Series comparison

-[PULL 00/33] target-arm queue
+[PULL 00/11] target-arm queue
-Hi; here's the first target-arm pullreq for the 7.0 cycle.
+target-arm queue: two bug fixes, plus the KVM/SVE patchset,
 which is a new feature but one which was in my pre-softfreeze
 pullreq (it just had to be dropped due to an unexpected test failure.)
 thanks
 -- PMM
-The following changes since commit 76b56fdfc9fa43ec6e5986aee33f108c6c6a511e:
+The following changes since commit b7c9a7f353c0e260519bf735ff0d4aa01e72784b:
-  Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2021-12-14 12:46:18 -0800)
+  Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging (2019-10-31 15:57:30 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20211215
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191101-1
-for you to fetch changes up to aed176558806674d030a8305d989d4e6a5073359:
+for you to fetch changes up to d9ae7624b659362cb2bb2b04fee53bf50829ca56:
-  tests/acpi: add expected blob for VIOT test on virt machine (2021-12-15 10:35:26 +0000)
+  target/arm: Allow reading flags from FPSCR for M-profile (2019-11-01 08:49:10 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * ITS: error reporting cleanup
+ * Support SVE in KVM guests
- * aspeed: improve documentation
+ * Don't UNDEF on M-profile 'vmrs apsr_nzcv, fpscr'
- * Fix STM32F2XX USART data register readout
+ * Update hflags after boot.c modifies CPU state
  * allow emulated GICv3 to be disabled in non-TCG builds
  * fix exception priority for singlestep, misaligned PC, bp, etc
  * Correct calculation of tlb range invalidate length
  * npcm7xx_emc: fix missing queue_flush
  * virt: Add VIOT ACPI table for virtio-iommu
  * target/i386: Use assert() to sanity-check b1 in SSE decode
  * Don't include qemu-common unnecessarily
 ----------------------------------------------------------------
-Alex Bennée (1):
+Andrew Jones (9):
-      hw/intc: clean-up error reporting for failed ITS cmd
+      target/arm/monitor: Introduce qmp_query_cpu_model_expansion
       tests: arm: Introduce cpu feature tests
       target/arm: Allow SVE to be disabled via a CPU property
       target/arm/cpu64: max cpu: Introduce sve<N> properties
       target/arm/kvm64: Add kvm_arch_get/put_sve
       target/arm/kvm64: max cpu: Enable SVE when available
       target/arm/kvm: scratch vcpu: Preserve input kvm_vcpu_init features
       target/arm/cpu64: max cpu: Support sve properties with KVM
       target/arm/kvm: host cpu: Add support for sve<N> properties
-Jean-Philippe Brucker (8):
+Christophe Lyon (1):
-      hw/arm/virt-acpi-build: Add VIOT table for virtio-iommu
+      target/arm: Allow reading flags from FPSCR for M-profile
       hw/arm/virt: Remove device tree restriction for virtio-iommu
       hw/arm/virt: Reject instantiation of multiple IOMMUs
       hw/arm/virt: Use object_property_set instead of qdev_prop_set
       tests/acpi: allow updates of VIOT expected data files
       tests/acpi: add test case for VIOT
       tests/acpi: add expected blobs for VIOT test on q35 machine
       tests/acpi: add expected blob for VIOT test on virt machine
-Joel Stanley (4):
+Edgar E. Iglesias (1):
-      docs: aspeed: Add new boards
+      hw/arm/boot: Rebuild hflags when modifying CPUState at boot
       docs: aspeed: Update OpenBMC image URL
       docs: aspeed: Give an example of booting a kernel
       docs: aspeed: ADC is now modelled
-Olivier Hériveaux (1):
+ tests/Makefile.include         |   5 +-
-      Fix STM32F2XX USART data register readout
+ qapi/machine-target.json       |   6 +-
  include/qemu/bitops.h          |   1 +
  target/arm/cpu.h               |  21 ++
  target/arm/kvm_arm.h           |  39 +++
  hw/arm/boot.c                  |   1 +
  target/arm/cpu.c               |  25 +-
  target/arm/cpu64.c             | 364 +++++++++++++++++++++++++--
  target/arm/helper.c            |  10 +-
  target/arm/kvm.c               |  25 +-
  target/arm/kvm32.c             |   6 +-
  target/arm/kvm64.c             | 325 +++++++++++++++++++++---
  target/arm/monitor.c           | 158 ++++++++++++
  target/arm/translate-vfp.inc.c |   5 +-
  tests/arm-cpu-features.c       | 551 +++++++++++++++++++++++++++++++++++++++++
  docs/arm-cpu-features.rst      | 317 ++++++++++++++++++++++++
 files changed, 1795 insertions(+), 64 deletions(-)
  create mode 100644 tests/arm-cpu-features.c
  create mode 100644 docs/arm-cpu-features.rst
-Patrick Venture (1):
-      hw/net: npcm7xx_emc fix missing queue_flush
-Peter Maydell (6):
-      target/i386: Use assert() to sanity-check b1 in SSE decode
-      include/hw/i386: Don't include qemu-common.h in .h files
-      target/hexagon/cpu.h: don't include qemu-common.h
-      target/rx/cpu.h: Don't include qemu-common.h
-      hw/arm: Don't include qemu-common.h unnecessarily
-      target/arm: Correct calculation of tlb range invalidate length
-Philippe Mathieu-Daudé (2):
-      hw/intc/arm_gicv3: Extract gicv3_set_gicv3state from arm_gicv3_cpuif.c
-      hw/intc/arm_gicv3: Introduce CONFIG_ARM_GIC_TCG Kconfig selector
-Richard Henderson (10):
-      target/arm: Hoist pc_next to a local variable in aarch64_tr_translate_insn
-      target/arm: Hoist pc_next to a local variable in arm_tr_translate_insn
-      target/arm: Hoist pc_next to a local variable in thumb_tr_translate_insn
-      target/arm: Split arm_pre_translate_insn
-      target/arm: Advance pc for arch single-step exception
-      target/arm: Split compute_fsr_fsc out of arm_deliver_fault
-      target/arm: Take an exception if PC is misaligned
-      target/arm: Assert thumb pc is aligned
-      target/arm: Suppress bp for exceptions with more priority
-      tests/tcg: Add arm and aarch64 pc alignment tests
- docs/system/arm/aspeed.rst        |  26 ++++++++++++----
- include/hw/i386/microvm.h         |   1 -
- include/hw/i386/x86.h             |   1 -
- target/arm/helper.h               |   1 +
- target/arm/syndrome.h             |   5 +++
- target/hexagon/cpu.h              |   1 -
- target/rx/cpu.h                   |   1 -
- hw/arm/boot.c                     |   1 -
- hw/arm/digic_boards.c             |   1 -
- hw/arm/highbank.c                 |   1 -
- hw/arm/npcm7xx_boards.c           |   1 -
- hw/arm/sbsa-ref.c                 |   1 -
- hw/arm/stm32f405_soc.c            |   1 -
- hw/arm/vexpress.c                 |   1 -
- hw/arm/virt-acpi-build.c          |   7 +++++
- hw/arm/virt.c                     |  21 ++++++-------
- hw/char/stm32f2xx_usart.c         |   3 +-
- hw/intc/arm_gicv3.c               |   2 +-
- hw/intc/arm_gicv3_cpuif.c         |  10 +-----
- hw/intc/arm_gicv3_cpuif_common.c  |  22 +++++++++++++
- hw/intc/arm_gicv3_its.c           |  39 +++++++++++++++--------
- hw/net/npcm7xx_emc.c              |  18 +++++------
- hw/virtio/virtio-iommu-pci.c      |  12 ++------
- linux-user/aarch64/cpu_loop.c     |  46 ++++++++++++++++------------
- linux-user/hexagon/cpu_loop.c     |   1 +
- target/arm/debug_helper.c         |  23 ++++++++++++++
- target/arm/gdbstub.c              |   9 ++++--
- target/arm/helper.c               |   6 ++--
- target/arm/machine.c              |  10 ++++++
- target/arm/tlb_helper.c           |  63 ++++++++++++++++++++++++++++----------
- target/arm/translate-a64.c        |  23 ++++++++++++--
- target/arm/translate.c            |  58 ++++++++++++++++++++++++++---------
- target/i386/tcg/translate.c       |  12 ++------
- tests/qtest/bios-tables-test.c    |  38 +++++++++++++++++++++++
- tests/tcg/aarch64/pcalign-a64.c   |  37 ++++++++++++++++++++++
- tests/tcg/arm/pcalign-a32.c       |  46 ++++++++++++++++++++++++++++
- hw/arm/Kconfig                    |   1 +
- hw/intc/Kconfig                   |   5 +++
- hw/intc/meson.build               |  11 ++++---
- tests/data/acpi/q35/DSDT.viot     | Bin 0 -> 9398 bytes
- tests/data/acpi/q35/VIOT.viot     | Bin 0 -> 112 bytes
- tests/data/acpi/virt/VIOT         | Bin 0 -> 88 bytes
- tests/tcg/aarch64/Makefile.target |   4 +--
- tests/tcg/arm/Makefile.target     |   4 +++
-files changed, 429 insertions(+), 145 deletions(-)
- create mode 100644 hw/intc/arm_gicv3_cpuif_common.c
- create mode 100644 tests/tcg/aarch64/pcalign-a64.c
- create mode 100644 tests/tcg/arm/pcalign-a32.c
- create mode 100644 tests/data/acpi/q35/DSDT.viot
- create mode 100644 tests/data/acpi/q35/VIOT.viot
- create mode 100644 tests/data/acpi/virt/VIOT

-[PULL 07/33] hw/intc/arm_gicv3: Extract gicv3_set_gicv3state from arm_gicv3_cpuif.c
+[PULL 01/11] target/arm/monitor: Introduce qmp_query_cpu_model_expansion
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+From: Andrew Jones <drjones@redhat.com>
-gicv3_set_gicv3state() is used by arm_gicv3_common.c in
+Add support for the query-cpu-model-expansion QMP command to Arm. We
-arm_gicv3_common_realize(). Since we want to restrict
+do this selectively, only exposing CPU properties which represent
-arm_gicv3_cpuif.c to TCG, extract gicv3_set_gicv3state()
+optional CPU features which the user may want to enable/disable.
-to a new file. Add this file to the meson 'specific'
+Additionally we restrict the list of queryable cpu models to 'max',
-source set, since it needs access to "cpu.h".
+'host', or the current type when KVM is in use. And, finally, we only
+implement expansion type 'full', as Arm does not yet have a "base"
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+CPU type. More details and example queries are described in a new
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+document (docs/arm-cpu-features.rst).
-Message-id: 20211115223619.2599282-2-philmd@redhat.com
 Note, certainly more features may be added to the list of advertised
 features, e.g. 'vfp' and 'neon'. The only requirement is that we can
 detect invalid configurations and emit failures at QMP query time.
 For 'vfp' and 'neon' this will require some refactoring to share a
 validation function between the QMP query and the CPU realize
 functions.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
 Message-id: 20191031142734.8590-2-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gicv3_cpuif.c        | 10 +---------
+ qapi/machine-target.json  |   6 +-
- hw/intc/arm_gicv3_cpuif_common.c | 22 ++++++++++++++++++++++
+ target/arm/monitor.c      | 146 ++++++++++++++++++++++++++++++++++++++
- hw/intc/meson.build              |  1 +
+ docs/arm-cpu-features.rst | 137 +++++++++++++++++++++++++++++++++++
-files changed, 24 insertions(+), 9 deletions(-)
+files changed, 286 insertions(+), 3 deletions(-)
- create mode 100644 hw/intc/arm_gicv3_cpuif_common.c
+ create mode 100644 docs/arm-cpu-features.rst
-diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
+diff --git a/qapi/machine-target.json b/qapi/machine-target.json
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_cpuif.c
+--- a/qapi/machine-target.json
-+++ b/hw/intc/arm_gicv3_cpuif.c
++++ b/qapi/machine-target.json
 @@ -XXX,XX +XXX,XX @@
- /*
+ ##
-- * ARM Generic Interrupt Controller v3
+ { 'struct': 'CpuModelExpansionInfo',
-+ * ARM Generic Interrupt Controller v3 (emulation)
+   'data': { 'model': 'CpuModelInfo' },
-  *
+-  'if': 'defined(TARGET_S390X) || defined(TARGET_I386)' }
-  * Copyright (c) 2016 Linaro Limited
++  'if': 'defined(TARGET_S390X) || defined(TARGET_I386) || defined(TARGET_ARM)' }
-  * Written by Peter Maydell
-@@ -XXX,XX +XXX,XX @@
+ ##
- #include "hw/irq.h"
+ # @query-cpu-model-expansion:
- #include "cpu.h"
+@@ -XXX,XX +XXX,XX @@
+ #   query-cpu-model-expansion while using these is not advised.
--void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)
+ #
--{
+ # Some architectures may not support all expansion types. s390x supports
--    ARMCPU *arm_cpu = ARM_CPU(cpu);
+-# "full" and "static".
--    CPUARMState *env = &arm_cpu->env;
++# "full" and "static". Arm only supports "full".
--
+ #
--    env->gicv3state = (void *)s;
+ # Returns: a CpuModelExpansionInfo. Returns an error if expanding CPU models is
--};
+ #          not supported, if the model cannot be expanded, if the model contains
--
+@@ -XXX,XX +XXX,XX @@
- static GICv3CPUState *icc_cs_from_env(CPUARMState *env)
+   'data': { 'type': 'CpuModelExpansionType',
              'model': 'CpuModelInfo' },
    'returns': 'CpuModelExpansionInfo',
 -  'if': 'defined(TARGET_S390X) || defined(TARGET_I386)' }
 +  'if': 'defined(TARGET_S390X) || defined(TARGET_I386) || defined(TARGET_ARM)' }
  ##
  # @CpuDefinitionInfo:
 diff --git a/target/arm/monitor.c b/target/arm/monitor.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/monitor.c
 +++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 +#include "hw/boards.h"
  #include "kvm_arm.h"
 +#include "qapi/error.h"
 +#include "qapi/visitor.h"
 +#include "qapi/qobject-input-visitor.h"
 +#include "qapi/qapi-commands-machine-target.h"
  #include "qapi/qapi-commands-misc-target.h"
 +#include "qapi/qmp/qerror.h"
 +#include "qapi/qmp/qdict.h"
 +#include "qom/qom-qobject.h"
  static GICCapability *gic_cap_new(int version)
  {
-     return env->gicv3state;
+@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
-diff --git a/hw/intc/arm_gicv3_cpuif_common.c b/hw/intc/arm_gicv3_cpuif_common.c
      return head;
  }
 +
 +/*
 + * These are cpu model features we want to advertise. The order here
 + * matters as this is the order in which qmp_query_cpu_model_expansion
 + * will attempt to set them. If there are dependencies between features,
 + * then the order that considers those dependencies must be used.
 + */
 +static const char *cpu_model_advertised_features[] = {
 +    "aarch64", "pmu",
 +    NULL
 +};
 +
 +CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
 +                                                     CpuModelInfo *model,
 +                                                     Error **errp)
 +{
 +    CpuModelExpansionInfo *expansion_info;
 +    const QDict *qdict_in = NULL;
 +    QDict *qdict_out;
 +    ObjectClass *oc;
 +    Object *obj;
 +    const char *name;
 +    int i;
 +
 +    if (type != CPU_MODEL_EXPANSION_TYPE_FULL) {
 +        error_setg(errp, "The requested expansion type is not supported");
 +        return NULL;
 +    }
 +
 +    if (!kvm_enabled() && !strcmp(model->name, "host")) {
 +        error_setg(errp, "The CPU type '%s' requires KVM", model->name);
 +        return NULL;
 +    }
 +
 +    oc = cpu_class_by_name(TYPE_ARM_CPU, model->name);
 +    if (!oc) {
 +        error_setg(errp, "The CPU type '%s' is not a recognized ARM CPU type",
 +                   model->name);
 +        return NULL;
 +    }
 +
 +    if (kvm_enabled()) {
 +        const char *cpu_type = current_machine->cpu_type;
 +        int len = strlen(cpu_type) - strlen(ARM_CPU_TYPE_SUFFIX);
 +        bool supported = false;
 +
 +        if (!strcmp(model->name, "host") || !strcmp(model->name, "max")) {
 +            /* These are kvmarm's recommended cpu types */
 +            supported = true;
 +        } else if (strlen(model->name) == len &&
 +                   !strncmp(model->name, cpu_type, len)) {
 +            /* KVM is enabled and we're using this type, so it works. */
 +            supported = true;
 +        }
 +        if (!supported) {
 +            error_setg(errp, "We cannot guarantee the CPU type '%s' works "
 +                             "with KVM on this host", model->name);
 +            return NULL;
 +        }
 +    }
 +
 +    if (model->props) {
 +        qdict_in = qobject_to(QDict, model->props);
 +        if (!qdict_in) {
 +            error_setg(errp, QERR_INVALID_PARAMETER_TYPE, "props", "dict");
 +            return NULL;
 +        }
 +    }
 +
 +    obj = object_new(object_class_get_name(oc));
 +
 +    if (qdict_in) {
 +        Visitor *visitor;
 +        Error *err = NULL;
 +
 +        visitor = qobject_input_visitor_new(model->props);
 +        visit_start_struct(visitor, NULL, NULL, 0, &err);
 +        if (err) {
 +            visit_free(visitor);
 +            object_unref(obj);
 +            error_propagate(errp, err);
 +            return NULL;
 +        }
 +
 +        i = 0;
 +        while ((name = cpu_model_advertised_features[i++]) != NULL) {
 +            if (qdict_get(qdict_in, name)) {
 +                object_property_set(obj, visitor, name, &err);
 +                if (err) {
 +                    break;
 +                }
 +            }
 +        }
 +
 +        if (!err) {
 +            visit_check_struct(visitor, &err);
 +        }
 +        visit_end_struct(visitor, NULL);
 +        visit_free(visitor);
 +        if (err) {
 +            object_unref(obj);
 +            error_propagate(errp, err);
 +            return NULL;
 +        }
 +    }
 +
 +    expansion_info = g_new0(CpuModelExpansionInfo, 1);
 +    expansion_info->model = g_malloc0(sizeof(*expansion_info->model));
 +    expansion_info->model->name = g_strdup(model->name);
 +
 +    qdict_out = qdict_new();
 +
 +    i = 0;
 +    while ((name = cpu_model_advertised_features[i++]) != NULL) {
 +        ObjectProperty *prop = object_property_find(obj, name, NULL);
 +        if (prop) {
 +            Error *err = NULL;
 +            QObject *value;
 +
 +            assert(prop->get);
 +            value = object_property_get_qobject(obj, name, &err);
 +            assert(!err);
 +
 +            qdict_put_obj(qdict_out, name, value);
 +        }
 +    }
 +
 +    if (!qdict_size(qdict_out)) {
 +        qobject_unref(qdict_out);
 +    } else {
 +        expansion_info->model->props = QOBJECT(qdict_out);
 +        expansion_info->model->has_props = true;
 +    }
 +
 +    object_unref(obj);
 +
 +    return expansion_info;
 +}
 diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/hw/intc/arm_gicv3_cpuif_common.c
++++ b/docs/arm-cpu-features.rst
 @@ -XXX,XX +XXX,XX @@
-+/* SPDX-License-Identifier: GPL-2.0-or-later */
++================
-+/*
++ARM CPU Features
-+ * ARM Generic Interrupt Controller v3
++================
-+ *
++
-+ * Copyright (c) 2016 Linaro Limited
++Examples of probing and using ARM CPU features
-+ * Written by Peter Maydell
++
-+ *
++Introduction
-+ * This code is licensed under the GPL, version 2 or (at your option)
++============
-+ * any later version.
++
-+ */
++CPU features are optional features that a CPU of supporting type may
-+
++choose to implement or not.  In QEMU, optional CPU features have
-+#include "qemu/osdep.h"
++corresponding boolean CPU proprieties that, when enabled, indicate
-+#include "gicv3_internal.h"
++that the feature is implemented, and, conversely, when disabled,
-+#include "cpu.h"
++indicate that it is not implemented. An example of an ARM CPU feature
-+
++is the Performance Monitoring Unit (PMU).  CPU types such as the
-+void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)
++Cortex-A15 and the Cortex-A57, which respectively implement ARM
-+{
++architecture reference manuals ARMv7-A and ARMv8-A, may both optionally
-+    ARMCPU *arm_cpu = ARM_CPU(cpu);
++implement PMUs.  For example, if a user wants to use a Cortex-A15 without
-+    CPUARMState *env = &arm_cpu->env;
++a PMU, then the `-cpu` parameter should contain `pmu=off` on the QEMU
-+
++command line, i.e. `-cpu cortex-a15,pmu=off`.
-+    env->gicv3state = (void *)s;
++
-+};
++As not all CPU types support all optional CPU features, then whether or
-diff --git a/hw/intc/meson.build b/hw/intc/meson.build
++not a CPU property exists depends on the CPU type.  For example, CPUs
-index XXXXXXX..XXXXXXX 100644
++that implement the ARMv8-A architecture reference manual may optionally
---- a/hw/intc/meson.build
++support the AArch32 CPU feature, which may be enabled by disabling the
-+++ b/hw/intc/meson.build
++`aarch64` CPU property.  A CPU type such as the Cortex-A15, which does
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in
++not implement ARMv8-A, will not have the `aarch64` CPU property.
++
- specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))
++QEMU's support may be limited for some CPU features, only partially
- specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))
++supporting the feature or only supporting the feature under certain
-+specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
++configurations.  For example, the `aarch64` CPU feature, which, when
- specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif.c'))
++disabled, enables the optional AArch32 CPU feature, is only supported
- specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))
++when using the KVM accelerator and when running on a host CPU type that
- specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
++supports the feature.
 +
 +CPU Feature Probing
 +===================
 +
 +Determining which CPU features are available and functional for a given
 +CPU type is possible with the `query-cpu-model-expansion` QMP command.
 +Below are some examples where `scripts/qmp/qmp-shell` (see the top comment
 +block in the script for usage) is used to issue the QMP commands.
 +
 +(1) Determine which CPU features are available for the `max` CPU type
 +    (Note, we started QEMU with qemu-system-aarch64, so `max` is
 +     implementing the ARMv8-A reference manual in this case)::
 +
 +      (QEMU) query-cpu-model-expansion type=full model={"name":"max"}
 +      { "return": {
 +        "model": { "name": "max", "props": {
 +        "pmu": true, "aarch64": true
 +      }}}}
 +
 +We see that the `max` CPU type has the `pmu` and `aarch64` CPU features.
 +We also see that the CPU features are enabled, as they are all `true`.
 +
 +(2) Let's try to disable the PMU::
 +
 +      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"pmu":false}}
 +      { "return": {
 +        "model": { "name": "max", "props": {
 +        "pmu": false, "aarch64": true
 +      }}}}
 +
 +We see it worked, as `pmu` is now `false`.
 +
 +(3) Let's try to disable `aarch64`, which enables the AArch32 CPU feature::
 +
 +      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"aarch64":false}}
 +      {"error": {
 +       "class": "GenericError", "desc":
 +       "'aarch64' feature cannot be disabled unless KVM is enabled and 32-bit EL1 is supported"
 +      }}
 +
 +It looks like this feature is limited to a configuration we do not
 +currently have.
 +
 +(4) Let's try probing CPU features for the Cortex-A15 CPU type::
 +
 +      (QEMU) query-cpu-model-expansion type=full model={"name":"cortex-a15"}
 +      {"return": {"model": {"name": "cortex-a15", "props": {"pmu": true}}}}
 +
 +Only the `pmu` CPU feature is available.
 +
 +A note about CPU feature dependencies
 +-------------------------------------
 +
 +It's possible for features to have dependencies on other features. I.e.
 +it may be possible to change one feature at a time without error, but
 +when attempting to change all features at once an error could occur
 +depending on the order they are processed.  It's also possible changing
 +all at once doesn't generate an error, because a feature's dependencies
 +are satisfied with other features, but the same feature cannot be changed
 +independently without error.  For these reasons callers should always
 +attempt to make their desired changes all at once in order to ensure the
 +collection is valid.
 +
 +A note about CPU models and KVM
 +-------------------------------
 +
 +Named CPU models generally do not work with KVM.  There are a few cases
 +that do work, e.g. using the named CPU model `cortex-a57` with KVM on a
 +seattle host, but mostly if KVM is enabled the `host` CPU type must be
 +used.  This means the guest is provided all the same CPU features as the
 +host CPU type has.  And, for this reason, the `host` CPU type should
 +enable all CPU features that the host has by default.  Indeed it's even
 +a bit strange to allow disabling CPU features that the host has when using
 +the `host` CPU type, but in the absence of CPU models it's the best we can
 +do if we want to launch guests without all the host's CPU features enabled.
 +
 +Enabling KVM also affects the `query-cpu-model-expansion` QMP command.  The
 +affect is not only limited to specific features, as pointed out in example
 +(3) of "CPU Feature Probing", but also to which CPU types may be expanded.
 +When KVM is enabled, only the `max`, `host`, and current CPU type may be
 +expanded.  This restriction is necessary as it's not possible to know all
 +CPU types that may work with KVM, but it does impose a small risk of users
 +experiencing unexpected errors.  For example on a seattle, as mentioned
 +above, the `cortex-a57` CPU type is also valid when KVM is enabled.
 +Therefore a user could use the `host` CPU type for the current type, but
 +then attempt to query `cortex-a57`, however that query will fail with our
 +restrictions.  This shouldn't be an issue though as management layers and
 +users have been preferring the `host` CPU type for use with KVM for quite
 +some time.  Additionally, if the KVM-enabled QEMU instance running on a
 +seattle host is using the `cortex-a57` CPU type, then querying `cortex-a57`
 +will work.
 +
 +Using CPU Features
 +==================
 +
 +After determining which CPU features are available and supported for a
 +given CPU type, then they may be selectively enabled or disabled on the
 +QEMU command line with that CPU type::
 +
 +  $ qemu-system-aarch64 -M virt -cpu max,pmu=off
 +
 +The example above disables the PMU for the `max` CPU type.
 +
 --
-.25.1
+.20.1

