top-level directory.
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or (at your
 + * option) any later version.  See the COPYING file in the top-level directory.
 + *
 + */
-+
 +#include "qemu/osdep.h"
-+#include "qemu/log.h"
++#include "libqtest.h"
-+#include "hw/qdev-properties.h"
++#include "qapi/qmp/qdict.h"
-+#include "hw/intc/arm_gicv3_its_common.h"
++#include "qapi/qmp/qjson.h"
-+#include "gicv3_internal.h"
++
-+#include "qom/object.h"
++#define MACHINE     "-machine virt,gic-version=max,accel=tcg "
-+#include "qapi/error.h"
++#define MACHINE_KVM "-machine virt,gic-version=max,accel=kvm:tcg "
-+
++#define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
-+typedef struct GICv3ITSClass GICv3ITSClass;
++                    "  'arguments': { 'type': 'full', "
-+/* This is reusing the GICv3ITSState typedef from ARM_GICV3_ITS_COMMON */
++#define QUERY_TAIL  "}}"
-+DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSClass,
++
-+                     ARM_GICV3_ITS, TYPE_ARM_GICV3_ITS)
++static bool kvm_enabled(QTestState *qts)
-+
++{
-+struct GICv3ITSClass {
++    QDict *resp, *qdict;
-+    GICv3ITSCommonClass parent_class;
++    bool enabled;
-+    void (*parent_reset)(DeviceState *dev);
++
-+};
++    resp = qtest_qmp(qts, "{ 'execute': 'query-kvm' }");
-+
++    g_assert(qdict_haskey(resp, "return"));
-+static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
++    qdict = qdict_get_qdict(resp, "return");
-+                                               uint64_t data, unsigned size,
++    g_assert(qdict_haskey(qdict, "enabled"));
-+                                               MemTxAttrs attrs)
++    enabled = qdict_get_bool(qdict, "enabled");
-+{
++    qobject_unref(resp);
-+    return MEMTX_OK;
++
-+}
++    return enabled;
-+
++}
-+static bool its_writel(GICv3ITSState *s, hwaddr offset,
++
-+                              uint64_t value, MemTxAttrs attrs)
++static QDict *do_query_no_props(QTestState *qts, const char *cpu_type)
 +{
-+    bool result = true;
++    return qtest_qmp(qts, QUERY_HEAD "'model': { 'name': %s }"
-+
++                          QUERY_TAIL, cpu_type);
-+    return result;
++}
-+}
++
-+
++static QDict *do_query(QTestState *qts, const char *cpu_type,
-+static bool its_readl(GICv3ITSState *s, hwaddr offset,
++                       const char *fmt, ...)
-+                             uint64_t *data, MemTxAttrs attrs)
++{
-+{
++    QDict *resp;
-+    bool result = true;
++
-+
++    if (fmt) {
-+    return result;
++        QDict *args;
-+}
++        va_list ap;
 +
-+static bool its_writell(GICv3ITSState *s, hwaddr offset,
++        va_start(ap, fmt);
-+                               uint64_t value, MemTxAttrs attrs)
++        args = qdict_from_vjsonf_nofail(fmt, ap);
-+{
++        va_end(ap);
-+    bool result = true;
++
-+
++        resp = qtest_qmp(qts, QUERY_HEAD "'model': { 'name': %s, "
-+    return result;
++                                                    "'props': %p }"
-+}
++                              QUERY_TAIL, cpu_type, args);
-+
++    } else {
-+static bool its_readll(GICv3ITSState *s, hwaddr offset,
++        resp = do_query_no_props(qts, cpu_type);
-+                              uint64_t *data, MemTxAttrs attrs)
++    }
-+{
++
-+    bool result = true;
++    return resp;
-+
++}
-+    return result;
++
-+}
++static const char *resp_get_error(QDict *resp)
-+
++{
-+static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
++    QDict *qdict;
-+                                  unsigned size, MemTxAttrs attrs)
++
-+{
++    g_assert(resp);
-+    GICv3ITSState *s = (GICv3ITSState *)opaque;
++
-+    bool result;
++    qdict = qdict_get_qdict(resp, "error");
-+
++    if (qdict) {
-+    switch (size) {
++        return qdict_get_str(qdict, "desc");
-+    case 4:
++    }
-+        result = its_readl(s, offset, data, attrs);
++
-+        break;
++    return NULL;
-+    case 8:
++}
-+        result = its_readll(s, offset, data, attrs);
++
-+        break;
++#define assert_error(qts, cpu_type, expected_error, fmt, ...)          \
-+    default:
++({                                                                     \
-+        result = false;
++    QDict *_resp;                                                      \
-+        break;
++    const char *_error;                                                \
-+    }
++                                                                       \
-+
++    _resp = do_query(qts, cpu_type, fmt, ##__VA_ARGS__);               \
-+    if (!result) {
++    g_assert(_resp);                                                   \
-+        qemu_log_mask(LOG_GUEST_ERROR,
++    _error = resp_get_error(_resp);                                    \
-+                      "%s: invalid guest read at offset " TARGET_FMT_plx
++    g_assert(_error);                                                  \
-+                      "size %u\n", __func__, offset, size);
++    g_assert(g_str_equal(_error, expected_error));                     \
-+        /*
++    qobject_unref(_resp);                                              \
-+         * The spec requires that reserved registers are RAZ/WI;
++})
-+         * so use false returns from leaf functions as a way to
++
-+         * trigger the guest-error logging but don't return it to
++static bool resp_has_props(QDict *resp)
-+         * the caller, or we'll cause a spurious guest data abort.
++{
-+         */
++    QDict *qdict;
-+        *data = 0;
++
-+    }
++    g_assert(resp);
-+    return MEMTX_OK;
++
-+}
++    if (!qdict_haskey(resp, "return")) {
-+
++        return false;
-+static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data,
++    }
-+                                   unsigned size, MemTxAttrs attrs)
++    qdict = qdict_get_qdict(resp, "return");
-+{
++
-+    GICv3ITSState *s = (GICv3ITSState *)opaque;
++    if (!qdict_haskey(qdict, "model")) {
-+    bool result;
++        return false;
-+
++    }
-+    switch (size) {
++    qdict = qdict_get_qdict(qdict, "model");
-+    case 4:
++
-+        result = its_writel(s, offset, data, attrs);
++    return qdict_haskey(qdict, "props");
-+        break;
++}
-+    case 8:
++
-+        result = its_writell(s, offset, data, attrs);
++static QDict *resp_get_props(QDict *resp)
-+        break;
++{
-+    default:
++    QDict *qdict;
-+        result = false;
++
-+        break;
++    g_assert(resp);
-+    }
++    g_assert(resp_has_props(resp));
 +
-+    if (!result) {
++    qdict = qdict_get_qdict(resp, "return");
-+        qemu_log_mask(LOG_GUEST_ERROR,
++    qdict = qdict_get_qdict(qdict, "model");
-+                      "%s: invalid guest write at offset " TARGET_FMT_plx
++    qdict = qdict_get_qdict(qdict, "props");
-+                      "size %u\n", __func__, offset, size);
++
-+        /*
++    return qdict;
-+         * The spec requires that reserved registers are RAZ/WI;
++}
-+         * so use false returns from leaf functions as a way to
++
-+         * trigger the guest-error logging but don't return it to
++#define assert_has_feature(qts, cpu_type, feature)                     \
-+         * the caller, or we'll cause a spurious guest data abort.
++({                                                                     \
-+         */
++    QDict *_resp = do_query_no_props(qts, cpu_type);                   \
-+    }
++    g_assert(_resp);                                                   \
-+    return MEMTX_OK;
++    g_assert(resp_has_props(_resp));                                   \
-+}
++    g_assert(qdict_get(resp_get_props(_resp), feature));               \
-+
++    qobject_unref(_resp);                                              \
-+static const MemoryRegionOps gicv3_its_control_ops = {
++})
-+    .read_with_attrs = gicv3_its_read,
++
-+    .write_with_attrs = gicv3_its_write,
++#define assert_has_not_feature(qts, cpu_type, feature)                 \
-+    .valid.min_access_size = 4,
++({                                                                     \
-+    .valid.max_access_size = 8,
++    QDict *_resp = do_query_no_props(qts, cpu_type);                   \
-+    .impl.min_access_size = 4,
++    g_assert(_resp);                                                   \
-+    .impl.max_access_size = 8,
++    g_assert(!resp_has_props(_resp) ||                                 \
-+    .endianness = DEVICE_NATIVE_ENDIAN,
++             !qdict_get(resp_get_props(_resp), feature));              \
-+};
++    qobject_unref(_resp);                                              \
-+
++})
-+static const MemoryRegionOps gicv3_its_translation_ops = {
++
-+    .write_with_attrs = gicv3_its_translation_write,
++static void assert_type_full(QTestState *qts)
-+    .valid.min_access_size = 2,
++{
-+    .valid.max_access_size = 4,
++    const char *error;
-+    .impl.min_access_size = 2,
++    QDict *resp;
-+    .impl.max_access_size = 4,
++
-+    .endianness = DEVICE_NATIVE_ENDIAN,
++    resp = qtest_qmp(qts, "{ 'execute': 'query-cpu-model-expansion', "
-+};
++                            "'arguments': { 'type': 'static', "
-+
++                                           "'model': { 'name': 'foo' }}}");
-+static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
++    g_assert(resp);
-+{
++    error = resp_get_error(resp);
-+    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
++    g_assert(error);
-+    int i;
++    g_assert(g_str_equal(error,
-+
++                         "The requested expansion type is not supported"));
-+    for (i = 0; i < s->gicv3->num_cpu; i++) {
++    qobject_unref(resp);
-+        if (!(s->gicv3->cpu[i].gicr_typer & GICR_TYPER_PLPIS)) {
++}
-+            error_setg(errp, "Physical LPI not supported by CPU %d", i);
++
-+            return;
++static void assert_bad_props(QTestState *qts, const char *cpu_type)
-+        }
++{
-+    }
++    const char *error;
-+
++    QDict *resp;
-+    gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
++
-+
++    resp = qtest_qmp(qts, "{ 'execute': 'query-cpu-model-expansion', "
-+    /* set the ITS default features supported */
++                            "'arguments': { 'type': 'full', "
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
++                                           "'model': { 'name': %s, "
-+                          GITS_TYPE_PHYSICAL);
++                                                      "'props': false }}}",
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE,
++                     cpu_type);
-+                          ITS_ITT_ENTRY_SIZE - 1);
++    g_assert(resp);
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, IDBITS, ITS_IDBITS);
++    error = resp_get_error(resp);
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, DEVBITS, ITS_DEVBITS);
++    g_assert(error);
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIL, 1);
++    g_assert(g_str_equal(error,
-+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIDBITS, ITS_CIDBITS);
++                         "Invalid parameter type for 'props', expected: dict"));
-+}
++    qobject_unref(resp);
-+
++}
-+static void gicv3_its_reset(DeviceState *dev)
++
-+{
++static void test_query_cpu_model_expansion(const void *data)
-+    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
++{
-+    GICv3ITSClass *c = ARM_GICV3_ITS_GET_CLASS(s);
++    QTestState *qts;
 +
-+    c->parent_reset(dev);
++    qts = qtest_init(MACHINE "-cpu max");
 +
-+    /* Quiescent bit reset to 1 */
++    /* Test common query-cpu-model-expansion input validation */
-+    s->ctlr = FIELD_DP32(s->ctlr, GITS_CTLR, QUIESCENT, 1);
++    assert_type_full(qts);
 +    assert_bad_props(qts, "max");
 +    assert_error(qts, "foo", "The CPU type 'foo' is not a recognized "
 +                 "ARM CPU type", NULL);
 +    assert_error(qts, "max", "Parameter 'not-a-prop' is unexpected",
 +                 "{ 'not-a-prop': false }");
 +    assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
 +
 +    /* Test expected feature presence/absence for some cpu types */
 +    assert_has_feature(qts, "max", "pmu");
 +    assert_has_feature(qts, "cortex-a15", "pmu");
 +    assert_has_not_feature(qts, "cortex-a15", "aarch64");
 +
 +    if (g_str_equal(qtest_get_arch(), "aarch64")) {
 +        assert_has_feature(qts, "max", "aarch64");
 +        assert_has_feature(qts, "cortex-a57", "pmu");
 +        assert_has_feature(qts, "cortex-a57", "aarch64");
 +
 +        /* Test that features that depend on KVM generate errors without. */
 +        assert_error(qts, "max",
 +                     "'aarch64' feature cannot be disabled "
 +                     "unless KVM is enabled and 32-bit EL1 "
 +                     "is supported",
 +                     "{ 'aarch64': false }");
 +    }
 +
 +    qtest_quit(qts);
 +}
 +
 +static void test_query_cpu_model_expansion_kvm(const void *data)
 +{
 +    QTestState *qts;
 +
 +    qts = qtest_init(MACHINE_KVM "-cpu max");
 +
 +    /*
-+     * setting GITS_BASER0.Type = 0b001 (Device)
++     * These tests target the 'host' CPU type, so KVM must be enabled.
 +     *         GITS_BASER1.Type = 0b100 (Collection Table)
 +     *         GITS_BASER<n>.Type,where n = 3 to 7 are 0b00 (Unimplemented)
 +     *         GITS_BASER<0,1>.Page_Size = 64KB
 +     * and default translation table entry size to 16 bytes
 +     */
-+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, TYPE,
++    if (!kvm_enabled(qts)) {
-+                             GITS_BASER_TYPE_DEVICE);
++        qtest_quit(qts);
-+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, PAGESIZE,
++        return;
-+                             GITS_BASER_PAGESIZE_64K);
++    }
-+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, ENTRYSIZE,
++
-+                             GITS_DTE_SIZE - 1);
++    if (g_str_equal(qtest_get_arch(), "aarch64")) {
-+
++        assert_has_feature(qts, "host", "aarch64");
-+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, TYPE,
++        assert_has_feature(qts, "host", "pmu");
-+                             GITS_BASER_TYPE_COLLECTION);
++
-+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, PAGESIZE,
++        assert_error(qts, "cortex-a15",
-+                             GITS_BASER_PAGESIZE_64K);
++            "We cannot guarantee the CPU type 'cortex-a15' works "
-+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, ENTRYSIZE,
++            "with KVM on this host", NULL);
-+                             GITS_CTE_SIZE - 1);
++    } else {
-+}
++        assert_has_not_feature(qts, "host", "aarch64");
-+
++        assert_has_not_feature(qts, "host", "pmu");
-+static Property gicv3_its_props[] = {
++    }
-+    DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
++
-+                     GICv3State *),
++    qtest_quit(qts);
-+    DEFINE_PROP_END_OF_LIST(),
++}
-+};
++
-+
++int main(int argc, char **argv)
-+static void gicv3_its_class_init(ObjectClass *klass, void *data)
++{
-+{
++    g_test_init(&argc, &argv, NULL);
-+    DeviceClass *dc = DEVICE_CLASS(klass);
++
-+    GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
++    qtest_add_data_func("/arm/query-cpu-model-expansion",
-+
++                        NULL, test_query_cpu_model_expansion);
-+    dc->realize = gicv3_arm_its_realize;
++    qtest_add_data_func("/arm/kvm/query-cpu-model-expansion",
-+    device_class_set_props(dc, gicv3_its_props);
++                        NULL, test_query_cpu_model_expansion_kvm);
-+    device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
++
-+}
++    return g_test_run();
-+
++}
 +static const TypeInfo gicv3_its_info = {
 +    .name = TYPE_ARM_GICV3_ITS,
 +    .parent = TYPE_ARM_GICV3_ITS_COMMON,
 +    .instance_size = sizeof(GICv3ITSState),
 +    .class_init = gicv3_its_class_init,
 +    .class_size = sizeof(GICv3ITSClass),
 +};
 +
 +static void gicv3_its_register_types(void)
 +{
 +    type_register_static(&gicv3_its_info);
 +}
 +
 +type_init(gicv3_its_register_types)
 diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_common.c
 +++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static int gicv3_its_post_load(void *opaque, int version_id)
  static const VMStateDescription vmstate_its = {
      .name = "arm_gicv3_its",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
      .pre_save = gicv3_its_pre_save,
      .post_load = gicv3_its_post_load,
      .priority = MIG_PRI_GICV3_ITS,
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps gicv3_its_trans_ops = {
      .endianness = DEVICE_NATIVE_ENDIAN,
  };
 -void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops)
 +void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
 +                         const MemoryRegionOps *tops)
  {
      SysBusDevice *sbd = SYS_BUS_DEVICE(s);
      memory_region_init_io(&s->iomem_its_cntrl, OBJECT(s), ops, s,
                            "control", ITS_CONTROL_SIZE);
      memory_region_init_io(&s->iomem_its_translation, OBJECT(s),
 -                          &gicv3_its_trans_ops, s,
 +                          tops ? tops : &gicv3_its_trans_ops, s,
                            "translation", ITS_TRANS_SIZE);
      /* Our two regions are always adjacent, therefore we now combine them
 diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its_kvm.c
 +++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
      kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
                              KVM_VGIC_ITS_ADDR_TYPE, s->dev_fd, 0);
 -    gicv3_its_init_mmio(s, NULL);
 +    gicv3_its_init_mmio(s, NULL, NULL);
      if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
          GITS_CTLR)) {
 diff --git a/hw/intc/meson.build b/hw/intc/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/meson.build
 +++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
    'arm_gicv3_dist.c',
    'arm_gicv3_its_common.c',
    'arm_gicv3_redist.c',
 +  'arm_gicv3_its.c',
  ))
  softmmu_ss.add(when: 'CONFIG_ETRAXFS', if_true: files('etraxfs_pic.c'))
  softmmu_ss.add(when: 'CONFIG_HEATHROW_PIC', if_true: files('heathrow_pic.c'))
 --
 .20.1

-[PULL 08/23] hw/arm: Add support for kudo-bmc board.
+[PULL 03/11] target/arm: Allow SVE to be disabled via a CPU property
-From: Chris Rauer <crauer@google.com>
+From: Andrew Jones <drjones@redhat.com>
-kudo-bmc is a board supported by OpenBMC.
+Since 97a28b0eeac14 ("target/arm: Allow VFP and Neon to be disabled via
-https://github.com/openbmc/openbmc/tree/master/meta-fii/meta-kudo
+a CPU property") we can disable the 'max' cpu model's VFP and neon
 features, but there's no way to disable SVE. Add the 'sve=on|off'
 property to give it that flexibility. We also rename
 cpu_max_get/set_sve_vq to cpu_max_get/set_sve_max_vq in order for them
 to follow the typical *_get/set_<property-name> pattern.
-Since v1:
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-- hyphenated Cortex-A9
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested: Booted kudo firmware.
+Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
-Signed-off-by: Chris Rauer <crauer@google.com>
+Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
-Reviewed-by: Patrick Venture <venture@google.com>
+Message-id: 20191031142734.8590-4-drjones@redhat.com
 Message-id: 20210907223234.1165705-1-crauer@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/nuvoton.rst |  1 +
+ target/arm/cpu.c         |  3 ++-
- hw/arm/npcm7xx_boards.c     | 34 ++++++++++++++++++++++++++++++++++
+ target/arm/cpu64.c       | 52 ++++++++++++++++++++++++++++++++++------
-files changed, 35 insertions(+)
+ target/arm/monitor.c     |  2 +-
  tests/arm-cpu-features.c |  1 +
 files changed, 49 insertions(+), 9 deletions(-)
-diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/nuvoton.rst
+--- a/target/arm/cpu.c
-+++ b/docs/system/arm/nuvoton.rst
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ Hyperscale applications. The following machines are based on this chip :
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
+         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
- - ``quanta-gbs-bmc``    Quanta GBS server BMC
+         env->cp15.cptr_el[3] |= CPTR_EZ;
- - ``quanta-gsj``        Quanta GSJ server BMC
+         /* with maximum vector length */
-+- ``kudo-bmc``          Fii USA Kudo server BMC
+-        env->vfp.zcr_el[1] = cpu->sve_max_vq - 1;
++        env->vfp.zcr_el[1] = cpu_isar_feature(aa64_sve, cpu) ?
- There are also two more SoCs, NPCM710 and NPCM705, which are single-core
++                             cpu->sve_max_vq - 1 : 0;
- variants of NPCM750 and NPCM730, respectively. These are currently not
+         env->vfp.zcr_el[2] = env->vfp.zcr_el[1];
-diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
+         env->vfp.zcr_el[3] = env->vfp.zcr_el[1];
          /*
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/npcm7xx_boards.c
+--- a/target/arm/cpu64.c
-+++ b/hw/arm/npcm7xx_boards.c
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
- #define NPCM750_EVB_POWER_ON_STRAPS 0x00001ff7
+     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
  #define QUANTA_GSJ_POWER_ON_STRAPS 0x00001fff
  #define QUANTA_GBS_POWER_ON_STRAPS 0x000017ff
 +#define KUDO_BMC_POWER_ON_STRAPS 0x00001fff
  static const char npcm7xx_default_bootrom[] = "npcm7xx_bootrom.bin";
@@ -XXX,XX +XXX,XX @@ static void quanta_gbs_init(MachineState *machine)
      npcm7xx_load_kernel(machine, soc);
  }
-+static void kudo_bmc_init(MachineState *machine)
+-static void cpu_max_get_sve_vq(Object *obj, Visitor *v, const char *name,
 -                               void *opaque, Error **errp)
 +static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
 +                                   void *opaque, Error **errp)
  {
      ARMCPU *cpu = ARM_CPU(obj);
 -    visit_type_uint32(v, name, &cpu->sve_max_vq, errp);
 +    uint32_t value;
 +
 +    /* All vector lengths are disabled when SVE is off. */
 +    if (!cpu_isar_feature(aa64_sve, cpu)) {
 +        value = 0;
 +    } else {
 +        value = cpu->sve_max_vq;
 +    }
 +    visit_type_uint32(v, name, &value, errp);
  }
 -static void cpu_max_set_sve_vq(Object *obj, Visitor *v, const char *name,
 -                               void *opaque, Error **errp)
 +static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
 +                                   void *opaque, Error **errp)
  {
      ARMCPU *cpu = ARM_CPU(obj);
      Error *err = NULL;
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_vq(Object *obj, Visitor *v, const char *name,
      error_propagate(errp, err);
  }
 +static void cpu_arm_get_sve(Object *obj, Visitor *v, const char *name,
 +                            void *opaque, Error **errp)
 +{
-+    NPCM7xxState *soc;
++    ARMCPU *cpu = ARM_CPU(obj);
 +    bool value = cpu_isar_feature(aa64_sve, cpu);
 +
-+    soc = npcm7xx_create_soc(machine, KUDO_BMC_POWER_ON_STRAPS);
++    visit_type_bool(v, name, &value, errp);
 +    npcm7xx_connect_dram(soc, machine->ram);
 +    qdev_realize(DEVICE(soc), NULL, &error_fatal);
 +
 +    npcm7xx_load_bootrom(machine, soc);
 +    npcm7xx_connect_flash(&soc->fiu[0], 0, "mx66u51235f",
 +                          drive_get(IF_MTD, 0, 0));
 +    npcm7xx_connect_flash(&soc->fiu[1], 0, "mx66u51235f",
 +                          drive_get(IF_MTD, 3, 0));
 +
 +    npcm7xx_load_kernel(machine, soc);
 +}
 +
- static void npcm7xx_set_soc_type(NPCM7xxMachineClass *nmc, const char *type)
++static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
- {
++                            void *opaque, Error **errp)
-     NPCM7xxClass *sc = NPCM7XX_CLASS(object_class_by_name(type));
++{
-@@ -XXX,XX +XXX,XX @@ static void gbs_bmc_machine_class_init(ObjectClass *oc, void *data)
++    ARMCPU *cpu = ARM_CPU(obj);
-     mc->default_ram_size = 1 * GiB;
++    Error *err = NULL;
 +    bool value;
 +    uint64_t t;
 +
 +    visit_type_bool(v, name, &value, &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    t = cpu->isar.id_aa64pfr0;
 +    t = FIELD_DP64(t, ID_AA64PFR0, SVE, value);
 +    cpu->isar.id_aa64pfr0 = t;
 +}
 +
  /* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
   * otherwise, a CPU with as many features enabled as our emulation supports.
   * The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
  #endif
          cpu->sve_max_vq = ARM_MAX_VQ;
 -        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_vq,
 -                            cpu_max_set_sve_vq, NULL, NULL, &error_fatal);
 +        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
 +                            cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
 +        object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
 +                            cpu_arm_set_sve, NULL, NULL, &error_fatal);
      }
  }
-+static void kudo_bmc_machine_class_init(ObjectClass *oc, void *data)
+diff --git a/target/arm/monitor.c b/target/arm/monitor.c
-+{
+index XXXXXXX..XXXXXXX 100644
-+    NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_CLASS(oc);
+--- a/target/arm/monitor.c
-+    MachineClass *mc = MACHINE_CLASS(oc);
++++ b/target/arm/monitor.c
-+
+@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
-+    npcm7xx_set_soc_type(nmc, TYPE_NPCM730);
+  * then the order that considers those dependencies must be used.
-+
+  */
-+    mc->desc = "Kudo BMC (Cortex-A9)";
+ static const char *cpu_model_advertised_features[] = {
-+    mc->init = kudo_bmc_init;
+-    "aarch64", "pmu",
-+    mc->default_ram_size = 1 * GiB;
++    "aarch64", "pmu", "sve",
-+};
+     NULL
 +
  static const TypeInfo npcm7xx_machine_types[] = {
      {
          .name           = TYPE_NPCM7XX_MACHINE,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo npcm7xx_machine_types[] = {
          .name           = MACHINE_TYPE_NAME("quanta-gbs-bmc"),
          .parent         = TYPE_NPCM7XX_MACHINE,
          .class_init     = gbs_bmc_machine_class_init,
 +    }, {
 +        .name           = MACHINE_TYPE_NAME("kudo-bmc"),
 +        .parent         = TYPE_NPCM7XX_MACHINE,
 +        .class_init     = kudo_bmc_machine_class_init,
      },
  };
+diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/arm-cpu-features.c
++++ b/tests/arm-cpu-features.c
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
+     if (g_str_equal(qtest_get_arch(), "aarch64")) {
+         assert_has_feature(qts, "max", "aarch64");
++        assert_has_feature(qts, "max", "sve");
+         assert_has_feature(qts, "cortex-a57", "pmu");
+         assert_has_feature(qts, "cortex-a57", "aarch64");
 --
 .20.1

-[PULL 13/23] hw/intc: GICv3 ITS Feature enablement
+[PULL 04/11] target/arm/cpu64: max cpu: Introduce sve<N> properties
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-Added properties to enable ITS feature and define qemu system
+Introduce cpu properties to give fine control over SVE vector lengths.
-address space memory in gicv3 common,setup distributor and
+We introduce a property for each valid length up to the current
-redistributor registers to indicate LPI support.
+maximum supported, which is 2048-bits. The properties are named, e.g.
 sve128, sve256, sve384, sve512, ..., where the number is the number of
 bits. See the updates to docs/arm-cpu-features.rst for a description
 of the semantics and for example uses.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
+Note, as sve-max-vq is still present and we'd like to be able to
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+support qmp_query_cpu_model_expansion with guests launched with e.g.
-Tested-by: Neil Armstrong <narmstrong@baylibre.com>
+-cpu max,sve-max-vq=8 on their command lines, then we do allow
-Message-id: 20210910143951.92242-6-shashi.mallela@linaro.org
+sve-max-vq and sve<N> properties to be provided at the same time, but
 this is not recommended, and is why sve-max-vq is not mentioned in the
 document.  If sve-max-vq is provided then it enables all lengths smaller
 than and including the max and disables all lengths larger. It also has
 the side-effect that no larger lengths may be enabled and that the max
 itself cannot be disabled. Smaller non-power-of-two lengths may,
 however, be disabled, e.g. -cpu max,sve-max-vq=4,sve384=off provides a
 guest the vector lengths 128, 256, and 512 bits.
 This patch has been co-authored with Richard Henderson, who reworked
 the target/arm/cpu64.c changes in order to push all the validation and
 auto-enabling/disabling steps into the finalizer, resulting in a nice
 LOC reduction.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
 Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
 Message-id: 20191031142734.8590-5-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/gicv3_internal.h           |  2 ++
+ include/qemu/bitops.h     |   1 +
- include/hw/intc/arm_gicv3_common.h |  1 +
+ target/arm/cpu.h          |  19 ++++
- hw/intc/arm_gicv3_common.c         | 12 ++++++++++++
+ target/arm/cpu.c          |  19 ++++
- hw/intc/arm_gicv3_dist.c           |  5 ++++-
+ target/arm/cpu64.c        | 192 ++++++++++++++++++++++++++++++++++++-
- hw/intc/arm_gicv3_redist.c         | 12 +++++++++---
+ target/arm/helper.c       |  10 +-
-files changed, 28 insertions(+), 4 deletions(-)
+ target/arm/monitor.c      |  12 +++
  tests/arm-cpu-features.c  | 194 ++++++++++++++++++++++++++++++++++++++
  docs/arm-cpu-features.rst | 168 +++++++++++++++++++++++++++++++--
 files changed, 606 insertions(+), 9 deletions(-)
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
+diff --git a/include/qemu/bitops.h b/include/qemu/bitops.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/include/qemu/bitops.h
-+++ b/hw/intc/gicv3_internal.h
++++ b/include/qemu/bitops.h
 @@ -XXX,XX +XXX,XX @@
- #define GICD_CTLR_E1NWF             (1U << 7)
+ #define BITS_PER_LONG           (sizeof (unsigned long) * BITS_PER_BYTE)
- #define GICD_CTLR_RWP               (1U << 31)
+ #define BIT(nr)                 (1UL << (nr))
-+#define GICD_TYPER_LPIS_SHIFT          17
++#define BIT_ULL(nr)             (1ULL << (nr))
-+
+ #define BIT_MASK(nr)            (1UL << ((nr) % BITS_PER_LONG))
- /* 16 bits EventId */
+ #define BIT_WORD(nr)            ((nr) / BITS_PER_LONG)
- #define GICD_TYPER_IDBITS            0xf
+ #define BITS_TO_LONGS(nr)       DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/arm_gicv3_common.h
+--- a/target/arm/cpu.h
-+++ b/include/hw/intc/arm_gicv3_common.h
++++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ struct GICv3State {
+@@ -XXX,XX +XXX,XX @@ typedef struct {
-     uint32_t num_cpu;
-     uint32_t num_irq;
+ #ifdef TARGET_AARCH64
-     uint32_t revision;
+ # define ARM_MAX_VQ    16
-+    bool lpi_enable;
++void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
-     bool security_extn;
++uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq);
-     bool irq_reset_nonsecure;
+ #else
-     bool gicd_no_migration_shift_bug;
+ # define ARM_MAX_VQ    1
-diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
++static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
 +static inline uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq)
 +{ return 0; }
  #endif
  typedef struct ARMVectorReg {
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
      /* Used to set the maximum vector length the cpu will support.  */
      uint32_t sve_max_vq;
 +
 +    /*
 +     * In sve_vq_map each set bit is a supported vector length of
 +     * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
 +     * length in quadwords.
 +     *
 +     * While processing properties during initialization, corresponding
 +     * sve_vq_init bits are set for bits in sve_vq_map that have been
 +     * set by properties.
 +     */
 +    DECLARE_BITMAP(sve_vq_map, ARM_MAX_VQ);
 +    DECLARE_BITMAP(sve_vq_init, ARM_MAX_VQ);
  };
  void arm_cpu_post_init(Object *obj);
@@ -XXX,XX +XXX,XX @@ static inline int arm_feature(CPUARMState *env, int feature)
      return (env->features & (1ULL << feature)) != 0;
  }
 +void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
 +
  #if !defined(CONFIG_USER_ONLY)
  /* Return true if exception levels below EL3 are in secure state,
   * or would be following an exception return to that level.
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_common.c
+--- a/target/arm/cpu.c
-+++ b/hw/intc/arm_gicv3_common.c
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_finalizefn(Object *obj)
  #endif
  }
 +void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
 +{
 +    Error *local_err = NULL;
 +
 +    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
 +        arm_cpu_sve_finalize(cpu, &local_err);
 +        if (local_err != NULL) {
 +            error_propagate(errp, local_err);
 +            return;
 +        }
 +    }
 +}
 +
  static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
  {
      CPUState *cs = CPU(dev);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          return;
      }
-+    if (s->lpi_enable && !s->dma) {
++    arm_cpu_finalize_features(cpu, &local_err);
-+        error_setg(errp, "Redist-ITS: Guest 'sysmem' reference link not set");
++    if (local_err != NULL) {
 +        error_propagate(errp, local_err);
 +        return;
 +    }
 +
-     s->cpu = g_new0(GICv3CPUState, s->num_cpu);
+     if (arm_feature(env, ARM_FEATURE_AARCH64) &&
+         cpu->has_vfp != cpu->has_neon) {
-     for (i = 0; i < s->num_cpu; i++) {
+         /*
-@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-             (1 << 24) |
+index XXXXXXX..XXXXXXX 100644
-             (i << 8) |
+--- a/target/arm/cpu64.c
-             (last << 4);
++++ b/target/arm/cpu64.c
-+
+@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
-+        if (s->lpi_enable) {
+     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
-+            s->cpu[i].gicr_typer |= GICR_TYPER_PLPIS;
+ }
 +void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
 +{
 +    /*
 +     * If any vector lengths are explicitly enabled with sve<N> properties,
 +     * then all other lengths are implicitly disabled.  If sve-max-vq is
 +     * specified then it is the same as explicitly enabling all lengths
 +     * up to and including the specified maximum, which means all larger
 +     * lengths will be implicitly disabled.  If no sve<N> properties
 +     * are enabled and sve-max-vq is not specified, then all lengths not
 +     * explicitly disabled will be enabled.  Additionally, all power-of-two
 +     * vector lengths less than the maximum enabled length will be
 +     * automatically enabled and all vector lengths larger than the largest
 +     * disabled power-of-two vector length will be automatically disabled.
 +     * Errors are generated if the user provided input that interferes with
 +     * any of the above.  Finally, if SVE is not disabled, then at least one
 +     * vector length must be enabled.
 +     */
 +    DECLARE_BITMAP(tmp, ARM_MAX_VQ);
 +    uint32_t vq, max_vq = 0;
 +
 +    /*
 +     * Process explicit sve<N> properties.
 +     * From the properties, sve_vq_map<N> implies sve_vq_init<N>.
 +     * Check first for any sve<N> enabled.
 +     */
 +    if (!bitmap_empty(cpu->sve_vq_map, ARM_MAX_VQ)) {
 +        max_vq = find_last_bit(cpu->sve_vq_map, ARM_MAX_VQ) + 1;
 +
 +        if (cpu->sve_max_vq && max_vq > cpu->sve_max_vq) {
 +            error_setg(errp, "cannot enable sve%d", max_vq * 128);
 +            error_append_hint(errp, "sve%d is larger than the maximum vector "
 +                              "length, sve-max-vq=%d (%d bits)\n",
 +                              max_vq * 128, cpu->sve_max_vq,
 +                              cpu->sve_max_vq * 128);
 +            return;
 +        }
 +
 +        /* Propagate enabled bits down through required powers-of-two. */
 +        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
 +            if (!test_bit(vq - 1, cpu->sve_vq_init)) {
 +                set_bit(vq - 1, cpu->sve_vq_map);
 +            }
 +        }
 +    } else if (cpu->sve_max_vq == 0) {
 +        /*
 +         * No explicit bits enabled, and no implicit bits from sve-max-vq.
 +         */
 +        if (!cpu_isar_feature(aa64_sve, cpu)) {
 +            /* SVE is disabled and so are all vector lengths.  Good. */
 +            return;
 +        }
 +
 +        /* Disabling a power-of-two disables all larger lengths. */
 +        if (test_bit(0, cpu->sve_vq_init)) {
 +            error_setg(errp, "cannot disable sve128");
 +            error_append_hint(errp, "Disabling sve128 results in all vector "
 +                              "lengths being disabled.\n");
 +            error_append_hint(errp, "With SVE enabled, at least one vector "
 +                              "length must be enabled.\n");
 +            return;
 +        }
 +        for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
 +            if (test_bit(vq - 1, cpu->sve_vq_init)) {
 +                break;
 +            }
 +        }
 +        max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
 +
 +        bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
 +        max_vq = find_last_bit(cpu->sve_vq_map, max_vq) + 1;
 +    }
 +
 +    /*
 +     * Process the sve-max-vq property.
 +     * Note that we know from the above that no bit above
 +     * sve-max-vq is currently set.
 +     */
 +    if (cpu->sve_max_vq != 0) {
 +        max_vq = cpu->sve_max_vq;
 +
 +        if (!test_bit(max_vq - 1, cpu->sve_vq_map) &&
 +            test_bit(max_vq - 1, cpu->sve_vq_init)) {
 +            error_setg(errp, "cannot disable sve%d", max_vq * 128);
 +            error_append_hint(errp, "The maximum vector length must be "
 +                              "enabled, sve-max-vq=%d (%d bits)\n",
 +                              max_vq, max_vq * 128);
 +            return;
 +        }
 +
 +        /* Set all bits not explicitly set within sve-max-vq. */
 +        bitmap_complement(tmp, cpu->sve_vq_init, max_vq);
 +        bitmap_or(cpu->sve_vq_map, cpu->sve_vq_map, tmp, max_vq);
 +    }
 +
 +    /*
 +     * We should know what max-vq is now.  Also, as we're done
 +     * manipulating sve-vq-map, we ensure any bits above max-vq
 +     * are clear, just in case anybody looks.
 +     */
 +    assert(max_vq != 0);
 +    bitmap_clear(cpu->sve_vq_map, max_vq, ARM_MAX_VQ - max_vq);
 +
 +    /* Ensure all required powers-of-two are enabled. */
 +    for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
 +        if (!test_bit(vq - 1, cpu->sve_vq_map)) {
 +            error_setg(errp, "cannot disable sve%d", vq * 128);
 +            error_append_hint(errp, "sve%d is required as it "
 +                              "is a power-of-two length smaller than "
 +                              "the maximum, sve%d\n",
 +                              vq * 128, max_vq * 128);
 +            return;
 +        }
 +    }
 +
 +    /*
 +     * Now that we validated all our vector lengths, the only question
 +     * left to answer is if we even want SVE at all.
 +     */
 +    if (!cpu_isar_feature(aa64_sve, cpu)) {
 +        error_setg(errp, "cannot enable sve%d", max_vq * 128);
 +        error_append_hint(errp, "SVE must be enabled to enable vector "
 +                          "lengths.\n");
 +        error_append_hint(errp, "Add sve=on to the CPU property list.\n");
 +        return;
 +    }
 +
 +    /* From now on sve_max_vq is the actual maximum supported length. */
 +    cpu->sve_max_vq = max_vq;
 +}
 +
 +uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq)
 +{
 +    uint32_t bitnum;
 +
 +    /*
 +     * We allow vq == ARM_MAX_VQ + 1 to be input because the caller may want
 +     * to find the maximum vq enabled, which may be ARM_MAX_VQ, but this
 +     * function always returns the next smaller than the input.
 +     */
 +    assert(vq && vq <= ARM_MAX_VQ + 1);
 +
 +    bitnum = find_last_bit(cpu->sve_vq_map, vq - 1);
 +    return bitnum == vq - 1 ? 0 : bitnum + 1;
 +}
 +
  static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
                                     void *opaque, Error **errp)
  {
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
      error_propagate(errp, err);
  }
 +static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
 +                               void *opaque, Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    uint32_t vq = atoi(&name[3]) / 128;
 +    bool value;
 +
 +    /* All vector lengths are disabled when SVE is off. */
 +    if (!cpu_isar_feature(aa64_sve, cpu)) {
 +        value = false;
 +    } else {
 +        value = test_bit(vq - 1, cpu->sve_vq_map);
 +    }
 +    visit_type_bool(v, name, &value, errp);
 +}
 +
 +static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
 +                               void *opaque, Error **errp)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +    uint32_t vq = atoi(&name[3]) / 128;
 +    Error *err = NULL;
 +    bool value;
 +
 +    visit_type_bool(v, name, &value, &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    if (value) {
 +        set_bit(vq - 1, cpu->sve_vq_map);
 +    } else {
 +        clear_bit(vq - 1, cpu->sve_vq_map);
 +    }
 +    set_bit(vq - 1, cpu->sve_vq_init);
 +}
 +
  static void cpu_arm_get_sve(Object *obj, Visitor *v, const char *name,
                              void *opaque, Error **errp)
  {
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
  static void aarch64_max_initfn(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
 +    uint32_t vq;
      if (kvm_enabled()) {
          kvm_arm_set_cpu_features_from_host(cpu);
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          cpu->dcz_blocksize = 7; /*  512 bytes */
  #endif
 -        cpu->sve_max_vq = ARM_MAX_VQ;
          object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                              cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
          object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
                              cpu_arm_set_sve, NULL, NULL, &error_fatal);
 +
 +        for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 +            char name[8];
 +            sprintf(name, "sve%d", vq * 128);
 +            object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
 +                                cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
 +        }
      }
  }
-@@ -XXX,XX +XXX,XX @@ static Property arm_gicv3_common_properties[] = {
+diff --git a/target/arm/helper.c b/target/arm/helper.c
-     DEFINE_PROP_UINT32("num-cpu", GICv3State, num_cpu, 1),
+index XXXXXXX..XXXXXXX 100644
-     DEFINE_PROP_UINT32("num-irq", GICv3State, num_irq, 32),
+--- a/target/arm/helper.c
-     DEFINE_PROP_UINT32("revision", GICv3State, revision, 3),
++++ b/target/arm/helper.c
-+    DEFINE_PROP_BOOL("has-lpi", GICv3State, lpi_enable, 0),
+@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
-     DEFINE_PROP_BOOL("has-security-extensions", GICv3State, security_extn, 0),
+     return 0;
-     DEFINE_PROP_ARRAY("redist-region-count", GICv3State, nb_redist_regions,
+ }
-                       redist_region_count, qdev_prop_uint32, uint32_t),
-+    DEFINE_PROP_LINK("sysmem", GICv3State, dma, TYPE_MEMORY_REGION,
++static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
-+                     MemoryRegion *),
++{
-     DEFINE_PROP_END_OF_LIST(),
++    uint32_t start_vq = (start_len & 0xf) + 1;
 +
 +    return arm_cpu_vq_map_next_smaller(cpu, start_vq + 1) - 1;
 +}
 +
  /*
   * Given that SVE is enabled, return the vector length for EL.
   */
@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
      if (arm_feature(env, ARM_FEATURE_EL3)) {
          zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
      }
 -    return zcr_len;
 +
 +    return sve_zcr_get_valid_len(cpu, zcr_len);
  }
  static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 diff --git a/target/arm/monitor.c b/target/arm/monitor.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/monitor.c
 +++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
      return head;
  }
 +QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
 +
  /*
   * These are cpu model features we want to advertise. The order here
   * matters as this is the order in which qmp_query_cpu_model_expansion
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
   */
  static const char *cpu_model_advertised_features[] = {
      "aarch64", "pmu", "sve",
 +    "sve128", "sve256", "sve384", "sve512",
 +    "sve640", "sve768", "sve896", "sve1024", "sve1152", "sve1280",
 +    "sve1408", "sve1536", "sve1664", "sve1792", "sve1920", "sve2048",
      NULL
  };
-diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
+@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
          if (!err) {
              visit_check_struct(visitor, &err);
          }
 +        if (!err) {
 +            arm_cpu_finalize_features(ARM_CPU(obj), &err);
 +        }
          visit_end_struct(visitor, NULL);
          visit_free(visitor);
          if (err) {
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
              error_propagate(errp, err);
              return NULL;
          }
 +    } else {
 +        Error *err = NULL;
 +        arm_cpu_finalize_features(ARM_CPU(obj), &err);
 +        assert(err == NULL);
      }
      expansion_info = g_new0(CpuModelExpansionInfo, 1);
 diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_dist.c
+--- a/tests/arm-cpu-features.c
-+++ b/hw/intc/arm_gicv3_dist.c
++++ b/tests/arm-cpu-features.c
-@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@
-          * A3V == 1 (non-zero values of Affinity level 3 supported)
+  * See the COPYING file in the top-level directory.
-          * IDbits == 0xf (we support 16-bit interrupt identifiers)
+  */
-          * DVIS == 0 (Direct virtual LPI injection not supported)
+ #include "qemu/osdep.h"
--         * LPIS == 0 (LPIs not supported)
++#include "qemu/bitops.h"
-+         * LPIS == 1 (LPIs are supported if affinity routing is enabled)
+ #include "libqtest.h"
-+         * num_LPIs == 0b00000 (bits [15:11],Number of LPIs as indicated
+ #include "qapi/qmp/qdict.h"
-+         *                      by GICD_TYPER.IDbits)
+ #include "qapi/qmp/qjson.h"
-          * MBIS == 0 (message-based SPIs not supported)
-          * SecurityExtn == 1 if security extns supported
++/*
-          * CPUNumber == 0 since for us ARE is always 1
++ * We expect the SVE max-vq to be 16. Also it must be <= 64
-@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
++ * for our test code, otherwise 'vls' can't just be a uint64_t.
-         bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
++ */
++#define SVE_MAX_VQ 16
-         *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
++
-+            (s->lpi_enable << GICD_TYPER_LPIS_SHIFT) |
+ #define MACHINE     "-machine virt,gic-version=max,accel=tcg "
-             (0xf << 19) | itlinesnumber;
+ #define MACHINE_KVM "-machine virt,gic-version=max,accel=kvm:tcg "
-         return true;
+ #define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
-     }
+@@ -XXX,XX +XXX,XX @@ static void assert_bad_props(QTestState *qts, const char *cpu_type)
-diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
+     qobject_unref(resp);
  }
 +static uint64_t resp_get_sve_vls(QDict *resp)
 +{
 +    QDict *props;
 +    const QDictEntry *e;
 +    uint64_t vls = 0;
 +    int n = 0;
 +
 +    g_assert(resp);
 +    g_assert(resp_has_props(resp));
 +
 +    props = resp_get_props(resp);
 +
 +    for (e = qdict_first(props); e; e = qdict_next(props, e)) {
 +        if (strlen(e->key) > 3 && !strncmp(e->key, "sve", 3) &&
 +            g_ascii_isdigit(e->key[3])) {
 +            char *endptr;
 +            int bits;
 +
 +            bits = g_ascii_strtoll(&e->key[3], &endptr, 10);
 +            if (!bits || *endptr != '\0') {
 +                continue;
 +            }
 +
 +            if (qdict_get_bool(props, e->key)) {
 +                vls |= BIT_ULL((bits / 128) - 1);
 +            }
 +            ++n;
 +        }
 +    }
 +
 +    g_assert(n == SVE_MAX_VQ);
 +
 +    return vls;
 +}
 +
 +#define assert_sve_vls(qts, cpu_type, expected_vls, fmt, ...)          \
 +({                                                                     \
 +    QDict *_resp = do_query(qts, cpu_type, fmt, ##__VA_ARGS__);        \
 +    g_assert(_resp);                                                   \
 +    g_assert(resp_has_props(_resp));                                   \
 +    g_assert(resp_get_sve_vls(_resp) == expected_vls);                 \
 +    qobject_unref(_resp);                                              \
 +})
 +
 +static void sve_tests_default(QTestState *qts, const char *cpu_type)
 +{
 +    /*
 +     * With no sve-max-vq or sve<N> properties on the command line
 +     * the default is to have all vector lengths enabled. This also
 +     * tests that 'sve' is 'on' by default.
 +     */
 +    assert_sve_vls(qts, cpu_type, BIT_ULL(SVE_MAX_VQ) - 1, NULL);
 +
 +    /* With SVE off, all vector lengths should also be off. */
 +    assert_sve_vls(qts, cpu_type, 0, "{ 'sve': false }");
 +
 +    /* With SVE on, we must have at least one vector length enabled. */
 +    assert_error(qts, cpu_type, "cannot disable sve128", "{ 'sve128': false }");
 +
 +    /* Basic enable/disable tests. */
 +    assert_sve_vls(qts, cpu_type, 0x7, "{ 'sve384': true }");
 +    assert_sve_vls(qts, cpu_type, ((BIT_ULL(SVE_MAX_VQ) - 1) & ~BIT_ULL(2)),
 +                   "{ 'sve384': false }");
 +
 +    /*
 +     * ---------------------------------------------------------------------
 +     *               power-of-two(vq)   all-power-            can      can
 +     *                                  of-two(< vq)        enable   disable
 +     * ---------------------------------------------------------------------
 +     * vq < max_vq      no                MUST*              yes      yes
 +     * vq < max_vq      yes               MUST*              yes      no
 +     * ---------------------------------------------------------------------
 +     * vq == max_vq     n/a               MUST*              yes**    yes**
 +     * ---------------------------------------------------------------------
 +     * vq > max_vq      n/a               no                 no       yes
 +     * vq > max_vq      n/a               yes                yes      yes
 +     * ---------------------------------------------------------------------
 +     *
 +     * [*] "MUST" means this requirement must already be satisfied,
 +     *     otherwise 'max_vq' couldn't itself be enabled.
 +     *
 +     * [**] Not testable with the QMP interface, only with the command line.
 +     */
 +
 +    /* max_vq := 8 */
 +    assert_sve_vls(qts, cpu_type, 0x8b, "{ 'sve1024': true }");
 +
 +    /* max_vq := 8, vq < max_vq, !power-of-two(vq) */
 +    assert_sve_vls(qts, cpu_type, 0x8f,
 +                   "{ 'sve1024': true, 'sve384': true }");
 +    assert_sve_vls(qts, cpu_type, 0x8b,
 +                   "{ 'sve1024': true, 'sve384': false }");
 +
 +    /* max_vq := 8, vq < max_vq, power-of-two(vq) */
 +    assert_sve_vls(qts, cpu_type, 0x8b,
 +                   "{ 'sve1024': true, 'sve256': true }");
 +    assert_error(qts, cpu_type, "cannot disable sve256",
 +                 "{ 'sve1024': true, 'sve256': false }");
 +
 +    /* max_vq := 3, vq > max_vq, !all-power-of-two(< vq) */
 +    assert_error(qts, cpu_type, "cannot disable sve512",
 +                 "{ 'sve384': true, 'sve512': false, 'sve640': true }");
 +
 +    /*
 +     * We can disable power-of-two vector lengths when all larger lengths
 +     * are also disabled. We only need to disable the power-of-two length,
 +     * as all non-enabled larger lengths will then be auto-disabled.
 +     */
 +    assert_sve_vls(qts, cpu_type, 0x7, "{ 'sve512': false }");
 +
 +    /* max_vq := 3, vq > max_vq, all-power-of-two(< vq) */
 +    assert_sve_vls(qts, cpu_type, 0x1f,
 +                   "{ 'sve384': true, 'sve512': true, 'sve640': true }");
 +    assert_sve_vls(qts, cpu_type, 0xf,
 +                   "{ 'sve384': true, 'sve512': true, 'sve640': false }");
 +}
 +
 +static void sve_tests_sve_max_vq_8(const void *data)
 +{
 +    QTestState *qts;
 +
 +    qts = qtest_init(MACHINE "-cpu max,sve-max-vq=8");
 +
 +    assert_sve_vls(qts, "max", BIT_ULL(8) - 1, NULL);
 +
 +    /*
 +     * Disabling the max-vq set by sve-max-vq is not allowed, but
 +     * of course enabling it is OK.
 +     */
 +    assert_error(qts, "max", "cannot disable sve1024", "{ 'sve1024': false }");
 +    assert_sve_vls(qts, "max", 0xff, "{ 'sve1024': true }");
 +
 +    /*
 +     * Enabling anything larger than max-vq set by sve-max-vq is not
 +     * allowed, but of course disabling everything larger is OK.
 +     */
 +    assert_error(qts, "max", "cannot enable sve1152", "{ 'sve1152': true }");
 +    assert_sve_vls(qts, "max", 0xff, "{ 'sve1152': false }");
 +
 +    /*
 +     * We can enable/disable non power-of-two lengths smaller than the
 +     * max-vq set by sve-max-vq, but, while we can enable power-of-two
 +     * lengths, we can't disable them.
 +     */
 +    assert_sve_vls(qts, "max", 0xff, "{ 'sve384': true }");
 +    assert_sve_vls(qts, "max", 0xfb, "{ 'sve384': false }");
 +    assert_sve_vls(qts, "max", 0xff, "{ 'sve256': true }");
 +    assert_error(qts, "max", "cannot disable sve256", "{ 'sve256': false }");
 +
 +    qtest_quit(qts);
 +}
 +
 +static void sve_tests_sve_off(const void *data)
 +{
 +    QTestState *qts;
 +
 +    qts = qtest_init(MACHINE "-cpu max,sve=off");
 +
 +    /* SVE is off, so the map should be empty. */
 +    assert_sve_vls(qts, "max", 0, NULL);
 +
 +    /* The map stays empty even if we turn lengths off. */
 +    assert_sve_vls(qts, "max", 0, "{ 'sve128': false }");
 +
 +    /* It's an error to enable lengths when SVE is off. */
 +    assert_error(qts, "max", "cannot enable sve128", "{ 'sve128': true }");
 +
 +    /* With SVE re-enabled we should get all vector lengths enabled. */
 +    assert_sve_vls(qts, "max", BIT_ULL(SVE_MAX_VQ) - 1, "{ 'sve': true }");
 +
 +    /* Or enable SVE with just specific vector lengths. */
 +    assert_sve_vls(qts, "max", 0x3,
 +                   "{ 'sve': true, 'sve128': true, 'sve256': true }");
 +
 +    qtest_quit(qts);
 +}
 +
  static void test_query_cpu_model_expansion(const void *data)
  {
      QTestState *qts;
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
      if (g_str_equal(qtest_get_arch(), "aarch64")) {
          assert_has_feature(qts, "max", "aarch64");
          assert_has_feature(qts, "max", "sve");
 +        assert_has_feature(qts, "max", "sve128");
          assert_has_feature(qts, "cortex-a57", "pmu");
          assert_has_feature(qts, "cortex-a57", "aarch64");
 +        sve_tests_default(qts, "max");
 +
          /* Test that features that depend on KVM generate errors without. */
          assert_error(qts, "max",
                       "'aarch64' feature cannot be disabled "
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
      qtest_add_data_func("/arm/kvm/query-cpu-model-expansion",
                          NULL, test_query_cpu_model_expansion_kvm);
 +    if (g_str_equal(qtest_get_arch(), "aarch64")) {
 +        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-max-vq-8",
 +                            NULL, sve_tests_sve_max_vq_8);
 +        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
 +                            NULL, sve_tests_sve_off);
 +    }
 +
      return g_test_run();
  }
 diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_redist.c
+--- a/docs/arm-cpu-features.rst
-+++ b/hw/intc/arm_gicv3_redist.c
++++ b/docs/arm-cpu-features.rst
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ block in the script for usage) is used to issue the QMP commands.
-     case GICR_CTLR:
+       (QEMU) query-cpu-model-expansion type=full model={"name":"max"}
-         /* For our implementation, GICR_TYPER.DPGS is 0 and so all
+       { "return": {
-          * the DPG bits are RAZ/WI. We don't do anything asynchronously,
+         "model": { "name": "max", "props": {
--         * so UWP and RWP are RAZ/WI. And GICR_TYPER.LPIS is 0 (we don't
+-        "pmu": true, "aarch64": true
--         * implement LPIs) so Enable_LPIs is RES0. So there are no writable
++        "sve1664": true, "pmu": true, "sve1792": true, "sve1920": true,
--         * bits for us.
++        "sve128": true, "aarch64": true, "sve1024": true, "sve": true,
-+         * so UWP and RWP are RAZ/WI. GICR_TYPER.LPIS is 1 (we
++        "sve640": true, "sve768": true, "sve1408": true, "sve256": true,
-+         * implement LPIs) so Enable_LPIs is programmable.
++        "sve1152": true, "sve512": true, "sve384": true, "sve1536": true,
-          */
++        "sve896": true, "sve1280": true, "sve2048": true
-+        if (cs->gicr_typer & GICR_TYPER_PLPIS) {
+       }}}}
-+            if (value & GICR_CTLR_ENABLE_LPIS) {
-+                cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
+-We see that the `max` CPU type has the `pmu` and `aarch64` CPU features.
-+            } else {
+-We also see that the CPU features are enabled, as they are all `true`.
-+                cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
++We see that the `max` CPU type has the `pmu`, `aarch64`, `sve`, and many
-+            }
++`sve<N>` CPU features.  We also see that all the CPU features are
-+        }
++enabled, as they are all `true`.  (The `sve<N>` CPU features are all
-         return MEMTX_OK;
++optional SVE vector lengths (see "SVE CPU Properties").  While with TCG
-     case GICR_STATUSR:
++all SVE vector lengths can be supported, when KVM is in use it's more
-         /* RAZ/WI for our implementation */
++likely that only a few lengths will be supported, if SVE is supported at
 +all.)
  (2) Let's try to disable the PMU::
        (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"pmu":false}}
        { "return": {
          "model": { "name": "max", "props": {
 -        "pmu": false, "aarch64": true
 +        "sve1664": true, "pmu": false, "sve1792": true, "sve1920": true,
 +        "sve128": true, "aarch64": true, "sve1024": true, "sve": true,
 +        "sve640": true, "sve768": true, "sve1408": true, "sve256": true,
 +        "sve1152": true, "sve512": true, "sve384": true, "sve1536": true,
 +        "sve896": true, "sve1280": true, "sve2048": true
        }}}}
  We see it worked, as `pmu` is now `false`.
@@ -XXX,XX +XXX,XX @@ We see it worked, as `pmu` is now `false`.
  It looks like this feature is limited to a configuration we do not
  currently have.
 -(4) Let's try probing CPU features for the Cortex-A15 CPU type::
 +(4) Let's disable `sve` and see what happens to all the optional SVE
 +    vector lengths::
 +
 +      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"sve":false}}
 +      { "return": {
 +        "model": { "name": "max", "props": {
 +        "sve1664": false, "pmu": true, "sve1792": false, "sve1920": false,
 +        "sve128": false, "aarch64": true, "sve1024": false, "sve": false,
 +        "sve640": false, "sve768": false, "sve1408": false, "sve256": false,
 +        "sve1152": false, "sve512": false, "sve384": false, "sve1536": false,
 +        "sve896": false, "sve1280": false, "sve2048": false
 +      }}}}
 +
 +As expected they are now all `false`.
 +
 +(5) Let's try probing CPU features for the Cortex-A15 CPU type::
        (QEMU) query-cpu-model-expansion type=full model={"name":"cortex-a15"}
        {"return": {"model": {"name": "cortex-a15", "props": {"pmu": true}}}}
@@ -XXX,XX +XXX,XX @@ After determining which CPU features are available and supported for a
  given CPU type, then they may be selectively enabled or disabled on the
  QEMU command line with that CPU type::
 -  $ qemu-system-aarch64 -M virt -cpu max,pmu=off
 +  $ qemu-system-aarch64 -M virt -cpu max,pmu=off,sve=on,sve128=on,sve256=on
 -The example above disables the PMU for the `max` CPU type.
 +The example above disables the PMU and enables the first two SVE vector
 +lengths for the `max` CPU type.  Note, the `sve=on` isn't actually
 +necessary, because, as we observed above with our probe of the `max` CPU
 +type, `sve` is already on by default.  Also, based on our probe of
 +defaults, it would seem we need to disable many SVE vector lengths, rather
 +than only enabling the two we want.  This isn't the case, because, as
 +disabling many SVE vector lengths would be quite verbose, the `sve<N>` CPU
 +properties have special semantics (see "SVE CPU Property Parsing
 +Semantics").
 +
 +SVE CPU Properties
 +==================
 +
 +There are two types of SVE CPU properties: `sve` and `sve<N>`.  The first
 +is used to enable or disable the entire SVE feature, just as the `pmu`
 +CPU property completely enables or disables the PMU.  The second type
 +is used to enable or disable specific vector lengths, where `N` is the
 +number of bits of the length.  The `sve<N>` CPU properties have special
 +dependencies and constraints, see "SVE CPU Property Dependencies and
 +Constraints" below.  Additionally, as we want all supported vector lengths
 +to be enabled by default, then, in order to avoid overly verbose command
 +lines (command lines full of `sve<N>=off`, for all `N` not wanted), we
 +provide the parsing semantics listed in "SVE CPU Property Parsing
 +Semantics".
 +
 +SVE CPU Property Dependencies and Constraints
 +---------------------------------------------
 +
 +  1) At least one vector length must be enabled when `sve` is enabled.
 +
 +  2) If a vector length `N` is enabled, then all power-of-two vector
 +     lengths smaller than `N` must also be enabled.  E.g. if `sve512`
 +     is enabled, then the 128-bit and 256-bit vector lengths must also
 +     be enabled.
 +
 +SVE CPU Property Parsing Semantics
 +----------------------------------
 +
 +  1) If SVE is disabled (`sve=off`), then which SVE vector lengths
 +     are enabled or disabled is irrelevant to the guest, as the entire
 +     SVE feature is disabled and that disables all vector lengths for
 +     the guest.  However QEMU will still track any `sve<N>` CPU
 +     properties provided by the user.  If later an `sve=on` is provided,
 +     then the guest will get only the enabled lengths.  If no `sve=on`
 +     is provided and there are explicitly enabled vector lengths, then
 +     an error is generated.
 +
 +  2) If SVE is enabled (`sve=on`), but no `sve<N>` CPU properties are
 +     provided, then all supported vector lengths are enabled, including
 +     the non-power-of-two lengths.
 +
 +  3) If SVE is enabled, then an error is generated when attempting to
 +     disable the last enabled vector length (see constraint (1) of "SVE
 +     CPU Property Dependencies and Constraints").
 +
 +  4) If one or more vector lengths have been explicitly enabled and at
 +     at least one of the dependency lengths of the maximum enabled length
 +     has been explicitly disabled, then an error is generated (see
 +     constraint (2) of "SVE CPU Property Dependencies and Constraints").
 +
 +  5) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
 +     CPU properties are set `on`, then the specified vector lengths are
 +     disabled but the default for any unspecified lengths remains enabled.
 +     Disabling a power-of-two vector length also disables all vector
 +     lengths larger than the power-of-two length (see constraint (2) of
 +     "SVE CPU Property Dependencies and Constraints").
 +
 +  6) If one or more `sve<N>` CPU properties are set to `on`, then they
 +     are enabled and all unspecified lengths default to disabled, except
 +     for the required lengths per constraint (2) of "SVE CPU Property
 +     Dependencies and Constraints", which will even be auto-enabled if
 +     they were not explicitly enabled.
 +
 +  7) If SVE was disabled (`sve=off`), allowing all vector lengths to be
 +     explicitly disabled (i.e. avoiding the error specified in (3) of
 +     "SVE CPU Property Parsing Semantics"), then if later an `sve=on` is
 +     provided an error will be generated.  To avoid this error, one must
 +     enable at least one vector length prior to enabling SVE.
 +
 +SVE CPU Property Examples
 +-------------------------
 +
 +  1) Disable SVE::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve=off
 +
 +  2) Implicitly enable all vector lengths for the `max` CPU type::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max
 +
 +  3) Only enable the 128-bit vector length::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve128=on
 +
 +  4) Disable the 512-bit vector length and all larger vector lengths,
 +     since 512 is a power-of-two.  This results in all the smaller,
 +     uninitialized lengths (128, 256, and 384) defaulting to enabled::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve512=off
 +
 +  5) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve128=on,sve256=on,sve512=on
 +
 +  6) The same as (5), but since the 128-bit and 256-bit vector
 +     lengths are required for the 512-bit vector length to be enabled,
 +     then allow them to be auto-enabled::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve512=on
 +
 +  7) Do the same as (6), but by first disabling SVE and then re-enabling it::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve512=on,sve=on
 +
 +  8) Force errors regarding the last vector length::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve128=off
 +     $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve128=off,sve=on
 +
 +SVE CPU Property Recommendations
 +--------------------------------
 +
 +The examples in "SVE CPU Property Examples" exhibit many ways to select
 +vector lengths which developers may find useful in order to avoid overly
 +verbose command lines.  However, the recommended way to select vector
 +lengths is to explicitly enable each desired length.  Therefore only
 +example's (1), (3), and (5) exhibit recommended uses of the properties.
 --
 .20.1