-[PULL 18/33] tests/tcg: Add arm and aarch64 pc alignment tests
+[PULL 02/11] tests: arm: Introduce cpu feature tests
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Now that Arm CPUs have advertised features lets add tests to ensure
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+we maintain their expected availability with and without KVM.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 20191031142734.8590-3-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/tcg/aarch64/pcalign-a64.c   | 37 +++++++++++++++++++++++++
+ tests/Makefile.include   |   5 +-
- tests/tcg/arm/pcalign-a32.c       | 46 +++++++++++++++++++++++++++++++
+ tests/arm-cpu-features.c | 253 +++++++++++++++++++++++++++++++++++++++
- tests/tcg/aarch64/Makefile.target |  4 +--
+files changed, 257 insertions(+), 1 deletion(-)
- tests/tcg/arm/Makefile.target     |  4 +++
+ create mode 100644 tests/arm-cpu-features.c
-files changed, 89 insertions(+), 2 deletions(-)
- create mode 100644 tests/tcg/aarch64/pcalign-a64.c
+diff --git a/tests/Makefile.include b/tests/Makefile.include
- create mode 100644 tests/tcg/arm/pcalign-a32.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/Makefile.include
-diff --git a/tests/tcg/aarch64/pcalign-a64.c b/tests/tcg/aarch64/pcalign-a64.c
++++ b/tests/Makefile.include
@@ -XXX,XX +XXX,XX @@ check-qtest-sparc64-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
  check-qtest-sparc64-y += tests/prom-env-test$(EXESUF)
  check-qtest-sparc64-y += tests/boot-serial-test$(EXESUF)
 +check-qtest-arm-y += tests/arm-cpu-features$(EXESUF)
  check-qtest-arm-y += tests/microbit-test$(EXESUF)
  check-qtest-arm-y += tests/m25p80-test$(EXESUF)
  check-qtest-arm-y += tests/test-arm-mptimer$(EXESUF)
@@ -XXX,XX +XXX,XX @@ check-qtest-arm-y += tests/boot-serial-test$(EXESUF)
  check-qtest-arm-y += tests/hexloader-test$(EXESUF)
  check-qtest-arm-$(CONFIG_PFLASH_CFI02) += tests/pflash-cfi02-test$(EXESUF)
 -check-qtest-aarch64-y = tests/numa-test$(EXESUF)
 +check-qtest-aarch64-y += tests/arm-cpu-features$(EXESUF)
 +check-qtest-aarch64-y += tests/numa-test$(EXESUF)
  check-qtest-aarch64-y += tests/boot-serial-test$(EXESUF)
  check-qtest-aarch64-y += tests/migration-test$(EXESUF)
  # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make test unconditional
@@ -XXX,XX +XXX,XX @@ tests/test-qapi-util$(EXESUF): tests/test-qapi-util.o $(test-util-obj-y)
  tests/numa-test$(EXESUF): tests/numa-test.o
  tests/vmgenid-test$(EXESUF): tests/vmgenid-test.o tests/boot-sector.o tests/acpi-utils.o
  tests/cdrom-test$(EXESUF): tests/cdrom-test.o tests/boot-sector.o $(libqos-obj-y)
 +tests/arm-cpu-features$(EXESUF): tests/arm-cpu-features.o
  tests/migration/stress$(EXESUF): tests/migration/stress.o
      $(call quiet-command, $(LINKPROG) -static -O3 $(PTHREAD_LIB) -o $@ $< ,"LINK","$(TARGET_DIR)$@")
 diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/tests/tcg/aarch64/pcalign-a64.c
++++ b/tests/arm-cpu-features.c
 @@ -XXX,XX +XXX,XX @@
-+/* Test PC misalignment exception */
++/*
-+
++ * Arm CPU feature test cases
-+#include <assert.h>
++ *
-+#include <signal.h>
++ * Copyright (c) 2019 Red Hat Inc.
-+#include <stdlib.h>
++ * Authors:
-+#include <stdio.h>
++ *  Andrew Jones <drjones@redhat.com>
-+
++ *
-+static void *expected;
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+
++ * See the COPYING file in the top-level directory.
-+static void sigbus(int sig, siginfo_t *info, void *vuc)
++ */
-+{
++#include "qemu/osdep.h"
-+    assert(info->si_code == BUS_ADRALN);
++#include "libqtest.h"
-+    assert(info->si_addr == expected);
++#include "qapi/qmp/qdict.h"
-+    exit(EXIT_SUCCESS);
++#include "qapi/qmp/qjson.h"
-+}
++
-+
++#define MACHINE     "-machine virt,gic-version=max,accel=tcg "
-+int main()
++#define MACHINE_KVM "-machine virt,gic-version=max,accel=kvm:tcg "
-+{
++#define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
-+    void *tmp;
++                    "  'arguments': { 'type': 'full', "
-+
++#define QUERY_TAIL  "}}"
-+    struct sigaction sa = {
++
-+        .sa_sigaction = sigbus,
++static bool kvm_enabled(QTestState *qts)
-+        .sa_flags = SA_SIGINFO
++{
-+    };
++    QDict *resp, *qdict;
-+
++    bool enabled;
-+    if (sigaction(SIGBUS, &sa, NULL) < 0) {
++
-+        perror("sigaction");
++    resp = qtest_qmp(qts, "{ 'execute': 'query-kvm' }");
-+        return EXIT_FAILURE;
++    g_assert(qdict_haskey(resp, "return"));
-+    }
++    qdict = qdict_get_qdict(resp, "return");
-+
++    g_assert(qdict_haskey(qdict, "enabled"));
-+    asm volatile("adr %0, 1f + 1\n\t"
++    enabled = qdict_get_bool(qdict, "enabled");
-+                 "str %0, %1\n\t"
++    qobject_unref(resp);
-+                 "br  %0\n"
++
-+                 "1:"
++    return enabled;
-+                 : "=&r"(tmp), "=m"(expected));
++}
-+    abort();
++
-+}
++static QDict *do_query_no_props(QTestState *qts, const char *cpu_type)
-diff --git a/tests/tcg/arm/pcalign-a32.c b/tests/tcg/arm/pcalign-a32.c
++{
-new file mode 100644
++    return qtest_qmp(qts, QUERY_HEAD "'model': { 'name': %s }"
-index XXXXXXX..XXXXXXX
++                          QUERY_TAIL, cpu_type);
---- /dev/null
++}
-+++ b/tests/tcg/arm/pcalign-a32.c
++
-@@ -XXX,XX +XXX,XX @@
++static QDict *do_query(QTestState *qts, const char *cpu_type,
-+/* Test PC misalignment exception */
++                       const char *fmt, ...)
-+
++{
-+#ifdef __thumb__
++    QDict *resp;
-+#error "This test must be compiled for ARM"
++
-+#endif
++    if (fmt) {
-+
++        QDict *args;
-+#include <assert.h>
++        va_list ap;
-+#include <signal.h>
++
-+#include <stdlib.h>
++        va_start(ap, fmt);
-+#include <stdio.h>
++        args = qdict_from_vjsonf_nofail(fmt, ap);
-+
++        va_end(ap);
-+static void *expected;
++
-+
++        resp = qtest_qmp(qts, QUERY_HEAD "'model': { 'name': %s, "
-+static void sigbus(int sig, siginfo_t *info, void *vuc)
++                                                    "'props': %p }"
-+{
++                              QUERY_TAIL, cpu_type, args);
-+    assert(info->si_code == BUS_ADRALN);
++    } else {
-+    assert(info->si_addr == expected);
++        resp = do_query_no_props(qts, cpu_type);
-+    exit(EXIT_SUCCESS);
++    }
-+}
++
-+
++    return resp;
-+int main()
++}
-+{
++
-+    void *tmp;
++static const char *resp_get_error(QDict *resp)
-+
++{
-+    struct sigaction sa = {
++    QDict *qdict;
-+        .sa_sigaction = sigbus,
++
-+        .sa_flags = SA_SIGINFO
++    g_assert(resp);
-+    };
++
-+
++    qdict = qdict_get_qdict(resp, "error");
-+    if (sigaction(SIGBUS, &sa, NULL) < 0) {
++    if (qdict) {
-+        perror("sigaction");
++        return qdict_get_str(qdict, "desc");
-+        return EXIT_FAILURE;
++    }
-+    }
++
-+
++    return NULL;
-+    asm volatile("adr %0, 1f + 2\n\t"
++}
-+                 "str %0, %1\n\t"
++
-+                 "bx  %0\n"
++#define assert_error(qts, cpu_type, expected_error, fmt, ...)          \
-+                 "1:"
++({                                                                     \
-+                 : "=&r"(tmp), "=m"(expected));
++    QDict *_resp;                                                      \
 +    const char *_error;                                                \
 +                                                                       \
 +    _resp = do_query(qts, cpu_type, fmt, ##__VA_ARGS__);               \
 +    g_assert(_resp);                                                   \
 +    _error = resp_get_error(_resp);                                    \
 +    g_assert(_error);                                                  \
 +    g_assert(g_str_equal(_error, expected_error));                     \
 +    qobject_unref(_resp);                                              \
 +})
 +
 +static bool resp_has_props(QDict *resp)
 +{
 +    QDict *qdict;
 +
 +    g_assert(resp);
 +
 +    if (!qdict_haskey(resp, "return")) {
 +        return false;
 +    }
 +    qdict = qdict_get_qdict(resp, "return");
 +
 +    if (!qdict_haskey(qdict, "model")) {
 +        return false;
 +    }
 +    qdict = qdict_get_qdict(qdict, "model");
 +
 +    return qdict_haskey(qdict, "props");
 +}
 +
 +static QDict *resp_get_props(QDict *resp)
 +{
 +    QDict *qdict;
 +
 +    g_assert(resp);
 +    g_assert(resp_has_props(resp));
 +
 +    qdict = qdict_get_qdict(resp, "return");
 +    qdict = qdict_get_qdict(qdict, "model");
 +    qdict = qdict_get_qdict(qdict, "props");
 +
 +    return qdict;
 +}
 +
 +#define assert_has_feature(qts, cpu_type, feature)                     \
 +({                                                                     \
 +    QDict *_resp = do_query_no_props(qts, cpu_type);                   \
 +    g_assert(_resp);                                                   \
 +    g_assert(resp_has_props(_resp));                                   \
 +    g_assert(qdict_get(resp_get_props(_resp), feature));               \
 +    qobject_unref(_resp);                                              \
 +})
 +
 +#define assert_has_not_feature(qts, cpu_type, feature)                 \
 +({                                                                     \
 +    QDict *_resp = do_query_no_props(qts, cpu_type);                   \
 +    g_assert(_resp);                                                   \
 +    g_assert(!resp_has_props(_resp) ||                                 \
 +             !qdict_get(resp_get_props(_resp), feature));              \
 +    qobject_unref(_resp);                                              \
 +})
 +
 +static void assert_type_full(QTestState *qts)
 +{
 +    const char *error;
 +    QDict *resp;
 +
 +    resp = qtest_qmp(qts, "{ 'execute': 'query-cpu-model-expansion', "
 +                            "'arguments': { 'type': 'static', "
 +                                           "'model': { 'name': 'foo' }}}");
 +    g_assert(resp);
 +    error = resp_get_error(resp);
 +    g_assert(error);
 +    g_assert(g_str_equal(error,
 +                         "The requested expansion type is not supported"));
 +    qobject_unref(resp);
 +}
 +
 +static void assert_bad_props(QTestState *qts, const char *cpu_type)
 +{
 +    const char *error;
 +    QDict *resp;
 +
 +    resp = qtest_qmp(qts, "{ 'execute': 'query-cpu-model-expansion', "
 +                            "'arguments': { 'type': 'full', "
 +                                           "'model': { 'name': %s, "
 +                                                      "'props': false }}}",
 +                     cpu_type);
 +    g_assert(resp);
 +    error = resp_get_error(resp);
 +    g_assert(error);
 +    g_assert(g_str_equal(error,
 +                         "Invalid parameter type for 'props', expected: dict"));
 +    qobject_unref(resp);
 +}
 +
 +static void test_query_cpu_model_expansion(const void *data)
 +{
 +    QTestState *qts;
 +
 +    qts = qtest_init(MACHINE "-cpu max");
 +
 +    /* Test common query-cpu-model-expansion input validation */
 +    assert_type_full(qts);
 +    assert_bad_props(qts, "max");
 +    assert_error(qts, "foo", "The CPU type 'foo' is not a recognized "
 +                 "ARM CPU type", NULL);
 +    assert_error(qts, "max", "Parameter 'not-a-prop' is unexpected",
 +                 "{ 'not-a-prop': false }");
 +    assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
 +
 +    /* Test expected feature presence/absence for some cpu types */
 +    assert_has_feature(qts, "max", "pmu");
 +    assert_has_feature(qts, "cortex-a15", "pmu");
 +    assert_has_not_feature(qts, "cortex-a15", "aarch64");
 +
 +    if (g_str_equal(qtest_get_arch(), "aarch64")) {
 +        assert_has_feature(qts, "max", "aarch64");
 +        assert_has_feature(qts, "cortex-a57", "pmu");
 +        assert_has_feature(qts, "cortex-a57", "aarch64");
 +
 +        /* Test that features that depend on KVM generate errors without. */
 +        assert_error(qts, "max",
 +                     "'aarch64' feature cannot be disabled "
 +                     "unless KVM is enabled and 32-bit EL1 "
 +                     "is supported",
 +                     "{ 'aarch64': false }");
 +    }
 +
 +    qtest_quit(qts);
 +}
 +
 +static void test_query_cpu_model_expansion_kvm(const void *data)
 +{
 +    QTestState *qts;
 +
 +    qts = qtest_init(MACHINE_KVM "-cpu max");
 +
 +    /*
-+     * From v8, it is CONSTRAINED UNPREDICTABLE whether BXWritePC aligns
++     * These tests target the 'host' CPU type, so KVM must be enabled.
 +     * the address or not.  If so, we can legitimately fall through.
 +     */
-+    return EXIT_SUCCESS;
++    if (!kvm_enabled(qts)) {
-+}
++        qtest_quit(qts);
-diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
++        return;
-index XXXXXXX..XXXXXXX 100644
++    }
---- a/tests/tcg/aarch64/Makefile.target
++
-+++ b/tests/tcg/aarch64/Makefile.target
++    if (g_str_equal(qtest_get_arch(), "aarch64")) {
-@@ -XXX,XX +XXX,XX @@ VPATH         += $(ARM_SRC)
++        assert_has_feature(qts, "host", "aarch64");
- AARCH64_SRC=$(SRC_PATH)/tests/tcg/aarch64
++        assert_has_feature(qts, "host", "pmu");
- VPATH         += $(AARCH64_SRC)
++
++        assert_error(qts, "cortex-a15",
--# Float-convert Tests
++            "We cannot guarantee the CPU type 'cortex-a15' works "
--AARCH64_TESTS=fcvt
++            "with KVM on this host", NULL);
-+# Base architecture tests
++    } else {
-+AARCH64_TESTS=fcvt pcalign-a64
++        assert_has_not_feature(qts, "host", "aarch64");
++        assert_has_not_feature(qts, "host", "pmu");
- fcvt: LDFLAGS+=-lm
++    }
++
-diff --git a/tests/tcg/arm/Makefile.target b/tests/tcg/arm/Makefile.target
++    qtest_quit(qts);
-index XXXXXXX..XXXXXXX 100644
++}
---- a/tests/tcg/arm/Makefile.target
++
-+++ b/tests/tcg/arm/Makefile.target
++int main(int argc, char **argv)
-@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
++{
-     $(call run-test,fcvt,$(QEMU) $<,"$< on $(TARGET_NAME)")
++    g_test_init(&argc, &argv, NULL);
-     $(call diff-out,fcvt,$(ARM_SRC)/fcvt.ref)
++
++    qtest_add_data_func("/arm/query-cpu-model-expansion",
-+# PC alignment test
++                        NULL, test_query_cpu_model_expansion);
-+ARM_TESTS += pcalign-a32
++    qtest_add_data_func("/arm/kvm/query-cpu-model-expansion",
-+pcalign-a32: CFLAGS+=-marm
++                        NULL, test_query_cpu_model_expansion_kvm);
 +
- ifeq ($(CONFIG_ARM_COMPATIBLE_SEMIHOSTING),y)
++    return g_test_run();
++}
  # Semihosting smoke test for linux-user
 --
-.25.1
+.20.1

-[PULL 31/33] tests/acpi: add test case for VIOT
+[PULL 03/11] target/arm: Allow SVE to be disabled via a CPU property
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-Add two test cases for VIOT, one on the q35 machine and the other on
+Since 97a28b0eeac14 ("target/arm: Allow VFP and Neon to be disabled via
-virt. To test complex topologies the q35 test has two PCIe buses that
+a CPU property") we can disable the 'max' cpu model's VFP and neon
-bypass the IOMMU (and are therefore not described by VIOT), and two
+features, but there's no way to disable SVE. Add the 'sve=on|off'
-buses that are translated by virtio-iommu.
+property to give it that flexibility. We also rename
 cpu_max_get/set_sve_vq to cpu_max_get/set_sve_max_vq in order for them
 to follow the typical *_get/set_<property-name> pattern.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
+Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
-Message-id: 20211210170415.583179-7-jean-philippe@linaro.org
+Message-id: 20191031142734.8590-4-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/bios-tables-test.c | 38 ++++++++++++++++++++++++++++++++++
+ target/arm/cpu.c         |  3 ++-
-file changed, 38 insertions(+)
+ target/arm/cpu64.c       | 52 ++++++++++++++++++++++++++++++++++------
  target/arm/monitor.c     |  2 +-
  tests/arm-cpu-features.c |  1 +
 files changed, 49 insertions(+), 9 deletions(-)
-diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/bios-tables-test.c
+--- a/target/arm/cpu.c
-+++ b/tests/qtest/bios-tables-test.c
++++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void test_acpi_virt_tcg(void)
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
-     free_test_data(&data);
+         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
          env->cp15.cptr_el[3] |= CPTR_EZ;
          /* with maximum vector length */
 -        env->vfp.zcr_el[1] = cpu->sve_max_vq - 1;
 +        env->vfp.zcr_el[1] = cpu_isar_feature(aa64_sve, cpu) ?
 +                             cpu->sve_max_vq - 1 : 0;
          env->vfp.zcr_el[2] = env->vfp.zcr_el[1];
          env->vfp.zcr_el[3] = env->vfp.zcr_el[1];
          /*
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
      define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
  }
-+static void test_acpi_q35_viot(void)
+-static void cpu_max_get_sve_vq(Object *obj, Visitor *v, const char *name,
 -                               void *opaque, Error **errp)
 +static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
 +                                   void *opaque, Error **errp)
  {
      ARMCPU *cpu = ARM_CPU(obj);
 -    visit_type_uint32(v, name, &cpu->sve_max_vq, errp);
 +    uint32_t value;
 +
 +    /* All vector lengths are disabled when SVE is off. */
 +    if (!cpu_isar_feature(aa64_sve, cpu)) {
 +        value = 0;
 +    } else {
 +        value = cpu->sve_max_vq;
 +    }
 +    visit_type_uint32(v, name, &value, errp);
  }
 -static void cpu_max_set_sve_vq(Object *obj, Visitor *v, const char *name,
 -                               void *opaque, Error **errp)
 +static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
 +                                   void *opaque, Error **errp)
  {
      ARMCPU *cpu = ARM_CPU(obj);
      Error *err = NULL;
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_vq(Object *obj, Visitor *v, const char *name,
      error_propagate(errp, err);
  }
 +static void cpu_arm_get_sve(Object *obj, Visitor *v, const char *name,
 +                            void *opaque, Error **errp)
 +{
-+    test_data data = {
++    ARMCPU *cpu = ARM_CPU(obj);
-+        .machine = MACHINE_Q35,
++    bool value = cpu_isar_feature(aa64_sve, cpu);
 +        .variant = ".viot",
 +    };
 +
-+    /*
++    visit_type_bool(v, name, &value, errp);
 +     * To keep things interesting, two buses bypass the IOMMU.
 +     * VIOT should only describes the other two buses.
 +     */
 +    test_acpi_one("-machine default_bus_bypass_iommu=on "
 +                  "-device virtio-iommu-pci "
 +                  "-device pxb-pcie,bus_nr=0x10,id=pcie.100,bus=pcie.0 "
 +                  "-device pxb-pcie,bus_nr=0x20,id=pcie.200,bus=pcie.0,bypass_iommu=on "
 +                  "-device pxb-pcie,bus_nr=0x30,id=pcie.300,bus=pcie.0",
 +                  &data);
 +    free_test_data(&data);
 +}
 +
-+static void test_acpi_virt_viot(void)
++static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
 +                            void *opaque, Error **errp)
 +{
-+    test_data data = {
++    ARMCPU *cpu = ARM_CPU(obj);
-+        .machine = "virt",
++    Error *err = NULL;
-+        .uefi_fl1 = "pc-bios/edk2-aarch64-code.fd",
++    bool value;
-+        .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
++    uint64_t t;
 +        .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
 +        .ram_start = 0x40000000ULL,
 +        .scan_len = 128ULL * 1024 * 1024,
 +    };
 +
-+    test_acpi_one("-cpu cortex-a57 "
++    visit_type_bool(v, name, &value, &err);
-+                  "-device virtio-iommu-pci", &data);
++    if (err) {
-+    free_test_data(&data);
++        error_propagate(errp, err);
 +        return;
 +    }
 +
 +    t = cpu->isar.id_aa64pfr0;
 +    t = FIELD_DP64(t, ID_AA64PFR0, SVE, value);
 +    cpu->isar.id_aa64pfr0 = t;
 +}
 +
- static void test_oem_fields(test_data *data)
+ /* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
- {
+  * otherwise, a CPU with as many features enabled as our emulation supports.
-     int i;
+  * The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-             qtest_add_func("acpi/q35/kvm/xapic", test_acpi_q35_kvm_xapic);
+ #endif
-             qtest_add_func("acpi/q35/kvm/dmar", test_acpi_q35_kvm_dmar);
-         }
+         cpu->sve_max_vq = ARM_MAX_VQ;
-+        qtest_add_func("acpi/q35/viot", test_acpi_q35_viot);
+-        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_vq,
-     } else if (strcmp(arch, "aarch64") == 0) {
+-                            cpu_max_set_sve_vq, NULL, NULL, &error_fatal);
-         if (has_tcg) {
++        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
-             qtest_add_func("acpi/virt", test_acpi_virt_tcg);
++                            cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
++        object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
-             qtest_add_func("acpi/virt/memhp", test_acpi_virt_tcg_memhp);
++                            cpu_arm_set_sve, NULL, NULL, &error_fatal);
              qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb);
              qtest_add_func("acpi/virt/oem-fields", test_acpi_oem_fields_virt);
 +            qtest_add_func("acpi/virt/viot", test_acpi_virt_viot);
          }
      }
-     ret = g_test_run();
+ }
 diff --git a/target/arm/monitor.c b/target/arm/monitor.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/monitor.c
 +++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
   * then the order that considers those dependencies must be used.
   */
  static const char *cpu_model_advertised_features[] = {
 -    "aarch64", "pmu",
 +    "aarch64", "pmu", "sve",
      NULL
  };
 diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/arm-cpu-features.c
 +++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
      if (g_str_equal(qtest_get_arch(), "aarch64")) {
          assert_has_feature(qts, "max", "aarch64");
 +        assert_has_feature(qts, "max", "sve");
          assert_has_feature(qts, "cortex-a57", "pmu");
          assert_has_feature(qts, "cortex-a57", "aarch64");
 --
-.25.1
+.20.1

-[PULL 24/33] target/arm: Correct calculation of tlb range invalidate length
+[PULL 04/11] target/arm/cpu64: max cpu: Introduce sve<N> properties
-The calculation of the length of TLB range invalidate operations
+From: Andrew Jones <drjones@redhat.com>
 in tlbi_aa64_range_get_length() is incorrect in two ways:
  * the NUM field is 5 bits, but we read only 4 bits
  * we miscalculate the page_shift value, because of an
    off-by-one error:
     TG 0b00 is invalid
     TG 0b01 is 4K granule size == 4096 == 2^12
     TG 0b10 is 16K granule size == 16384 == 2^14
     TG 0b11 is 64K granule size == 65536 == 2^16
    so page_shift should be (TG - 1) * 2 + 12
-Thanks to the bug report submitter Cha HyunSoo for identifying
+Introduce cpu properties to give fine control over SVE vector lengths.
-both these errors.
+We introduce a property for each valid length up to the current
 maximum supported, which is 2048-bits. The properties are named, e.g.
 sve128, sve256, sve384, sve512, ..., where the number is the number of
 bits. See the updates to docs/arm-cpu-features.rst for a description
 of the semantics and for example uses.
-Fixes: 84940ed82552d3c ("target/arm: Add support for FEAT_TLBIRANGE")
+Note, as sve-max-vq is still present and we'd like to be able to
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/734
+support qmp_query_cpu_model_expansion with guests launched with e.g.
 -cpu max,sve-max-vq=8 on their command lines, then we do allow
 sve-max-vq and sve<N> properties to be provided at the same time, but
 this is not recommended, and is why sve-max-vq is not mentioned in the
 document.  If sve-max-vq is provided then it enables all lengths smaller
 than and including the max and disables all lengths larger. It also has
 the side-effect that no larger lengths may be enabled and that the max
 itself cannot be disabled. Smaller non-power-of-two lengths may,
 however, be disabled, e.g. -cpu max,sve-max-vq=4,sve384=off provides a
 guest the vector lengths 128, 256, and 512 bits.
 This patch has been co-authored with Richard Henderson, who reworked
 the target/arm/cpu64.c changes in order to push all the validation and
 auto-enabling/disabling steps into the finalizer, resulting in a nice
 LOC reduction.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
 Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
 Message-id: 20191031142734.8590-5-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20211130173257.1274194-1-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 6 +++---
+ include/qemu/bitops.h     |   1 +
-file changed, 3 insertions(+), 3 deletions(-)
+ target/arm/cpu.h          |  19 ++++
  target/arm/cpu.c          |  19 ++++
  target/arm/cpu64.c        | 192 ++++++++++++++++++++++++++++++++++++-
  target/arm/helper.c       |  10 +-
  target/arm/monitor.c      |  12 +++
  tests/arm-cpu-features.c  | 194 ++++++++++++++++++++++++++++++++++++++
  docs/arm-cpu-features.rst | 168 +++++++++++++++++++++++++++++++--
 files changed, 606 insertions(+), 9 deletions(-)
+diff --git a/include/qemu/bitops.h b/include/qemu/bitops.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/qemu/bitops.h
++++ b/include/qemu/bitops.h
+@@ -XXX,XX +XXX,XX @@
+ #define BITS_PER_LONG           (sizeof (unsigned long) * BITS_PER_BYTE)
+ #define BIT(nr)                 (1UL << (nr))
++#define BIT_ULL(nr)             (1ULL << (nr))
+ #define BIT_MASK(nr)            (1UL << ((nr) % BITS_PER_LONG))
+ #define BIT_WORD(nr)            ((nr) / BITS_PER_LONG)
+ #define BITS_TO_LONGS(nr)       DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct {
+ #ifdef TARGET_AARCH64
+ # define ARM_MAX_VQ    16
++void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
++uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq);
+ #else
+ # define ARM_MAX_VQ    1
++static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
++static inline uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq)
++{ return 0; }
+ #endif
+ typedef struct ARMVectorReg {
+@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
+     /* Used to set the maximum vector length the cpu will support.  */
+     uint32_t sve_max_vq;
++
++    /*
++     * In sve_vq_map each set bit is a supported vector length of
++     * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
++     * length in quadwords.
++     *
++     * While processing properties during initialization, corresponding
++     * sve_vq_init bits are set for bits in sve_vq_map that have been
++     * set by properties.
++     */
++    DECLARE_BITMAP(sve_vq_map, ARM_MAX_VQ);
++    DECLARE_BITMAP(sve_vq_init, ARM_MAX_VQ);
+ };
+ void arm_cpu_post_init(Object *obj);
+@@ -XXX,XX +XXX,XX @@ static inline int arm_feature(CPUARMState *env, int feature)
+     return (env->features & (1ULL << feature)) != 0;
+ }
++void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
++
+ #if !defined(CONFIG_USER_ONLY)
+ /* Return true if exception levels below EL3 are in secure state,
+  * or would be following an exception return to that level.
+diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.c
++++ b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_finalizefn(Object *obj)
+ #endif
+ }
++void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
++{
++    Error *local_err = NULL;
++
++    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
++        arm_cpu_sve_finalize(cpu, &local_err);
++        if (local_err != NULL) {
++            error_propagate(errp, local_err);
++            return;
++        }
++    }
++}
++
+ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
+ {
+     CPUState *cs = CPU(dev);
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
+         return;
+     }
++    arm_cpu_finalize_features(cpu, &local_err);
++    if (local_err != NULL) {
++        error_propagate(errp, local_err);
++        return;
++    }
++
+     if (arm_feature(env, ARM_FEATURE_AARCH64) &&
+         cpu->has_vfp != cpu->has_neon) {
+         /*
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu64.c
++++ b/target/arm/cpu64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
+     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
+ }
++void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
++{
++    /*
++     * If any vector lengths are explicitly enabled with sve<N> properties,
++     * then all other lengths are implicitly disabled.  If sve-max-vq is
++     * specified then it is the same as explicitly enabling all lengths
++     * up to and including the specified maximum, which means all larger
++     * lengths will be implicitly disabled.  If no sve<N> properties
++     * are enabled and sve-max-vq is not specified, then all lengths not
++     * explicitly disabled will be enabled.  Additionally, all power-of-two
++     * vector lengths less than the maximum enabled length will be
++     * automatically enabled and all vector lengths larger than the largest
++     * disabled power-of-two vector length will be automatically disabled.
++     * Errors are generated if the user provided input that interferes with
++     * any of the above.  Finally, if SVE is not disabled, then at least one
++     * vector length must be enabled.
++     */
++    DECLARE_BITMAP(tmp, ARM_MAX_VQ);
++    uint32_t vq, max_vq = 0;
++
++    /*
++     * Process explicit sve<N> properties.
++     * From the properties, sve_vq_map<N> implies sve_vq_init<N>.
++     * Check first for any sve<N> enabled.
++     */
++    if (!bitmap_empty(cpu->sve_vq_map, ARM_MAX_VQ)) {
++        max_vq = find_last_bit(cpu->sve_vq_map, ARM_MAX_VQ) + 1;
++
++        if (cpu->sve_max_vq && max_vq > cpu->sve_max_vq) {
++            error_setg(errp, "cannot enable sve%d", max_vq * 128);
++            error_append_hint(errp, "sve%d is larger than the maximum vector "
++                              "length, sve-max-vq=%d (%d bits)\n",
++                              max_vq * 128, cpu->sve_max_vq,
++                              cpu->sve_max_vq * 128);
++            return;
++        }
++
++        /* Propagate enabled bits down through required powers-of-two. */
++        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
++            if (!test_bit(vq - 1, cpu->sve_vq_init)) {
++                set_bit(vq - 1, cpu->sve_vq_map);
++            }
++        }
++    } else if (cpu->sve_max_vq == 0) {
++        /*
++         * No explicit bits enabled, and no implicit bits from sve-max-vq.
++         */
++        if (!cpu_isar_feature(aa64_sve, cpu)) {
++            /* SVE is disabled and so are all vector lengths.  Good. */
++            return;
++        }
++
++        /* Disabling a power-of-two disables all larger lengths. */
++        if (test_bit(0, cpu->sve_vq_init)) {
++            error_setg(errp, "cannot disable sve128");
++            error_append_hint(errp, "Disabling sve128 results in all vector "
++                              "lengths being disabled.\n");
++            error_append_hint(errp, "With SVE enabled, at least one vector "
++                              "length must be enabled.\n");
++            return;
++        }
++        for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
++            if (test_bit(vq - 1, cpu->sve_vq_init)) {
++                break;
++            }
++        }
++        max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
++
++        bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
++        max_vq = find_last_bit(cpu->sve_vq_map, max_vq) + 1;
++    }
++
++    /*
++     * Process the sve-max-vq property.
++     * Note that we know from the above that no bit above
++     * sve-max-vq is currently set.
++     */
++    if (cpu->sve_max_vq != 0) {
++        max_vq = cpu->sve_max_vq;
++
++        if (!test_bit(max_vq - 1, cpu->sve_vq_map) &&
++            test_bit(max_vq - 1, cpu->sve_vq_init)) {
++            error_setg(errp, "cannot disable sve%d", max_vq * 128);
++            error_append_hint(errp, "The maximum vector length must be "
++                              "enabled, sve-max-vq=%d (%d bits)\n",
++                              max_vq, max_vq * 128);
++            return;
++        }
++
++        /* Set all bits not explicitly set within sve-max-vq. */
++        bitmap_complement(tmp, cpu->sve_vq_init, max_vq);
++        bitmap_or(cpu->sve_vq_map, cpu->sve_vq_map, tmp, max_vq);
++    }
++
++    /*
++     * We should know what max-vq is now.  Also, as we're done
++     * manipulating sve-vq-map, we ensure any bits above max-vq
++     * are clear, just in case anybody looks.
++     */
++    assert(max_vq != 0);
++    bitmap_clear(cpu->sve_vq_map, max_vq, ARM_MAX_VQ - max_vq);
++
++    /* Ensure all required powers-of-two are enabled. */
++    for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
++        if (!test_bit(vq - 1, cpu->sve_vq_map)) {
++            error_setg(errp, "cannot disable sve%d", vq * 128);
++            error_append_hint(errp, "sve%d is required as it "
++                              "is a power-of-two length smaller than "
++                              "the maximum, sve%d\n",
++                              vq * 128, max_vq * 128);
++            return;
++        }
++    }
++
++    /*
++     * Now that we validated all our vector lengths, the only question
++     * left to answer is if we even want SVE at all.
++     */
++    if (!cpu_isar_feature(aa64_sve, cpu)) {
++        error_setg(errp, "cannot enable sve%d", max_vq * 128);
++        error_append_hint(errp, "SVE must be enabled to enable vector "
++                          "lengths.\n");
++        error_append_hint(errp, "Add sve=on to the CPU property list.\n");
++        return;
++    }
++
++    /* From now on sve_max_vq is the actual maximum supported length. */
++    cpu->sve_max_vq = max_vq;
++}
++
++uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq)
++{
++    uint32_t bitnum;
++
++    /*
++     * We allow vq == ARM_MAX_VQ + 1 to be input because the caller may want
++     * to find the maximum vq enabled, which may be ARM_MAX_VQ, but this
++     * function always returns the next smaller than the input.
++     */
++    assert(vq && vq <= ARM_MAX_VQ + 1);
++
++    bitnum = find_last_bit(cpu->sve_vq_map, vq - 1);
++    return bitnum == vq - 1 ? 0 : bitnum + 1;
++}
++
+ static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
+                                    void *opaque, Error **errp)
+ {
+@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
+     error_propagate(errp, err);
+ }
++static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
++                               void *opaque, Error **errp)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++    uint32_t vq = atoi(&name[3]) / 128;
++    bool value;
++
++    /* All vector lengths are disabled when SVE is off. */
++    if (!cpu_isar_feature(aa64_sve, cpu)) {
++        value = false;
++    } else {
++        value = test_bit(vq - 1, cpu->sve_vq_map);
++    }
++    visit_type_bool(v, name, &value, errp);
++}
++
++static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
++                               void *opaque, Error **errp)
++{
++    ARMCPU *cpu = ARM_CPU(obj);
++    uint32_t vq = atoi(&name[3]) / 128;
++    Error *err = NULL;
++    bool value;
++
++    visit_type_bool(v, name, &value, &err);
++    if (err) {
++        error_propagate(errp, err);
++        return;
++    }
++
++    if (value) {
++        set_bit(vq - 1, cpu->sve_vq_map);
++    } else {
++        clear_bit(vq - 1, cpu->sve_vq_map);
++    }
++    set_bit(vq - 1, cpu->sve_vq_init);
++}
++
+ static void cpu_arm_get_sve(Object *obj, Visitor *v, const char *name,
+                             void *opaque, Error **errp)
+ {
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
+ static void aarch64_max_initfn(Object *obj)
+ {
+     ARMCPU *cpu = ARM_CPU(obj);
++    uint32_t vq;
+     if (kvm_enabled()) {
+         kvm_arm_set_cpu_features_from_host(cpu);
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+         cpu->dcz_blocksize = 7; /*  512 bytes */
+ #endif
+-        cpu->sve_max_vq = ARM_MAX_VQ;
+         object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
+                             cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
+         object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
+                             cpu_arm_set_sve, NULL, NULL, &error_fatal);
++
++        for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
++            char name[8];
++            sprintf(name, "sve%d", vq * 128);
++            object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
++                                cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
++        }
+     }
+ }
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t tlbi_aa64_range_get_length(CPUARMState *env,
+@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
-     uint64_t exponent;
+     return 0;
-     uint64_t length;
+ }
--    num = extract64(value, 39, 4);
++static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
-+    num = extract64(value, 39, 5);
++{
-     scale = extract64(value, 44, 2);
++    uint32_t start_vq = (start_len & 0xf) + 1;
-     page_size_granule = extract64(value, 46, 2);
++
++    return arm_cpu_vq_map_next_smaller(cpu, start_vq + 1) - 1;
--    page_shift = page_size_granule * 2 + 12;
++}
--
++
-     if (page_size_granule == 0) {
+ /*
-         qemu_log_mask(LOG_GUEST_ERROR, "Invalid page size granule %d\n",
+  * Given that SVE is enabled, return the vector length for EL.
-                       page_size_granule);
+  */
-         return 0;
+@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
      if (arm_feature(env, ARM_FEATURE_EL3)) {
          zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
      }
+-    return zcr_len;
-+    page_shift = (page_size_granule - 1) * 2 + 12;
++
-+
++    return sve_zcr_get_valid_len(cpu, zcr_len);
-     exponent = (5 * scale) + 1;
+ }
-     length = (num + 1) << (exponent + page_shift);
  static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 diff --git a/target/arm/monitor.c b/target/arm/monitor.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/monitor.c
 +++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
      return head;
  }
 +QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
 +
  /*
   * These are cpu model features we want to advertise. The order here
   * matters as this is the order in which qmp_query_cpu_model_expansion
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
   */
  static const char *cpu_model_advertised_features[] = {
      "aarch64", "pmu", "sve",
 +    "sve128", "sve256", "sve384", "sve512",
 +    "sve640", "sve768", "sve896", "sve1024", "sve1152", "sve1280",
 +    "sve1408", "sve1536", "sve1664", "sve1792", "sve1920", "sve2048",
      NULL
  };
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
          if (!err) {
              visit_check_struct(visitor, &err);
          }
 +        if (!err) {
 +            arm_cpu_finalize_features(ARM_CPU(obj), &err);
 +        }
          visit_end_struct(visitor, NULL);
          visit_free(visitor);
          if (err) {
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
              error_propagate(errp, err);
              return NULL;
          }
 +    } else {
 +        Error *err = NULL;
 +        arm_cpu_finalize_features(ARM_CPU(obj), &err);
 +        assert(err == NULL);
      }
      expansion_info = g_new0(CpuModelExpansionInfo, 1);
 diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/arm-cpu-features.c
 +++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@
   * See the COPYING file in the top-level directory.
   */
  #include "qemu/osdep.h"
 +#include "qemu/bitops.h"
  #include "libqtest.h"
  #include "qapi/qmp/qdict.h"
  #include "qapi/qmp/qjson.h"
 +/*
 + * We expect the SVE max-vq to be 16. Also it must be <= 64
 + * for our test code, otherwise 'vls' can't just be a uint64_t.
 + */
 +#define SVE_MAX_VQ 16
 +
  #define MACHINE     "-machine virt,gic-version=max,accel=tcg "
  #define MACHINE_KVM "-machine virt,gic-version=max,accel=kvm:tcg "
  #define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
@@ -XXX,XX +XXX,XX @@ static void assert_bad_props(QTestState *qts, const char *cpu_type)
      qobject_unref(resp);
  }
 +static uint64_t resp_get_sve_vls(QDict *resp)
 +{
 +    QDict *props;
 +    const QDictEntry *e;
 +    uint64_t vls = 0;
 +    int n = 0;
 +
 +    g_assert(resp);
 +    g_assert(resp_has_props(resp));
 +
 +    props = resp_get_props(resp);
 +
 +    for (e = qdict_first(props); e; e = qdict_next(props, e)) {
 +        if (strlen(e->key) > 3 && !strncmp(e->key, "sve", 3) &&
 +            g_ascii_isdigit(e->key[3])) {
 +            char *endptr;
 +            int bits;
 +
 +            bits = g_ascii_strtoll(&e->key[3], &endptr, 10);
 +            if (!bits || *endptr != '\0') {
 +                continue;
 +            }
 +
 +            if (qdict_get_bool(props, e->key)) {
 +                vls |= BIT_ULL((bits / 128) - 1);
 +            }
 +            ++n;
 +        }
 +    }
 +
 +    g_assert(n == SVE_MAX_VQ);
 +
 +    return vls;
 +}
 +
 +#define assert_sve_vls(qts, cpu_type, expected_vls, fmt, ...)          \
 +({                                                                     \
 +    QDict *_resp = do_query(qts, cpu_type, fmt, ##__VA_ARGS__);        \
 +    g_assert(_resp);                                                   \
 +    g_assert(resp_has_props(_resp));                                   \
 +    g_assert(resp_get_sve_vls(_resp) == expected_vls);                 \
 +    qobject_unref(_resp);                                              \
 +})
 +
 +static void sve_tests_default(QTestState *qts, const char *cpu_type)
 +{
 +    /*
 +     * With no sve-max-vq or sve<N> properties on the command line
 +     * the default is to have all vector lengths enabled. This also
 +     * tests that 'sve' is 'on' by default.
 +     */
 +    assert_sve_vls(qts, cpu_type, BIT_ULL(SVE_MAX_VQ) - 1, NULL);
 +
 +    /* With SVE off, all vector lengths should also be off. */
 +    assert_sve_vls(qts, cpu_type, 0, "{ 'sve': false }");
 +
 +    /* With SVE on, we must have at least one vector length enabled. */
 +    assert_error(qts, cpu_type, "cannot disable sve128", "{ 'sve128': false }");
 +
 +    /* Basic enable/disable tests. */
 +    assert_sve_vls(qts, cpu_type, 0x7, "{ 'sve384': true }");
 +    assert_sve_vls(qts, cpu_type, ((BIT_ULL(SVE_MAX_VQ) - 1) & ~BIT_ULL(2)),
 +                   "{ 'sve384': false }");
 +
 +    /*
 +     * ---------------------------------------------------------------------
 +     *               power-of-two(vq)   all-power-            can      can
 +     *                                  of-two(< vq)        enable   disable
 +     * ---------------------------------------------------------------------
 +     * vq < max_vq      no                MUST*              yes      yes
 +     * vq < max_vq      yes               MUST*              yes      no
 +     * ---------------------------------------------------------------------
 +     * vq == max_vq     n/a               MUST*              yes**    yes**
 +     * ---------------------------------------------------------------------
 +     * vq > max_vq      n/a               no                 no       yes
 +     * vq > max_vq      n/a               yes                yes      yes
 +     * ---------------------------------------------------------------------
 +     *
 +     * [*] "MUST" means this requirement must already be satisfied,
 +     *     otherwise 'max_vq' couldn't itself be enabled.
 +     *
 +     * [**] Not testable with the QMP interface, only with the command line.
 +     */
 +
 +    /* max_vq := 8 */
 +    assert_sve_vls(qts, cpu_type, 0x8b, "{ 'sve1024': true }");
 +
 +    /* max_vq := 8, vq < max_vq, !power-of-two(vq) */
 +    assert_sve_vls(qts, cpu_type, 0x8f,
 +                   "{ 'sve1024': true, 'sve384': true }");
 +    assert_sve_vls(qts, cpu_type, 0x8b,
 +                   "{ 'sve1024': true, 'sve384': false }");
 +
 +    /* max_vq := 8, vq < max_vq, power-of-two(vq) */
 +    assert_sve_vls(qts, cpu_type, 0x8b,
 +                   "{ 'sve1024': true, 'sve256': true }");
 +    assert_error(qts, cpu_type, "cannot disable sve256",
 +                 "{ 'sve1024': true, 'sve256': false }");
 +
 +    /* max_vq := 3, vq > max_vq, !all-power-of-two(< vq) */
 +    assert_error(qts, cpu_type, "cannot disable sve512",
 +                 "{ 'sve384': true, 'sve512': false, 'sve640': true }");
 +
 +    /*
 +     * We can disable power-of-two vector lengths when all larger lengths
 +     * are also disabled. We only need to disable the power-of-two length,
 +     * as all non-enabled larger lengths will then be auto-disabled.
 +     */
 +    assert_sve_vls(qts, cpu_type, 0x7, "{ 'sve512': false }");
 +
 +    /* max_vq := 3, vq > max_vq, all-power-of-two(< vq) */
 +    assert_sve_vls(qts, cpu_type, 0x1f,
 +                   "{ 'sve384': true, 'sve512': true, 'sve640': true }");
 +    assert_sve_vls(qts, cpu_type, 0xf,
 +                   "{ 'sve384': true, 'sve512': true, 'sve640': false }");
 +}
 +
 +static void sve_tests_sve_max_vq_8(const void *data)
 +{
 +    QTestState *qts;
 +
 +    qts = qtest_init(MACHINE "-cpu max,sve-max-vq=8");
 +
 +    assert_sve_vls(qts, "max", BIT_ULL(8) - 1, NULL);
 +
 +    /*
 +     * Disabling the max-vq set by sve-max-vq is not allowed, but
 +     * of course enabling it is OK.
 +     */
 +    assert_error(qts, "max", "cannot disable sve1024", "{ 'sve1024': false }");
 +    assert_sve_vls(qts, "max", 0xff, "{ 'sve1024': true }");
 +
 +    /*
 +     * Enabling anything larger than max-vq set by sve-max-vq is not
 +     * allowed, but of course disabling everything larger is OK.
 +     */
 +    assert_error(qts, "max", "cannot enable sve1152", "{ 'sve1152': true }");
 +    assert_sve_vls(qts, "max", 0xff, "{ 'sve1152': false }");
 +
 +    /*
 +     * We can enable/disable non power-of-two lengths smaller than the
 +     * max-vq set by sve-max-vq, but, while we can enable power-of-two
 +     * lengths, we can't disable them.
 +     */
 +    assert_sve_vls(qts, "max", 0xff, "{ 'sve384': true }");
 +    assert_sve_vls(qts, "max", 0xfb, "{ 'sve384': false }");
 +    assert_sve_vls(qts, "max", 0xff, "{ 'sve256': true }");
 +    assert_error(qts, "max", "cannot disable sve256", "{ 'sve256': false }");
 +
 +    qtest_quit(qts);
 +}
 +
 +static void sve_tests_sve_off(const void *data)
 +{
 +    QTestState *qts;
 +
 +    qts = qtest_init(MACHINE "-cpu max,sve=off");
 +
 +    /* SVE is off, so the map should be empty. */
 +    assert_sve_vls(qts, "max", 0, NULL);
 +
 +    /* The map stays empty even if we turn lengths off. */
 +    assert_sve_vls(qts, "max", 0, "{ 'sve128': false }");
 +
 +    /* It's an error to enable lengths when SVE is off. */
 +    assert_error(qts, "max", "cannot enable sve128", "{ 'sve128': true }");
 +
 +    /* With SVE re-enabled we should get all vector lengths enabled. */
 +    assert_sve_vls(qts, "max", BIT_ULL(SVE_MAX_VQ) - 1, "{ 'sve': true }");
 +
 +    /* Or enable SVE with just specific vector lengths. */
 +    assert_sve_vls(qts, "max", 0x3,
 +                   "{ 'sve': true, 'sve128': true, 'sve256': true }");
 +
 +    qtest_quit(qts);
 +}
 +
  static void test_query_cpu_model_expansion(const void *data)
  {
      QTestState *qts;
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
      if (g_str_equal(qtest_get_arch(), "aarch64")) {
          assert_has_feature(qts, "max", "aarch64");
          assert_has_feature(qts, "max", "sve");
 +        assert_has_feature(qts, "max", "sve128");
          assert_has_feature(qts, "cortex-a57", "pmu");
          assert_has_feature(qts, "cortex-a57", "aarch64");
 +        sve_tests_default(qts, "max");
 +
          /* Test that features that depend on KVM generate errors without. */
          assert_error(qts, "max",
                       "'aarch64' feature cannot be disabled "
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
      qtest_add_data_func("/arm/kvm/query-cpu-model-expansion",
                          NULL, test_query_cpu_model_expansion_kvm);
 +    if (g_str_equal(qtest_get_arch(), "aarch64")) {
 +        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-max-vq-8",
 +                            NULL, sve_tests_sve_max_vq_8);
 +        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
 +                            NULL, sve_tests_sve_off);
 +    }
 +
      return g_test_run();
  }
 diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/arm-cpu-features.rst
 +++ b/docs/arm-cpu-features.rst
@@ -XXX,XX +XXX,XX @@ block in the script for usage) is used to issue the QMP commands.
        (QEMU) query-cpu-model-expansion type=full model={"name":"max"}
        { "return": {
          "model": { "name": "max", "props": {
 -        "pmu": true, "aarch64": true
 +        "sve1664": true, "pmu": true, "sve1792": true, "sve1920": true,
 +        "sve128": true, "aarch64": true, "sve1024": true, "sve": true,
 +        "sve640": true, "sve768": true, "sve1408": true, "sve256": true,
 +        "sve1152": true, "sve512": true, "sve384": true, "sve1536": true,
 +        "sve896": true, "sve1280": true, "sve2048": true
        }}}}
 -We see that the `max` CPU type has the `pmu` and `aarch64` CPU features.
 -We also see that the CPU features are enabled, as they are all `true`.
 +We see that the `max` CPU type has the `pmu`, `aarch64`, `sve`, and many
 +`sve<N>` CPU features.  We also see that all the CPU features are
 +enabled, as they are all `true`.  (The `sve<N>` CPU features are all
 +optional SVE vector lengths (see "SVE CPU Properties").  While with TCG
 +all SVE vector lengths can be supported, when KVM is in use it's more
 +likely that only a few lengths will be supported, if SVE is supported at
 +all.)
  (2) Let's try to disable the PMU::
        (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"pmu":false}}
        { "return": {
          "model": { "name": "max", "props": {
 -        "pmu": false, "aarch64": true
 +        "sve1664": true, "pmu": false, "sve1792": true, "sve1920": true,
 +        "sve128": true, "aarch64": true, "sve1024": true, "sve": true,
 +        "sve640": true, "sve768": true, "sve1408": true, "sve256": true,
 +        "sve1152": true, "sve512": true, "sve384": true, "sve1536": true,
 +        "sve896": true, "sve1280": true, "sve2048": true
        }}}}
  We see it worked, as `pmu` is now `false`.
@@ -XXX,XX +XXX,XX @@ We see it worked, as `pmu` is now `false`.
  It looks like this feature is limited to a configuration we do not
  currently have.
 -(4) Let's try probing CPU features for the Cortex-A15 CPU type::
 +(4) Let's disable `sve` and see what happens to all the optional SVE
 +    vector lengths::
 +
 +      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"sve":false}}
 +      { "return": {
 +        "model": { "name": "max", "props": {
 +        "sve1664": false, "pmu": true, "sve1792": false, "sve1920": false,
 +        "sve128": false, "aarch64": true, "sve1024": false, "sve": false,
 +        "sve640": false, "sve768": false, "sve1408": false, "sve256": false,
 +        "sve1152": false, "sve512": false, "sve384": false, "sve1536": false,
 +        "sve896": false, "sve1280": false, "sve2048": false
 +      }}}}
 +
 +As expected they are now all `false`.
 +
 +(5) Let's try probing CPU features for the Cortex-A15 CPU type::
        (QEMU) query-cpu-model-expansion type=full model={"name":"cortex-a15"}
        {"return": {"model": {"name": "cortex-a15", "props": {"pmu": true}}}}
@@ -XXX,XX +XXX,XX @@ After determining which CPU features are available and supported for a
  given CPU type, then they may be selectively enabled or disabled on the
  QEMU command line with that CPU type::
 -  $ qemu-system-aarch64 -M virt -cpu max,pmu=off
 +  $ qemu-system-aarch64 -M virt -cpu max,pmu=off,sve=on,sve128=on,sve256=on
 -The example above disables the PMU for the `max` CPU type.
 +The example above disables the PMU and enables the first two SVE vector
 +lengths for the `max` CPU type.  Note, the `sve=on` isn't actually
 +necessary, because, as we observed above with our probe of the `max` CPU
 +type, `sve` is already on by default.  Also, based on our probe of
 +defaults, it would seem we need to disable many SVE vector lengths, rather
 +than only enabling the two we want.  This isn't the case, because, as
 +disabling many SVE vector lengths would be quite verbose, the `sve<N>` CPU
 +properties have special semantics (see "SVE CPU Property Parsing
 +Semantics").
 +
 +SVE CPU Properties
 +==================
 +
 +There are two types of SVE CPU properties: `sve` and `sve<N>`.  The first
 +is used to enable or disable the entire SVE feature, just as the `pmu`
 +CPU property completely enables or disables the PMU.  The second type
 +is used to enable or disable specific vector lengths, where `N` is the
 +number of bits of the length.  The `sve<N>` CPU properties have special
 +dependencies and constraints, see "SVE CPU Property Dependencies and
 +Constraints" below.  Additionally, as we want all supported vector lengths
 +to be enabled by default, then, in order to avoid overly verbose command
 +lines (command lines full of `sve<N>=off`, for all `N` not wanted), we
 +provide the parsing semantics listed in "SVE CPU Property Parsing
 +Semantics".
 +
 +SVE CPU Property Dependencies and Constraints
 +---------------------------------------------
 +
 +  1) At least one vector length must be enabled when `sve` is enabled.
 +
 +  2) If a vector length `N` is enabled, then all power-of-two vector
 +     lengths smaller than `N` must also be enabled.  E.g. if `sve512`
 +     is enabled, then the 128-bit and 256-bit vector lengths must also
 +     be enabled.
 +
 +SVE CPU Property Parsing Semantics
 +----------------------------------
 +
 +  1) If SVE is disabled (`sve=off`), then which SVE vector lengths
 +     are enabled or disabled is irrelevant to the guest, as the entire
 +     SVE feature is disabled and that disables all vector lengths for
 +     the guest.  However QEMU will still track any `sve<N>` CPU
 +     properties provided by the user.  If later an `sve=on` is provided,
 +     then the guest will get only the enabled lengths.  If no `sve=on`
 +     is provided and there are explicitly enabled vector lengths, then
 +     an error is generated.
 +
 +  2) If SVE is enabled (`sve=on`), but no `sve<N>` CPU properties are
 +     provided, then all supported vector lengths are enabled, including
 +     the non-power-of-two lengths.
 +
 +  3) If SVE is enabled, then an error is generated when attempting to
 +     disable the last enabled vector length (see constraint (1) of "SVE
 +     CPU Property Dependencies and Constraints").
 +
 +  4) If one or more vector lengths have been explicitly enabled and at
 +     at least one of the dependency lengths of the maximum enabled length
 +     has been explicitly disabled, then an error is generated (see
 +     constraint (2) of "SVE CPU Property Dependencies and Constraints").
 +
 +  5) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
 +     CPU properties are set `on`, then the specified vector lengths are
 +     disabled but the default for any unspecified lengths remains enabled.
 +     Disabling a power-of-two vector length also disables all vector
 +     lengths larger than the power-of-two length (see constraint (2) of
 +     "SVE CPU Property Dependencies and Constraints").
 +
 +  6) If one or more `sve<N>` CPU properties are set to `on`, then they
 +     are enabled and all unspecified lengths default to disabled, except
 +     for the required lengths per constraint (2) of "SVE CPU Property
 +     Dependencies and Constraints", which will even be auto-enabled if
 +     they were not explicitly enabled.
 +
 +  7) If SVE was disabled (`sve=off`), allowing all vector lengths to be
 +     explicitly disabled (i.e. avoiding the error specified in (3) of
 +     "SVE CPU Property Parsing Semantics"), then if later an `sve=on` is
 +     provided an error will be generated.  To avoid this error, one must
 +     enable at least one vector length prior to enabling SVE.
 +
 +SVE CPU Property Examples
 +-------------------------
 +
 +  1) Disable SVE::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve=off
 +
 +  2) Implicitly enable all vector lengths for the `max` CPU type::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max
 +
 +  3) Only enable the 128-bit vector length::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve128=on
 +
 +  4) Disable the 512-bit vector length and all larger vector lengths,
 +     since 512 is a power-of-two.  This results in all the smaller,
 +     uninitialized lengths (128, 256, and 384) defaulting to enabled::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve512=off
 +
 +  5) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve128=on,sve256=on,sve512=on
 +
 +  6) The same as (5), but since the 128-bit and 256-bit vector
 +     lengths are required for the 512-bit vector length to be enabled,
 +     then allow them to be auto-enabled::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve512=on
 +
 +  7) Do the same as (6), but by first disabling SVE and then re-enabling it::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve512=on,sve=on
 +
 +  8) Force errors regarding the last vector length::
 +
 +     $ qemu-system-aarch64 -M virt -cpu max,sve128=off
 +     $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve128=off,sve=on
 +
 +SVE CPU Property Recommendations
 +--------------------------------
 +
 +The examples in "SVE CPU Property Examples" exhibit many ways to select
 +vector lengths which developers may find useful in order to avoid overly
 +verbose command lines.  However, the recommended way to select vector
 +lengths is to explicitly enable each desired length.  Therefore only
 +example's (1), (3), and (5) exhibit recommended uses of the properties.
 --
-.25.1
+.20.1

-[PULL 16/33] target/arm: Assert thumb pc is aligned
+[PULL 05/11] target/arm/kvm64: Add kvm_arch_get/put_sve
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-Misaligned thumb PC is architecturally impossible.
+These are the SVE equivalents to kvm_arch_get/put_fpsimd. Note, the
-Assert is better than proceeding, in case we've missed
+swabbing is different than it is for fpsmid because the vector format
-something somewhere.
+is a little-endian stream of words.
-Expand a comment about aligning the pc in gdbstub.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-Fail an incoming migrate if a thumb pc is misaligned.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20191031142734.8590-6-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/gdbstub.c   |  9 +++++++--
+ target/arm/kvm64.c | 185 ++++++++++++++++++++++++++++++++++++++-------
- target/arm/machine.c   | 10 ++++++++++
+file changed, 156 insertions(+), 29 deletions(-)
- target/arm/translate.c |  3 +++
-files changed, 20 insertions(+), 2 deletions(-)
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub.c
+--- a/target/arm/kvm64.c
-+++ b/target/arm/gdbstub.c
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_destroy_vcpu(CPUState *cs)
+ bool kvm_arm_reg_syncs_via_cpreg_list(uint64_t regidx)
-     tmp = ldl_p(mem_buf);
+ {
+     /* Return true if the regidx is a register we should synchronize
--    /* Mask out low bit of PC to workaround gdb bugs.  This will probably
+-     * via the cpreg_tuples array (ie is not a core reg we sync by
--       cause problems if we ever implement the Jazelle DBX extensions.  */
+-     * hand in kvm_arch_get/put_registers())
-+    /*
++     * via the cpreg_tuples array (ie is not a core or sve reg that
-+     * Mask out low bits of PC to workaround gdb bugs.
++     * we sync by hand in kvm_arch_get/put_registers())
-+     * This avoids an assert in thumb_tr_translate_insn, because it is
+      */
-+     * architecturally impossible to misalign the pc.
+     switch (regidx & KVM_REG_ARM_COPROC_MASK) {
-+     * This will probably cause problems if we ever implement the
+     case KVM_REG_ARM_CORE:
-+     * Jazelle DBX extensions.
++    case KVM_REG_ARM64_SVE:
-+     */
+         return false;
-     if (n == 15) {
+     default:
-         tmp &= ~1;
+         return true;
-     }
+@@ -XXX,XX +XXX,XX @@ int kvm_arm_cpreg_level(uint64_t regidx)
-diff --git a/target/arm/machine.c b/target/arm/machine.c
-index XXXXXXX..XXXXXXX 100644
+ static int kvm_arch_put_fpsimd(CPUState *cs)
---- a/target/arm/machine.c
+ {
-+++ b/target/arm/machine.c
+-    ARMCPU *cpu = ARM_CPU(cs);
-@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
+-    CPUARMState *env = &cpu->env;
-             return -1;
++    CPUARMState *env = &ARM_CPU(cs)->env;
      struct kvm_one_reg reg;
 -    uint32_t fpr;
      int i, ret;
      for (i = 0; i < 32; i++) {
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_fpsimd(CPUState *cs)
          }
      }
-+
-+    /*
+-    reg.addr = (uintptr_t)(&fpr);
-+     * Misaligned thumb pc is architecturally impossible.
+-    fpr = vfp_get_fpsr(env);
-+     * We have an assert in thumb_tr_translate_insn to verify this.
+-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-+     * Fail an incoming migrate to avoid this assert.
+-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-+     */
+-    if (ret) {
-+    if (!is_a64(env) && env->thumb && (env->regs[15] & 1)) {
+-        return ret;
-+        return -1;
++    return 0;
-+    }
++}
 +
-     if (!kvm_enabled()) {
++/*
-         pmu_op_finish(&cpu->env);
++ * SVE registers are encoded in KVM's memory in an endianness-invariant format.
-     }
++ * The byte at offset i from the start of the in-memory representation contains
-diff --git a/target/arm/translate.c b/target/arm/translate.c
++ * the bits [(7 + 8 * i) : (8 * i)] of the register value. As this means the
-index XXXXXXX..XXXXXXX 100644
++ * lowest offsets are stored in the lowest memory addresses, then that nearly
---- a/target/arm/translate.c
++ * matches QEMU's representation, which is to use an array of host-endian
-+++ b/target/arm/translate.c
++ * uint64_t's, where the lower offsets are at the lower indices. To complete
-@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
++ * the translation we just need to byte swap the uint64_t's on big-endian hosts.
-     uint32_t insn;
++ */
-     bool is_16bit;
++static uint64_t *sve_bswap64(uint64_t *dst, uint64_t *src, int nr)
++{
-+    /* Misaligned thumb PC is architecturally impossible. */
++#ifdef HOST_WORDS_BIGENDIAN
-+    assert((dc->base.pc_next & 1) == 0);
++    int i;
 +
-     if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {
++    for (i = 0; i < nr; ++i) {
-         dc->base.pc_next = pc + 2;
++        dst[i] = bswap64(src[i]);
-         return;
+     }
 -    reg.addr = (uintptr_t)(&fpr);
 -    fpr = vfp_get_fpcr(env);
 -    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
 +    return dst;
 +#else
 +    return src;
 +#endif
 +}
 +
 +/*
 + * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
 + * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
 + * code the slice index to zero for now as it's unlikely we'll need more than
 + * one slice for quite some time.
 + */
 +static int kvm_arch_put_sve(CPUState *cs)
 +{
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    CPUARMState *env = &cpu->env;
 +    uint64_t tmp[ARM_MAX_VQ * 2];
 +    uint64_t *r;
 +    struct kvm_one_reg reg;
 +    int n, ret;
 +
 +    for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
 +        r = sve_bswap64(tmp, &env->vfp.zregs[n].d[0], cpu->sve_max_vq * 2);
 +        reg.addr = (uintptr_t)r;
 +        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
 +        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +        if (ret) {
 +            return ret;
 +        }
 +    }
 +
 +    for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
 +        r = sve_bswap64(tmp, r = &env->vfp.pregs[n].p[0],
 +                        DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
 +        reg.addr = (uintptr_t)r;
 +        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
 +        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +        if (ret) {
 +            return ret;
 +        }
 +    }
 +
 +    r = sve_bswap64(tmp, &env->vfp.pregs[FFR_PRED_NUM].p[0],
 +                    DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
 +    reg.addr = (uintptr_t)r;
 +    reg.id = KVM_REG_ARM64_SVE_FFR(0);
      ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
      if (ret) {
          return ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
  {
      struct kvm_one_reg reg;
      uint64_t val;
 +    uint32_t fpr;
      int i, ret;
      unsigned int el;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
          }
      }
 -    ret = kvm_arch_put_fpsimd(cs);
 +    if (cpu_isar_feature(aa64_sve, cpu)) {
 +        ret = kvm_arch_put_sve(cs);
 +    } else {
 +        ret = kvm_arch_put_fpsimd(cs);
 +    }
 +    if (ret) {
 +        return ret;
 +    }
 +
 +    reg.addr = (uintptr_t)(&fpr);
 +    fpr = vfp_get_fpsr(env);
 +    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
 +    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +    if (ret) {
 +        return ret;
 +    }
 +
 +    reg.addr = (uintptr_t)(&fpr);
 +    fpr = vfp_get_fpcr(env);
 +    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
 +    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
      if (ret) {
          return ret;
      }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
  static int kvm_arch_get_fpsimd(CPUState *cs)
  {
 -    ARMCPU *cpu = ARM_CPU(cs);
 -    CPUARMState *env = &cpu->env;
 +    CPUARMState *env = &ARM_CPU(cs)->env;
      struct kvm_one_reg reg;
 -    uint32_t fpr;
      int i, ret;
      for (i = 0; i < 32; i++) {
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_fpsimd(CPUState *cs)
          }
      }
 -    reg.addr = (uintptr_t)(&fpr);
 -    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
 -    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 -    if (ret) {
 -        return ret;
 -    }
 -    vfp_set_fpsr(env, fpr);
 +    return 0;
 +}
 -    reg.addr = (uintptr_t)(&fpr);
 -    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
 +/*
 + * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
 + * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
 + * code the slice index to zero for now as it's unlikely we'll need more than
 + * one slice for quite some time.
 + */
 +static int kvm_arch_get_sve(CPUState *cs)
 +{
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    CPUARMState *env = &cpu->env;
 +    struct kvm_one_reg reg;
 +    uint64_t *r;
 +    int n, ret;
 +
 +    for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
 +        r = &env->vfp.zregs[n].d[0];
 +        reg.addr = (uintptr_t)r;
 +        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
 +        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +        if (ret) {
 +            return ret;
 +        }
 +        sve_bswap64(r, r, cpu->sve_max_vq * 2);
 +    }
 +
 +    for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
 +        r = &env->vfp.pregs[n].p[0];
 +        reg.addr = (uintptr_t)r;
 +        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
 +        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +        if (ret) {
 +            return ret;
 +        }
 +        sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
 +    }
 +
 +    r = &env->vfp.pregs[FFR_PRED_NUM].p[0];
 +    reg.addr = (uintptr_t)r;
 +    reg.id = KVM_REG_ARM64_SVE_FFR(0);
      ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
      if (ret) {
          return ret;
      }
 -    vfp_set_fpcr(env, fpr);
 +    sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
      struct kvm_one_reg reg;
      uint64_t val;
      unsigned int el;
 +    uint32_t fpr;
      int i, ret;
      ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
          env->spsr = env->banked_spsr[i];
      }
 -    ret = kvm_arch_get_fpsimd(cs);
 +    if (cpu_isar_feature(aa64_sve, cpu)) {
 +        ret = kvm_arch_get_sve(cs);
 +    } else {
 +        ret = kvm_arch_get_fpsimd(cs);
 +    }
      if (ret) {
          return ret;
      }
 +    reg.addr = (uintptr_t)(&fpr);
 +    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
 +    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    if (ret) {
 +        return ret;
 +    }
 +    vfp_set_fpsr(env, fpr);
 +
 +    reg.addr = (uintptr_t)(&fpr);
 +    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
 +    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
 +    if (ret) {
 +        return ret;
 +    }
 +    vfp_set_fpcr(env, fpr);
 +
      ret = kvm_get_vcpu_events(cpu);
      if (ret) {
          return ret;
 --
-.25.1
+.20.1