-[PULL 10/23] hw/intc: GICv3 ITS register definitions added
+[PULL 05/11] target/arm/kvm64: Add kvm_arch_get/put_sve
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-Defined descriptors for ITS device table,collection table and ITS
+These are the SVE equivalents to kvm_arch_get/put_fpsimd. Note, the
-command queue entities.Implemented register read/write functions,
+swabbing is different than it is for fpsmid because the vector format
-extract ITS table parameters and command queue parameters,extended
+is a little-endian stream of words.
-gicv3 common to capture qemu address space(which host the ITS table
-platform memories required for subsequent ITS processing) and
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-initialize the same in ITS device.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Neil Armstrong <narmstrong@baylibre.com>
+Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
-Message-id: 20210910143951.92242-3-shashi.mallela@linaro.org
+Message-id: 20191031142734.8590-6-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/gicv3_internal.h               |  29 ++
+ target/arm/kvm64.c | 185 ++++++++++++++++++++++++++++++++++++++-------
- include/hw/intc/arm_gicv3_common.h     |   3 +
+file changed, 156 insertions(+), 29 deletions(-)
- include/hw/intc/arm_gicv3_its_common.h |  23 ++
- hw/intc/arm_gicv3_its.c                | 376 +++++++++++++++++++++++++
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 files changed, 431 insertions(+)
 diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/target/arm/kvm64.c
-+++ b/hw/intc/gicv3_internal.h
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_BASER, INNERCACHE, 59, 3)
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_destroy_vcpu(CPUState *cs)
- FIELD(GITS_BASER, INDIRECT, 62, 1)
+ bool kvm_arm_reg_syncs_via_cpreg_list(uint64_t regidx)
- FIELD(GITS_BASER, VALID, 63, 1)
+ {
+     /* Return true if the regidx is a register we should synchronize
-+FIELD(GITS_CBASER, SIZE, 0, 8)
+-     * via the cpreg_tuples array (ie is not a core reg we sync by
-+FIELD(GITS_CBASER, SHAREABILITY, 10, 2)
+-     * hand in kvm_arch_get/put_registers())
-+FIELD(GITS_CBASER, PHYADDR, 12, 40)
++     * via the cpreg_tuples array (ie is not a core or sve reg that
-+FIELD(GITS_CBASER, OUTERCACHE, 53, 3)
++     * we sync by hand in kvm_arch_get/put_registers())
-+FIELD(GITS_CBASER, INNERCACHE, 59, 3)
+      */
-+FIELD(GITS_CBASER, VALID, 63, 1)
+     switch (regidx & KVM_REG_ARM_COPROC_MASK) {
-+
+     case KVM_REG_ARM_CORE:
-+FIELD(GITS_CREADR, STALLED, 0, 1)
++    case KVM_REG_ARM64_SVE:
-+FIELD(GITS_CREADR, OFFSET, 5, 15)
+         return false;
-+
+     default:
-+FIELD(GITS_CWRITER, RETRY, 0, 1)
+         return true;
-+FIELD(GITS_CWRITER, OFFSET, 5, 15)
+@@ -XXX,XX +XXX,XX @@ int kvm_arm_cpreg_level(uint64_t regidx)
-+
-+FIELD(GITS_CTLR, ENABLED, 0, 1)
+ static int kvm_arch_put_fpsimd(CPUState *cs)
- FIELD(GITS_CTLR, QUIESCENT, 31, 1)
+ {
+-    ARMCPU *cpu = ARM_CPU(cs);
- FIELD(GITS_TYPER, PHYSICAL, 0, 1)
+-    CPUARMState *env = &cpu->env;
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, PTA, 19, 1)
++    CPUARMState *env = &ARM_CPU(cs)->env;
- FIELD(GITS_TYPER, CIDBITS, 32, 4)
+     struct kvm_one_reg reg;
- FIELD(GITS_TYPER, CIL, 36, 1)
+-    uint32_t fpr;
+     int i, ret;
-+#define GITS_IDREGS           0xFFD0
-+
+     for (i = 0; i < 32; i++) {
-+#define ITS_CTLR_ENABLED               (1U)  /* ITS Enabled */
+@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_fpsimd(CPUState *cs)
-+
+         }
-+#define GITS_BASER_RO_MASK                  (R_GITS_BASER_ENTRYSIZE_MASK | \
+     }
-+                                              R_GITS_BASER_TYPE_MASK)
-+
+-    reg.addr = (uintptr_t)(&fpr);
- #define GITS_BASER_PAGESIZE_4K                0
+-    fpr = vfp_get_fpsr(env);
- #define GITS_BASER_PAGESIZE_16K               1
+-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
- #define GITS_BASER_PAGESIZE_64K               2
+-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
+-    if (ret) {
- #define GITS_BASER_TYPE_DEVICE               1ULL
+-        return ret;
- #define GITS_BASER_TYPE_COLLECTION           4ULL
++    return 0;
++}
-+#define GITS_PAGE_SIZE_4K       0x1000
++
-+#define GITS_PAGE_SIZE_16K      0x4000
++/*
-+#define GITS_PAGE_SIZE_64K      0x10000
++ * SVE registers are encoded in KVM's memory in an endianness-invariant format.
-+
++ * The byte at offset i from the start of the in-memory representation contains
-+#define L1TABLE_ENTRY_SIZE         8
++ * the bits [(7 + 8 * i) : (8 * i)] of the register value. As this means the
-+
++ * lowest offsets are stored in the lowest memory addresses, then that nearly
-+#define GITS_CMDQ_ENTRY_SIZE               32
++ * matches QEMU's representation, which is to use an array of host-endian
-+
++ * uint64_t's, where the lower offsets are at the lower indices. To complete
- /**
++ * the translation we just need to byte swap the uint64_t's on big-endian hosts.
-  * Default features advertised by this version of ITS
++ */
-  */
++static uint64_t *sve_bswap64(uint64_t *dst, uint64_t *src, int nr)
 diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gicv3_common.h
 +++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3State {
      int dev_fd; /* kvm device fd if backed by kvm vgic support */
      Error *migration_blocker;
 +    MemoryRegion *dma;
 +    AddressSpace dma_as;
 +
      /* Distributor */
      /* for a GIC with the security extensions the NS banked version of this
 diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/arm_gicv3_its_common.h
 +++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
  #define GITS_TRANSLATER  0x0040
 +typedef struct {
 +    bool valid;
 +    bool indirect;
 +    uint16_t entry_sz;
 +    uint32_t page_sz;
 +    uint32_t max_entries;
 +    union {
 +        uint32_t max_devids;
 +        uint32_t max_collids;
 +    } maxids;
 +    uint64_t base_addr;
 +} TableDesc;
 +
 +typedef struct {
 +    bool valid;
 +    uint32_t max_entries;
 +    uint64_t base_addr;
 +} CmdQDesc;
 +
  struct GICv3ITSState {
      SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
      uint64_t creadr;
      uint64_t baser[8];
 +    TableDesc  dt;
 +    TableDesc  ct;
 +    CmdQDesc   cq;
 +
      Error *migration_blocker;
  };
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_its.c
 +++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
      void (*parent_reset)(DeviceState *dev);
  };
 +static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
 +{
-+    uint64_t result = 0;
++#ifdef HOST_WORDS_BIGENDIAN
-+
++    int i;
-+    switch (page_sz) {
++
-+    case GITS_PAGE_SIZE_4K:
++    for (i = 0; i < nr; ++i) {
-+    case GITS_PAGE_SIZE_16K:
++        dst[i] = bswap64(src[i]);
-+        result = FIELD_EX64(value, GITS_BASER, PHYADDR) << 12;
+     }
-+        break;
-+
+-    reg.addr = (uintptr_t)(&fpr);
-+    case GITS_PAGE_SIZE_64K:
+-    fpr = vfp_get_fpcr(env);
-+        result = FIELD_EX64(value, GITS_BASER, PHYADDRL_64K) << 16;
+-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
-+        result |= FIELD_EX64(value, GITS_BASER, PHYADDRH_64K) << 48;
++    return dst;
-+        break;
++#else
-+
++    return src;
-+    default:
++#endif
 +        break;
 +    }
 +    return result;
 +}
 +
 +/*
-+ * This function extracts the ITS Device and Collection table specific
++ * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
-+ * parameters (like base_addr, size etc) from GITS_BASER register.
++ * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
-+ * It is called during ITS enable and also during post_load migration
++ * code the slice index to zero for now as it's unlikely we'll need more than
 + * one slice for quite some time.
 + */
-+static void extract_table_params(GICv3ITSState *s)
++static int kvm_arch_put_sve(CPUState *cs)
 +{
-+    uint16_t num_pages = 0;
++    ARMCPU *cpu = ARM_CPU(cs);
-+    uint8_t  page_sz_type;
++    CPUARMState *env = &cpu->env;
-+    uint8_t type;
++    uint64_t tmp[ARM_MAX_VQ * 2];
-+    uint32_t page_sz = 0;
++    uint64_t *r;
-+    uint64_t value;
++    struct kvm_one_reg reg;
-+
++    int n, ret;
-+    for (int i = 0; i < 8; i++) {
++
-+        value = s->baser[i];
++    for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
-+
++        r = sve_bswap64(tmp, &env->vfp.zregs[n].d[0], cpu->sve_max_vq * 2);
-+        if (!value) {
++        reg.addr = (uintptr_t)r;
-+            continue;
++        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
-+        }
++        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-+
++        if (ret) {
-+        page_sz_type = FIELD_EX64(value, GITS_BASER, PAGESIZE);
++            return ret;
-+
++        }
-+        switch (page_sz_type) {
++    }
-+        case 0:
++
-+            page_sz = GITS_PAGE_SIZE_4K;
++    for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
-+            break;
++        r = sve_bswap64(tmp, r = &env->vfp.pregs[n].p[0],
-+
++                        DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
-+        case 1:
++        reg.addr = (uintptr_t)r;
-+            page_sz = GITS_PAGE_SIZE_16K;
++        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
-+            break;
++        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-+
++        if (ret) {
-+        case 2:
++            return ret;
-+        case 3:
++        }
-+            page_sz = GITS_PAGE_SIZE_64K;
++    }
-+            break;
++
-+
++    r = sve_bswap64(tmp, &env->vfp.pregs[FFR_PRED_NUM].p[0],
-+        default:
++                    DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
-+            g_assert_not_reached();
++    reg.addr = (uintptr_t)r;
-+        }
++    reg.id = KVM_REG_ARM64_SVE_FFR(0);
-+
+     ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-+        num_pages = FIELD_EX64(value, GITS_BASER, SIZE) + 1;
+     if (ret) {
-+
+         return ret;
-+        type = FIELD_EX64(value, GITS_BASER, TYPE);
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
-+
+ {
-+        switch (type) {
+     struct kvm_one_reg reg;
-+
+     uint64_t val;
-+        case GITS_BASER_TYPE_DEVICE:
++    uint32_t fpr;
-+            memset(&s->dt, 0 , sizeof(s->dt));
+     int i, ret;
-+            s->dt.valid = FIELD_EX64(value, GITS_BASER, VALID);
+     unsigned int el;
-+
-+            if (!s->dt.valid) {
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
-+                return;
+         }
-+            }
+     }
-+
-+            s->dt.page_sz = page_sz;
+-    ret = kvm_arch_put_fpsimd(cs);
-+            s->dt.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
++    if (cpu_isar_feature(aa64_sve, cpu)) {
-+            s->dt.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
++        ret = kvm_arch_put_sve(cs);
-+
++    } else {
-+            if (!s->dt.indirect) {
++        ret = kvm_arch_put_fpsimd(cs);
-+                s->dt.max_entries = (num_pages * page_sz) / s->dt.entry_sz;
++    }
-+            } else {
++    if (ret) {
-+                s->dt.max_entries = (((num_pages * page_sz) /
++        return ret;
-+                                     L1TABLE_ENTRY_SIZE) *
++    }
-+                                     (page_sz / s->dt.entry_sz));
++
-+            }
++    reg.addr = (uintptr_t)(&fpr);
-+
++    fpr = vfp_get_fpsr(env);
-+            s->dt.maxids.max_devids = (1UL << (FIELD_EX64(s->typer, GITS_TYPER,
++    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-+                                       DEVBITS) + 1));
++    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-+
++    if (ret) {
-+            s->dt.base_addr = baser_base_addr(value, page_sz);
++        return ret;
-+
++    }
-+            break;
++
-+
++    reg.addr = (uintptr_t)(&fpr);
-+        case GITS_BASER_TYPE_COLLECTION:
++    fpr = vfp_get_fpcr(env);
-+            memset(&s->ct, 0 , sizeof(s->ct));
++    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
-+            s->ct.valid = FIELD_EX64(value, GITS_BASER, VALID);
++    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-+
+     if (ret) {
-+            /*
+         return ret;
-+             * GITS_TYPER.HCC is 0 for this implementation
+     }
-+             * hence writes are discarded if ct.valid is 0
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
-+             */
-+            if (!s->ct.valid) {
+ static int kvm_arch_get_fpsimd(CPUState *cs)
-+                return;
+ {
-+            }
+-    ARMCPU *cpu = ARM_CPU(cs);
-+
+-    CPUARMState *env = &cpu->env;
-+            s->ct.page_sz = page_sz;
++    CPUARMState *env = &ARM_CPU(cs)->env;
-+            s->ct.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
+     struct kvm_one_reg reg;
-+            s->ct.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
+-    uint32_t fpr;
-+
+     int i, ret;
-+            if (!s->ct.indirect) {
-+                s->ct.max_entries = (num_pages * page_sz) / s->ct.entry_sz;
+     for (i = 0; i < 32; i++) {
-+            } else {
+@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_fpsimd(CPUState *cs)
-+                s->ct.max_entries = (((num_pages * page_sz) /
+         }
-+                                     L1TABLE_ENTRY_SIZE) *
+     }
-+                                     (page_sz / s->ct.entry_sz));
-+            }
+-    reg.addr = (uintptr_t)(&fpr);
-+
+-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-+            if (FIELD_EX64(s->typer, GITS_TYPER, CIL)) {
+-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-+                s->ct.maxids.max_collids = (1UL << (FIELD_EX64(s->typer,
+-    if (ret) {
-+                                            GITS_TYPER, CIDBITS) + 1));
+-        return ret;
-+            } else {
+-    }
-+                /* 16-bit CollectionId supported when CIL == 0 */
+-    vfp_set_fpsr(env, fpr);
-+                s->ct.maxids.max_collids = (1UL << 16);
++    return 0;
 +            }
 +
 +            s->ct.base_addr = baser_base_addr(value, page_sz);
 +
 +            break;
 +
 +        default:
 +            break;
 +        }
 +    }
 +}
-+
-+static void extract_cmdq_params(GICv3ITSState *s)
+-    reg.addr = (uintptr_t)(&fpr);
 -    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
 +/*
 + * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
 + * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
 + * code the slice index to zero for now as it's unlikely we'll need more than
 + * one slice for quite some time.
 + */
 +static int kvm_arch_get_sve(CPUState *cs)
 +{
-+    uint16_t num_pages = 0;
++    ARMCPU *cpu = ARM_CPU(cs);
-+    uint64_t value = s->cbaser;
++    CPUARMState *env = &cpu->env;
-+
++    struct kvm_one_reg reg;
-+    num_pages = FIELD_EX64(value, GITS_CBASER, SIZE) + 1;
++    uint64_t *r;
-+
++    int n, ret;
-+    memset(&s->cq, 0 , sizeof(s->cq));
++
-+    s->cq.valid = FIELD_EX64(value, GITS_CBASER, VALID);
++    for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
-+
++        r = &env->vfp.zregs[n].d[0];
-+    if (s->cq.valid) {
++        reg.addr = (uintptr_t)r;
-+        s->cq.max_entries = (num_pages * GITS_PAGE_SIZE_4K) /
++        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
-+                             GITS_CMDQ_ENTRY_SIZE;
++        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-+        s->cq.base_addr = FIELD_EX64(value, GITS_CBASER, PHYADDR);
++        if (ret) {
-+        s->cq.base_addr <<= R_GITS_CBASER_PHYADDR_SHIFT;
++            return ret;
-+    }
++        }
-+}
++        sve_bswap64(r, r, cpu->sve_max_vq * 2);
-+
++    }
- static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
++
-                                                uint64_t data, unsigned size,
++    for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
-                                                MemTxAttrs attrs)
++        r = &env->vfp.pregs[n].p[0];
-@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
++        reg.addr = (uintptr_t)r;
-                               uint64_t value, MemTxAttrs attrs)
++        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
- {
++        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-     bool result = true;
++        if (ret) {
-+    int index;
++            return ret;
++        }
-+    switch (offset) {
++        sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
-+    case GITS_CTLR:
++    }
-+        s->ctlr |= (value & ~(s->ctlr));
++
-+
++    r = &env->vfp.pregs[FFR_PRED_NUM].p[0];
-+        if (s->ctlr & ITS_CTLR_ENABLED) {
++    reg.addr = (uintptr_t)r;
-+            extract_table_params(s);
++    reg.id = KVM_REG_ARM64_SVE_FFR(0);
-+            extract_cmdq_params(s);
+     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-+            s->creadr = 0;
+     if (ret) {
-+        }
+         return ret;
-+        break;
+     }
-+    case GITS_CBASER:
+-    vfp_set_fpcr(env, fpr);
-+        /*
++    sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
-+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
-+         *                 already enabled
+     return 0;
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            s->cbaser = deposit64(s->cbaser, 0, 32, value);
 +            s->creadr = 0;
 +            s->cwriter = s->creadr;
 +        }
 +        break;
 +    case GITS_CBASER + 4:
 +        /*
 +         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            s->cbaser = deposit64(s->cbaser, 32, 32, value);
 +            s->creadr = 0;
 +            s->cwriter = s->creadr;
 +        }
 +        break;
 +    case GITS_CWRITER:
 +        s->cwriter = deposit64(s->cwriter, 0, 32,
 +                               (value & ~R_GITS_CWRITER_RETRY_MASK));
 +        break;
 +    case GITS_CWRITER + 4:
 +        s->cwriter = deposit64(s->cwriter, 32, 32, value);
 +        break;
 +    case GITS_CREADR:
 +        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
 +            s->creadr = deposit64(s->creadr, 0, 32,
 +                                  (value & ~R_GITS_CREADR_STALLED_MASK));
 +        } else {
 +            /* RO register, ignore the write */
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid guest write to RO register at offset "
 +                          TARGET_FMT_plx "\n", __func__, offset);
 +        }
 +        break;
 +    case GITS_CREADR + 4:
 +        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
 +            s->creadr = deposit64(s->creadr, 32, 32, value);
 +        } else {
 +            /* RO register, ignore the write */
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid guest write to RO register at offset "
 +                          TARGET_FMT_plx "\n", __func__, offset);
 +        }
 +        break;
 +    case GITS_BASER ... GITS_BASER + 0x3f:
 +        /*
 +         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            index = (offset - GITS_BASER) / 8;
 +
 +            if (offset & 7) {
 +                value <<= 32;
 +                value &= ~GITS_BASER_RO_MASK;
 +                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(0, 32);
 +                s->baser[index] |= value;
 +            } else {
 +                value &= ~GITS_BASER_RO_MASK;
 +                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(32, 32);
 +                s->baser[index] |= value;
 +            }
 +        }
 +        break;
 +    case GITS_IIDR:
 +    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
 +        /* RO registers, ignore the write */
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid guest write to RO register at offset "
 +                      TARGET_FMT_plx "\n", __func__, offset);
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
      return result;
  }
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
-@@ -XXX,XX +XXX,XX @@ static bool its_readl(GICv3ITSState *s, hwaddr offset,
+     struct kvm_one_reg reg;
-                              uint64_t *data, MemTxAttrs attrs)
+     uint64_t val;
- {
+     unsigned int el;
-     bool result = true;
++    uint32_t fpr;
-+    int index;
+     int i, ret;
-+    switch (offset) {
+     ARMCPU *cpu = ARM_CPU(cs);
-+    case GITS_CTLR:
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
-+        *data = s->ctlr;
+         env->spsr = env->banked_spsr[i];
-+        break;
+     }
-+    case GITS_IIDR:
-+        *data = gicv3_iidr();
+-    ret = kvm_arch_get_fpsimd(cs);
-+        break;
++    if (cpu_isar_feature(aa64_sve, cpu)) {
-+    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
++        ret = kvm_arch_get_sve(cs);
-+        /* ID registers */
++    } else {
-+        *data = gicv3_idreg(offset - GITS_IDREGS);
++        ret = kvm_arch_get_fpsimd(cs);
-+        break;
++    }
-+    case GITS_TYPER:
+     if (ret) {
-+        *data = extract64(s->typer, 0, 32);
+         return ret;
-+        break;
+     }
-+    case GITS_TYPER + 4:
-+        *data = extract64(s->typer, 32, 32);
++    reg.addr = (uintptr_t)(&fpr);
-+        break;
++    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-+    case GITS_CBASER:
++    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-+        *data = extract64(s->cbaser, 0, 32);
++    if (ret) {
-+        break;
++        return ret;
-+    case GITS_CBASER + 4:
++    }
-+        *data = extract64(s->cbaser, 32, 32);
++    vfp_set_fpsr(env, fpr);
-+        break;
++
-+    case GITS_CREADR:
++    reg.addr = (uintptr_t)(&fpr);
-+        *data = extract64(s->creadr, 0, 32);
++    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
-+        break;
++    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-+    case GITS_CREADR + 4:
++    if (ret) {
-+        *data = extract64(s->creadr, 32, 32);
++        return ret;
-+        break;
++    }
-+    case GITS_CWRITER:
++    vfp_set_fpcr(env, fpr);
-+        *data = extract64(s->cwriter, 0, 32);
++
-+        break;
+     ret = kvm_get_vcpu_events(cpu);
-+    case GITS_CWRITER + 4:
+     if (ret) {
-+        *data = extract64(s->cwriter, 32, 32);
+         return ret;
 +        break;
 +    case GITS_BASER ... GITS_BASER + 0x3f:
 +        index = (offset - GITS_BASER) / 8;
 +        if (offset & 7) {
 +            *data = extract64(s->baser[index], 32, 32);
 +        } else {
 +            *data = extract64(s->baser[index], 0, 32);
 +        }
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
      return result;
  }
@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
                                 uint64_t value, MemTxAttrs attrs)
  {
      bool result = true;
 +    int index;
 +    switch (offset) {
 +    case GITS_BASER ... GITS_BASER + 0x3f:
 +        /*
 +         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            index = (offset - GITS_BASER) / 8;
 +            s->baser[index] &= GITS_BASER_RO_MASK;
 +            s->baser[index] |= (value & ~GITS_BASER_RO_MASK);
 +        }
 +        break;
 +    case GITS_CBASER:
 +        /*
 +         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
 +         *                 already enabled
 +         */
 +        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +            s->cbaser = value;
 +            s->creadr = 0;
 +            s->cwriter = s->creadr;
 +        }
 +        break;
 +    case GITS_CWRITER:
 +        s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
 +        break;
 +    case GITS_CREADR:
 +        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
 +            s->creadr = value & ~R_GITS_CREADR_STALLED_MASK;
 +        } else {
 +            /* RO register, ignore the write */
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "%s: invalid guest write to RO register at offset "
 +                          TARGET_FMT_plx "\n", __func__, offset);
 +        }
 +        break;
 +    case GITS_TYPER:
 +        /* RO registers, ignore the write */
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid guest write to RO register at offset "
 +                      TARGET_FMT_plx "\n", __func__, offset);
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
      return result;
  }
@@ -XXX,XX +XXX,XX @@ static bool its_readll(GICv3ITSState *s, hwaddr offset,
                                uint64_t *data, MemTxAttrs attrs)
  {
      bool result = true;
 +    int index;
 +    switch (offset) {
 +    case GITS_TYPER:
 +        *data = s->typer;
 +        break;
 +    case GITS_BASER ... GITS_BASER + 0x3f:
 +        index = (offset - GITS_BASER) / 8;
 +        *data = s->baser[index];
 +        break;
 +    case GITS_CBASER:
 +        *data = s->cbaser;
 +        break;
 +    case GITS_CREADR:
 +        *data = s->creadr;
 +        break;
 +    case GITS_CWRITER:
 +        *data = s->cwriter;
 +        break;
 +    default:
 +        result = false;
 +        break;
 +    }
      return result;
  }
@@ -XXX,XX +XXX,XX @@ static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
      gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
 +    address_space_init(&s->gicv3->dma_as, s->gicv3->dma,
 +                       "gicv3-its-sysmem");
 +
      /* set the ITS default features supported */
      s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
                            GITS_TYPE_PHYSICAL);
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_reset(DeviceState *dev)
                               GITS_CTE_SIZE - 1);
  }
 +static void gicv3_its_post_load(GICv3ITSState *s)
 +{
 +    if (s->ctlr & ITS_CTLR_ENABLED) {
 +        extract_table_params(s);
 +        extract_cmdq_params(s);
 +    }
 +}
 +
  static Property gicv3_its_props[] = {
      DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
                       GICv3State *),
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_class_init(ObjectClass *klass, void *data)
  {
      DeviceClass *dc = DEVICE_CLASS(klass);
      GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
 +    GICv3ITSCommonClass *icc = ARM_GICV3_ITS_COMMON_CLASS(klass);
      dc->realize = gicv3_arm_its_realize;
      device_class_set_props(dc, gicv3_its_props);
      device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
 +    icc->post_load = gicv3_its_post_load;
  }
  static const TypeInfo gicv3_its_info = {
 --
 .20.1

-[PULL 19/23] target/arm: Merge disas_a64_insn into aarch64_tr_translate_insn
+[PULL 06/11] target/arm/kvm64: max cpu: Enable SVE when available
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-It is confusing to have different exits from translation
+Enable SVE in the KVM guest when the 'max' cpu type is configured
-for various conditions in separate functions.
+and KVM supports it. KVM SVE requires use of the new finalize
+vcpu ioctl, so we add that now too. For starters SVE can only be
-Merge disas_a64_insn into its only caller.  Standardize
+turned on or off, getting all vector lengths the host CPU supports
-on the "s" name for the DisasContext, as the code from
+when on. We'll add the other SVE CPU properties in later patches.
-disas_a64_insn had more instances.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20210821195958.41312-3-richard.henderson@linaro.org
+Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
 Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
 Message-id: 20191031142734.8590-7-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-a64.c | 224 ++++++++++++++++++-------------------
+ target/arm/kvm_arm.h     | 27 +++++++++++++++++++++++++++
-file changed, 109 insertions(+), 115 deletions(-)
+ target/arm/cpu64.c       | 17 ++++++++++++++---
+ target/arm/kvm.c         |  5 +++++
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+ target/arm/kvm64.c       | 20 +++++++++++++++++++-
-index XXXXXXX..XXXXXXX 100644
+ tests/arm-cpu-features.c |  4 ++++
---- a/target/arm/translate-a64.c
+files changed, 69 insertions(+), 4 deletions(-)
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static bool btype_destination_ok(uint32_t insn, bool bt, int btype)
+diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm_arm.h
 +++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@
   */
  int kvm_arm_vcpu_init(CPUState *cs);
 +/**
 + * kvm_arm_vcpu_finalize
 + * @cs: CPUState
 + * @feature: int
 + *
 + * Finalizes the configuration of the specified VCPU feature by
 + * invoking the KVM_ARM_VCPU_FINALIZE ioctl. Features requiring
 + * this are documented in the "KVM_ARM_VCPU_FINALIZE" section of
 + * KVM's API documentation.
 + *
 + * Returns: 0 if success else < 0 error code
 + */
 +int kvm_arm_vcpu_finalize(CPUState *cs, int feature);
 +
  /**
   * kvm_arm_register_device:
   * @mr: memory region for this device
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_aarch32_supported(CPUState *cs);
   */
  bool kvm_arm_pmu_supported(CPUState *cs);
 +/**
 + * bool kvm_arm_sve_supported:
 + * @cs: CPUState
 + *
 + * Returns true if the KVM VCPU can enable SVE and false otherwise.
 + */
 +bool kvm_arm_sve_supported(CPUState *cs);
 +
  /**
   * kvm_arm_get_max_vm_ipa_size - Returns the number of bits in the
   * IPA address space supported by KVM
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_pmu_supported(CPUState *cs)
      return false;
  }
--/* C3.1 A64 instruction index by encoding */
++static inline bool kvm_arm_sve_supported(CPUState *cs)
--static void disas_a64_insn(CPUARMState *env, DisasContext *s)
++{
--{
++    return false;
--    uint32_t insn;
++}
--
++
--    s->pc_curr = s->base.pc_next;
+ static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
 -    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
 -    s->insn = insn;
 -    s->base.pc_next += 4;
 -
 -    s->fp_access_checked = false;
 -    s->sve_access_checked = false;
 -
 -    if (s->pstate_il) {
 -        /*
 -         * Illegal execution state. This has priority over BTI
 -         * exceptions, but comes after instruction abort exceptions.
 -         */
 -        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 -                           syn_illegalstate(), default_exception_el(s));
 -        return;
 -    }
 -
 -    if (dc_isar_feature(aa64_bti, s)) {
 -        if (s->base.num_insns == 1) {
 -            /*
 -             * At the first insn of the TB, compute s->guarded_page.
 -             * We delayed computing this until successfully reading
 -             * the first insn of the TB, above.  This (mostly) ensures
 -             * that the softmmu tlb entry has been populated, and the
 -             * page table GP bit is available.
 -             *
 -             * Note that we need to compute this even if btype == 0,
 -             * because this value is used for BR instructions later
 -             * where ENV is not available.
 -             */
 -            s->guarded_page = is_guarded_page(env, s);
 -
 -            /* First insn can have btype set to non-zero.  */
 -            tcg_debug_assert(s->btype >= 0);
 -
 -            /*
 -             * Note that the Branch Target Exception has fairly high
 -             * priority -- below debugging exceptions but above most
 -             * everything else.  This allows us to handle this now
 -             * instead of waiting until the insn is otherwise decoded.
 -             */
 -            if (s->btype != 0
 -                && s->guarded_page
 -                && !btype_destination_ok(insn, s->bt, s->btype)) {
 -                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 -                                   syn_btitrap(s->btype),
 -                                   default_exception_el(s));
 -                return;
 -            }
 -        } else {
 -            /* Not the first insn: btype must be 0.  */
 -            tcg_debug_assert(s->btype == 0);
 -        }
 -    }
 -
 -    switch (extract32(insn, 25, 4)) {
 -    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
 -        unallocated_encoding(s);
 -        break;
 -    case 0x2:
 -        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
 -            unallocated_encoding(s);
 -        }
 -        break;
 -    case 0x8: case 0x9: /* Data processing - immediate */
 -        disas_data_proc_imm(s, insn);
 -        break;
 -    case 0xa: case 0xb: /* Branch, exception generation and system insns */
 -        disas_b_exc_sys(s, insn);
 -        break;
 -    case 0x4:
 -    case 0x6:
 -    case 0xc:
 -    case 0xe:      /* Loads and stores */
 -        disas_ldst(s, insn);
 -        break;
 -    case 0x5:
 -    case 0xd:      /* Data processing - register */
 -        disas_data_proc_reg(s, insn);
 -        break;
 -    case 0x7:
 -    case 0xf:      /* Data processing - SIMD and floating point */
 -        disas_data_proc_simd_fp(s, insn);
 -        break;
 -    default:
 -        assert(FALSE); /* all 15 cases should be handled above */
 -        break;
 -    }
 -
 -    /* if we allocated any temporaries, free them here */
 -    free_tmp_a64(s);
 -
 -    /*
 -     * After execution of most insns, btype is reset to 0.
 -     * Note that we set btype == -1 when the insn sets btype.
 -     */
 -    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
 -        reset_btype(s);
 -    }
 -}
 -
  static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
                                            CPUState *cpu)
  {
-@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
+     return -ENOENT;
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
- static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+index XXXXXXX..XXXXXXX 100644
- {
+--- a/target/arm/cpu64.c
--    DisasContext *dc = container_of(dcbase, DisasContext, base);
++++ b/target/arm/cpu64.c
-+    DisasContext *s = container_of(dcbase, DisasContext, base);
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
-     CPUARMState *env = cpu->env_ptr;
+         return;
-+    uint32_t insn;
+     }
--    if (dc->ss_active && !dc->pstate_ss) {
++    if (value && kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
-+    if (s->ss_active && !s->pstate_ss) {
++        error_setg(errp, "'sve' feature not supported by KVM on this host");
          /* Singlestep state is Active-pending.
           * If we're in this state at the start of a TB then either
           *  a) we just took an exception to an EL which is being debugged
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
           * "did not step an insn" case, and so the syndrome ISV and EX
           * bits should be zero.
           */
 -        assert(dc->base.num_insns == 1);
 -        gen_swstep_exception(dc, 0, 0);
 -        dc->base.is_jmp = DISAS_NORETURN;
 -    } else {
 -        disas_a64_insn(env, dc);
 +        assert(s->base.num_insns == 1);
 +        gen_swstep_exception(s, 0, 0);
 +        s->base.is_jmp = DISAS_NORETURN;
 +        return;
      }
 -    translator_loop_temp_check(&dc->base);
 +    s->pc_curr = s->base.pc_next;
 +    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
 +    s->insn = insn;
 +    s->base.pc_next += 4;
 +
 +    s->fp_access_checked = false;
 +    s->sve_access_checked = false;
 +
 +    if (s->pstate_il) {
 +        /*
 +         * Illegal execution state. This has priority over BTI
 +         * exceptions, but comes after instruction abort exceptions.
 +         */
 +        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
 +                           syn_illegalstate(), default_exception_el(s));
 +        return;
 +    }
 +
-+    if (dc_isar_feature(aa64_bti, s)) {
+     t = cpu->isar.id_aa64pfr0;
-+        if (s->base.num_insns == 1) {
+     t = FIELD_DP64(t, ID_AA64PFR0, SVE, value);
-+            /*
+     cpu->isar.id_aa64pfr0 = t;
-+             * At the first insn of the TB, compute s->guarded_page.
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-+             * We delayed computing this until successfully reading
+ {
-+             * the first insn of the TB, above.  This (mostly) ensures
+     ARMCPU *cpu = ARM_CPU(obj);
-+             * that the softmmu tlb entry has been populated, and the
+     uint32_t vq;
-+             * page table GP bit is available.
++    uint64_t t;
-+             *
-+             * Note that we need to compute this even if btype == 0,
+     if (kvm_enabled()) {
-+             * because this value is used for BR instructions later
+         kvm_arm_set_cpu_features_from_host(cpu);
-+             * where ENV is not available.
++        if (kvm_arm_sve_supported(CPU(cpu))) {
-+             */
++            t = cpu->isar.id_aa64pfr0;
-+            s->guarded_page = is_guarded_page(env, s);
++            t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-+
++            cpu->isar.id_aa64pfr0 = t;
-+            /* First insn can have btype set to non-zero.  */
++        }
-+            tcg_debug_assert(s->btype >= 0);
+     } else {
-+
+-        uint64_t t;
-+            /*
+         uint32_t u;
-+             * Note that the Branch Target Exception has fairly high
+         aarch64_a57_initfn(obj);
-+             * priority -- below debugging exceptions but above most
-+             * everything else.  This allows us to handle this now
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-+             * instead of waiting until the insn is otherwise decoded.
-+             */
+         object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
-+            if (s->btype != 0
+                             cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
-+                && s->guarded_page
+-        object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
-+                && !btype_destination_ok(insn, s->bt, s->btype)) {
+-                            cpu_arm_set_sve, NULL, NULL, &error_fatal);
-+                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-+                                   syn_btitrap(s->btype),
+         for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
-+                                   default_exception_el(s));
+             char name[8];
-+                return;
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-+            }
+                                 cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
-+        } else {
+         }
-+            /* Not the first insn: btype must be 0.  */
+     }
-+            tcg_debug_assert(s->btype == 0);
++
 +    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
 +                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
  }
  struct ARMCPUInfo {
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vcpu_init(CPUState *cs)
      return kvm_vcpu_ioctl(cs, KVM_ARM_VCPU_INIT, &init);
  }
 +int kvm_arm_vcpu_finalize(CPUState *cs, int feature)
 +{
 +    return kvm_vcpu_ioctl(cs, KVM_ARM_VCPU_FINALIZE, &feature);
 +}
 +
  void kvm_arm_init_serror_injection(CPUState *cs)
  {
      cap_has_inject_serror_esr = kvm_check_extension(cs->kvm_state,
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_aarch32_supported(CPUState *cpu)
      return kvm_check_extension(s, KVM_CAP_ARM_EL1_32BIT);
  }
 +bool kvm_arm_sve_supported(CPUState *cpu)
 +{
 +    KVMState *s = KVM_STATE(current_machine->accelerator);
 +
 +    return kvm_check_extension(s, KVM_CAP_ARM_SVE);
 +}
 +
  #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
  int kvm_arch_init_vcpu(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
          cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_EL1_32BIT;
      }
      if (!kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PMU_V3)) {
 -            cpu->has_pmu = false;
 +        cpu->has_pmu = false;
      }
      if (cpu->has_pmu) {
          cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PMU_V3;
      } else {
          unset_feature(&env->features, ARM_FEATURE_PMU);
      }
 +    if (cpu_isar_feature(aa64_sve, cpu)) {
 +        assert(kvm_arm_sve_supported(cs));
 +        cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_SVE;
 +    }
      /* Do KVM_ARM_VCPU_INIT ioctl */
      ret = kvm_arm_vcpu_init(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
          return ret;
      }
 +    if (cpu_isar_feature(aa64_sve, cpu)) {
 +        ret = kvm_arm_vcpu_finalize(cs, KVM_ARM_VCPU_SVE);
 +        if (ret) {
 +            return ret;
 +        }
 +    }
 +
-+    switch (extract32(insn, 25, 4)) {
+     /*
-+    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
+      * When KVM is in use, PSCI is emulated in-kernel and not by qemu.
-+        unallocated_encoding(s);
+      * Currently KVM has its own idea about MPIDR assignment, so we
-+        break;
+diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
-+    case 0x2:
+index XXXXXXX..XXXXXXX 100644
-+        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
+--- a/tests/arm-cpu-features.c
-+            unallocated_encoding(s);
++++ b/tests/arm-cpu-features.c
-+        }
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-+        break;
+         assert_has_feature(qts, "host", "aarch64");
-+    case 0x8: case 0x9: /* Data processing - immediate */
+         assert_has_feature(qts, "host", "pmu");
-+        disas_data_proc_imm(s, insn);
-+        break;
++        assert_has_feature(qts, "max", "sve");
-+    case 0xa: case 0xb: /* Branch, exception generation and system insns */
++
-+        disas_b_exc_sys(s, insn);
+         assert_error(qts, "cortex-a15",
-+        break;
+             "We cannot guarantee the CPU type 'cortex-a15' works "
-+    case 0x4:
+             "with KVM on this host", NULL);
-+    case 0x6:
+     } else {
-+    case 0xc:
+         assert_has_not_feature(qts, "host", "aarch64");
-+    case 0xe:      /* Loads and stores */
+         assert_has_not_feature(qts, "host", "pmu");
-+        disas_ldst(s, insn);
++
-+        break;
++        assert_has_not_feature(qts, "max", "sve");
-+    case 0x5:
+     }
-+    case 0xd:      /* Data processing - register */
-+        disas_data_proc_reg(s, insn);
+     qtest_quit(qts);
 +        break;
 +    case 0x7:
 +    case 0xf:      /* Data processing - SIMD and floating point */
 +        disas_data_proc_simd_fp(s, insn);
 +        break;
 +    default:
 +        assert(FALSE); /* all 15 cases should be handled above */
 +        break;
 +    }
 +
 +    /* if we allocated any temporaries, free them here */
 +    free_tmp_a64(s);
 +
 +    /*
 +     * After execution of most insns, btype is reset to 0.
 +     * Note that we set btype == -1 when the insn sets btype.
 +     */
 +    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
 +        reset_btype(s);
 +    }
 +
 +    translator_loop_temp_check(&s->base);
  }
  static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
 --
 .20.1

-[PULL 07/23] hw/arm/virt: KVM: Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
+[PULL 07/11] target/arm/kvm: scratch vcpu: Preserve input kvm_vcpu_init features
-From: Marc Zyngier <maz@kernel.org>
+From: Andrew Jones <drjones@redhat.com>
-Although we probe for the IPA limits imposed by KVM (and the hardware)
+kvm_arm_create_scratch_host_vcpu() takes a struct kvm_vcpu_init
-when computing the memory map, we still use the old style '0' when
+parameter. Rather than just using it as an output parameter to
-creating a scratch VM in kvm_arm_create_scratch_host_vcpu().
+pass back the preferred target, use it also as an input parameter,
 allowing a caller to pass a selected target if they wish and to
 also pass cpu features. If the caller doesn't want to select a
 target they can pass -1 for the target which indicates they want
 to use the preferred target and have it passed back like before.
-On systems that are severely IPA challenged (such as the Apple M1),
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-this results in a failure as KVM cannot use the default 40bit that
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-'0' represents.
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
-Instead, probe for the extension and use the reported IPA limit
+Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
-if available.
+Message-id: 20191031142734.8590-8-drjones@redhat.com
 Cc: Andrew Jones <drjones@redhat.com>
 Cc: Eric Auger <eric.auger@redhat.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Reviewed-by: Andrew Jones <drjones@redhat.com>
 Message-id: 20210822144441.1290891-2-maz@kernel.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/kvm.c | 7 ++++++-
+ target/arm/kvm.c   | 20 +++++++++++++++-----
-file changed, 6 insertions(+), 1 deletion(-)
+ target/arm/kvm32.c |  6 +++++-
  target/arm/kvm64.c |  6 +++++-
 files changed, 25 insertions(+), 7 deletions(-)
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
 @@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
+                                       int *fdarray,
                                        struct kvm_vcpu_init *init)
  {
-     int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
+-    int ret, kvmfd = -1, vmfd = -1, cpufd = -1;
-+    int max_vm_pa_size;
++    int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
-     kvmfd = qemu_open_old("/dev/kvm", O_RDWR);
+     kvmfd = qemu_open("/dev/kvm", O_RDWR);
      if (kvmfd < 0) {
-         goto err;
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
          goto finish;
      }
--    vmfd = ioctl(kvmfd, KVM_CREATE_VM, 0);
-+    max_vm_pa_size = ioctl(kvmfd, KVM_CHECK_EXTENSION, KVM_CAP_ARM_VM_IPA_SIZE);
+-    ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, init);
-+    if (max_vm_pa_size < 0) {
++    if (init->target == -1) {
-+        max_vm_pa_size = 0;
++        struct kvm_vcpu_init preferred;
 +
 +        ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, &preferred);
 +        if (!ret) {
 +            init->target = preferred.target;
 +        }
 +    }
-+    vmfd = ioctl(kvmfd, KVM_CREATE_VM, max_vm_pa_size);
+     if (ret >= 0) {
-     if (vmfd < 0) {
+         ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
-         goto err;
+         if (ret < 0) {
-     }
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
           * creating one kind of guest CPU which is its preferred
           * CPU type.
           */
 +        struct kvm_vcpu_init try;
 +
          while (*cpus_to_try != QEMU_KVM_ARM_TARGET_NONE) {
 -            init->target = *cpus_to_try++;
 -            memset(init->features, 0, sizeof(init->features));
 -            ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
 +            try.target = *cpus_to_try++;
 +            memcpy(try.features, init->features, sizeof(init->features));
 +            ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, &try);
              if (ret >= 0) {
                  break;
              }
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
          if (ret < 0) {
              goto err;
          }
 +        init->target = try.target;
      } else {
          /* Treat a NULL cpus_to_try argument the same as an empty
           * list, which means we will fail the call since this must
 diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm32.c
 +++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          QEMU_KVM_ARM_TARGET_CORTEX_A15,
          QEMU_KVM_ARM_TARGET_NONE
      };
 -    struct kvm_vcpu_init init;
 +    /*
 +     * target = -1 informs kvm_arm_create_scratch_host_vcpu()
 +     * to use the preferred target
 +     */
 +    struct kvm_vcpu_init init = { .target = -1, };
      if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
          return false;
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          KVM_ARM_TARGET_CORTEX_A57,
          QEMU_KVM_ARM_TARGET_NONE
      };
 -    struct kvm_vcpu_init init;
 +    /*
 +     * target = -1 informs kvm_arm_create_scratch_host_vcpu()
 +     * to use the preferred target
 +     */
 +    struct kvm_vcpu_init init = { .target = -1, };
      if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
          return false;
 --
 .20.1