-[PULL 15/33] target/arm: Take an exception if PC is misaligned
+[PULL 06/11] target/arm/kvm64: max cpu: Enable SVE when available
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-For A64, any input to an indirect branch can cause this.
+Enable SVE in the KVM guest when the 'max' cpu type is configured
+and KVM supports it. KVM SVE requires use of the new finalize
-For A32, many indirect branch paths force the branch to be aligned,
+vcpu ioctl, so we add that now too. For starters SVE can only be
-but BXWritePC does not.  This includes the BX instruction but also
+turned on or off, getting all vector lengths the host CPU supports
-other interworking changes to PC.  Prior to v8, this case is UNDEFINED.
+when on. We'll add the other SVE CPU properties in later patches.
-With v8, this is CONSTRAINED UNPREDICTABLE and may either raise an
-exception or force align the PC.
+Signed-off-by: Andrew Jones <drjones@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-We choose to raise an exception because we have the infrastructure,
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-it makes the generated code for gen_bx simpler, and it has the
+Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
-possibility of catching more guest bugs.
+Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
+Message-id: 20191031142734.8590-7-drjones@redhat.com
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h           |  1 +
+ target/arm/kvm_arm.h     | 27 +++++++++++++++++++++++++++
- target/arm/syndrome.h         |  5 ++++
+ target/arm/cpu64.c       | 17 ++++++++++++++---
- linux-user/aarch64/cpu_loop.c | 46 ++++++++++++++++++++---------------
+ target/arm/kvm.c         |  5 +++++
- target/arm/tlb_helper.c       | 18 ++++++++++++++
+ target/arm/kvm64.c       | 20 +++++++++++++++++++-
- target/arm/translate-a64.c    | 15 ++++++++++++
+ tests/arm-cpu-features.c |  4 ++++
- target/arm/translate.c        | 22 ++++++++++++++++-
+files changed, 69 insertions(+), 4 deletions(-)
-files changed, 87 insertions(+), 20 deletions(-)
+diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/kvm_arm.h
---- a/target/arm/helper.h
++++ b/target/arm/kvm_arm.h
-+++ b/target/arm/helper.h
+@@ -XXX,XX +XXX,XX @@
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
+  */
- DEF_HELPER_2(exception_internal, void, env, i32)
+ int kvm_arm_vcpu_init(CPUState *cs);
- DEF_HELPER_4(exception_with_syndrome, void, env, i32, i32, i32)
- DEF_HELPER_2(exception_bkpt_insn, void, env, i32)
++/**
-+DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
++ * kvm_arm_vcpu_finalize
- DEF_HELPER_1(setend, void, env)
++ * @cs: CPUState
- DEF_HELPER_2(wfi, void, env, i32)
++ * @feature: int
- DEF_HELPER_1(wfe, void, env)
++ *
-diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
++ * Finalizes the configuration of the specified VCPU feature by
-index XXXXXXX..XXXXXXX 100644
++ * invoking the KVM_ARM_VCPU_FINALIZE ioctl. Features requiring
---- a/target/arm/syndrome.h
++ * this are documented in the "KVM_ARM_VCPU_FINALIZE" section of
-+++ b/target/arm/syndrome.h
++ * KVM's API documentation.
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_illegalstate(void)
++ *
-     return (EC_ILLEGALSTATE << ARM_EL_EC_SHIFT) | ARM_EL_IL;
++ * Returns: 0 if success else < 0 error code
- }
++ */
++int kvm_arm_vcpu_finalize(CPUState *cs, int feature);
-+static inline uint32_t syn_pcalignment(void)
++
  /**
   * kvm_arm_register_device:
   * @mr: memory region for this device
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_aarch32_supported(CPUState *cs);
   */
  bool kvm_arm_pmu_supported(CPUState *cs);
 +/**
 + * bool kvm_arm_sve_supported:
 + * @cs: CPUState
 + *
 + * Returns true if the KVM VCPU can enable SVE and false otherwise.
 + */
 +bool kvm_arm_sve_supported(CPUState *cs);
 +
  /**
   * kvm_arm_get_max_vm_ipa_size - Returns the number of bits in the
   * IPA address space supported by KVM
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_pmu_supported(CPUState *cs)
      return false;
  }
 +static inline bool kvm_arm_sve_supported(CPUState *cs)
 +{
-+    return (EC_PCALIGNMENT << ARM_EL_EC_SHIFT) | ARM_EL_IL;
++    return false;
 +}
 +
- #endif /* TARGET_ARM_SYNDROME_H */
+ static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
-diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
+ {
-index XXXXXXX..XXXXXXX 100644
+     return -ENOENT;
---- a/linux-user/aarch64/cpu_loop.c
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-+++ b/linux-user/aarch64/cpu_loop.c
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
+--- a/target/arm/cpu64.c
-             break;
++++ b/target/arm/cpu64.c
-         case EXCP_PREFETCH_ABORT:
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
          case EXCP_DATA_ABORT:
 -            /* We should only arrive here with EC in {DATAABORT, INSNABORT}. */
              ec = syn_get_ec(env->exception.syndrome);
 -            assert(ec == EC_DATAABORT || ec == EC_INSNABORT);
 -
 -            /* Both EC have the same format for FSC, or close enough. */
 -            fsc = extract32(env->exception.syndrome, 0, 6);
 -            switch (fsc) {
 -            case 0x04 ... 0x07: /* Translation fault, level {0-3} */
 -                si_signo = TARGET_SIGSEGV;
 -                si_code = TARGET_SEGV_MAPERR;
 +            switch (ec) {
 +            case EC_DATAABORT:
 +            case EC_INSNABORT:
 +                /* Both EC have the same format for FSC, or close enough. */
 +                fsc = extract32(env->exception.syndrome, 0, 6);
 +                switch (fsc) {
 +                case 0x04 ... 0x07: /* Translation fault, level {0-3} */
 +                    si_signo = TARGET_SIGSEGV;
 +                    si_code = TARGET_SEGV_MAPERR;
 +                    break;
 +                case 0x09 ... 0x0b: /* Access flag fault, level {1-3} */
 +                case 0x0d ... 0x0f: /* Permission fault, level {1-3} */
 +                    si_signo = TARGET_SIGSEGV;
 +                    si_code = TARGET_SEGV_ACCERR;
 +                    break;
 +                case 0x11: /* Synchronous Tag Check Fault */
 +                    si_signo = TARGET_SIGSEGV;
 +                    si_code = TARGET_SEGV_MTESERR;
 +                    break;
 +                case 0x21: /* Alignment fault */
 +                    si_signo = TARGET_SIGBUS;
 +                    si_code = TARGET_BUS_ADRALN;
 +                    break;
 +                default:
 +                    g_assert_not_reached();
 +                }
                  break;
 -            case 0x09 ... 0x0b: /* Access flag fault, level {1-3} */
 -            case 0x0d ... 0x0f: /* Permission fault, level {1-3} */
 -                si_signo = TARGET_SIGSEGV;
 -                si_code = TARGET_SEGV_ACCERR;
 -                break;
 -            case 0x11: /* Synchronous Tag Check Fault */
 -                si_signo = TARGET_SIGSEGV;
 -                si_code = TARGET_SEGV_MTESERR;
 -                break;
 -            case 0x21: /* Alignment fault */
 +            case EC_PCALIGNMENT:
                  si_signo = TARGET_SIGBUS;
                  si_code = TARGET_BUS_ADRALN;
                  break;
 diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tlb_helper.c
 +++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "internals.h"
  #include "exec/exec-all.h"
 +#include "exec/helper-proto.h"
  static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
                                              unsigned int target_el,
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
      arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi);
  }
 +void helper_exception_pc_alignment(CPUARMState *env, target_ulong pc)
 +{
 +    ARMMMUFaultInfo fi = { .type = ARMFault_Alignment };
 +    int target_el = exception_target_el(env);
 +    int mmu_idx = cpu_mmu_index(env, true);
 +    uint32_t fsc;
 +
 +    env->exception.vaddress = pc;
 +
 +    /*
 +     * Note that the fsc is not applicable to this exception,
 +     * since any syndrome is pcalignment not insn_abort.
 +     */
 +    env->exception.fsr = compute_fsr_fsc(env, &fi, target_el, mmu_idx, &fsc);
 +    raise_exception(env, EXCP_PREFETCH_ABORT, syn_pcalignment(), target_el);
 +}
 +
  #if !defined(CONFIG_USER_ONLY)
  /*
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
      uint64_t pc = s->base.pc_next;
      uint32_t insn;
 +    /* Singlestep exceptions have the highest priority. */
      if (s->ss_active && !s->pstate_ss) {
          /* Singlestep state is Active-pending.
           * If we're in this state at the start of a TB then either
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
          return;
      }
-+    if (pc & 3) {
++    if (value && kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
-+        /*
++        error_setg(errp, "'sve' feature not supported by KVM on this host");
 +         * PC alignment fault.  This has priority over the instruction abort
 +         * that we would receive from a translation fault via arm_ldl_code.
 +         * This should only be possible after an indirect branch, at the
 +         * start of the TB.
 +         */
 +        assert(s->base.num_insns == 1);
 +        gen_helper_exception_pc_alignment(cpu_env, tcg_constant_tl(pc));
 +        s->base.is_jmp = DISAS_NORETURN;
 +        s->base.pc_next = QEMU_ALIGN_UP(pc, 4);
 +        return;
 +    }
 +
-     s->pc_curr = pc;
+     t = cpu->isar.id_aa64pfr0;
-     insn = arm_ldl_code(env, &s->base, pc, s->sctlr_b);
+     t = FIELD_DP64(t, ID_AA64PFR0, SVE, value);
-     s->insn = insn;
+     cpu->isar.id_aa64pfr0 = t;
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-index XXXXXXX..XXXXXXX 100644
+ {
---- a/target/arm/translate.c
+     ARMCPU *cpu = ARM_CPU(obj);
-+++ b/target/arm/translate.c
+     uint32_t vq;
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
++    uint64_t t;
-     uint32_t pc = dc->base.pc_next;
-     unsigned int insn;
+     if (kvm_enabled()) {
+         kvm_arm_set_cpu_features_from_host(cpu);
--    if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {
++        if (kvm_arm_sve_supported(CPU(cpu))) {
-+    /* Singlestep exceptions have the highest priority. */
++            t = cpu->isar.id_aa64pfr0;
-+    if (arm_check_ss_active(dc)) {
++            t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-+        dc->base.pc_next = pc + 4;
++            cpu->isar.id_aa64pfr0 = t;
-+        return;
++        }
      } else {
 -        uint64_t t;
          uint32_t u;
          aarch64_a57_initfn(obj);
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                              cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
 -        object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
 -                            cpu_arm_set_sve, NULL, NULL, &error_fatal);
          for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
              char name[8];
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
                                  cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
          }
      }
 +
 +    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
 +                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
  }
  struct ARMCPUInfo {
 diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm.c
 +++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vcpu_init(CPUState *cs)
      return kvm_vcpu_ioctl(cs, KVM_ARM_VCPU_INIT, &init);
  }
 +int kvm_arm_vcpu_finalize(CPUState *cs, int feature)
 +{
 +    return kvm_vcpu_ioctl(cs, KVM_ARM_VCPU_FINALIZE, &feature);
 +}
 +
  void kvm_arm_init_serror_injection(CPUState *cs)
  {
      cap_has_inject_serror_esr = kvm_check_extension(cs->kvm_state,
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_aarch32_supported(CPUState *cpu)
      return kvm_check_extension(s, KVM_CAP_ARM_EL1_32BIT);
  }
 +bool kvm_arm_sve_supported(CPUState *cpu)
 +{
 +    KVMState *s = KVM_STATE(current_machine->accelerator);
 +
 +    return kvm_check_extension(s, KVM_CAP_ARM_SVE);
 +}
 +
  #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
  int kvm_arch_init_vcpu(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
          cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_EL1_32BIT;
      }
      if (!kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PMU_V3)) {
 -            cpu->has_pmu = false;
 +        cpu->has_pmu = false;
      }
      if (cpu->has_pmu) {
          cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PMU_V3;
      } else {
          unset_feature(&env->features, ARM_FEATURE_PMU);
      }
 +    if (cpu_isar_feature(aa64_sve, cpu)) {
 +        assert(kvm_arm_sve_supported(cs));
 +        cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_SVE;
 +    }
-+
-+    if (pc & 3) {
+     /* Do KVM_ARM_VCPU_INIT ioctl */
-+        /*
+     ret = kvm_arm_vcpu_init(cs);
-+         * PC alignment fault.  This has priority over the instruction abort
+@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
-+         * that we would receive from a translation fault via arm_ldl_code
+         return ret;
-+         * (or the execution of the kernelpage entrypoint). This should only
+     }
-+         * be possible after an indirect branch, at the start of the TB.
-+         */
++    if (cpu_isar_feature(aa64_sve, cpu)) {
-+        assert(dc->base.num_insns == 1);
++        ret = kvm_arm_vcpu_finalize(cs, KVM_ARM_VCPU_SVE);
-+        gen_helper_exception_pc_alignment(cpu_env, tcg_constant_tl(pc));
++        if (ret) {
-+        dc->base.is_jmp = DISAS_NORETURN;
++            return ret;
-+        dc->base.pc_next = QEMU_ALIGN_UP(pc, 4);
++        }
 +        return;
 +    }
 +
-+    if (arm_check_kernelpage(dc)) {
+     /*
-         dc->base.pc_next = pc + 4;
+      * When KVM is in use, PSCI is emulated in-kernel and not by qemu.
-         return;
+      * Currently KVM has its own idea about MPIDR assignment, so we
-     }
+diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/arm-cpu-features.c
 +++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
          assert_has_feature(qts, "host", "aarch64");
          assert_has_feature(qts, "host", "pmu");
 +        assert_has_feature(qts, "max", "sve");
 +
          assert_error(qts, "cortex-a15",
              "We cannot guarantee the CPU type 'cortex-a15' works "
              "with KVM on this host", NULL);
      } else {
          assert_has_not_feature(qts, "host", "aarch64");
          assert_has_not_feature(qts, "host", "pmu");
 +
 +        assert_has_not_feature(qts, "max", "sve");
      }
      qtest_quit(qts);
 --
-.25.1
+.20.1

-[PULL 14/33] target/arm: Split compute_fsr_fsc out of arm_deliver_fault
+[PULL 07/11] target/arm/kvm: scratch vcpu: Preserve input kvm_vcpu_init features
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-We will reuse this section of arm_deliver_fault for
+kvm_arm_create_scratch_host_vcpu() takes a struct kvm_vcpu_init
-raising pc alignment faults.
+parameter. Rather than just using it as an output parameter to
 pass back the preferred target, use it also as an input parameter,
 allowing a caller to pass a selected target if they wish and to
 also pass cpu features. If the caller doesn't want to select a
 target they can pass -1 for the target which indicates they want
 to use the preferred target and have it passed back like before.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
 Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
 Message-id: 20191031142734.8590-8-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/tlb_helper.c | 45 +++++++++++++++++++++++++----------------
+ target/arm/kvm.c   | 20 +++++++++++++++-----
-file changed, 28 insertions(+), 17 deletions(-)
+ target/arm/kvm32.c |  6 +++++-
  target/arm/kvm64.c |  6 +++++-
 files changed, 25 insertions(+), 7 deletions(-)
-diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
+diff --git a/target/arm/kvm.c b/target/arm/kvm.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/tlb_helper.c
+--- a/target/arm/kvm.c
-+++ b/target/arm/tlb_helper.c
++++ b/target/arm/kvm.c
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
-     return syn;
+                                       int *fdarray,
- }
+                                       struct kvm_vcpu_init *init)
 -static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,
 -                                            MMUAccessType access_type,
 -                                            int mmu_idx, ARMMMUFaultInfo *fi)
 +static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
 +                                int target_el, int mmu_idx, uint32_t *ret_fsc)
  {
--    CPUARMState *env = &cpu->env;
+-    int ret, kvmfd = -1, vmfd = -1, cpufd = -1;
--    int target_el;
++    int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
--    bool same_el;
--    uint32_t syn, exc, fsr, fsc;
+     kvmfd = qemu_open("/dev/kvm", O_RDWR);
-     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
+     if (kvmfd < 0) {
--
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
--    target_el = exception_target_el(env);
+         goto finish;
 -    if (fi->stage2) {
 -        target_el = 2;
 -        env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
 -        if (arm_is_secure_below_el3(env) && fi->s1ns) {
 -            env->cp15.hpfar_el2 |= HPFAR_NS;
 -        }
 -    }
 -    same_el = (arm_current_el(env) == target_el);
 +    uint32_t fsr, fsc;
      if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
          arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
@@ -XXX,XX +XXX,XX @@ static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,
          fsc = 0x3f;
      }
-+    *ret_fsc = fsc;
+-    ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, init);
-+    return fsr;
++    if (init->target == -1) {
-+}
++        struct kvm_vcpu_init preferred;
 +
-+static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,
++        ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, &preferred);
-+                                            MMUAccessType access_type,
++        if (!ret) {
-+                                            int mmu_idx, ARMMMUFaultInfo *fi)
++            init->target = preferred.target;
 +{
 +    CPUARMState *env = &cpu->env;
 +    int target_el;
 +    bool same_el;
 +    uint32_t syn, exc, fsr, fsc;
 +
 +    target_el = exception_target_el(env);
 +    if (fi->stage2) {
 +        target_el = 2;
 +        env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
 +        if (arm_is_secure_below_el3(env) && fi->s1ns) {
 +            env->cp15.hpfar_el2 |= HPFAR_NS;
 +        }
 +    }
-+    same_el = (arm_current_el(env) == target_el);
+     if (ret >= 0) {
          ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
          if (ret < 0) {
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
           * creating one kind of guest CPU which is its preferred
           * CPU type.
           */
 +        struct kvm_vcpu_init try;
 +
-+    fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
+         while (*cpus_to_try != QEMU_KVM_ARM_TARGET_NONE) {
-+
+-            init->target = *cpus_to_try++;
-     if (access_type == MMU_INST_FETCH) {
+-            memset(init->features, 0, sizeof(init->features));
-         syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
+-            ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
-         exc = EXCP_PREFETCH_ABORT;
++            try.target = *cpus_to_try++;
 +            memcpy(try.features, init->features, sizeof(init->features));
 +            ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, &try);
              if (ret >= 0) {
                  break;
              }
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
          if (ret < 0) {
              goto err;
          }
 +        init->target = try.target;
      } else {
          /* Treat a NULL cpus_to_try argument the same as an empty
           * list, which means we will fail the call since this must
 diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm32.c
 +++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          QEMU_KVM_ARM_TARGET_CORTEX_A15,
          QEMU_KVM_ARM_TARGET_NONE
      };
 -    struct kvm_vcpu_init init;
 +    /*
 +     * target = -1 informs kvm_arm_create_scratch_host_vcpu()
 +     * to use the preferred target
 +     */
 +    struct kvm_vcpu_init init = { .target = -1, };
      if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
          return false;
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
          KVM_ARM_TARGET_CORTEX_A57,
          QEMU_KVM_ARM_TARGET_NONE
      };
 -    struct kvm_vcpu_init init;
 +    /*
 +     * target = -1 informs kvm_arm_create_scratch_host_vcpu()
 +     * to use the preferred target
 +     */
 +    struct kvm_vcpu_init init = { .target = -1, };
      if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
          return false;
 --
-.25.1
+.20.1