-[PULL 11/23] hw/intc: GICv3 ITS command queue framework
+[PULL 08/11] target/arm/cpu64: max cpu: Support sve properties with KVM
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-Added functionality to trigger ITS command queue processing on
+Extend the SVE vq map initialization and validation with KVM's
-write to CWRITE register and process each command queue entry to
+supported vector lengths when KVM is enabled. In order to determine
-identify the command type and handle commands like MAPD,MAPC,SYNC.
+and select supported lengths we add two new KVM functions for getting
 and setting the KVM_REG_ARM64_SVE_VLS pseudo-register.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
+This patch has been co-authored with Richard Henderson, who reworked
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+the target/arm/cpu64.c changes in order to push all the validation and
 auto-enabling/disabling steps into the finalizer, resulting in a nice
 LOC reduction.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Tested-by: Neil Armstrong <narmstrong@baylibre.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210910143951.92242-4-shashi.mallela@linaro.org
+Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
 Message-id: 20191031142734.8590-9-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/gicv3_internal.h |  40 +++++
+ target/arm/kvm_arm.h      |  12 +++
- hw/intc/arm_gicv3_its.c  | 319 +++++++++++++++++++++++++++++++++++++++
+ target/arm/cpu64.c        | 176 ++++++++++++++++++++++++++++----------
-files changed, 359 insertions(+)
+ target/arm/kvm64.c        | 100 +++++++++++++++++++++-
  tests/arm-cpu-features.c  | 104 +++++++++++++++++++++-
  docs/arm-cpu-features.rst |  45 +++++++---
 files changed, 379 insertions(+), 58 deletions(-)
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
+diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
+--- a/target/arm/kvm_arm.h
-+++ b/hw/intc/gicv3_internal.h
++++ b/target/arm/kvm_arm.h
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMHostCPUFeatures {
- #define L1TABLE_ENTRY_SIZE         8
+  */
+ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf);
- #define GITS_CMDQ_ENTRY_SIZE               32
-+#define NUM_BYTES_IN_DW                     8
++/**
-+
++ * kvm_arm_sve_get_vls:
-+#define CMD_MASK                  0xff
++ * @cs: CPUState
-+
++ * @map: bitmap to fill in
-+/* ITS Commands */
++ *
-+#define GITS_CMD_CLEAR            0x04
++ * Get all the SVE vector lengths supported by the KVM host, setting
-+#define GITS_CMD_DISCARD          0x0F
++ * the bits corresponding to their length in quadwords minus one
-+#define GITS_CMD_INT              0x03
++ * (vq - 1) in @map up to ARM_MAX_VQ.
-+#define GITS_CMD_MAPC             0x09
++ */
-+#define GITS_CMD_MAPD             0x08
++void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map);
-+#define GITS_CMD_MAPI             0x0B
++
 +#define GITS_CMD_MAPTI            0x0A
 +#define GITS_CMD_INV              0x0C
 +#define GITS_CMD_INVALL           0x0D
 +#define GITS_CMD_SYNC             0x05
 +
 +/* MAPC command fields */
 +#define ICID_LENGTH                  16
 +#define ICID_MASK                 ((1U << ICID_LENGTH) - 1)
 +FIELD(MAPC, RDBASE, 16, 32)
 +
 +#define RDBASE_PROCNUM_LENGTH        16
 +#define RDBASE_PROCNUM_MASK       ((1ULL << RDBASE_PROCNUM_LENGTH) - 1)
 +
 +/* MAPD command fields */
 +#define ITTADDR_LENGTH               44
 +#define ITTADDR_SHIFT                 8
 +#define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
 +#define SIZE_MASK                 0x1f
 +
 +#define DEVID_SHIFT                  32
 +#define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
 +
 +#define VALID_SHIFT               63
 +#define CMD_FIELD_VALID_MASK      (1ULL << VALID_SHIFT)
 +#define L2_TABLE_VALID_MASK       CMD_FIELD_VALID_MASK
 +#define TABLE_ENTRY_VALID_MASK    (1ULL << 0)
  /**
-  * Default features advertised by this version of ITS
+  * kvm_arm_set_cpu_features_from_host:
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
+  * @cpu: ARMCPU to set the features for
-  * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
+@@ -XXX,XX +XXX,XX @@ static inline int kvm_arm_vgic_probe(void)
-  */
+ static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq) {}
- #define GITS_DTE_SIZE                 (0x8ULL)
+ static inline void kvm_arm_pmu_init(CPUState *cs) {}
-+#define GITS_DTE_ITTADDR_SHIFT           6
-+#define GITS_DTE_ITTADDR_MASK         MAKE_64BIT_MASK(GITS_DTE_ITTADDR_SHIFT, \
++static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map) {}
-+                                                      ITTADDR_LENGTH)
+ #endif
- /*
+ static inline const char *gic_class_name(void)
-  * 8 bytes Collection Table Entry size
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its.c
+--- a/target/arm/cpu64.c
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
-     return result;
+      * any of the above.  Finally, if SVE is not disabled, then at least one
       * vector length must be enabled.
       */
 +    DECLARE_BITMAP(kvm_supported, ARM_MAX_VQ);
      DECLARE_BITMAP(tmp, ARM_MAX_VQ);
      uint32_t vq, max_vq = 0;
 +    /* Collect the set of vector lengths supported by KVM. */
 +    bitmap_zero(kvm_supported, ARM_MAX_VQ);
 +    if (kvm_enabled() && kvm_arm_sve_supported(CPU(cpu))) {
 +        kvm_arm_sve_get_vls(CPU(cpu), kvm_supported);
 +    } else if (kvm_enabled()) {
 +        assert(!cpu_isar_feature(aa64_sve, cpu));
 +    }
 +
      /*
       * Process explicit sve<N> properties.
       * From the properties, sve_vq_map<N> implies sve_vq_init<N>.
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
              return;
          }
 -        /* Propagate enabled bits down through required powers-of-two. */
 -        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
 -            if (!test_bit(vq - 1, cpu->sve_vq_init)) {
 -                set_bit(vq - 1, cpu->sve_vq_map);
 +        if (kvm_enabled()) {
 +            /*
 +             * For KVM we have to automatically enable all supported unitialized
 +             * lengths, even when the smaller lengths are not all powers-of-two.
 +             */
 +            bitmap_andnot(tmp, kvm_supported, cpu->sve_vq_init, max_vq);
 +            bitmap_or(cpu->sve_vq_map, cpu->sve_vq_map, tmp, max_vq);
 +        } else {
 +            /* Propagate enabled bits down through required powers-of-two. */
 +            for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
 +                if (!test_bit(vq - 1, cpu->sve_vq_init)) {
 +                    set_bit(vq - 1, cpu->sve_vq_map);
 +                }
              }
          }
      } else if (cpu->sve_max_vq == 0) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
              return;
          }
 -        /* Disabling a power-of-two disables all larger lengths. */
 -        if (test_bit(0, cpu->sve_vq_init)) {
 -            error_setg(errp, "cannot disable sve128");
 -            error_append_hint(errp, "Disabling sve128 results in all vector "
 -                              "lengths being disabled.\n");
 -            error_append_hint(errp, "With SVE enabled, at least one vector "
 -                              "length must be enabled.\n");
 -            return;
 -        }
 -        for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
 -            if (test_bit(vq - 1, cpu->sve_vq_init)) {
 -                break;
 +        if (kvm_enabled()) {
 +            /* Disabling a supported length disables all larger lengths. */
 +            for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 +                if (test_bit(vq - 1, cpu->sve_vq_init) &&
 +                    test_bit(vq - 1, kvm_supported)) {
 +                    break;
 +                }
              }
 +            max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
 +            bitmap_andnot(cpu->sve_vq_map, kvm_supported,
 +                          cpu->sve_vq_init, max_vq);
 +            if (max_vq == 0 || bitmap_empty(cpu->sve_vq_map, max_vq)) {
 +                error_setg(errp, "cannot disable sve%d", vq * 128);
 +                error_append_hint(errp, "Disabling sve%d results in all "
 +                                  "vector lengths being disabled.\n",
 +                                  vq * 128);
 +                error_append_hint(errp, "With SVE enabled, at least one "
 +                                  "vector length must be enabled.\n");
 +                return;
 +            }
 +        } else {
 +            /* Disabling a power-of-two disables all larger lengths. */
 +            if (test_bit(0, cpu->sve_vq_init)) {
 +                error_setg(errp, "cannot disable sve128");
 +                error_append_hint(errp, "Disabling sve128 results in all "
 +                                  "vector lengths being disabled.\n");
 +                error_append_hint(errp, "With SVE enabled, at least one "
 +                                  "vector length must be enabled.\n");
 +                return;
 +            }
 +            for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
 +                if (test_bit(vq - 1, cpu->sve_vq_init)) {
 +                    break;
 +                }
 +            }
 +            max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
 +            bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
          }
 -        max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
 -        bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
          max_vq = find_last_bit(cpu->sve_vq_map, max_vq) + 1;
      }
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
      assert(max_vq != 0);
      bitmap_clear(cpu->sve_vq_map, max_vq, ARM_MAX_VQ - max_vq);
 -    /* Ensure all required powers-of-two are enabled. */
 -    for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
 -        if (!test_bit(vq - 1, cpu->sve_vq_map)) {
 -            error_setg(errp, "cannot disable sve%d", vq * 128);
 -            error_append_hint(errp, "sve%d is required as it "
 -                              "is a power-of-two length smaller than "
 -                              "the maximum, sve%d\n",
 -                              vq * 128, max_vq * 128);
 +    if (kvm_enabled()) {
 +        /* Ensure the set of lengths matches what KVM supports. */
 +        bitmap_xor(tmp, cpu->sve_vq_map, kvm_supported, max_vq);
 +        if (!bitmap_empty(tmp, max_vq)) {
 +            vq = find_last_bit(tmp, max_vq) + 1;
 +            if (test_bit(vq - 1, cpu->sve_vq_map)) {
 +                if (cpu->sve_max_vq) {
 +                    error_setg(errp, "cannot set sve-max-vq=%d",
 +                               cpu->sve_max_vq);
 +                    error_append_hint(errp, "This KVM host does not support "
 +                                      "the vector length %d-bits.\n",
 +                                      vq * 128);
 +                    error_append_hint(errp, "It may not be possible to use "
 +                                      "sve-max-vq with this KVM host. Try "
 +                                      "using only sve<N> properties.\n");
 +                } else {
 +                    error_setg(errp, "cannot enable sve%d", vq * 128);
 +                    error_append_hint(errp, "This KVM host does not support "
 +                                      "the vector length %d-bits.\n",
 +                                      vq * 128);
 +                }
 +            } else {
 +                error_setg(errp, "cannot disable sve%d", vq * 128);
 +                error_append_hint(errp, "The KVM host requires all "
 +                                  "supported vector lengths smaller "
 +                                  "than %d bits to also be enabled.\n",
 +                                  max_vq * 128);
 +            }
              return;
          }
 +    } else {
 +        /* Ensure all required powers-of-two are enabled. */
 +        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
 +            if (!test_bit(vq - 1, cpu->sve_vq_map)) {
 +                error_setg(errp, "cannot disable sve%d", vq * 128);
 +                error_append_hint(errp, "sve%d is required as it "
 +                                  "is a power-of-two length smaller than "
 +                                  "the maximum, sve%d\n",
 +                                  vq * 128, max_vq * 128);
 +                return;
 +            }
 +        }
      }
      /*
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
  {
      ARMCPU *cpu = ARM_CPU(obj);
      Error *err = NULL;
 +    uint32_t max_vq;
 -    visit_type_uint32(v, name, &cpu->sve_max_vq, &err);
 -
 -    if (!err && (cpu->sve_max_vq == 0 || cpu->sve_max_vq > ARM_MAX_VQ)) {
 -        error_setg(&err, "unsupported SVE vector length");
 -        error_append_hint(&err, "Valid sve-max-vq in range [1-%d]\n",
 -                          ARM_MAX_VQ);
 +    visit_type_uint32(v, name, &max_vq, &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
      }
 -    error_propagate(errp, err);
 +
 +    if (kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
 +        error_setg(errp, "cannot set sve-max-vq");
 +        error_append_hint(errp, "SVE not supported by KVM on this host\n");
 +        return;
 +    }
 +
 +    if (max_vq == 0 || max_vq > ARM_MAX_VQ) {
 +        error_setg(errp, "unsupported SVE vector length");
 +        error_append_hint(errp, "Valid sve-max-vq in range [1-%d]\n",
 +                          ARM_MAX_VQ);
 +        return;
 +    }
 +
 +    cpu->sve_max_vq = max_vq;
  }
-+static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
+ static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
-+                       uint64_t rdbase)
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
          return;
      }
 +    if (value && kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
 +        error_setg(errp, "cannot enable %s", name);
 +        error_append_hint(errp, "SVE not supported by KVM on this host\n");
 +        return;
 +    }
 +
      if (value) {
          set_bit(vq - 1, cpu->sve_vq_map);
      } else {
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
          cpu->dcz_blocksize = 7; /*  512 bytes */
  #endif
 -
 -        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
 -                            cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
 -
 -        for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 -            char name[8];
 -            sprintf(name, "sve%d", vq * 128);
 -            object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
 -                                cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
 -        }
      }
      object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
                          cpu_arm_set_sve, NULL, NULL, &error_fatal);
 +    object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
 +                        cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
 +
 +    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 +        char name[8];
 +        sprintf(name, "sve%d", vq * 128);
 +        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
 +                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
 +    }
  }
  struct ARMCPUInfo {
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_sve_supported(CPUState *cpu)
      return kvm_check_extension(s, KVM_CAP_ARM_SVE);
  }
 +QEMU_BUILD_BUG_ON(KVM_ARM64_SVE_VQ_MIN != 1);
 +
 +void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
 +{
-+    AddressSpace *as = &s->gicv3->dma_as;
++    /* Only call this function if kvm_arm_sve_supported() returns true. */
-+    uint64_t value;
++    static uint64_t vls[KVM_ARM64_SVE_VLS_WORDS];
-+    uint64_t l2t_addr;
++    static bool probed;
-+    bool valid_l2t;
++    uint32_t vq = 0;
-+    uint32_t l2t_id;
++    int i, j;
-+    uint32_t max_l2_entries;
++
-+    uint64_t cte = 0;
++    bitmap_clear(map, 0, ARM_MAX_VQ);
 +    MemTxResult res = MEMTX_OK;
 +
 +    if (!s->ct.valid) {
 +        return true;
 +    }
 +
 +    if (valid) {
 +        /* add mapping entry to collection table */
 +        cte = (valid & TABLE_ENTRY_VALID_MASK) | (rdbase << 1ULL);
 +    }
 +
 +    /*
-+     * The specification defines the format of level 1 entries of a
++     * KVM ensures all host CPUs support the same set of vector lengths.
-+     * 2-level table, but the format of level 2 entries and the format
++     * So we only need to create the scratch VCPUs once and then cache
-+     * of flat-mapped tables is IMPDEF.
++     * the results.
 +     */
-+    if (s->ct.indirect) {
++    if (!probed) {
-+        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
++        struct kvm_vcpu_init init = {
-+
++            .target = -1,
-+        value = address_space_ldq_le(as,
++            .features[0] = (1 << KVM_ARM_VCPU_SVE),
-+                                     s->ct.base_addr +
++        };
-+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
++        struct kvm_one_reg reg = {
-+                                     MEMTXATTRS_UNSPECIFIED, &res);
++            .id = KVM_REG_ARM64_SVE_VLS,
-+
++            .addr = (uint64_t)&vls[0],
-+        if (res != MEMTX_OK) {
++        };
-+            return false;
++        int fdarray[3], ret;
-+        }
++
-+
++        probed = true;
-+        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
++
-+
++        if (!kvm_arm_create_scratch_host_vcpu(NULL, fdarray, &init)) {
-+        if (valid_l2t) {
++            error_report("failed to create scratch VCPU with SVE enabled");
-+            max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
++            abort();
-+
++        }
-+            l2t_addr = value & ((1ULL << 51) - 1);
++        ret = ioctl(fdarray[2], KVM_GET_ONE_REG, &reg);
-+
++        kvm_arm_destroy_scratch_host_vcpu(fdarray);
-+            address_space_stq_le(as, l2t_addr +
++        if (ret) {
-+                                 ((icid % max_l2_entries) * GITS_CTE_SIZE),
++            error_report("failed to get KVM_REG_ARM64_SVE_VLS: %s",
-+                                 cte, MEMTXATTRS_UNSPECIFIED, &res);
++                         strerror(errno));
-+        }
++            abort();
-+    } else {
++        }
-+        /* Flat level table */
++
-+        address_space_stq_le(as, s->ct.base_addr + (icid * GITS_CTE_SIZE),
++        for (i = KVM_ARM64_SVE_VLS_WORDS - 1; i >= 0; --i) {
-+                             cte, MEMTXATTRS_UNSPECIFIED, &res);
++            if (vls[i]) {
-+    }
++                vq = 64 - clz64(vls[i]) + i * 64;
-+    if (res != MEMTX_OK) {
++                break;
-+        return false;
++            }
-+    } else {
++        }
-+        return true;
++        if (vq > ARM_MAX_VQ) {
 +            warn_report("KVM supports vector lengths larger than "
 +                        "QEMU can enable");
 +        }
 +    }
 +
 +    for (i = 0; i < KVM_ARM64_SVE_VLS_WORDS; ++i) {
 +        if (!vls[i]) {
 +            continue;
 +        }
 +        for (j = 1; j <= 64; ++j) {
 +            vq = j + i * 64;
 +            if (vq > ARM_MAX_VQ) {
 +                return;
 +            }
 +            if (vls[i] & (1UL << (j - 1))) {
 +                set_bit(vq - 1, map);
 +            }
 +        }
 +    }
 +}
 +
-+static bool process_mapc(GICv3ITSState *s, uint32_t offset)
++static int kvm_arm_sve_set_vls(CPUState *cs)
 +{
-+    AddressSpace *as = &s->gicv3->dma_as;
++    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = {0};
-+    uint16_t icid;
++    struct kvm_one_reg reg = {
-+    uint64_t rdbase;
++        .id = KVM_REG_ARM64_SVE_VLS,
-+    bool valid;
++        .addr = (uint64_t)&vls[0],
-+    MemTxResult res = MEMTX_OK;
++    };
-+    bool result = false;
++    ARMCPU *cpu = ARM_CPU(cs);
-+    uint64_t value;
++    uint32_t vq;
-+
++    int i, j;
-+    offset += NUM_BYTES_IN_DW;
++
-+    offset += NUM_BYTES_IN_DW;
++    assert(cpu->sve_max_vq <= KVM_ARM64_SVE_VQ_MAX);
 +
-+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
++    for (vq = 1; vq <= cpu->sve_max_vq; ++vq) {
-+                                 MEMTXATTRS_UNSPECIFIED, &res);
++        if (test_bit(vq - 1, cpu->sve_vq_map)) {
-+
++            i = (vq - 1) / 64;
-+    if (res != MEMTX_OK) {
++            j = (vq - 1) % 64;
-+        return result;
++            vls[i] |= 1UL << j;
-+    }
++        }
-+
++    }
-+    icid = value & ICID_MASK;
++
-+
++    return kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    rdbase = (value & R_MAPC_RDBASE_MASK) >> R_MAPC_RDBASE_SHIFT;
 +    rdbase &= RDBASE_PROCNUM_MASK;
 +
 +    valid = (value & CMD_FIELD_VALID_MASK);
 +
 +    if ((icid > s->ct.maxids.max_collids) || (rdbase > s->gicv3->num_cpu)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "ITS MAPC: invalid collection table attributes "
 +                      "icid %d rdbase %lu\n",  icid, rdbase);
 +        /*
 +         * in this implementation, in case of error
 +         * we ignore this command and move onto the next
 +         * command in the queue
 +         */
 +    } else {
 +        result = update_cte(s, icid, valid, rdbase);
 +    }
 +
 +    return result;
 +}
 +
-+static bool update_dte(GICv3ITSState *s, uint32_t devid, bool valid,
+ #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
-+                       uint8_t size, uint64_t itt_addr)
  int kvm_arch_init_vcpu(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
      if (cpu->kvm_target == QEMU_KVM_ARM_TARGET_NONE ||
          !object_dynamic_cast(OBJECT(cpu), TYPE_AARCH64_CPU)) {
 -        fprintf(stderr, "KVM is not supported for this guest CPU type\n");
 +        error_report("KVM is not supported for this guest CPU type");
          return -EINVAL;
      }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
      }
      if (cpu_isar_feature(aa64_sve, cpu)) {
 +        ret = kvm_arm_sve_set_vls(cs);
 +        if (ret) {
 +            return ret;
 +        }
          ret = kvm_arm_vcpu_finalize(cs, KVM_ARM_VCPU_SVE);
          if (ret) {
              return ret;
 diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/arm-cpu-features.c
 +++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static QDict *resp_get_props(QDict *resp)
      return qdict;
  }
 +static bool resp_get_feature(QDict *resp, const char *feature)
 +{
-+    AddressSpace *as = &s->gicv3->dma_as;
++    QDict *props;
-+    uint64_t value;
++
-+    uint64_t l2t_addr;
++    g_assert(resp);
-+    bool valid_l2t;
++    g_assert(resp_has_props(resp));
-+    uint32_t l2t_id;
++    props = resp_get_props(resp);
-+    uint32_t max_l2_entries;
++    g_assert(qdict_get(props, feature));
-+    uint64_t dte = 0;
++    return qdict_get_bool(props, feature);
-+    MemTxResult res = MEMTX_OK;
++}
 +
-+    if (s->dt.valid) {
+ #define assert_has_feature(qts, cpu_type, feature)                     \
-+        if (valid) {
+ ({                                                                     \
-+            /* add mapping entry to device table */
+     QDict *_resp = do_query_no_props(qts, cpu_type);                   \
-+            dte = (valid & TABLE_ENTRY_VALID_MASK) |
+@@ -XXX,XX +XXX,XX @@ static void sve_tests_sve_off(const void *data)
-+                  ((size & SIZE_MASK) << 1U) |
+     qtest_quit(qts);
-+                  (itt_addr << GITS_DTE_ITTADDR_SHIFT);
+ }
-+        }
-+    } else {
++static void sve_tests_sve_off_kvm(const void *data)
-+        return true;
++{
-+    }
++    QTestState *qts;
 +
 +    qts = qtest_init(MACHINE_KVM "-cpu max,sve=off");
 +
 +    /*
-+     * The specification defines the format of level 1 entries of a
++     * We don't know if this host supports SVE so we don't
-+     * 2-level table, but the format of level 2 entries and the format
++     * attempt to test enabling anything. We only test that
-+     * of flat-mapped tables is IMPDEF.
++     * everything is disabled (as it should be with sve=off)
 +     * and that using sve<N>=off to explicitly disable vector
 +     * lengths is OK too.
 +     */
-+    if (s->dt.indirect) {
++    assert_sve_vls(qts, "max", 0, NULL);
-+        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
++    assert_sve_vls(qts, "max", 0, "{ 'sve128': false }");
 +
-+        value = address_space_ldq_le(as,
++    qtest_quit(qts);
 +                                     s->dt.base_addr +
 +                                     (l2t_id * L1TABLE_ENTRY_SIZE),
 +                                     MEMTXATTRS_UNSPECIFIED, &res);
 +
 +        if (res != MEMTX_OK) {
 +            return false;
 +        }
 +
 +        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
 +
 +        if (valid_l2t) {
 +            max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
 +
 +            l2t_addr = value & ((1ULL << 51) - 1);
 +
 +            address_space_stq_le(as, l2t_addr +
 +                                 ((devid % max_l2_entries) * GITS_DTE_SIZE),
 +                                 dte, MEMTXATTRS_UNSPECIFIED, &res);
 +        }
 +    } else {
 +        /* Flat level table */
 +        address_space_stq_le(as, s->dt.base_addr + (devid * GITS_DTE_SIZE),
 +                             dte, MEMTXATTRS_UNSPECIFIED, &res);
 +    }
 +    if (res != MEMTX_OK) {
 +        return false;
 +    } else {
 +        return true;
 +    }
 +}
 +
-+static bool process_mapd(GICv3ITSState *s, uint64_t value, uint32_t offset)
+ static void test_query_cpu_model_expansion(const void *data)
-+{
+ {
-+    AddressSpace *as = &s->gicv3->dma_as;
+     QTestState *qts;
-+    uint32_t devid;
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-+    uint8_t size;
+     }
-+    uint64_t itt_addr;
-+    bool valid;
+     if (g_str_equal(qtest_get_arch(), "aarch64")) {
-+    MemTxResult res = MEMTX_OK;
++        bool kvm_supports_sve;
-+    bool result = false;
++        char max_name[8], name[8];
-+
++        uint32_t max_vq, vq;
-+    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
++        uint64_t vls;
-+
++        QDict *resp;
-+    offset += NUM_BYTES_IN_DW;
++        char *error;
-+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
++
-+                                 MEMTXATTRS_UNSPECIFIED, &res);
+         assert_has_feature(qts, "host", "aarch64");
-+
+         assert_has_feature(qts, "host", "pmu");
-+    if (res != MEMTX_OK) {
-+        return result;
+-        assert_has_feature(qts, "max", "sve");
-+    }
+-
-+
+         assert_error(qts, "cortex-a15",
-+    size = (value & SIZE_MASK);
+             "We cannot guarantee the CPU type 'cortex-a15' works "
-+
+             "with KVM on this host", NULL);
-+    offset += NUM_BYTES_IN_DW;
++
-+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
++        assert_has_feature(qts, "max", "sve");
-+                                 MEMTXATTRS_UNSPECIFIED, &res);
++        resp = do_query_no_props(qts, "max");
-+
++        kvm_supports_sve = resp_get_feature(resp, "sve");
-+    if (res != MEMTX_OK) {
++        vls = resp_get_sve_vls(resp);
-+        return result;
++        qobject_unref(resp);
-+    }
++
-+
++        if (kvm_supports_sve) {
-+    itt_addr = (value & ITTADDR_MASK) >> ITTADDR_SHIFT;
++            g_assert(vls != 0);
-+
++            max_vq = 64 - __builtin_clzll(vls);
-+    valid = (value & CMD_FIELD_VALID_MASK);
++            sprintf(max_name, "sve%d", max_vq * 128);
 +
-+    if ((devid > s->dt.maxids.max_devids) ||
++            /* Enabling a supported length is of course fine. */
-+        (size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS))) {
++            assert_sve_vls(qts, "max", vls, "{ %s: true }", max_name);
-+        qemu_log_mask(LOG_GUEST_ERROR,
++
-+                      "ITS MAPD: invalid device table attributes "
++            /* Get the next supported length smaller than max-vq. */
-+                      "devid %d or size %d\n", devid, size);
++            vq = 64 - __builtin_clzll(vls & ~BIT_ULL(max_vq - 1));
-+        /*
++            if (vq) {
-+         * in this implementation, in case of error
++                /*
-+         * we ignore this command and move onto the next
++                 * We have at least one length smaller than max-vq,
-+         * command in the queue
++                 * so we can disable max-vq.
-+         */
++                 */
-+    } else {
++                assert_sve_vls(qts, "max", (vls & ~BIT_ULL(max_vq - 1)),
-+        result = update_dte(s, devid, valid, size, itt_addr);
++                               "{ %s: false }", max_name);
-+    }
++
-+
++                /*
-+    return result;
++                 * Smaller, supported vector lengths cannot be disabled
-+}
++                 * unless all larger, supported vector lengths are also
-+
++                 * disabled.
-+/*
++                 */
-+ * Current implementation blocks until all
++                sprintf(name, "sve%d", vq * 128);
-+ * commands are processed
++                error = g_strdup_printf("cannot disable %s", name);
-+ */
++                assert_error(qts, "max", error,
-+static void process_cmdq(GICv3ITSState *s)
++                             "{ %s: true, %s: false }",
-+{
++                             max_name, name);
-+    uint32_t wr_offset = 0;
++                g_free(error);
-+    uint32_t rd_offset = 0;
++            }
-+    uint32_t cq_offset = 0;
++
 +    uint64_t data;
 +    AddressSpace *as = &s->gicv3->dma_as;
 +    MemTxResult res = MEMTX_OK;
 +    bool result = true;
 +    uint8_t cmd;
 +
 +    if (!(s->ctlr & ITS_CTLR_ENABLED)) {
 +        return;
 +    }
 +
 +    wr_offset = FIELD_EX64(s->cwriter, GITS_CWRITER, OFFSET);
 +
 +    if (wr_offset > s->cq.max_entries) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid write offset "
 +                      "%d\n", __func__, wr_offset);
 +        return;
 +    }
 +
 +    rd_offset = FIELD_EX64(s->creadr, GITS_CREADR, OFFSET);
 +
 +    if (rd_offset > s->cq.max_entries) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: invalid read offset "
 +                      "%d\n", __func__, rd_offset);
 +        return;
 +    }
 +
 +    while (wr_offset != rd_offset) {
 +        cq_offset = (rd_offset * GITS_CMDQ_ENTRY_SIZE);
 +        data = address_space_ldq_le(as, s->cq.base_addr + cq_offset,
 +                                    MEMTXATTRS_UNSPECIFIED, &res);
 +        if (res != MEMTX_OK) {
 +            result = false;
 +        }
 +        cmd = (data & CMD_MASK);
 +
 +        switch (cmd) {
 +        case GITS_CMD_INT:
 +            break;
 +        case GITS_CMD_CLEAR:
 +            break;
 +        case GITS_CMD_SYNC:
 +            /*
-+             * Current implementation makes a blocking synchronous call
++             * The smallest, supported vector length is required, because
-+             * for every command issued earlier, hence the internal state
++             * we need at least one vector length enabled.
 +             * is already consistent by the time SYNC command is executed.
 +             * Hence no further processing is required for SYNC command.
 +             */
-+            break;
++            vq = __builtin_ffsll(vls);
-+        case GITS_CMD_MAPD:
++            sprintf(name, "sve%d", vq * 128);
-+            result = process_mapd(s, data, cq_offset);
++            error = g_strdup_printf("cannot disable %s", name);
-+            break;
++            assert_error(qts, "max", error, "{ %s: false }", name);
-+        case GITS_CMD_MAPC:
++            g_free(error);
-+            result = process_mapc(s, cq_offset);
++
-+            break;
++            /* Get an unsupported length. */
-+        case GITS_CMD_MAPTI:
++            for (vq = 1; vq <= max_vq; ++vq) {
-+            break;
++                if (!(vls & BIT_ULL(vq - 1))) {
-+        case GITS_CMD_MAPI:
++                    break;
-+            break;
++                }
-+        case GITS_CMD_DISCARD:
++            }
-+            break;
++            if (vq <= SVE_MAX_VQ) {
-+        case GITS_CMD_INV:
++                sprintf(name, "sve%d", vq * 128);
-+        case GITS_CMD_INVALL:
++                error = g_strdup_printf("cannot enable %s", name);
-+            break;
++                assert_error(qts, "max", error, "{ %s: true }", name);
-+        default:
++                g_free(error);
-+            break;
++            }
 +        }
 +        if (result) {
 +            rd_offset++;
 +            rd_offset %= s->cq.max_entries;
 +            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, OFFSET, rd_offset);
 +        } else {
-+            /*
++            g_assert(vls == 0);
-+             * in this implementation, in case of dma read/write error
++        }
-+             * we stall the command processing
+     } else {
-+             */
+         assert_has_not_feature(qts, "host", "aarch64");
-+            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
+         assert_has_not_feature(qts, "host", "pmu");
-+            qemu_log_mask(LOG_GUEST_ERROR,
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
-+                          "%s: %x cmd processing failed\n", __func__, cmd);
+                             NULL, sve_tests_sve_max_vq_8);
-+            break;
+         qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
-+        }
+                             NULL, sve_tests_sve_off);
-+    }
++        qtest_add_data_func("/arm/kvm/query-cpu-model-expansion/sve-off",
-+}
++                            NULL, sve_tests_sve_off_kvm);
-+
+     }
- /*
-  * This function extracts the ITS Device and Collection table specific
+     return g_test_run();
-  * parameters (like base_addr, size etc) from GITS_BASER register.
+diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
-@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
+index XXXXXXX..XXXXXXX 100644
-             extract_table_params(s);
+--- a/docs/arm-cpu-features.rst
-             extract_cmdq_params(s);
++++ b/docs/arm-cpu-features.rst
-             s->creadr = 0;
+@@ -XXX,XX +XXX,XX @@ SVE CPU Property Dependencies and Constraints
-+            process_cmdq(s);
-         }
+) At least one vector length must be enabled when `sve` is enabled.
-         break;
-     case GITS_CBASER:
+-  2) If a vector length `N` is enabled, then all power-of-two vector
-@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
+-     lengths smaller than `N` must also be enabled.  E.g. if `sve512`
-     case GITS_CWRITER:
+-     is enabled, then the 128-bit and 256-bit vector lengths must also
-         s->cwriter = deposit64(s->cwriter, 0, 32,
+-     be enabled.
-                                (value & ~R_GITS_CWRITER_RETRY_MASK));
++  2) If a vector length `N` is enabled, then, when KVM is enabled, all
-+        if (s->cwriter != s->creadr) {
++     smaller, host supported vector lengths must also be enabled.  If
-+            process_cmdq(s);
++     KVM is not enabled, then only all the smaller, power-of-two vector
-+        }
++     lengths must be enabled.  E.g. with KVM if the host supports all
-         break;
++     vector lengths up to 512-bits (128, 256, 384, 512), then if `sve512`
-     case GITS_CWRITER + 4:
++     is enabled, the 128-bit vector length, 256-bit vector length, and
-         s->cwriter = deposit64(s->cwriter, 32, 32, value);
++     384-bit vector length must also be enabled. Without KVM, the 384-bit
-@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
++     vector length would not be required.
-         break;
++
-     case GITS_CWRITER:
++  3) If KVM is enabled then only vector lengths that the host CPU type
-         s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
++     support may be enabled.  If SVE is not supported by the host, then
-+        if (s->cwriter != s->creadr) {
++     no `sve*` properties may be enabled.
-+            process_cmdq(s);
-+        }
+ SVE CPU Property Parsing Semantics
-         break;
+ ----------------------------------
-     case GITS_CREADR:
+@@ -XXX,XX +XXX,XX @@ SVE CPU Property Parsing Semantics
-         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
+      an error is generated.
 ) If SVE is enabled (`sve=on`), but no `sve<N>` CPU properties are
 -     provided, then all supported vector lengths are enabled, including
 -     the non-power-of-two lengths.
 +     provided, then all supported vector lengths are enabled, which when
 +     KVM is not in use means including the non-power-of-two lengths, and,
 +     when KVM is in use, it means all vector lengths supported by the host
 +     processor.
 ) If SVE is enabled, then an error is generated when attempting to
       disable the last enabled vector length (see constraint (1) of "SVE
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Parsing Semantics
       has been explicitly disabled, then an error is generated (see
       constraint (2) of "SVE CPU Property Dependencies and Constraints").
 -  5) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
 +  5) When KVM is enabled, if the host does not support SVE, then an error
 +     is generated when attempting to enable any `sve*` properties (see
 +     constraint (3) of "SVE CPU Property Dependencies and Constraints").
 +
 +  6) When KVM is enabled, if the host does support SVE, then an error is
 +     generated when attempting to enable any vector lengths not supported
 +     by the host (see constraint (3) of "SVE CPU Property Dependencies and
 +     Constraints").
 +
 +  7) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
       CPU properties are set `on`, then the specified vector lengths are
       disabled but the default for any unspecified lengths remains enabled.
 -     Disabling a power-of-two vector length also disables all vector
 -     lengths larger than the power-of-two length (see constraint (2) of
 -     "SVE CPU Property Dependencies and Constraints").
 +     When KVM is not enabled, disabling a power-of-two vector length also
 +     disables all vector lengths larger than the power-of-two length.
 +     When KVM is enabled, then disabling any supported vector length also
 +     disables all larger vector lengths (see constraint (2) of "SVE CPU
 +     Property Dependencies and Constraints").
 -  6) If one or more `sve<N>` CPU properties are set to `on`, then they
 +  8) If one or more `sve<N>` CPU properties are set to `on`, then they
       are enabled and all unspecified lengths default to disabled, except
       for the required lengths per constraint (2) of "SVE CPU Property
       Dependencies and Constraints", which will even be auto-enabled if
       they were not explicitly enabled.
 -  7) If SVE was disabled (`sve=off`), allowing all vector lengths to be
 +  9) If SVE was disabled (`sve=off`), allowing all vector lengths to be
       explicitly disabled (i.e. avoiding the error specified in (3) of
       "SVE CPU Property Parsing Semantics"), then if later an `sve=on` is
       provided an error will be generated.  To avoid this error, one must
 --
 .20.1

-[PULL 18/23] target/arm: Take an exception if PSTATE.IL is set
+[PULL 09/11] target/arm/kvm: host cpu: Add support for sve<N> properties
-In v8A, the PSTATE.IL bit is set for various kinds of illegal
+From: Andrew Jones <drjones@redhat.com>
-exception return or mode-change attempts.  We already set PSTATE.IL
-(or its AArch32 equivalent CPSR.IL) in all those cases, but we
+Allow cpu 'host' to enable SVE when it's available, unless the
-weren't implementing the part of the behaviour where attempting to
+user chooses to disable it with the added 'sve=off' cpu property.
-execute an instruction with PSTATE.IL takes an immediate exception
+Also give the user the ability to select vector lengths with the
-with an appropriate syndrome value.
+sve<N> properties. We don't adopt 'max' cpu's other sve property,
+sve-max-vq, because that property is difficult to use with KVM.
-Add a new TB flags bit tracking PSTATE.IL/CPSR.IL, and generate code
+That property assumes all vector lengths in the range from 1 up
-to take an exception instead of whatever the instruction would have
+to and including the specified maximum length are supported, but
-been.
+there may be optional lengths not supported by the host in that
+range. With KVM one must be more specific when enabling vector
-PSTATE.IL and CPSR.IL change only on exception entry, attempted
+lengths.
-exception exit, and various AArch32 mode changes via cpsr_write().
-These places generally already rebuild the hflags, so the only place
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-we need an extra rebuild_hflags call is in the illegal-return
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-codepath of the AArch64 exception_return helper.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
 Message-id: 20191031142734.8590-10-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210821195958.41312-2-richard.henderson@linaro.org
-Message-Id: <20210817162118.24319-1-peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-[rth: Added missing returns; set IL bit in syndrome]
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- target/arm/cpu.h           |  1 +
+ target/arm/cpu.h          |  2 ++
- target/arm/syndrome.h      |  5 +++++
+ target/arm/cpu.c          |  3 +++
- target/arm/translate.h     |  2 ++
+ target/arm/cpu64.c        | 33 +++++++++++++++++----------------
- target/arm/helper-a64.c    |  1 +
+ target/arm/kvm64.c        | 14 +++++++++++++-
- target/arm/helper.c        |  8 ++++++++
+ tests/arm-cpu-features.c  | 17 ++++++++---------
- target/arm/translate-a64.c | 11 +++++++++++
+ docs/arm-cpu-features.rst | 19 ++++++++++++-------
- target/arm/translate.c     | 21 +++++++++++++++++++++
+files changed, 55 insertions(+), 33 deletions(-)
 files changed, 49 insertions(+)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
+@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
- FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
+ void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
- /* Memory operations require alignment: SCTLR_ELx.A or CCR.UNALIGN_TRP */
+ void aarch64_sve_change_el(CPUARMState *env, int old_el,
- FIELD(TBFLAG_ANY, ALIGN_MEM, 12, 1)
+                            int new_el, bool el0_a64);
-+FIELD(TBFLAG_ANY, PSTATE__IL, 13, 1)
++void aarch64_add_sve_properties(Object *obj);
+ #else
- /*
+ static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
-  * Bit usage when in AArch32 state, both A- and M-profile.
+ static inline void aarch64_sve_change_el(CPUARMState *env, int o,
-diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
+                                          int n, bool a)
-index XXXXXXX..XXXXXXX 100644
+ { }
---- a/target/arm/syndrome.h
++static inline void aarch64_add_sve_properties(Object *obj) { }
-+++ b/target/arm/syndrome.h
+ #endif
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_wfx(int cv, int cond, int ti, bool is_16bit)
-            (cv << 24) | (cond << 20) | ti;
+ #if !defined(CONFIG_TCG)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_host_initfn(Object *obj)
      ARMCPU *cpu = ARM_CPU(obj);
      kvm_arm_set_cpu_features_from_host(cpu);
 +    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
 +        aarch64_add_sve_properties(obj);
 +    }
      arm_cpu_post_init(obj);
  }
-+static inline uint32_t syn_illegalstate(void)
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
      cpu->isar.id_aa64pfr0 = t;
  }
 +void aarch64_add_sve_properties(Object *obj)
 +{
-+    return (EC_ILLEGALSTATE << ARM_EL_EC_SHIFT) | ARM_EL_IL;
++    uint32_t vq;
 +
 +    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
 +                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
 +
 +    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 +        char name[8];
 +        sprintf(name, "sve%d", vq * 128);
 +        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
 +                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
 +    }
 +}
 +
- #endif /* TARGET_ARM_SYNDROME_H */
+ /* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
-diff --git a/target/arm/translate.h b/target/arm/translate.h
+  * otherwise, a CPU with as many features enabled as our emulation supports.
-index XXXXXXX..XXXXXXX 100644
+  * The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
---- a/target/arm/translate.h
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
-+++ b/target/arm/translate.h
+ static void aarch64_max_initfn(Object *obj)
-@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
+ {
-     bool hstr_active;
+     ARMCPU *cpu = ARM_CPU(obj);
-     /* True if memory operations require alignment */
+-    uint32_t vq;
-     bool align_mem;
+-    uint64_t t;
-+    /* True if PSTATE.IL is set */
-+    bool pstate_il;
+     if (kvm_enabled()) {
-     /*
+         kvm_arm_set_cpu_features_from_host(cpu);
-      * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
+-        if (kvm_arm_sve_supported(CPU(cpu))) {
-      *  < 0, set by the current instruction.
+-            t = cpu->isar.id_aa64pfr0;
-diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
+-            t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-index XXXXXXX..XXXXXXX 100644
+-            cpu->isar.id_aa64pfr0 = t;
---- a/target/arm/helper-a64.c
+-        }
-+++ b/target/arm/helper-a64.c
+     } else {
-@@ -XXX,XX +XXX,XX @@ illegal_return:
++        uint64_t t;
-     if (!arm_singlestep_active(env)) {
+         uint32_t u;
-         env->pstate &= ~PSTATE_SS;
+         aarch64_a57_initfn(obj);
-     }
-+    helper_rebuild_hflags_a64(env, cur_el);
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: "
+ #endif
-                   "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc);
+     }
 -    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
 -                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
 +    aarch64_add_sve_properties(obj);
      object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                          cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
 -
 -    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 -        char name[8];
 -        sprintf(name, "sve%d", vq * 128);
 -        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
 -                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
 -    }
  }
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
+ struct ARMCPUInfo {
---- a/target/arm/helper.c
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
-+++ b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
+--- a/target/arm/kvm64.c
-         DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1);
++++ b/target/arm/kvm64.c
-     }
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
+      * and then query that CPU for the relevant ID registers.
-+    if (env->uncached_cpsr & CPSR_IL) {
+      */
-+        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
+     int fdarray[3];
 +    bool sve_supported;
      uint64_t features = 0;
 +    uint64_t t;
      int err;
      /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                                ARM64_SYS_REG(3, 0, 0, 3, 2));
      }
 +    sve_supported = ioctl(fdarray[0], KVM_CHECK_EXTENSION, KVM_CAP_ARM_SVE) > 0;
 +
      kvm_arm_destroy_scratch_host_vcpu(fdarray);
      if (err < 0) {
          return false;
      }
 -   /* We can assume any KVM supporting CPU is at least a v8
 +    /* Add feature bits that can't appear until after VCPU init. */
 +    if (sve_supported) {
 +        t = ahcf->isar.id_aa64pfr0;
 +        t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
 +        ahcf->isar.id_aa64pfr0 = t;
 +    }
 +
-     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
++    /*
- }
++     * We can assume any KVM supporting CPU is at least a v8
+      * with VFPv4+Neon; this in turn implies most of the other
-@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
+      * feature bits.
-         }
+      */
-     }
+diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
+index XXXXXXX..XXXXXXX 100644
-+    if (env->pstate & PSTATE_IL) {
+--- a/tests/arm-cpu-features.c
-+        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
++++ b/tests/arm-cpu-features.c
-+    }
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-+
+             "We cannot guarantee the CPU type 'cortex-a15' works "
-     if (cpu_isar_feature(aa64_mte, env_archcpu(env))) {
+             "with KVM on this host", NULL);
-         /*
-          * Set MTE_ACTIVE if any access may be Checked, and leave clear
+-        assert_has_feature(qts, "max", "sve");
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+-        resp = do_query_no_props(qts, "max");
-index XXXXXXX..XXXXXXX 100644
++        assert_has_feature(qts, "host", "sve");
---- a/target/arm/translate-a64.c
++        resp = do_query_no_props(qts, "host");
-+++ b/target/arm/translate-a64.c
+         kvm_supports_sve = resp_get_feature(resp, "sve");
-@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
+         vls = resp_get_sve_vls(resp);
-     s->fp_access_checked = false;
+         qobject_unref(resp);
-     s->sve_access_checked = false;
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
+             sprintf(max_name, "sve%d", max_vq * 128);
-+    if (s->pstate_il) {
-+        /*
+             /* Enabling a supported length is of course fine. */
-+         * Illegal execution state. This has priority over BTI
+-            assert_sve_vls(qts, "max", vls, "{ %s: true }", max_name);
-+         * exceptions, but comes after instruction abort exceptions.
++            assert_sve_vls(qts, "host", vls, "{ %s: true }", max_name);
-+         */
-+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+             /* Get the next supported length smaller than max-vq. */
-+                           syn_illegalstate(), default_exception_el(s));
+             vq = 64 - __builtin_clzll(vls & ~BIT_ULL(max_vq - 1));
-+        return;
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-+    }
+                  * We have at least one length smaller than max-vq,
-+
+                  * so we can disable max-vq.
-     if (dc_isar_feature(aa64_bti, s)) {
+                  */
-         if (s->base.num_insns == 1) {
+-                assert_sve_vls(qts, "max", (vls & ~BIT_ULL(max_vq - 1)),
-             /*
++                assert_sve_vls(qts, "host", (vls & ~BIT_ULL(max_vq - 1)),
-@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
+                                "{ %s: false }", max_name);
- #endif
-     dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
+                 /*
-     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-+    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
+                  */
-     dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
+                 sprintf(name, "sve%d", vq * 128);
-     dc->sve_len = (EX_TBFLAG_A64(tb_flags, ZCR_LEN) + 1) * 16;
+                 error = g_strdup_printf("cannot disable %s", name);
-     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
+-                assert_error(qts, "max", error,
-diff --git a/target/arm/translate.c b/target/arm/translate.c
++                assert_error(qts, "host", error,
-index XXXXXXX..XXXXXXX 100644
+                              "{ %s: true, %s: false }",
---- a/target/arm/translate.c
+                              max_name, name);
-+++ b/target/arm/translate.c
+                 g_free(error);
-@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-         return;
+             vq = __builtin_ffsll(vls);
-     }
+             sprintf(name, "sve%d", vq * 128);
+             error = g_strdup_printf("cannot disable %s", name);
-+    if (s->pstate_il) {
+-            assert_error(qts, "max", error, "{ %s: false }", name);
-+        /*
++            assert_error(qts, "host", error, "{ %s: false }", name);
-+         * Illegal execution state. This has priority over BTI
+             g_free(error);
-+         * exceptions, but comes after instruction abort exceptions.
-+         */
+             /* Get an unsupported length. */
-+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-+                           syn_illegalstate(), default_exception_el(s));
+             if (vq <= SVE_MAX_VQ) {
-+        return;
+                 sprintf(name, "sve%d", vq * 128);
-+    }
+                 error = g_strdup_printf("cannot enable %s", name);
-+
+-                assert_error(qts, "max", error, "{ %s: true }", name);
-     if (cond == 0xf) {
++                assert_error(qts, "host", error, "{ %s: true }", name);
-         /* In ARMv3 and v4 the NV condition is UNPREDICTABLE; we
+                 g_free(error);
-          * choose to UNDEF. In ARMv5 and above the space is used
+             }
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
+         } else {
- #endif
+@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
-     dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
+     } else {
-     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
+         assert_has_not_feature(qts, "host", "aarch64");
-+    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
+         assert_has_not_feature(qts, "host", "pmu");
+-
-     if (arm_feature(env, ARM_FEATURE_M)) {
+-        assert_has_not_feature(qts, "max", "sve");
-         dc->vfp_enabled = 1;
++        assert_has_not_feature(qts, "host", "sve");
-@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
+     }
-     }
-     dc->insn = insn;
+     qtest_quit(qts);
+diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
-+    if (dc->pstate_il) {
+index XXXXXXX..XXXXXXX 100644
-+        /*
+--- a/docs/arm-cpu-features.rst
-+         * Illegal execution state. This has priority over BTI
++++ b/docs/arm-cpu-features.rst
-+         * exceptions, but comes after instruction abort exceptions.
+@@ -XXX,XX +XXX,XX @@ SVE CPU Property Examples
-+         */
-+        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF,
+      $ qemu-system-aarch64 -M virt -cpu max
-+                           syn_illegalstate(), default_exception_el(dc));
-+        return;
+-  3) Only enable the 128-bit vector length::
-+    }
++  3) When KVM is enabled, implicitly enable all host CPU supported vector
-+
++     lengths with the `host` CPU type::
-     if (dc->eci) {
++
-         /*
++     $ qemu-system-aarch64 -M virt,accel=kvm -cpu host
-          * For M-profile continuable instructions, ECI/ICI handling
++
 +  4) Only enable the 128-bit vector length::
       $ qemu-system-aarch64 -M virt -cpu max,sve128=on
 -  4) Disable the 512-bit vector length and all larger vector lengths,
 +  5) Disable the 512-bit vector length and all larger vector lengths,
       since 512 is a power-of-two.  This results in all the smaller,
       uninitialized lengths (128, 256, and 384) defaulting to enabled::
       $ qemu-system-aarch64 -M virt -cpu max,sve512=off
 -  5) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
 +  6) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
       $ qemu-system-aarch64 -M virt -cpu max,sve128=on,sve256=on,sve512=on
 -  6) The same as (5), but since the 128-bit and 256-bit vector
 +  7) The same as (6), but since the 128-bit and 256-bit vector
       lengths are required for the 512-bit vector length to be enabled,
       then allow them to be auto-enabled::
       $ qemu-system-aarch64 -M virt -cpu max,sve512=on
 -  7) Do the same as (6), but by first disabling SVE and then re-enabling it::
 +  8) Do the same as (7), but by first disabling SVE and then re-enabling it::
       $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve512=on,sve=on
 -  8) Force errors regarding the last vector length::
 +  9) Force errors regarding the last vector length::
       $ qemu-system-aarch64 -M virt -cpu max,sve128=off
       $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve128=off,sve=on
@@ -XXX,XX +XXX,XX @@ The examples in "SVE CPU Property Examples" exhibit many ways to select
  vector lengths which developers may find useful in order to avoid overly
  verbose command lines.  However, the recommended way to select vector
  lengths is to explicitly enable each desired length.  Therefore only
 -example's (1), (3), and (5) exhibit recommended uses of the properties.
 +example's (1), (4), and (6) exhibit recommended uses of the properties.
 --
 .20.1

-[PULL 16/23] hw/arm/virt: add ITS support in virt GIC
+[PULL 10/11] hw/arm/boot: Rebuild hflags when modifying CPUState at boot
-From: Shashi Mallela <shashi.mallela@linaro.org>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-Included creation of ITS as part of virt platform GIC
+Rebuild hflags when modifying CPUState at boot.
 initialization. This Emulated ITS model now co-exists with kvm
 ITS and is enabled in absence of kvm irq kernel support in a
 platform.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
+Fixes: e979972a6a
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Message-id: 20210910143951.92242-9-shashi.mallela@linaro.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Luc Michel <luc.michel@greensocs.com>
 Message-id: 20191031040830.18800-2-edgar.iglesias@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/virt.h |  2 ++
+ hw/arm/boot.c | 1 +
- target/arm/kvm_arm.h  |  4 ++--
+file changed, 1 insertion(+)
  hw/arm/virt.c         | 29 +++++++++++++++++++++++++++--
 files changed, 31 insertions(+), 4 deletions(-)
-diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
+diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/virt.h
+--- a/hw/arm/boot.c
-+++ b/include/hw/arm/virt.h
++++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
+@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
-     MachineClass parent;
+                 info->secondary_cpu_reset_hook(cpu, info);
-     bool disallow_affinity_adjustment;
+             }
-     bool no_its;
+         }
-+    bool no_tcg_its;
++        arm_rebuild_hflags(env);
      bool no_pmu;
      bool claim_edge_triggered_timers;
      bool smbios_old_sys_ver;
@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {
      bool highmem;
      bool highmem_ecam;
      bool its;
 +    bool tcg_its;
      bool virt;
      bool ras;
      bool mte;
 diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm_arm.h
 +++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ static inline const char *its_class_name(void)
          /* KVM implementation requires this capability */
          return kvm_direct_msi_enabled() ? "arm-its-kvm" : NULL;
      } else {
 -        /* Software emulation is not implemented yet */
 -        return NULL;
 +        /* Software emulation based model */
 +        return "arm-gicv3-its";
      }
  }
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_its(VirtMachineState *vms)
-     const char *itsclass = its_class_name();
-     DeviceState *dev;
-+    if (!strcmp(itsclass, "arm-gicv3-its")) {
-+        if (!vms->tcg_its) {
-+            itsclass = NULL;
-+        }
-+    }
-+
-     if (!itsclass) {
-         /* Do nothing if not supported */
-         return;
-@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms)
-     vms->msi_controller = VIRT_MSI_CTRL_GICV2M;
- }
--static void create_gic(VirtMachineState *vms)
-+static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
- {
-     MachineState *ms = MACHINE(vms);
-     /* We create a standalone GIC */
-@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms)
-                              nb_redist_regions);
-         qdev_prop_set_uint32(vms->gic, "redist-region-count[0]", redist0_count);
-+        if (!kvm_irqchip_in_kernel()) {
-+            if (vms->tcg_its) {
-+                object_property_set_link(OBJECT(vms->gic), "sysmem",
-+                                         OBJECT(mem), &error_fatal);
-+                qdev_prop_set_bit(vms->gic, "has-lpi", true);
-+            }
-+        }
-+
-         if (nb_redist_regions == 2) {
-             uint32_t redist1_capacity =
-                     vms->memmap[VIRT_HIGH_GIC_REDIST2].size / GICV3_REDIST_SIZE;
-@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
-     virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
--    create_gic(vms);
-+    create_gic(vms, sysmem);
-     virt_cpu_post_init(vms, sysmem);
-@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
-     } else {
-         /* Default allows ITS instantiation */
-         vms->its = true;
-+
-+        if (vmc->no_tcg_its) {
-+            vms->tcg_its = false;
-+        } else {
-+            vms->tcg_its = true;
-+        }
-     }
-     /* Default disallows iommu instantiation */
-@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(6, 2)
- static void virt_machine_6_1_options(MachineClass *mc)
- {
-+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
-+
-     virt_machine_6_2_options(mc);
-     compat_props_add(mc->compat_props, hw_compat_6_1, hw_compat_6_1_len);
-+
-+    /* qemu ITS was introduced with 6.2 */
-+    vmc->no_tcg_its = true;
- }
- DEFINE_VIRT_MACHINE(6, 1)
 --
 .20.1

-[PULL 03/23] hw/char: cadence_uart: Move clock/reset check to uart_can_receive()
+[PULL 11/11] target/arm: Allow reading flags from FPSCR for M-profile
-From: Bin Meng <bmeng.cn@gmail.com>
+From: Christophe Lyon <christophe.lyon@linaro.org>
-Currently the clock/reset check is done in uart_receive(), but we
+rt==15 is a special case when reading the flags: it means the
-can move the check to uart_can_receive() which is earlier.
+destination is APSR. This patch avoids rejecting
 vmrs apsr_nzcv, fpscr
 as illegal instruction.
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Cc: qemu-stable@nongnu.org
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Christophe Lyon <christophe.lyon@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20191025095711.10853-1-christophe.lyon@linaro.org
-Message-id: 20210901124521.30599-4-bmeng.cn@gmail.com
+[PMM: updated the comment]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/cadence_uart.c | 17 ++++++++++-------
+ target/arm/translate-vfp.inc.c | 5 +++--
-file changed, 10 insertions(+), 7 deletions(-)
+file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cadence_uart.c
+--- a/target/arm/translate-vfp.inc.c
-+++ b/hw/char/cadence_uart.c
++++ b/target/arm/translate-vfp.inc.c
-@@ -XXX,XX +XXX,XX @@ static void uart_parameters_setup(CadenceUARTState *s)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
- static int uart_can_receive(void *opaque)
+     if (arm_dc_feature(s, ARM_FEATURE_M)) {
- {
+         /*
-     CadenceUARTState *s = opaque;
+          * The only M-profile VFP vmrs/vmsr sysreg is FPSCR.
--    int ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
+-         * Writes to R15 are UNPREDICTABLE; we choose to undef.
--    uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
++         * Accesses to R15 are UNPREDICTABLE; we choose to undef.
-+    int ret;
++         * (FPSCR -> r15 is a special case which writes to the PSR flags.)
-+    uint32_t ch_mode;
+          */
-+
+-        if (a->rt == 15 || a->reg != ARM_VFP_FPSCR) {
-+    /* ignore characters when unclocked or in reset */
++        if (a->rt == 15 && (!a->l || a->reg != ARM_VFP_FPSCR)) {
-+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+             return false;
-+        return 0;
+         }
 +    }
 +
 +    ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
 +    ch_mode = s->r[R_MR] & UART_MR_CHMODE;
      if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
          ret = MIN(ret, CADENCE_UART_RX_FIFO_SIZE - s->rx_count);
@@ -XXX,XX +XXX,XX @@ static void uart_receive(void *opaque, const uint8_t *buf, int size)
      CadenceUARTState *s = opaque;
      uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
 -    /* ignore characters when unclocked or in reset */
 -    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
 -        return;
 -    }
 -
      if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
          uart_write_rx_fifo(opaque, buf, size);
      }
 --
 .20.1

-[PULL 04/23] hw/char: cadence_uart: Convert to memop_with_attrs() ops
+Deleted patch
-From: Bin Meng <bmeng.cn@gmail.com>
-This converts uart_read() and uart_write() to memop_with_attrs() ops.
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210901124521.30599-5-bmeng.cn@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/char/cadence_uart.c | 26 +++++++++++++++-----------
-file changed, 15 insertions(+), 11 deletions(-)
-diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cadence_uart.c
-+++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@ static void uart_read_rx_fifo(CadenceUARTState *s, uint32_t *c)
-     uart_update_status(s);
- }
--static void uart_write(void *opaque, hwaddr offset,
--                          uint64_t value, unsigned size)
-+static MemTxResult uart_write(void *opaque, hwaddr offset,
-+                              uint64_t value, unsigned size, MemTxAttrs attrs)
- {
-     CadenceUARTState *s = opaque;
-     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
-     offset >>= 2;
-     if (offset >= CADENCE_UART_R_MAX) {
--        return;
-+        return MEMTX_DECODE_ERROR;
-     }
-     switch (offset) {
-     case R_IER: /* ier (wts imr) */
-@@ -XXX,XX +XXX,XX @@ static void uart_write(void *opaque, hwaddr offset,
-         break;
-     }
-     uart_update_status(s);
-+
-+    return MEMTX_OK;
- }
--static uint64_t uart_read(void *opaque, hwaddr offset,
--        unsigned size)
-+static MemTxResult uart_read(void *opaque, hwaddr offset,
-+                             uint64_t *value, unsigned size, MemTxAttrs attrs)
- {
-     CadenceUARTState *s = opaque;
-     uint32_t c = 0;
-     offset >>= 2;
-     if (offset >= CADENCE_UART_R_MAX) {
--        c = 0;
--    } else if (offset == R_TX_RX) {
-+        return MEMTX_DECODE_ERROR;
-+    }
-+    if (offset == R_TX_RX) {
-         uart_read_rx_fifo(s, &c);
-     } else {
--       c = s->r[offset];
-+        c = s->r[offset];
-     }
-     DB_PRINT(" offset:%x data:%08x\n", (unsigned)(offset << 2), (unsigned)c);
--    return c;
-+    *value = c;
-+    return MEMTX_OK;
- }
- static const MemoryRegionOps uart_ops = {
--    .read = uart_read,
--    .write = uart_write,
-+    .read_with_attrs = uart_read,
-+    .write_with_attrs = uart_write,
-     .endianness = DEVICE_NATIVE_ENDIAN,
- };
---
-.20.1

-[PULL 05/23] hw/char: cadence_uart: Ignore access when unclocked or in reset for uart_{read, write}()
+Deleted patch
-From: Bin Meng <bmeng.cn@gmail.com>
-Read or write to uart registers when unclocked or in reset should be
-ignored. Add the check there, and as a result of this, the check in
-uart_write_tx_fifo() is now unnecessary.
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210901124521.30599-6-bmeng.cn@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/char/cadence_uart.c | 15 ++++++++++-----
-file changed, 10 insertions(+), 5 deletions(-)
-diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cadence_uart.c
-+++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
- static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
-                                int size)
- {
--    /* ignore characters when unclocked or in reset */
--    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
--        return;
--    }
--
-     if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
- {
-     CadenceUARTState *s = opaque;
-+    /* ignore access when unclocked or in reset */
-+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+        return MEMTX_ERROR;
-+    }
-+
-     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
-     offset >>= 2;
-     if (offset >= CADENCE_UART_R_MAX) {
-@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
-     CadenceUARTState *s = opaque;
-     uint32_t c = 0;
-+    /* ignore access when unclocked or in reset */
-+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+        return MEMTX_ERROR;
-+    }
-+
-     offset >>= 2;
-     if (offset >= CADENCE_UART_R_MAX) {
-         return MEMTX_DECODE_ERROR;
---
-.20.1

-[PULL 06/23] hw/char: cadence_uart: Log a guest error when device is unclocked or in reset
+Deleted patch
-From: Bin Meng <bmeng.cn@gmail.com>
-We've got SW that expects FSBL (Bootlooader) to setup clocks and
-resets. It's quite common that users run that SW on QEMU without
-FSBL (FSBL typically requires the Xilinx tools installed). That's
-fine, since users can stil use -device loader to enable clocks etc.
-To help folks understand what's going, a log (guest-error) message
-would be helpful here. In particular with the serial port since
-things will go very quiet if they get things wrong.
-Suggested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20210901124521.30599-7-bmeng.cn@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/char/cadence_uart.c | 8 ++++++++
-file changed, 8 insertions(+)
-diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/char/cadence_uart.c
-+++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@ static int uart_can_receive(void *opaque)
-     /* ignore characters when unclocked or in reset */
-     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
-+                      __func__);
-         return 0;
-     }
-@@ -XXX,XX +XXX,XX @@ static void uart_event(void *opaque, QEMUChrEvent event)
-     /* ignore characters when unclocked or in reset */
-     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
-+                      __func__);
-         return;
-     }
-@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
-     /* ignore access when unclocked or in reset */
-     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
-+                      __func__);
-         return MEMTX_ERROR;
-     }
-@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
-     /* ignore access when unclocked or in reset */
-     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
-+                      __func__);
-         return MEMTX_ERROR;
-     }
---
-.20.1

-[PULL 14/23] hw/intc: GICv3 redistributor ITS processing
+Deleted patch
-From: Shashi Mallela <shashi.mallela@linaro.org>
-Implemented lpi processing at redistributor to get lpi config info
-from lpi configuration table,determine priority,set pending state in
-lpi pending table and forward the lpi to cpuif.Added logic to invoke
-redistributor lpi processing with translated LPI which set/clear LPI
-from ITS device as part of ITS INT,CLEAR,DISCARD command and
-GITS_TRANSLATER processing.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
-Tested-by: Neil Armstrong <narmstrong@baylibre.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210910143951.92242-7-shashi.mallela@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/intc/gicv3_internal.h           |   9 ++
- include/hw/intc/arm_gicv3_common.h |   7 ++
- hw/intc/arm_gicv3.c                |  14 +++
- hw/intc/arm_gicv3_common.c         |   1 +
- hw/intc/arm_gicv3_cpuif.c          |   7 +-
- hw/intc/arm_gicv3_its.c            |  23 +++++
- hw/intc/arm_gicv3_redist.c         | 141 +++++++++++++++++++++++++++++
-files changed, 200 insertions(+), 2 deletions(-)
-diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/gicv3_internal.h
-+++ b/hw/intc/gicv3_internal.h
-@@ -XXX,XX +XXX,XX @@ FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
- FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
- FIELD(GICR_PENDBASER, PTZ, 62, 1)
-+#define GICR_PROPBASER_IDBITS_THRESHOLD          0xd
-+
- #define ICC_CTLR_EL1_CBPR           (1U << 0)
- #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
- #define ICC_CTLR_EL1_PMHE           (1U << 6)
-@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
- #define L1TABLE_ENTRY_SIZE         8
-+#define LPI_CTE_ENABLED          TABLE_ENTRY_VALID_MASK
-+#define LPI_PRIORITY_MASK         0xfc
-+
- #define GITS_CMDQ_ENTRY_SIZE               32
- #define NUM_BYTES_IN_DW                     8
-@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
-  * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
-  */
- #define GITS_CTE_SIZE                 (0x8ULL)
-+#define GITS_CTE_RDBASE_PROCNUM_MASK  MAKE_64BIT_MASK(1, RDBASE_PROCNUM_LENGTH)
- /* Special interrupt IDs */
- #define INTID_SECURE 1020
-@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
-                                unsigned size, MemTxAttrs attrs);
- void gicv3_dist_set_irq(GICv3State *s, int irq, int level);
- void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level);
-+void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level);
-+void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level);
-+void gicv3_redist_update_lpi(GICv3CPUState *cs);
- void gicv3_redist_send_sgi(GICv3CPUState *cs, int grp, int irq, bool ns);
- void gicv3_init_cpuif(GICv3State *s);
-diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/arm_gicv3_common.h
-+++ b/include/hw/intc/arm_gicv3_common.h
-@@ -XXX,XX +XXX,XX @@ struct GICv3CPUState {
-      * real state above; it doesn't need to be migrated.
-      */
-     PendingIrq hppi;
-+
-+    /*
-+     * Cached information recalculated from LPI tables
-+     * in guest memory
-+     */
-+    PendingIrq hpplpi;
-+
-     /* This is temporary working state, to avoid a malloc in gicv3_update() */
-     bool seenbetter;
- };
-diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3.c
-+++ b/hw/intc/arm_gicv3.c
-@@ -XXX,XX +XXX,XX @@ static void gicv3_redist_update_noirqset(GICv3CPUState *cs)
-         cs->hppi.grp = gicv3_irq_group(cs->gic, cs, cs->hppi.irq);
-     }
-+    if ((cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) && cs->gic->lpi_enable &&
-+        (cs->hpplpi.prio != 0xff)) {
-+        if (irqbetter(cs, cs->hpplpi.irq, cs->hpplpi.prio)) {
-+            cs->hppi.irq = cs->hpplpi.irq;
-+            cs->hppi.prio = cs->hpplpi.prio;
-+            cs->hppi.grp = cs->hpplpi.grp;
-+            seenbetter = true;
-+        }
-+    }
-+
-     /* If the best interrupt we just found would preempt whatever
-      * was the previous best interrupt before this update, then
-      * we know it's definitely the best one now.
-@@ -XXX,XX +XXX,XX @@ static void gicv3_set_irq(void *opaque, int irq, int level)
- static void arm_gicv3_post_load(GICv3State *s)
- {
-+    int i;
-     /* Recalculate our cached idea of the current highest priority
-      * pending interrupt, but don't set IRQ or FIQ lines.
-      */
-+    for (i = 0; i < s->num_cpu; i++) {
-+        gicv3_redist_update_lpi(&s->cpu[i]);
-+    }
-     gicv3_full_update_noirqset(s);
-     /* Repopulate the cache of GICv3CPUState pointers for target CPUs */
-     gicv3_cache_all_target_cpustates(s);
-diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_common.c
-+++ b/hw/intc/arm_gicv3_common.c
-@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_reset(DeviceState *dev)
-         memset(cs->gicr_ipriorityr, 0, sizeof(cs->gicr_ipriorityr));
-         cs->hppi.prio = 0xff;
-+        cs->hpplpi.prio = 0xff;
-         /* State in the CPU interface must *not* be reset here, because it
-          * is part of the CPU's reset domain, not the GIC device's.
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
-+++ b/hw/intc/arm_gicv3_cpuif.c
-@@ -XXX,XX +XXX,XX @@ static void icc_activate_irq(GICv3CPUState *cs, int irq)
-         cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
-         cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
-         gicv3_redist_update(cs);
--    } else {
-+    } else if (irq < GICV3_LPI_INTID_START) {
-         gicv3_gicd_active_set(cs->gic, irq);
-         gicv3_gicd_pending_clear(cs->gic, irq);
-         gicv3_update(cs->gic, irq, 1);
-+    } else {
-+        gicv3_redist_lpi_pending(cs, irq, 0);
-     }
- }
-@@ -XXX,XX +XXX,XX @@ static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
-     trace_gicv3_icc_eoir_write(is_eoir0 ? 0 : 1,
-                                gicv3_redist_affid(cs), value);
--    if (irq >= cs->gic->num_irq) {
-+    if ((irq >= cs->gic->num_irq) &&
-+        !(cs->gic->lpi_enable && (irq >= GICV3_LPI_INTID_START))) {
-         /* This handles two cases:
-          * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
-          * to the GICC_EOIR, the GIC ignores that write.
-diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its.c
-+++ b/hw/intc/arm_gicv3_its.c
-@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
-     uint64_t cte = 0;
-     bool cte_valid = false;
-     bool result = false;
-+    uint64_t rdbase;
-     if (cmd == NONE) {
-         devid = offset;
-@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
-          * Current implementation only supports rdbase == procnum
-          * Hence rdbase physical address is ignored
-          */
-+        rdbase = (cte & GITS_CTE_RDBASE_PROCNUM_MASK) >> 1U;
-+
-+        if (rdbase > s->gicv3->num_cpu) {
-+            return result;
-+        }
-+
-+        if ((cmd == CLEAR) || (cmd == DISCARD)) {
-+            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 0);
-+        } else {
-+            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 1);
-+        }
-+
-         if (cmd == DISCARD) {
-             IteEntry ite = {};
-             /* remove mapping from interrupt translation table */
-@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
-     MemTxResult res = MEMTX_OK;
-     bool result = true;
-     uint8_t cmd;
-+    int i;
-     if (!(s->ctlr & ITS_CTLR_ENABLED)) {
-         return;
-@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
-             break;
-         case GITS_CMD_INV:
-         case GITS_CMD_INVALL:
-+            /*
-+             * Current implementation doesn't cache any ITS tables,
-+             * but the calculated lpi priority information. We only
-+             * need to trigger lpi priority re-calculation to be in
-+             * sync with LPI config table or pending table changes.
-+             */
-+            for (i = 0; i < s->gicv3->num_cpu; i++) {
-+                gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
-+            }
-             break;
-         default:
-             break;
-diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_redist.c
-+++ b/hw/intc/arm_gicv3_redist.c
-@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
-         if (cs->gicr_typer & GICR_TYPER_PLPIS) {
-             if (value & GICR_CTLR_ENABLE_LPIS) {
-                 cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
-+                /* Check for any pending interr in pending table */
-+                gicv3_redist_update_lpi(cs);
-+                gicv3_redist_update(cs);
-             } else {
-                 cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
-             }
-@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
-     return r;
- }
-+static void gicv3_redist_check_lpi_priority(GICv3CPUState *cs, int irq)
-+{
-+    AddressSpace *as = &cs->gic->dma_as;
-+    uint64_t lpict_baddr;
-+    uint8_t lpite;
-+    uint8_t prio;
-+
-+    lpict_baddr = cs->gicr_propbaser & R_GICR_PROPBASER_PHYADDR_MASK;
-+
-+    address_space_read(as, lpict_baddr + ((irq - GICV3_LPI_INTID_START) *
-+                       sizeof(lpite)), MEMTXATTRS_UNSPECIFIED, &lpite,
-+                       sizeof(lpite));
-+
-+    if (!(lpite & LPI_CTE_ENABLED)) {
-+        return;
-+    }
-+
-+    if (cs->gic->gicd_ctlr & GICD_CTLR_DS) {
-+        prio = lpite & LPI_PRIORITY_MASK;
-+    } else {
-+        prio = ((lpite & LPI_PRIORITY_MASK) >> 1) | 0x80;
-+    }
-+
-+    if ((prio < cs->hpplpi.prio) ||
-+        ((prio == cs->hpplpi.prio) && (irq <= cs->hpplpi.irq))) {
-+        cs->hpplpi.irq = irq;
-+        cs->hpplpi.prio = prio;
-+        /* LPIs are always non-secure Grp1 interrupts */
-+        cs->hpplpi.grp = GICV3_G1NS;
-+    }
-+}
-+
-+void gicv3_redist_update_lpi(GICv3CPUState *cs)
-+{
-+    /*
-+     * This function scans the LPI pending table and for each pending
-+     * LPI, reads the corresponding entry from LPI configuration table
-+     * to extract the priority info and determine if the current LPI
-+     * priority is lower than the last computed high priority lpi interrupt.
-+     * If yes, replace current LPI as the new high priority lpi interrupt.
-+     */
-+    AddressSpace *as = &cs->gic->dma_as;
-+    uint64_t lpipt_baddr;
-+    uint32_t pendt_size = 0;
-+    uint8_t pend;
-+    int i, bit;
-+    uint64_t idbits;
-+
-+    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
-+                 GICD_TYPER_IDBITS);
-+
-+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
-+        !cs->gicr_pendbaser) {
-+        return;
-+    }
-+
-+    cs->hpplpi.prio = 0xff;
-+
-+    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
-+
-+    /* Determine the highest priority pending interrupt among LPIs */
-+    pendt_size = (1ULL << (idbits + 1));
-+
-+    for (i = GICV3_LPI_INTID_START / 8; i < pendt_size / 8; i++) {
-+        address_space_read(as, lpipt_baddr + i, MEMTXATTRS_UNSPECIFIED, &pend,
-+                           sizeof(pend));
-+
-+        while (pend) {
-+            bit = ctz32(pend);
-+            gicv3_redist_check_lpi_priority(cs, i * 8 + bit);
-+            pend &= ~(1 << bit);
-+        }
-+    }
-+}
-+
-+void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level)
-+{
-+    /*
-+     * This function updates the pending bit in lpi pending table for
-+     * the irq being activated or deactivated.
-+     */
-+    AddressSpace *as = &cs->gic->dma_as;
-+    uint64_t lpipt_baddr;
-+    bool ispend = false;
-+    uint8_t pend;
-+
-+    /*
-+     * get the bit value corresponding to this irq in the
-+     * lpi pending table
-+     */
-+    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
-+
-+    address_space_read(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
-+                       MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
-+
-+    ispend = extract32(pend, irq % 8, 1);
-+
-+    /* no change in the value of pending bit, return */
-+    if (ispend == level) {
-+        return;
-+    }
-+    pend = deposit32(pend, irq % 8, 1, level ? 1 : 0);
-+
-+    address_space_write(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
-+                        MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
-+
-+    /*
-+     * check if this LPI is better than the current hpplpi, if yes
-+     * just set hpplpi.prio and .irq without doing a full rescan
-+     */
-+    if (level) {
-+        gicv3_redist_check_lpi_priority(cs, irq);
-+    } else {
-+        if (irq == cs->hpplpi.irq) {
-+            gicv3_redist_update_lpi(cs);
-+        }
-+    }
-+}
-+
-+void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level)
-+{
-+    uint64_t idbits;
-+
-+    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
-+                 GICD_TYPER_IDBITS);
-+
-+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
-+         !cs->gicr_pendbaser || (irq > (1ULL << (idbits + 1)) - 1) ||
-+         irq < GICV3_LPI_INTID_START) {
-+        return;
-+    }
-+
-+    /* set/clear the pending bit for this irq */
-+    gicv3_redist_lpi_pending(cs, irq, level);
-+
-+    gicv3_redist_update(cs);
-+}
-+
- void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level)
- {
-     /* Update redistributor state for a change in an external PPI input line */
---
-.20.1

-[PULL 15/23] tests/data/acpi/virt: Add IORT files for ITS
+Deleted patch
-From: Shashi Mallela <shashi.mallela@linaro.org>
-Added expected IORT files applicable with latest GICv3
-ITS changes.Temporarily differences in these files are
-okay.
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
-Acked-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210910143951.92242-8-shashi.mallela@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/qtest/bios-tables-test-allowed-diff.h | 4 ++++
- tests/data/acpi/virt/IORT                   | 0
- tests/data/acpi/virt/IORT.memhp             | 0
- tests/data/acpi/virt/IORT.numamem           | 0
- tests/data/acpi/virt/IORT.pxb               | 0
-files changed, 4 insertions(+)
- create mode 100644 tests/data/acpi/virt/IORT
- create mode 100644 tests/data/acpi/virt/IORT.memhp
- create mode 100644 tests/data/acpi/virt/IORT.numamem
- create mode 100644 tests/data/acpi/virt/IORT.pxb
-diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
-index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/bios-tables-test-allowed-diff.h
-+++ b/tests/qtest/bios-tables-test-allowed-diff.h
-@@ -1 +1,5 @@
- /* List of comma-separated changed AML files to ignore */
-+"tests/data/acpi/virt/IORT",
-+"tests/data/acpi/virt/IORT.memhp",
-+"tests/data/acpi/virt/IORT.numamem",
-+"tests/data/acpi/virt/IORT.pxb",
-diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
-new file mode 100644
-index XXXXXXX..XXXXXXX
-diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
-new file mode 100644
-index XXXXXXX..XXXXXXX
-diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
-new file mode 100644
-index XXXXXXX..XXXXXXX
-diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
-new file mode 100644
-index XXXXXXX..XXXXXXX
---
-.20.1

-[PULL 17/23] tests/data/acpi/virt: Update IORT files for ITS
+Deleted patch
-From: Shashi Mallela <shashi.mallela@linaro.org>
-Updated expected IORT files applicable with latest GICv3
-ITS changes.
-Full diff of new file disassembly:
-/*
- * Intel ACPI Component Architecture
- * AML/ASL+ Disassembler version 20180629 (64-bit version)
- * Copyright (c) 2000 - 2018 Intel Corporation
- *
- * Disassembly of tests/data/acpi/virt/IORT.pxb, Tue Jun 29 17:35:38 2021
- *
- * ACPI Data Table [IORT]
- *
- * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue
- */
-[000h 0000   4]                    Signature : "IORT"    [IO Remapping Table]
-[004h 0004   4]                 Table Length : 0000007C
-[008h 0008   1]                     Revision : 00
-[009h 0009   1]                     Checksum : 07
-[00Ah 0010   6]                       Oem ID : "BOCHS "
-[010h 0016   8]                 Oem Table ID : "BXPC    "
-[018h 0024   4]                 Oem Revision : 00000001
-[01Ch 0028   4]              Asl Compiler ID : "BXPC"
-[020h 0032   4]        Asl Compiler Revision : 00000001
-[024h 0036   4]                   Node Count : 00000002
-[028h 0040   4]                  Node Offset : 00000030
-[02Ch 0044   4]                     Reserved : 00000000
-[030h 0048   1]                         Type : 00
-[031h 0049   2]                       Length : 0018
-[033h 0051   1]                     Revision : 00
-[034h 0052   4]                     Reserved : 00000000
-[038h 0056   4]                Mapping Count : 00000000
-[03Ch 0060   4]               Mapping Offset : 00000000
-[040h 0064   4]                     ItsCount : 00000001
-[044h 0068   4]                  Identifiers : 00000000
-[048h 0072   1]                         Type : 02
-[049h 0073   2]                       Length : 0034
-[04Bh 0075   1]                     Revision : 00
-[04Ch 0076   4]                     Reserved : 00000000
-[050h 0080   4]                Mapping Count : 00000001
-[054h 0084   4]               Mapping Offset : 00000020
-[058h 0088   8]            Memory Properties : [IORT Memory Access Properties]
-[058h 0088   4]              Cache Coherency : 00000001
-[05Ch 0092   1]        Hints (decoded below) : 00
-                                   Transient : 0
-                              Write Allocate : 0
-                               Read Allocate : 0
-                                    Override : 0
-[05Dh 0093   2]                     Reserved : 0000
-[05Fh 0095   1] Memory Flags (decoded below) : 03
-                                   Coherency : 1
-                            Device Attribute : 1
-[060h 0096   4]                ATS Attribute : 00000000
-[064h 0100   4]           PCI Segment Number : 00000000
-[068h 0104   1]            Memory Size Limit : 00
-[069h 0105   3]                     Reserved : 000000
-[068h 0104   4]                   Input base : 00000000
-[06Ch 0108   4]                     ID Count : 0000FFFF
-[070h 0112   4]                  Output Base : 00000000
-[074h 0116   4]             Output Reference : 00000030
-[078h 0120   4]        Flags (decoded below) : 00000000
-                              Single Mapping : 0
-Raw Table Data: Length 124 (0x7C)
-: 49 4F 52 54 7C 00 00 00 00 07 42 4F 43 48 53 20  // IORT|.....BOCHS
-: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43  // BXPC    ....BXPC
-: 01 00 00 00 02 00 00 00 30 00 00 00 00 00 00 00  // ........0.......
-: 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00  // ................
-: 01 00 00 00 00 00 00 00 02 34 00 00 00 00 00 00  // .........4......
-: 01 00 00 00 20 00 00 00 01 00 00 00 00 00 00 03  // .... ...........
-: 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00  // ................
-: 00 00 00 00 30 00 00 00 00 00 00 00              // ....0.......
-Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
-Acked-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20210910143951.92242-10-shashi.mallela@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/qtest/bios-tables-test-allowed-diff.h |   4 ----
- tests/data/acpi/virt/IORT                   | Bin 0 -> 124 bytes
- tests/data/acpi/virt/IORT.memhp             | Bin 0 -> 124 bytes
- tests/data/acpi/virt/IORT.numamem           | Bin 0 -> 124 bytes
- tests/data/acpi/virt/IORT.pxb               | Bin 0 -> 124 bytes
-files changed, 4 deletions(-)
-diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
-index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/bios-tables-test-allowed-diff.h
-+++ b/tests/qtest/bios-tables-test-allowed-diff.h
-@@ -1,5 +1 @@
- /* List of comma-separated changed AML files to ignore */
--"tests/data/acpi/virt/IORT",
--"tests/data/acpi/virt/IORT.memhp",
--"tests/data/acpi/virt/IORT.numamem",
--"tests/data/acpi/virt/IORT.pxb",
-diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
-index XXXXXXX..XXXXXXX 100644
-GIT binary patch
-literal 124
-zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
-QRGb+i3L*dhhtM#y0PN=p0RR91
-literal 0
-HcmV?d00001
-diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
-index XXXXXXX..XXXXXXX 100644
-GIT binary patch
-literal 124
-zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
-QRGb+i3L*dhhtM#y0PN=p0RR91
-literal 0
-HcmV?d00001
-diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
-index XXXXXXX..XXXXXXX 100644
-GIT binary patch
-literal 124
-zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
-QRGb+i3L*dhhtM#y0PN=p0RR91
-literal 0
-HcmV?d00001
-diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
-index XXXXXXX..XXXXXXX 100644
-GIT binary patch
-literal 124
-zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
-QRGb+i3L*dhhtM#y0PN=p0RR91
-literal 0
-HcmV?d00001
---
-.20.1

-[PULL 20/23] qdev: Support marking individual buses as 'full'
+Deleted patch
-By default, QEMU will allow devices to be plugged into a bus up to
-the bus class's device count limit.  If the user creates a device on
-the command line or via the monitor and doesn't explicitly specify
-the bus to plug it in, QEMU will plug it into the first non-full bus
-that it finds.
-This is fine in most cases, but some machines have multiple buses of
-a given type, some of which are dedicated to on-board devices and
-some of which have an externally exposed connector for user-pluggable
-devices. One example is I2C buses.
-Provide a new function qbus_mark_full() so that a machine model can
-mark this kind of "internal only" bus as 'full' after it has created
-all the devices that should be plugged into that bus. The "find a
-non-full bus" algorithm will then skip the internal-only bus when
-looking for a place to plug in user-created devices.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210903151435.22379-2-peter.maydell@linaro.org
----
- include/hw/qdev-core.h | 24 ++++++++++++++++++++++++
- softmmu/qdev-monitor.c |  7 ++++++-
-files changed, 30 insertions(+), 1 deletion(-)
-diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/qdev-core.h
-+++ b/include/hw/qdev-core.h
-@@ -XXX,XX +XXX,XX @@ struct BusState {
-     HotplugHandler *hotplug_handler;
-     int max_index;
-     bool realized;
-+    bool full;
-     int num_children;
-     /*
-@@ -XXX,XX +XXX,XX @@ static inline bool qbus_is_hotpluggable(BusState *bus)
-    return bus->hotplug_handler;
- }
-+/**
-+ * qbus_mark_full: Mark this bus as full, so no more devices can be attached
-+ * @bus: Bus to mark as full
-+ *
-+ * By default, QEMU will allow devices to be plugged into a bus up
-+ * to the bus class's device count limit. Calling this function
-+ * marks a particular bus as full, so that no more devices can be
-+ * plugged into it. In particular this means that the bus will not
-+ * be considered as a candidate for plugging in devices created by
-+ * the user on the commandline or via the monitor.
-+ * If a machine has multiple buses of a given type, such as I2C,
-+ * where some of those buses in the real hardware are used only for
-+ * internal devices and some are exposed via expansion ports, you
-+ * can use this function to mark the internal-only buses as full
-+ * after you have created all their internal devices. Then user
-+ * created devices will appear on the expansion-port bus where
-+ * guest software expects them.
-+ */
-+static inline void qbus_mark_full(BusState *bus)
-+{
-+    bus->full = true;
-+}
-+
- void device_listener_register(DeviceListener *listener);
- void device_listener_unregister(DeviceListener *listener);
-diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/qdev-monitor.c
-+++ b/softmmu/qdev-monitor.c
-@@ -XXX,XX +XXX,XX @@ static DeviceState *qbus_find_dev(BusState *bus, char *elem)
- static inline bool qbus_is_full(BusState *bus)
- {
--    BusClass *bus_class = BUS_GET_CLASS(bus);
-+    BusClass *bus_class;
-+
-+    if (bus->full) {
-+        return true;
-+    }
-+    bus_class = BUS_GET_CLASS(bus);
-     return bus_class->max_dev && bus->num_children >= bus_class->max_dev;
- }
---
-.20.1

-[PULL 21/23] hw/arm/mps2-tz.c: Add extra data parameter to MakeDevFn
+Deleted patch
-The mps2-tz boards use a data-driven structure to create the devices
-that sit behind peripheral protection controllers.  Currently the
-functions which create these devices are passed an 'opaque' pointer
-which is always the address within the machine struct of the device
-to create, and some "all devices need this" information like irqs and
-addresses.
-If a specific device needs more information than this, it is
-currently not possible to pass that through from the PPCInfo
-data structure. Add support for passing an extra data parameter,
-so that we can more flexibly handle the needs of specific
-device types. To provide some type-safety we make this extra
-parameter a pointer to a union (which initially has no members).
-In particular, we would like to be able to indicate which of the
-i2c controllers are for on-board devices only and which are
-connected to the external 'shield' expansion port; a subsequent
-patch will use this mechanism for that purpose.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210903151435.22379-3-peter.maydell@linaro.org
----
- hw/arm/mps2-tz.c | 35 ++++++++++++++++++++++-------------
-file changed, 22 insertions(+), 13 deletions(-)
-diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2-tz.c
-+++ b/hw/arm/mps2-tz.c
-@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
-     }
- }
-+/* Union describing the device-specific extra data we pass to the devfn. */
-+typedef union PPCExtraData {
-+} PPCExtraData;
-+
- /* Most of the devices in the AN505 FPGA image sit behind
-  * Peripheral Protection Controllers. These data structures
-  * define the layout of which devices sit behind which PPCs.
-@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
-  */
- typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
-                                 const char *name, hwaddr size,
--                                const int *irqs);
-+                                const int *irqs,
-+                                const PPCExtraData *extradata);
- typedef struct PPCPortInfo {
-     const char *name;
-@@ -XXX,XX +XXX,XX @@ typedef struct PPCPortInfo {
-     hwaddr addr;
-     hwaddr size;
-     int irqs[3]; /* currently no device needs more IRQ lines than this */
-+    PPCExtraData extradata; /* to pass device-specific info to the devfn */
- } PPCPortInfo;
- typedef struct PPCInfo {
-@@ -XXX,XX +XXX,XX @@ typedef struct PPCInfo {
- static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
-                                     void *opaque,
-                                     const char *name, hwaddr size,
--                                    const int *irqs)
-+                                    const int *irqs,
-+                                    const PPCExtraData *extradata)
- {
-     /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
-      * and return a pointer to its MemoryRegion.
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
- static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
-                                const char *name, hwaddr size,
--                               const int *irqs)
-+                               const int *irqs, const PPCExtraData *extradata)
- {
-     /* The irq[] array is tx, rx, combined, in that order */
-     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
- static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
-                               const char *name, hwaddr size,
--                              const int *irqs)
-+                              const int *irqs, const PPCExtraData *extradata)
- {
-     MPS2SCC *scc = opaque;
-     DeviceState *sccdev;
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
- static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
-                                  const char *name, hwaddr size,
--                                 const int *irqs)
-+                                 const int *irqs, const PPCExtraData *extradata)
- {
-     MPS2FPGAIO *fpgaio = opaque;
-     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
- static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
-                                   const char *name, hwaddr size,
--                                  const int *irqs)
-+                                  const int *irqs,
-+                                  const PPCExtraData *extradata)
- {
-     SysBusDevice *s;
-     NICInfo *nd = &nd_table[0];
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
- static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
-                                   const char *name, hwaddr size,
--                                  const int *irqs)
-+                                  const int *irqs,
-+                                  const PPCExtraData *extradata)
- {
-     /*
-      * The AN524 makes the ethernet and USB share a PPC port.
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
- static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
-                               const char *name, hwaddr size,
--                              const int *irqs)
-+                              const int *irqs, const PPCExtraData *extradata)
- {
-     TZMPC *mpc = opaque;
-     int i = mpc - &mms->mpc[0];
-@@ -XXX,XX +XXX,XX @@ static void remap_irq_fn(void *opaque, int n, int level)
- static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
-                               const char *name, hwaddr size,
--                              const int *irqs)
-+                              const int *irqs, const PPCExtraData *extradata)
- {
-     /* The irq[] array is DMACINTR, DMACINTERR, DMACINTTC, in that order */
-     PL080State *dma = opaque;
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
- static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
-                               const char *name, hwaddr size,
--                              const int *irqs)
-+                              const int *irqs, const PPCExtraData *extradata)
- {
-     /*
-      * The AN505 has five PL022 SPI controllers.
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
- static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
-                               const char *name, hwaddr size,
--                              const int *irqs)
-+                              const int *irqs, const PPCExtraData *extradata)
- {
-     ArmSbconI2CState *i2c = opaque;
-     SysBusDevice *s;
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
- static MemoryRegion *make_rtc(MPS2TZMachineState *mms, void *opaque,
-                               const char *name, hwaddr size,
--                              const int *irqs)
-+                              const int *irqs, const PPCExtraData *extradata)
- {
-     PL031State *pl031 = opaque;
-     SysBusDevice *s;
-@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
-             }
-             mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size,
--                              pinfo->irqs);
-+                              pinfo->irqs, &pinfo->extradata);
-             portname = g_strdup_printf("port[%d]", port);
-             object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
-                                      &error_fatal);
---
-.20.1

-[PULL 22/23] hw/arm/mps2-tz.c: Mark internal-only I2C buses as 'full'
+Deleted patch
-The various MPS2 boards have multiple I2C buses: typically a bus
-dedicated to the audio configuration, one for the LCD touchscreen
-controller, one for a DDR4 EEPROM, and two which are connected to the
-external Shield expansion connector.  Mark the buses which are used
-only for board-internal devices as 'full' so that if the user creates
-i2c devices on the commandline without specifying a bus name then
-they will be connected to the I2C controller used for the Shield
-connector, where guest software will expect them.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210903151435.22379-4-peter.maydell@linaro.org
----
- hw/arm/mps2-tz.c | 57 ++++++++++++++++++++++++++++++++++++------------
-file changed, 43 insertions(+), 14 deletions(-)
-diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2-tz.c
-+++ b/hw/arm/mps2-tz.c
-@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
- /* Union describing the device-specific extra data we pass to the devfn. */
- typedef union PPCExtraData {
-+    bool i2c_internal;
- } PPCExtraData;
- /* Most of the devices in the AN505 FPGA image sit behind
-@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
-     object_initialize_child(OBJECT(mms), name, i2c, TYPE_ARM_SBCON_I2C);
-     s = SYS_BUS_DEVICE(i2c);
-     sysbus_realize(s, &error_fatal);
-+
-+    /*
-+     * If this is an internal-use-only i2c bus, mark it full
-+     * so that user-created i2c devices are not plugged into it.
-+     * If we implement models of any on-board i2c devices that
-+     * plug in to one of the internal-use-only buses, then we will
-+     * need to create and plugging those in here before we mark the
-+     * bus as full.
-+     */
-+    if (extradata->i2c_internal) {
-+        BusState *qbus = qdev_get_child_bus(DEVICE(i2c), "i2c");
-+        qbus_mark_full(qbus);
-+    }
-+
-     return sysbus_mmio_get_region(s, 0);
- }
-@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
-                 { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000, { 36, 37, 44 } },
-                 { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000, { 38, 39, 45 } },
-                 { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000, { 40, 41, 46 } },
--                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000 },
--                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000 },
--                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000 },
--                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000 },
-+                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000, {},
-+                  { .i2c_internal = true /* touchscreen */ } },
-+                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000, {},
-+                  { .i2c_internal = true /* audio conf */ } },
-+                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000, {},
-+                  { .i2c_internal = false /* shield 0 */ } },
-+                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000, {},
-+                  { .i2c_internal = false /* shield 1 */ } },
-             },
-         }, {
-             .name = "apb_ppcexp2",
-@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
-         }, {
-             .name = "apb_ppcexp1",
-             .ports = {
--                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000 },
--                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000 },
-+                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000, {},
-+                  { .i2c_internal = true /* touchscreen */ } },
-+                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000, {},
-+                  { .i2c_internal = true /* audio conf */ } },
-                 { "spi0", make_spi, &mms->spi[0], 0x41202000, 0x1000, { 52 } },
-                 { "spi1", make_spi, &mms->spi[1], 0x41203000, 0x1000, { 53 } },
-                 { "spi2", make_spi, &mms->spi[2], 0x41204000, 0x1000, { 54 } },
--                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000 },
--                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000 },
-+                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000, {},
-+                  { .i2c_internal = false /* shield 0 */ } },
-+                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000, {},
-+                  { .i2c_internal = false /* shield 1 */ } },
-                 { /* port 7 reserved */ },
--                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000 },
-+                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000, {},
-+                  { .i2c_internal = true /* DDR4 EEPROM */ } },
-             },
-         }, {
-             .name = "apb_ppcexp2",
-@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
-         }, {
-             .name = "apb_ppcexp1",
-             .ports = {
--                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000 },
--                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000 },
-+                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000, {},
-+                  { .i2c_internal = true /* touchscreen */ } },
-+                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000, {},
-+                  { .i2c_internal = true /* audio conf */ } },
-                 { "spi0", make_spi, &mms->spi[0], 0x49202000, 0x1000, { 53 } },
-                 { "spi1", make_spi, &mms->spi[1], 0x49203000, 0x1000, { 54 } },
-                 { "spi2", make_spi, &mms->spi[2], 0x49204000, 0x1000, { 55 } },
--                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000 },
--                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000 },
-+                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000, {},
-+                  { .i2c_internal = false /* shield 0 */ } },
-+                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000, {},
-+                  { .i2c_internal = false /* shield 1 */ } },
-                 { /* port 7 reserved */ },
--                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000 },
-+                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000, {},
-+                  { .i2c_internal = true /* DDR4 EEPROM */ } },
-             },
-         }, {
-             .name = "apb_ppcexp2",
---
-.20.1

-[PULL 23/23] hw/arm/mps2.c: Mark internal-only I2C buses as 'full'
+Deleted patch
-The various MPS2 boards implemented in mps2.c have multiple I2C
-buses: a bus dedicated to the audio configuration, one for the LCD
-touchscreen controller, and two which are connected to the external
-Shield expansion connector.  Mark the buses which are used only for
-board-internal devices as 'full' so that if the user creates i2c
-devices on the commandline without specifying a bus name then they
-will be connected to the I2C controller used for the Shield
-connector, where guest software will expect them.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20210903151435.22379-5-peter.maydell@linaro.org
----
- hw/arm/mps2.c | 12 +++++++++++-
-file changed, 11 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/mps2.c
-+++ b/hw/arm/mps2.c
-@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
-x40023000,    /* Audio */
-x40029000,    /* Shield0 */
-x4002a000};   /* Shield1 */
--        sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
-+        DeviceState *dev;
-+
-+        dev = sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
-+        if (i < 2) {
-+            /*
-+             * internal-only bus: mark it full to avoid user-created
-+             * i2c devices being plugged into it.
-+             */
-+            BusState *qbus = qdev_get_child_bus(dev, "i2c");
-+            qbus_mark_full(qbus);
-+        }
-     }
-     create_unimplemented_device("i2s", 0x40024000, 0x400);
---
-.20.1

The following changes since commit eae587e8e3694b1aceab23239493fb4c7e1a80f5:

Merge remote-tracking branch 'remotes/armbru/tags/pull-qapi-2021-09-13' into staging (2021-09-13 11:00:30 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210913

for you to fetch changes up to 9a2b2ecf4d25a3943918c95d2db4508b304161b5:

hw/arm/mps2.c: Mark internal-only I2C buses as 'full' (2021-09-13 17:09:28 +0100)

----------------------------------------------------------------
target-arm queue:
 * mark MPS2/MPS3 board-internal i2c buses as 'full' so that command
   line user-created devices are not plugged into them
 * Take an exception if PSTATE.IL is set
 * Support an emulated ITS in the virt board
 * Add support for kudo-bmc board
 * Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM
 * cadence_uart: Fix clock handling issues that prevented
   u-boot from running

----------------------------------------------------------------
Bin Meng (6):
      hw/misc: zynq_slcr: Correctly compute output clocks in the reset exit phase
      hw/char: cadence_uart: Disable transmit when input clock is disabled
      hw/char: cadence_uart: Move clock/reset check to uart_can_receive()
      hw/char: cadence_uart: Convert to memop_with_attrs() ops
      hw/char: cadence_uart: Ignore access when unclocked or in reset for uart_{read, write}()
      hw/char: cadence_uart: Log a guest error when device is unclocked or in reset

Chris Rauer (1):
      hw/arm: Add support for kudo-bmc board.

Marc Zyngier (1):
      hw/arm/virt: KVM: Probe for KVM_CAP_ARM_VM_IPA_SIZE when creating scratch VM

Peter Maydell (5):
      target/arm: Take an exception if PSTATE.IL is set
      qdev: Support marking individual buses as 'full'
      hw/arm/mps2-tz.c: Add extra data parameter to MakeDevFn
      hw/arm/mps2-tz.c: Mark internal-only I2C buses as 'full'
      hw/arm/mps2.c: Mark internal-only I2C buses as 'full'

Richard Henderson (1):
      target/arm: Merge disas_a64_insn into aarch64_tr_translate_insn

Shashi Mallela (9):
      hw/intc: GICv3 ITS initial framework
      hw/intc: GICv3 ITS register definitions added
      hw/intc: GICv3 ITS command queue framework
      hw/intc: GICv3 ITS Command processing
      hw/intc: GICv3 ITS Feature enablement
      hw/intc: GICv3 redistributor ITS processing
      tests/data/acpi/virt: Add IORT files for ITS
      hw/arm/virt: add ITS support in virt GIC
      tests/data/acpi/virt: Update IORT files for ITS

From: Bin Meng <bmeng.cn@gmail.com>

As of today, when booting upstream U-Boot for Xilinx Zynq, the UART
does not receive anything. Debugging shows that the UART input clock
frequency is zero which prevents the UART from receiving anything as
per the logic in uart_receive().

From zynq_slcr_reset_exit() comment, it intends to compute output
clocks according to ps_clk and registers. zynq_slcr_compute_clocks()
is called to accomplish the task, inside which device_is_in_reset()
is called to actually make the attempt in vain.

Rework reset_hold() and reset_exit() so that in the reset exit phase,
the logic can really compute output clocks in reset_exit().

With this change, upstream U-Boot boots properly again with:

$ qemu-system-arm -M xilinx-zynq-a9 -m 1G -display none -serial null -serial stdio \
    -device loader,file=u-boot-dtb.bin,addr=0x4000000,cpu-num=0

Fixes: 38867cb7ec90 ("hw/misc/zynq_slcr: add clock generation for uarts")
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20210901124521.30599-2-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/misc/zynq_slcr.c | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/hw/misc/zynq_slcr.c b/hw/misc/zynq_slcr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/zynq_slcr.c
+++ b/hw/misc/zynq_slcr.c
@@ -XXX,XX +XXX,XX @@ static uint64_t zynq_slcr_compute_clock(const uint64_t periods[],
     zynq_slcr_compute_clock((plls), (state)->regs[reg], \
                             reg ## _ ## enable_field ## _SHIFT)
 
+static void zynq_slcr_compute_clocks_internal(ZynqSLCRState *s, uint64_t ps_clk)
+{
+    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
+    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
+    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
+
+    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
+
+    /* compute uartX reference clocks */
+    clock_set(s->uart0_ref_clk,
+              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
+    clock_set(s->uart1_ref_clk,
+              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
+}
+
 /**
  * Compute and set the ouputs clocks periods.
  * But do not propagate them further. Connected clocks
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_compute_clocks(ZynqSLCRState *s)
         ps_clk = 0;
     }
 
-    uint64_t io_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_IO_PLL_CTRL]);
-    uint64_t arm_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_ARM_PLL_CTRL]);
-    uint64_t ddr_pll = zynq_slcr_compute_pll(ps_clk, s->regs[R_DDR_PLL_CTRL]);
-
-    uint64_t uart_mux[4] = {io_pll, io_pll, arm_pll, ddr_pll};
-
-    /* compute uartX reference clocks */
-    clock_set(s->uart0_ref_clk,
-              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT0));
-    clock_set(s->uart1_ref_clk,
-              ZYNQ_COMPUTE_CLK(s, uart_mux, R_UART_CLK_CTRL, CLKACT1));
+    zynq_slcr_compute_clocks_internal(s, ps_clk);
 }
 
 /**
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_hold(Object *obj)
     ZynqSLCRState *s = ZYNQ_SLCR(obj);
 
     /* will disable all output clocks */
-    zynq_slcr_compute_clocks(s);
+    zynq_slcr_compute_clocks_internal(s, 0);
     zynq_slcr_propagate_clocks(s);
 }
 
@@ -XXX,XX +XXX,XX @@ static void zynq_slcr_reset_exit(Object *obj)
     ZynqSLCRState *s = ZYNQ_SLCR(obj);
 
     /* will compute output clocks according to ps_clk and registers */
-    zynq_slcr_compute_clocks(s);
+    zynq_slcr_compute_clocks_internal(s, clock_get(s->ps_clk));
     zynq_slcr_propagate_clocks(s);
 }
 
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

At present when input clock is disabled, any character transmitted
to tx fifo can still show on the serial line, which is wrong.

Fixes: b636db306e06 ("hw/char/cadence_uart: add clock support")
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Message-id: 20210901124521.30599-3-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
 static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
                                int size)
 {
+    /* ignore characters when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return;
+    }
+
     if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
         return;
     }
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

Currently the clock/reset check is done in uart_receive(), but we
can move the check to uart_can_receive() which is earlier.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-4-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 17 ++++++++++-------
 1 file changed, 10 insertions(+), 7 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static void uart_parameters_setup(CadenceUARTState *s)
 static int uart_can_receive(void *opaque)
 {
     CadenceUARTState *s = opaque;
-    int ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
-    uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
+    int ret;
+    uint32_t ch_mode;
+
+    /* ignore characters when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return 0;
+    }
+
+    ret = MAX(CADENCE_UART_RX_FIFO_SIZE, CADENCE_UART_TX_FIFO_SIZE);
+    ch_mode = s->r[R_MR] & UART_MR_CHMODE;
 
     if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
         ret = MIN(ret, CADENCE_UART_RX_FIFO_SIZE - s->rx_count);
@@ -XXX,XX +XXX,XX @@ static void uart_receive(void *opaque, const uint8_t *buf, int size)
     CadenceUARTState *s = opaque;
     uint32_t ch_mode = s->r[R_MR] & UART_MR_CHMODE;
 
-    /* ignore characters when unclocked or in reset */
-    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-        return;
-    }
-
     if (ch_mode == NORMAL_MODE || ch_mode == ECHO_MODE) {
         uart_write_rx_fifo(opaque, buf, size);
     }
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

This converts uart_read() and uart_write() to memop_with_attrs() ops.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-5-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 26 +++++++++++++++-----------
 1 file changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static void uart_read_rx_fifo(CadenceUARTState *s, uint32_t *c)
     uart_update_status(s);
 }
 
-static void uart_write(void *opaque, hwaddr offset,
-                          uint64_t value, unsigned size)
+static MemTxResult uart_write(void *opaque, hwaddr offset,
+                              uint64_t value, unsigned size, MemTxAttrs attrs)
 {
     CadenceUARTState *s = opaque;
 
     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
-        return;
+        return MEMTX_DECODE_ERROR;
     }
     switch (offset) {
     case R_IER: /* ier (wts imr) */
@@ -XXX,XX +XXX,XX @@ static void uart_write(void *opaque, hwaddr offset,
         break;
     }
     uart_update_status(s);
+
+    return MEMTX_OK;
 }
 
-static uint64_t uart_read(void *opaque, hwaddr offset,
-        unsigned size)
+static MemTxResult uart_read(void *opaque, hwaddr offset,
+                             uint64_t *value, unsigned size, MemTxAttrs attrs)
 {
     CadenceUARTState *s = opaque;
     uint32_t c = 0;
 
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
-        c = 0;
-    } else if (offset == R_TX_RX) {
+        return MEMTX_DECODE_ERROR;
+    }
+    if (offset == R_TX_RX) {
         uart_read_rx_fifo(s, &c);
     } else {
-       c = s->r[offset];
+        c = s->r[offset];
     }
 
     DB_PRINT(" offset:%x data:%08x\n", (unsigned)(offset << 2), (unsigned)c);
-    return c;
+    *value = c;
+    return MEMTX_OK;
 }
 
 static const MemoryRegionOps uart_ops = {
-    .read = uart_read,
-    .write = uart_write,
+    .read_with_attrs = uart_read,
+    .write_with_attrs = uart_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

Read or write to uart registers when unclocked or in reset should be
ignored. Add the check there, and as a result of this, the check in
uart_write_tx_fifo() is now unnecessary.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-6-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static gboolean cadence_uart_xmit(void *do_not_use, GIOCondition cond,
 static void uart_write_tx_fifo(CadenceUARTState *s, const uint8_t *buf,
                                int size)
 {
-    /* ignore characters when unclocked or in reset */
-    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
-        return;
-    }
-
     if ((s->r[R_CR] & UART_CR_TX_DIS) || !(s->r[R_CR] & UART_CR_TX_EN)) {
         return;
     }
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
 {
     CadenceUARTState *s = opaque;
 
+    /* ignore access when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return MEMTX_ERROR;
+    }
+
     DB_PRINT(" offset:%x data:%08x\n", (unsigned)offset, (unsigned)value);
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
     CadenceUARTState *s = opaque;
     uint32_t c = 0;
 
+    /* ignore access when unclocked or in reset */
+    if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        return MEMTX_ERROR;
+    }
+
     offset >>= 2;
     if (offset >= CADENCE_UART_R_MAX) {
         return MEMTX_DECODE_ERROR;
-- 
2.20.1

From: Bin Meng <bmeng.cn@gmail.com>

We've got SW that expects FSBL (Bootlooader) to setup clocks and
resets. It's quite common that users run that SW on QEMU without
FSBL (FSBL typically requires the Xilinx tools installed). That's
fine, since users can stil use -device loader to enable clocks etc.

To help folks understand what's going, a log (guest-error) message
would be helpful here. In particular with the serial port since
things will go very quiet if they get things wrong.

Suggested-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20210901124521.30599-7-bmeng.cn@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/cadence_uart.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static int uart_can_receive(void *opaque)
 
     /* ignore characters when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static void uart_event(void *opaque, QEMUChrEvent event)
 
     /* ignore characters when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
 
     /* ignore access when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return MEMTX_ERROR;
     }
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_read(void *opaque, hwaddr offset,
 
     /* ignore access when unclocked or in reset */
     if (!clock_is_enabled(s->refclk) || device_is_in_reset(DEVICE(s))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: uart is unclocked or in reset\n",
+                      __func__);
         return MEMTX_ERROR;
     }
 
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

Although we probe for the IPA limits imposed by KVM (and the hardware)
when computing the memory map, we still use the old style '0' when
creating a scratch VM in kvm_arm_create_scratch_host_vcpu().

On systems that are severely IPA challenged (such as the Apple M1),
this results in a failure as KVM cannot use the default 40bit that
'0' represents.

Instead, probe for the extension and use the reported IPA limit
if available.