-[PULL 01/33] hw/intc: clean-up error reporting for failed ITS cmd
+[PULL 08/11] target/arm/cpu64: max cpu: Support sve properties with KVM
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Andrew Jones <drjones@redhat.com>
-While trying to debug a GIC ITS failure I saw some guest errors that
+Extend the SVE vq map initialization and validation with KVM's
-had poor formatting as well as leaving me confused as to what failed.
+supported vector lengths when KVM is enabled. In order to determine
-As most of the checks aren't possible without a valid dte split that
+and select supported lengths we add two new KVM functions for getting
-check apart and then check the other conditions in steps. This avoids
+and setting the KVM_REG_ARM64_SVE_VLS pseudo-register.
 us relying on undefined data.
-I still get a failure with the current kvm-unit-tests but at least I
+This patch has been co-authored with Richard Henderson, who reworked
-know (partially) why now:
+the target/arm/cpu64.c changes in order to push all the validation and
 auto-enabling/disabling steps into the finalizer, resulting in a nice
 LOC reduction.
-  Exception return from AArch64 EL1 to AArch64 EL1 PC 0x40080588
+Signed-off-by: Andrew Jones <drjones@redhat.com>
-  PASS: gicv3: its-trigger: inv/invall: dev2/eventid=20 now triggers an LPI
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-  ITS: MAPD devid=2 size = 0x8 itt=0x40430000 valid=0
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-  INT dev_id=2 event_id=20
+Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
-  process_its_cmd: invalid command attributes: invalid dte: 0 for 2 (MEM_TX: 0)
+Message-id: 20191031142734.8590-9-drjones@redhat.com
   PASS: gicv3: its-trigger: mapd valid=false: no LPI after device unmap
   SUMMARY: 6 tests, 1 unexpected failures
 Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20211112170454.3158925-1-alex.bennee@linaro.org
 Cc: Shashi Mallela <shashi.mallela@linaro.org>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/intc/arm_gicv3_its.c | 39 +++++++++++++++++++++++++++------------
+ target/arm/kvm_arm.h      |  12 +++
-file changed, 27 insertions(+), 12 deletions(-)
+ target/arm/cpu64.c        | 176 ++++++++++++++++++++++++++++----------
  target/arm/kvm64.c        | 100 +++++++++++++++++++++-
  tests/arm-cpu-features.c  | 104 +++++++++++++++++++++-
  docs/arm-cpu-features.rst |  45 +++++++---
 files changed, 379 insertions(+), 58 deletions(-)
-diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
+diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3_its.c
+--- a/target/arm/kvm_arm.h
-+++ b/hw/intc/arm_gicv3_its.c
++++ b/target/arm/kvm_arm.h
-@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
+@@ -XXX,XX +XXX,XX @@ typedef struct ARMHostCPUFeatures {
-         if (res != MEMTX_OK) {
+  */
-             return result;
+ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf);
 +/**
 + * kvm_arm_sve_get_vls:
 + * @cs: CPUState
 + * @map: bitmap to fill in
 + *
 + * Get all the SVE vector lengths supported by the KVM host, setting
 + * the bits corresponding to their length in quadwords minus one
 + * (vq - 1) in @map up to ARM_MAX_VQ.
 + */
 +void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map);
 +
  /**
   * kvm_arm_set_cpu_features_from_host:
   * @cpu: ARMCPU to set the features for
@@ -XXX,XX +XXX,XX @@ static inline int kvm_arm_vgic_probe(void)
  static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq) {}
  static inline void kvm_arm_pmu_init(CPUState *cs) {}
 +static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map) {}
  #endif
  static inline const char *gic_class_name(void)
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
       * any of the above.  Finally, if SVE is not disabled, then at least one
       * vector length must be enabled.
       */
 +    DECLARE_BITMAP(kvm_supported, ARM_MAX_VQ);
      DECLARE_BITMAP(tmp, ARM_MAX_VQ);
      uint32_t vq, max_vq = 0;
 +    /* Collect the set of vector lengths supported by KVM. */
 +    bitmap_zero(kvm_supported, ARM_MAX_VQ);
 +    if (kvm_enabled() && kvm_arm_sve_supported(CPU(cpu))) {
 +        kvm_arm_sve_get_vls(CPU(cpu), kvm_supported);
 +    } else if (kvm_enabled()) {
 +        assert(!cpu_isar_feature(aa64_sve, cpu));
 +    }
 +
      /*
       * Process explicit sve<N> properties.
       * From the properties, sve_vq_map<N> implies sve_vq_init<N>.
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
              return;
          }
 -        /* Propagate enabled bits down through required powers-of-two. */
 -        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
 -            if (!test_bit(vq - 1, cpu->sve_vq_init)) {
 -                set_bit(vq - 1, cpu->sve_vq_map);
 +        if (kvm_enabled()) {
 +            /*
 +             * For KVM we have to automatically enable all supported unitialized
 +             * lengths, even when the smaller lengths are not all powers-of-two.
 +             */
 +            bitmap_andnot(tmp, kvm_supported, cpu->sve_vq_init, max_vq);
 +            bitmap_or(cpu->sve_vq_map, cpu->sve_vq_map, tmp, max_vq);
 +        } else {
 +            /* Propagate enabled bits down through required powers-of-two. */
 +            for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
 +                if (!test_bit(vq - 1, cpu->sve_vq_init)) {
 +                    set_bit(vq - 1, cpu->sve_vq_map);
 +                }
              }
          }
      } else if (cpu->sve_max_vq == 0) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
              return;
          }
 -        /* Disabling a power-of-two disables all larger lengths. */
 -        if (test_bit(0, cpu->sve_vq_init)) {
 -            error_setg(errp, "cannot disable sve128");
 -            error_append_hint(errp, "Disabling sve128 results in all vector "
 -                              "lengths being disabled.\n");
 -            error_append_hint(errp, "With SVE enabled, at least one vector "
 -                              "length must be enabled.\n");
 -            return;
 -        }
 -        for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
 -            if (test_bit(vq - 1, cpu->sve_vq_init)) {
 -                break;
 +        if (kvm_enabled()) {
 +            /* Disabling a supported length disables all larger lengths. */
 +            for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 +                if (test_bit(vq - 1, cpu->sve_vq_init) &&
 +                    test_bit(vq - 1, kvm_supported)) {
 +                    break;
 +                }
              }
 +            max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
 +            bitmap_andnot(cpu->sve_vq_map, kvm_supported,
 +                          cpu->sve_vq_init, max_vq);
 +            if (max_vq == 0 || bitmap_empty(cpu->sve_vq_map, max_vq)) {
 +                error_setg(errp, "cannot disable sve%d", vq * 128);
 +                error_append_hint(errp, "Disabling sve%d results in all "
 +                                  "vector lengths being disabled.\n",
 +                                  vq * 128);
 +                error_append_hint(errp, "With SVE enabled, at least one "
 +                                  "vector length must be enabled.\n");
 +                return;
 +            }
 +        } else {
 +            /* Disabling a power-of-two disables all larger lengths. */
 +            if (test_bit(0, cpu->sve_vq_init)) {
 +                error_setg(errp, "cannot disable sve128");
 +                error_append_hint(errp, "Disabling sve128 results in all "
 +                                  "vector lengths being disabled.\n");
 +                error_append_hint(errp, "With SVE enabled, at least one "
 +                                  "vector length must be enabled.\n");
 +                return;
 +            }
 +            for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
 +                if (test_bit(vq - 1, cpu->sve_vq_init)) {
 +                    break;
 +                }
 +            }
 +            max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
 +            bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
          }
 -        max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
 -        bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
          max_vq = find_last_bit(cpu->sve_vq_map, max_vq) + 1;
      }
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
      assert(max_vq != 0);
      bitmap_clear(cpu->sve_vq_map, max_vq, ARM_MAX_VQ - max_vq);
 -    /* Ensure all required powers-of-two are enabled. */
 -    for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
 -        if (!test_bit(vq - 1, cpu->sve_vq_map)) {
 -            error_setg(errp, "cannot disable sve%d", vq * 128);
 -            error_append_hint(errp, "sve%d is required as it "
 -                              "is a power-of-two length smaller than "
 -                              "the maximum, sve%d\n",
 -                              vq * 128, max_vq * 128);
 +    if (kvm_enabled()) {
 +        /* Ensure the set of lengths matches what KVM supports. */
 +        bitmap_xor(tmp, cpu->sve_vq_map, kvm_supported, max_vq);
 +        if (!bitmap_empty(tmp, max_vq)) {
 +            vq = find_last_bit(tmp, max_vq) + 1;
 +            if (test_bit(vq - 1, cpu->sve_vq_map)) {
 +                if (cpu->sve_max_vq) {
 +                    error_setg(errp, "cannot set sve-max-vq=%d",
 +                               cpu->sve_max_vq);
 +                    error_append_hint(errp, "This KVM host does not support "
 +                                      "the vector length %d-bits.\n",
 +                                      vq * 128);
 +                    error_append_hint(errp, "It may not be possible to use "
 +                                      "sve-max-vq with this KVM host. Try "
 +                                      "using only sve<N> properties.\n");
 +                } else {
 +                    error_setg(errp, "cannot enable sve%d", vq * 128);
 +                    error_append_hint(errp, "This KVM host does not support "
 +                                      "the vector length %d-bits.\n",
 +                                      vq * 128);
 +                }
 +            } else {
 +                error_setg(errp, "cannot disable sve%d", vq * 128);
 +                error_append_hint(errp, "The KVM host requires all "
 +                                  "supported vector lengths smaller "
 +                                  "than %d bits to also be enabled.\n",
 +                                  max_vq * 128);
 +            }
              return;
          }
 +    } else {
-+        qemu_log_mask(LOG_GUEST_ERROR,
++        /* Ensure all required powers-of-two are enabled. */
-+                      "%s: invalid command attributes: "
++        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
-+                      "invalid dte: %"PRIx64" for %d (MEM_TX: %d)\n",
++            if (!test_bit(vq - 1, cpu->sve_vq_map)) {
-+                      __func__, dte, devid, res);
++                error_setg(errp, "cannot disable sve%d", vq * 128);
-+        return result;
++                error_append_hint(errp, "sve%d is required as it "
-     }
++                                  "is a power-of-two length smaller than "
++                                  "the maximum, sve%d\n",
--    if ((devid > s->dt.maxids.max_devids) || !dte_valid || !ite_valid ||
++                                  vq * 128, max_vq * 128);
--            !cte_valid || (eventid > max_eventid)) {
++                return;
 +            }
 +        }
      }
      /*
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
  {
      ARMCPU *cpu = ARM_CPU(obj);
      Error *err = NULL;
 +    uint32_t max_vq;
 -    visit_type_uint32(v, name, &cpu->sve_max_vq, &err);
 -
 -    if (!err && (cpu->sve_max_vq == 0 || cpu->sve_max_vq > ARM_MAX_VQ)) {
 -        error_setg(&err, "unsupported SVE vector length");
 -        error_append_hint(&err, "Valid sve-max-vq in range [1-%d]\n",
 -                          ARM_MAX_VQ);
 +    visit_type_uint32(v, name, &max_vq, &err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
      }
 -    error_propagate(errp, err);
 +
 +    if (kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
 +        error_setg(errp, "cannot set sve-max-vq");
 +        error_append_hint(errp, "SVE not supported by KVM on this host\n");
 +        return;
 +    }
 +
 +    if (max_vq == 0 || max_vq > ARM_MAX_VQ) {
 +        error_setg(errp, "unsupported SVE vector length");
 +        error_append_hint(errp, "Valid sve-max-vq in range [1-%d]\n",
 +                          ARM_MAX_VQ);
 +        return;
 +    }
 +
 +    cpu->sve_max_vq = max_vq;
  }
  static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
          return;
      }
 +    if (value && kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
 +        error_setg(errp, "cannot enable %s", name);
 +        error_append_hint(errp, "SVE not supported by KVM on this host\n");
 +        return;
 +    }
 +
      if (value) {
          set_bit(vq - 1, cpu->sve_vq_map);
      } else {
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
          cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
          cpu->dcz_blocksize = 7; /*  512 bytes */
  #endif
 -
 -        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
 -                            cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
 -
 -        for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 -            char name[8];
 -            sprintf(name, "sve%d", vq * 128);
 -            object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
 -                                cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
 -        }
      }
      object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
                          cpu_arm_set_sve, NULL, NULL, &error_fatal);
 +    object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
 +                        cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
 +
 +    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 +        char name[8];
 +        sprintf(name, "sve%d", vq * 128);
 +        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
 +                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
 +    }
  }
  struct ARMCPUInfo {
 diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/kvm64.c
 +++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_sve_supported(CPUState *cpu)
      return kvm_check_extension(s, KVM_CAP_ARM_SVE);
  }
 +QEMU_BUILD_BUG_ON(KVM_ARM64_SVE_VQ_MIN != 1);
 +
 +void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
 +{
 +    /* Only call this function if kvm_arm_sve_supported() returns true. */
 +    static uint64_t vls[KVM_ARM64_SVE_VLS_WORDS];
 +    static bool probed;
 +    uint32_t vq = 0;
 +    int i, j;
 +
 +    bitmap_clear(map, 0, ARM_MAX_VQ);
 +
 +    /*
-+     * In this implementation, in case of guest errors we ignore the
++     * KVM ensures all host CPUs support the same set of vector lengths.
-+     * command and move onto the next command in the queue.
++     * So we only need to create the scratch VCPUs once and then cache
 +     * the results.
 +     */
-+    if (devid > s->dt.maxids.max_devids) {
++    if (!probed) {
-         qemu_log_mask(LOG_GUEST_ERROR,
++        struct kvm_vcpu_init init = {
--                      "%s: invalid command attributes "
++            .target = -1,
--                      "devid %d or eventid %d or invalid dte %d or"
++            .features[0] = (1 << KVM_ARM_VCPU_SVE),
--                      "invalid cte %d or invalid ite %d\n",
++        };
--                      __func__, devid, eventid, dte_valid, cte_valid,
++        struct kvm_one_reg reg = {
--                      ite_valid);
++            .id = KVM_REG_ARM64_SVE_VLS,
--        /*
++            .addr = (uint64_t)&vls[0],
--         * in this implementation, in case of error
++        };
--         * we ignore this command and move onto the next
++        int fdarray[3], ret;
--         * command in the queue
++
--         */
++        probed = true;
-+                      "%s: invalid command attributes: devid %d>%d",
++
-+                      __func__, devid, s->dt.maxids.max_devids);
++        if (!kvm_arm_create_scratch_host_vcpu(NULL, fdarray, &init)) {
-+
++            error_report("failed to create scratch VCPU with SVE enabled");
-+    } else if (!dte_valid || !ite_valid || !cte_valid) {
++            abort();
-+        qemu_log_mask(LOG_GUEST_ERROR,
++        }
-+                      "%s: invalid command attributes: "
++        ret = ioctl(fdarray[2], KVM_GET_ONE_REG, &reg);
-+                      "dte: %s, ite: %s, cte: %s\n",
++        kvm_arm_destroy_scratch_host_vcpu(fdarray);
-+                      __func__,
++        if (ret) {
-+                      dte_valid ? "valid" : "invalid",
++            error_report("failed to get KVM_REG_ARM64_SVE_VLS: %s",
-+                      ite_valid ? "valid" : "invalid",
++                         strerror(errno));
-+                      cte_valid ? "valid" : "invalid");
++            abort();
-+    } else if (eventid > max_eventid) {
++        }
-+        qemu_log_mask(LOG_GUEST_ERROR,
++
-+                      "%s: invalid command attributes: eventid %d > %d\n",
++        for (i = KVM_ARM64_SVE_VLS_WORDS - 1; i >= 0; --i) {
-+                      __func__, eventid, max_eventid);
++            if (vls[i]) {
 +                vq = 64 - clz64(vls[i]) + i * 64;
 +                break;
 +            }
 +        }
 +        if (vq > ARM_MAX_VQ) {
 +            warn_report("KVM supports vector lengths larger than "
 +                        "QEMU can enable");
 +        }
 +    }
 +
 +    for (i = 0; i < KVM_ARM64_SVE_VLS_WORDS; ++i) {
 +        if (!vls[i]) {
 +            continue;
 +        }
 +        for (j = 1; j <= 64; ++j) {
 +            vq = j + i * 64;
 +            if (vq > ARM_MAX_VQ) {
 +                return;
 +            }
 +            if (vls[i] & (1UL << (j - 1))) {
 +                set_bit(vq - 1, map);
 +            }
 +        }
 +    }
 +}
 +
 +static int kvm_arm_sve_set_vls(CPUState *cs)
 +{
 +    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = {0};
 +    struct kvm_one_reg reg = {
 +        .id = KVM_REG_ARM64_SVE_VLS,
 +        .addr = (uint64_t)&vls[0],
 +    };
 +    ARMCPU *cpu = ARM_CPU(cs);
 +    uint32_t vq;
 +    int i, j;
 +
 +    assert(cpu->sve_max_vq <= KVM_ARM64_SVE_VQ_MAX);
 +
 +    for (vq = 1; vq <= cpu->sve_max_vq; ++vq) {
 +        if (test_bit(vq - 1, cpu->sve_vq_map)) {
 +            i = (vq - 1) / 64;
 +            j = (vq - 1) % 64;
 +            vls[i] |= 1UL << j;
 +        }
 +    }
 +
 +    return kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
 +}
 +
  #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
  int kvm_arch_init_vcpu(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
      if (cpu->kvm_target == QEMU_KVM_ARM_TARGET_NONE ||
          !object_dynamic_cast(OBJECT(cpu), TYPE_AARCH64_CPU)) {
 -        fprintf(stderr, "KVM is not supported for this guest CPU type\n");
 +        error_report("KVM is not supported for this guest CPU type");
          return -EINVAL;
      }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
      }
      if (cpu_isar_feature(aa64_sve, cpu)) {
 +        ret = kvm_arm_sve_set_vls(cs);
 +        if (ret) {
 +            return ret;
 +        }
          ret = kvm_arm_vcpu_finalize(cs, KVM_ARM_VCPU_SVE);
          if (ret) {
              return ret;
 diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/arm-cpu-features.c
 +++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static QDict *resp_get_props(QDict *resp)
      return qdict;
  }
 +static bool resp_get_feature(QDict *resp, const char *feature)
 +{
 +    QDict *props;
 +
 +    g_assert(resp);
 +    g_assert(resp_has_props(resp));
 +    props = resp_get_props(resp);
 +    g_assert(qdict_get(props, feature));
 +    return qdict_get_bool(props, feature);
 +}
 +
  #define assert_has_feature(qts, cpu_type, feature)                     \
  ({                                                                     \
      QDict *_resp = do_query_no_props(qts, cpu_type);                   \
@@ -XXX,XX +XXX,XX @@ static void sve_tests_sve_off(const void *data)
      qtest_quit(qts);
  }
 +static void sve_tests_sve_off_kvm(const void *data)
 +{
 +    QTestState *qts;
 +
 +    qts = qtest_init(MACHINE_KVM "-cpu max,sve=off");
 +
 +    /*
 +     * We don't know if this host supports SVE so we don't
 +     * attempt to test enabling anything. We only test that
 +     * everything is disabled (as it should be with sve=off)
 +     * and that using sve<N>=off to explicitly disable vector
 +     * lengths is OK too.
 +     */
 +    assert_sve_vls(qts, "max", 0, NULL);
 +    assert_sve_vls(qts, "max", 0, "{ 'sve128': false }");
 +
 +    qtest_quit(qts);
 +}
 +
  static void test_query_cpu_model_expansion(const void *data)
  {
      QTestState *qts;
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
      }
      if (g_str_equal(qtest_get_arch(), "aarch64")) {
 +        bool kvm_supports_sve;
 +        char max_name[8], name[8];
 +        uint32_t max_vq, vq;
 +        uint64_t vls;
 +        QDict *resp;
 +        char *error;
 +
          assert_has_feature(qts, "host", "aarch64");
          assert_has_feature(qts, "host", "pmu");
 -        assert_has_feature(qts, "max", "sve");
 -
          assert_error(qts, "cortex-a15",
              "We cannot guarantee the CPU type 'cortex-a15' works "
              "with KVM on this host", NULL);
 +
 +        assert_has_feature(qts, "max", "sve");
 +        resp = do_query_no_props(qts, "max");
 +        kvm_supports_sve = resp_get_feature(resp, "sve");
 +        vls = resp_get_sve_vls(resp);
 +        qobject_unref(resp);
 +
 +        if (kvm_supports_sve) {
 +            g_assert(vls != 0);
 +            max_vq = 64 - __builtin_clzll(vls);
 +            sprintf(max_name, "sve%d", max_vq * 128);
 +
 +            /* Enabling a supported length is of course fine. */
 +            assert_sve_vls(qts, "max", vls, "{ %s: true }", max_name);
 +
 +            /* Get the next supported length smaller than max-vq. */
 +            vq = 64 - __builtin_clzll(vls & ~BIT_ULL(max_vq - 1));
 +            if (vq) {
 +                /*
 +                 * We have at least one length smaller than max-vq,
 +                 * so we can disable max-vq.
 +                 */
 +                assert_sve_vls(qts, "max", (vls & ~BIT_ULL(max_vq - 1)),
 +                               "{ %s: false }", max_name);
 +
 +                /*
 +                 * Smaller, supported vector lengths cannot be disabled
 +                 * unless all larger, supported vector lengths are also
 +                 * disabled.
 +                 */
 +                sprintf(name, "sve%d", vq * 128);
 +                error = g_strdup_printf("cannot disable %s", name);
 +                assert_error(qts, "max", error,
 +                             "{ %s: true, %s: false }",
 +                             max_name, name);
 +                g_free(error);
 +            }
 +
 +            /*
 +             * The smallest, supported vector length is required, because
 +             * we need at least one vector length enabled.
 +             */
 +            vq = __builtin_ffsll(vls);
 +            sprintf(name, "sve%d", vq * 128);
 +            error = g_strdup_printf("cannot disable %s", name);
 +            assert_error(qts, "max", error, "{ %s: false }", name);
 +            g_free(error);
 +
 +            /* Get an unsupported length. */
 +            for (vq = 1; vq <= max_vq; ++vq) {
 +                if (!(vls & BIT_ULL(vq - 1))) {
 +                    break;
 +                }
 +            }
 +            if (vq <= SVE_MAX_VQ) {
 +                sprintf(name, "sve%d", vq * 128);
 +                error = g_strdup_printf("cannot enable %s", name);
 +                assert_error(qts, "max", error, "{ %s: true }", name);
 +                g_free(error);
 +            }
 +        } else {
 +            g_assert(vls == 0);
 +        }
      } else {
-         /*
+         assert_has_not_feature(qts, "host", "aarch64");
-          * Current implementation only supports rdbase == procnum
+         assert_has_not_feature(qts, "host", "pmu");
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
                              NULL, sve_tests_sve_max_vq_8);
          qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
                              NULL, sve_tests_sve_off);
 +        qtest_add_data_func("/arm/kvm/query-cpu-model-expansion/sve-off",
 +                            NULL, sve_tests_sve_off_kvm);
      }
      return g_test_run();
 diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/arm-cpu-features.rst
 +++ b/docs/arm-cpu-features.rst
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Dependencies and Constraints
 ) At least one vector length must be enabled when `sve` is enabled.
 -  2) If a vector length `N` is enabled, then all power-of-two vector
 -     lengths smaller than `N` must also be enabled.  E.g. if `sve512`
 -     is enabled, then the 128-bit and 256-bit vector lengths must also
 -     be enabled.
 +  2) If a vector length `N` is enabled, then, when KVM is enabled, all
 +     smaller, host supported vector lengths must also be enabled.  If
 +     KVM is not enabled, then only all the smaller, power-of-two vector
 +     lengths must be enabled.  E.g. with KVM if the host supports all
 +     vector lengths up to 512-bits (128, 256, 384, 512), then if `sve512`
 +     is enabled, the 128-bit vector length, 256-bit vector length, and
 +     384-bit vector length must also be enabled. Without KVM, the 384-bit
 +     vector length would not be required.
 +
 +  3) If KVM is enabled then only vector lengths that the host CPU type
 +     support may be enabled.  If SVE is not supported by the host, then
 +     no `sve*` properties may be enabled.
  SVE CPU Property Parsing Semantics
  ----------------------------------
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Parsing Semantics
       an error is generated.
 ) If SVE is enabled (`sve=on`), but no `sve<N>` CPU properties are
 -     provided, then all supported vector lengths are enabled, including
 -     the non-power-of-two lengths.
 +     provided, then all supported vector lengths are enabled, which when
 +     KVM is not in use means including the non-power-of-two lengths, and,
 +     when KVM is in use, it means all vector lengths supported by the host
 +     processor.
 ) If SVE is enabled, then an error is generated when attempting to
       disable the last enabled vector length (see constraint (1) of "SVE
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Parsing Semantics
       has been explicitly disabled, then an error is generated (see
       constraint (2) of "SVE CPU Property Dependencies and Constraints").
 -  5) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
 +  5) When KVM is enabled, if the host does not support SVE, then an error
 +     is generated when attempting to enable any `sve*` properties (see
 +     constraint (3) of "SVE CPU Property Dependencies and Constraints").
 +
 +  6) When KVM is enabled, if the host does support SVE, then an error is
 +     generated when attempting to enable any vector lengths not supported
 +     by the host (see constraint (3) of "SVE CPU Property Dependencies and
 +     Constraints").
 +
 +  7) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
       CPU properties are set `on`, then the specified vector lengths are
       disabled but the default for any unspecified lengths remains enabled.
 -     Disabling a power-of-two vector length also disables all vector
 -     lengths larger than the power-of-two length (see constraint (2) of
 -     "SVE CPU Property Dependencies and Constraints").
 +     When KVM is not enabled, disabling a power-of-two vector length also
 +     disables all vector lengths larger than the power-of-two length.
 +     When KVM is enabled, then disabling any supported vector length also
 +     disables all larger vector lengths (see constraint (2) of "SVE CPU
 +     Property Dependencies and Constraints").
 -  6) If one or more `sve<N>` CPU properties are set to `on`, then they
 +  8) If one or more `sve<N>` CPU properties are set to `on`, then they
       are enabled and all unspecified lengths default to disabled, except
       for the required lengths per constraint (2) of "SVE CPU Property
       Dependencies and Constraints", which will even be auto-enabled if
       they were not explicitly enabled.
 -  7) If SVE was disabled (`sve=off`), allowing all vector lengths to be
 +  9) If SVE was disabled (`sve=off`), allowing all vector lengths to be
       explicitly disabled (i.e. avoiding the error specified in (3) of
       "SVE CPU Property Parsing Semantics"), then if later an `sve=on` is
       provided an error will be generated.  To avoid this error, one must
 --
-.25.1
+.20.1

-[PULL 02/33] docs: aspeed: Add new boards
+Deleted patch
-From: Joel Stanley <joel@jms.id.au>
-Add X11, FP5280G2, G220A, Rainier and Fuji. Mention that Swift will be
-removed in v7.0.
-Signed-off-by: Joel Stanley <joel@jms.id.au>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 20211117065752.330632-2-joel@jms.id.au
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/aspeed.rst | 7 ++++++-
-file changed, 6 insertions(+), 1 deletion(-)
-diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/aspeed.rst
-+++ b/docs/system/arm/aspeed.rst
-@@ -XXX,XX +XXX,XX @@ AST2400 SoC based machines :
- - ``palmetto-bmc``         OpenPOWER Palmetto POWER8 BMC
- - ``quanta-q71l-bmc``      OpenBMC Quanta BMC
-+- ``supermicrox11-bmc``    Supermicro X11 BMC
- AST2500 SoC based machines :
-@@ -XXX,XX +XXX,XX @@ AST2500 SoC based machines :
- - ``romulus-bmc``          OpenPOWER Romulus POWER9 BMC
- - ``witherspoon-bmc``      OpenPOWER Witherspoon POWER9 BMC
- - ``sonorapass-bmc``       OCP SonoraPass BMC
--- ``swift-bmc``            OpenPOWER Swift BMC POWER9
-+- ``swift-bmc``            OpenPOWER Swift BMC POWER9 (to be removed in v7.0)
-+- ``fp5280g2-bmc``         Inspur FP5280G2 BMC
-+- ``g220a-bmc``            Bytedance G220A BMC
- AST2600 SoC based machines :
- - ``ast2600-evb``          Aspeed AST2600 Evaluation board (Cortex-A7)
- - ``tacoma-bmc``           OpenPOWER Witherspoon POWER9 AST2600 BMC
-+- ``rainier-bmc``          IBM Rainier POWER10 BMC
-+- ``fuji-bmc``             Facebook Fuji BMC
- Supported devices
- -----------------
---
-.25.1

-[PULL 03/33] docs: aspeed: Update OpenBMC image URL
+Deleted patch
-From: Joel Stanley <joel@jms.id.au>
-This is the latest URL for the OpenBMC CI. The old URL still works, but
-redirects.
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Joel Stanley <joel@jms.id.au>
-Message-id: 20211117065752.330632-3-joel@jms.id.au
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/aspeed.rst | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/aspeed.rst
-+++ b/docs/system/arm/aspeed.rst
-@@ -XXX,XX +XXX,XX @@ The Aspeed machines can be started using the ``-kernel`` option to
- load a Linux kernel or from a firmware. Images can be downloaded from
- the OpenBMC jenkins :
--   https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/distro=ubuntu,label=docker-builder
-+   https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/
- or directly from the OpenBMC GitHub release repository :
---
-.25.1

-[PULL 04/33] docs: aspeed: Give an example of booting a kernel
+Deleted patch
-From: Joel Stanley <joel@jms.id.au>
-A common use case for the ASPEED machine is to boot a Linux kernel.
-Provide a full example command line.
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Joel Stanley <joel@jms.id.au>
-Message-id: 20211117065752.330632-4-joel@jms.id.au
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/aspeed.rst | 15 ++++++++++++---
-file changed, 12 insertions(+), 3 deletions(-)
-diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/aspeed.rst
-+++ b/docs/system/arm/aspeed.rst
-@@ -XXX,XX +XXX,XX @@ Missing devices
- Boot options
- ------------
--The Aspeed machines can be started using the ``-kernel`` option to
--load a Linux kernel or from a firmware. Images can be downloaded from
--the OpenBMC jenkins :
-+The Aspeed machines can be started using the ``-kernel`` and ``-dtb`` options
-+to load a Linux kernel or from a firmware. Images can be downloaded from the
-+OpenBMC jenkins :
-    https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/
-@@ -XXX,XX +XXX,XX @@ or directly from the OpenBMC GitHub release repository :
-    https://github.com/openbmc/openbmc/releases
-+To boot a kernel directly from a Linux build tree:
-+
-+.. code-block:: bash
-+
-+  $ qemu-system-arm -M ast2600-evb -nographic \
-+        -kernel arch/arm/boot/zImage \
-+        -dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \
-+        -initrd rootfs.cpio
-+
- The image should be attached as an MTD drive. Run :
- .. code-block:: bash
---
-.25.1

-[PULL 05/33] docs: aspeed: ADC is now modelled
+Deleted patch
-From: Joel Stanley <joel@jms.id.au>
-Move it to the supported list.
-Signed-off-by: Joel Stanley <joel@jms.id.au>
-Message-id: 20211117065752.330632-5-joel@jms.id.au
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/aspeed.rst | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/aspeed.rst
-+++ b/docs/system/arm/aspeed.rst
-@@ -XXX,XX +XXX,XX @@ Supported devices
-  * Front LEDs (PCA9552 on I2C bus)
-  * LPC Peripheral Controller (a subset of subdevices are supported)
-  * Hash/Crypto Engine (HACE) - Hash support only. TODO: HMAC and RSA
-+ * ADC
- Missing devices
- ---------------
-  * Coprocessor support
-- * ADC (out of tree implementation)
-  * PWM and Fan Controller
-  * Slave GPIO Controller
-  * Super I/O Controller
---
-.25.1

-[PULL 06/33] Fix STM32F2XX USART data register readout
+Deleted patch
-From: Olivier Hériveaux <olivier.heriveaux@ledger.fr>
-Fix issue where the data register may be overwritten by next character
-reception before being read and returned.
-Signed-off-by: Olivier Hériveaux <olivier.heriveaux@ledger.fr>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20211128120723.4053-1-olivier.heriveaux@ledger.fr
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/char/stm32f2xx_usart.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/char/stm32f2xx_usart.c b/hw/char/stm32f2xx_usart.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/char/stm32f2xx_usart.c
-+++ b/hw/char/stm32f2xx_usart.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t stm32f2xx_usart_read(void *opaque, hwaddr addr,
-         return retvalue;
-     case USART_DR:
-         DB_PRINT("Value: 0x%" PRIx32 ", %c\n", s->usart_dr, (char) s->usart_dr);
-+        retvalue = s->usart_dr & 0x3FF;
-         s->usart_sr &= ~USART_SR_RXNE;
-         qemu_chr_fe_accept_input(&s->chr);
-         qemu_set_irq(s->irq, 0);
--        return s->usart_dr & 0x3FF;
-+        return retvalue;
-     case USART_BRR:
-         return s->usart_brr;
-     case USART_CR1:
---
-.25.1

-[PULL 08/33] hw/intc/arm_gicv3: Introduce CONFIG_ARM_GIC_TCG Kconfig selector
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
-The TYPE_ARM_GICV3 device is an emulated one.  When using
-KVM, it is recommended to use the TYPE_KVM_ARM_GICV3 device
-(which uses in-kernel support).
-When using --with-devices-FOO, it is possible to build a
-binary with a specific set of devices. When this binary is
-restricted to KVM accelerator, the TYPE_ARM_GICV3 device is
-irrelevant, and it is desirable to remove it from the binary.
-Therefore introduce the CONFIG_ARM_GIC_TCG Kconfig selector
-which select the files required to have the TYPE_ARM_GICV3
-device, but also allowing to de-select this device.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20211115223619.2599282-3-philmd@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/intc/arm_gicv3.c |  2 +-
- hw/intc/Kconfig     |  5 +++++
- hw/intc/meson.build | 10 ++++++----
-files changed, 12 insertions(+), 5 deletions(-)
-diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/arm_gicv3.c
-+++ b/hw/intc/arm_gicv3.c
-@@ -XXX,XX +XXX,XX @@
- /*
-- * ARM Generic Interrupt Controller v3
-+ * ARM Generic Interrupt Controller v3 (emulation)
-  *
-  * Copyright (c) 2015 Huawei.
-  * Copyright (c) 2016 Linaro Limited
-diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/Kconfig
-+++ b/hw/intc/Kconfig
-@@ -XXX,XX +XXX,XX @@ config APIC
-     select MSI_NONBROKEN
-     select I8259
-+config ARM_GIC_TCG
-+    bool
-+    default y
-+    depends on ARM_GIC && TCG
-+
- config ARM_GIC_KVM
-     bool
-     default y
-diff --git a/hw/intc/meson.build b/hw/intc/meson.build
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/meson.build
-+++ b/hw/intc/meson.build
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
-   'arm_gic.c',
-   'arm_gic_common.c',
-   'arm_gicv2m.c',
--  'arm_gicv3.c',
-   'arm_gicv3_common.c',
--  'arm_gicv3_dist.c',
-   'arm_gicv3_its_common.c',
--  'arm_gicv3_redist.c',
-+))
-+softmmu_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files(
-+  'arm_gicv3.c',
-+  'arm_gicv3_dist.c',
-   'arm_gicv3_its.c',
-+  'arm_gicv3_redist.c',
- ))
- softmmu_ss.add(when: 'CONFIG_ETRAXFS', if_true: files('etraxfs_pic.c'))
- softmmu_ss.add(when: 'CONFIG_HEATHROW_PIC', if_true: files('heathrow_pic.c'))
-@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in
- specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))
- specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))
- specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
--specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif.c'))
-+specific_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files('arm_gicv3_cpuif.c'))
- specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))
- specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
- specific_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))
---
-.25.1

-[PULL 09/33] target/arm: Hoist pc_next to a local variable in aarch64_tr_translate_insn
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-a64.c | 7 ++++---
-file changed, 4 insertions(+), 3 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
- {
-     DisasContext *s = container_of(dcbase, DisasContext, base);
-     CPUARMState *env = cpu->env_ptr;
-+    uint64_t pc = s->base.pc_next;
-     uint32_t insn;
-     if (s->ss_active && !s->pstate_ss) {
-@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
-         return;
-     }
--    s->pc_curr = s->base.pc_next;
--    insn = arm_ldl_code(env, &s->base, s->base.pc_next, s->sctlr_b);
-+    s->pc_curr = pc;
-+    insn = arm_ldl_code(env, &s->base, pc, s->sctlr_b);
-     s->insn = insn;
--    s->base.pc_next += 4;
-+    s->base.pc_next = pc + 4;
-     s->fp_access_checked = false;
-     s->sve_access_checked = false;
---
-.25.1

-[PULL 10/33] target/arm: Hoist pc_next to a local variable in arm_tr_translate_insn
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate.c | 9 +++++----
-file changed, 5 insertions(+), 4 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
- {
-     DisasContext *dc = container_of(dcbase, DisasContext, base);
-     CPUARMState *env = cpu->env_ptr;
-+    uint32_t pc = dc->base.pc_next;
-     unsigned int insn;
-     if (arm_pre_translate_insn(dc)) {
--        dc->base.pc_next += 4;
-+        dc->base.pc_next = pc + 4;
-         return;
-     }
--    dc->pc_curr = dc->base.pc_next;
--    insn = arm_ldl_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
-+    dc->pc_curr = pc;
-+    insn = arm_ldl_code(env, &dc->base, pc, dc->sctlr_b);
-     dc->insn = insn;
--    dc->base.pc_next += 4;
-+    dc->base.pc_next = pc + 4;
-     disas_arm_insn(dc, insn);
-     arm_post_translate_insn(dc);
---
-.25.1

-[PULL 11/33] target/arm: Hoist pc_next to a local variable in thumb_tr_translate_insn
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate.c | 16 ++++++++--------
-file changed, 8 insertions(+), 8 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
- {
-     DisasContext *dc = container_of(dcbase, DisasContext, base);
-     CPUARMState *env = cpu->env_ptr;
-+    uint32_t pc = dc->base.pc_next;
-     uint32_t insn;
-     bool is_16bit;
-     if (arm_pre_translate_insn(dc)) {
--        dc->base.pc_next += 2;
-+        dc->base.pc_next = pc + 2;
-         return;
-     }
--    dc->pc_curr = dc->base.pc_next;
--    insn = arm_lduw_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
-+    dc->pc_curr = pc;
-+    insn = arm_lduw_code(env, &dc->base, pc, dc->sctlr_b);
-     is_16bit = thumb_insn_is_16bit(dc, dc->base.pc_next, insn);
--    dc->base.pc_next += 2;
-+    pc += 2;
-     if (!is_16bit) {
--        uint32_t insn2 = arm_lduw_code(env, &dc->base, dc->base.pc_next,
--                                       dc->sctlr_b);
--
-+        uint32_t insn2 = arm_lduw_code(env, &dc->base, pc, dc->sctlr_b);
-         insn = insn << 16 | insn2;
--        dc->base.pc_next += 2;
-+        pc += 2;
-     }
-+    dc->base.pc_next = pc;
-     dc->insn = insn;
-     if (dc->pstate_il) {
---
-.25.1

-[PULL 25/33] hw/net: npcm7xx_emc fix missing queue_flush
+[PULL 09/11] target/arm/kvm: host cpu: Add support for sve<N> properties
-From: Patrick Venture <venture@google.com>
+From: Andrew Jones <drjones@redhat.com>
-The rx_active boolean change to true should always trigger a try_read
+Allow cpu 'host' to enable SVE when it's available, unless the
-call that flushes the queue.
+user chooses to disable it with the added 'sve=off' cpu property.
+Also give the user the ability to select vector lengths with the
-Signed-off-by: Patrick Venture <venture@google.com>
+sve<N> properties. We don't adopt 'max' cpu's other sve property,
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+sve-max-vq, because that property is difficult to use with KVM.
-Message-id: 20211203221002.1719306-1-venture@google.com
+That property assumes all vector lengths in the range from 1 up
 to and including the specified maximum length are supported, but
 there may be optional lengths not supported by the host in that
 range. With KVM one must be more specific when enabling vector
 lengths.
 Signed-off-by: Andrew Jones <drjones@redhat.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
 Message-id: 20191031142734.8590-10-drjones@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/net/npcm7xx_emc.c | 18 ++++++++----------
+ target/arm/cpu.h          |  2 ++
-file changed, 8 insertions(+), 10 deletions(-)
+ target/arm/cpu.c          |  3 +++
+ target/arm/cpu64.c        | 33 +++++++++++++++++----------------
-diff --git a/hw/net/npcm7xx_emc.c b/hw/net/npcm7xx_emc.c
+ target/arm/kvm64.c        | 14 +++++++++++++-
-index XXXXXXX..XXXXXXX 100644
+ tests/arm-cpu-features.c  | 17 ++++++++---------
---- a/hw/net/npcm7xx_emc.c
+ docs/arm-cpu-features.rst | 19 ++++++++++++-------
-+++ b/hw/net/npcm7xx_emc.c
+files changed, 55 insertions(+), 33 deletions(-)
-@@ -XXX,XX +XXX,XX @@ static void emc_halt_rx(NPCM7xxEMCState *emc, uint32_t mista_flag)
-     emc_set_mista(emc, mista_flag);
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
  void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
  void aarch64_sve_change_el(CPUARMState *env, int old_el,
                             int new_el, bool el0_a64);
 +void aarch64_add_sve_properties(Object *obj);
  #else
  static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
  static inline void aarch64_sve_change_el(CPUARMState *env, int o,
                                           int n, bool a)
  { }
 +static inline void aarch64_add_sve_properties(Object *obj) { }
  #endif
  #if !defined(CONFIG_TCG)
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_host_initfn(Object *obj)
      ARMCPU *cpu = ARM_CPU(obj);
      kvm_arm_set_cpu_features_from_host(cpu);
 +    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
 +        aarch64_add_sve_properties(obj);
 +    }
      arm_cpu_post_init(obj);
  }
-+static void emc_enable_rx_and_flush(NPCM7xxEMCState *emc)
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
      cpu->isar.id_aa64pfr0 = t;
  }
 +void aarch64_add_sve_properties(Object *obj)
 +{
-+    emc->rx_active = true;
++    uint32_t vq;
-+    qemu_flush_queued_packets(qemu_get_queue(emc->nic));
++
 +    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
 +                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
 +
 +    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 +        char name[8];
 +        sprintf(name, "sve%d", vq * 128);
 +        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
 +                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
 +    }
 +}
 +
- static void emc_set_next_tx_descriptor(NPCM7xxEMCState *emc,
+ /* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
-                                        const NPCM7xxEMCTxDesc *tx_desc,
+  * otherwise, a CPU with as many features enabled as our emulation supports.
-                                        uint32_t desc_addr)
+  * The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
-@@ -XXX,XX +XXX,XX @@ static ssize_t emc_receive(NetClientState *nc, const uint8_t *buf, size_t len1)
+@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
-     return len;
+ static void aarch64_max_initfn(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
 -    uint32_t vq;
 -    uint64_t t;
      if (kvm_enabled()) {
          kvm_arm_set_cpu_features_from_host(cpu);
 -        if (kvm_arm_sve_supported(CPU(cpu))) {
 -            t = cpu->isar.id_aa64pfr0;
 -            t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
 -            cpu->isar.id_aa64pfr0 = t;
 -        }
      } else {
 +        uint64_t t;
          uint32_t u;
          aarch64_a57_initfn(obj);
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
  #endif
      }
 -    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
 -                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
 +    aarch64_add_sve_properties(obj);
      object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                          cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
 -
 -    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
 -        char name[8];
 -        sprintf(name, "sve%d", vq * 128);
 -        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
 -                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
 -    }
  }
--static void emc_try_receive_next_packet(NPCM7xxEMCState *emc)
+ struct ARMCPUInfo {
--{
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
--    if (emc_can_receive(qemu_get_queue(emc->nic))) {
+index XXXXXXX..XXXXXXX 100644
--        qemu_flush_queued_packets(qemu_get_queue(emc->nic));
+--- a/target/arm/kvm64.c
--    }
++++ b/target/arm/kvm64.c
--}
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
       * and then query that CPU for the relevant ID registers.
       */
      int fdarray[3];
 +    bool sve_supported;
      uint64_t features = 0;
 +    uint64_t t;
      int err;
      /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                                ARM64_SYS_REG(3, 0, 0, 3, 2));
      }
 +    sve_supported = ioctl(fdarray[0], KVM_CHECK_EXTENSION, KVM_CAP_ARM_SVE) > 0;
 +
      kvm_arm_destroy_scratch_host_vcpu(fdarray);
      if (err < 0) {
          return false;
      }
 -   /* We can assume any KVM supporting CPU is at least a v8
 +    /* Add feature bits that can't appear until after VCPU init. */
 +    if (sve_supported) {
 +        t = ahcf->isar.id_aa64pfr0;
 +        t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
 +        ahcf->isar.id_aa64pfr0 = t;
 +    }
 +
 +    /*
 +     * We can assume any KVM supporting CPU is at least a v8
       * with VFPv4+Neon; this in turn implies most of the other
       * feature bits.
       */
 diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/arm-cpu-features.c
 +++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
              "We cannot guarantee the CPU type 'cortex-a15' works "
              "with KVM on this host", NULL);
 -        assert_has_feature(qts, "max", "sve");
 -        resp = do_query_no_props(qts, "max");
 +        assert_has_feature(qts, "host", "sve");
 +        resp = do_query_no_props(qts, "host");
          kvm_supports_sve = resp_get_feature(resp, "sve");
          vls = resp_get_sve_vls(resp);
          qobject_unref(resp);
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
              sprintf(max_name, "sve%d", max_vq * 128);
              /* Enabling a supported length is of course fine. */
 -            assert_sve_vls(qts, "max", vls, "{ %s: true }", max_name);
 +            assert_sve_vls(qts, "host", vls, "{ %s: true }", max_name);
              /* Get the next supported length smaller than max-vq. */
              vq = 64 - __builtin_clzll(vls & ~BIT_ULL(max_vq - 1));
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
                   * We have at least one length smaller than max-vq,
                   * so we can disable max-vq.
                   */
 -                assert_sve_vls(qts, "max", (vls & ~BIT_ULL(max_vq - 1)),
 +                assert_sve_vls(qts, "host", (vls & ~BIT_ULL(max_vq - 1)),
                                 "{ %s: false }", max_name);
                  /*
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
                   */
                  sprintf(name, "sve%d", vq * 128);
                  error = g_strdup_printf("cannot disable %s", name);
 -                assert_error(qts, "max", error,
 +                assert_error(qts, "host", error,
                               "{ %s: true, %s: false }",
                               max_name, name);
                  g_free(error);
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
              vq = __builtin_ffsll(vls);
              sprintf(name, "sve%d", vq * 128);
              error = g_strdup_printf("cannot disable %s", name);
 -            assert_error(qts, "max", error, "{ %s: false }", name);
 +            assert_error(qts, "host", error, "{ %s: false }", name);
              g_free(error);
              /* Get an unsupported length. */
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
              if (vq <= SVE_MAX_VQ) {
                  sprintf(name, "sve%d", vq * 128);
                  error = g_strdup_printf("cannot enable %s", name);
 -                assert_error(qts, "max", error, "{ %s: true }", name);
 +                assert_error(qts, "host", error, "{ %s: true }", name);
                  g_free(error);
              }
          } else {
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
      } else {
          assert_has_not_feature(qts, "host", "aarch64");
          assert_has_not_feature(qts, "host", "pmu");
 -
- static uint64_t npcm7xx_emc_read(void *opaque, hwaddr offset, unsigned size)
+-        assert_has_not_feature(qts, "max", "sve");
- {
++        assert_has_not_feature(qts, "host", "sve");
-     NPCM7xxEMCState *emc = opaque;
+     }
-@@ -XXX,XX +XXX,XX @@ static void npcm7xx_emc_write(void *opaque, hwaddr offset,
-             emc->regs[REG_MGSTA] |= REG_MGSTA_RXHA;
+     qtest_quit(qts);
-         }
+diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
-         if (value & REG_MCMDR_RXON) {
+index XXXXXXX..XXXXXXX 100644
--            emc->rx_active = true;
+--- a/docs/arm-cpu-features.rst
-+            emc_enable_rx_and_flush(emc);
++++ b/docs/arm-cpu-features.rst
-         } else {
+@@ -XXX,XX +XXX,XX @@ SVE CPU Property Examples
-             emc_halt_rx(emc, 0);
-         }
+      $ qemu-system-aarch64 -M virt -cpu max
-@@ -XXX,XX +XXX,XX @@ static void npcm7xx_emc_write(void *opaque, hwaddr offset,
-         break;
+-  3) Only enable the 128-bit vector length::
-     case REG_RSDR:
++  3) When KVM is enabled, implicitly enable all host CPU supported vector
-         if (emc->regs[REG_MCMDR] & REG_MCMDR_RXON) {
++     lengths with the `host` CPU type::
--            emc->rx_active = true;
++
--            emc_try_receive_next_packet(emc);
++     $ qemu-system-aarch64 -M virt,accel=kvm -cpu host
-+            emc_enable_rx_and_flush(emc);
++
-         }
++  4) Only enable the 128-bit vector length::
-         break;
-     case REG_MIIDA:
+      $ qemu-system-aarch64 -M virt -cpu max,sve128=on
 -  4) Disable the 512-bit vector length and all larger vector lengths,
 +  5) Disable the 512-bit vector length and all larger vector lengths,
       since 512 is a power-of-two.  This results in all the smaller,
       uninitialized lengths (128, 256, and 384) defaulting to enabled::
       $ qemu-system-aarch64 -M virt -cpu max,sve512=off
 -  5) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
 +  6) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
       $ qemu-system-aarch64 -M virt -cpu max,sve128=on,sve256=on,sve512=on
 -  6) The same as (5), but since the 128-bit and 256-bit vector
 +  7) The same as (6), but since the 128-bit and 256-bit vector
       lengths are required for the 512-bit vector length to be enabled,
       then allow them to be auto-enabled::
       $ qemu-system-aarch64 -M virt -cpu max,sve512=on
 -  7) Do the same as (6), but by first disabling SVE and then re-enabling it::
 +  8) Do the same as (7), but by first disabling SVE and then re-enabling it::
       $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve512=on,sve=on
 -  8) Force errors regarding the last vector length::
 +  9) Force errors regarding the last vector length::
       $ qemu-system-aarch64 -M virt -cpu max,sve128=off
       $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve128=off,sve=on
@@ -XXX,XX +XXX,XX @@ The examples in "SVE CPU Property Examples" exhibit many ways to select
  vector lengths which developers may find useful in order to avoid overly
  verbose command lines.  However, the recommended way to select vector
  lengths is to explicitly enable each desired length.  Therefore only
 -example's (1), (3), and (5) exhibit recommended uses of the properties.
 +example's (1), (4), and (6) exhibit recommended uses of the properties.
 --
-.25.1
+.20.1

-[PULL 23/33] hw/arm: Don't include qemu-common.h unnecessarily
+[PULL 10/11] hw/arm/boot: Rebuild hflags when modifying CPUState at boot
-A lot of C files in hw/arm include qemu-common.h when they don't
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
 need anything from it. Drop the include lines.
-omap1.c, pxa2xx.c and strongarm.c retain the include because they
+Rebuild hflags when modifying CPUState at boot.
 use it for the prototype of qemu_get_timedate().
+Fixes: e979972a6a
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Message-id: 20191031040830.18800-2-edgar.iglesias@xilinx.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
-Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp>
-Message-id: 20211129200510.1233037-5-peter.maydell@linaro.org
 ---
- hw/arm/boot.c           | 1 -
+ hw/arm/boot.c | 1 +
- hw/arm/digic_boards.c   | 1 -
+file changed, 1 insertion(+)
  hw/arm/highbank.c       | 1 -
  hw/arm/npcm7xx_boards.c | 1 -
  hw/arm/sbsa-ref.c       | 1 -
  hw/arm/stm32f405_soc.c  | 1 -
  hw/arm/vexpress.c       | 1 -
  hw/arm/virt.c           | 1 -
 files changed, 8 deletions(-)
 diff --git a/hw/arm/boot.c b/hw/arm/boot.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/boot.c
 +++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
-  */
+                 info->secondary_cpu_reset_hook(cpu, info);
+             }
- #include "qemu/osdep.h"
+         }
--#include "qemu-common.h"
++        arm_rebuild_hflags(env);
- #include "qemu/datadir.h"
+     }
- #include "qemu/error-report.h"
+ }
- #include "qapi/error.h"
 diff --git a/hw/arm/digic_boards.c b/hw/arm/digic_boards.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/digic_boards.c
 +++ b/hw/arm/digic_boards.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
 -#include "qemu-common.h"
  #include "qemu/datadir.h"
  #include "hw/boards.h"
  #include "qemu/error-report.h"
 diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/highbank.c
 +++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "qemu/datadir.h"
  #include "qapi/error.h"
  #include "hw/sysbus.h"
 diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/npcm7xx_boards.c
 +++ b/hw/arm/npcm7xx_boards.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/qdev-core.h"
  #include "hw/qdev-properties.h"
  #include "qapi/error.h"
 -#include "qemu-common.h"
  #include "qemu/datadir.h"
  #include "qemu/units.h"
  #include "sysemu/blockdev.h"
 diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/sbsa-ref.c
 +++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "qemu/datadir.h"
  #include "qapi/error.h"
  #include "qemu/error-report.h"
 diff --git a/hw/arm/stm32f405_soc.c b/hw/arm/stm32f405_soc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/stm32f405_soc.c
 +++ b/hw/arm/stm32f405_soc.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
 -#include "qemu-common.h"
  #include "exec/address-spaces.h"
  #include "sysemu/sysemu.h"
  #include "hw/arm/stm32f405_soc.h"
 diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/vexpress.c
 +++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/error.h"
 -#include "qemu-common.h"
  #include "qemu/datadir.h"
  #include "cpu.h"
  #include "hw/sysbus.h"
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 -#include "qemu-common.h"
  #include "qemu/datadir.h"
  #include "qemu/units.h"
  #include "qemu/option.h"
 --
-.25.1
+.20.1

-[PULL 12/33] target/arm: Split arm_pre_translate_insn
+[PULL 11/11] target/arm: Allow reading flags from FPSCR for M-profile
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Christophe Lyon <christophe.lyon@linaro.org>
-Create arm_check_ss_active and arm_check_kernelpage.
+rt==15 is a special case when reading the flags: it means the
 destination is APSR. This patch avoids rejecting
 vmrs apsr_nzcv, fpscr
 as illegal instruction.
-Reverse the order of the tests.  While it doesn't matter in practice,
+Cc: qemu-stable@nongnu.org
-because only user-only has a kernel page and user-only never sets
+Signed-off-by: Christophe Lyon <christophe.lyon@linaro.org>
-ss_active, ss_active has priority over execution exceptions and it
+Message-id: 20191025095711.10853-1-christophe.lyon@linaro.org
-is best to keep them in the proper order.
+[PMM: updated the comment]
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate.c | 10 +++++++---
+ target/arm/translate-vfp.inc.c | 5 +++--
-file changed, 7 insertions(+), 3 deletions(-)
+file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
+--- a/target/arm/translate-vfp.inc.c
-+++ b/target/arm/translate.c
++++ b/target/arm/translate-vfp.inc.c
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
+@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
-     dc->insn_start = tcg_last_op();
+     if (arm_dc_feature(s, ARM_FEATURE_M)) {
- }
+         /*
+          * The only M-profile VFP vmrs/vmsr sysreg is FPSCR.
--static bool arm_pre_translate_insn(DisasContext *dc)
+-         * Writes to R15 are UNPREDICTABLE; we choose to undef.
-+static bool arm_check_kernelpage(DisasContext *dc)
++         * Accesses to R15 are UNPREDICTABLE; we choose to undef.
- {
++         * (FPSCR -> r15 is a special case which writes to the PSR flags.)
- #ifdef CONFIG_USER_ONLY
+          */
-     /* Intercept jump to the magic kernel page.  */
+-        if (a->rt == 15 || a->reg != ARM_VFP_FPSCR) {
-@@ -XXX,XX +XXX,XX @@ static bool arm_pre_translate_insn(DisasContext *dc)
++        if (a->rt == 15 && (!a->l || a->reg != ARM_VFP_FPSCR)) {
-         return true;
+             return false;
-     }
+         }
  #endif
 +    return false;
 +}
 +static bool arm_check_ss_active(DisasContext *dc)
 +{
      if (dc->ss_active && !dc->pstate_ss) {
          /* Singlestep state is Active-pending.
           * If we're in this state at the start of a TB then either
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
      uint32_t pc = dc->base.pc_next;
      unsigned int insn;
 -    if (arm_pre_translate_insn(dc)) {
 +    if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {
          dc->base.pc_next = pc + 4;
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
      uint32_t insn;
      bool is_16bit;
 -    if (arm_pre_translate_insn(dc)) {
 +    if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {
          dc->base.pc_next = pc + 2;
          return;
      }
 --
-.25.1
+.20.1

-[PULL 13/33] target/arm: Advance pc for arch single-step exception
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-The size of the code covered by a TranslationBlock cannot be 0;
-this is checked via assert in tb_gen_code.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-a64.c | 1 +
-file changed, 1 insertion(+)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
-         assert(s->base.num_insns == 1);
-         gen_swstep_exception(s, 0, 0);
-         s->base.is_jmp = DISAS_NORETURN;
-+        s->base.pc_next = pc + 4;
-         return;
-     }
---
-.25.1

-[PULL 17/33] target/arm: Suppress bp for exceptions with more priority
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Both single-step and pc alignment faults have priority over
-breakpoint exceptions.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/debug_helper.c | 23 +++++++++++++++++++++++
-file changed, 23 insertions(+)
-diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/debug_helper.c
-+++ b/target/arm/debug_helper.c
-@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_breakpoint(CPUState *cs)
- {
-     ARMCPU *cpu = ARM_CPU(cs);
-     CPUARMState *env = &cpu->env;
-+    target_ulong pc;
-     int n;
-     /*
-@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_breakpoint(CPUState *cs)
-         return false;
-     }
-+    /*
-+     * Single-step exceptions have priority over breakpoint exceptions.
-+     * If single-step state is active-pending, suppress the bp.
-+     */
-+    if (arm_singlestep_active(env) && !(env->pstate & PSTATE_SS)) {
-+        return false;
-+    }
-+
-+    /*
-+     * PC alignment faults have priority over breakpoint exceptions.
-+     */
-+    pc = is_a64(env) ? env->pc : env->regs[15];
-+    if ((is_a64(env) || !env->thumb) && (pc & 3) != 0) {
-+        return false;
-+    }
-+
-+    /*
-+     * Instruction aborts have priority over breakpoint exceptions.
-+     * TODO: We would need to look up the page for PC and verify that
-+     * it is present and executable.
-+     */
-+
-     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
-         if (bp_wp_matches(cpu, n, false)) {
-             return true;
---
-.25.1

-[PULL 19/33] target/i386: Use assert() to sanity-check b1 in SSE decode
+Deleted patch
-In the SSE decode function gen_sse(), we combine a byte
-'b' and a value 'b1' which can be [0..3], and switch on them:
-   b |= (b1 << 8);
-   switch (b) {
-   ...
-   default:
-   unknown_op:
-       gen_unknown_opcode(env, s);
-       return;
-   }
-In three cases inside this switch, we were then also checking for
- "if (b1 >= 2) { goto unknown_op; }".
-However, this can never happen, because the 'case' values in each place
-are 0x0nn or 0x1nn and the switch will have directed the b1 == (2, 3)
-cases to the default already.
-This check was added in commit c045af25a52e9 in 2010; the added code
-was unnecessary then as well, and was apparently intended only to
-ensure that we never accidentally ended up indexing off the end
-of an sse_op_table with only 2 entries as a result of future bugs
-in the decode logic.
-Change the checks to assert() instead, and make sure they're always
-immediately before the array access they are protecting.
-Fixes: Coverity CID 1460207
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
----
- target/i386/tcg/translate.c | 12 +++---------
-file changed, 3 insertions(+), 9 deletions(-)
-diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/i386/tcg/translate.c
-+++ b/target/i386/tcg/translate.c
-@@ -XXX,XX +XXX,XX @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b,
-         case 0x171: /* shift xmm, im */
-         case 0x172:
-         case 0x173:
--            if (b1 >= 2) {
--                goto unknown_op;
--            }
-             val = x86_ldub_code(env, s);
-             if (is_xmm) {
-                 tcg_gen_movi_tl(s->T0, val);
-@@ -XXX,XX +XXX,XX @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b,
-                                 offsetof(CPUX86State, mmx_t0.MMX_L(1)));
-                 op1_offset = offsetof(CPUX86State,mmx_t0);
-             }
-+            assert(b1 < 2);
-             sse_fn_epp = sse_op_table2[((b - 1) & 3) * 8 +
-                                        (((modrm >> 3)) & 7)][b1];
-             if (!sse_fn_epp) {
-@@ -XXX,XX +XXX,XX @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b,
-             rm = modrm & 7;
-             reg = ((modrm >> 3) & 7) | REX_R(s);
-             mod = (modrm >> 6) & 3;
--            if (b1 >= 2) {
--                goto unknown_op;
--            }
-+            assert(b1 < 2);
-             sse_fn_epp = sse_op_table6[b].op[b1];
-             if (!sse_fn_epp) {
-                 goto unknown_op;
-@@ -XXX,XX +XXX,XX @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b,
-             rm = modrm & 7;
-             reg = ((modrm >> 3) & 7) | REX_R(s);
-             mod = (modrm >> 6) & 3;
--            if (b1 >= 2) {
--                goto unknown_op;
--            }
-+            assert(b1 < 2);
-             sse_fn_eppi = sse_op_table7[b].op[b1];
-             if (!sse_fn_eppi) {
-                 goto unknown_op;
---
-.25.1

-[PULL 20/33] include/hw/i386: Don't include qemu-common.h in .h files
+Deleted patch
-The qemu-common.h header is not supposed to be included from any
-other header files, only from .c files (as documented in a comment at
-the start of it).
-include/hw/i386/x86.h and include/hw/i386/microvm.h break this rule.
-In fact, the include is not required at all, so we can just drop it
-from both files.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20211129200510.1233037-2-peter.maydell@linaro.org
----
- include/hw/i386/microvm.h | 1 -
- include/hw/i386/x86.h     | 1 -
-files changed, 2 deletions(-)
-diff --git a/include/hw/i386/microvm.h b/include/hw/i386/microvm.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i386/microvm.h
-+++ b/include/hw/i386/microvm.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef HW_I386_MICROVM_H
- #define HW_I386_MICROVM_H
--#include "qemu-common.h"
- #include "exec/hwaddr.h"
- #include "qemu/notify.h"
-diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/i386/x86.h
-+++ b/include/hw/i386/x86.h
-@@ -XXX,XX +XXX,XX @@
- #ifndef HW_I386_X86_H
- #define HW_I386_X86_H
--#include "qemu-common.h"
- #include "exec/hwaddr.h"
- #include "qemu/notify.h"
---
-.25.1

-[PULL 21/33] target/hexagon/cpu.h: don't include qemu-common.h
+Deleted patch
-The qemu-common.h header is not supposed to be included from any
-other header files, only from .c files (as documented in a comment at
-the start of it).
-Move the include to linux-user/hexagon/cpu_loop.c, which needs it for
-the declaration of cpu_exec_step_atomic().
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
-Message-id: 20211129200510.1233037-3-peter.maydell@linaro.org
----
- target/hexagon/cpu.h          | 1 -
- linux-user/hexagon/cpu_loop.c | 1 +
-files changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/hexagon/cpu.h
-+++ b/target/hexagon/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUHexagonState CPUHexagonState;
- #include "fpu/softfloat-types.h"
--#include "qemu-common.h"
- #include "exec/cpu-defs.h"
- #include "hex_regs.h"
- #include "mmvec/mmvec.h"
-diff --git a/linux-user/hexagon/cpu_loop.c b/linux-user/hexagon/cpu_loop.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/hexagon/cpu_loop.c
-+++ b/linux-user/hexagon/cpu_loop.c
-@@ -XXX,XX +XXX,XX @@
-  */
- #include "qemu/osdep.h"
-+#include "qemu-common.h"
- #include "qemu.h"
- #include "user-internals.h"
- #include "cpu_loop-common.h"
---
-.25.1

-[PULL 22/33] target/rx/cpu.h: Don't include qemu-common.h
+Deleted patch
-The qemu-common.h header is not supposed to be included from any
-other header files, only from .c files (as documented in a comment at
-the start of it).
-Nothing actually relies on target/rx/cpu.h including it, so we can
-just drop the include.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
-Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp>
-Message-id: 20211129200510.1233037-4-peter.maydell@linaro.org
----
- target/rx/cpu.h | 1 -
-file changed, 1 deletion(-)
-diff --git a/target/rx/cpu.h b/target/rx/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/rx/cpu.h
-+++ b/target/rx/cpu.h
-@@ -XXX,XX +XXX,XX @@
- #define RX_CPU_H
- #include "qemu/bitops.h"
--#include "qemu-common.h"
- #include "hw/registerfields.h"
- #include "cpu-qom.h"
---
-.25.1

-[PULL 26/33] hw/arm/virt-acpi-build: Add VIOT table for virtio-iommu
+Deleted patch
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
-When a virtio-iommu is instantiated, describe it using the ACPI VIOT
-table.
-Acked-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Message-id: 20211210170415.583179-2-jean-philippe@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/virt-acpi-build.c | 7 +++++++
- hw/arm/Kconfig           | 1 +
-files changed, 8 insertions(+)
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
-+++ b/hw/arm/virt-acpi-build.c
-@@ -XXX,XX +XXX,XX @@
- #include "kvm_arm.h"
- #include "migration/vmstate.h"
- #include "hw/acpi/ghes.h"
-+#include "hw/acpi/viot.h"
- #define ARM_SPI_BASE 32
-@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
-     }
- #endif
-+    if (vms->iommu == VIRT_IOMMU_VIRTIO) {
-+        acpi_add_table(table_offsets, tables_blob);
-+        build_viot(ms, tables_blob, tables->linker, vms->virtio_iommu_bdf,
-+                   vms->oem_id, vms->oem_table_id);
-+    }
-+
-     /* XSDT is pointed to by RSDP */
-     xsdt = tables_blob->len;
-     build_xsdt(tables_blob, tables->linker, table_offsets, vms->oem_id,
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
-+++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
-     select DIMM
-     select ACPI_HW_REDUCED
-     select ACPI_APEI
-+    select ACPI_VIOT
- config CHEETAH
-     bool
---
-.25.1

-[PULL 27/33] hw/arm/virt: Remove device tree restriction for virtio-iommu
+Deleted patch
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
-virtio-iommu is now supported with ACPI VIOT as well as device tree.
-Remove the restriction that prevents from instantiating a virtio-iommu
-device under ACPI.
-Acked-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Message-id: 20211210170415.583179-3-jean-philippe@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/virt.c                | 10 ++--------
- hw/virtio/virtio-iommu-pci.c | 12 ++----------
-files changed, 4 insertions(+), 18 deletions(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
-     MachineClass *mc = MACHINE_GET_CLASS(machine);
-     if (device_is_dynamic_sysbus(mc, dev) ||
--       (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM))) {
-+        object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM) ||
-+        object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
-         return HOTPLUG_HANDLER(machine);
-     }
--    if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
--        VirtMachineState *vms = VIRT_MACHINE(machine);
--
--        if (!vms->bootinfo.firmware_loaded || !virt_is_acpi_enabled(vms)) {
--            return HOTPLUG_HANDLER(machine);
--        }
--    }
-     return NULL;
- }
-diff --git a/hw/virtio/virtio-iommu-pci.c b/hw/virtio/virtio-iommu-pci.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/virtio/virtio-iommu-pci.c
-+++ b/hw/virtio/virtio-iommu-pci.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
-     VirtIOIOMMU *s = VIRTIO_IOMMU(vdev);
-     if (!qdev_get_machine_hotplug_handler(DEVICE(vpci_dev))) {
--        MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
--
--        error_setg(errp,
--                   "%s machine fails to create iommu-map device tree bindings",
--                   mc->name);
--        error_append_hint(errp,
--                          "Check your machine implements a hotplug handler "
--                          "for the virtio-iommu-pci device\n");
--        error_append_hint(errp, "Check the guest is booted without FW or with "
--                          "-no-acpi\n");
-+        error_setg(errp, "Check your machine implements a hotplug handler "
-+                         "for the virtio-iommu-pci device");
-         return;
-     }
-     for (int i = 0; i < s->nb_reserved_regions; i++) {
---
-.25.1

-[PULL 28/33] hw/arm/virt: Reject instantiation of multiple IOMMUs
+Deleted patch
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
-We do not support instantiating multiple IOMMUs. Before adding a
-virtio-iommu, check that no other IOMMU is present. This will detect
-both "iommu=smmuv3" machine parameter and another virtio-iommu instance.
-Fixes: 70e89132c9 ("hw/arm/virt: Add the virtio-iommu device tree mappings")
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Message-id: 20211210170415.583179-4-jean-philippe@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/virt.c | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,
-         hwaddr db_start = 0, db_end = 0;
-         char *resv_prop_str;
-+        if (vms->iommu != VIRT_IOMMU_NONE) {
-+            error_setg(errp, "virt machine does not support multiple IOMMUs");
-+            return;
-+        }
-+
-         switch (vms->msi_controller) {
-         case VIRT_MSI_CTRL_NONE:
-             return;
---
-.25.1

-[PULL 29/33] hw/arm/virt: Use object_property_set instead of qdev_prop_set
+Deleted patch
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
-To propagate errors to the caller of the pre_plug callback, use the
-object_poperty_set*() functions directly instead of the qdev_prop_set*()
-helpers.
-Suggested-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Message-id: 20211210170415.583179-5-jean-philippe@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/virt.c | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,
-                                         db_start, db_end,
-                                         VIRTIO_IOMMU_RESV_MEM_T_MSI);
--        qdev_prop_set_uint32(dev, "len-reserved-regions", 1);
--        qdev_prop_set_string(dev, "reserved-regions[0]", resv_prop_str);
-+        object_property_set_uint(OBJECT(dev), "len-reserved-regions", 1, errp);
-+        object_property_set_str(OBJECT(dev), "reserved-regions[0]",
-+                                resv_prop_str, errp);
-         g_free(resv_prop_str);
-     }
- }
---
-.25.1

-[PULL 30/33] tests/acpi: allow updates of VIOT expected data files
+Deleted patch
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Create empty data files and allow updates for the upcoming VIOT tests.
-Acked-by: Igor Mammedov <imammedo@redhat.com>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Message-id: 20211210170415.583179-6-jean-philippe@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/qtest/bios-tables-test-allowed-diff.h | 3 +++
- tests/data/acpi/q35/DSDT.viot               | 0
- tests/data/acpi/q35/VIOT.viot               | 0
- tests/data/acpi/virt/VIOT                   | 0
-files changed, 3 insertions(+)
- create mode 100644 tests/data/acpi/q35/DSDT.viot
- create mode 100644 tests/data/acpi/q35/VIOT.viot
- create mode 100644 tests/data/acpi/virt/VIOT
-diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
-index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/bios-tables-test-allowed-diff.h
-+++ b/tests/qtest/bios-tables-test-allowed-diff.h
-@@ -1 +1,4 @@
- /* List of comma-separated changed AML files to ignore */
-+"tests/data/acpi/virt/VIOT",
-+"tests/data/acpi/q35/DSDT.viot",
-+"tests/data/acpi/q35/VIOT.viot",
-diff --git a/tests/data/acpi/q35/DSDT.viot b/tests/data/acpi/q35/DSDT.viot
-new file mode 100644
-index XXXXXXX..XXXXXXX
-diff --git a/tests/data/acpi/q35/VIOT.viot b/tests/data/acpi/q35/VIOT.viot
-new file mode 100644
-index XXXXXXX..XXXXXXX
-diff --git a/tests/data/acpi/virt/VIOT b/tests/data/acpi/virt/VIOT
-new file mode 100644
-index XXXXXXX..XXXXXXX
---
-.25.1