Cc: Andrew Jones <drjones@redhat.com>
Cc: Eric Auger <eric.auger@redhat.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Andrew Jones <drjones@redhat.com>
Message-id: 20210822144441.1290891-2-maz@kernel.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

From: Chris Rauer <crauer@google.com>

kudo-bmc is a board supported by OpenBMC.
https://github.com/openbmc/openbmc/tree/master/meta-fii/meta-kudo

Since v1:
- hyphenated Cortex-A9

Tested: Booted kudo firmware.
Signed-off-by: Chris Rauer <crauer@google.com>
Reviewed-by: Patrick Venture <venture@google.com>
Message-id: 20210907223234.1165705-1-crauer@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/nuvoton.rst |  1 +
 hw/arm/npcm7xx_boards.c     | 34 ++++++++++++++++++++++++++++++++++
 2 files changed, 35 insertions(+)

diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/nuvoton.rst
+++ b/docs/system/arm/nuvoton.rst
@@ -XXX,XX +XXX,XX @@ Hyperscale applications. The following machines are based on this chip :
 
 - ``quanta-gbs-bmc``    Quanta GBS server BMC
 - ``quanta-gsj``        Quanta GSJ server BMC
+- ``kudo-bmc``          Fii USA Kudo server BMC
 
 There are also two more SoCs, NPCM710 and NPCM705, which are single-core
 variants of NPCM750 and NPCM730, respectively. These are currently not
diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx_boards.c
+++ b/hw/arm/npcm7xx_boards.c
@@ -XXX,XX +XXX,XX @@
 #define NPCM750_EVB_POWER_ON_STRAPS 0x00001ff7
 #define QUANTA_GSJ_POWER_ON_STRAPS 0x00001fff
 #define QUANTA_GBS_POWER_ON_STRAPS 0x000017ff
+#define KUDO_BMC_POWER_ON_STRAPS 0x00001fff
 
 static const char npcm7xx_default_bootrom[] = "npcm7xx_bootrom.bin";
 
@@ -XXX,XX +XXX,XX @@ static void quanta_gbs_init(MachineState *machine)
     npcm7xx_load_kernel(machine, soc);
 }
 
+static void kudo_bmc_init(MachineState *machine)
+{
+    NPCM7xxState *soc;
+
+    soc = npcm7xx_create_soc(machine, KUDO_BMC_POWER_ON_STRAPS);
+    npcm7xx_connect_dram(soc, machine->ram);
+    qdev_realize(DEVICE(soc), NULL, &error_fatal);
+
+    npcm7xx_load_bootrom(machine, soc);
+    npcm7xx_connect_flash(&soc->fiu[0], 0, "mx66u51235f",
+                          drive_get(IF_MTD, 0, 0));
+    npcm7xx_connect_flash(&soc->fiu[1], 0, "mx66u51235f",
+                          drive_get(IF_MTD, 3, 0));
+
+    npcm7xx_load_kernel(machine, soc);
+}
+
 static void npcm7xx_set_soc_type(NPCM7xxMachineClass *nmc, const char *type)
 {
     NPCM7xxClass *sc = NPCM7XX_CLASS(object_class_by_name(type));
@@ -XXX,XX +XXX,XX @@ static void gbs_bmc_machine_class_init(ObjectClass *oc, void *data)
     mc->default_ram_size = 1 * GiB;
 }
 
+static void kudo_bmc_machine_class_init(ObjectClass *oc, void *data)
+{
+    NPCM7xxMachineClass *nmc = NPCM7XX_MACHINE_CLASS(oc);
+    MachineClass *mc = MACHINE_CLASS(oc);
+
+    npcm7xx_set_soc_type(nmc, TYPE_NPCM730);
+
+    mc->desc = "Kudo BMC (Cortex-A9)";
+    mc->init = kudo_bmc_init;
+    mc->default_ram_size = 1 * GiB;
+};
+
 static const TypeInfo npcm7xx_machine_types[] = {
     {
         .name           = TYPE_NPCM7XX_MACHINE,
@@ -XXX,XX +XXX,XX @@ static const TypeInfo npcm7xx_machine_types[] = {
         .name           = MACHINE_TYPE_NAME("quanta-gbs-bmc"),
         .parent         = TYPE_NPCM7XX_MACHINE,
         .class_init     = gbs_bmc_machine_class_init,
+    }, {
+        .name           = MACHINE_TYPE_NAME("kudo-bmc"),
+        .parent         = TYPE_NPCM7XX_MACHINE,
+        .class_init     = kudo_bmc_machine_class_init,
     },
 };
 
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added register definitions relevant to ITS,implemented overall
ITS device framework with stubs for ITS control and translater
regions read/write,extended ITS common to handle mmio init between
existing kvm device and newer qemu device.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Message-id: 20210910143951.92242-2-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h               |  96 +++++++++-
 include/hw/intc/arm_gicv3_its_common.h |   9 +-
 hw/intc/arm_gicv3_its.c                | 241 +++++++++++++++++++++++++
 hw/intc/arm_gicv3_its_common.c         |   7 +-
 hw/intc/arm_gicv3_its_kvm.c            |   2 +-
 hw/intc/meson.build                    |   1 +
 6 files changed, 342 insertions(+), 14 deletions(-)
 create mode 100644 hw/intc/arm_gicv3_its.c

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@
 #ifndef QEMU_ARM_GICV3_INTERNAL_H
 #define QEMU_ARM_GICV3_INTERNAL_H
 
+#include "hw/registerfields.h"
 #include "hw/intc/arm_gicv3_common.h"
 
 /* Distributor registers, as offsets from the distributor base address */
@@ -XXX,XX +XXX,XX @@
 #define GICD_CTLR_E1NWF             (1U << 7)
 #define GICD_CTLR_RWP               (1U << 31)
 
+/* 16 bits EventId */
+#define GICD_TYPER_IDBITS            0xf
+
 /*
  * Redistributor frame offsets from RD_base
  */
@@ -XXX,XX +XXX,XX @@
 #define GICR_WAKER_ProcessorSleep    (1U << 1)
 #define GICR_WAKER_ChildrenAsleep    (1U << 2)
 
-#define GICR_PROPBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
-#define GICR_PROPBASER_ADDR_MASK               (0xfffffffffULL << 12)
-#define GICR_PROPBASER_SHAREABILITY_MASK       (3U << 10)
-#define GICR_PROPBASER_CACHEABILITY_MASK       (7U << 7)
-#define GICR_PROPBASER_IDBITS_MASK             (0x1f)
+FIELD(GICR_PROPBASER, IDBITS, 0, 5)
+FIELD(GICR_PROPBASER, INNERCACHE, 7, 3)
+FIELD(GICR_PROPBASER, SHAREABILITY, 10, 2)
+FIELD(GICR_PROPBASER, PHYADDR, 12, 40)
+FIELD(GICR_PROPBASER, OUTERCACHE, 56, 3)
 
-#define GICR_PENDBASER_PTZ                     (1ULL << 62)
-#define GICR_PENDBASER_OUTER_CACHEABILITY_MASK (7ULL << 56)
-#define GICR_PENDBASER_ADDR_MASK               (0xffffffffULL << 16)
-#define GICR_PENDBASER_SHAREABILITY_MASK       (3U << 10)
-#define GICR_PENDBASER_CACHEABILITY_MASK       (7U << 7)
+FIELD(GICR_PENDBASER, INNERCACHE, 7, 3)
+FIELD(GICR_PENDBASER, SHAREABILITY, 10, 2)
+FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
+FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
+FIELD(GICR_PENDBASER, PTZ, 62, 1)
 
 #define ICC_CTLR_EL1_CBPR           (1U << 0)
 #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
@@ -XXX,XX +XXX,XX @@
 #define ICH_VTR_EL2_PREBITS_SHIFT 26
 #define ICH_VTR_EL2_PRIBITS_SHIFT 29
 
+/* ITS Registers */
+
+FIELD(GITS_BASER, SIZE, 0, 8)
+FIELD(GITS_BASER, PAGESIZE, 8, 2)
+FIELD(GITS_BASER, SHAREABILITY, 10, 2)
+FIELD(GITS_BASER, PHYADDR, 12, 36)
+FIELD(GITS_BASER, PHYADDRL_64K, 16, 32)
+FIELD(GITS_BASER, PHYADDRH_64K, 12, 4)
+FIELD(GITS_BASER, ENTRYSIZE, 48, 5)
+FIELD(GITS_BASER, OUTERCACHE, 53, 3)
+FIELD(GITS_BASER, TYPE, 56, 3)
+FIELD(GITS_BASER, INNERCACHE, 59, 3)
+FIELD(GITS_BASER, INDIRECT, 62, 1)
+FIELD(GITS_BASER, VALID, 63, 1)
+
+FIELD(GITS_CTLR, QUIESCENT, 31, 1)
+
+FIELD(GITS_TYPER, PHYSICAL, 0, 1)
+FIELD(GITS_TYPER, ITT_ENTRY_SIZE, 4, 4)
+FIELD(GITS_TYPER, IDBITS, 8, 5)
+FIELD(GITS_TYPER, DEVBITS, 13, 5)
+FIELD(GITS_TYPER, SEIS, 18, 1)
+FIELD(GITS_TYPER, PTA, 19, 1)
+FIELD(GITS_TYPER, CIDBITS, 32, 4)
+FIELD(GITS_TYPER, CIL, 36, 1)
+
+#define GITS_BASER_PAGESIZE_4K                0
+#define GITS_BASER_PAGESIZE_16K               1
+#define GITS_BASER_PAGESIZE_64K               2
+
+#define GITS_BASER_TYPE_DEVICE               1ULL
+#define GITS_BASER_TYPE_COLLECTION           4ULL
+
+/**
+ * Default features advertised by this version of ITS
+ */
+/* Physical LPIs supported */
+#define GITS_TYPE_PHYSICAL           (1U << 0)
+
+/*
+ * 12 bytes Interrupt translation Table Entry size
+ * as per Table 5.3 in GICv3 spec
+ * ITE Lower 8 Bytes
+ *   Bits:    | 49 ... 26 | 25 ... 2 |   1     |   0    |
+ *   Values:  |    1023   |  IntNum  | IntType |  Valid |
+ * ITE Higher 4 Bytes
+ *   Bits:    | 31 ... 16 | 15 ...0 |
+ *   Values:  |  vPEID    |  ICID   |
+ */
+#define ITS_ITT_ENTRY_SIZE            0xC
+
+/* 16 bits EventId */
+#define ITS_IDBITS                   GICD_TYPER_IDBITS
+
+/* 16 bits DeviceId */
+#define ITS_DEVBITS                   0xF
+
+/* 16 bits CollectionId */
+#define ITS_CIDBITS                  0xF
+
+/*
+ * 8 bytes Device Table Entry size
+ * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
+ */
+#define GITS_DTE_SIZE                 (0x8ULL)
+
+/*
+ * 8 bytes Collection Table Entry size
+ * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
+ */
+#define GITS_CTE_SIZE                 (0x8ULL)
+
 /* Special interrupt IDs */
 #define INTID_SECURE 1020
 #define INTID_NONSECURE 1021
diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/intc/arm_gicv3_common.h"
 #include "qom/object.h"
 
+#define TYPE_ARM_GICV3_ITS "arm-gicv3-its"
+
 #define ITS_CONTROL_SIZE 0x10000
 #define ITS_TRANS_SIZE   0x10000
 #define ITS_SIZE         (ITS_CONTROL_SIZE + ITS_TRANS_SIZE)
 
 #define GITS_CTLR        0x0
 #define GITS_IIDR        0x4
+#define GITS_TYPER       0x8
 #define GITS_CBASER      0x80
 #define GITS_CWRITER     0x88
 #define GITS_CREADR      0x90
 #define GITS_BASER       0x100
 
+#define GITS_TRANSLATER  0x0040
+
 struct GICv3ITSState {
     SysBusDevice parent_obj;
 
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
     /* Registers */
     uint32_t ctlr;
     uint32_t iidr;
+    uint64_t typer;
     uint64_t cbaser;
     uint64_t cwriter;
     uint64_t creadr;
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
 
 typedef struct GICv3ITSState GICv3ITSState;
 
-void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops);
+void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
+                   const MemoryRegionOps *tops);
 
 #define TYPE_ARM_GICV3_ITS_COMMON "arm-gicv3-its-common"
 typedef struct GICv3ITSCommonClass GICv3ITSCommonClass;
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * ITS emulation for a GICv3-based system
+ *
+ * Copyright Linaro.org 2021
+ *
+ * Authors:
+ *  Shashi Mallela <shashi.mallela@linaro.org>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or (at your
+ * option) any later version.  See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/qdev-properties.h"
+#include "hw/intc/arm_gicv3_its_common.h"
+#include "gicv3_internal.h"
+#include "qom/object.h"
+#include "qapi/error.h"
+
+typedef struct GICv3ITSClass GICv3ITSClass;
+/* This is reusing the GICv3ITSState typedef from ARM_GICV3_ITS_COMMON */
+DECLARE_OBJ_CHECKERS(GICv3ITSState, GICv3ITSClass,
+                     ARM_GICV3_ITS, TYPE_ARM_GICV3_ITS)
+
+struct GICv3ITSClass {
+    GICv3ITSCommonClass parent_class;
+    void (*parent_reset)(DeviceState *dev);
+};
+
+static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
+                                               uint64_t data, unsigned size,
+                                               MemTxAttrs attrs)
+{
+    return MEMTX_OK;
+}
+
+static bool its_writel(GICv3ITSState *s, hwaddr offset,
+                              uint64_t value, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static bool its_readl(GICv3ITSState *s, hwaddr offset,
+                             uint64_t *data, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static bool its_writell(GICv3ITSState *s, hwaddr offset,
+                               uint64_t value, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static bool its_readll(GICv3ITSState *s, hwaddr offset,
+                              uint64_t *data, MemTxAttrs attrs)
+{
+    bool result = true;
+
+    return result;
+}
+
+static MemTxResult gicv3_its_read(void *opaque, hwaddr offset, uint64_t *data,
+                                  unsigned size, MemTxAttrs attrs)
+{
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    bool result;
+
+    switch (size) {
+    case 4:
+        result = its_readl(s, offset, data, attrs);
+        break;
+    case 8:
+        result = its_readll(s, offset, data, attrs);
+        break;
+    default:
+        result = false;
+        break;
+    }
+
+    if (!result) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest read at offset " TARGET_FMT_plx
+                      "size %u\n", __func__, offset, size);
+        /*
+         * The spec requires that reserved registers are RAZ/WI;
+         * so use false returns from leaf functions as a way to
+         * trigger the guest-error logging but don't return it to
+         * the caller, or we'll cause a spurious guest data abort.
+         */
+        *data = 0;
+    }
+    return MEMTX_OK;
+}
+
+static MemTxResult gicv3_its_write(void *opaque, hwaddr offset, uint64_t data,
+                                   unsigned size, MemTxAttrs attrs)
+{
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    bool result;
+
+    switch (size) {
+    case 4:
+        result = its_writel(s, offset, data, attrs);
+        break;
+    case 8:
+        result = its_writell(s, offset, data, attrs);
+        break;
+    default:
+        result = false;
+        break;
+    }
+
+    if (!result) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest write at offset " TARGET_FMT_plx
+                      "size %u\n", __func__, offset, size);
+        /*
+         * The spec requires that reserved registers are RAZ/WI;
+         * so use false returns from leaf functions as a way to
+         * trigger the guest-error logging but don't return it to
+         * the caller, or we'll cause a spurious guest data abort.
+         */
+    }
+    return MEMTX_OK;
+}
+
+static const MemoryRegionOps gicv3_its_control_ops = {
+    .read_with_attrs = gicv3_its_read,
+    .write_with_attrs = gicv3_its_write,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 8,
+    .impl.min_access_size = 4,
+    .impl.max_access_size = 8,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static const MemoryRegionOps gicv3_its_translation_ops = {
+    .write_with_attrs = gicv3_its_translation_write,
+    .valid.min_access_size = 2,
+    .valid.max_access_size = 4,
+    .impl.min_access_size = 2,
+    .impl.max_access_size = 4,
+    .endianness = DEVICE_NATIVE_ENDIAN,
+};
+
+static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
+{
+    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
+    int i;
+
+    for (i = 0; i < s->gicv3->num_cpu; i++) {
+        if (!(s->gicv3->cpu[i].gicr_typer & GICR_TYPER_PLPIS)) {
+            error_setg(errp, "Physical LPI not supported by CPU %d", i);
+            return;
+        }
+    }
+
+    gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
+
+    /* set the ITS default features supported */
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
+                          GITS_TYPE_PHYSICAL);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, ITT_ENTRY_SIZE,
+                          ITS_ITT_ENTRY_SIZE - 1);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, IDBITS, ITS_IDBITS);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, DEVBITS, ITS_DEVBITS);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIL, 1);
+    s->typer = FIELD_DP64(s->typer, GITS_TYPER, CIDBITS, ITS_CIDBITS);
+}
+
+static void gicv3_its_reset(DeviceState *dev)
+{
+    GICv3ITSState *s = ARM_GICV3_ITS_COMMON(dev);
+    GICv3ITSClass *c = ARM_GICV3_ITS_GET_CLASS(s);
+
+    c->parent_reset(dev);
+
+    /* Quiescent bit reset to 1 */
+    s->ctlr = FIELD_DP32(s->ctlr, GITS_CTLR, QUIESCENT, 1);
+
+    /*
+     * setting GITS_BASER0.Type = 0b001 (Device)
+     *         GITS_BASER1.Type = 0b100 (Collection Table)
+     *         GITS_BASER<n>.Type,where n = 3 to 7 are 0b00 (Unimplemented)
+     *         GITS_BASER<0,1>.Page_Size = 64KB
+     * and default translation table entry size to 16 bytes
+     */
+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, TYPE,
+                             GITS_BASER_TYPE_DEVICE);
+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, PAGESIZE,
+                             GITS_BASER_PAGESIZE_64K);
+    s->baser[0] = FIELD_DP64(s->baser[0], GITS_BASER, ENTRYSIZE,
+                             GITS_DTE_SIZE - 1);
+
+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, TYPE,
+                             GITS_BASER_TYPE_COLLECTION);
+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, PAGESIZE,
+                             GITS_BASER_PAGESIZE_64K);
+    s->baser[1] = FIELD_DP64(s->baser[1], GITS_BASER, ENTRYSIZE,
+                             GITS_CTE_SIZE - 1);
+}
+
+static Property gicv3_its_props[] = {
+    DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
+                     GICv3State *),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void gicv3_its_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
+
+    dc->realize = gicv3_arm_its_realize;
+    device_class_set_props(dc, gicv3_its_props);
+    device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
+}
+
+static const TypeInfo gicv3_its_info = {
+    .name = TYPE_ARM_GICV3_ITS,
+    .parent = TYPE_ARM_GICV3_ITS_COMMON,
+    .instance_size = sizeof(GICv3ITSState),
+    .class_init = gicv3_its_class_init,
+    .class_size = sizeof(GICv3ITSClass),
+};
+
+static void gicv3_its_register_types(void)
+{
+    type_register_static(&gicv3_its_info);
+}
+
+type_init(gicv3_its_register_types)
diff --git a/hw/intc/arm_gicv3_its_common.c b/hw/intc/arm_gicv3_its_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_common.c
+++ b/hw/intc/arm_gicv3_its_common.c
@@ -XXX,XX +XXX,XX @@ static int gicv3_its_post_load(void *opaque, int version_id)
 
 static const VMStateDescription vmstate_its = {
     .name = "arm_gicv3_its",
+    .version_id = 1,
+    .minimum_version_id = 1,
     .pre_save = gicv3_its_pre_save,
     .post_load = gicv3_its_post_load,
     .priority = MIG_PRI_GICV3_ITS,
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps gicv3_its_trans_ops = {
     .endianness = DEVICE_NATIVE_ENDIAN,
 };
 
-void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops)
+void gicv3_its_init_mmio(GICv3ITSState *s, const MemoryRegionOps *ops,
+                         const MemoryRegionOps *tops)
 {
     SysBusDevice *sbd = SYS_BUS_DEVICE(s);
 
     memory_region_init_io(&s->iomem_its_cntrl, OBJECT(s), ops, s,
                           "control", ITS_CONTROL_SIZE);
     memory_region_init_io(&s->iomem_its_translation, OBJECT(s),
-                          &gicv3_its_trans_ops, s,
+                          tops ? tops : &gicv3_its_trans_ops, s,
                           "translation", ITS_TRANS_SIZE);
 
     /* Our two regions are always adjacent, therefore we now combine them
diff --git a/hw/intc/arm_gicv3_its_kvm.c b/hw/intc/arm_gicv3_its_kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its_kvm.c
+++ b/hw/intc/arm_gicv3_its_kvm.c
@@ -XXX,XX +XXX,XX @@ static void kvm_arm_its_realize(DeviceState *dev, Error **errp)
     kvm_arm_register_device(&s->iomem_its_cntrl, -1, KVM_DEV_ARM_VGIC_GRP_ADDR,
                             KVM_VGIC_ITS_ADDR_TYPE, s->dev_fd, 0);
 
-    gicv3_its_init_mmio(s, NULL);
+    gicv3_its_init_mmio(s, NULL, NULL);
 
     if (!kvm_device_check_attr(s->dev_fd, KVM_DEV_ARM_VGIC_GRP_ITS_REGS,
         GITS_CTLR)) {
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
   'arm_gicv3_dist.c',
   'arm_gicv3_its_common.c',
   'arm_gicv3_redist.c',
+  'arm_gicv3_its.c',
 ))
 softmmu_ss.add(when: 'CONFIG_ETRAXFS', if_true: files('etraxfs_pic.c'))
 softmmu_ss.add(when: 'CONFIG_HEATHROW_PIC', if_true: files('heathrow_pic.c'))
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Defined descriptors for ITS device table,collection table and ITS
command queue entities.Implemented register read/write functions,
extract ITS table parameters and command queue parameters,extended
gicv3 common to capture qemu address space(which host the ITS table
platform memories required for subsequent ITS processing) and
initialize the same in ITS device.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Message-id: 20210910143951.92242-3-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h               |  29 ++
 include/hw/intc/arm_gicv3_common.h     |   3 +
 include/hw/intc/arm_gicv3_its_common.h |  23 ++
 hw/intc/arm_gicv3_its.c                | 376 +++++++++++++++++++++++++
 4 files changed, 431 insertions(+)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_BASER, INNERCACHE, 59, 3)
 FIELD(GITS_BASER, INDIRECT, 62, 1)
 FIELD(GITS_BASER, VALID, 63, 1)
 
+FIELD(GITS_CBASER, SIZE, 0, 8)
+FIELD(GITS_CBASER, SHAREABILITY, 10, 2)
+FIELD(GITS_CBASER, PHYADDR, 12, 40)
+FIELD(GITS_CBASER, OUTERCACHE, 53, 3)
+FIELD(GITS_CBASER, INNERCACHE, 59, 3)
+FIELD(GITS_CBASER, VALID, 63, 1)
+
+FIELD(GITS_CREADR, STALLED, 0, 1)
+FIELD(GITS_CREADR, OFFSET, 5, 15)
+
+FIELD(GITS_CWRITER, RETRY, 0, 1)
+FIELD(GITS_CWRITER, OFFSET, 5, 15)
+
+FIELD(GITS_CTLR, ENABLED, 0, 1)
 FIELD(GITS_CTLR, QUIESCENT, 31, 1)
 
 FIELD(GITS_TYPER, PHYSICAL, 0, 1)
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, PTA, 19, 1)
 FIELD(GITS_TYPER, CIDBITS, 32, 4)
 FIELD(GITS_TYPER, CIL, 36, 1)
 
+#define GITS_IDREGS           0xFFD0
+
+#define ITS_CTLR_ENABLED               (1U)  /* ITS Enabled */
+
+#define GITS_BASER_RO_MASK                  (R_GITS_BASER_ENTRYSIZE_MASK | \
+                                              R_GITS_BASER_TYPE_MASK)
+
 #define GITS_BASER_PAGESIZE_4K                0
 #define GITS_BASER_PAGESIZE_16K               1
 #define GITS_BASER_PAGESIZE_64K               2
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
 #define GITS_BASER_TYPE_DEVICE               1ULL
 #define GITS_BASER_TYPE_COLLECTION           4ULL
 
+#define GITS_PAGE_SIZE_4K       0x1000
+#define GITS_PAGE_SIZE_16K      0x4000
+#define GITS_PAGE_SIZE_64K      0x10000
+
+#define L1TABLE_ENTRY_SIZE         8
+
+#define GITS_CMDQ_ENTRY_SIZE               32
+
 /**
  * Default features advertised by this version of ITS
  */
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3State {
     int dev_fd; /* kvm device fd if backed by kvm vgic support */
     Error *migration_blocker;
 
+    MemoryRegion *dma;
+    AddressSpace dma_as;
+
     /* Distributor */
 
     /* for a GIC with the security extensions the NS banked version of this
diff --git a/include/hw/intc/arm_gicv3_its_common.h b/include/hw/intc/arm_gicv3_its_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_its_common.h
+++ b/include/hw/intc/arm_gicv3_its_common.h
@@ -XXX,XX +XXX,XX @@
 
 #define GITS_TRANSLATER  0x0040
 
+typedef struct {
+    bool valid;
+    bool indirect;
+    uint16_t entry_sz;
+    uint32_t page_sz;
+    uint32_t max_entries;
+    union {
+        uint32_t max_devids;
+        uint32_t max_collids;
+    } maxids;
+    uint64_t base_addr;
+} TableDesc;
+
+typedef struct {
+    bool valid;
+    uint32_t max_entries;
+    uint64_t base_addr;
+} CmdQDesc;
+
 struct GICv3ITSState {
     SysBusDevice parent_obj;
 
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSState {
     uint64_t creadr;
     uint64_t baser[8];
 
+    TableDesc  dt;
+    TableDesc  ct;
+    CmdQDesc   cq;
+
     Error *migration_blocker;
 };
 
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
     void (*parent_reset)(DeviceState *dev);
 };
 
+static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
+{
+    uint64_t result = 0;
+
+    switch (page_sz) {
+    case GITS_PAGE_SIZE_4K:
+    case GITS_PAGE_SIZE_16K:
+        result = FIELD_EX64(value, GITS_BASER, PHYADDR) << 12;
+        break;
+
+    case GITS_PAGE_SIZE_64K:
+        result = FIELD_EX64(value, GITS_BASER, PHYADDRL_64K) << 16;
+        result |= FIELD_EX64(value, GITS_BASER, PHYADDRH_64K) << 48;
+        break;
+
+    default:
+        break;
+    }
+    return result;
+}
+
+/*
+ * This function extracts the ITS Device and Collection table specific
+ * parameters (like base_addr, size etc) from GITS_BASER register.
+ * It is called during ITS enable and also during post_load migration
+ */
+static void extract_table_params(GICv3ITSState *s)
+{
+    uint16_t num_pages = 0;
+    uint8_t  page_sz_type;
+    uint8_t type;
+    uint32_t page_sz = 0;
+    uint64_t value;
+
+    for (int i = 0; i < 8; i++) {
+        value = s->baser[i];
+
+        if (!value) {
+            continue;
+        }
+
+        page_sz_type = FIELD_EX64(value, GITS_BASER, PAGESIZE);
+
+        switch (page_sz_type) {
+        case 0:
+            page_sz = GITS_PAGE_SIZE_4K;
+            break;
+
+        case 1:
+            page_sz = GITS_PAGE_SIZE_16K;
+            break;
+
+        case 2:
+        case 3:
+            page_sz = GITS_PAGE_SIZE_64K;
+            break;
+
+        default:
+            g_assert_not_reached();
+        }
+
+        num_pages = FIELD_EX64(value, GITS_BASER, SIZE) + 1;
+
+        type = FIELD_EX64(value, GITS_BASER, TYPE);
+
+        switch (type) {
+
+        case GITS_BASER_TYPE_DEVICE:
+            memset(&s->dt, 0 , sizeof(s->dt));
+            s->dt.valid = FIELD_EX64(value, GITS_BASER, VALID);
+
+            if (!s->dt.valid) {
+                return;
+            }
+
+            s->dt.page_sz = page_sz;
+            s->dt.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
+            s->dt.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
+
+            if (!s->dt.indirect) {
+                s->dt.max_entries = (num_pages * page_sz) / s->dt.entry_sz;
+            } else {
+                s->dt.max_entries = (((num_pages * page_sz) /
+                                     L1TABLE_ENTRY_SIZE) *
+                                     (page_sz / s->dt.entry_sz));
+            }
+
+            s->dt.maxids.max_devids = (1UL << (FIELD_EX64(s->typer, GITS_TYPER,
+                                       DEVBITS) + 1));
+
+            s->dt.base_addr = baser_base_addr(value, page_sz);
+
+            break;
+
+        case GITS_BASER_TYPE_COLLECTION:
+            memset(&s->ct, 0 , sizeof(s->ct));
+            s->ct.valid = FIELD_EX64(value, GITS_BASER, VALID);
+
+            /*
+             * GITS_TYPER.HCC is 0 for this implementation
+             * hence writes are discarded if ct.valid is 0
+             */
+            if (!s->ct.valid) {
+                return;
+            }
+
+            s->ct.page_sz = page_sz;
+            s->ct.indirect = FIELD_EX64(value, GITS_BASER, INDIRECT);
+            s->ct.entry_sz = FIELD_EX64(value, GITS_BASER, ENTRYSIZE);
+
+            if (!s->ct.indirect) {
+                s->ct.max_entries = (num_pages * page_sz) / s->ct.entry_sz;
+            } else {
+                s->ct.max_entries = (((num_pages * page_sz) /
+                                     L1TABLE_ENTRY_SIZE) *
+                                     (page_sz / s->ct.entry_sz));
+            }
+
+            if (FIELD_EX64(s->typer, GITS_TYPER, CIL)) {
+                s->ct.maxids.max_collids = (1UL << (FIELD_EX64(s->typer,
+                                            GITS_TYPER, CIDBITS) + 1));
+            } else {
+                /* 16-bit CollectionId supported when CIL == 0 */
+                s->ct.maxids.max_collids = (1UL << 16);
+            }
+
+            s->ct.base_addr = baser_base_addr(value, page_sz);
+
+            break;
+
+        default:
+            break;
+        }
+    }
+}
+
+static void extract_cmdq_params(GICv3ITSState *s)
+{
+    uint16_t num_pages = 0;
+    uint64_t value = s->cbaser;
+
+    num_pages = FIELD_EX64(value, GITS_CBASER, SIZE) + 1;
+
+    memset(&s->cq, 0 , sizeof(s->cq));
+    s->cq.valid = FIELD_EX64(value, GITS_CBASER, VALID);
+
+    if (s->cq.valid) {
+        s->cq.max_entries = (num_pages * GITS_PAGE_SIZE_4K) /
+                             GITS_CMDQ_ENTRY_SIZE;
+        s->cq.base_addr = FIELD_EX64(value, GITS_CBASER, PHYADDR);
+        s->cq.base_addr <<= R_GITS_CBASER_PHYADDR_SHIFT;
+    }
+}
+
 static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
                                                uint64_t data, unsigned size,
                                                MemTxAttrs attrs)
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
                               uint64_t value, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_CTLR:
+        s->ctlr |= (value & ~(s->ctlr));
+
+        if (s->ctlr & ITS_CTLR_ENABLED) {
+            extract_table_params(s);
+            extract_cmdq_params(s);
+            s->creadr = 0;
+        }
+        break;
+    case GITS_CBASER:
+        /*
+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            s->cbaser = deposit64(s->cbaser, 0, 32, value);
+            s->creadr = 0;
+            s->cwriter = s->creadr;
+        }
+        break;
+    case GITS_CBASER + 4:
+        /*
+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            s->cbaser = deposit64(s->cbaser, 32, 32, value);
+            s->creadr = 0;
+            s->cwriter = s->creadr;
+        }
+        break;
+    case GITS_CWRITER:
+        s->cwriter = deposit64(s->cwriter, 0, 32,
+                               (value & ~R_GITS_CWRITER_RETRY_MASK));
+        break;
+    case GITS_CWRITER + 4:
+        s->cwriter = deposit64(s->cwriter, 32, 32, value);
+        break;
+    case GITS_CREADR:
+        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
+            s->creadr = deposit64(s->creadr, 0, 32,
+                                  (value & ~R_GITS_CREADR_STALLED_MASK));
+        } else {
+            /* RO register, ignore the write */
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid guest write to RO register at offset "
+                          TARGET_FMT_plx "\n", __func__, offset);
+        }
+        break;
+    case GITS_CREADR + 4:
+        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
+            s->creadr = deposit64(s->creadr, 32, 32, value);
+        } else {
+            /* RO register, ignore the write */
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid guest write to RO register at offset "
+                          TARGET_FMT_plx "\n", __func__, offset);
+        }
+        break;
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        /*
+         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            index = (offset - GITS_BASER) / 8;
+
+            if (offset & 7) {
+                value <<= 32;
+                value &= ~GITS_BASER_RO_MASK;
+                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(0, 32);
+                s->baser[index] |= value;
+            } else {
+                value &= ~GITS_BASER_RO_MASK;
+                s->baser[index] &= GITS_BASER_RO_MASK | MAKE_64BIT_MASK(32, 32);
+                s->baser[index] |= value;
+            }
+        }
+        break;
+    case GITS_IIDR:
+    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
+        /* RO registers, ignore the write */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest write to RO register at offset "
+                      TARGET_FMT_plx "\n", __func__, offset);
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool its_readl(GICv3ITSState *s, hwaddr offset,
                              uint64_t *data, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_CTLR:
+        *data = s->ctlr;
+        break;
+    case GITS_IIDR:
+        *data = gicv3_iidr();
+        break;
+    case GITS_IDREGS ... GITS_IDREGS + 0x2f:
+        /* ID registers */
+        *data = gicv3_idreg(offset - GITS_IDREGS);
+        break;
+    case GITS_TYPER:
+        *data = extract64(s->typer, 0, 32);
+        break;
+    case GITS_TYPER + 4:
+        *data = extract64(s->typer, 32, 32);
+        break;
+    case GITS_CBASER:
+        *data = extract64(s->cbaser, 0, 32);
+        break;
+    case GITS_CBASER + 4:
+        *data = extract64(s->cbaser, 32, 32);
+        break;
+    case GITS_CREADR:
+        *data = extract64(s->creadr, 0, 32);
+        break;
+    case GITS_CREADR + 4:
+        *data = extract64(s->creadr, 32, 32);
+        break;
+    case GITS_CWRITER:
+        *data = extract64(s->cwriter, 0, 32);
+        break;
+    case GITS_CWRITER + 4:
+        *data = extract64(s->cwriter, 32, 32);
+        break;
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        index = (offset - GITS_BASER) / 8;
+        if (offset & 7) {
+            *data = extract64(s->baser[index], 32, 32);
+        } else {
+            *data = extract64(s->baser[index], 0, 32);
+        }
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
                                uint64_t value, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        /*
+         * IMPDEF choice:- GITS_BASERn register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            index = (offset - GITS_BASER) / 8;
+            s->baser[index] &= GITS_BASER_RO_MASK;
+            s->baser[index] |= (value & ~GITS_BASER_RO_MASK);
+        }
+        break;
+    case GITS_CBASER:
+        /*
+         * IMPDEF choice:- GITS_CBASER register becomes RO if ITS is
+         *                 already enabled
+         */
+        if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+            s->cbaser = value;
+            s->creadr = 0;
+            s->cwriter = s->creadr;
+        }
+        break;
+    case GITS_CWRITER:
+        s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
+        break;
+    case GITS_CREADR:
+        if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
+            s->creadr = value & ~R_GITS_CREADR_STALLED_MASK;
+        } else {
+            /* RO register, ignore the write */
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: invalid guest write to RO register at offset "
+                          TARGET_FMT_plx "\n", __func__, offset);
+        }
+        break;
+    case GITS_TYPER:
+        /* RO registers, ignore the write */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid guest write to RO register at offset "
+                      TARGET_FMT_plx "\n", __func__, offset);
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool its_readll(GICv3ITSState *s, hwaddr offset,
                               uint64_t *data, MemTxAttrs attrs)
 {
     bool result = true;
+    int index;
 
+    switch (offset) {
+    case GITS_TYPER:
+        *data = s->typer;
+        break;
+    case GITS_BASER ... GITS_BASER + 0x3f:
+        index = (offset - GITS_BASER) / 8;
+        *data = s->baser[index];
+        break;
+    case GITS_CBASER:
+        *data = s->cbaser;
+        break;
+    case GITS_CREADR:
+        *data = s->creadr;
+        break;
+    case GITS_CWRITER:
+        *data = s->cwriter;
+        break;
+    default:
+        result = false;
+        break;
+    }
     return result;
 }
 
@@ -XXX,XX +XXX,XX @@ static void gicv3_arm_its_realize(DeviceState *dev, Error **errp)
 
     gicv3_its_init_mmio(s, &gicv3_its_control_ops, &gicv3_its_translation_ops);
 
+    address_space_init(&s->gicv3->dma_as, s->gicv3->dma,
+                       "gicv3-its-sysmem");
+
     /* set the ITS default features supported */
     s->typer = FIELD_DP64(s->typer, GITS_TYPER, PHYSICAL,
                           GITS_TYPE_PHYSICAL);
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_reset(DeviceState *dev)
                              GITS_CTE_SIZE - 1);
 }
 
+static void gicv3_its_post_load(GICv3ITSState *s)
+{
+    if (s->ctlr & ITS_CTLR_ENABLED) {
+        extract_table_params(s);
+        extract_cmdq_params(s);
+    }
+}
+
 static Property gicv3_its_props[] = {
     DEFINE_PROP_LINK("parent-gicv3", GICv3ITSState, gicv3, "arm-gicv3",
                      GICv3State *),
@@ -XXX,XX +XXX,XX @@ static void gicv3_its_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     GICv3ITSClass *ic = ARM_GICV3_ITS_CLASS(klass);
+    GICv3ITSCommonClass *icc = ARM_GICV3_ITS_COMMON_CLASS(klass);
 
     dc->realize = gicv3_arm_its_realize;
     device_class_set_props(dc, gicv3_its_props);
     device_class_set_parent_reset(dc, gicv3_its_reset, &ic->parent_reset);
+    icc->post_load = gicv3_its_post_load;
 }
 
 static const TypeInfo gicv3_its_info = {
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added functionality to trigger ITS command queue processing on
write to CWRITE register and process each command queue entry to
identify the command type and handle commands like MAPD,MAPC,SYNC.

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
 #define L1TABLE_ENTRY_SIZE         8
 
 #define GITS_CMDQ_ENTRY_SIZE               32
+#define NUM_BYTES_IN_DW                     8
+
+#define CMD_MASK                  0xff
+
+/* ITS Commands */
+#define GITS_CMD_CLEAR            0x04
+#define GITS_CMD_DISCARD          0x0F
+#define GITS_CMD_INT              0x03
+#define GITS_CMD_MAPC             0x09
+#define GITS_CMD_MAPD             0x08
+#define GITS_CMD_MAPI             0x0B
+#define GITS_CMD_MAPTI            0x0A
+#define GITS_CMD_INV              0x0C
+#define GITS_CMD_INVALL           0x0D
+#define GITS_CMD_SYNC             0x05
+
+/* MAPC command fields */
+#define ICID_LENGTH                  16
+#define ICID_MASK                 ((1U << ICID_LENGTH) - 1)
+FIELD(MAPC, RDBASE, 16, 32)
+
+#define RDBASE_PROCNUM_LENGTH        16
+#define RDBASE_PROCNUM_MASK       ((1ULL << RDBASE_PROCNUM_LENGTH) - 1)
+
+/* MAPD command fields */
+#define ITTADDR_LENGTH               44
+#define ITTADDR_SHIFT                 8
+#define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
+#define SIZE_MASK                 0x1f
+
+#define DEVID_SHIFT                  32
+#define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
+
+#define VALID_SHIFT               63
+#define CMD_FIELD_VALID_MASK      (1ULL << VALID_SHIFT)
+#define L2_TABLE_VALID_MASK       CMD_FIELD_VALID_MASK
+#define TABLE_ENTRY_VALID_MASK    (1ULL << 0)
 
 /**
  * Default features advertised by this version of ITS
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
  * Valid = 1 bit,ITTAddr = 44 bits,Size = 5 bits
  */
 #define GITS_DTE_SIZE                 (0x8ULL)
+#define GITS_DTE_ITTADDR_SHIFT           6
+#define GITS_DTE_ITTADDR_MASK         MAKE_64BIT_MASK(GITS_DTE_ITTADDR_SHIFT, \
+                                                      ITTADDR_LENGTH)
 
 /*
  * 8 bytes Collection Table Entry size
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
     return result;
 }
 
+static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
+                       uint64_t rdbase)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t value;
+    uint64_t l2t_addr;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+    uint64_t cte = 0;
+    MemTxResult res = MEMTX_OK;
+
+    if (!s->ct.valid) {
+        return true;
+    }
+
+    if (valid) {
+        /* add mapping entry to collection table */
+        cte = (valid & TABLE_ENTRY_VALID_MASK) | (rdbase << 1ULL);
+    }
+
+    /*
+     * The specification defines the format of level 1 entries of a
+     * 2-level table, but the format of level 2 entries and the format
+     * of flat-mapped tables is IMPDEF.
+     */
+    if (s->ct.indirect) {
+        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->ct.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, &res);
+
+        if (res != MEMTX_OK) {
+            return false;
+        }
+
+        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+        if (valid_l2t) {
+            max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
+
+            l2t_addr = value & ((1ULL << 51) - 1);
+
+            address_space_stq_le(as, l2t_addr +
+                                 ((icid % max_l2_entries) * GITS_CTE_SIZE),
+                                 cte, MEMTXATTRS_UNSPECIFIED, &res);
+        }
+    } else {
+        /* Flat level table */
+        address_space_stq_le(as, s->ct.base_addr + (icid * GITS_CTE_SIZE),
+                             cte, MEMTXATTRS_UNSPECIFIED, &res);
+    }
+    if (res != MEMTX_OK) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
+static bool process_mapc(GICv3ITSState *s, uint32_t offset)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint16_t icid;
+    uint64_t rdbase;
+    bool valid;
+    MemTxResult res = MEMTX_OK;
+    bool result = false;
+    uint64_t value;
+
+    offset += NUM_BYTES_IN_DW;
+    offset += NUM_BYTES_IN_DW;
+
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    icid = value & ICID_MASK;
+
+    rdbase = (value & R_MAPC_RDBASE_MASK) >> R_MAPC_RDBASE_SHIFT;
+    rdbase &= RDBASE_PROCNUM_MASK;
+
+    valid = (value & CMD_FIELD_VALID_MASK);
+
+    if ((icid > s->ct.maxids.max_collids) || (rdbase > s->gicv3->num_cpu)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "ITS MAPC: invalid collection table attributes "
+                      "icid %d rdbase %lu\n",  icid, rdbase);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        result = update_cte(s, icid, valid, rdbase);
+    }
+
+    return result;
+}
+
+static bool update_dte(GICv3ITSState *s, uint32_t devid, bool valid,
+                       uint8_t size, uint64_t itt_addr)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t value;
+    uint64_t l2t_addr;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+    uint64_t dte = 0;
+    MemTxResult res = MEMTX_OK;
+
+    if (s->dt.valid) {
+        if (valid) {
+            /* add mapping entry to device table */
+            dte = (valid & TABLE_ENTRY_VALID_MASK) |
+                  ((size & SIZE_MASK) << 1U) |
+                  (itt_addr << GITS_DTE_ITTADDR_SHIFT);
+        }
+    } else {
+        return true;
+    }
+
+    /*
+     * The specification defines the format of level 1 entries of a
+     * 2-level table, but the format of level 2 entries and the format
+     * of flat-mapped tables is IMPDEF.
+     */
+    if (s->dt.indirect) {
+        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->dt.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, &res);
+
+        if (res != MEMTX_OK) {
+            return false;
+        }
+
+        valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+        if (valid_l2t) {
+            max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
+
+            l2t_addr = value & ((1ULL << 51) - 1);
+
+            address_space_stq_le(as, l2t_addr +
+                                 ((devid % max_l2_entries) * GITS_DTE_SIZE),
+                                 dte, MEMTXATTRS_UNSPECIFIED, &res);
+        }
+    } else {
+        /* Flat level table */
+        address_space_stq_le(as, s->dt.base_addr + (devid * GITS_DTE_SIZE),
+                             dte, MEMTXATTRS_UNSPECIFIED, &res);
+    }
+    if (res != MEMTX_OK) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
+static bool process_mapd(GICv3ITSState *s, uint64_t value, uint32_t offset)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint32_t devid;
+    uint8_t size;
+    uint64_t itt_addr;
+    bool valid;
+    MemTxResult res = MEMTX_OK;
+    bool result = false;
+
+    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
+
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    size = (value & SIZE_MASK);
+
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    itt_addr = (value & ITTADDR_MASK) >> ITTADDR_SHIFT;
+
+    valid = (value & CMD_FIELD_VALID_MASK);
+
+    if ((devid > s->dt.maxids.max_devids) ||
+        (size > FIELD_EX64(s->typer, GITS_TYPER, IDBITS))) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "ITS MAPD: invalid device table attributes "
+                      "devid %d or size %d\n", devid, size);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        result = update_dte(s, devid, valid, size, itt_addr);
+    }
+
+    return result;
+}
+
+/*
+ * Current implementation blocks until all
+ * commands are processed
+ */
+static void process_cmdq(GICv3ITSState *s)
+{
+    uint32_t wr_offset = 0;
+    uint32_t rd_offset = 0;
+    uint32_t cq_offset = 0;
+    uint64_t data;
+    AddressSpace *as = &s->gicv3->dma_as;
+    MemTxResult res = MEMTX_OK;
+    bool result = true;
+    uint8_t cmd;
+
+    if (!(s->ctlr & ITS_CTLR_ENABLED)) {
+        return;
+    }
+
+    wr_offset = FIELD_EX64(s->cwriter, GITS_CWRITER, OFFSET);
+
+    if (wr_offset > s->cq.max_entries) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid write offset "
+                      "%d\n", __func__, wr_offset);
+        return;
+    }
+
+    rd_offset = FIELD_EX64(s->creadr, GITS_CREADR, OFFSET);
+
+    if (rd_offset > s->cq.max_entries) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid read offset "
+                      "%d\n", __func__, rd_offset);
+        return;
+    }
+
+    while (wr_offset != rd_offset) {
+        cq_offset = (rd_offset * GITS_CMDQ_ENTRY_SIZE);
+        data = address_space_ldq_le(as, s->cq.base_addr + cq_offset,
+                                    MEMTXATTRS_UNSPECIFIED, &res);
+        if (res != MEMTX_OK) {
+            result = false;
+        }
+        cmd = (data & CMD_MASK);
+
+        switch (cmd) {
+        case GITS_CMD_INT:
+            break;
+        case GITS_CMD_CLEAR:
+            break;
+        case GITS_CMD_SYNC:
+            /*
+             * Current implementation makes a blocking synchronous call
+             * for every command issued earlier, hence the internal state
+             * is already consistent by the time SYNC command is executed.
+             * Hence no further processing is required for SYNC command.
+             */
+            break;
+        case GITS_CMD_MAPD:
+            result = process_mapd(s, data, cq_offset);
+            break;
+        case GITS_CMD_MAPC:
+            result = process_mapc(s, cq_offset);
+            break;
+        case GITS_CMD_MAPTI:
+            break;
+        case GITS_CMD_MAPI:
+            break;
+        case GITS_CMD_DISCARD:
+            break;
+        case GITS_CMD_INV:
+        case GITS_CMD_INVALL:
+            break;
+        default:
+            break;
+        }
+        if (result) {
+            rd_offset++;
+            rd_offset %= s->cq.max_entries;
+            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, OFFSET, rd_offset);
+        } else {
+            /*
+             * in this implementation, in case of dma read/write error
+             * we stall the command processing
+             */
+            s->creadr = FIELD_DP64(s->creadr, GITS_CREADR, STALLED, 1);
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: %x cmd processing failed\n", __func__, cmd);
+            break;
+        }
+    }
+}
+
 /*
  * This function extracts the ITS Device and Collection table specific
  * parameters (like base_addr, size etc) from GITS_BASER register.
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
             extract_table_params(s);
             extract_cmdq_params(s);
             s->creadr = 0;
+            process_cmdq(s);
         }
         break;
     case GITS_CBASER:
@@ -XXX,XX +XXX,XX @@ static bool its_writel(GICv3ITSState *s, hwaddr offset,
     case GITS_CWRITER:
         s->cwriter = deposit64(s->cwriter, 0, 32,
                                (value & ~R_GITS_CWRITER_RETRY_MASK));
+        if (s->cwriter != s->creadr) {
+            process_cmdq(s);
+        }
         break;
     case GITS_CWRITER + 4:
         s->cwriter = deposit64(s->cwriter, 32, 32, value);
@@ -XXX,XX +XXX,XX @@ static bool its_writell(GICv3ITSState *s, hwaddr offset,
         break;
     case GITS_CWRITER:
         s->cwriter = value & ~R_GITS_CWRITER_RETRY_MASK;
+        if (s->cwriter != s->creadr) {
+            process_cmdq(s);
+        }
         break;
     case GITS_CREADR:
         if (s->gicv3->gicd_ctlr & GICD_CTLR_DS) {
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added ITS command queue handling for MAPTI,MAPI commands,handled ITS
translation which triggers an LPI via INT command as well as write
to GITS_TRANSLATER register,defined enum to differentiate between ITS
command interrupt trigger and GITS_TRANSLATER based interrupt trigger.
Each of these commands make use of other functionalities implemented to
get device table entry,collection table entry or interrupt translation
table entry required for their processing.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-5-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h           |  12 +
 include/hw/intc/arm_gicv3_common.h |   2 +
 hw/intc/arm_gicv3_its.c            | 365 ++++++++++++++++++++++++++++-
 3 files changed, 378 insertions(+), 1 deletion(-)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
 #define ITTADDR_MASK             MAKE_64BIT_MASK(ITTADDR_SHIFT, ITTADDR_LENGTH)
 #define SIZE_MASK                 0x1f
 
+/* MAPI command fields */
+#define EVENTID_MASK              ((1ULL << 32) - 1)
+
+/* MAPTI command fields */
+#define pINTID_SHIFT                 32
+#define pINTID_MASK               MAKE_64BIT_MASK(32, 32)
+
 #define DEVID_SHIFT                  32
 #define DEVID_MASK                MAKE_64BIT_MASK(32, 32)
 
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
  *   Values:  |  vPEID    |  ICID   |
  */
 #define ITS_ITT_ENTRY_SIZE            0xC
+#define ITE_ENTRY_INTTYPE_SHIFT        1
+#define ITE_ENTRY_INTID_SHIFT          2
+#define ITE_ENTRY_INTID_MASK         MAKE_64BIT_MASK(2, 24)
+#define ITE_ENTRY_INTSP_SHIFT          26
+#define ITE_ENTRY_ICID_MASK          MAKE_64BIT_MASK(0, 16)
 
 /* 16 bits EventId */
 #define ITS_IDBITS                   GICD_TYPER_IDBITS
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@
 #define GICV3_MAXIRQ 1020
 #define GICV3_MAXSPI (GICV3_MAXIRQ - GIC_INTERNAL)
 
+#define GICV3_LPI_INTID_START 8192
+
 #define GICV3_REDIST_SIZE 0x20000
 
 /* Number of SGI target-list bits */
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ struct GICv3ITSClass {
     void (*parent_reset)(DeviceState *dev);
 };
 
+/*
+ * This is an internal enum used to distinguish between LPI triggered
+ * via command queue and LPI triggered via gits_translater write.
+ */
+typedef enum ItsCmdType {
+    NONE = 0, /* internal indication for GITS_TRANSLATER write */
+    CLEAR = 1,
+    DISCARD = 2,
+    INT = 3,
+} ItsCmdType;
+
+typedef struct {
+    uint32_t iteh;
+    uint64_t itel;
+} IteEntry;
+
 static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
 {
     uint64_t result = 0;
@@ -XXX,XX +XXX,XX @@ static uint64_t baser_base_addr(uint64_t value, uint32_t page_sz)
     return result;
 }
 
+static bool get_cte(GICv3ITSState *s, uint16_t icid, uint64_t *cte,
+                    MemTxResult *res)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t l2t_addr;
+    uint64_t value;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+
+    if (s->ct.indirect) {
+        l2t_id = icid / (s->ct.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->ct.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, res);
+
+        if (*res == MEMTX_OK) {
+            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+            if (valid_l2t) {
+                max_l2_entries = s->ct.page_sz / s->ct.entry_sz;
+
+                l2t_addr = value & ((1ULL << 51) - 1);
+
+                *cte =  address_space_ldq_le(as, l2t_addr +
+                                    ((icid % max_l2_entries) * GITS_CTE_SIZE),
+                                    MEMTXATTRS_UNSPECIFIED, res);
+           }
+       }
+    } else {
+        /* Flat level table */
+        *cte =  address_space_ldq_le(as, s->ct.base_addr +
+                                     (icid * GITS_CTE_SIZE),
+                                      MEMTXATTRS_UNSPECIFIED, res);
+    }
+
+    return (*cte & TABLE_ENTRY_VALID_MASK) != 0;
+}
+
+static bool update_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
+                       IteEntry ite)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t itt_addr;
+    MemTxResult res = MEMTX_OK;
+
+    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
+    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
+
+    address_space_stq_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
+                         sizeof(uint32_t))), ite.itel, MEMTXATTRS_UNSPECIFIED,
+                         &res);
+
+    if (res == MEMTX_OK) {
+        address_space_stl_le(as, itt_addr + (eventid * (sizeof(uint64_t) +
+                             sizeof(uint32_t))) + sizeof(uint32_t), ite.iteh,
+                             MEMTXATTRS_UNSPECIFIED, &res);
+    }
+    if (res != MEMTX_OK) {
+        return false;
+    } else {
+        return true;
+    }
+}
+
+static bool get_ite(GICv3ITSState *s, uint32_t eventid, uint64_t dte,
+                    uint16_t *icid, uint32_t *pIntid, MemTxResult *res)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t itt_addr;
+    bool status = false;
+    IteEntry ite = {};
+
+    itt_addr = (dte & GITS_DTE_ITTADDR_MASK) >> GITS_DTE_ITTADDR_SHIFT;
+    itt_addr <<= ITTADDR_SHIFT; /* 256 byte aligned */
+
+    ite.itel = address_space_ldq_le(as, itt_addr +
+                                    (eventid * (sizeof(uint64_t) +
+                                    sizeof(uint32_t))), MEMTXATTRS_UNSPECIFIED,
+                                    res);
+
+    if (*res == MEMTX_OK) {
+        ite.iteh = address_space_ldl_le(as, itt_addr +
+                                        (eventid * (sizeof(uint64_t) +
+                                        sizeof(uint32_t))) + sizeof(uint32_t),
+                                        MEMTXATTRS_UNSPECIFIED, res);
+
+        if (*res == MEMTX_OK) {
+            if (ite.itel & TABLE_ENTRY_VALID_MASK) {
+                if ((ite.itel >> ITE_ENTRY_INTTYPE_SHIFT) &
+                    GITS_TYPE_PHYSICAL) {
+                    *pIntid = (ite.itel & ITE_ENTRY_INTID_MASK) >>
+                               ITE_ENTRY_INTID_SHIFT;
+                    *icid = ite.iteh & ITE_ENTRY_ICID_MASK;
+                    status = true;
+                }
+            }
+        }
+    }
+    return status;
+}
+
+static uint64_t get_dte(GICv3ITSState *s, uint32_t devid, MemTxResult *res)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint64_t l2t_addr;
+    uint64_t value;
+    bool valid_l2t;
+    uint32_t l2t_id;
+    uint32_t max_l2_entries;
+
+    if (s->dt.indirect) {
+        l2t_id = devid / (s->dt.page_sz / L1TABLE_ENTRY_SIZE);
+
+        value = address_space_ldq_le(as,
+                                     s->dt.base_addr +
+                                     (l2t_id * L1TABLE_ENTRY_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, res);
+
+        if (*res == MEMTX_OK) {
+            valid_l2t = (value & L2_TABLE_VALID_MASK) != 0;
+
+            if (valid_l2t) {
+                max_l2_entries = s->dt.page_sz / s->dt.entry_sz;
+
+                l2t_addr = value & ((1ULL << 51) - 1);
+
+                value =  address_space_ldq_le(as, l2t_addr +
+                                   ((devid % max_l2_entries) * GITS_DTE_SIZE),
+                                   MEMTXATTRS_UNSPECIFIED, res);
+            }
+        }
+    } else {
+        /* Flat level table */
+        value = address_space_ldq_le(as, s->dt.base_addr +
+                                     (devid * GITS_DTE_SIZE),
+                                     MEMTXATTRS_UNSPECIFIED, res);
+    }
+
+    return value;
+}
+
+/*
+ * This function handles the processing of following commands based on
+ * the ItsCmdType parameter passed:-
+ * 1. triggering of lpi interrupt translation via ITS INT command
+ * 2. triggering of lpi interrupt translation via gits_translater register
+ * 3. handling of ITS CLEAR command
+ * 4. handling of ITS DISCARD command
+ */
+static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
+                            ItsCmdType cmd)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint32_t devid, eventid;
+    MemTxResult res = MEMTX_OK;
+    bool dte_valid;
+    uint64_t dte = 0;
+    uint32_t max_eventid;
+    uint16_t icid = 0;
+    uint32_t pIntid = 0;
+    bool ite_valid = false;
+    uint64_t cte = 0;
+    bool cte_valid = false;
+    bool result = false;
+
+    if (cmd == NONE) {
+        devid = offset;
+    } else {
+        devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
+
+        offset += NUM_BYTES_IN_DW;
+        value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                     MEMTXATTRS_UNSPECIFIED, &res);
+    }
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    eventid = (value & EVENTID_MASK);
+
+    dte = get_dte(s, devid, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
+
+    if (dte_valid) {
+        max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
+
+        ite_valid = get_ite(s, eventid, dte, &icid, &pIntid, &res);
+
+        if (res != MEMTX_OK) {
+            return result;
+        }
+
+        if (ite_valid) {
+            cte_valid = get_cte(s, icid, &cte, &res);
+        }
+
+        if (res != MEMTX_OK) {
+            return result;
+        }
+    }
+
+    if ((devid > s->dt.maxids.max_devids) || !dte_valid || !ite_valid ||
+            !cte_valid || (eventid > max_eventid)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes "
+                      "devid %d or eventid %d or invalid dte %d or"
+                      "invalid cte %d or invalid ite %d\n",
+                      __func__, devid, eventid, dte_valid, cte_valid,
+                      ite_valid);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        /*
+         * Current implementation only supports rdbase == procnum
+         * Hence rdbase physical address is ignored
+         */
+        if (cmd == DISCARD) {
+            IteEntry ite = {};
+            /* remove mapping from interrupt translation table */
+            result = update_ite(s, eventid, dte, ite);
+        }
+    }
+
+    return result;
+}
+
+static bool process_mapti(GICv3ITSState *s, uint64_t value, uint32_t offset,
+                          bool ignore_pInt)
+{
+    AddressSpace *as = &s->gicv3->dma_as;
+    uint32_t devid, eventid;
+    uint32_t pIntid = 0;
+    uint32_t max_eventid, max_Intid;
+    bool dte_valid;
+    MemTxResult res = MEMTX_OK;
+    uint16_t icid = 0;
+    uint64_t dte = 0;
+    IteEntry ite;
+    uint32_t int_spurious = INTID_SPURIOUS;
+    bool result = false;
+
+    devid = ((value & DEVID_MASK) >> DEVID_SHIFT);
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    eventid = (value & EVENTID_MASK);
+
+    if (!ignore_pInt) {
+        pIntid = ((value & pINTID_MASK) >> pINTID_SHIFT);
+    }
+
+    offset += NUM_BYTES_IN_DW;
+    value = address_space_ldq_le(as, s->cq.base_addr + offset,
+                                 MEMTXATTRS_UNSPECIFIED, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+
+    icid = value & ICID_MASK;
+
+    dte = get_dte(s, devid, &res);
+
+    if (res != MEMTX_OK) {
+        return result;
+    }
+    dte_valid = dte & TABLE_ENTRY_VALID_MASK;
+
+    max_eventid = (1UL << (((dte >> 1U) & SIZE_MASK) + 1));
+
+    if (!ignore_pInt) {
+        max_Intid = (1ULL << (GICD_TYPER_IDBITS + 1)) - 1;
+    }
+
+    if ((devid > s->dt.maxids.max_devids) || (icid > s->ct.maxids.max_collids)
+            || !dte_valid || (eventid > max_eventid) ||
+            (!ignore_pInt && (((pIntid < GICV3_LPI_INTID_START) ||
+            (pIntid > max_Intid)) && (pIntid != INTID_SPURIOUS)))) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes "
+                      "devid %d or icid %d or eventid %d or pIntid %d or"
+                      "unmapped dte %d\n", __func__, devid, icid, eventid,
+                      pIntid, dte_valid);
+        /*
+         * in this implementation, in case of error
+         * we ignore this command and move onto the next
+         * command in the queue
+         */
+    } else {
+        /* add ite entry to interrupt translation table */
+        ite.itel = (dte_valid & TABLE_ENTRY_VALID_MASK) |
+                    (GITS_TYPE_PHYSICAL << ITE_ENTRY_INTTYPE_SHIFT);
+
+        if (ignore_pInt) {
+            ite.itel |= (eventid << ITE_ENTRY_INTID_SHIFT);
+        } else {
+            ite.itel |= (pIntid << ITE_ENTRY_INTID_SHIFT);
+        }
+        ite.itel |= (int_spurious << ITE_ENTRY_INTSP_SHIFT);
+        ite.iteh = icid;
+
+        result = update_ite(s, eventid, dte, ite);
+    }
+
+    return result;
+}
+
 static bool update_cte(GICv3ITSState *s, uint16_t icid, bool valid,
                        uint64_t rdbase)
 {
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
 
         switch (cmd) {
         case GITS_CMD_INT:
+            res = process_its_cmd(s, data, cq_offset, INT);
             break;
         case GITS_CMD_CLEAR:
+            res = process_its_cmd(s, data, cq_offset, CLEAR);
             break;
         case GITS_CMD_SYNC:
             /*
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
             result = process_mapc(s, cq_offset);
             break;
         case GITS_CMD_MAPTI:
+            result = process_mapti(s, data, cq_offset, false);
             break;
         case GITS_CMD_MAPI:
+            result = process_mapti(s, data, cq_offset, true);
             break;
         case GITS_CMD_DISCARD:
+            result = process_its_cmd(s, data, cq_offset, DISCARD);
             break;
         case GITS_CMD_INV:
         case GITS_CMD_INVALL:
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicv3_its_translation_write(void *opaque, hwaddr offset,
                                                uint64_t data, unsigned size,
                                                MemTxAttrs attrs)
 {
-    return MEMTX_OK;
+    GICv3ITSState *s = (GICv3ITSState *)opaque;
+    bool result = true;
+    uint32_t devid = 0;
+
+    switch (offset) {
+    case GITS_TRANSLATER:
+        if (s->ctlr & ITS_CTLR_ENABLED) {
+            devid = attrs.requester_id;
+            result = process_its_cmd(s, data, devid, NONE);
+        }
+        break;
+    default:
+        break;
+    }
+
+    if (result) {
+        return MEMTX_OK;
+    } else {
+        return MEMTX_ERROR;
+    }
 }
 
 static bool its_writel(GICv3ITSState *s, hwaddr offset,
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added properties to enable ITS feature and define qemu system
address space memory in gicv3 common,setup distributor and
redistributor registers to indicate LPI support.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Message-id: 20210910143951.92242-6-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h           |  2 ++
 include/hw/intc/arm_gicv3_common.h |  1 +
 hw/intc/arm_gicv3_common.c         | 12 ++++++++++++
 hw/intc/arm_gicv3_dist.c           |  5 ++++-
 hw/intc/arm_gicv3_redist.c         | 12 +++++++++---
 5 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@
 #define GICD_CTLR_E1NWF             (1U << 7)
 #define GICD_CTLR_RWP               (1U << 31)
 