-[PULL 32/33] tests/acpi: add expected blobs for VIOT test on q35 machine
+Deleted patch
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Add expected blobs of the VIOT and DSDT table for the VIOT test on the
-q35 machine.
-Since the test instantiates a virtio device and two PCIe expander
-bridges, DSDT.viot has more blocks than the base DSDT.
-The VIOT table generated for the q35 test is:
-[000h 0000   4]                    Signature : "VIOT"    [Virtual I/O Translation Table]
-[004h 0004   4]                 Table Length : 00000070
-[008h 0008   1]                     Revision : 00
-[009h 0009   1]                     Checksum : 3D
-[00Ah 0010   6]                       Oem ID : "BOCHS "
-[010h 0016   8]                 Oem Table ID : "BXPC    "
-[018h 0024   4]                 Oem Revision : 00000001
-[01Ch 0028   4]              Asl Compiler ID : "BXPC"
-[020h 0032   4]        Asl Compiler Revision : 00000001
-[024h 0036   2]                   Node count : 0003
-[026h 0038   2]                  Node offset : 0030
-[028h 0040   8]                     Reserved : 0000000000000000
-[030h 0048   1]                         Type : 03 [VirtIO-PCI IOMMU]
-[031h 0049   1]                     Reserved : 00
-[032h 0050   2]                       Length : 0010
-[034h 0052   2]                  PCI Segment : 0000
-[036h 0054   2]               PCI BDF number : 0010
-[038h 0056   8]                     Reserved : 0000000000000000
-[040h 0064   1]                         Type : 01 [PCI Range]
-[041h 0065   1]                     Reserved : 00
-[042h 0066   2]                       Length : 0018
-[044h 0068   4]               Endpoint start : 00003000
-[048h 0072   2]            PCI Segment start : 0000
-[04Ah 0074   2]              PCI Segment end : 0000
-[04Ch 0076   2]                PCI BDF start : 3000
-[04Eh 0078   2]                  PCI BDF end : 30FF
-[050h 0080   2]                  Output node : 0030
-[052h 0082   6]                     Reserved : 000000000000
-[058h 0088   1]                         Type : 01 [PCI Range]
-[059h 0089   1]                     Reserved : 00
-[05Ah 0090   2]                       Length : 0018
-[05Ch 0092   4]               Endpoint start : 00001000
-[060h 0096   2]            PCI Segment start : 0000
-[062h 0098   2]              PCI Segment end : 0000
-[064h 0100   2]                PCI BDF start : 1000
-[066h 0102   2]                  PCI BDF end : 10FF
-[068h 0104   2]                  Output node : 0030
-[06Ah 0106   6]                     Reserved : 000000000000
-And the DSDT diff is:
-@@ -XXX,XX +XXX,XX @@
-  *
-  * Disassembling to symbolic ASL+ operators
-  *
-- * Disassembly of tests/data/acpi/q35/DSDT, Fri Dec 10 15:03:08 2021
-+ * Disassembly of /tmp/aml-H9Y5D1, Fri Dec 10 15:02:27 2021
-  *
-  * Original Table Header:
-  *     Signature        "DSDT"
-- *     Length           0x00002061 (8289)
-+ *     Length           0x000024B6 (9398)
-  *     Revision         0x01 **** 32-bit table (V1), no 64-bit math support
-- *     Checksum         0xFA
-+ *     Checksum         0xA7
-  *     OEM ID           "BOCHS "
-  *     OEM Table ID     "BXPC    "
-  *     OEM Revision     0x00000001 (1)
-@@ -XXX,XX +XXX,XX @@
-         }
-     }
-+    Scope (\_SB)
-+    {
-+        Device (PC30)
-+        {
-+            Name (_UID, 0x30)  // _UID: Unique ID
-+            Name (_BBN, 0x30)  // _BBN: BIOS Bus Number
-+            Name (_HID, EisaId ("PNP0A08") /* PCI Express Bus */)  // _HID: Hardware ID
-+            Name (_CID, EisaId ("PNP0A03") /* PCI Bus */)  // _CID: Compatible ID
-+            Method (_OSC, 4, NotSerialized)  // _OSC: Operating System Capabilities
-+            {
-+                CreateDWordField (Arg3, Zero, CDW1)
-+                If ((Arg0 == ToUUID ("33db4d5b-1ff7-401c-9657-7441c03dd766") /* PCI Host Bridge Device */))
-+                {
-+                    CreateDWordField (Arg3, 0x04, CDW2)
-+                    CreateDWordField (Arg3, 0x08, CDW3)
-+                    Local0 = CDW3 /* \_SB_.PC30._OSC.CDW3 */
-+                    Local0 &= 0x1F
-+                    If ((Arg1 != One))
-+                    {
-+                        CDW1 |= 0x08
-+                    }
-+
-+                    If ((CDW3 != Local0))
-+                    {
-+                        CDW1 |= 0x10
-+                    }
-+
-+                    CDW3 = Local0
-+                }
-+                Else
-+                {
-+                    CDW1 |= 0x04
-+                }
-+
-+                Return (Arg3)
-+            }
-+
-+            Method (_PRT, 0, NotSerialized)  // _PRT: PCI Routing Table
-+            {
-+                Local0 = Package (0x80){}
-+                Local1 = Zero
-+                While ((Local1 < 0x80))
-+                {
-+                    Local2 = (Local1 >> 0x02)
-+                    Local3 = ((Local1 + Local2) & 0x03)
-+                    If ((Local3 == Zero))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKD,
-+                                Zero
-+                            }
-+                    }
-+
-+                    If ((Local3 == One))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKA,
-+                                Zero
-+                            }
-+                    }
-+
-+                    If ((Local3 == 0x02))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKB,
-+                                Zero
-+                            }
-+                    }
-+
-+                    If ((Local3 == 0x03))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKC,
-+                                Zero
-+                            }
-+                    }
-+
-+                    Local4 [Zero] = ((Local2 << 0x10) | 0xFFFF)
-+                    Local4 [One] = (Local1 & 0x03)
-+                    Local0 [Local1] = Local4
-+                    Local1++
-+                }
-+
-+                Return (Local0)
-+            }
-+
-+            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
-+            {
-+                WordBusNumber (ResourceProducer, MinFixed, MaxFixed, PosDecode,
-+                    0x0000,             // Granularity
-+                    0x0030,             // Range Minimum
-+                    0x0030,             // Range Maximum
-+                    0x0000,             // Translation Offset
-+                    0x0001,             // Length
-+                    ,, )
-+            })
-+        }
-+    }
-+
-+    Scope (\_SB)
-+    {
-+        Device (PC20)
-+        {
-+            Name (_UID, 0x20)  // _UID: Unique ID
-+            Name (_BBN, 0x20)  // _BBN: BIOS Bus Number
-+            Name (_HID, EisaId ("PNP0A08") /* PCI Express Bus */)  // _HID: Hardware ID
-+            Name (_CID, EisaId ("PNP0A03") /* PCI Bus */)  // _CID: Compatible ID
-+            Method (_OSC, 4, NotSerialized)  // _OSC: Operating System Capabilities
-+            {
-+                CreateDWordField (Arg3, Zero, CDW1)
-+                If ((Arg0 == ToUUID ("33db4d5b-1ff7-401c-9657-7441c03dd766") /* PCI Host Bridge Device */))
-+                {
-+                    CreateDWordField (Arg3, 0x04, CDW2)
-+                    CreateDWordField (Arg3, 0x08, CDW3)
-+                    Local0 = CDW3 /* \_SB_.PC20._OSC.CDW3 */
-+                    Local0 &= 0x1F
-+                    If ((Arg1 != One))
-+                    {
-+                        CDW1 |= 0x08
-+                    }
-+
-+                    If ((CDW3 != Local0))
-+                    {
-+                        CDW1 |= 0x10
-+                    }
-+
-+                    CDW3 = Local0
-+                }
-+                Else
-+                {
-+                    CDW1 |= 0x04
-+                }
-+
-+                Return (Arg3)
-+            }
-+
-+            Method (_PRT, 0, NotSerialized)  // _PRT: PCI Routing Table
-+            {
-+                Local0 = Package (0x80){}
-+                Local1 = Zero
-+                While ((Local1 < 0x80))
-+                {
-+                    Local2 = (Local1 >> 0x02)
-+                    Local3 = ((Local1 + Local2) & 0x03)
-+                    If ((Local3 == Zero))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKD,
-+                                Zero
-+                            }
-+                    }
-+
-+                    If ((Local3 == One))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKA,
-+                                Zero
-+                            }
-+                    }
-+
-+                    If ((Local3 == 0x02))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKB,
-+                                Zero
-+                            }
-+                    }
-+
-+                    If ((Local3 == 0x03))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKC,
-+                                Zero
-+                            }
-+                    }
-+
-+                    Local4 [Zero] = ((Local2 << 0x10) | 0xFFFF)
-+                    Local4 [One] = (Local1 & 0x03)
-+                    Local0 [Local1] = Local4
-+                    Local1++
-+                }
-+
-+                Return (Local0)
-+            }
-+
-+            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
-+            {
-+                WordBusNumber (ResourceProducer, MinFixed, MaxFixed, PosDecode,
-+                    0x0000,             // Granularity
-+                    0x0020,             // Range Minimum
-+                    0x0020,             // Range Maximum
-+                    0x0000,             // Translation Offset
-+                    0x0001,             // Length
-+                    ,, )
-+            })
-+        }
-+    }
-+
-+    Scope (\_SB)
-+    {
-+        Device (PC10)
-+        {
-+            Name (_UID, 0x10)  // _UID: Unique ID
-+            Name (_BBN, 0x10)  // _BBN: BIOS Bus Number
-+            Name (_HID, EisaId ("PNP0A08") /* PCI Express Bus */)  // _HID: Hardware ID
-+            Name (_CID, EisaId ("PNP0A03") /* PCI Bus */)  // _CID: Compatible ID
-+            Method (_OSC, 4, NotSerialized)  // _OSC: Operating System Capabilities
-+            {
-+                CreateDWordField (Arg3, Zero, CDW1)
-+                If ((Arg0 == ToUUID ("33db4d5b-1ff7-401c-9657-7441c03dd766") /* PCI Host Bridge Device */))
-+                {
-+                    CreateDWordField (Arg3, 0x04, CDW2)
-+                    CreateDWordField (Arg3, 0x08, CDW3)
-+                    Local0 = CDW3 /* \_SB_.PC10._OSC.CDW3 */
-+                    Local0 &= 0x1F
-+                    If ((Arg1 != One))
-+                    {
-+                        CDW1 |= 0x08
-+                    }
-+
-+                    If ((CDW3 != Local0))
-+                    {
-+                        CDW1 |= 0x10
-+                    }
-+
-+                    CDW3 = Local0
-+                }
-+                Else
-+                {
-+                    CDW1 |= 0x04
-+                }
-+
-+                Return (Arg3)
-+            }
-+
-+            Method (_PRT, 0, NotSerialized)  // _PRT: PCI Routing Table
-+            {
-+                Local0 = Package (0x80){}
-+                Local1 = Zero
-+                While ((Local1 < 0x80))
-+                {
-+                    Local2 = (Local1 >> 0x02)
-+                    Local3 = ((Local1 + Local2) & 0x03)
-+                    If ((Local3 == Zero))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKD,
-+                                Zero
-+                            }
-+                    }
-+
-+                    If ((Local3 == One))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKA,
-+                                Zero
-+                            }
-+                    }
-+
-+                    If ((Local3 == 0x02))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKB,
-+                                Zero
-+                            }
-+                    }
-+
-+                    If ((Local3 == 0x03))
-+                    {
-+                        Local4 = Package (0x04)
-+                            {
-+                                Zero,
-+                                Zero,
-+                                LNKC,
-+                                Zero
-+                            }
-+                    }
-+
-+                    Local4 [Zero] = ((Local2 << 0x10) | 0xFFFF)
-+                    Local4 [One] = (Local1 & 0x03)
-+                    Local0 [Local1] = Local4
-+                    Local1++
-+                }
-+
-+                Return (Local0)
-+            }
-+
-+            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
-+            {
-+                WordBusNumber (ResourceProducer, MinFixed, MaxFixed, PosDecode,
-+                    0x0000,             // Granularity
-+                    0x0010,             // Range Minimum
-+                    0x0010,             // Range Maximum
-+                    0x0000,             // Translation Offset
-+                    0x0001,             // Length
-+                    ,, )
-+            })
-+        }
-+    }
-+
-     Scope (\_SB.PCI0)
-     {
-         Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
-@@ -XXX,XX +XXX,XX @@
-             WordBusNumber (ResourceProducer, MinFixed, MaxFixed, PosDecode,
-x0000,             // Granularity
-x0000,             // Range Minimum
--                0x00FF,             // Range Maximum
-+                0x000F,             // Range Maximum
-x0000,             // Translation Offset
--                0x0100,             // Length
-+                0x0010,             // Length
-                 ,, )
-             IO (Decode16,
-x0CF8,             // Range Minimum
-@@ -XXX,XX +XXX,XX @@
-                 }
-             }
-+            Device (S10)
-+            {
-+                Name (_ADR, 0x00020000)  // _ADR: Address
-+            }
-+
-+            Device (S18)
-+            {
-+                Name (_ADR, 0x00030000)  // _ADR: Address
-+            }
-+
-+            Device (S20)
-+            {
-+                Name (_ADR, 0x00040000)  // _ADR: Address
-+            }
-+
-+            Device (S28)
-+            {
-+                Name (_ADR, 0x00050000)  // _ADR: Address
-+            }
-+
-             Method (PCNT, 0, NotSerialized)
-             {
-             }
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Message-id: 20211210170415.583179-8-jean-philippe@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/qtest/bios-tables-test-allowed-diff.h |   2 --
- tests/data/acpi/q35/DSDT.viot               | Bin 0 -> 9398 bytes
- tests/data/acpi/q35/VIOT.viot               | Bin 0 -> 112 bytes
-files changed, 2 deletions(-)
-diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
-index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/bios-tables-test-allowed-diff.h
-+++ b/tests/qtest/bios-tables-test-allowed-diff.h
-@@ -XXX,XX +XXX,XX @@
- /* List of comma-separated changed AML files to ignore */
- "tests/data/acpi/virt/VIOT",
--"tests/data/acpi/q35/DSDT.viot",
--"tests/data/acpi/q35/VIOT.viot",
-diff --git a/tests/data/acpi/q35/DSDT.viot b/tests/data/acpi/q35/DSDT.viot
-index XXXXXXX..XXXXXXX 100644
-GIT binary patch
-literal 9398
-zcmeHNO>7&-8J*>iv|O&FB}G~Oi$yp||57BBoWHhc5OS9yDTx$CQgH$r;8Idr*-4Q_
-z5(9Az1F`}niVsB-)<KW7p`g9Br(A2Gm-gmc1N78GFS!;)e2V(MnH_0{q<{#yMgn&C
-zn|*J-d9yqFhO_H6z19~`FlPL*u<DkZ*}|)JH;X@mF-FI<cPg<fti9tEN*yB^i5czN
-zNq&q?!OZ;BE3B7{KWzJ-`Tn~f`9?Qj8~2^N8{Oc8J%57{==w%rS#;nOCp*nTr@iZ1
-zb+?i;JLQUJ=O0?8*>S~D)a>NF1~WVB6^~_B#yhJ`H+JU@=6aXs`?Yv)J2h=N?drcS
-zeLZ*n<<Bm^n}6`jfBx#u8&(W}1?)}iF9o#mZ~E2+zwdn7yK3AbIzKnxpZ>JRPm3~#
-z&ICS{+_OayRW-l=Mtk=~uaS3o8z<_udd|(wqg`&JnVPfCe>BUOO`Su3e>pff_^UW%
-z&JE^NO`)=Amg~iqRB1pPscP?(>#ZuY8GHCmlEvD$9g3%4Db~Dfz2SATnddvrR-Oe^
-z;s;dJec!hnzi)ri^I6YN9vtkm{^TdUF8h7gX8-<Qe4p)GQ=)AtYx2VcwdLVAEXEjG
-z^Mj|UHPqkj-LsWuzQem1>F3atdZn=zv3$#RmZzSHN+6-yyU#8cJb=YDilX&sl}vNm
-znkgAR^O<3kj4if>{ly5fwRfMWuC5=lrlvKPX~i#654Cp}R_d*JS$9laZ$ra6)<ns8
-zFZy28G%xP(nit&F>LDi%G<tIc=TY=gl$jSD&Uv!Yat~XR46h%rI$!}a%!|xG7u8Zn
-zeY8_|n=K>xz_v_W8VX$W-Fg-qFWcT}7MCyz{%%{ia7hZ>Law-k6NOr}VI&_48U=2l
-zwqDKFE8eTwwozDdms#e?x?5a|v>&JF;2_v0L~z5n%BYU^52<*cWuD4|GYUm@1+?))
-zte^45>Rz)t*<T5V#={r>@t@{%?^i#W{i=HAZ*Dc9y59Va-+#P!jrGs;u38a{fLr`N
-zvT@rUu>DljxJ?^&Z?-?vyJn3C>3D=qux{Y*bs5|5n)Qmi$TD^Zdn4GU$ocJS2Hh-<
-z`xPI^^+v0nUVdjMos8k`WGl7hA`{03ju%<lrgAHSpd^DRf-*}_#Ly0mB!LSfVgWcQ
-z&T$@~G9)JI=hz5m0vkrel+Xy{Oh7pkAu-V!j*W7rY(bO}Q$nMH2`FbGB&N)QaV4<4
-zo)~9JXiP9=;}NPl<C@MmXG&;XFlFNrsyfFsonxFSp<}vEgsRSQP3O3#b6nSnP}ON_
-zI!#Tdsp~|j>ckUB>FI=~GokB5sOq#dotCE4(sd$KbtW~PNlj-`*NIToiD#j5J#9^=
-zt?NXn>YUJYPG~wObe#xQos*i*NloXZt`niEb4t@WrRki~bs|)CI+{*L)9L6s5vn><
-zn$DD_Go|Z9sOn5>I@6lYw5}7Os&iV?Ij!lO)^#FOb!If38BJ$K*NIToIiu;E(R9w}
-zIuWWmPiZ<&X*y5oIuWWmF_XaEC!a&Jn$B5WCqh-{X-(&8P3LJ{Cqh-{8P3dyPr@^t
-zSqL9?X9Uwd3W@23*s~h*tj0X6GZCuHa~kuU#yqDp5vt7d8uPryJg+kms?5hU=3^T3
-zF`bD}WnSP+=`t5MQ$FJ_2&Q~+BP6E0f^%BVIW6a$o)e+SX~IDBih-7z6{O~7YTy`&
-zLjy&Cv?7QikV#>n0>>@MV8oK`Gmun34-FKdlm-J8SZSaNlnhir4-FI{S|bfqV8e)V
-zss<{chX#reE#g=hsKAC%sF6d-Km}BWs!kZFsFpKfpbC@>6rprQGEjt4Ck#|zITHq|
-zK*>M_l;<P^MJRQ`Kn0dFVW0|>3{*fllMEE0)CmI>Sk8ojDo`>|0p(0GP=xY&!axO<
-zGhv_#lnhirIg<<&q0|Wj6<E%MfhtfkPyyvkGEjt4Ck#|zITHq|K*>M_lrzad5lWpf
-zP=V!47^ngz0~JutBm+e#b;3XemNQ|X3X}{~Ksl2P6rt1!0~J`#gn=qhGEf2KOfpb}
-zQYQ>lU^x>8szAv=1(Y+%KoLrvFi?TzOc<yFB?A>u&LjgxD0RX>1(q{mpbC@>R6seC
-z3>2Z%2?G^a&V+#~P%=;f<xDbAgi<FARA4z12C6{GKn0XD$v_cGoiI>=<xCi;0wn_#
-zP|hR+MJRQ`Kn0dFVW0|>3{*fllMEE0)CmI>Sk8ojDo`>|0p(0GP=rz^3{+q_69%e4
-z$v_2^Gs!>^N}VuJf#pmXr~)Me6;RG314Srx!axxz28u{EP=u<1B2)}iVZuNaCK;&0
-zBm-5LFi?dF167!0pbC==RAItE6($T+VUmF=Ofpb~2?JG_Fi?d_2C6X0Kouqo6p_5T
-zFi=FeV!SiSKoR0H$dH(_Z(*Q_WZ%L-5y`$K14StNmJAdjmWs}HV4<vU_xO+1efmLq
-zZ;W>N_U)fP6Qy6Nw5mbt9Y(#emWSi66=>tq#xoh#Ue=0qyhxi8ZOUe5y0V7VfPUhp
-zwX=;ymc+i5%sg9Ja~lZ&8oAV@mHc>&CHP9v4R(jhtT?un;O4e9#pno)Xkh7OWgK&a
-zyj=3Iv0OuoK_;5rOr5f(Kb~ZXDBO+V`OWYo#_C08imwChQxnjdd?wZLDou8aj;$SD
-zGDYiA3<$Tu<JnHL(KPOChi#zrR32t83}naR$+ym4P_h?z_5#|cW-nw$XD_sOtE62l
-zrD3@*)NVyiklt0&yF9%+klsBey&I<Y2E<!f(E8TuJte)z(|ZHyy<^gQVfx}=`q&B5
-z7nSryp1wGczIaUfVwiq$Fn#<4=@*ssi#+|}K>EdF(l3VTOM~ghPLRH&q%ZOGrGfON
-zW73zx^yR_y<0nX8R??Sw`tm^f@-gYlNFSp|*<gA{q?Zp5Oe-+l#rmyYmKozi9y=P>
-zVReJU*h=ZuVXiS$ohTbw-O#v9>(yZbGE|)?8(H1ZIKvV!jWa0>vy!3eMA^vdhQ>`s
-zuMSg{q3T50$m)j1!HixV<}X9liL#N^4c*tL^y)CF8LCc{jjV3yKAqL8!%SzWI#H%q
-z=bSrQ&)%JCRttF5g4Zf`6l?y@>PzD7MA^D>wBlcH6r1ucwJ<p0O%rZ?JzIY3-QdmZ
-zzs|n>`a5r3e|z)wcUaqS>nqFQ-8x}eCF4u`OWUxqst-@1rSmUs%WmKP5e0dcb?e2N
-z;Z|x*!);VwF|Yuhqs^khqOM!@u*jY!WYldISF(V6`BoNd&6Qfk3>X#SuD^7J>p_D=
-zBPa51y^_n#=cpOt#Zf$ya$Ae9Mfz56n|<i!a=ELS@)%a{^NIH3SDuN<R~sah1km#P
-zU@?*f%<rG=4W1wgfi;C?_n|W@%lm$&8YfvNOJodIg&IcIpIJQRHr<+ej11GQ6)&eF
-z2Lam*jIH}#y0>KnY%4JQfOYS$*uU%f#@$U6`N8I3N-lV?5ErFCdv~xDmu2(wexld4
-z4v^;aVAT2k6GJ^m*FD(Wqc(Qg^)6a<?}h$zLoj}4;PP!+(O{@!a1y-hoAhF_7!z+6
-zslpAmNtYbjHrw-~#SPVk_FUf>-Obg6yV`8o$8_`PyJe_;bY5_EMBfBfWU!Q=*9HsG
-z%_Cda{@_Krr!oHVhv9+y+T5qR8zZ2aZ>5r!$*|f$^U%yBUYfR&B!+EYy_PwL!BeUi
-zJH^}r3r9Q+B)X@Z)fk=P13w&7x#wBtXTZ)g>WITPg5r&pQc!nmyrmk#S(>>b9xnNr
-zx_b#v9Xv-Y><Wb%?S^0Xe&<)bbKl_=Z|3C$tf|F<bYzE*mfHB;uC)`q-?buaBe?l?
-zcLTpK*k<49Z32`K?|nSBMFqxTK^_IE-li2fEGdK~(ZdoKBl6ab4a;Hler#`xvEXJG
-zb?<E%EZExfX>jcOVhS*0rS~RS1dA#xhkv@Nct@#q?LyeKS<$uFec!bw>{@uu$gZ6a
-zyVen1i{1BKd%~`D7|m$;U0a<I*3I7%^N%N%lGYdU_GS!gaR8T$NA@GzFi~z`l7hdl
-zarZy6590|88pi(1zq;V(>38zM0sT&<zX;R5$1w3;`_JMG`;&I&0Y23DMx1%@(w(R9
-z4M$j;D5J+Gy%fijRQsctzFKf&cv|BAz#YLq3CZJWDdtL4u1u1|mkdcUp7|sxJC+?Y
-z_@@s`v3j}Q7*z>6X~cwUxUL8G1KT)_XTp!KAbs;vCp{K3&~_X@+ew=-D}v`2MbFV0
-zQsVsL=rXi-pI*G|iiz;VTCutgUs)hDzV1+4?8KcoP3xROf<M%qC6lgVdpFt4<-|uM
-z=#rl_b1#YjSIl6Toj2z_hOZcKupkdE(LozC(fN=FY(x|sk)ym|;Rq2E1xJWD%Z!ol
-Gu>S+TT-130
-literal 0
-HcmV?d00001
-diff --git a/tests/data/acpi/q35/VIOT.viot b/tests/data/acpi/q35/VIOT.viot
-index XXXXXXX..XXXXXXX 100644
-GIT binary patch
-literal 112
-zcmWIZ^baXu00LVle`k+i1*eDrX9XZ&1PX!JAex!M0Hgv8m>C3sGzdcgBZCA3T-xBj
-Q0Zb)W9Hva*zW_`e0M!8s0RR91
-literal 0
-HcmV?d00001
---
-.25.1

-[PULL 33/33] tests/acpi: add expected blob for VIOT test on virt machine
+Deleted patch
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
-The VIOT blob contains the following:
-[000h 0000   4]                    Signature : "VIOT"    [Virtual I/O Translation Table]
-[004h 0004   4]                 Table Length : 00000058
-[008h 0008   1]                     Revision : 00
-[009h 0009   1]                     Checksum : 66
-[00Ah 0010   6]                       Oem ID : "BOCHS "
-[010h 0016   8]                 Oem Table ID : "BXPC    "
-[018h 0024   4]                 Oem Revision : 00000001
-[01Ch 0028   4]              Asl Compiler ID : "BXPC"
-[020h 0032   4]        Asl Compiler Revision : 00000001
-[024h 0036   2]                   Node count : 0002
-[026h 0038   2]                  Node offset : 0030
-[028h 0040   8]                     Reserved : 0000000000000000
-[030h 0048   1]                         Type : 03 [VirtIO-PCI IOMMU]
-[031h 0049   1]                     Reserved : 00
-[032h 0050   2]                       Length : 0010
-[034h 0052   2]                  PCI Segment : 0000
-[036h 0054   2]               PCI BDF number : 0008
-[038h 0056   8]                     Reserved : 0000000000000000
-[040h 0064   1]                         Type : 01 [PCI Range]
-[041h 0065   1]                     Reserved : 00
-[042h 0066   2]                       Length : 0018
-[044h 0068   4]               Endpoint start : 00000000
-[048h 0072   2]            PCI Segment start : 0000
-[04Ah 0074   2]              PCI Segment end : 0000
-[04Ch 0076   2]                PCI BDF start : 0000
-[04Eh 0078   2]                  PCI BDF end : 00FF
-[050h 0080   2]                  Output node : 0030
-[052h 0082   6]                     Reserved : 000000000000
-Acked-by: Ani Sinha <ani@anisinha.ca>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Message-id: 20211210170415.583179-9-jean-philippe@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/qtest/bios-tables-test-allowed-diff.h |   1 -
- tests/data/acpi/virt/VIOT                   | Bin 0 -> 88 bytes
-files changed, 1 deletion(-)
-diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
-index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/bios-tables-test-allowed-diff.h
-+++ b/tests/qtest/bios-tables-test-allowed-diff.h
-@@ -1,2 +1 @@
- /* List of comma-separated changed AML files to ignore */
--"tests/data/acpi/virt/VIOT",
-diff --git a/tests/data/acpi/virt/VIOT b/tests/data/acpi/virt/VIOT
-index XXXXXXX..XXXXXXX 100644
-GIT binary patch
-literal 88
-zcmWIZ^bd((0D?3pe`k+i1*eDrX9XZ&1PX!JAexE60Hgv8m>C3sGzXN&z`)2L0cSHX
-I{D-Rq0Q5fy0RR91
-literal 0
-HcmV?d00001
---
-.25.1

Hi; here's the first target-arm pullreq for the 7.0 cycle.

thanks
-- PMM

The following changes since commit 76b56fdfc9fa43ec6e5986aee33f108c6c6a511e:

Merge tag 'block-pull-request' of https://gitlab.com/stefanha/qemu into staging (2021-12-14 12:46:18 -0800)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20211215

for you to fetch changes up to aed176558806674d030a8305d989d4e6a5073359:

tests/acpi: add expected blob for VIOT test on virt machine (2021-12-15 10:35:26 +0000)

----------------------------------------------------------------
target-arm queue:
 * ITS: error reporting cleanup
 * aspeed: improve documentation
 * Fix STM32F2XX USART data register readout
 * allow emulated GICv3 to be disabled in non-TCG builds
 * fix exception priority for singlestep, misaligned PC, bp, etc
 * Correct calculation of tlb range invalidate length
 * npcm7xx_emc: fix missing queue_flush
 * virt: Add VIOT ACPI table for virtio-iommu
 * target/i386: Use assert() to sanity-check b1 in SSE decode
 * Don't include qemu-common unnecessarily

----------------------------------------------------------------
Alex Bennée (1):
      hw/intc: clean-up error reporting for failed ITS cmd

Jean-Philippe Brucker (8):
      hw/arm/virt-acpi-build: Add VIOT table for virtio-iommu
      hw/arm/virt: Remove device tree restriction for virtio-iommu
      hw/arm/virt: Reject instantiation of multiple IOMMUs
      hw/arm/virt: Use object_property_set instead of qdev_prop_set
      tests/acpi: allow updates of VIOT expected data files
      tests/acpi: add test case for VIOT
      tests/acpi: add expected blobs for VIOT test on q35 machine
      tests/acpi: add expected blob for VIOT test on virt machine

Joel Stanley (4):
      docs: aspeed: Add new boards
      docs: aspeed: Update OpenBMC image URL
      docs: aspeed: Give an example of booting a kernel
      docs: aspeed: ADC is now modelled

Olivier Hériveaux (1):
      Fix STM32F2XX USART data register readout

Patrick Venture (1):
      hw/net: npcm7xx_emc fix missing queue_flush

Peter Maydell (6):
      target/i386: Use assert() to sanity-check b1 in SSE decode
      include/hw/i386: Don't include qemu-common.h in .h files
      target/hexagon/cpu.h: don't include qemu-common.h
      target/rx/cpu.h: Don't include qemu-common.h
      hw/arm: Don't include qemu-common.h unnecessarily
      target/arm: Correct calculation of tlb range invalidate length

Philippe Mathieu-Daudé (2):
      hw/intc/arm_gicv3: Extract gicv3_set_gicv3state from arm_gicv3_cpuif.c
      hw/intc/arm_gicv3: Introduce CONFIG_ARM_GIC_TCG Kconfig selector

Richard Henderson (10):
      target/arm: Hoist pc_next to a local variable in aarch64_tr_translate_insn
      target/arm: Hoist pc_next to a local variable in arm_tr_translate_insn
      target/arm: Hoist pc_next to a local variable in thumb_tr_translate_insn
      target/arm: Split arm_pre_translate_insn
      target/arm: Advance pc for arch single-step exception
      target/arm: Split compute_fsr_fsc out of arm_deliver_fault
      target/arm: Take an exception if PC is misaligned
      target/arm: Assert thumb pc is aligned
      target/arm: Suppress bp for exceptions with more priority
      tests/tcg: Add arm and aarch64 pc alignment tests

docs/system/arm/aspeed.rst        |  26 ++++++++++++----
 include/hw/i386/microvm.h         |   1 -
 include/hw/i386/x86.h             |   1 -
 target/arm/helper.h               |   1 +
 target/arm/syndrome.h             |   5 +++
 target/hexagon/cpu.h              |   1 -
 target/rx/cpu.h                   |   1 -
 hw/arm/boot.c                     |   1 -
 hw/arm/digic_boards.c             |   1 -
 hw/arm/highbank.c                 |   1 -
 hw/arm/npcm7xx_boards.c           |   1 -
 hw/arm/sbsa-ref.c                 |   1 -
 hw/arm/stm32f405_soc.c            |   1 -
 hw/arm/vexpress.c                 |   1 -
 hw/arm/virt-acpi-build.c          |   7 +++++
 hw/arm/virt.c                     |  21 ++++++-------
 hw/char/stm32f2xx_usart.c         |   3 +-
 hw/intc/arm_gicv3.c               |   2 +-
 hw/intc/arm_gicv3_cpuif.c         |  10 +-----
 hw/intc/arm_gicv3_cpuif_common.c  |  22 +++++++++++++
 hw/intc/arm_gicv3_its.c           |  39 +++++++++++++++--------
 hw/net/npcm7xx_emc.c              |  18 +++++------
 hw/virtio/virtio-iommu-pci.c      |  12 ++------
 linux-user/aarch64/cpu_loop.c     |  46 ++++++++++++++++------------
 linux-user/hexagon/cpu_loop.c     |   1 +
 target/arm/debug_helper.c         |  23 ++++++++++++++
 target/arm/gdbstub.c              |   9 ++++--
 target/arm/helper.c               |   6 ++--
 target/arm/machine.c              |  10 ++++++
 target/arm/tlb_helper.c           |  63 ++++++++++++++++++++++++++++----------
 target/arm/translate-a64.c        |  23 ++++++++++++--
 target/arm/translate.c            |  58 ++++++++++++++++++++++++++---------
 target/i386/tcg/translate.c       |  12 ++------
 tests/qtest/bios-tables-test.c    |  38 +++++++++++++++++++++++
 tests/tcg/aarch64/pcalign-a64.c   |  37 ++++++++++++++++++++++
 tests/tcg/arm/pcalign-a32.c       |  46 ++++++++++++++++++++++++++++
 hw/arm/Kconfig                    |   1 +
 hw/intc/Kconfig                   |   5 +++
 hw/intc/meson.build               |  11 ++++---
 tests/data/acpi/q35/DSDT.viot     | Bin 0 -> 9398 bytes
 tests/data/acpi/q35/VIOT.viot     | Bin 0 -> 112 bytes
 tests/data/acpi/virt/VIOT         | Bin 0 -> 88 bytes
 tests/tcg/aarch64/Makefile.target |   4 +--
 tests/tcg/arm/Makefile.target     |   4 +++
 44 files changed, 429 insertions(+), 145 deletions(-)
 create mode 100644 hw/intc/arm_gicv3_cpuif_common.c
 create mode 100644 tests/tcg/aarch64/pcalign-a64.c
 create mode 100644 tests/tcg/arm/pcalign-a32.c
 create mode 100644 tests/data/acpi/q35/DSDT.viot
 create mode 100644 tests/data/acpi/q35/VIOT.viot
 create mode 100644 tests/data/acpi/virt/VIOT

From: Alex Bennée <alex.bennee@linaro.org>

While trying to debug a GIC ITS failure I saw some guest errors that
had poor formatting as well as leaving me confused as to what failed.
As most of the checks aren't possible without a valid dte split that
check apart and then check the other conditions in steps. This avoids
us relying on undefined data.