+#define GICD_TYPER_LPIS_SHIFT          17
+
 /* 16 bits EventId */
 #define GICD_TYPER_IDBITS            0xf
 
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3State {
     uint32_t num_cpu;
     uint32_t num_irq;
     uint32_t revision;
+    bool lpi_enable;
     bool security_extn;
     bool irq_reset_nonsecure;
     bool gicd_no_migration_shift_bug;
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (s->lpi_enable && !s->dma) {
+        error_setg(errp, "Redist-ITS: Guest 'sysmem' reference link not set");
+        return;
+    }
+
     s->cpu = g_new0(GICv3CPUState, s->num_cpu);
 
     for (i = 0; i < s->num_cpu; i++) {
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_realize(DeviceState *dev, Error **errp)
             (1 << 24) |
             (i << 8) |
             (last << 4);
+
+        if (s->lpi_enable) {
+            s->cpu[i].gicr_typer |= GICR_TYPER_PLPIS;
+        }
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static Property arm_gicv3_common_properties[] = {
     DEFINE_PROP_UINT32("num-cpu", GICv3State, num_cpu, 1),
     DEFINE_PROP_UINT32("num-irq", GICv3State, num_irq, 32),
     DEFINE_PROP_UINT32("revision", GICv3State, revision, 3),
+    DEFINE_PROP_BOOL("has-lpi", GICv3State, lpi_enable, 0),
     DEFINE_PROP_BOOL("has-security-extensions", GICv3State, security_extn, 0),
     DEFINE_PROP_ARRAY("redist-region-count", GICv3State, nb_redist_regions,
                       redist_region_count, qdev_prop_uint32, uint32_t),
+    DEFINE_PROP_LINK("sysmem", GICv3State, dma, TYPE_MEMORY_REGION,
+                     MemoryRegion *),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/intc/arm_gicv3_dist.c b/hw/intc/arm_gicv3_dist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_dist.c
+++ b/hw/intc/arm_gicv3_dist.c
@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
          * A3V == 1 (non-zero values of Affinity level 3 supported)
          * IDbits == 0xf (we support 16-bit interrupt identifiers)
          * DVIS == 0 (Direct virtual LPI injection not supported)
-         * LPIS == 0 (LPIs not supported)
+         * LPIS == 1 (LPIs are supported if affinity routing is enabled)
+         * num_LPIs == 0b00000 (bits [15:11],Number of LPIs as indicated
+         *                      by GICD_TYPER.IDbits)
          * MBIS == 0 (message-based SPIs not supported)
          * SecurityExtn == 1 if security extns supported
          * CPUNumber == 0 since for us ARE is always 1
@@ -XXX,XX +XXX,XX @@ static bool gicd_readl(GICv3State *s, hwaddr offset,
         bool sec_extn = !(s->gicd_ctlr & GICD_CTLR_DS);
 
         *data = (1 << 25) | (1 << 24) | (sec_extn << 10) |
+            (s->lpi_enable << GICD_TYPER_LPIS_SHIFT) |
             (0xf << 19) | itlinesnumber;
         return true;
     }
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
     case GICR_CTLR:
         /* For our implementation, GICR_TYPER.DPGS is 0 and so all
          * the DPG bits are RAZ/WI. We don't do anything asynchronously,
-         * so UWP and RWP are RAZ/WI. And GICR_TYPER.LPIS is 0 (we don't
-         * implement LPIs) so Enable_LPIs is RES0. So there are no writable
-         * bits for us.
+         * so UWP and RWP are RAZ/WI. GICR_TYPER.LPIS is 1 (we
+         * implement LPIs) so Enable_LPIs is programmable.
          */
+        if (cs->gicr_typer & GICR_TYPER_PLPIS) {
+            if (value & GICR_CTLR_ENABLE_LPIS) {
+                cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
+            } else {
+                cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
+            }
+        }
         return MEMTX_OK;
     case GICR_STATUSR:
         /* RAZ/WI for our implementation */
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Implemented lpi processing at redistributor to get lpi config info
from lpi configuration table,determine priority,set pending state in
lpi pending table and forward the lpi to cpuif.Added logic to invoke
redistributor lpi processing with translated LPI which set/clear LPI
from ITS device as part of ITS INT,CLEAR,DISCARD command and
GITS_TRANSLATER processing.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-7-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/gicv3_internal.h           |   9 ++
 include/hw/intc/arm_gicv3_common.h |   7 ++
 hw/intc/arm_gicv3.c                |  14 +++
 hw/intc/arm_gicv3_common.c         |   1 +
 hw/intc/arm_gicv3_cpuif.c          |   7 +-
 hw/intc/arm_gicv3_its.c            |  23 +++++
 hw/intc/arm_gicv3_redist.c         | 141 +++++++++++++++++++++++++++++
 7 files changed, 200 insertions(+), 2 deletions(-)

diff --git a/hw/intc/gicv3_internal.h b/hw/intc/gicv3_internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/gicv3_internal.h
+++ b/hw/intc/gicv3_internal.h
@@ -XXX,XX +XXX,XX @@ FIELD(GICR_PENDBASER, PHYADDR, 16, 36)
 FIELD(GICR_PENDBASER, OUTERCACHE, 56, 3)
 FIELD(GICR_PENDBASER, PTZ, 62, 1)
 
+#define GICR_PROPBASER_IDBITS_THRESHOLD          0xd
+
 #define ICC_CTLR_EL1_CBPR           (1U << 0)
 #define ICC_CTLR_EL1_EOIMODE        (1U << 1)
 #define ICC_CTLR_EL1_PMHE           (1U << 6)
@@ -XXX,XX +XXX,XX @@ FIELD(GITS_TYPER, CIL, 36, 1)
 
 #define L1TABLE_ENTRY_SIZE         8
 
+#define LPI_CTE_ENABLED          TABLE_ENTRY_VALID_MASK
+#define LPI_PRIORITY_MASK         0xfc
+
 #define GITS_CMDQ_ENTRY_SIZE               32
 #define NUM_BYTES_IN_DW                     8
 
@@ -XXX,XX +XXX,XX @@ FIELD(MAPC, RDBASE, 16, 32)
  * Valid = 1 bit,RDBase = 36 bits(considering max RDBASE)
  */
 #define GITS_CTE_SIZE                 (0x8ULL)
+#define GITS_CTE_RDBASE_PROCNUM_MASK  MAKE_64BIT_MASK(1, RDBASE_PROCNUM_LENGTH)
 
 /* Special interrupt IDs */
 #define INTID_SECURE 1020
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
                                unsigned size, MemTxAttrs attrs);
 void gicv3_dist_set_irq(GICv3State *s, int irq, int level);
 void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level);
+void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level);
+void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level);
+void gicv3_redist_update_lpi(GICv3CPUState *cs);
 void gicv3_redist_send_sgi(GICv3CPUState *cs, int grp, int irq, bool ns);
 void gicv3_init_cpuif(GICv3State *s);
 
diff --git a/include/hw/intc/arm_gicv3_common.h b/include/hw/intc/arm_gicv3_common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/arm_gicv3_common.h
+++ b/include/hw/intc/arm_gicv3_common.h
@@ -XXX,XX +XXX,XX @@ struct GICv3CPUState {
      * real state above; it doesn't need to be migrated.
      */
     PendingIrq hppi;
+
+    /*
+     * Cached information recalculated from LPI tables
+     * in guest memory
+     */
+    PendingIrq hpplpi;
+
     /* This is temporary working state, to avoid a malloc in gicv3_update() */
     bool seenbetter;
 };
diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3.c
+++ b/hw/intc/arm_gicv3.c
@@ -XXX,XX +XXX,XX @@ static void gicv3_redist_update_noirqset(GICv3CPUState *cs)
         cs->hppi.grp = gicv3_irq_group(cs->gic, cs, cs->hppi.irq);
     }
 
+    if ((cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) && cs->gic->lpi_enable &&
+        (cs->hpplpi.prio != 0xff)) {
+        if (irqbetter(cs, cs->hpplpi.irq, cs->hpplpi.prio)) {
+            cs->hppi.irq = cs->hpplpi.irq;
+            cs->hppi.prio = cs->hpplpi.prio;
+            cs->hppi.grp = cs->hpplpi.grp;
+            seenbetter = true;
+        }
+    }
+
     /* If the best interrupt we just found would preempt whatever
      * was the previous best interrupt before this update, then
      * we know it's definitely the best one now.
@@ -XXX,XX +XXX,XX @@ static void gicv3_set_irq(void *opaque, int irq, int level)
 
 static void arm_gicv3_post_load(GICv3State *s)
 {
+    int i;
     /* Recalculate our cached idea of the current highest priority
      * pending interrupt, but don't set IRQ or FIQ lines.
      */
+    for (i = 0; i < s->num_cpu; i++) {
+        gicv3_redist_update_lpi(&s->cpu[i]);
+    }
     gicv3_full_update_noirqset(s);
     /* Repopulate the cache of GICv3CPUState pointers for target CPUs */
     gicv3_cache_all_target_cpustates(s);
diff --git a/hw/intc/arm_gicv3_common.c b/hw/intc/arm_gicv3_common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_common.c
+++ b/hw/intc/arm_gicv3_common.c
@@ -XXX,XX +XXX,XX @@ static void arm_gicv3_common_reset(DeviceState *dev)
         memset(cs->gicr_ipriorityr, 0, sizeof(cs->gicr_ipriorityr));
 
         cs->hppi.prio = 0xff;
+        cs->hpplpi.prio = 0xff;
 
         /* State in the CPU interface must *not* be reset here, because it
          * is part of the CPU's reset domain, not the GIC device's.
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@ static void icc_activate_irq(GICv3CPUState *cs, int irq)
         cs->gicr_iactiver0 = deposit32(cs->gicr_iactiver0, irq, 1, 1);
         cs->gicr_ipendr0 = deposit32(cs->gicr_ipendr0, irq, 1, 0);
         gicv3_redist_update(cs);
-    } else {
+    } else if (irq < GICV3_LPI_INTID_START) {
         gicv3_gicd_active_set(cs->gic, irq);
         gicv3_gicd_pending_clear(cs->gic, irq);
         gicv3_update(cs->gic, irq, 1);
+    } else {
+        gicv3_redist_lpi_pending(cs, irq, 0);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void icc_eoir_write(CPUARMState *env, const ARMCPRegInfo *ri,
     trace_gicv3_icc_eoir_write(is_eoir0 ? 0 : 1,
                                gicv3_redist_affid(cs), value);
 
-    if (irq >= cs->gic->num_irq) {
+    if ((irq >= cs->gic->num_irq) &&
+        !(cs->gic->lpi_enable && (irq >= GICV3_LPI_INTID_START))) {
         /* This handles two cases:
          * 1. If software writes the ID of a spurious interrupt [ie 1020-1023]
          * to the GICC_EOIR, the GIC ignores that write.
diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
     uint64_t cte = 0;
     bool cte_valid = false;
     bool result = false;
+    uint64_t rdbase;
 
     if (cmd == NONE) {
         devid = offset;
@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
          * Current implementation only supports rdbase == procnum
          * Hence rdbase physical address is ignored
          */
+        rdbase = (cte & GITS_CTE_RDBASE_PROCNUM_MASK) >> 1U;
+
+        if (rdbase > s->gicv3->num_cpu) {
+            return result;
+        }
+
+        if ((cmd == CLEAR) || (cmd == DISCARD)) {
+            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 0);
+        } else {
+            gicv3_redist_process_lpi(&s->gicv3->cpu[rdbase], pIntid, 1);
+        }
+
         if (cmd == DISCARD) {
             IteEntry ite = {};
             /* remove mapping from interrupt translation table */
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
     MemTxResult res = MEMTX_OK;
     bool result = true;
     uint8_t cmd;
+    int i;
 
     if (!(s->ctlr & ITS_CTLR_ENABLED)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void process_cmdq(GICv3ITSState *s)
             break;
         case GITS_CMD_INV:
         case GITS_CMD_INVALL:
+            /*
+             * Current implementation doesn't cache any ITS tables,
+             * but the calculated lpi priority information. We only
+             * need to trigger lpi priority re-calculation to be in
+             * sync with LPI config table or pending table changes.
+             */
+            for (i = 0; i < s->gicv3->num_cpu; i++) {
+                gicv3_redist_update_lpi(&s->gicv3->cpu[i]);
+            }
             break;
         default:
             break;
diff --git a/hw/intc/arm_gicv3_redist.c b/hw/intc/arm_gicv3_redist.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_redist.c
+++ b/hw/intc/arm_gicv3_redist.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult gicr_writel(GICv3CPUState *cs, hwaddr offset,
         if (cs->gicr_typer & GICR_TYPER_PLPIS) {
             if (value & GICR_CTLR_ENABLE_LPIS) {
                 cs->gicr_ctlr |= GICR_CTLR_ENABLE_LPIS;
+                /* Check for any pending interr in pending table */
+                gicv3_redist_update_lpi(cs);
+                gicv3_redist_update(cs);
             } else {
                 cs->gicr_ctlr &= ~GICR_CTLR_ENABLE_LPIS;
             }
@@ -XXX,XX +XXX,XX @@ MemTxResult gicv3_redist_write(void *opaque, hwaddr offset, uint64_t data,
     return r;
 }
 
+static void gicv3_redist_check_lpi_priority(GICv3CPUState *cs, int irq)
+{
+    AddressSpace *as = &cs->gic->dma_as;
+    uint64_t lpict_baddr;
+    uint8_t lpite;
+    uint8_t prio;
+
+    lpict_baddr = cs->gicr_propbaser & R_GICR_PROPBASER_PHYADDR_MASK;
+
+    address_space_read(as, lpict_baddr + ((irq - GICV3_LPI_INTID_START) *
+                       sizeof(lpite)), MEMTXATTRS_UNSPECIFIED, &lpite,
+                       sizeof(lpite));
+
+    if (!(lpite & LPI_CTE_ENABLED)) {
+        return;
+    }
+
+    if (cs->gic->gicd_ctlr & GICD_CTLR_DS) {
+        prio = lpite & LPI_PRIORITY_MASK;
+    } else {
+        prio = ((lpite & LPI_PRIORITY_MASK) >> 1) | 0x80;
+    }
+
+    if ((prio < cs->hpplpi.prio) ||
+        ((prio == cs->hpplpi.prio) && (irq <= cs->hpplpi.irq))) {
+        cs->hpplpi.irq = irq;
+        cs->hpplpi.prio = prio;
+        /* LPIs are always non-secure Grp1 interrupts */
+        cs->hpplpi.grp = GICV3_G1NS;
+    }
+}
+
+void gicv3_redist_update_lpi(GICv3CPUState *cs)
+{
+    /*
+     * This function scans the LPI pending table and for each pending
+     * LPI, reads the corresponding entry from LPI configuration table
+     * to extract the priority info and determine if the current LPI
+     * priority is lower than the last computed high priority lpi interrupt.
+     * If yes, replace current LPI as the new high priority lpi interrupt.
+     */
+    AddressSpace *as = &cs->gic->dma_as;
+    uint64_t lpipt_baddr;
+    uint32_t pendt_size = 0;
+    uint8_t pend;
+    int i, bit;
+    uint64_t idbits;
+
+    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
+                 GICD_TYPER_IDBITS);
+
+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
+        !cs->gicr_pendbaser) {
+        return;
+    }
+
+    cs->hpplpi.prio = 0xff;
+
+    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
+
+    /* Determine the highest priority pending interrupt among LPIs */
+    pendt_size = (1ULL << (idbits + 1));
+
+    for (i = GICV3_LPI_INTID_START / 8; i < pendt_size / 8; i++) {
+        address_space_read(as, lpipt_baddr + i, MEMTXATTRS_UNSPECIFIED, &pend,
+                           sizeof(pend));
+
+        while (pend) {
+            bit = ctz32(pend);
+            gicv3_redist_check_lpi_priority(cs, i * 8 + bit);
+            pend &= ~(1 << bit);
+        }
+    }
+}
+
+void gicv3_redist_lpi_pending(GICv3CPUState *cs, int irq, int level)
+{
+    /*
+     * This function updates the pending bit in lpi pending table for
+     * the irq being activated or deactivated.
+     */
+    AddressSpace *as = &cs->gic->dma_as;
+    uint64_t lpipt_baddr;
+    bool ispend = false;
+    uint8_t pend;
+
+    /*
+     * get the bit value corresponding to this irq in the
+     * lpi pending table
+     */
+    lpipt_baddr = cs->gicr_pendbaser & R_GICR_PENDBASER_PHYADDR_MASK;
+
+    address_space_read(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
+                       MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
+
+    ispend = extract32(pend, irq % 8, 1);
+
+    /* no change in the value of pending bit, return */
+    if (ispend == level) {
+        return;
+    }
+    pend = deposit32(pend, irq % 8, 1, level ? 1 : 0);
+
+    address_space_write(as, lpipt_baddr + ((irq / 8) * sizeof(pend)),
+                        MEMTXATTRS_UNSPECIFIED, &pend, sizeof(pend));
+
+    /*
+     * check if this LPI is better than the current hpplpi, if yes
+     * just set hpplpi.prio and .irq without doing a full rescan
+     */
+    if (level) {
+        gicv3_redist_check_lpi_priority(cs, irq);
+    } else {
+        if (irq == cs->hpplpi.irq) {
+            gicv3_redist_update_lpi(cs);
+        }
+    }
+}
+
+void gicv3_redist_process_lpi(GICv3CPUState *cs, int irq, int level)
+{
+    uint64_t idbits;
+
+    idbits = MIN(FIELD_EX64(cs->gicr_propbaser, GICR_PROPBASER, IDBITS),
+                 GICD_TYPER_IDBITS);
+
+    if (!(cs->gicr_ctlr & GICR_CTLR_ENABLE_LPIS) || !cs->gicr_propbaser ||
+         !cs->gicr_pendbaser || (irq > (1ULL << (idbits + 1)) - 1) ||
+         irq < GICV3_LPI_INTID_START) {
+        return;
+    }
+
+    /* set/clear the pending bit for this irq */
+    gicv3_redist_lpi_pending(cs, irq, level);
+
+    gicv3_redist_update(cs);
+}
+
 void gicv3_redist_set_irq(GICv3CPUState *cs, int irq, int level)
 {
     /* Update redistributor state for a change in an external PPI input line */
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Added expected IORT files applicable with latest GICv3
ITS changes.Temporarily differences in these files are
okay.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-8-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 4 ++++
 tests/data/acpi/virt/IORT                   | 0
 tests/data/acpi/virt/IORT.memhp             | 0
 tests/data/acpi/virt/IORT.numamem           | 0
 tests/data/acpi/virt/IORT.pxb               | 0
 5 files changed, 4 insertions(+)
 create mode 100644 tests/data/acpi/virt/IORT
 create mode 100644 tests/data/acpi/virt/IORT.memhp
 create mode 100644 tests/data/acpi/virt/IORT.numamem
 create mode 100644 tests/data/acpi/virt/IORT.pxb

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1 +1,5 @@
 /* List of comma-separated changed AML files to ignore */
+"tests/data/acpi/virt/IORT",
+"tests/data/acpi/virt/IORT.memhp",
+"tests/data/acpi/virt/IORT.numamem",
+"tests/data/acpi/virt/IORT.pxb",
diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
new file mode 100644
index XXXXXXX..XXXXXXX
diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
new file mode 100644
index XXXXXXX..XXXXXXX
diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
new file mode 100644
index XXXXXXX..XXXXXXX
diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
new file mode 100644
index XXXXXXX..XXXXXXX
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Included creation of ITS as part of virt platform GIC
initialization. This Emulated ITS model now co-exists with kvm
ITS and is enabled in absence of kvm irq kernel support in a
platform.

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-9-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/virt.h |  2 ++
 target/arm/kvm_arm.h  |  4 ++--
 hw/arm/virt.c         | 29 +++++++++++++++++++++++++++--
 3 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ struct VirtMachineClass {
     MachineClass parent;
     bool disallow_affinity_adjustment;
     bool no_its;
+    bool no_tcg_its;
     bool no_pmu;
     bool claim_edge_triggered_timers;
     bool smbios_old_sys_ver;
@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {
     bool highmem;
     bool highmem_ecam;
     bool its;
+    bool tcg_its;
     bool virt;
     bool ras;
     bool mte;
diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ static inline const char *its_class_name(void)
         /* KVM implementation requires this capability */
         return kvm_direct_msi_enabled() ? "arm-its-kvm" : NULL;
     } else {
-        /* Software emulation is not implemented yet */
-        return NULL;
+        /* Software emulation based model */
+        return "arm-gicv3-its";
     }
 }
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_its(VirtMachineState *vms)
     const char *itsclass = its_class_name();
     DeviceState *dev;
 
+    if (!strcmp(itsclass, "arm-gicv3-its")) {
+        if (!vms->tcg_its) {
+            itsclass = NULL;
+        }
+    }
+
     if (!itsclass) {
         /* Do nothing if not supported */
         return;
@@ -XXX,XX +XXX,XX @@ static void create_v2m(VirtMachineState *vms)
     vms->msi_controller = VIRT_MSI_CTRL_GICV2M;
 }
 
-static void create_gic(VirtMachineState *vms)
+static void create_gic(VirtMachineState *vms, MemoryRegion *mem)
 {
     MachineState *ms = MACHINE(vms);
     /* We create a standalone GIC */
@@ -XXX,XX +XXX,XX @@ static void create_gic(VirtMachineState *vms)
                              nb_redist_regions);
         qdev_prop_set_uint32(vms->gic, "redist-region-count[0]", redist0_count);
 
+        if (!kvm_irqchip_in_kernel()) {
+            if (vms->tcg_its) {
+                object_property_set_link(OBJECT(vms->gic), "sysmem",
+                                         OBJECT(mem), &error_fatal);
+                qdev_prop_set_bit(vms->gic, "has-lpi", true);
+            }
+        }
+
         if (nb_redist_regions == 2) {
             uint32_t redist1_capacity =
                     vms->memmap[VIRT_HIGH_GIC_REDIST2].size / GICV3_REDIST_SIZE;
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
 
     virt_flash_fdt(vms, sysmem, secure_sysmem ?: sysmem);
 
-    create_gic(vms);
+    create_gic(vms, sysmem);
 
     virt_cpu_post_init(vms, sysmem);
 
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
     } else {
         /* Default allows ITS instantiation */
         vms->its = true;
+
+        if (vmc->no_tcg_its) {
+            vms->tcg_its = false;
+        } else {
+            vms->tcg_its = true;
+        }
     }
 
     /* Default disallows iommu instantiation */
@@ -XXX,XX +XXX,XX @@ DEFINE_VIRT_MACHINE_AS_LATEST(6, 2)
 
 static void virt_machine_6_1_options(MachineClass *mc)
 {
+    VirtMachineClass *vmc = VIRT_MACHINE_CLASS(OBJECT_CLASS(mc));
+
     virt_machine_6_2_options(mc);
     compat_props_add(mc->compat_props, hw_compat_6_1, hw_compat_6_1_len);
+
+    /* qemu ITS was introduced with 6.2 */
+    vmc->no_tcg_its = true;
 }
 DEFINE_VIRT_MACHINE(6, 1)
 
-- 
2.20.1

From: Shashi Mallela <shashi.mallela@linaro.org>

Updated expected IORT files applicable with latest GICv3
ITS changes.

Full diff of new file disassembly:

/*
 * Intel ACPI Component Architecture
 * AML/ASL+ Disassembler version 20180629 (64-bit version)
 * Copyright (c) 2000 - 2018 Intel Corporation
 *
 * Disassembly of tests/data/acpi/virt/IORT.pxb, Tue Jun 29 17:35:38 2021
 *
 * ACPI Data Table [IORT]
 *
 * Format: [HexOffset DecimalOffset ByteLength]  FieldName : FieldValue
 */

[000h 0000   4]                    Signature : "IORT"    [IO Remapping Table]
[004h 0004   4]                 Table Length : 0000007C
[008h 0008   1]                     Revision : 00
[009h 0009   1]                     Checksum : 07
[00Ah 0010   6]                       Oem ID : "BOCHS "
[010h 0016   8]                 Oem Table ID : "BXPC    "
[018h 0024   4]                 Oem Revision : 00000001
[01Ch 0028   4]              Asl Compiler ID : "BXPC"
[020h 0032   4]        Asl Compiler Revision : 00000001

[024h 0036   4]                   Node Count : 00000002
[028h 0040   4]                  Node Offset : 00000030
[02Ch 0044   4]                     Reserved : 00000000

[030h 0048   1]                         Type : 00
[031h 0049   2]                       Length : 0018
[033h 0051   1]                     Revision : 00
[034h 0052   4]                     Reserved : 00000000
[038h 0056   4]                Mapping Count : 00000000
[03Ch 0060   4]               Mapping Offset : 00000000

[040h 0064   4]                     ItsCount : 00000001
[044h 0068   4]                  Identifiers : 00000000

[048h 0072   1]                         Type : 02
[049h 0073   2]                       Length : 0034
[04Bh 0075   1]                     Revision : 00
[04Ch 0076   4]                     Reserved : 00000000
[050h 0080   4]                Mapping Count : 00000001
[054h 0084   4]               Mapping Offset : 00000020

[058h 0088   8]            Memory Properties : [IORT Memory Access Properties]
[058h 0088   4]              Cache Coherency : 00000001
[05Ch 0092   1]        Hints (decoded below) : 00
                                   Transient : 0
                              Write Allocate : 0
                               Read Allocate : 0
                                    Override : 0
[05Dh 0093   2]                     Reserved : 0000
[05Fh 0095   1] Memory Flags (decoded below) : 03
                                   Coherency : 1
                            Device Attribute : 1
[060h 0096   4]                ATS Attribute : 00000000
[064h 0100   4]           PCI Segment Number : 00000000
[068h 0104   1]            Memory Size Limit : 00
[069h 0105   3]                     Reserved : 000000

[068h 0104   4]                   Input base : 00000000
[06Ch 0108   4]                     ID Count : 0000FFFF
[070h 0112   4]                  Output Base : 00000000
[074h 0116   4]             Output Reference : 00000030
[078h 0120   4]        Flags (decoded below) : 00000000
                              Single Mapping : 0

Raw Table Data: Length 124 (0x7C)

0000: 49 4F 52 54 7C 00 00 00 00 07 42 4F 43 48 53 20  // IORT|.....BOCHS
    0010: 42 58 50 43 20 20 20 20 01 00 00 00 42 58 50 43  // BXPC    ....BXPC
    0020: 01 00 00 00 02 00 00 00 30 00 00 00 00 00 00 00  // ........0.......
    0030: 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00  // ................
    0040: 01 00 00 00 00 00 00 00 02 34 00 00 00 00 00 00  // .........4......
    0050: 01 00 00 00 20 00 00 00 01 00 00 00 00 00 00 03  // .... ...........
    0060: 00 00 00 00 00 00 00 00 00 00 00 00 FF FF 00 00  // ................
    0070: 00 00 00 00 30 00 00 00 00 00 00 00              // ....0.......

Signed-off-by: Shashi Mallela <shashi.mallela@linaro.org>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20210910143951.92242-10-shashi.mallela@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test-allowed-diff.h |   4 ----
 tests/data/acpi/virt/IORT                   | Bin 0 -> 124 bytes
 tests/data/acpi/virt/IORT.memhp             | Bin 0 -> 124 bytes
 tests/data/acpi/virt/IORT.numamem           | Bin 0 -> 124 bytes
 tests/data/acpi/virt/IORT.pxb               | Bin 0 -> 124 bytes
 5 files changed, 4 deletions(-)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -1,5 +1 @@
 /* List of comma-separated changed AML files to ignore */
-"tests/data/acpi/virt/IORT",
-"tests/data/acpi/virt/IORT.memhp",
-"tests/data/acpi/virt/IORT.numamem",
-"tests/data/acpi/virt/IORT.pxb",
diff --git a/tests/data/acpi/virt/IORT b/tests/data/acpi/virt/IORT
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/virt/IORT.memhp b/tests/data/acpi/virt/IORT.memhp
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/virt/IORT.numamem b/tests/data/acpi/virt/IORT.numamem
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/virt/IORT.pxb b/tests/data/acpi/virt/IORT.pxb
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 124
zcmebD4+^Pa00MR=e`k+i1*eDrX9XZ&1PX!JAesq?4S*O7Bw!2(4Uz`|CKCt^;wu0#
QRGb+i3L*dhhtM#y0PN=p0RR91

literal 0
HcmV?d00001

-- 
2.20.1

In v8A, the PSTATE.IL bit is set for various kinds of illegal
exception return or mode-change attempts.  We already set PSTATE.IL
(or its AArch32 equivalent CPSR.IL) in all those cases, but we
weren't implementing the part of the behaviour where attempting to
execute an instruction with PSTATE.IL takes an immediate exception
with an appropriate syndrome value.

Add a new TB flags bit tracking PSTATE.IL/CPSR.IL, and generate code
to take an exception instead of whatever the instruction would have
been.

PSTATE.IL and CPSR.IL change only on exception entry, attempted
exception exit, and various AArch32 mode changes via cpsr_write().
These places generally already rebuild the hflags, so the only place
we need an extra rebuild_hflags call is in the illegal-return
codepath of the AArch64 exception_return helper.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210821195958.41312-2-richard.henderson@linaro.org
Message-Id: <20210817162118.24319-1-peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
[rth: Added missing returns; set IL bit in syndrome]
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h           |  1 +
 target/arm/syndrome.h      |  5 +++++
 target/arm/translate.h     |  2 ++
 target/arm/helper-a64.c    |  1 +
 target/arm/helper.c        |  8 ++++++++
 target/arm/translate-a64.c | 11 +++++++++++
 target/arm/translate.c     | 21 +++++++++++++++++++++
 7 files changed, 49 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ FIELD(TBFLAG_ANY, FPEXC_EL, 8, 2)
 FIELD(TBFLAG_ANY, DEBUG_TARGET_EL, 10, 2)
 /* Memory operations require alignment: SCTLR_ELx.A or CCR.UNALIGN_TRP */
 FIELD(TBFLAG_ANY, ALIGN_MEM, 12, 1)
+FIELD(TBFLAG_ANY, PSTATE__IL, 13, 1)
 
 /*
  * Bit usage when in AArch32 state, both A- and M-profile.
diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_wfx(int cv, int cond, int ti, bool is_16bit)
            (cv << 24) | (cond << 20) | ti;
 }
 
+static inline uint32_t syn_illegalstate(void)
+{
+    return (EC_ILLEGALSTATE << ARM_EL_EC_SHIFT) | ARM_EL_IL;
+}
+
 #endif /* TARGET_ARM_SYNDROME_H */
diff --git a/target/arm/translate.h b/target/arm/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.h
+++ b/target/arm/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool hstr_active;
     /* True if memory operations require alignment */
     bool align_mem;
+    /* True if PSTATE.IL is set */
+    bool pstate_il;
     /*
      * >= 0, a copy of PSTATE.BTYPE, which will be 0 without v8.5-BTI.
      *  < 0, set by the current instruction.
diff --git a/target/arm/helper-a64.c b/target/arm/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper-a64.c
+++ b/target/arm/helper-a64.c
@@ -XXX,XX +XXX,XX @@ illegal_return:
     if (!arm_singlestep_active(env)) {
         env->pstate &= ~PSTATE_SS;
     }
+    helper_rebuild_hflags_a64(env, cur_el);
     qemu_log_mask(LOG_GUEST_ERROR, "Illegal exception return at EL%d: "
                   "resuming execution at 0x%" PRIx64 "\n", cur_el, env->pc);
 }
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a32(CPUARMState *env, int fp_el,
         DP_TBFLAG_A32(flags, HSTR_ACTIVE, 1);
     }
 
+    if (env->uncached_cpsr & CPSR_IL) {
+        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
+    }
+
     return rebuild_hflags_common_32(env, fp_el, mmu_idx, flags);
 }
 
@@ -XXX,XX +XXX,XX @@ static CPUARMTBFlags rebuild_hflags_a64(CPUARMState *env, int el, int fp_el,
         }
     }
 
+    if (env->pstate & PSTATE_IL) {
+        DP_TBFLAG_ANY(flags, PSTATE__IL, 1);
+    }
+
     if (cpu_isar_feature(aa64_mte, env_archcpu(env))) {
         /*
          * Set MTE_ACTIVE if any access may be Checked, and leave clear
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_a64_insn(CPUARMState *env, DisasContext *s)
     s->fp_access_checked = false;
     s->sve_access_checked = false;
 
+    if (s->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(s));
+        return;
+    }
+
     if (dc_isar_feature(aa64_bti, s)) {
         if (s->base.num_insns == 1) {
             /*
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
 #endif
     dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
+    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
     dc->sve_excp_el = EX_TBFLAG_A64(tb_flags, SVEEXC_EL);
     dc->sve_len = (EX_TBFLAG_A64(tb_flags, ZCR_LEN) + 1) * 16;
     dc->pauth_active = EX_TBFLAG_A64(tb_flags, PAUTH_ACTIVE);
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void disas_arm_insn(DisasContext *s, unsigned int insn)
         return;
     }
 
+    if (s->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(s));
+        return;
+    }
+
     if (cond == 0xf) {
         /* In ARMv3 and v4 the NV condition is UNPREDICTABLE; we
          * choose to UNDEF. In ARMv5 and above the space is used
@@ -XXX,XX +XXX,XX @@ static void arm_tr_init_disas_context(DisasContextBase *dcbase, CPUState *cs)
 #endif
     dc->fp_excp_el = EX_TBFLAG_ANY(tb_flags, FPEXC_EL);
     dc->align_mem = EX_TBFLAG_ANY(tb_flags, ALIGN_MEM);
+    dc->pstate_il = EX_TBFLAG_ANY(tb_flags, PSTATE__IL);
 
     if (arm_feature(env, ARM_FEATURE_M)) {
         dc->vfp_enabled = 1;
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     }
     dc->insn = insn;
 
+    if (dc->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(dc, dc->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(dc));
+        return;
+    }
+
     if (dc->eci) {
         /*
          * For M-profile continuable instructions, ECI/ICI handling
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

It is confusing to have different exits from translation
for various conditions in separate functions.

Merge disas_a64_insn into its only caller.  Standardize
on the "s" name for the DisasContext, as the code from
disas_a64_insn had more instances.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210821195958.41312-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 224 ++++++++++++++++++-------------------
 1 file changed, 109 insertions(+), 115 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool btype_destination_ok(uint32_t insn, bool bt, int btype)
     return false;
 }
 
-/* C3.1 A64 instruction index by encoding */
-static void disas_a64_insn(CPUARMState *env, DisasContext *s)
-{
-    uint32_t insn;
-
-    s->pc_curr = s->base.pc_next;
-    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
-    s->insn = insn;
-    s->base.pc_next += 4;
-
-    s->fp_access_checked = false;
-    s->sve_access_checked = false;
-
-    if (s->pstate_il) {
-        /*
-         * Illegal execution state. This has priority over BTI
-         * exceptions, but comes after instruction abort exceptions.
-         */
-        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                           syn_illegalstate(), default_exception_el(s));
-        return;
-    }
-
-    if (dc_isar_feature(aa64_bti, s)) {
-        if (s->base.num_insns == 1) {
-            /*
-             * At the first insn of the TB, compute s->guarded_page.
-             * We delayed computing this until successfully reading
-             * the first insn of the TB, above.  This (mostly) ensures
-             * that the softmmu tlb entry has been populated, and the
-             * page table GP bit is available.
-             *
-             * Note that we need to compute this even if btype == 0,
-             * because this value is used for BR instructions later
-             * where ENV is not available.
-             */
-            s->guarded_page = is_guarded_page(env, s);
-
-            /* First insn can have btype set to non-zero.  */
-            tcg_debug_assert(s->btype >= 0);
-
-            /*
-             * Note that the Branch Target Exception has fairly high
-             * priority -- below debugging exceptions but above most
-             * everything else.  This allows us to handle this now
-             * instead of waiting until the insn is otherwise decoded.
-             */
-            if (s->btype != 0
-                && s->guarded_page
-                && !btype_destination_ok(insn, s->bt, s->btype)) {
-                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
-                                   syn_btitrap(s->btype),
-                                   default_exception_el(s));
-                return;
-            }
-        } else {
-            /* Not the first insn: btype must be 0.  */
-            tcg_debug_assert(s->btype == 0);
-        }
-    }
-
-    switch (extract32(insn, 25, 4)) {
-    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
-        unallocated_encoding(s);
-        break;
-    case 0x2:
-        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
-            unallocated_encoding(s);
-        }
-        break;
-    case 0x8: case 0x9: /* Data processing - immediate */
-        disas_data_proc_imm(s, insn);
-        break;
-    case 0xa: case 0xb: /* Branch, exception generation and system insns */
-        disas_b_exc_sys(s, insn);
-        break;
-    case 0x4:
-    case 0x6:
-    case 0xc:
-    case 0xe:      /* Loads and stores */
-        disas_ldst(s, insn);
-        break;
-    case 0x5:
-    case 0xd:      /* Data processing - register */
-        disas_data_proc_reg(s, insn);
-        break;
-    case 0x7:
-    case 0xf:      /* Data processing - SIMD and floating point */
-        disas_data_proc_simd_fp(s, insn);
-        break;
-    default:
-        assert(FALSE); /* all 15 cases should be handled above */
-        break;
-    }
-
-    /* if we allocated any temporaries, free them here */
-    free_tmp_a64(s);
-
-    /*
-     * After execution of most insns, btype is reset to 0.
-     * Note that we set btype == -1 when the insn sets btype.
-     */
-    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
-        reset_btype(s);
-    }
-}
-
 static void aarch64_tr_init_disas_context(DisasContextBase *dcbase,
                                           CPUState *cpu)
 {
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
 
 static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
-    DisasContext *dc = container_of(dcbase, DisasContext, base);
+    DisasContext *s = container_of(dcbase, DisasContext, base);
     CPUARMState *env = cpu->env_ptr;
+    uint32_t insn;
 
-    if (dc->ss_active && !dc->pstate_ss) {
+    if (s->ss_active && !s->pstate_ss) {
         /* Singlestep state is Active-pending.
          * If we're in this state at the start of a TB then either
          *  a) we just took an exception to an EL which is being debugged
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          * "did not step an insn" case, and so the syndrome ISV and EX
          * bits should be zero.
          */
-        assert(dc->base.num_insns == 1);
-        gen_swstep_exception(dc, 0, 0);
-        dc->base.is_jmp = DISAS_NORETURN;
-    } else {
-        disas_a64_insn(env, dc);
+        assert(s->base.num_insns == 1);
+        gen_swstep_exception(s, 0, 0);
+        s->base.is_jmp = DISAS_NORETURN;
+        return;
     }
 
-    translator_loop_temp_check(&dc->base);
+    s->pc_curr = s->base.pc_next;
+    insn = arm_ldl_code(env, s->base.pc_next, s->sctlr_b);
+    s->insn = insn;
+    s->base.pc_next += 4;
+
+    s->fp_access_checked = false;
+    s->sve_access_checked = false;
+
+    if (s->pstate_il) {
+        /*
+         * Illegal execution state. This has priority over BTI
+         * exceptions, but comes after instruction abort exceptions.
+         */
+        gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                           syn_illegalstate(), default_exception_el(s));
+        return;
+    }
+
+    if (dc_isar_feature(aa64_bti, s)) {
+        if (s->base.num_insns == 1) {
+            /*
+             * At the first insn of the TB, compute s->guarded_page.
+             * We delayed computing this until successfully reading
+             * the first insn of the TB, above.  This (mostly) ensures
+             * that the softmmu tlb entry has been populated, and the
+             * page table GP bit is available.
+             *
+             * Note that we need to compute this even if btype == 0,
+             * because this value is used for BR instructions later
+             * where ENV is not available.
+             */
+            s->guarded_page = is_guarded_page(env, s);
+
+            /* First insn can have btype set to non-zero.  */
+            tcg_debug_assert(s->btype >= 0);
+
+            /*
+             * Note that the Branch Target Exception has fairly high
+             * priority -- below debugging exceptions but above most
+             * everything else.  This allows us to handle this now
+             * instead of waiting until the insn is otherwise decoded.
+             */
+            if (s->btype != 0
+                && s->guarded_page
+                && !btype_destination_ok(insn, s->bt, s->btype)) {
+                gen_exception_insn(s, s->pc_curr, EXCP_UDEF,
+                                   syn_btitrap(s->btype),
+                                   default_exception_el(s));
+                return;
+            }
+        } else {
+            /* Not the first insn: btype must be 0.  */
+            tcg_debug_assert(s->btype == 0);
+        }
+    }
+
+    switch (extract32(insn, 25, 4)) {
+    case 0x0: case 0x1: case 0x3: /* UNALLOCATED */
+        unallocated_encoding(s);
+        break;
+    case 0x2:
+        if (!dc_isar_feature(aa64_sve, s) || !disas_sve(s, insn)) {
+            unallocated_encoding(s);
+        }
+        break;
+    case 0x8: case 0x9: /* Data processing - immediate */
+        disas_data_proc_imm(s, insn);
+        break;
+    case 0xa: case 0xb: /* Branch, exception generation and system insns */
+        disas_b_exc_sys(s, insn);
+        break;
+    case 0x4:
+    case 0x6:
+    case 0xc:
+    case 0xe:      /* Loads and stores */
+        disas_ldst(s, insn);
+        break;
+    case 0x5:
+    case 0xd:      /* Data processing - register */
+        disas_data_proc_reg(s, insn);
+        break;
+    case 0x7:
+    case 0xf:      /* Data processing - SIMD and floating point */
+        disas_data_proc_simd_fp(s, insn);
+        break;
+    default:
+        assert(FALSE); /* all 15 cases should be handled above */
+        break;
+    }
+
+    /* if we allocated any temporaries, free them here */
+    free_tmp_a64(s);
+
+    /*
+     * After execution of most insns, btype is reset to 0.
+     * Note that we set btype == -1 when the insn sets btype.
+     */
+    if (s->btype > 0 && s->base.is_jmp != DISAS_NORETURN) {
+        reset_btype(s);
+    }
+
+    translator_loop_temp_check(&s->base);
 }
 
 static void aarch64_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-- 
2.20.1

By default, QEMU will allow devices to be plugged into a bus up to
the bus class's device count limit.  If the user creates a device on
the command line or via the monitor and doesn't explicitly specify
the bus to plug it in, QEMU will plug it into the first non-full bus
that it finds.

This is fine in most cases, but some machines have multiple buses of
a given type, some of which are dedicated to on-board devices and
some of which have an externally exposed connector for user-pluggable
devices. One example is I2C buses.

Provide a new function qbus_mark_full() so that a machine model can
mark this kind of "internal only" bus as 'full' after it has created
all the devices that should be plugged into that bus. The "find a
non-full bus" algorithm will then skip the internal-only bus when
looking for a place to plug in user-created devices.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-2-peter.maydell@linaro.org
---
 include/hw/qdev-core.h | 24 ++++++++++++++++++++++++
 softmmu/qdev-monitor.c |  7 ++++++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/include/hw/qdev-core.h b/include/hw/qdev-core.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/qdev-core.h
+++ b/include/hw/qdev-core.h
@@ -XXX,XX +XXX,XX @@ struct BusState {
     HotplugHandler *hotplug_handler;
     int max_index;
     bool realized;
+    bool full;
     int num_children;
 
     /*
@@ -XXX,XX +XXX,XX @@ static inline bool qbus_is_hotpluggable(BusState *bus)
    return bus->hotplug_handler;
 }
 
+/**
+ * qbus_mark_full: Mark this bus as full, so no more devices can be attached
+ * @bus: Bus to mark as full
+ *
+ * By default, QEMU will allow devices to be plugged into a bus up
+ * to the bus class's device count limit. Calling this function
+ * marks a particular bus as full, so that no more devices can be
+ * plugged into it. In particular this means that the bus will not
+ * be considered as a candidate for plugging in devices created by
+ * the user on the commandline or via the monitor.
+ * If a machine has multiple buses of a given type, such as I2C,
+ * where some of those buses in the real hardware are used only for
+ * internal devices and some are exposed via expansion ports, you
+ * can use this function to mark the internal-only buses as full
+ * after you have created all their internal devices. Then user
+ * created devices will appear on the expansion-port bus where
+ * guest software expects them.
+ */
+static inline void qbus_mark_full(BusState *bus)
+{
+    bus->full = true;
+}
+
 void device_listener_register(DeviceListener *listener);
 void device_listener_unregister(DeviceListener *listener);
 
diff --git a/softmmu/qdev-monitor.c b/softmmu/qdev-monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/qdev-monitor.c
+++ b/softmmu/qdev-monitor.c
@@ -XXX,XX +XXX,XX @@ static DeviceState *qbus_find_dev(BusState *bus, char *elem)
 
 static inline bool qbus_is_full(BusState *bus)
 {
-    BusClass *bus_class = BUS_GET_CLASS(bus);
+    BusClass *bus_class;
+
+    if (bus->full) {
+        return true;
+    }
+    bus_class = BUS_GET_CLASS(bus);
     return bus_class->max_dev && bus->num_children >= bus_class->max_dev;
 }
 
-- 
2.20.1

The mps2-tz boards use a data-driven structure to create the devices
that sit behind peripheral protection controllers.  Currently the
functions which create these devices are passed an 'opaque' pointer
which is always the address within the machine struct of the device
to create, and some "all devices need this" information like irqs and
addresses.

If a specific device needs more information than this, it is
currently not possible to pass that through from the PPCInfo
data structure. Add support for passing an extra data parameter,
so that we can more flexibly handle the needs of specific
device types. To provide some type-safety we make this extra
parameter a pointer to a union (which initially has no members).

In particular, we would like to be able to indicate which of the
i2c controllers are for on-board devices only and which are
connected to the external 'shield' expansion port; a subsequent
patch will use this mechanism for that purpose.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-3-peter.maydell@linaro.org
---
 hw/arm/mps2-tz.c | 35 ++++++++++++++++++++++-------------
 1 file changed, 22 insertions(+), 13 deletions(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
     }
 }
 
+/* Union describing the device-specific extra data we pass to the devfn. */
+typedef union PPCExtraData {
+} PPCExtraData;
+
 /* Most of the devices in the AN505 FPGA image sit behind
  * Peripheral Protection Controllers. These data structures
  * define the layout of which devices sit behind which PPCs.
@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
  */
 typedef MemoryRegion *MakeDevFn(MPS2TZMachineState *mms, void *opaque,
                                 const char *name, hwaddr size,
-                                const int *irqs);
+                                const int *irqs,
+                                const PPCExtraData *extradata);
 
 typedef struct PPCPortInfo {
     const char *name;
@@ -XXX,XX +XXX,XX @@ typedef struct PPCPortInfo {
     hwaddr addr;
     hwaddr size;
     int irqs[3]; /* currently no device needs more IRQ lines than this */
+    PPCExtraData extradata; /* to pass device-specific info to the devfn */
 } PPCPortInfo;
 
 typedef struct PPCInfo {
@@ -XXX,XX +XXX,XX @@ typedef struct PPCInfo {
 static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
                                     void *opaque,
                                     const char *name, hwaddr size,
-                                    const int *irqs)
+                                    const int *irqs,
+                                    const PPCExtraData *extradata)
 {
     /* Initialize, configure and realize a TYPE_UNIMPLEMENTED_DEVICE,
      * and return a pointer to its MemoryRegion.
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_unimp_dev(MPS2TZMachineState *mms,
 
 static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
                                const char *name, hwaddr size,
-                               const int *irqs)
+                               const int *irqs, const PPCExtraData *extradata)
 {
     /* The irq[] array is tx, rx, combined, in that order */
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_uart(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     MPS2SCC *scc = opaque;
     DeviceState *sccdev;
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_scc(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
                                  const char *name, hwaddr size,
-                                 const int *irqs)
+                                 const int *irqs, const PPCExtraData *extradata)
 {
     MPS2FPGAIO *fpgaio = opaque;
     MPS2TZMachineClass *mmc = MPS2TZ_MACHINE_GET_CLASS(mms);
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_fpgaio(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
                                   const char *name, hwaddr size,
-                                  const int *irqs)
+                                  const int *irqs,
+                                  const PPCExtraData *extradata)
 {
     SysBusDevice *s;
     NICInfo *nd = &nd_table[0];
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_dev(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
                                   const char *name, hwaddr size,
-                                  const int *irqs)
+                                  const int *irqs,
+                                  const PPCExtraData *extradata)
 {
     /*
      * The AN524 makes the ethernet and USB share a PPC port.
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_eth_usb(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_mpc(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     TZMPC *mpc = opaque;
     int i = mpc - &mms->mpc[0];
@@ -XXX,XX +XXX,XX @@ static void remap_irq_fn(void *opaque, int n, int level)
 
 static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     /* The irq[] array is DMACINTR, DMACINTERR, DMACINTTC, in that order */
     PL080State *dma = opaque;
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_dma(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     /*
      * The AN505 has five PL022 SPI controllers.
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_spi(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     ArmSbconI2CState *i2c = opaque;
     SysBusDevice *s;
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
 
 static MemoryRegion *make_rtc(MPS2TZMachineState *mms, void *opaque,
                               const char *name, hwaddr size,
-                              const int *irqs)
+                              const int *irqs, const PPCExtraData *extradata)
 {
     PL031State *pl031 = opaque;
     SysBusDevice *s;
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
             }
 
             mr = pinfo->devfn(mms, pinfo->opaque, pinfo->name, pinfo->size,
-                              pinfo->irqs);
+                              pinfo->irqs, &pinfo->extradata);
             portname = g_strdup_printf("port[%d]", port);
             object_property_set_link(OBJECT(ppc), portname, OBJECT(mr),
                                      &error_fatal);
-- 
2.20.1

The various MPS2 boards have multiple I2C buses: typically a bus
dedicated to the audio configuration, one for the LCD touchscreen
controller, one for a DDR4 EEPROM, and two which are connected to the
external Shield expansion connector.  Mark the buses which are used
only for board-internal devices as 'full' so that if the user creates
i2c devices on the commandline without specifying a bus name then
they will be connected to the I2C controller used for the Shield
connector, where guest software will expect them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-4-peter.maydell@linaro.org
---
 hw/arm/mps2-tz.c | 57 ++++++++++++++++++++++++++++++++++++------------
 1 file changed, 43 insertions(+), 14 deletions(-)

diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static qemu_irq get_sse_irq_in(MPS2TZMachineState *mms, int irqno)
 
 /* Union describing the device-specific extra data we pass to the devfn. */
 typedef union PPCExtraData {
+    bool i2c_internal;
 } PPCExtraData;
 
 /* Most of the devices in the AN505 FPGA image sit behind
@@ -XXX,XX +XXX,XX @@ static MemoryRegion *make_i2c(MPS2TZMachineState *mms, void *opaque,
     object_initialize_child(OBJECT(mms), name, i2c, TYPE_ARM_SBCON_I2C);
     s = SYS_BUS_DEVICE(i2c);
     sysbus_realize(s, &error_fatal);
+
+    /*
+     * If this is an internal-use-only i2c bus, mark it full
+     * so that user-created i2c devices are not plugged into it.
+     * If we implement models of any on-board i2c devices that
+     * plug in to one of the internal-use-only buses, then we will
+     * need to create and plugging those in here before we mark the
+     * bus as full.
+     */
+    if (extradata->i2c_internal) {
+        BusState *qbus = qdev_get_child_bus(DEVICE(i2c), "i2c");
+        qbus_mark_full(qbus);
+    }
+
     return sysbus_mmio_get_region(s, 0);
 }
 
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
                 { "uart2", make_uart, &mms->uart[2], 0x40202000, 0x1000, { 36, 37, 44 } },
                 { "uart3", make_uart, &mms->uart[3], 0x40203000, 0x1000, { 38, 39, 45 } },
                 { "uart4", make_uart, &mms->uart[4], 0x40204000, 0x1000, { 40, 41, 46 } },
-                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000 },
-                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000 },
-                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000 },
-                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000 },
+                { "i2c0", make_i2c, &mms->i2c[0], 0x40207000, 0x1000, {},
+                  { .i2c_internal = true /* touchscreen */ } },
+                { "i2c1", make_i2c, &mms->i2c[1], 0x40208000, 0x1000, {},
+                  { .i2c_internal = true /* audio conf */ } },
+                { "i2c2", make_i2c, &mms->i2c[2], 0x4020c000, 0x1000, {},
+                  { .i2c_internal = false /* shield 0 */ } },
+                { "i2c3", make_i2c, &mms->i2c[3], 0x4020d000, 0x1000, {},
+                  { .i2c_internal = false /* shield 1 */ } },
             },
         }, {
             .name = "apb_ppcexp2",
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
         }, {
             .name = "apb_ppcexp1",
             .ports = {
-                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000 },
-                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000 },
+                { "i2c0", make_i2c, &mms->i2c[0], 0x41200000, 0x1000, {},
+                  { .i2c_internal = true /* touchscreen */ } },
+                { "i2c1", make_i2c, &mms->i2c[1], 0x41201000, 0x1000, {},
+                  { .i2c_internal = true /* audio conf */ } },
                 { "spi0", make_spi, &mms->spi[0], 0x41202000, 0x1000, { 52 } },
                 { "spi1", make_spi, &mms->spi[1], 0x41203000, 0x1000, { 53 } },
                 { "spi2", make_spi, &mms->spi[2], 0x41204000, 0x1000, { 54 } },
-                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000 },
-                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000 },
+                { "i2c2", make_i2c, &mms->i2c[2], 0x41205000, 0x1000, {},
+                  { .i2c_internal = false /* shield 0 */ } },
+                { "i2c3", make_i2c, &mms->i2c[3], 0x41206000, 0x1000, {},
+                  { .i2c_internal = false /* shield 1 */ } },
                 { /* port 7 reserved */ },
-                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000 },
+                { "i2c4", make_i2c, &mms->i2c[4], 0x41208000, 0x1000, {},
+                  { .i2c_internal = true /* DDR4 EEPROM */ } },
             },
         }, {
             .name = "apb_ppcexp2",
@@ -XXX,XX +XXX,XX @@ static void mps2tz_common_init(MachineState *machine)
         }, {
             .name = "apb_ppcexp1",
             .ports = {
-                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000 },
-                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000 },
+                { "i2c0", make_i2c, &mms->i2c[0], 0x49200000, 0x1000, {},
+                  { .i2c_internal = true /* touchscreen */ } },
+                { "i2c1", make_i2c, &mms->i2c[1], 0x49201000, 0x1000, {},
+                  { .i2c_internal = true /* audio conf */ } },
                 { "spi0", make_spi, &mms->spi[0], 0x49202000, 0x1000, { 53 } },
                 { "spi1", make_spi, &mms->spi[1], 0x49203000, 0x1000, { 54 } },
                 { "spi2", make_spi, &mms->spi[2], 0x49204000, 0x1000, { 55 } },
-                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000 },
-                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000 },
+                { "i2c2", make_i2c, &mms->i2c[2], 0x49205000, 0x1000, {},
+                  { .i2c_internal = false /* shield 0 */ } },
+                { "i2c3", make_i2c, &mms->i2c[3], 0x49206000, 0x1000, {},
+                  { .i2c_internal = false /* shield 1 */ } },
                 { /* port 7 reserved */ },
-                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000 },
+                { "i2c4", make_i2c, &mms->i2c[4], 0x49208000, 0x1000, {},
+                  { .i2c_internal = true /* DDR4 EEPROM */ } },
             },
         }, {
             .name = "apb_ppcexp2",
-- 
2.20.1

The various MPS2 boards implemented in mps2.c have multiple I2C
buses: a bus dedicated to the audio configuration, one for the LCD
touchscreen controller, and two which are connected to the external
Shield expansion connector.  Mark the buses which are used only for
board-internal devices as 'full' so that if the user creates i2c
devices on the commandline without specifying a bus name then they
will be connected to the I2C controller used for the Shield
connector, where guest software will expect them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20210903151435.22379-5-peter.maydell@linaro.org
---
 hw/arm/mps2.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/hw/arm/mps2.c b/hw/arm/mps2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2.c
+++ b/hw/arm/mps2.c
@@ -XXX,XX +XXX,XX @@ static void mps2_common_init(MachineState *machine)
                                          0x40023000,    /* Audio */
                                          0x40029000,    /* Shield0 */
                                          0x4002a000};   /* Shield1 */
-        sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
+        DeviceState *dev;
+
+        dev = sysbus_create_simple(TYPE_ARM_SBCON_I2C, i2cbase[i], NULL);
+        if (i < 2) {
+            /*
+             * internal-only bus: mark it full to avoid user-created
+             * i2c devices being plugged into it.
+             */
+            BusState *qbus = qdev_get_child_bus(dev, "i2c");
+            qbus_mark_full(qbus);
+        }
     }
     create_unimplemented_device("i2s", 0x40024000, 0x400);
 
-- 
2.20.1

target-arm queue: two bug fixes, plus the KVM/SVE patchset,
which is a new feature but one which was in my pre-softfreeze
pullreq (it just had to be dropped due to an unexpected test failure.)

thanks
-- PMM

The following changes since commit b7c9a7f353c0e260519bf735ff0d4aa01e72784b:

Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging (2019-10-31 15:57:30 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191101-1

for you to fetch changes up to d9ae7624b659362cb2bb2b04fee53bf50829ca56:

target/arm: Allow reading flags from FPSCR for M-profile (2019-11-01 08:49:10 +0000)

----------------------------------------------------------------
target-arm queue:
 * Support SVE in KVM guests
 * Don't UNDEF on M-profile 'vmrs apsr_nzcv, fpscr'
 * Update hflags after boot.c modifies CPU state

----------------------------------------------------------------
Andrew Jones (9):
      target/arm/monitor: Introduce qmp_query_cpu_model_expansion
      tests: arm: Introduce cpu feature tests
      target/arm: Allow SVE to be disabled via a CPU property
      target/arm/cpu64: max cpu: Introduce sve<N> properties
      target/arm/kvm64: Add kvm_arch_get/put_sve
      target/arm/kvm64: max cpu: Enable SVE when available
      target/arm/kvm: scratch vcpu: Preserve input kvm_vcpu_init features
      target/arm/cpu64: max cpu: Support sve properties with KVM
      target/arm/kvm: host cpu: Add support for sve<N> properties

Christophe Lyon (1):
      target/arm: Allow reading flags from FPSCR for M-profile

Edgar E. Iglesias (1):
      hw/arm/boot: Rebuild hflags when modifying CPUState at boot

From: Andrew Jones <drjones@redhat.com>

Add support for the query-cpu-model-expansion QMP command to Arm. We
do this selectively, only exposing CPU properties which represent
optional CPU features which the user may want to enable/disable.
Additionally we restrict the list of queryable cpu models to 'max',
'host', or the current type when KVM is in use. And, finally, we only
implement expansion type 'full', as Arm does not yet have a "base"
CPU type. More details and example queries are described in a new
document (docs/arm-cpu-features.rst).

Note, certainly more features may be added to the list of advertised
features, e.g. 'vfp' and 'neon'. The only requirement is that we can
detect invalid configurations and emit failures at QMP query time.
For 'vfp' and 'neon' this will require some refactoring to share a
validation function between the QMP query and the CPU realize
functions.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
Message-id: 20191031142734.8590-2-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 qapi/machine-target.json  |   6 +-
 target/arm/monitor.c      | 146 ++++++++++++++++++++++++++++++++++++++
 docs/arm-cpu-features.rst | 137 +++++++++++++++++++++++++++++++++++
 3 files changed, 286 insertions(+), 3 deletions(-)
 create mode 100644 docs/arm-cpu-features.rst

diff --git a/qapi/machine-target.json b/qapi/machine-target.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/machine-target.json
+++ b/qapi/machine-target.json
@@ -XXX,XX +XXX,XX @@
 ##
 { 'struct': 'CpuModelExpansionInfo',
   'data': { 'model': 'CpuModelInfo' },
-  'if': 'defined(TARGET_S390X) || defined(TARGET_I386)' }
+  'if': 'defined(TARGET_S390X) || defined(TARGET_I386) || defined(TARGET_ARM)' }
 
 ##
 # @query-cpu-model-expansion:
@@ -XXX,XX +XXX,XX @@
 #   query-cpu-model-expansion while using these is not advised.
 #
 # Some architectures may not support all expansion types. s390x supports
-# "full" and "static".
+# "full" and "static". Arm only supports "full".
 #
 # Returns: a CpuModelExpansionInfo. Returns an error if expanding CPU models is
 #          not supported, if the model cannot be expanded, if the model contains
@@ -XXX,XX +XXX,XX @@
   'data': { 'type': 'CpuModelExpansionType',
             'model': 'CpuModelInfo' },
   'returns': 'CpuModelExpansionInfo',
-  'if': 'defined(TARGET_S390X) || defined(TARGET_I386)' }
+  'if': 'defined(TARGET_S390X) || defined(TARGET_I386) || defined(TARGET_ARM)' }
 
 ##
 # @CpuDefinitionInfo:
diff --git a/target/arm/monitor.c b/target/arm/monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/monitor.c
+++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "hw/boards.h"
 #include "kvm_arm.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+#include "qapi/qobject-input-visitor.h"
+#include "qapi/qapi-commands-machine-target.h"
 #include "qapi/qapi-commands-misc-target.h"
+#include "qapi/qmp/qerror.h"
+#include "qapi/qmp/qdict.h"
+#include "qom/qom-qobject.h"
 
 static GICCapability *gic_cap_new(int version)
 {
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
 
     return head;
 }
+
+/*
+ * These are cpu model features we want to advertise. The order here
+ * matters as this is the order in which qmp_query_cpu_model_expansion
+ * will attempt to set them. If there are dependencies between features,
+ * then the order that considers those dependencies must be used.
+ */
+static const char *cpu_model_advertised_features[] = {
+    "aarch64", "pmu",
+    NULL
+};
+
+CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+                                                     CpuModelInfo *model,
+                                                     Error **errp)
+{
+    CpuModelExpansionInfo *expansion_info;
+    const QDict *qdict_in = NULL;
+    QDict *qdict_out;
+    ObjectClass *oc;
+    Object *obj;
+    const char *name;
+    int i;
+
+    if (type != CPU_MODEL_EXPANSION_TYPE_FULL) {
+        error_setg(errp, "The requested expansion type is not supported");
+        return NULL;
+    }
+
+    if (!kvm_enabled() && !strcmp(model->name, "host")) {
+        error_setg(errp, "The CPU type '%s' requires KVM", model->name);
+        return NULL;
+    }
+
+    oc = cpu_class_by_name(TYPE_ARM_CPU, model->name);
+    if (!oc) {
+        error_setg(errp, "The CPU type '%s' is not a recognized ARM CPU type",
+                   model->name);
+        return NULL;
+    }
+
+    if (kvm_enabled()) {
+        const char *cpu_type = current_machine->cpu_type;
+        int len = strlen(cpu_type) - strlen(ARM_CPU_TYPE_SUFFIX);
+        bool supported = false;
+
+        if (!strcmp(model->name, "host") || !strcmp(model->name, "max")) {
+            /* These are kvmarm's recommended cpu types */
+            supported = true;
+        } else if (strlen(model->name) == len &&
+                   !strncmp(model->name, cpu_type, len)) {
+            /* KVM is enabled and we're using this type, so it works. */
+            supported = true;
+        }
+        if (!supported) {
+            error_setg(errp, "We cannot guarantee the CPU type '%s' works "
+                             "with KVM on this host", model->name);
+            return NULL;
+        }
+    }
+
+    if (model->props) {
+        qdict_in = qobject_to(QDict, model->props);
+        if (!qdict_in) {
+            error_setg(errp, QERR_INVALID_PARAMETER_TYPE, "props", "dict");
+            return NULL;
+        }
+    }
+
+    obj = object_new(object_class_get_name(oc));
+
+    if (qdict_in) {
+        Visitor *visitor;
+        Error *err = NULL;
+
+        visitor = qobject_input_visitor_new(model->props);
+        visit_start_struct(visitor, NULL, NULL, 0, &err);
+        if (err) {
+            visit_free(visitor);
+            object_unref(obj);
+            error_propagate(errp, err);
+            return NULL;
+        }
+
+        i = 0;
+        while ((name = cpu_model_advertised_features[i++]) != NULL) {
+            if (qdict_get(qdict_in, name)) {
+                object_property_set(obj, visitor, name, &err);
+                if (err) {
+                    break;
+                }
+            }
+        }
+
+        if (!err) {
+            visit_check_struct(visitor, &err);
+        }
+        visit_end_struct(visitor, NULL);
+        visit_free(visitor);
+        if (err) {
+            object_unref(obj);
+            error_propagate(errp, err);
+            return NULL;
+        }
+    }
+
+    expansion_info = g_new0(CpuModelExpansionInfo, 1);
+    expansion_info->model = g_malloc0(sizeof(*expansion_info->model));
+    expansion_info->model->name = g_strdup(model->name);
+
+    qdict_out = qdict_new();
+
+    i = 0;
+    while ((name = cpu_model_advertised_features[i++]) != NULL) {
+        ObjectProperty *prop = object_property_find(obj, name, NULL);
+        if (prop) {
+            Error *err = NULL;
+            QObject *value;
+
+            assert(prop->get);
+            value = object_property_get_qobject(obj, name, &err);
+            assert(!err);
+
+            qdict_put_obj(qdict_out, name, value);
+        }
+    }
+
+    if (!qdict_size(qdict_out)) {
+        qobject_unref(qdict_out);
+    } else {
+        expansion_info->model->props = QOBJECT(qdict_out);
+        expansion_info->model->has_props = true;
+    }
+
+    object_unref(obj);
+
+    return expansion_info;
+}
diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/arm-cpu-features.rst
@@ -XXX,XX +XXX,XX @@
+================
+ARM CPU Features
+================
+
+Examples of probing and using ARM CPU features
+
+Introduction
+============
+
+CPU features are optional features that a CPU of supporting type may
+choose to implement or not.  In QEMU, optional CPU features have
+corresponding boolean CPU proprieties that, when enabled, indicate
+that the feature is implemented, and, conversely, when disabled,
+indicate that it is not implemented. An example of an ARM CPU feature
+is the Performance Monitoring Unit (PMU).  CPU types such as the
+Cortex-A15 and the Cortex-A57, which respectively implement ARM
+architecture reference manuals ARMv7-A and ARMv8-A, may both optionally
+implement PMUs.  For example, if a user wants to use a Cortex-A15 without
+a PMU, then the `-cpu` parameter should contain `pmu=off` on the QEMU
+command line, i.e. `-cpu cortex-a15,pmu=off`.
+
+As not all CPU types support all optional CPU features, then whether or
+not a CPU property exists depends on the CPU type.  For example, CPUs
+that implement the ARMv8-A architecture reference manual may optionally
+support the AArch32 CPU feature, which may be enabled by disabling the
+`aarch64` CPU property.  A CPU type such as the Cortex-A15, which does
+not implement ARMv8-A, will not have the `aarch64` CPU property.
+
+QEMU's support may be limited for some CPU features, only partially
+supporting the feature or only supporting the feature under certain
+configurations.  For example, the `aarch64` CPU feature, which, when
+disabled, enables the optional AArch32 CPU feature, is only supported
+when using the KVM accelerator and when running on a host CPU type that
+supports the feature.
+
+CPU Feature Probing
+===================
+
+Determining which CPU features are available and functional for a given
+CPU type is possible with the `query-cpu-model-expansion` QMP command.
+Below are some examples where `scripts/qmp/qmp-shell` (see the top comment
+block in the script for usage) is used to issue the QMP commands.
+
+(1) Determine which CPU features are available for the `max` CPU type
+    (Note, we started QEMU with qemu-system-aarch64, so `max` is
+     implementing the ARMv8-A reference manual in this case)::
+
+      (QEMU) query-cpu-model-expansion type=full model={"name":"max"}
+      { "return": {
+        "model": { "name": "max", "props": {
+        "pmu": true, "aarch64": true
+      }}}}
+
+We see that the `max` CPU type has the `pmu` and `aarch64` CPU features.
+We also see that the CPU features are enabled, as they are all `true`.
+
+(2) Let's try to disable the PMU::
+
+      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"pmu":false}}
+      { "return": {
+        "model": { "name": "max", "props": {
+        "pmu": false, "aarch64": true
+      }}}}
+
+We see it worked, as `pmu` is now `false`.
+
+(3) Let's try to disable `aarch64`, which enables the AArch32 CPU feature::
+
+      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"aarch64":false}}
+      {"error": {
+       "class": "GenericError", "desc":
+       "'aarch64' feature cannot be disabled unless KVM is enabled and 32-bit EL1 is supported"
+      }}
+
+It looks like this feature is limited to a configuration we do not
+currently have.
+
+(4) Let's try probing CPU features for the Cortex-A15 CPU type::
+
+      (QEMU) query-cpu-model-expansion type=full model={"name":"cortex-a15"}
+      {"return": {"model": {"name": "cortex-a15", "props": {"pmu": true}}}}
+
+Only the `pmu` CPU feature is available.
+
+A note about CPU feature dependencies
+-------------------------------------
+
+It's possible for features to have dependencies on other features. I.e.
+it may be possible to change one feature at a time without error, but
+when attempting to change all features at once an error could occur
+depending on the order they are processed.  It's also possible changing
+all at once doesn't generate an error, because a feature's dependencies
+are satisfied with other features, but the same feature cannot be changed
+independently without error.  For these reasons callers should always
+attempt to make their desired changes all at once in order to ensure the
+collection is valid.
+
+A note about CPU models and KVM
+-------------------------------
+
+Named CPU models generally do not work with KVM.  There are a few cases
+that do work, e.g. using the named CPU model `cortex-a57` with KVM on a
+seattle host, but mostly if KVM is enabled the `host` CPU type must be
+used.  This means the guest is provided all the same CPU features as the
+host CPU type has.  And, for this reason, the `host` CPU type should
+enable all CPU features that the host has by default.  Indeed it's even
+a bit strange to allow disabling CPU features that the host has when using
+the `host` CPU type, but in the absence of CPU models it's the best we can
+do if we want to launch guests without all the host's CPU features enabled.
+
+Enabling KVM also affects the `query-cpu-model-expansion` QMP command.  The
+affect is not only limited to specific features, as pointed out in example
+(3) of "CPU Feature Probing", but also to which CPU types may be expanded.
+When KVM is enabled, only the `max`, `host`, and current CPU type may be
+expanded.  This restriction is necessary as it's not possible to know all
+CPU types that may work with KVM, but it does impose a small risk of users
+experiencing unexpected errors.  For example on a seattle, as mentioned
+above, the `cortex-a57` CPU type is also valid when KVM is enabled.
+Therefore a user could use the `host` CPU type for the current type, but
+then attempt to query `cortex-a57`, however that query will fail with our
+restrictions.  This shouldn't be an issue though as management layers and
+users have been preferring the `host` CPU type for use with KVM for quite
+some time.  Additionally, if the KVM-enabled QEMU instance running on a
+seattle host is using the `cortex-a57` CPU type, then querying `cortex-a57`
+will work.
+
+Using CPU Features
+==================
+
+After determining which CPU features are available and supported for a
+given CPU type, then they may be selectively enabled or disabled on the
+QEMU command line with that CPU type::
+
+  $ qemu-system-aarch64 -M virt -cpu max,pmu=off
+
+The example above disables the PMU for the `max` CPU type.
+
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Now that Arm CPUs have advertised features lets add tests to ensure
we maintain their expected availability with and without KVM.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20191031142734.8590-3-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/Makefile.include   |   5 +-
 tests/arm-cpu-features.c | 253 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 257 insertions(+), 1 deletion(-)
 create mode 100644 tests/arm-cpu-features.c

diff --git a/tests/Makefile.include b/tests/Makefile.include
index XXXXXXX..XXXXXXX 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -XXX,XX +XXX,XX @@ check-qtest-sparc64-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
 check-qtest-sparc64-y += tests/prom-env-test$(EXESUF)
 check-qtest-sparc64-y += tests/boot-serial-test$(EXESUF)
 
+check-qtest-arm-y += tests/arm-cpu-features$(EXESUF)
 check-qtest-arm-y += tests/microbit-test$(EXESUF)
 check-qtest-arm-y += tests/m25p80-test$(EXESUF)
 check-qtest-arm-y += tests/test-arm-mptimer$(EXESUF)
@@ -XXX,XX +XXX,XX @@ check-qtest-arm-y += tests/boot-serial-test$(EXESUF)
 check-qtest-arm-y += tests/hexloader-test$(EXESUF)
 check-qtest-arm-$(CONFIG_PFLASH_CFI02) += tests/pflash-cfi02-test$(EXESUF)
 
-check-qtest-aarch64-y = tests/numa-test$(EXESUF)
+check-qtest-aarch64-y += tests/arm-cpu-features$(EXESUF)
+check-qtest-aarch64-y += tests/numa-test$(EXESUF)
 check-qtest-aarch64-y += tests/boot-serial-test$(EXESUF)
 check-qtest-aarch64-y += tests/migration-test$(EXESUF)
 # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make test unconditional
@@ -XXX,XX +XXX,XX @@ tests/test-qapi-util$(EXESUF): tests/test-qapi-util.o $(test-util-obj-y)
 tests/numa-test$(EXESUF): tests/numa-test.o
 tests/vmgenid-test$(EXESUF): tests/vmgenid-test.o tests/boot-sector.o tests/acpi-utils.o
 tests/cdrom-test$(EXESUF): tests/cdrom-test.o tests/boot-sector.o $(libqos-obj-y)
+tests/arm-cpu-features$(EXESUF): tests/arm-cpu-features.o
 
 tests/migration/stress$(EXESUF): tests/migration/stress.o
 	$(call quiet-command, $(LINKPROG) -static -O3 $(PTHREAD_LIB) -o $@ $< ,"LINK","$(TARGET_DIR)$@")
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Arm CPU feature test cases
+ *
+ * Copyright (c) 2019 Red Hat Inc.
+ * Authors:
+ *  Andrew Jones <drjones@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "libqtest.h"
+#include "qapi/qmp/qdict.h"
+#include "qapi/qmp/qjson.h"
+
+#define MACHINE     "-machine virt,gic-version=max,accel=tcg "
+#define MACHINE_KVM "-machine virt,gic-version=max,accel=kvm:tcg "
+#define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
+                    "  'arguments': { 'type': 'full', "
+#define QUERY_TAIL  "}}"
+
+static bool kvm_enabled(QTestState *qts)
+{
+    QDict *resp, *qdict;
+    bool enabled;
+
+    resp = qtest_qmp(qts, "{ 'execute': 'query-kvm' }");
+    g_assert(qdict_haskey(resp, "return"));
+    qdict = qdict_get_qdict(resp, "return");
+    g_assert(qdict_haskey(qdict, "enabled"));
+    enabled = qdict_get_bool(qdict, "enabled");
+    qobject_unref(resp);
+
+    return enabled;
+}
+
+static QDict *do_query_no_props(QTestState *qts, const char *cpu_type)
+{
+    return qtest_qmp(qts, QUERY_HEAD "'model': { 'name': %s }"
+                          QUERY_TAIL, cpu_type);
+}
+
+static QDict *do_query(QTestState *qts, const char *cpu_type,
+                       const char *fmt, ...)
+{
+    QDict *resp;
+
+    if (fmt) {
+        QDict *args;
+        va_list ap;
+
+        va_start(ap, fmt);
+        args = qdict_from_vjsonf_nofail(fmt, ap);
+        va_end(ap);
+
+        resp = qtest_qmp(qts, QUERY_HEAD "'model': { 'name': %s, "
+                                                    "'props': %p }"
+                              QUERY_TAIL, cpu_type, args);
+    } else {
+        resp = do_query_no_props(qts, cpu_type);
+    }
+
+    return resp;
+}
+
+static const char *resp_get_error(QDict *resp)
+{
+    QDict *qdict;
+
+    g_assert(resp);
+
+    qdict = qdict_get_qdict(resp, "error");
+    if (qdict) {
+        return qdict_get_str(qdict, "desc");
+    }
+
+    return NULL;
+}
+
+#define assert_error(qts, cpu_type, expected_error, fmt, ...)          \
+({                                                                     \
+    QDict *_resp;                                                      \
+    const char *_error;                                                \
+                                                                       \
+    _resp = do_query(qts, cpu_type, fmt, ##__VA_ARGS__);               \
+    g_assert(_resp);                                                   \
+    _error = resp_get_error(_resp);                                    \
+    g_assert(_error);                                                  \
+    g_assert(g_str_equal(_error, expected_error));                     \
+    qobject_unref(_resp);                                              \
+})
+
+static bool resp_has_props(QDict *resp)
+{
+    QDict *qdict;
+
+    g_assert(resp);
+
+    if (!qdict_haskey(resp, "return")) {
+        return false;
+    }
+    qdict = qdict_get_qdict(resp, "return");
+
+    if (!qdict_haskey(qdict, "model")) {
+        return false;
+    }
+    qdict = qdict_get_qdict(qdict, "model");
+
+    return qdict_haskey(qdict, "props");
+}
+
+static QDict *resp_get_props(QDict *resp)
+{
+    QDict *qdict;
+
+    g_assert(resp);
+    g_assert(resp_has_props(resp));
+
+    qdict = qdict_get_qdict(resp, "return");
+    qdict = qdict_get_qdict(qdict, "model");
+    qdict = qdict_get_qdict(qdict, "props");
+
+    return qdict;
+}
+
+#define assert_has_feature(qts, cpu_type, feature)                     \
+({                                                                     \
+    QDict *_resp = do_query_no_props(qts, cpu_type);                   \
+    g_assert(_resp);                                                   \
+    g_assert(resp_has_props(_resp));                                   \
+    g_assert(qdict_get(resp_get_props(_resp), feature));               \
+    qobject_unref(_resp);                                              \
+})
+
+#define assert_has_not_feature(qts, cpu_type, feature)                 \
+({                                                                     \
+    QDict *_resp = do_query_no_props(qts, cpu_type);                   \
+    g_assert(_resp);                                                   \
+    g_assert(!resp_has_props(_resp) ||                                 \
+             !qdict_get(resp_get_props(_resp), feature));              \
+    qobject_unref(_resp);                                              \
+})
+
+static void assert_type_full(QTestState *qts)
+{
+    const char *error;
+    QDict *resp;
+
+    resp = qtest_qmp(qts, "{ 'execute': 'query-cpu-model-expansion', "
+                            "'arguments': { 'type': 'static', "
+                                           "'model': { 'name': 'foo' }}}");
+    g_assert(resp);
+    error = resp_get_error(resp);
+    g_assert(error);
+    g_assert(g_str_equal(error,
+                         "The requested expansion type is not supported"));
+    qobject_unref(resp);
+}
+
+static void assert_bad_props(QTestState *qts, const char *cpu_type)
+{
+    const char *error;
+    QDict *resp;
+
+    resp = qtest_qmp(qts, "{ 'execute': 'query-cpu-model-expansion', "
+                            "'arguments': { 'type': 'full', "
+                                           "'model': { 'name': %s, "
+                                                      "'props': false }}}",
+                     cpu_type);
+    g_assert(resp);
+    error = resp_get_error(resp);
+    g_assert(error);
+    g_assert(g_str_equal(error,
+                         "Invalid parameter type for 'props', expected: dict"));
+    qobject_unref(resp);
+}
+
+static void test_query_cpu_model_expansion(const void *data)
+{
+    QTestState *qts;
+
+    qts = qtest_init(MACHINE "-cpu max");
+
+    /* Test common query-cpu-model-expansion input validation */
+    assert_type_full(qts);
+    assert_bad_props(qts, "max");
+    assert_error(qts, "foo", "The CPU type 'foo' is not a recognized "
+                 "ARM CPU type", NULL);
+    assert_error(qts, "max", "Parameter 'not-a-prop' is unexpected",
+                 "{ 'not-a-prop': false }");
+    assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
+
+    /* Test expected feature presence/absence for some cpu types */
+    assert_has_feature(qts, "max", "pmu");
+    assert_has_feature(qts, "cortex-a15", "pmu");
+    assert_has_not_feature(qts, "cortex-a15", "aarch64");
+
+    if (g_str_equal(qtest_get_arch(), "aarch64")) {
+        assert_has_feature(qts, "max", "aarch64");
+        assert_has_feature(qts, "cortex-a57", "pmu");
+        assert_has_feature(qts, "cortex-a57", "aarch64");
+
+        /* Test that features that depend on KVM generate errors without. */
+        assert_error(qts, "max",
+                     "'aarch64' feature cannot be disabled "
+                     "unless KVM is enabled and 32-bit EL1 "
+                     "is supported",
+                     "{ 'aarch64': false }");
+    }
+
+    qtest_quit(qts);
+}
+
+static void test_query_cpu_model_expansion_kvm(const void *data)
+{
+    QTestState *qts;
+
+    qts = qtest_init(MACHINE_KVM "-cpu max");
+
+    /*
+     * These tests target the 'host' CPU type, so KVM must be enabled.
+     */
+    if (!kvm_enabled(qts)) {
+        qtest_quit(qts);
+        return;
+    }
+
+    if (g_str_equal(qtest_get_arch(), "aarch64")) {
+        assert_has_feature(qts, "host", "aarch64");
+        assert_has_feature(qts, "host", "pmu");
+
+        assert_error(qts, "cortex-a15",
+            "We cannot guarantee the CPU type 'cortex-a15' works "
+            "with KVM on this host", NULL);
+    } else {
+        assert_has_not_feature(qts, "host", "aarch64");
+        assert_has_not_feature(qts, "host", "pmu");
+    }
+
+    qtest_quit(qts);
+}
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_data_func("/arm/query-cpu-model-expansion",
+                        NULL, test_query_cpu_model_expansion);
+    qtest_add_data_func("/arm/kvm/query-cpu-model-expansion",
+                        NULL, test_query_cpu_model_expansion_kvm);
+
+    return g_test_run();
+}
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Since 97a28b0eeac14 ("target/arm: Allow VFP and Neon to be disabled via
a CPU property") we can disable the 'max' cpu model's VFP and neon
features, but there's no way to disable SVE. Add the 'sve=on|off'
property to give it that flexibility. We also rename
cpu_max_get/set_sve_vq to cpu_max_get/set_sve_max_vq in order for them
to follow the typical *_get/set_<property-name> pattern.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
Message-id: 20191031142734.8590-4-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c         |  3 ++-
 target/arm/cpu64.c       | 52 ++++++++++++++++++++++++++++++++++------
 target/arm/monitor.c     |  2 +-
 tests/arm-cpu-features.c |  1 +
 4 files changed, 49 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
         env->cp15.cptr_el[3] |= CPTR_EZ;
         /* with maximum vector length */
-        env->vfp.zcr_el[1] = cpu->sve_max_vq - 1;
+        env->vfp.zcr_el[1] = cpu_isar_feature(aa64_sve, cpu) ?
+                             cpu->sve_max_vq - 1 : 0;
         env->vfp.zcr_el[2] = env->vfp.zcr_el[1];
         env->vfp.zcr_el[3] = env->vfp.zcr_el[1];
         /*
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
-static void cpu_max_get_sve_vq(Object *obj, Visitor *v, const char *name,
-                               void *opaque, Error **errp)
+static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    visit_type_uint32(v, name, &cpu->sve_max_vq, errp);
+    uint32_t value;
+
+    /* All vector lengths are disabled when SVE is off. */
+    if (!cpu_isar_feature(aa64_sve, cpu)) {
+        value = 0;
+    } else {
+        value = cpu->sve_max_vq;
+    }
+    visit_type_uint32(v, name, &value, errp);
 }
 
-static void cpu_max_set_sve_vq(Object *obj, Visitor *v, const char *name,
-                               void *opaque, Error **errp)
+static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
     Error *err = NULL;
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_vq(Object *obj, Visitor *v, const char *name,
     error_propagate(errp, err);
 }
 
+static void cpu_arm_get_sve(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    bool value = cpu_isar_feature(aa64_sve, cpu);
+
+    visit_type_bool(v, name, &value, errp);
+}
+
+static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    Error *err = NULL;
+    bool value;
+    uint64_t t;
+
+    visit_type_bool(v, name, &value, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    t = cpu->isar.id_aa64pfr0;
+    t = FIELD_DP64(t, ID_AA64PFR0, SVE, value);
+    cpu->isar.id_aa64pfr0 = t;
+}
+
 /* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
  * otherwise, a CPU with as many features enabled as our emulation supports.
  * The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 #endif
 
         cpu->sve_max_vq = ARM_MAX_VQ;
-        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_vq,
-                            cpu_max_set_sve_vq, NULL, NULL, &error_fatal);
+        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
+                            cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
+        object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
+                            cpu_arm_set_sve, NULL, NULL, &error_fatal);
     }
 }
 
diff --git a/target/arm/monitor.c b/target/arm/monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/monitor.c
+++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
  * then the order that considers those dependencies must be used.
  */
 static const char *cpu_model_advertised_features[] = {
-    "aarch64", "pmu",
+    "aarch64", "pmu", "sve",
     NULL
 };
 
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/arm-cpu-features.c
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
 
     if (g_str_equal(qtest_get_arch(), "aarch64")) {
         assert_has_feature(qts, "max", "aarch64");
+        assert_has_feature(qts, "max", "sve");
         assert_has_feature(qts, "cortex-a57", "pmu");
         assert_has_feature(qts, "cortex-a57", "aarch64");
 
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Introduce cpu properties to give fine control over SVE vector lengths.
We introduce a property for each valid length up to the current
maximum supported, which is 2048-bits. The properties are named, e.g.
sve128, sve256, sve384, sve512, ..., where the number is the number of
bits. See the updates to docs/arm-cpu-features.rst for a description
of the semantics and for example uses.

Note, as sve-max-vq is still present and we'd like to be able to
support qmp_query_cpu_model_expansion with guests launched with e.g.
-cpu max,sve-max-vq=8 on their command lines, then we do allow
sve-max-vq and sve<N> properties to be provided at the same time, but
this is not recommended, and is why sve-max-vq is not mentioned in the
document.  If sve-max-vq is provided then it enables all lengths smaller
than and including the max and disables all lengths larger. It also has
the side-effect that no larger lengths may be enabled and that the max
itself cannot be disabled. Smaller non-power-of-two lengths may,
however, be disabled, e.g. -cpu max,sve-max-vq=4,sve384=off provides a
guest the vector lengths 128, 256, and 512 bits.

This patch has been co-authored with Richard Henderson, who reworked
the target/arm/cpu64.c changes in order to push all the validation and
auto-enabling/disabling steps into the finalizer, resulting in a nice
LOC reduction.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
Message-id: 20191031142734.8590-5-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qemu/bitops.h     |   1 +
 target/arm/cpu.h          |  19 ++++
 target/arm/cpu.c          |  19 ++++
 target/arm/cpu64.c        | 192 ++++++++++++++++++++++++++++++++++++-
 target/arm/helper.c       |  10 +-
 target/arm/monitor.c      |  12 +++
 tests/arm-cpu-features.c  | 194 ++++++++++++++++++++++++++++++++++++++
 docs/arm-cpu-features.rst | 168 +++++++++++++++++++++++++++++++--
 8 files changed, 606 insertions(+), 9 deletions(-)

diff --git a/include/qemu/bitops.h b/include/qemu/bitops.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/bitops.h
+++ b/include/qemu/bitops.h
@@ -XXX,XX +XXX,XX @@
 #define BITS_PER_LONG           (sizeof (unsigned long) * BITS_PER_BYTE)
 
 #define BIT(nr)                 (1UL << (nr))
+#define BIT_ULL(nr)             (1ULL << (nr))
 #define BIT_MASK(nr)            (1UL << ((nr) % BITS_PER_LONG))
 #define BIT_WORD(nr)            ((nr) / BITS_PER_LONG)
 #define BITS_TO_LONGS(nr)       DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 #ifdef TARGET_AARCH64
 # define ARM_MAX_VQ    16
+void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
+uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq);
 #else
 # define ARM_MAX_VQ    1
+static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
+static inline uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq)
+{ return 0; }
 #endif
 
 typedef struct ARMVectorReg {
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
 
     /* Used to set the maximum vector length the cpu will support.  */
     uint32_t sve_max_vq;
+
+    /*
+     * In sve_vq_map each set bit is a supported vector length of
+     * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
+     * length in quadwords.
+     *
+     * While processing properties during initialization, corresponding
+     * sve_vq_init bits are set for bits in sve_vq_map that have been
+     * set by properties.
+     */
+    DECLARE_BITMAP(sve_vq_map, ARM_MAX_VQ);
+    DECLARE_BITMAP(sve_vq_init, ARM_MAX_VQ);
 };
 
 void arm_cpu_post_init(Object *obj);
@@ -XXX,XX +XXX,XX @@ static inline int arm_feature(CPUARMState *env, int feature)
     return (env->features & (1ULL << feature)) != 0;
 }
 
+void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
+
 #if !defined(CONFIG_USER_ONLY)
 /* Return true if exception levels below EL3 are in secure state,
  * or would be following an exception return to that level.
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_finalizefn(Object *obj)
 #endif
 }
 
+void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
+{
+    Error *local_err = NULL;
+
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        arm_cpu_sve_finalize(cpu, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
+}
+
 static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     CPUState *cs = CPU(dev);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
+    arm_cpu_finalize_features(cpu, &local_err);
+    if (local_err != NULL) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
     if (arm_feature(env, ARM_FEATURE_AARCH64) &&
         cpu->has_vfp != cpu->has_neon) {
         /*
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
+void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
+{
+    /*
+     * If any vector lengths are explicitly enabled with sve<N> properties,
+     * then all other lengths are implicitly disabled.  If sve-max-vq is
+     * specified then it is the same as explicitly enabling all lengths
+     * up to and including the specified maximum, which means all larger
+     * lengths will be implicitly disabled.  If no sve<N> properties
+     * are enabled and sve-max-vq is not specified, then all lengths not
+     * explicitly disabled will be enabled.  Additionally, all power-of-two
+     * vector lengths less than the maximum enabled length will be
+     * automatically enabled and all vector lengths larger than the largest
+     * disabled power-of-two vector length will be automatically disabled.
+     * Errors are generated if the user provided input that interferes with
+     * any of the above.  Finally, if SVE is not disabled, then at least one
+     * vector length must be enabled.
+     */
+    DECLARE_BITMAP(tmp, ARM_MAX_VQ);
+    uint32_t vq, max_vq = 0;
+
+    /*
+     * Process explicit sve<N> properties.
+     * From the properties, sve_vq_map<N> implies sve_vq_init<N>.
+     * Check first for any sve<N> enabled.
+     */
+    if (!bitmap_empty(cpu->sve_vq_map, ARM_MAX_VQ)) {
+        max_vq = find_last_bit(cpu->sve_vq_map, ARM_MAX_VQ) + 1;
+
+        if (cpu->sve_max_vq && max_vq > cpu->sve_max_vq) {
+            error_setg(errp, "cannot enable sve%d", max_vq * 128);
+            error_append_hint(errp, "sve%d is larger than the maximum vector "
+                              "length, sve-max-vq=%d (%d bits)\n",
+                              max_vq * 128, cpu->sve_max_vq,
+                              cpu->sve_max_vq * 128);
+            return;
+        }
+
+        /* Propagate enabled bits down through required powers-of-two. */
+        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
+            if (!test_bit(vq - 1, cpu->sve_vq_init)) {
+                set_bit(vq - 1, cpu->sve_vq_map);
+            }
+        }
+    } else if (cpu->sve_max_vq == 0) {
+        /*
+         * No explicit bits enabled, and no implicit bits from sve-max-vq.
+         */
+        if (!cpu_isar_feature(aa64_sve, cpu)) {
+            /* SVE is disabled and so are all vector lengths.  Good. */
+            return;
+        }
+
+        /* Disabling a power-of-two disables all larger lengths. */
+        if (test_bit(0, cpu->sve_vq_init)) {
+            error_setg(errp, "cannot disable sve128");
+            error_append_hint(errp, "Disabling sve128 results in all vector "
+                              "lengths being disabled.\n");
+            error_append_hint(errp, "With SVE enabled, at least one vector "
+                              "length must be enabled.\n");
+            return;
+        }
+        for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
+            if (test_bit(vq - 1, cpu->sve_vq_init)) {
+                break;
+            }
+        }
+        max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
+
+        bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
+        max_vq = find_last_bit(cpu->sve_vq_map, max_vq) + 1;
+    }
+
+    /*
+     * Process the sve-max-vq property.
+     * Note that we know from the above that no bit above
+     * sve-max-vq is currently set.
+     */
+    if (cpu->sve_max_vq != 0) {
+        max_vq = cpu->sve_max_vq;
+
+        if (!test_bit(max_vq - 1, cpu->sve_vq_map) &&
+            test_bit(max_vq - 1, cpu->sve_vq_init)) {
+            error_setg(errp, "cannot disable sve%d", max_vq * 128);
+            error_append_hint(errp, "The maximum vector length must be "
+                              "enabled, sve-max-vq=%d (%d bits)\n",
+                              max_vq, max_vq * 128);
+            return;
+        }
+
+        /* Set all bits not explicitly set within sve-max-vq. */
+        bitmap_complement(tmp, cpu->sve_vq_init, max_vq);
+        bitmap_or(cpu->sve_vq_map, cpu->sve_vq_map, tmp, max_vq);
+    }
+
+    /*
+     * We should know what max-vq is now.  Also, as we're done
+     * manipulating sve-vq-map, we ensure any bits above max-vq
+     * are clear, just in case anybody looks.
+     */
+    assert(max_vq != 0);
+    bitmap_clear(cpu->sve_vq_map, max_vq, ARM_MAX_VQ - max_vq);
+
+    /* Ensure all required powers-of-two are enabled. */
+    for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
+        if (!test_bit(vq - 1, cpu->sve_vq_map)) {
+            error_setg(errp, "cannot disable sve%d", vq * 128);
+            error_append_hint(errp, "sve%d is required as it "
+                              "is a power-of-two length smaller than "
+                              "the maximum, sve%d\n",
+                              vq * 128, max_vq * 128);
+            return;
+        }
+    }
+
+    /*
+     * Now that we validated all our vector lengths, the only question
+     * left to answer is if we even want SVE at all.
+     */
+    if (!cpu_isar_feature(aa64_sve, cpu)) {
+        error_setg(errp, "cannot enable sve%d", max_vq * 128);
+        error_append_hint(errp, "SVE must be enabled to enable vector "
+                          "lengths.\n");
+        error_append_hint(errp, "Add sve=on to the CPU property list.\n");
+        return;
+    }
+
+    /* From now on sve_max_vq is the actual maximum supported length. */
+    cpu->sve_max_vq = max_vq;
+}
+
+uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq)
+{
+    uint32_t bitnum;
+
+    /*
+     * We allow vq == ARM_MAX_VQ + 1 to be input because the caller may want
+     * to find the maximum vq enabled, which may be ARM_MAX_VQ, but this
+     * function always returns the next smaller than the input.
+     */
+    assert(vq && vq <= ARM_MAX_VQ + 1);
+
+    bitnum = find_last_bit(cpu->sve_vq_map, vq - 1);
+    return bitnum == vq - 1 ? 0 : bitnum + 1;
+}
+
 static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
                                    void *opaque, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
     error_propagate(errp, err);
 }
 
+static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
+                               void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t vq = atoi(&name[3]) / 128;
+    bool value;
+
+    /* All vector lengths are disabled when SVE is off. */
+    if (!cpu_isar_feature(aa64_sve, cpu)) {
+        value = false;
+    } else {
+        value = test_bit(vq - 1, cpu->sve_vq_map);
+    }
+    visit_type_bool(v, name, &value, errp);
+}
+
+static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
+                               void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t vq = atoi(&name[3]) / 128;
+    Error *err = NULL;
+    bool value;
+
+    visit_type_bool(v, name, &value, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    if (value) {
+        set_bit(vq - 1, cpu->sve_vq_map);
+    } else {
+        clear_bit(vq - 1, cpu->sve_vq_map);
+    }
+    set_bit(vq - 1, cpu->sve_vq_init);
+}
+
 static void cpu_arm_get_sve(Object *obj, Visitor *v, const char *name,
                             void *opaque, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
 static void aarch64_max_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t vq;
 
     if (kvm_enabled()) {
         kvm_arm_set_cpu_features_from_host(cpu);
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         cpu->dcz_blocksize = 7; /*  512 bytes */
 #endif
 
-        cpu->sve_max_vq = ARM_MAX_VQ;
         object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                             cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
         object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
                             cpu_arm_set_sve, NULL, NULL, &error_fatal);
+
+        for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
+            char name[8];
+            sprintf(name, "sve%d", vq * 128);
+            object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
+                                cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
+        }
     }
 }
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
     return 0;
 }
 
+static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
+{
+    uint32_t start_vq = (start_len & 0xf) + 1;
+
+    return arm_cpu_vq_map_next_smaller(cpu, start_vq + 1) - 1;
+}
+
 /*
  * Given that SVE is enabled, return the vector length for EL.
  */
@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
     }
-    return zcr_len;
+
+    return sve_zcr_get_valid_len(cpu, zcr_len);
 }
 
 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
diff --git a/target/arm/monitor.c b/target/arm/monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/monitor.c
+++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
     return head;
 }
 
+QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
+
 /*
  * These are cpu model features we want to advertise. The order here
  * matters as this is the order in which qmp_query_cpu_model_expansion
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
  */
 static const char *cpu_model_advertised_features[] = {
     "aarch64", "pmu", "sve",
+    "sve128", "sve256", "sve384", "sve512",
+    "sve640", "sve768", "sve896", "sve1024", "sve1152", "sve1280",
+    "sve1408", "sve1536", "sve1664", "sve1792", "sve1920", "sve2048",
     NULL
 };
 
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
         if (!err) {
             visit_check_struct(visitor, &err);
         }
+        if (!err) {
+            arm_cpu_finalize_features(ARM_CPU(obj), &err);
+        }
         visit_end_struct(visitor, NULL);
         visit_free(visitor);
         if (err) {
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
             error_propagate(errp, err);
             return NULL;
         }
+    } else {
+        Error *err = NULL;
+        arm_cpu_finalize_features(ARM_CPU(obj), &err);
+        assert(err == NULL);
     }
 
     expansion_info = g_new0(CpuModelExpansionInfo, 1);
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/arm-cpu-features.c
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@
  * See the COPYING file in the top-level directory.
  */
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "libqtest.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qjson.h"
 
+/*
+ * We expect the SVE max-vq to be 16. Also it must be <= 64
+ * for our test code, otherwise 'vls' can't just be a uint64_t.
+ */
+#define SVE_MAX_VQ 16
+
 #define MACHINE     "-machine virt,gic-version=max,accel=tcg "
 #define MACHINE_KVM "-machine virt,gic-version=max,accel=kvm:tcg "
 #define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
@@ -XXX,XX +XXX,XX @@ static void assert_bad_props(QTestState *qts, const char *cpu_type)
     qobject_unref(resp);
 }
 
+static uint64_t resp_get_sve_vls(QDict *resp)
+{
+    QDict *props;
+    const QDictEntry *e;
+    uint64_t vls = 0;
+    int n = 0;
+
+    g_assert(resp);
+    g_assert(resp_has_props(resp));
+
+    props = resp_get_props(resp);
+
+    for (e = qdict_first(props); e; e = qdict_next(props, e)) {
+        if (strlen(e->key) > 3 && !strncmp(e->key, "sve", 3) &&
+            g_ascii_isdigit(e->key[3])) {
+            char *endptr;
+            int bits;
+
+            bits = g_ascii_strtoll(&e->key[3], &endptr, 10);
+            if (!bits || *endptr != '\0') {
+                continue;
+            }
+
+            if (qdict_get_bool(props, e->key)) {
+                vls |= BIT_ULL((bits / 128) - 1);
+            }
+            ++n;
+        }
+    }
+
+    g_assert(n == SVE_MAX_VQ);
+
+    return vls;
+}
+
+#define assert_sve_vls(qts, cpu_type, expected_vls, fmt, ...)          \
+({                                                                     \
+    QDict *_resp = do_query(qts, cpu_type, fmt, ##__VA_ARGS__);        \
+    g_assert(_resp);                                                   \
+    g_assert(resp_has_props(_resp));                                   \
+    g_assert(resp_get_sve_vls(_resp) == expected_vls);                 \
+    qobject_unref(_resp);                                              \
+})
+
+static void sve_tests_default(QTestState *qts, const char *cpu_type)
+{
+    /*
+     * With no sve-max-vq or sve<N> properties on the command line
+     * the default is to have all vector lengths enabled. This also
+     * tests that 'sve' is 'on' by default.
+     */
+    assert_sve_vls(qts, cpu_type, BIT_ULL(SVE_MAX_VQ) - 1, NULL);
+
+    /* With SVE off, all vector lengths should also be off. */
+    assert_sve_vls(qts, cpu_type, 0, "{ 'sve': false }");
+
+    /* With SVE on, we must have at least one vector length enabled. */
+    assert_error(qts, cpu_type, "cannot disable sve128", "{ 'sve128': false }");
+
+    /* Basic enable/disable tests. */
+    assert_sve_vls(qts, cpu_type, 0x7, "{ 'sve384': true }");
+    assert_sve_vls(qts, cpu_type, ((BIT_ULL(SVE_MAX_VQ) - 1) & ~BIT_ULL(2)),
+                   "{ 'sve384': false }");
+
+    /*
+     * ---------------------------------------------------------------------
+     *               power-of-two(vq)   all-power-            can      can
+     *                                  of-two(< vq)        enable   disable
+     * ---------------------------------------------------------------------
+     * vq < max_vq      no                MUST*              yes      yes
+     * vq < max_vq      yes               MUST*              yes      no
+     * ---------------------------------------------------------------------
+     * vq == max_vq     n/a               MUST*              yes**    yes**
+     * ---------------------------------------------------------------------
+     * vq > max_vq      n/a               no                 no       yes
+     * vq > max_vq      n/a               yes                yes      yes
+     * ---------------------------------------------------------------------
+     *
+     * [*] "MUST" means this requirement must already be satisfied,
+     *     otherwise 'max_vq' couldn't itself be enabled.
+     *
+     * [**] Not testable with the QMP interface, only with the command line.
+     */
+
+    /* max_vq := 8 */
+    assert_sve_vls(qts, cpu_type, 0x8b, "{ 'sve1024': true }");
+
+    /* max_vq := 8, vq < max_vq, !power-of-two(vq) */
+    assert_sve_vls(qts, cpu_type, 0x8f,
+                   "{ 'sve1024': true, 'sve384': true }");
+    assert_sve_vls(qts, cpu_type, 0x8b,
+                   "{ 'sve1024': true, 'sve384': false }");
+
+    /* max_vq := 8, vq < max_vq, power-of-two(vq) */
+    assert_sve_vls(qts, cpu_type, 0x8b,
+                   "{ 'sve1024': true, 'sve256': true }");
+    assert_error(qts, cpu_type, "cannot disable sve256",
+                 "{ 'sve1024': true, 'sve256': false }");
+
+    /* max_vq := 3, vq > max_vq, !all-power-of-two(< vq) */
+    assert_error(qts, cpu_type, "cannot disable sve512",
+                 "{ 'sve384': true, 'sve512': false, 'sve640': true }");
+
+    /*
+     * We can disable power-of-two vector lengths when all larger lengths
+     * are also disabled. We only need to disable the power-of-two length,
+     * as all non-enabled larger lengths will then be auto-disabled.
+     */
+    assert_sve_vls(qts, cpu_type, 0x7, "{ 'sve512': false }");
+
+    /* max_vq := 3, vq > max_vq, all-power-of-two(< vq) */
+    assert_sve_vls(qts, cpu_type, 0x1f,
+                   "{ 'sve384': true, 'sve512': true, 'sve640': true }");
+    assert_sve_vls(qts, cpu_type, 0xf,
+                   "{ 'sve384': true, 'sve512': true, 'sve640': false }");
+}
+
+static void sve_tests_sve_max_vq_8(const void *data)
+{
+    QTestState *qts;
+
+    qts = qtest_init(MACHINE "-cpu max,sve-max-vq=8");
+
+    assert_sve_vls(qts, "max", BIT_ULL(8) - 1, NULL);
+
+    /*
+     * Disabling the max-vq set by sve-max-vq is not allowed, but
+     * of course enabling it is OK.
+     */
+    assert_error(qts, "max", "cannot disable sve1024", "{ 'sve1024': false }");
+    assert_sve_vls(qts, "max", 0xff, "{ 'sve1024': true }");
+
+    /*
+     * Enabling anything larger than max-vq set by sve-max-vq is not
+     * allowed, but of course disabling everything larger is OK.
+     */
+    assert_error(qts, "max", "cannot enable sve1152", "{ 'sve1152': true }");
+    assert_sve_vls(qts, "max", 0xff, "{ 'sve1152': false }");
+
+    /*
+     * We can enable/disable non power-of-two lengths smaller than the
+     * max-vq set by sve-max-vq, but, while we can enable power-of-two
+     * lengths, we can't disable them.
+     */
+    assert_sve_vls(qts, "max", 0xff, "{ 'sve384': true }");
+    assert_sve_vls(qts, "max", 0xfb, "{ 'sve384': false }");
+    assert_sve_vls(qts, "max", 0xff, "{ 'sve256': true }");
+    assert_error(qts, "max", "cannot disable sve256", "{ 'sve256': false }");
+
+    qtest_quit(qts);
+}
+
+static void sve_tests_sve_off(const void *data)
+{
+    QTestState *qts;
+
+    qts = qtest_init(MACHINE "-cpu max,sve=off");
+
+    /* SVE is off, so the map should be empty. */
+    assert_sve_vls(qts, "max", 0, NULL);
+
+    /* The map stays empty even if we turn lengths off. */
+    assert_sve_vls(qts, "max", 0, "{ 'sve128': false }");
+
+    /* It's an error to enable lengths when SVE is off. */
+    assert_error(qts, "max", "cannot enable sve128", "{ 'sve128': true }");
+
+    /* With SVE re-enabled we should get all vector lengths enabled. */
+    assert_sve_vls(qts, "max", BIT_ULL(SVE_MAX_VQ) - 1, "{ 'sve': true }");
+
+    /* Or enable SVE with just specific vector lengths. */
+    assert_sve_vls(qts, "max", 0x3,
+                   "{ 'sve': true, 'sve128': true, 'sve256': true }");
+
+    qtest_quit(qts);
+}
+
 static void test_query_cpu_model_expansion(const void *data)
 {
     QTestState *qts;
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
     if (g_str_equal(qtest_get_arch(), "aarch64")) {
         assert_has_feature(qts, "max", "aarch64");
         assert_has_feature(qts, "max", "sve");
+        assert_has_feature(qts, "max", "sve128");
         assert_has_feature(qts, "cortex-a57", "pmu");
         assert_has_feature(qts, "cortex-a57", "aarch64");
 
+        sve_tests_default(qts, "max");
+
         /* Test that features that depend on KVM generate errors without. */
         assert_error(qts, "max",
                      "'aarch64' feature cannot be disabled "
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     qtest_add_data_func("/arm/kvm/query-cpu-model-expansion",
                         NULL, test_query_cpu_model_expansion_kvm);
 
+    if (g_str_equal(qtest_get_arch(), "aarch64")) {
+        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-max-vq-8",
+                            NULL, sve_tests_sve_max_vq_8);
+        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
+                            NULL, sve_tests_sve_off);
+    }
+
     return g_test_run();
 }
diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/arm-cpu-features.rst
+++ b/docs/arm-cpu-features.rst
@@ -XXX,XX +XXX,XX @@ block in the script for usage) is used to issue the QMP commands.
       (QEMU) query-cpu-model-expansion type=full model={"name":"max"}
       { "return": {
         "model": { "name": "max", "props": {
-        "pmu": true, "aarch64": true
+        "sve1664": true, "pmu": true, "sve1792": true, "sve1920": true,
+        "sve128": true, "aarch64": true, "sve1024": true, "sve": true,
+        "sve640": true, "sve768": true, "sve1408": true, "sve256": true,
+        "sve1152": true, "sve512": true, "sve384": true, "sve1536": true,
+        "sve896": true, "sve1280": true, "sve2048": true
       }}}}
 
-We see that the `max` CPU type has the `pmu` and `aarch64` CPU features.
-We also see that the CPU features are enabled, as they are all `true`.
+We see that the `max` CPU type has the `pmu`, `aarch64`, `sve`, and many
+`sve<N>` CPU features.  We also see that all the CPU features are
+enabled, as they are all `true`.  (The `sve<N>` CPU features are all
+optional SVE vector lengths (see "SVE CPU Properties").  While with TCG
+all SVE vector lengths can be supported, when KVM is in use it's more
+likely that only a few lengths will be supported, if SVE is supported at
+all.)
 
 (2) Let's try to disable the PMU::
 
       (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"pmu":false}}
       { "return": {
         "model": { "name": "max", "props": {
-        "pmu": false, "aarch64": true
+        "sve1664": true, "pmu": false, "sve1792": true, "sve1920": true,
+        "sve128": true, "aarch64": true, "sve1024": true, "sve": true,
+        "sve640": true, "sve768": true, "sve1408": true, "sve256": true,
+        "sve1152": true, "sve512": true, "sve384": true, "sve1536": true,
+        "sve896": true, "sve1280": true, "sve2048": true
       }}}}
 
 We see it worked, as `pmu` is now `false`.
@@ -XXX,XX +XXX,XX @@ We see it worked, as `pmu` is now `false`.
 It looks like this feature is limited to a configuration we do not
 currently have.
 
-(4) Let's try probing CPU features for the Cortex-A15 CPU type::
+(4) Let's disable `sve` and see what happens to all the optional SVE
+    vector lengths::
+
+      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"sve":false}}
+      { "return": {
+        "model": { "name": "max", "props": {
+        "sve1664": false, "pmu": true, "sve1792": false, "sve1920": false,
+        "sve128": false, "aarch64": true, "sve1024": false, "sve": false,
+        "sve640": false, "sve768": false, "sve1408": false, "sve256": false,
+        "sve1152": false, "sve512": false, "sve384": false, "sve1536": false,
+        "sve896": false, "sve1280": false, "sve2048": false
+      }}}}
+
+As expected they are now all `false`.
+
+(5) Let's try probing CPU features for the Cortex-A15 CPU type::
 
       (QEMU) query-cpu-model-expansion type=full model={"name":"cortex-a15"}
       {"return": {"model": {"name": "cortex-a15", "props": {"pmu": true}}}}
@@ -XXX,XX +XXX,XX @@ After determining which CPU features are available and supported for a
 given CPU type, then they may be selectively enabled or disabled on the
 QEMU command line with that CPU type::
 
-  $ qemu-system-aarch64 -M virt -cpu max,pmu=off
+  $ qemu-system-aarch64 -M virt -cpu max,pmu=off,sve=on,sve128=on,sve256=on
 
-The example above disables the PMU for the `max` CPU type.
+The example above disables the PMU and enables the first two SVE vector
+lengths for the `max` CPU type.  Note, the `sve=on` isn't actually
+necessary, because, as we observed above with our probe of the `max` CPU
+type, `sve` is already on by default.  Also, based on our probe of
+defaults, it would seem we need to disable many SVE vector lengths, rather
+than only enabling the two we want.  This isn't the case, because, as
+disabling many SVE vector lengths would be quite verbose, the `sve<N>` CPU
+properties have special semantics (see "SVE CPU Property Parsing
+Semantics").
+
+SVE CPU Properties
+==================
+
+There are two types of SVE CPU properties: `sve` and `sve<N>`.  The first
+is used to enable or disable the entire SVE feature, just as the `pmu`
+CPU property completely enables or disables the PMU.  The second type
+is used to enable or disable specific vector lengths, where `N` is the
+number of bits of the length.  The `sve<N>` CPU properties have special
+dependencies and constraints, see "SVE CPU Property Dependencies and
+Constraints" below.  Additionally, as we want all supported vector lengths
+to be enabled by default, then, in order to avoid overly verbose command
+lines (command lines full of `sve<N>=off`, for all `N` not wanted), we
+provide the parsing semantics listed in "SVE CPU Property Parsing
+Semantics".
+
+SVE CPU Property Dependencies and Constraints
+---------------------------------------------
+
+  1) At least one vector length must be enabled when `sve` is enabled.
+
+  2) If a vector length `N` is enabled, then all power-of-two vector
+     lengths smaller than `N` must also be enabled.  E.g. if `sve512`
+     is enabled, then the 128-bit and 256-bit vector lengths must also
+     be enabled.
+
+SVE CPU Property Parsing Semantics
+----------------------------------
+
+  1) If SVE is disabled (`sve=off`), then which SVE vector lengths
+     are enabled or disabled is irrelevant to the guest, as the entire
+     SVE feature is disabled and that disables all vector lengths for
+     the guest.  However QEMU will still track any `sve<N>` CPU
+     properties provided by the user.  If later an `sve=on` is provided,
+     then the guest will get only the enabled lengths.  If no `sve=on`
+     is provided and there are explicitly enabled vector lengths, then
+     an error is generated.
+
+  2) If SVE is enabled (`sve=on`), but no `sve<N>` CPU properties are
+     provided, then all supported vector lengths are enabled, including
+     the non-power-of-two lengths.
+
+  3) If SVE is enabled, then an error is generated when attempting to
+     disable the last enabled vector length (see constraint (1) of "SVE
+     CPU Property Dependencies and Constraints").
+
+  4) If one or more vector lengths have been explicitly enabled and at
+     at least one of the dependency lengths of the maximum enabled length
+     has been explicitly disabled, then an error is generated (see
+     constraint (2) of "SVE CPU Property Dependencies and Constraints").
+
+  5) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
+     CPU properties are set `on`, then the specified vector lengths are
+     disabled but the default for any unspecified lengths remains enabled.
+     Disabling a power-of-two vector length also disables all vector
+     lengths larger than the power-of-two length (see constraint (2) of
+     "SVE CPU Property Dependencies and Constraints").
+
+  6) If one or more `sve<N>` CPU properties are set to `on`, then they
+     are enabled and all unspecified lengths default to disabled, except
+     for the required lengths per constraint (2) of "SVE CPU Property
+     Dependencies and Constraints", which will even be auto-enabled if
+     they were not explicitly enabled.
+
+  7) If SVE was disabled (`sve=off`), allowing all vector lengths to be
+     explicitly disabled (i.e. avoiding the error specified in (3) of
+     "SVE CPU Property Parsing Semantics"), then if later an `sve=on` is
+     provided an error will be generated.  To avoid this error, one must
+     enable at least one vector length prior to enabling SVE.
+
+SVE CPU Property Examples
+-------------------------
+
+  1) Disable SVE::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve=off
+
+  2) Implicitly enable all vector lengths for the `max` CPU type::
+
+     $ qemu-system-aarch64 -M virt -cpu max
+
+  3) Only enable the 128-bit vector length::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve128=on
+
+  4) Disable the 512-bit vector length and all larger vector lengths,
+     since 512 is a power-of-two.  This results in all the smaller,
+     uninitialized lengths (128, 256, and 384) defaulting to enabled::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve512=off
+
+  5) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve128=on,sve256=on,sve512=on
+
+  6) The same as (5), but since the 128-bit and 256-bit vector
+     lengths are required for the 512-bit vector length to be enabled,
+     then allow them to be auto-enabled::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve512=on
+
+  7) Do the same as (6), but by first disabling SVE and then re-enabling it::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve512=on,sve=on
+
+  8) Force errors regarding the last vector length::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve128=off
+     $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve128=off,sve=on
+
+SVE CPU Property Recommendations
+--------------------------------
+
+The examples in "SVE CPU Property Examples" exhibit many ways to select
+vector lengths which developers may find useful in order to avoid overly
+verbose command lines.  However, the recommended way to select vector
+lengths is to explicitly enable each desired length.  Therefore only
+example's (1), (3), and (5) exhibit recommended uses of the properties.
 
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

These are the SVE equivalents to kvm_arch_get/put_fpsimd. Note, the
swabbing is different than it is for fpsmid because the vector format
is a little-endian stream of words.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Message-id: 20191031142734.8590-6-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 185 ++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 156 insertions(+), 29 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_destroy_vcpu(CPUState *cs)
 bool kvm_arm_reg_syncs_via_cpreg_list(uint64_t regidx)
 {
     /* Return true if the regidx is a register we should synchronize
-     * via the cpreg_tuples array (ie is not a core reg we sync by
-     * hand in kvm_arch_get/put_registers())
+     * via the cpreg_tuples array (ie is not a core or sve reg that
+     * we sync by hand in kvm_arch_get/put_registers())
      */
     switch (regidx & KVM_REG_ARM_COPROC_MASK) {
     case KVM_REG_ARM_CORE:
+    case KVM_REG_ARM64_SVE:
         return false;
     default:
         return true;
@@ -XXX,XX +XXX,XX @@ int kvm_arm_cpreg_level(uint64_t regidx)
 
 static int kvm_arch_put_fpsimd(CPUState *cs)
 {
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
+    CPUARMState *env = &ARM_CPU(cs)->env;
     struct kvm_one_reg reg;
-    uint32_t fpr;
     int i, ret;
 
     for (i = 0; i < 32; i++) {
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_fpsimd(CPUState *cs)
         }
     }
 
-    reg.addr = (uintptr_t)(&fpr);
-    fpr = vfp_get_fpsr(env);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-    if (ret) {
-        return ret;
+    return 0;
+}
+
+/*
+ * SVE registers are encoded in KVM's memory in an endianness-invariant format.
+ * The byte at offset i from the start of the in-memory representation contains
+ * the bits [(7 + 8 * i) : (8 * i)] of the register value. As this means the
+ * lowest offsets are stored in the lowest memory addresses, then that nearly
+ * matches QEMU's representation, which is to use an array of host-endian
+ * uint64_t's, where the lower offsets are at the lower indices. To complete
+ * the translation we just need to byte swap the uint64_t's on big-endian hosts.
+ */
+static uint64_t *sve_bswap64(uint64_t *dst, uint64_t *src, int nr)
+{
+#ifdef HOST_WORDS_BIGENDIAN
+    int i;
+
+    for (i = 0; i < nr; ++i) {
+        dst[i] = bswap64(src[i]);
     }
 
-    reg.addr = (uintptr_t)(&fpr);
-    fpr = vfp_get_fpcr(env);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
+    return dst;
+#else
+    return src;
+#endif
+}
+
+/*
+ * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
+ * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
+ * code the slice index to zero for now as it's unlikely we'll need more than
+ * one slice for quite some time.
+ */
+static int kvm_arch_put_sve(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    uint64_t tmp[ARM_MAX_VQ * 2];
+    uint64_t *r;
+    struct kvm_one_reg reg;
+    int n, ret;
+
+    for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
+        r = sve_bswap64(tmp, &env->vfp.zregs[n].d[0], cpu->sve_max_vq * 2);
+        reg.addr = (uintptr_t)r;
+        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
+        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+        if (ret) {
+            return ret;
+        }
+    }
+
+    for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
+        r = sve_bswap64(tmp, r = &env->vfp.pregs[n].p[0],
+                        DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
+        reg.addr = (uintptr_t)r;
+        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
+        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+        if (ret) {
+            return ret;
+        }
+    }
+
+    r = sve_bswap64(tmp, &env->vfp.pregs[FFR_PRED_NUM].p[0],
+                    DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
+    reg.addr = (uintptr_t)r;
+    reg.id = KVM_REG_ARM64_SVE_FFR(0);
     ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
     if (ret) {
         return ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
 {
     struct kvm_one_reg reg;
     uint64_t val;
+    uint32_t fpr;
     int i, ret;
     unsigned int el;
 
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         }
     }
 
-    ret = kvm_arch_put_fpsimd(cs);
+    if (cpu_isar_feature(aa64_sve, cpu)) {
+        ret = kvm_arch_put_sve(cs);
+    } else {
+        ret = kvm_arch_put_fpsimd(cs);
+    }
+    if (ret) {
+        return ret;
+    }
+
+    reg.addr = (uintptr_t)(&fpr);
+    fpr = vfp_get_fpsr(env);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
+    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    if (ret) {
+        return ret;
+    }
+
+    reg.addr = (uintptr_t)(&fpr);
+    fpr = vfp_get_fpcr(env);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
+    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
     if (ret) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
 
 static int kvm_arch_get_fpsimd(CPUState *cs)
 {
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
+    CPUARMState *env = &ARM_CPU(cs)->env;
     struct kvm_one_reg reg;
-    uint32_t fpr;
     int i, ret;
 
     for (i = 0; i < 32; i++) {
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_fpsimd(CPUState *cs)
         }
     }
 
-    reg.addr = (uintptr_t)(&fpr);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-    if (ret) {
-        return ret;
-    }
-    vfp_set_fpsr(env, fpr);
+    return 0;
+}
 
-    reg.addr = (uintptr_t)(&fpr);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
+/*
+ * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
+ * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
+ * code the slice index to zero for now as it's unlikely we'll need more than
+ * one slice for quite some time.
+ */
+static int kvm_arch_get_sve(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    uint64_t *r;
+    int n, ret;
+
+    for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
+        r = &env->vfp.zregs[n].d[0];
+        reg.addr = (uintptr_t)r;
+        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
+        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+        if (ret) {
+            return ret;
+        }
+        sve_bswap64(r, r, cpu->sve_max_vq * 2);
+    }
+
+    for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
+        r = &env->vfp.pregs[n].p[0];
+        reg.addr = (uintptr_t)r;
+        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
+        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+        if (ret) {
+            return ret;
+        }
+        sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
+    }
+
+    r = &env->vfp.pregs[FFR_PRED_NUM].p[0];
+    reg.addr = (uintptr_t)r;
+    reg.id = KVM_REG_ARM64_SVE_FFR(0);
     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
     if (ret) {
         return ret;
     }
-    vfp_set_fpcr(env, fpr);
+    sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
 
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
     struct kvm_one_reg reg;
     uint64_t val;
     unsigned int el;
+    uint32_t fpr;
     int i, ret;
 
     ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
         env->spsr = env->banked_spsr[i];
     }
 
-    ret = kvm_arch_get_fpsimd(cs);
+    if (cpu_isar_feature(aa64_sve, cpu)) {
+        ret = kvm_arch_get_sve(cs);
+    } else {
+        ret = kvm_arch_get_fpsimd(cs);
+    }
     if (ret) {
         return ret;
     }
 
+    reg.addr = (uintptr_t)(&fpr);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
+    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    if (ret) {
+        return ret;
+    }
+    vfp_set_fpsr(env, fpr);
+
+    reg.addr = (uintptr_t)(&fpr);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
+    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    if (ret) {
+        return ret;
+    }
+    vfp_set_fpcr(env, fpr);
+
     ret = kvm_get_vcpu_events(cpu);
     if (ret) {
         return ret;
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Enable SVE in the KVM guest when the 'max' cpu type is configured
and KVM supports it. KVM SVE requires use of the new finalize
vcpu ioctl, so we add that now too. For starters SVE can only be
turned on or off, getting all vector lengths the host CPU supports
when on. We'll add the other SVE CPU properties in later patches.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
Message-id: 20191031142734.8590-7-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h     | 27 +++++++++++++++++++++++++++
 target/arm/cpu64.c       | 17 ++++++++++++++---
 target/arm/kvm.c         |  5 +++++
 target/arm/kvm64.c       | 20 +++++++++++++++++++-
 tests/arm-cpu-features.c |  4 ++++
 5 files changed, 69 insertions(+), 4 deletions(-)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@
  */
 int kvm_arm_vcpu_init(CPUState *cs);
 
+/**
+ * kvm_arm_vcpu_finalize
+ * @cs: CPUState
+ * @feature: int
+ *
+ * Finalizes the configuration of the specified VCPU feature by
+ * invoking the KVM_ARM_VCPU_FINALIZE ioctl. Features requiring
+ * this are documented in the "KVM_ARM_VCPU_FINALIZE" section of
+ * KVM's API documentation.
+ *
+ * Returns: 0 if success else < 0 error code
+ */
+int kvm_arm_vcpu_finalize(CPUState *cs, int feature);
+
 /**
  * kvm_arm_register_device:
  * @mr: memory region for this device
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_aarch32_supported(CPUState *cs);
  */
 bool kvm_arm_pmu_supported(CPUState *cs);
 
+/**
+ * bool kvm_arm_sve_supported:
+ * @cs: CPUState
+ *
+ * Returns true if the KVM VCPU can enable SVE and false otherwise.
+ */
+bool kvm_arm_sve_supported(CPUState *cs);
+
 /**
  * kvm_arm_get_max_vm_ipa_size - Returns the number of bits in the
  * IPA address space supported by KVM
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_pmu_supported(CPUState *cs)
     return false;
 }
 
+static inline bool kvm_arm_sve_supported(CPUState *cs)
+{
+    return false;
+}
+
 static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
 {
     return -ENOENT;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
         return;
     }
 
+    if (value && kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
+        error_setg(errp, "'sve' feature not supported by KVM on this host");
+        return;
+    }
+
     t = cpu->isar.id_aa64pfr0;
     t = FIELD_DP64(t, ID_AA64PFR0, SVE, value);
     cpu->isar.id_aa64pfr0 = t;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
     uint32_t vq;
+    uint64_t t;
 
     if (kvm_enabled()) {
         kvm_arm_set_cpu_features_from_host(cpu);
+        if (kvm_arm_sve_supported(CPU(cpu))) {
+            t = cpu->isar.id_aa64pfr0;
+            t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
+            cpu->isar.id_aa64pfr0 = t;
+        }
     } else {
-        uint64_t t;
         uint32_t u;
         aarch64_a57_initfn(obj);
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 
         object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                             cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
-        object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
-                            cpu_arm_set_sve, NULL, NULL, &error_fatal);
 
         for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
             char name[8];
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
                                 cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
         }
     }
+
+    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
+                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
 }
 
 struct ARMCPUInfo {
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vcpu_init(CPUState *cs)
     return kvm_vcpu_ioctl(cs, KVM_ARM_VCPU_INIT, &init);
 }
 
+int kvm_arm_vcpu_finalize(CPUState *cs, int feature)
+{
+    return kvm_vcpu_ioctl(cs, KVM_ARM_VCPU_FINALIZE, &feature);
+}
+
 void kvm_arm_init_serror_injection(CPUState *cs)
 {
     cap_has_inject_serror_esr = kvm_check_extension(cs->kvm_state,
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_aarch32_supported(CPUState *cpu)
     return kvm_check_extension(s, KVM_CAP_ARM_EL1_32BIT);
 }
 
+bool kvm_arm_sve_supported(CPUState *cpu)
+{
+    KVMState *s = KVM_STATE(current_machine->accelerator);
+
+    return kvm_check_extension(s, KVM_CAP_ARM_SVE);
+}
+
 #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
 
 int kvm_arch_init_vcpu(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_EL1_32BIT;
     }
     if (!kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PMU_V3)) {
-            cpu->has_pmu = false;
+        cpu->has_pmu = false;
     }
     if (cpu->has_pmu) {
         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PMU_V3;
     } else {
         unset_feature(&env->features, ARM_FEATURE_PMU);
     }
+    if (cpu_isar_feature(aa64_sve, cpu)) {
+        assert(kvm_arm_sve_supported(cs));
+        cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_SVE;
+    }
 
     /* Do KVM_ARM_VCPU_INIT ioctl */
     ret = kvm_arm_vcpu_init(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
         return ret;
     }
 
+    if (cpu_isar_feature(aa64_sve, cpu)) {
+        ret = kvm_arm_vcpu_finalize(cs, KVM_ARM_VCPU_SVE);
+        if (ret) {
+            return ret;
+        }
+    }
+
     /*
      * When KVM is in use, PSCI is emulated in-kernel and not by qemu.
      * Currently KVM has its own idea about MPIDR assignment, so we
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/arm-cpu-features.c
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
         assert_has_feature(qts, "host", "aarch64");
         assert_has_feature(qts, "host", "pmu");
 
+        assert_has_feature(qts, "max", "sve");
+
         assert_error(qts, "cortex-a15",
             "We cannot guarantee the CPU type 'cortex-a15' works "
             "with KVM on this host", NULL);
     } else {
         assert_has_not_feature(qts, "host", "aarch64");
         assert_has_not_feature(qts, "host", "pmu");
+
+        assert_has_not_feature(qts, "max", "sve");
     }
 
     qtest_quit(qts);
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

kvm_arm_create_scratch_host_vcpu() takes a struct kvm_vcpu_init
parameter. Rather than just using it as an output parameter to
pass back the preferred target, use it also as an input parameter,
allowing a caller to pass a selected target if they wish and to
also pass cpu features. If the caller doesn't want to select a
target they can pass -1 for the target which indicates they want
to use the preferred target and have it passed back like before.

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
                                       int *fdarray,
                                       struct kvm_vcpu_init *init)
 {
-    int ret, kvmfd = -1, vmfd = -1, cpufd = -1;
+    int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
 
     kvmfd = qemu_open("/dev/kvm", O_RDWR);
     if (kvmfd < 0) {
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
         goto finish;
     }
 
-    ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, init);
+    if (init->target == -1) {
+        struct kvm_vcpu_init preferred;
+
+        ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, &preferred);
+        if (!ret) {
+            init->target = preferred.target;
+        }
+    }
     if (ret >= 0) {
         ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
         if (ret < 0) {
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
          * creating one kind of guest CPU which is its preferred
          * CPU type.
          */
+        struct kvm_vcpu_init try;
+
         while (*cpus_to_try != QEMU_KVM_ARM_TARGET_NONE) {
-            init->target = *cpus_to_try++;
-            memset(init->features, 0, sizeof(init->features));
-            ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
+            try.target = *cpus_to_try++;
+            memcpy(try.features, init->features, sizeof(init->features));
+            ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, &try);
             if (ret >= 0) {
                 break;
             }
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
         if (ret < 0) {
             goto err;
         }
+        init->target = try.target;
     } else {
         /* Treat a NULL cpus_to_try argument the same as an empty
          * list, which means we will fail the call since this must
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         QEMU_KVM_ARM_TARGET_CORTEX_A15,
         QEMU_KVM_ARM_TARGET_NONE
     };
-    struct kvm_vcpu_init init;
+    /*
+     * target = -1 informs kvm_arm_create_scratch_host_vcpu()
+     * to use the preferred target
+     */
+    struct kvm_vcpu_init init = { .target = -1, };
 
     if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
         return false;
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         KVM_ARM_TARGET_CORTEX_A57,
         QEMU_KVM_ARM_TARGET_NONE
     };
-    struct kvm_vcpu_init init;
+    /*
+     * target = -1 informs kvm_arm_create_scratch_host_vcpu()
+     * to use the preferred target
+     */
+    struct kvm_vcpu_init init = { .target = -1, };
 
     if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
         return false;
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Extend the SVE vq map initialization and validation with KVM's
supported vector lengths when KVM is enabled. In order to determine
and select supported lengths we add two new KVM functions for getting
and setting the KVM_REG_ARM64_SVE_VLS pseudo-register.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Message-id: 20191031142734.8590-9-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h      |  12 +++
 target/arm/cpu64.c        | 176 ++++++++++++++++++++++++++++----------
 target/arm/kvm64.c        | 100 +++++++++++++++++++++-
 tests/arm-cpu-features.c  | 104 +++++++++++++++++++++-
 docs/arm-cpu-features.rst |  45 +++++++---
 5 files changed, 379 insertions(+), 58 deletions(-)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMHostCPUFeatures {
  */
 bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf);
 
+/**
+ * kvm_arm_sve_get_vls:
+ * @cs: CPUState
+ * @map: bitmap to fill in
+ *
+ * Get all the SVE vector lengths supported by the KVM host, setting
+ * the bits corresponding to their length in quadwords minus one
+ * (vq - 1) in @map up to ARM_MAX_VQ.
+ */
+void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map);
+
 /**
  * kvm_arm_set_cpu_features_from_host:
  * @cpu: ARMCPU to set the features for
@@ -XXX,XX +XXX,XX @@ static inline int kvm_arm_vgic_probe(void)
 static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq) {}
 static inline void kvm_arm_pmu_init(CPUState *cs) {}
 
+static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map) {}
 #endif
 
 static inline const char *gic_class_name(void)
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
      * any of the above.  Finally, if SVE is not disabled, then at least one
      * vector length must be enabled.
      */
+    DECLARE_BITMAP(kvm_supported, ARM_MAX_VQ);
     DECLARE_BITMAP(tmp, ARM_MAX_VQ);
     uint32_t vq, max_vq = 0;
 
+    /* Collect the set of vector lengths supported by KVM. */
+    bitmap_zero(kvm_supported, ARM_MAX_VQ);
+    if (kvm_enabled() && kvm_arm_sve_supported(CPU(cpu))) {
+        kvm_arm_sve_get_vls(CPU(cpu), kvm_supported);
+    } else if (kvm_enabled()) {
+        assert(!cpu_isar_feature(aa64_sve, cpu));
+    }
+
     /*
      * Process explicit sve<N> properties.
      * From the properties, sve_vq_map<N> implies sve_vq_init<N>.
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
             return;
         }
 
-        /* Propagate enabled bits down through required powers-of-two. */
-        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
-            if (!test_bit(vq - 1, cpu->sve_vq_init)) {
-                set_bit(vq - 1, cpu->sve_vq_map);
+        if (kvm_enabled()) {
+            /*
+             * For KVM we have to automatically enable all supported unitialized
+             * lengths, even when the smaller lengths are not all powers-of-two.
+             */
+            bitmap_andnot(tmp, kvm_supported, cpu->sve_vq_init, max_vq);
+            bitmap_or(cpu->sve_vq_map, cpu->sve_vq_map, tmp, max_vq);
+        } else {
+            /* Propagate enabled bits down through required powers-of-two. */
+            for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
+                if (!test_bit(vq - 1, cpu->sve_vq_init)) {
+                    set_bit(vq - 1, cpu->sve_vq_map);
+                }
             }
         }
     } else if (cpu->sve_max_vq == 0) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
             return;
         }
 
-        /* Disabling a power-of-two disables all larger lengths. */
-        if (test_bit(0, cpu->sve_vq_init)) {
-            error_setg(errp, "cannot disable sve128");
-            error_append_hint(errp, "Disabling sve128 results in all vector "
-                              "lengths being disabled.\n");
-            error_append_hint(errp, "With SVE enabled, at least one vector "
-                              "length must be enabled.\n");
-            return;
-        }
-        for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
-            if (test_bit(vq - 1, cpu->sve_vq_init)) {
-                break;
+        if (kvm_enabled()) {
+            /* Disabling a supported length disables all larger lengths. */
+            for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
+                if (test_bit(vq - 1, cpu->sve_vq_init) &&
+                    test_bit(vq - 1, kvm_supported)) {
+                    break;
+                }
             }
+            max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
+            bitmap_andnot(cpu->sve_vq_map, kvm_supported,
+                          cpu->sve_vq_init, max_vq);
+            if (max_vq == 0 || bitmap_empty(cpu->sve_vq_map, max_vq)) {
+                error_setg(errp, "cannot disable sve%d", vq * 128);
+                error_append_hint(errp, "Disabling sve%d results in all "
+                                  "vector lengths being disabled.\n",
+                                  vq * 128);
+                error_append_hint(errp, "With SVE enabled, at least one "
+                                  "vector length must be enabled.\n");
+                return;
+            }
+        } else {
+            /* Disabling a power-of-two disables all larger lengths. */
+            if (test_bit(0, cpu->sve_vq_init)) {
+                error_setg(errp, "cannot disable sve128");
+                error_append_hint(errp, "Disabling sve128 results in all "
+                                  "vector lengths being disabled.\n");
+                error_append_hint(errp, "With SVE enabled, at least one "
+                                  "vector length must be enabled.\n");
+                return;
+            }
+            for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
+                if (test_bit(vq - 1, cpu->sve_vq_init)) {
+                    break;
+                }
+            }
+            max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
+            bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
         }
-        max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
 
-        bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
         max_vq = find_last_bit(cpu->sve_vq_map, max_vq) + 1;
     }
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
     assert(max_vq != 0);
     bitmap_clear(cpu->sve_vq_map, max_vq, ARM_MAX_VQ - max_vq);
 
-    /* Ensure all required powers-of-two are enabled. */
-    for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
-        if (!test_bit(vq - 1, cpu->sve_vq_map)) {
-            error_setg(errp, "cannot disable sve%d", vq * 128);
-            error_append_hint(errp, "sve%d is required as it "
-                              "is a power-of-two length smaller than "
-                              "the maximum, sve%d\n",
-                              vq * 128, max_vq * 128);
+    if (kvm_enabled()) {
+        /* Ensure the set of lengths matches what KVM supports. */
+        bitmap_xor(tmp, cpu->sve_vq_map, kvm_supported, max_vq);
+        if (!bitmap_empty(tmp, max_vq)) {
+            vq = find_last_bit(tmp, max_vq) + 1;
+            if (test_bit(vq - 1, cpu->sve_vq_map)) {
+                if (cpu->sve_max_vq) {
+                    error_setg(errp, "cannot set sve-max-vq=%d",
+                               cpu->sve_max_vq);
+                    error_append_hint(errp, "This KVM host does not support "
+                                      "the vector length %d-bits.\n",
+                                      vq * 128);
+                    error_append_hint(errp, "It may not be possible to use "
+                                      "sve-max-vq with this KVM host. Try "
+                                      "using only sve<N> properties.\n");
+                } else {
+                    error_setg(errp, "cannot enable sve%d", vq * 128);
+                    error_append_hint(errp, "This KVM host does not support "
+                                      "the vector length %d-bits.\n",
+                                      vq * 128);
+                }
+            } else {
+                error_setg(errp, "cannot disable sve%d", vq * 128);
+                error_append_hint(errp, "The KVM host requires all "
+                                  "supported vector lengths smaller "
+                                  "than %d bits to also be enabled.\n",
+                                  max_vq * 128);
+            }
             return;
         }
+    } else {
+        /* Ensure all required powers-of-two are enabled. */
+        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
+            if (!test_bit(vq - 1, cpu->sve_vq_map)) {
+                error_setg(errp, "cannot disable sve%d", vq * 128);
+                error_append_hint(errp, "sve%d is required as it "
+                                  "is a power-of-two length smaller than "
+                                  "the maximum, sve%d\n",
+                                  vq * 128, max_vq * 128);
+                return;
+            }
+        }
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
 {
     ARMCPU *cpu = ARM_CPU(obj);
     Error *err = NULL;
+    uint32_t max_vq;
 
-    visit_type_uint32(v, name, &cpu->sve_max_vq, &err);
-
-    if (!err && (cpu->sve_max_vq == 0 || cpu->sve_max_vq > ARM_MAX_VQ)) {
-        error_setg(&err, "unsupported SVE vector length");
-        error_append_hint(&err, "Valid sve-max-vq in range [1-%d]\n",
-                          ARM_MAX_VQ);
+    visit_type_uint32(v, name, &max_vq, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
     }
-    error_propagate(errp, err);
+
+    if (kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
+        error_setg(errp, "cannot set sve-max-vq");
+        error_append_hint(errp, "SVE not supported by KVM on this host\n");
+        return;
+    }
+
+    if (max_vq == 0 || max_vq > ARM_MAX_VQ) {
+        error_setg(errp, "unsupported SVE vector length");
+        error_append_hint(errp, "Valid sve-max-vq in range [1-%d]\n",
+                          ARM_MAX_VQ);
+        return;
+    }
+
+    cpu->sve_max_vq = max_vq;
 }
 
 static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
         return;
     }
 
+    if (value && kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
+        error_setg(errp, "cannot enable %s", name);
+        error_append_hint(errp, "SVE not supported by KVM on this host\n");
+        return;
+    }
+
     if (value) {
         set_bit(vq - 1, cpu->sve_vq_map);
     } else {
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
         cpu->dcz_blocksize = 7; /*  512 bytes */
 #endif
-
-        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
-                            cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
-
-        for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
-            char name[8];
-            sprintf(name, "sve%d", vq * 128);
-            object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
-                                cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
-        }
     }
 
     object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
                         cpu_arm_set_sve, NULL, NULL, &error_fatal);
+    object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
+                        cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
+
+    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
+        char name[8];
+        sprintf(name, "sve%d", vq * 128);
+        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
+                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
+    }
 }
 
 struct ARMCPUInfo {
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_sve_supported(CPUState *cpu)
     return kvm_check_extension(s, KVM_CAP_ARM_SVE);
 }
 
+QEMU_BUILD_BUG_ON(KVM_ARM64_SVE_VQ_MIN != 1);
+
+void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
+{
+    /* Only call this function if kvm_arm_sve_supported() returns true. */
+    static uint64_t vls[KVM_ARM64_SVE_VLS_WORDS];
+    static bool probed;
+    uint32_t vq = 0;
+    int i, j;
+
+    bitmap_clear(map, 0, ARM_MAX_VQ);
+
+    /*
+     * KVM ensures all host CPUs support the same set of vector lengths.
+     * So we only need to create the scratch VCPUs once and then cache
+     * the results.
+     */
+    if (!probed) {
+        struct kvm_vcpu_init init = {
+            .target = -1,
+            .features[0] = (1 << KVM_ARM_VCPU_SVE),
+        };
+        struct kvm_one_reg reg = {
+            .id = KVM_REG_ARM64_SVE_VLS,
+            .addr = (uint64_t)&vls[0],
+        };
+        int fdarray[3], ret;
+
+        probed = true;
+
+        if (!kvm_arm_create_scratch_host_vcpu(NULL, fdarray, &init)) {
+            error_report("failed to create scratch VCPU with SVE enabled");
+            abort();
+        }
+        ret = ioctl(fdarray[2], KVM_GET_ONE_REG, &reg);
+        kvm_arm_destroy_scratch_host_vcpu(fdarray);
+        if (ret) {
+            error_report("failed to get KVM_REG_ARM64_SVE_VLS: %s",
+                         strerror(errno));
+            abort();
+        }
+
+        for (i = KVM_ARM64_SVE_VLS_WORDS - 1; i >= 0; --i) {
+            if (vls[i]) {
+                vq = 64 - clz64(vls[i]) + i * 64;
+                break;
+            }
+        }
+        if (vq > ARM_MAX_VQ) {
+            warn_report("KVM supports vector lengths larger than "
+                        "QEMU can enable");
+        }
+    }
+
+    for (i = 0; i < KVM_ARM64_SVE_VLS_WORDS; ++i) {
+        if (!vls[i]) {
+            continue;
+        }
+        for (j = 1; j <= 64; ++j) {
+            vq = j + i * 64;
+            if (vq > ARM_MAX_VQ) {
+                return;
+            }
+            if (vls[i] & (1UL << (j - 1))) {
+                set_bit(vq - 1, map);
+            }
+        }
+    }
+}
+
+static int kvm_arm_sve_set_vls(CPUState *cs)
+{
+    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = {0};
+    struct kvm_one_reg reg = {
+        .id = KVM_REG_ARM64_SVE_VLS,
+        .addr = (uint64_t)&vls[0],
+    };
+    ARMCPU *cpu = ARM_CPU(cs);
+    uint32_t vq;
+    int i, j;
+
+    assert(cpu->sve_max_vq <= KVM_ARM64_SVE_VQ_MAX);
+
+    for (vq = 1; vq <= cpu->sve_max_vq; ++vq) {
+        if (test_bit(vq - 1, cpu->sve_vq_map)) {
+            i = (vq - 1) / 64;
+            j = (vq - 1) % 64;
+            vls[i] |= 1UL << j;
+        }
+    }
+
+    return kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+}
+
 #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
 
 int kvm_arch_init_vcpu(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
 
     if (cpu->kvm_target == QEMU_KVM_ARM_TARGET_NONE ||
         !object_dynamic_cast(OBJECT(cpu), TYPE_AARCH64_CPU)) {
-        fprintf(stderr, "KVM is not supported for this guest CPU type\n");
+        error_report("KVM is not supported for this guest CPU type");
         return -EINVAL;
     }
 
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
     }
 
     if (cpu_isar_feature(aa64_sve, cpu)) {
+        ret = kvm_arm_sve_set_vls(cs);
+        if (ret) {
+            return ret;
+        }
         ret = kvm_arm_vcpu_finalize(cs, KVM_ARM_VCPU_SVE);
         if (ret) {
             return ret;
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/arm-cpu-features.c
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static QDict *resp_get_props(QDict *resp)
     return qdict;
 }
 
+static bool resp_get_feature(QDict *resp, const char *feature)
+{
+    QDict *props;
+
+    g_assert(resp);
+    g_assert(resp_has_props(resp));
+    props = resp_get_props(resp);
+    g_assert(qdict_get(props, feature));
+    return qdict_get_bool(props, feature);
+}
+
 #define assert_has_feature(qts, cpu_type, feature)                     \
 ({                                                                     \
     QDict *_resp = do_query_no_props(qts, cpu_type);                   \
@@ -XXX,XX +XXX,XX @@ static void sve_tests_sve_off(const void *data)
     qtest_quit(qts);
 }
 
+static void sve_tests_sve_off_kvm(const void *data)
+{
+    QTestState *qts;
+
+    qts = qtest_init(MACHINE_KVM "-cpu max,sve=off");
+
+    /*
+     * We don't know if this host supports SVE so we don't
+     * attempt to test enabling anything. We only test that
+     * everything is disabled (as it should be with sve=off)
+     * and that using sve<N>=off to explicitly disable vector
+     * lengths is OK too.
+     */
+    assert_sve_vls(qts, "max", 0, NULL);
+    assert_sve_vls(qts, "max", 0, "{ 'sve128': false }");
+
+    qtest_quit(qts);
+}
+
 static void test_query_cpu_model_expansion(const void *data)
 {
     QTestState *qts;
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
     }
 
     if (g_str_equal(qtest_get_arch(), "aarch64")) {
+        bool kvm_supports_sve;
+        char max_name[8], name[8];
+        uint32_t max_vq, vq;
+        uint64_t vls;
+        QDict *resp;
+        char *error;
+
         assert_has_feature(qts, "host", "aarch64");
         assert_has_feature(qts, "host", "pmu");
 
-        assert_has_feature(qts, "max", "sve");
-
         assert_error(qts, "cortex-a15",
             "We cannot guarantee the CPU type 'cortex-a15' works "
             "with KVM on this host", NULL);
+
+        assert_has_feature(qts, "max", "sve");
+        resp = do_query_no_props(qts, "max");
+        kvm_supports_sve = resp_get_feature(resp, "sve");
+        vls = resp_get_sve_vls(resp);
+        qobject_unref(resp);
+
+        if (kvm_supports_sve) {
+            g_assert(vls != 0);
+            max_vq = 64 - __builtin_clzll(vls);
+            sprintf(max_name, "sve%d", max_vq * 128);
+
+            /* Enabling a supported length is of course fine. */
+            assert_sve_vls(qts, "max", vls, "{ %s: true }", max_name);
+
+            /* Get the next supported length smaller than max-vq. */
+            vq = 64 - __builtin_clzll(vls & ~BIT_ULL(max_vq - 1));
+            if (vq) {
+                /*
+                 * We have at least one length smaller than max-vq,
+                 * so we can disable max-vq.
+                 */
+                assert_sve_vls(qts, "max", (vls & ~BIT_ULL(max_vq - 1)),
+                               "{ %s: false }", max_name);
+
+                /*
+                 * Smaller, supported vector lengths cannot be disabled
+                 * unless all larger, supported vector lengths are also
+                 * disabled.
+                 */
+                sprintf(name, "sve%d", vq * 128);
+                error = g_strdup_printf("cannot disable %s", name);
+                assert_error(qts, "max", error,
+                             "{ %s: true, %s: false }",
+                             max_name, name);
+                g_free(error);
+            }
+
+            /*
+             * The smallest, supported vector length is required, because
+             * we need at least one vector length enabled.
+             */
+            vq = __builtin_ffsll(vls);
+            sprintf(name, "sve%d", vq * 128);
+            error = g_strdup_printf("cannot disable %s", name);
+            assert_error(qts, "max", error, "{ %s: false }", name);
+            g_free(error);
+
+            /* Get an unsupported length. */
+            for (vq = 1; vq <= max_vq; ++vq) {
+                if (!(vls & BIT_ULL(vq - 1))) {
+                    break;
+                }
+            }
+            if (vq <= SVE_MAX_VQ) {
+                sprintf(name, "sve%d", vq * 128);
+                error = g_strdup_printf("cannot enable %s", name);
+                assert_error(qts, "max", error, "{ %s: true }", name);
+                g_free(error);
+            }
+        } else {
+            g_assert(vls == 0);
+        }
     } else {
         assert_has_not_feature(qts, "host", "aarch64");
         assert_has_not_feature(qts, "host", "pmu");
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
                             NULL, sve_tests_sve_max_vq_8);
         qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
                             NULL, sve_tests_sve_off);
+        qtest_add_data_func("/arm/kvm/query-cpu-model-expansion/sve-off",
+                            NULL, sve_tests_sve_off_kvm);
     }
 
     return g_test_run();
diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/arm-cpu-features.rst
+++ b/docs/arm-cpu-features.rst
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Dependencies and Constraints
 
   1) At least one vector length must be enabled when `sve` is enabled.
 
-  2) If a vector length `N` is enabled, then all power-of-two vector
-     lengths smaller than `N` must also be enabled.  E.g. if `sve512`
-     is enabled, then the 128-bit and 256-bit vector lengths must also
-     be enabled.
+  2) If a vector length `N` is enabled, then, when KVM is enabled, all
+     smaller, host supported vector lengths must also be enabled.  If
+     KVM is not enabled, then only all the smaller, power-of-two vector
+     lengths must be enabled.  E.g. with KVM if the host supports all
+     vector lengths up to 512-bits (128, 256, 384, 512), then if `sve512`
+     is enabled, the 128-bit vector length, 256-bit vector length, and
+     384-bit vector length must also be enabled. Without KVM, the 384-bit
+     vector length would not be required.
+
+  3) If KVM is enabled then only vector lengths that the host CPU type
+     support may be enabled.  If SVE is not supported by the host, then
+     no `sve*` properties may be enabled.
 
 SVE CPU Property Parsing Semantics
 ----------------------------------
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Parsing Semantics
      an error is generated.
 
   2) If SVE is enabled (`sve=on`), but no `sve<N>` CPU properties are
-     provided, then all supported vector lengths are enabled, including
-     the non-power-of-two lengths.
+     provided, then all supported vector lengths are enabled, which when
+     KVM is not in use means including the non-power-of-two lengths, and,
+     when KVM is in use, it means all vector lengths supported by the host
+     processor.
 
   3) If SVE is enabled, then an error is generated when attempting to
      disable the last enabled vector length (see constraint (1) of "SVE
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Parsing Semantics
      has been explicitly disabled, then an error is generated (see
      constraint (2) of "SVE CPU Property Dependencies and Constraints").
 
-  5) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
+  5) When KVM is enabled, if the host does not support SVE, then an error
+     is generated when attempting to enable any `sve*` properties (see
+     constraint (3) of "SVE CPU Property Dependencies and Constraints").
+
+  6) When KVM is enabled, if the host does support SVE, then an error is
+     generated when attempting to enable any vector lengths not supported
+     by the host (see constraint (3) of "SVE CPU Property Dependencies and
+     Constraints").
+
+  7) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
      CPU properties are set `on`, then the specified vector lengths are
      disabled but the default for any unspecified lengths remains enabled.
-     Disabling a power-of-two vector length also disables all vector
-     lengths larger than the power-of-two length (see constraint (2) of
-     "SVE CPU Property Dependencies and Constraints").
+     When KVM is not enabled, disabling a power-of-two vector length also
+     disables all vector lengths larger than the power-of-two length.
+     When KVM is enabled, then disabling any supported vector length also
+     disables all larger vector lengths (see constraint (2) of "SVE CPU
+     Property Dependencies and Constraints").
 
-  6) If one or more `sve<N>` CPU properties are set to `on`, then they
+  8) If one or more `sve<N>` CPU properties are set to `on`, then they
      are enabled and all unspecified lengths default to disabled, except
      for the required lengths per constraint (2) of "SVE CPU Property
      Dependencies and Constraints", which will even be auto-enabled if
      they were not explicitly enabled.
 
-  7) If SVE was disabled (`sve=off`), allowing all vector lengths to be
+  9) If SVE was disabled (`sve=off`), allowing all vector lengths to be
      explicitly disabled (i.e. avoiding the error specified in (3) of
      "SVE CPU Property Parsing Semantics"), then if later an `sve=on` is
      provided an error will be generated.  To avoid this error, one must
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Allow cpu 'host' to enable SVE when it's available, unless the
user chooses to disable it with the added 'sve=off' cpu property.
Also give the user the ability to select vector lengths with the
sve<N> properties. We don't adopt 'max' cpu's other sve property,
sve-max-vq, because that property is difficult to use with KVM.
That property assumes all vector lengths in the range from 1 up
to and including the specified maximum length are supported, but
there may be optional lengths not supported by the host in that
range. With KVM one must be more specific when enabling vector
lengths.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Message-id: 20191031142734.8590-10-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h          |  2 ++
 target/arm/cpu.c          |  3 +++
 target/arm/cpu64.c        | 33 +++++++++++++++++----------------
 target/arm/kvm64.c        | 14 +++++++++++++-
 tests/arm-cpu-features.c  | 17 ++++++++---------
 docs/arm-cpu-features.rst | 19 ++++++++++++-------
 6 files changed, 55 insertions(+), 33 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
 void aarch64_sve_change_el(CPUARMState *env, int old_el,
                            int new_el, bool el0_a64);
+void aarch64_add_sve_properties(Object *obj);
 #else
 static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
 static inline void aarch64_sve_change_el(CPUARMState *env, int o,
                                          int n, bool a)
 { }
+static inline void aarch64_add_sve_properties(Object *obj) { }
 #endif
 
 #if !defined(CONFIG_TCG)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_host_initfn(Object *obj)
     ARMCPU *cpu = ARM_CPU(obj);
 
     kvm_arm_set_cpu_features_from_host(cpu);
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        aarch64_add_sve_properties(obj);
+    }
     arm_cpu_post_init(obj);
 }
 
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
     cpu->isar.id_aa64pfr0 = t;
 }
 
+void aarch64_add_sve_properties(Object *obj)
+{
+    uint32_t vq;
+
+    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
+                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
+
+    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
+        char name[8];
+        sprintf(name, "sve%d", vq * 128);
+        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
+                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
+    }
+}
+
 /* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
  * otherwise, a CPU with as many features enabled as our emulation supports.
  * The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
 static void aarch64_max_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    uint32_t vq;
-    uint64_t t;
 
     if (kvm_enabled()) {
         kvm_arm_set_cpu_features_from_host(cpu);
-        if (kvm_arm_sve_supported(CPU(cpu))) {
-            t = cpu->isar.id_aa64pfr0;
-            t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-            cpu->isar.id_aa64pfr0 = t;
-        }
     } else {
+        uint64_t t;
         uint32_t u;
         aarch64_a57_initfn(obj);
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 #endif
     }
 
-    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
-                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
+    aarch64_add_sve_properties(obj);
     object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                         cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
-
-    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
-        char name[8];
-        sprintf(name, "sve%d", vq * 128);
-        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
-                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
-    }
 }
 
 struct ARMCPUInfo {
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * and then query that CPU for the relevant ID registers.
      */
     int fdarray[3];
+    bool sve_supported;
     uint64_t features = 0;
+    uint64_t t;
     int err;
 
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                               ARM64_SYS_REG(3, 0, 0, 3, 2));
     }
 
+    sve_supported = ioctl(fdarray[0], KVM_CHECK_EXTENSION, KVM_CAP_ARM_SVE) > 0;
+
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 
     if (err < 0) {
         return false;
     }
 
-   /* We can assume any KVM supporting CPU is at least a v8
+    /* Add feature bits that can't appear until after VCPU init. */
+    if (sve_supported) {
+        t = ahcf->isar.id_aa64pfr0;
+        t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
+        ahcf->isar.id_aa64pfr0 = t;
+    }
+
+    /*
+     * We can assume any KVM supporting CPU is at least a v8
      * with VFPv4+Neon; this in turn implies most of the other
      * feature bits.
      */
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/arm-cpu-features.c
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
             "We cannot guarantee the CPU type 'cortex-a15' works "
             "with KVM on this host", NULL);
 
-        assert_has_feature(qts, "max", "sve");
-        resp = do_query_no_props(qts, "max");
+        assert_has_feature(qts, "host", "sve");
+        resp = do_query_no_props(qts, "host");
         kvm_supports_sve = resp_get_feature(resp, "sve");
         vls = resp_get_sve_vls(resp);
         qobject_unref(resp);
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
             sprintf(max_name, "sve%d", max_vq * 128);
 
             /* Enabling a supported length is of course fine. */
-            assert_sve_vls(qts, "max", vls, "{ %s: true }", max_name);
+            assert_sve_vls(qts, "host", vls, "{ %s: true }", max_name);
 
             /* Get the next supported length smaller than max-vq. */
             vq = 64 - __builtin_clzll(vls & ~BIT_ULL(max_vq - 1));
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
                  * We have at least one length smaller than max-vq,
                  * so we can disable max-vq.
                  */
-                assert_sve_vls(qts, "max", (vls & ~BIT_ULL(max_vq - 1)),
+                assert_sve_vls(qts, "host", (vls & ~BIT_ULL(max_vq - 1)),
                                "{ %s: false }", max_name);
 
                 /*
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
                  */
                 sprintf(name, "sve%d", vq * 128);
                 error = g_strdup_printf("cannot disable %s", name);
-                assert_error(qts, "max", error,
+                assert_error(qts, "host", error,
                              "{ %s: true, %s: false }",
                              max_name, name);
                 g_free(error);
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
             vq = __builtin_ffsll(vls);
             sprintf(name, "sve%d", vq * 128);
             error = g_strdup_printf("cannot disable %s", name);
-            assert_error(qts, "max", error, "{ %s: false }", name);
+            assert_error(qts, "host", error, "{ %s: false }", name);
             g_free(error);
 
             /* Get an unsupported length. */
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
             if (vq <= SVE_MAX_VQ) {
                 sprintf(name, "sve%d", vq * 128);
                 error = g_strdup_printf("cannot enable %s", name);
-                assert_error(qts, "max", error, "{ %s: true }", name);
+                assert_error(qts, "host", error, "{ %s: true }", name);
                 g_free(error);
             }
         } else {
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
     } else {
         assert_has_not_feature(qts, "host", "aarch64");
         assert_has_not_feature(qts, "host", "pmu");
-
-        assert_has_not_feature(qts, "max", "sve");
+        assert_has_not_feature(qts, "host", "sve");
     }
 
     qtest_quit(qts);
diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/arm-cpu-features.rst
+++ b/docs/arm-cpu-features.rst
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Examples
 
      $ qemu-system-aarch64 -M virt -cpu max
 
-  3) Only enable the 128-bit vector length::
+  3) When KVM is enabled, implicitly enable all host CPU supported vector
+     lengths with the `host` CPU type::
+
+     $ qemu-system-aarch64 -M virt,accel=kvm -cpu host
+
+  4) Only enable the 128-bit vector length::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve128=on
 
-  4) Disable the 512-bit vector length and all larger vector lengths,
+  5) Disable the 512-bit vector length and all larger vector lengths,
      since 512 is a power-of-two.  This results in all the smaller,
      uninitialized lengths (128, 256, and 384) defaulting to enabled::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve512=off
 
-  5) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
+  6) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve128=on,sve256=on,sve512=on
 
-  6) The same as (5), but since the 128-bit and 256-bit vector
+  7) The same as (6), but since the 128-bit and 256-bit vector
      lengths are required for the 512-bit vector length to be enabled,
      then allow them to be auto-enabled::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve512=on
 
-  7) Do the same as (6), but by first disabling SVE and then re-enabling it::
+  8) Do the same as (7), but by first disabling SVE and then re-enabling it::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve512=on,sve=on
 
-  8) Force errors regarding the last vector length::
+  9) Force errors regarding the last vector length::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve128=off
      $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve128=off,sve=on
@@ -XXX,XX +XXX,XX @@ The examples in "SVE CPU Property Examples" exhibit many ways to select
 vector lengths which developers may find useful in order to avoid overly
 verbose command lines.  However, the recommended way to select vector
 lengths is to explicitly enable each desired length.  Therefore only
-example's (1), (3), and (5) exhibit recommended uses of the properties.
+example's (1), (4), and (6) exhibit recommended uses of the properties.
 
-- 
2.20.1

From: Christophe Lyon <christophe.lyon@linaro.org>

rt==15 is a special case when reading the flags: it means the
destination is APSR. This patch avoids rejecting
vmrs apsr_nzcv, fpscr
as illegal instruction.

Cc: qemu-stable@nongnu.org
Signed-off-by: Christophe Lyon <christophe.lyon@linaro.org>
Message-id: 20191025095711.10853-1-christophe.lyon@linaro.org
[PMM: updated the comment]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
     if (arm_dc_feature(s, ARM_FEATURE_M)) {
         /*
          * The only M-profile VFP vmrs/vmsr sysreg is FPSCR.
-         * Writes to R15 are UNPREDICTABLE; we choose to undef.
+         * Accesses to R15 are UNPREDICTABLE; we choose to undef.
+         * (FPSCR -> r15 is a special case which writes to the PSR flags.)
          */
-        if (a->rt == 15 || a->reg != ARM_VFP_FPSCR) {
+        if (a->rt == 15 && (!a->l || a->reg != ARM_VFP_FPSCR)) {
             return false;
         }
     }
-- 
2.20.1