I still get a failure with the current kvm-unit-tests but at least I
know (partially) why now:

Exception return from AArch64 EL1 to AArch64 EL1 PC 0x40080588
  PASS: gicv3: its-trigger: inv/invall: dev2/eventid=20 now triggers an LPI
  ITS: MAPD devid=2 size = 0x8 itt=0x40430000 valid=0
  INT dev_id=2 event_id=20
  process_its_cmd: invalid command attributes: invalid dte: 0 for 2 (MEM_TX: 0)
  PASS: gicv3: its-trigger: mapd valid=false: no LPI after device unmap
  SUMMARY: 6 tests, 1 unexpected failures

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20211112170454.3158925-1-alex.bennee@linaro.org
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_its.c | 39 +++++++++++++++++++++++++++------------
 1 file changed, 27 insertions(+), 12 deletions(-)

diff --git a/hw/intc/arm_gicv3_its.c b/hw/intc/arm_gicv3_its.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_its.c
+++ b/hw/intc/arm_gicv3_its.c
@@ -XXX,XX +XXX,XX @@ static bool process_its_cmd(GICv3ITSState *s, uint64_t value, uint32_t offset,
         if (res != MEMTX_OK) {
             return result;
         }
+    } else {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes: "
+                      "invalid dte: %"PRIx64" for %d (MEM_TX: %d)\n",
+                      __func__, dte, devid, res);
+        return result;
     }
 
-    if ((devid > s->dt.maxids.max_devids) || !dte_valid || !ite_valid ||
-            !cte_valid || (eventid > max_eventid)) {
+
+    /*
+     * In this implementation, in case of guest errors we ignore the
+     * command and move onto the next command in the queue.
+     */
+    if (devid > s->dt.maxids.max_devids) {
         qemu_log_mask(LOG_GUEST_ERROR,
-                      "%s: invalid command attributes "
-                      "devid %d or eventid %d or invalid dte %d or"
-                      "invalid cte %d or invalid ite %d\n",
-                      __func__, devid, eventid, dte_valid, cte_valid,
-                      ite_valid);
-        /*
-         * in this implementation, in case of error
-         * we ignore this command and move onto the next
-         * command in the queue
-         */
+                      "%s: invalid command attributes: devid %d>%d",
+                      __func__, devid, s->dt.maxids.max_devids);
+
+    } else if (!dte_valid || !ite_valid || !cte_valid) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes: "
+                      "dte: %s, ite: %s, cte: %s\n",
+                      __func__,
+                      dte_valid ? "valid" : "invalid",
+                      ite_valid ? "valid" : "invalid",
+                      cte_valid ? "valid" : "invalid");
+    } else if (eventid > max_eventid) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: invalid command attributes: eventid %d > %d\n",
+                      __func__, eventid, max_eventid);
     } else {
         /*
          * Current implementation only supports rdbase == procnum
-- 
2.25.1

From: Joel Stanley <joel@jms.id.au>

Add X11, FP5280G2, G220A, Rainier and Fuji. Mention that Swift will be
removed in v7.0.

Signed-off-by: Joel Stanley <joel@jms.id.au>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Message-id: 20211117065752.330632-2-joel@jms.id.au
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/aspeed.rst | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -XXX,XX +XXX,XX @@ AST2400 SoC based machines :
 
 - ``palmetto-bmc``         OpenPOWER Palmetto POWER8 BMC
 - ``quanta-q71l-bmc``      OpenBMC Quanta BMC
+- ``supermicrox11-bmc``    Supermicro X11 BMC
 
 AST2500 SoC based machines :
 
@@ -XXX,XX +XXX,XX @@ AST2500 SoC based machines :
 - ``romulus-bmc``          OpenPOWER Romulus POWER9 BMC
 - ``witherspoon-bmc``      OpenPOWER Witherspoon POWER9 BMC
 - ``sonorapass-bmc``       OCP SonoraPass BMC
-- ``swift-bmc``            OpenPOWER Swift BMC POWER9
+- ``swift-bmc``            OpenPOWER Swift BMC POWER9 (to be removed in v7.0)
+- ``fp5280g2-bmc``         Inspur FP5280G2 BMC
+- ``g220a-bmc``            Bytedance G220A BMC
 
 AST2600 SoC based machines :
 
 - ``ast2600-evb``          Aspeed AST2600 Evaluation board (Cortex-A7)
 - ``tacoma-bmc``           OpenPOWER Witherspoon POWER9 AST2600 BMC
+- ``rainier-bmc``          IBM Rainier POWER10 BMC
+- ``fuji-bmc``             Facebook Fuji BMC
 
 Supported devices
 -----------------
-- 
2.25.1

From: Joel Stanley <joel@jms.id.au>

A common use case for the ASPEED machine is to boot a Linux kernel.
Provide a full example command line.

Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Joel Stanley <joel@jms.id.au>
Message-id: 20211117065752.330632-4-joel@jms.id.au
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/aspeed.rst | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/aspeed.rst
+++ b/docs/system/arm/aspeed.rst
@@ -XXX,XX +XXX,XX @@ Missing devices
 Boot options
 ------------
 
-The Aspeed machines can be started using the ``-kernel`` option to
-load a Linux kernel or from a firmware. Images can be downloaded from
-the OpenBMC jenkins :
+The Aspeed machines can be started using the ``-kernel`` and ``-dtb`` options
+to load a Linux kernel or from a firmware. Images can be downloaded from the
+OpenBMC jenkins :
 
    https://jenkins.openbmc.org/job/ci-openbmc/lastSuccessfulBuild/
 
@@ -XXX,XX +XXX,XX @@ or directly from the OpenBMC GitHub release repository :
 
    https://github.com/openbmc/openbmc/releases
 
+To boot a kernel directly from a Linux build tree:
+
+.. code-block:: bash
+
+  $ qemu-system-arm -M ast2600-evb -nographic \
+        -kernel arch/arm/boot/zImage \
+        -dtb arch/arm/boot/dts/aspeed-ast2600-evb.dtb \
+        -initrd rootfs.cpio
+
 The image should be attached as an MTD drive. Run :
 
 .. code-block:: bash
-- 
2.25.1

From: Olivier Hériveaux <olivier.heriveaux@ledger.fr>

Fix issue where the data register may be overwritten by next character
reception before being read and returned.

Signed-off-by: Olivier Hériveaux <olivier.heriveaux@ledger.fr>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20211128120723.4053-1-olivier.heriveaux@ledger.fr
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/stm32f2xx_usart.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/char/stm32f2xx_usart.c b/hw/char/stm32f2xx_usart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/stm32f2xx_usart.c
+++ b/hw/char/stm32f2xx_usart.c
@@ -XXX,XX +XXX,XX @@ static uint64_t stm32f2xx_usart_read(void *opaque, hwaddr addr,
         return retvalue;
     case USART_DR:
         DB_PRINT("Value: 0x%" PRIx32 ", %c\n", s->usart_dr, (char) s->usart_dr);
+        retvalue = s->usart_dr & 0x3FF;
         s->usart_sr &= ~USART_SR_RXNE;
         qemu_chr_fe_accept_input(&s->chr);
         qemu_set_irq(s->irq, 0);
-        return s->usart_dr & 0x3FF;
+        return retvalue;
     case USART_BRR:
         return s->usart_brr;
     case USART_CR1:
-- 
2.25.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

gicv3_set_gicv3state() is used by arm_gicv3_common.c in
arm_gicv3_common_realize(). Since we want to restrict
arm_gicv3_cpuif.c to TCG, extract gicv3_set_gicv3state()
to a new file. Add this file to the meson 'specific'
source set, since it needs access to "cpu.h".

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20211115223619.2599282-2-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3_cpuif.c        | 10 +---------
 hw/intc/arm_gicv3_cpuif_common.c | 22 ++++++++++++++++++++++
 hw/intc/meson.build              |  1 +
 3 files changed, 24 insertions(+), 9 deletions(-)
 create mode 100644 hw/intc/arm_gicv3_cpuif_common.c

diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@
 /*
- * ARM Generic Interrupt Controller v3
+ * ARM Generic Interrupt Controller v3 (emulation)
  *
  * Copyright (c) 2016 Linaro Limited
  * Written by Peter Maydell
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "cpu.h"
 
-void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)
-{
-    ARMCPU *arm_cpu = ARM_CPU(cpu);
-    CPUARMState *env = &arm_cpu->env;
-
-    env->gicv3state = (void *)s;
-};
-
 static GICv3CPUState *icc_cs_from_env(CPUARMState *env)
 {
     return env->gicv3state;
diff --git a/hw/intc/arm_gicv3_cpuif_common.c b/hw/intc/arm_gicv3_cpuif_common.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/intc/arm_gicv3_cpuif_common.c
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+/*
+ * ARM Generic Interrupt Controller v3
+ *
+ * Copyright (c) 2016 Linaro Limited
+ * Written by Peter Maydell
+ *
+ * This code is licensed under the GPL, version 2 or (at your option)
+ * any later version.
+ */
+
+#include "qemu/osdep.h"
+#include "gicv3_internal.h"
+#include "cpu.h"
+
+void gicv3_set_gicv3state(CPUState *cpu, GICv3CPUState *s)
+{
+    ARMCPU *arm_cpu = ARM_CPU(cpu);
+    CPUARMState *env = &arm_cpu->env;
+
+    env->gicv3state = (void *)s;
+};
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in
 
 specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))
 specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))
+specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
 specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif.c'))
 specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))
 specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
-- 
2.25.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The TYPE_ARM_GICV3 device is an emulated one.  When using
KVM, it is recommended to use the TYPE_KVM_ARM_GICV3 device
(which uses in-kernel support).

When using --with-devices-FOO, it is possible to build a
binary with a specific set of devices. When this binary is
restricted to KVM accelerator, the TYPE_ARM_GICV3 device is
irrelevant, and it is desirable to remove it from the binary.

Therefore introduce the CONFIG_ARM_GIC_TCG Kconfig selector
which select the files required to have the TYPE_ARM_GICV3
device, but also allowing to de-select this device.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20211115223619.2599282-3-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/intc/arm_gicv3.c |  2 +-
 hw/intc/Kconfig     |  5 +++++
 hw/intc/meson.build | 10 ++++++----
 3 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/hw/intc/arm_gicv3.c b/hw/intc/arm_gicv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3.c
+++ b/hw/intc/arm_gicv3.c
@@ -XXX,XX +XXX,XX @@
 /*
- * ARM Generic Interrupt Controller v3
+ * ARM Generic Interrupt Controller v3 (emulation)
  *
  * Copyright (c) 2015 Huawei.
  * Copyright (c) 2016 Linaro Limited
diff --git a/hw/intc/Kconfig b/hw/intc/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/Kconfig
+++ b/hw/intc/Kconfig
@@ -XXX,XX +XXX,XX @@ config APIC
     select MSI_NONBROKEN
     select I8259
 
+config ARM_GIC_TCG
+    bool
+    default y
+    depends on ARM_GIC && TCG
+
 config ARM_GIC_KVM
     bool
     default y
diff --git a/hw/intc/meson.build b/hw/intc/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/meson.build
+++ b/hw/intc/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_ARM_GIC', if_true: files(
   'arm_gic.c',
   'arm_gic_common.c',
   'arm_gicv2m.c',
-  'arm_gicv3.c',
   'arm_gicv3_common.c',
-  'arm_gicv3_dist.c',
   'arm_gicv3_its_common.c',
-  'arm_gicv3_redist.c',
+))
+softmmu_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files(
+  'arm_gicv3.c',
+  'arm_gicv3_dist.c',
   'arm_gicv3_its.c',
+  'arm_gicv3_redist.c',
 ))
 softmmu_ss.add(when: 'CONFIG_ETRAXFS', if_true: files('etraxfs_pic.c'))
 softmmu_ss.add(when: 'CONFIG_HEATHROW_PIC', if_true: files('heathrow_pic.c'))
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_XLNX_ZYNQMP_PMU', if_true: files('xlnx-pmu-iomod-in
 specific_ss.add(when: 'CONFIG_ALLWINNER_A10_PIC', if_true: files('allwinner-a10-pic.c'))
 specific_ss.add(when: 'CONFIG_APIC', if_true: files('apic.c', 'apic_common.c'))
 specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif_common.c'))
-specific_ss.add(when: 'CONFIG_ARM_GIC', if_true: files('arm_gicv3_cpuif.c'))
+specific_ss.add(when: 'CONFIG_ARM_GIC_TCG', if_true: files('arm_gicv3_cpuif.c'))
 specific_ss.add(when: 'CONFIG_ARM_GIC_KVM', if_true: files('arm_gic_kvm.c'))
 specific_ss.add(when: ['CONFIG_ARM_GIC_KVM', 'TARGET_AARCH64'], if_true: files('arm_gicv3_kvm.c', 'arm_gicv3_its_kvm.c'))
 specific_ss.add(when: 'CONFIG_ARM_V7M', if_true: files('armv7m_nvic.c'))
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *s = container_of(dcbase, DisasContext, base);
     CPUARMState *env = cpu->env_ptr;
+    uint64_t pc = s->base.pc_next;
     uint32_t insn;
 
     if (s->ss_active && !s->pstate_ss) {
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
         return;
     }
 
-    s->pc_curr = s->base.pc_next;
-    insn = arm_ldl_code(env, &s->base, s->base.pc_next, s->sctlr_b);
+    s->pc_curr = pc;
+    insn = arm_ldl_code(env, &s->base, pc, s->sctlr_b);
     s->insn = insn;
-    s->base.pc_next += 4;
+    s->base.pc_next = pc + 4;
 
     s->fp_access_checked = false;
     s->sve_access_checked = false;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
     CPUARMState *env = cpu->env_ptr;
+    uint32_t pc = dc->base.pc_next;
     unsigned int insn;
 
     if (arm_pre_translate_insn(dc)) {
-        dc->base.pc_next += 4;
+        dc->base.pc_next = pc + 4;
         return;
     }
 
-    dc->pc_curr = dc->base.pc_next;
-    insn = arm_ldl_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
+    dc->pc_curr = pc;
+    insn = arm_ldl_code(env, &dc->base, pc, dc->sctlr_b);
     dc->insn = insn;
-    dc->base.pc_next += 4;
+    dc->base.pc_next = pc + 4;
     disas_arm_insn(dc, insn);
 
     arm_post_translate_insn(dc);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
 {
     DisasContext *dc = container_of(dcbase, DisasContext, base);
     CPUARMState *env = cpu->env_ptr;
+    uint32_t pc = dc->base.pc_next;
     uint32_t insn;
     bool is_16bit;
 
     if (arm_pre_translate_insn(dc)) {
-        dc->base.pc_next += 2;
+        dc->base.pc_next = pc + 2;
         return;
     }
 
-    dc->pc_curr = dc->base.pc_next;
-    insn = arm_lduw_code(env, &dc->base, dc->base.pc_next, dc->sctlr_b);
+    dc->pc_curr = pc;
+    insn = arm_lduw_code(env, &dc->base, pc, dc->sctlr_b);
     is_16bit = thumb_insn_is_16bit(dc, dc->base.pc_next, insn);
-    dc->base.pc_next += 2;
+    pc += 2;
     if (!is_16bit) {
-        uint32_t insn2 = arm_lduw_code(env, &dc->base, dc->base.pc_next,
-                                       dc->sctlr_b);
-
+        uint32_t insn2 = arm_lduw_code(env, &dc->base, pc, dc->sctlr_b);
         insn = insn << 16 | insn2;
-        dc->base.pc_next += 2;
+        pc += 2;
     }
+    dc->base.pc_next = pc;
     dc->insn = insn;
 
     if (dc->pstate_il) {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Create arm_check_ss_active and arm_check_kernelpage.

Reverse the order of the tests.  While it doesn't matter in practice,
because only user-only has a kernel page and user-only never sets
ss_active, ss_active has priority over execution exceptions and it
is best to keep them in the proper order.

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_insn_start(DisasContextBase *dcbase, CPUState *cpu)
     dc->insn_start = tcg_last_op();
 }
 
-static bool arm_pre_translate_insn(DisasContext *dc)
+static bool arm_check_kernelpage(DisasContext *dc)
 {
 #ifdef CONFIG_USER_ONLY
     /* Intercept jump to the magic kernel page.  */
@@ -XXX,XX +XXX,XX @@ static bool arm_pre_translate_insn(DisasContext *dc)
         return true;
     }
 #endif
+    return false;
+}
 
+static bool arm_check_ss_active(DisasContext *dc)
+{
     if (dc->ss_active && !dc->pstate_ss) {
         /* Singlestep state is Active-pending.
          * If we're in this state at the start of a TB then either
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     uint32_t pc = dc->base.pc_next;
     unsigned int insn;
 
-    if (arm_pre_translate_insn(dc)) {
+    if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {
         dc->base.pc_next = pc + 4;
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     uint32_t insn;
     bool is_16bit;
 
-    if (arm_pre_translate_insn(dc)) {
+    if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {
         dc->base.pc_next = pc + 2;
         return;
     }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We will reuse this section of arm_deliver_fault for
raising pc alignment faults.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tlb_helper.c | 45 +++++++++++++++++++++++++----------------
 1 file changed, 28 insertions(+), 17 deletions(-)

diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tlb_helper.c
+++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
     return syn;
 }
 
-static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,
-                                            MMUAccessType access_type,
-                                            int mmu_idx, ARMMMUFaultInfo *fi)
+static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
+                                int target_el, int mmu_idx, uint32_t *ret_fsc)
 {
-    CPUARMState *env = &cpu->env;
-    int target_el;
-    bool same_el;
-    uint32_t syn, exc, fsr, fsc;
     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
-
-    target_el = exception_target_el(env);
-    if (fi->stage2) {
-        target_el = 2;
-        env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
-        if (arm_is_secure_below_el3(env) && fi->s1ns) {
-            env->cp15.hpfar_el2 |= HPFAR_NS;
-        }
-    }
-    same_el = (arm_current_el(env) == target_el);
+    uint32_t fsr, fsc;
 
     if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
         arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
@@ -XXX,XX +XXX,XX @@ static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,
         fsc = 0x3f;
     }
 
+    *ret_fsc = fsc;
+    return fsr;
+}
+
+static void QEMU_NORETURN arm_deliver_fault(ARMCPU *cpu, vaddr addr,
+                                            MMUAccessType access_type,
+                                            int mmu_idx, ARMMMUFaultInfo *fi)
+{
+    CPUARMState *env = &cpu->env;
+    int target_el;
+    bool same_el;
+    uint32_t syn, exc, fsr, fsc;
+
+    target_el = exception_target_el(env);
+    if (fi->stage2) {
+        target_el = 2;
+        env->cp15.hpfar_el2 = extract64(fi->s2addr, 12, 47) << 4;
+        if (arm_is_secure_below_el3(env) && fi->s1ns) {
+            env->cp15.hpfar_el2 |= HPFAR_NS;
+        }
+    }
+    same_el = (arm_current_el(env) == target_el);
+
+    fsr = compute_fsr_fsc(env, fi, target_el, mmu_idx, &fsc);
+
     if (access_type == MMU_INST_FETCH) {
         syn = syn_insn_abort(same_el, fi->ea, fi->s1ptw, fsc);
         exc = EXCP_PREFETCH_ABORT;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

For A64, any input to an indirect branch can cause this.

For A32, many indirect branch paths force the branch to be aligned,
but BXWritePC does not.  This includes the BX instruction but also
other interworking changes to PC.  Prior to v8, this case is UNDEFINED.
With v8, this is CONSTRAINED UNPREDICTABLE and may either raise an
exception or force align the PC.

We choose to raise an exception because we have the infrastructure,
it makes the generated code for gen_bx simpler, and it has the
possibility of catching more guest bugs.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h           |  1 +
 target/arm/syndrome.h         |  5 ++++
 linux-user/aarch64/cpu_loop.c | 46 ++++++++++++++++++++---------------
 target/arm/tlb_helper.c       | 18 ++++++++++++++
 target/arm/translate-a64.c    | 15 ++++++++++++
 target/arm/translate.c        | 22 ++++++++++++++++-
 6 files changed, 87 insertions(+), 20 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_3(sel_flags, TCG_CALL_NO_RWG_SE,
 DEF_HELPER_2(exception_internal, void, env, i32)
 DEF_HELPER_4(exception_with_syndrome, void, env, i32, i32, i32)
 DEF_HELPER_2(exception_bkpt_insn, void, env, i32)
+DEF_HELPER_2(exception_pc_alignment, noreturn, env, tl)
 DEF_HELPER_1(setend, void, env)
 DEF_HELPER_2(wfi, void, env, i32)
 DEF_HELPER_1(wfe, void, env)
diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_illegalstate(void)
     return (EC_ILLEGALSTATE << ARM_EL_EC_SHIFT) | ARM_EL_IL;
 }
 
+static inline uint32_t syn_pcalignment(void)
+{
+    return (EC_PCALIGNMENT << ARM_EL_EC_SHIFT) | ARM_EL_IL;
+}
+
 #endif /* TARGET_ARM_SYNDROME_H */
diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
             break;
         case EXCP_PREFETCH_ABORT:
         case EXCP_DATA_ABORT:
-            /* We should only arrive here with EC in {DATAABORT, INSNABORT}. */
             ec = syn_get_ec(env->exception.syndrome);
-            assert(ec == EC_DATAABORT || ec == EC_INSNABORT);
-
-            /* Both EC have the same format for FSC, or close enough. */
-            fsc = extract32(env->exception.syndrome, 0, 6);
-            switch (fsc) {
-            case 0x04 ... 0x07: /* Translation fault, level {0-3} */
-                si_signo = TARGET_SIGSEGV;
-                si_code = TARGET_SEGV_MAPERR;
+            switch (ec) {
+            case EC_DATAABORT:
+            case EC_INSNABORT:
+                /* Both EC have the same format for FSC, or close enough. */
+                fsc = extract32(env->exception.syndrome, 0, 6);
+                switch (fsc) {
+                case 0x04 ... 0x07: /* Translation fault, level {0-3} */
+                    si_signo = TARGET_SIGSEGV;
+                    si_code = TARGET_SEGV_MAPERR;
+                    break;
+                case 0x09 ... 0x0b: /* Access flag fault, level {1-3} */
+                case 0x0d ... 0x0f: /* Permission fault, level {1-3} */
+                    si_signo = TARGET_SIGSEGV;
+                    si_code = TARGET_SEGV_ACCERR;
+                    break;
+                case 0x11: /* Synchronous Tag Check Fault */
+                    si_signo = TARGET_SIGSEGV;
+                    si_code = TARGET_SEGV_MTESERR;
+                    break;
+                case 0x21: /* Alignment fault */
+                    si_signo = TARGET_SIGBUS;
+                    si_code = TARGET_BUS_ADRALN;
+                    break;
+                default:
+                    g_assert_not_reached();
+                }
                 break;
-            case 0x09 ... 0x0b: /* Access flag fault, level {1-3} */
-            case 0x0d ... 0x0f: /* Permission fault, level {1-3} */
-                si_signo = TARGET_SIGSEGV;
-                si_code = TARGET_SEGV_ACCERR;
-                break;
-            case 0x11: /* Synchronous Tag Check Fault */
-                si_signo = TARGET_SIGSEGV;
-                si_code = TARGET_SEGV_MTESERR;
-                break;
-            case 0x21: /* Alignment fault */
+            case EC_PCALIGNMENT:
                 si_signo = TARGET_SIGBUS;
                 si_code = TARGET_BUS_ADRALN;
                 break;
diff --git a/target/arm/tlb_helper.c b/target/arm/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tlb_helper.c
+++ b/target/arm/tlb_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "internals.h"
 #include "exec/exec-all.h"
+#include "exec/helper-proto.h"
 
 static inline uint32_t merge_syn_data_abort(uint32_t template_syn,
                                             unsigned int target_el,
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_unaligned_access(CPUState *cs, vaddr vaddr,
     arm_deliver_fault(cpu, vaddr, access_type, mmu_idx, &fi);
 }
 
+void helper_exception_pc_alignment(CPUARMState *env, target_ulong pc)
+{
+    ARMMMUFaultInfo fi = { .type = ARMFault_Alignment };
+    int target_el = exception_target_el(env);
+    int mmu_idx = cpu_mmu_index(env, true);
+    uint32_t fsc;
+
+    env->exception.vaddress = pc;
+
+    /*
+     * Note that the fsc is not applicable to this exception,
+     * since any syndrome is pcalignment not insn_abort.
+     */
+    env->exception.fsr = compute_fsr_fsc(env, &fi, target_el, mmu_idx, &fsc);
+    raise_exception(env, EXCP_PREFETCH_ABORT, syn_pcalignment(), target_el);
+}
+
 #if !defined(CONFIG_USER_ONLY)
 
 /*
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     uint64_t pc = s->base.pc_next;
     uint32_t insn;
 
+    /* Singlestep exceptions have the highest priority. */
     if (s->ss_active && !s->pstate_ss) {
         /* Singlestep state is Active-pending.
          * If we're in this state at the start of a TB then either
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
         return;
     }
 
+    if (pc & 3) {
+        /*
+         * PC alignment fault.  This has priority over the instruction abort
+         * that we would receive from a translation fault via arm_ldl_code.
+         * This should only be possible after an indirect branch, at the
+         * start of the TB.
+         */
+        assert(s->base.num_insns == 1);
+        gen_helper_exception_pc_alignment(cpu_env, tcg_constant_tl(pc));
+        s->base.is_jmp = DISAS_NORETURN;
+        s->base.pc_next = QEMU_ALIGN_UP(pc, 4);
+        return;
+    }
+
     s->pc_curr = pc;
     insn = arm_ldl_code(env, &s->base, pc, s->sctlr_b);
     s->insn = insn;
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     uint32_t pc = dc->base.pc_next;
     unsigned int insn;
 
-    if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {
+    /* Singlestep exceptions have the highest priority. */
+    if (arm_check_ss_active(dc)) {
+        dc->base.pc_next = pc + 4;
+        return;
+    }
+
+    if (pc & 3) {
+        /*
+         * PC alignment fault.  This has priority over the instruction abort
+         * that we would receive from a translation fault via arm_ldl_code
+         * (or the execution of the kernelpage entrypoint). This should only
+         * be possible after an indirect branch, at the start of the TB.
+         */
+        assert(dc->base.num_insns == 1);
+        gen_helper_exception_pc_alignment(cpu_env, tcg_constant_tl(pc));
+        dc->base.is_jmp = DISAS_NORETURN;
+        dc->base.pc_next = QEMU_ALIGN_UP(pc, 4);
+        return;
+    }
+
+    if (arm_check_kernelpage(dc)) {
         dc->base.pc_next = pc + 4;
         return;
     }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Misaligned thumb PC is architecturally impossible.
Assert is better than proceeding, in case we've missed
something somewhere.

Expand a comment about aligning the pc in gdbstub.
Fail an incoming migrate if a thumb pc is misaligned.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub.c   |  9 +++++++--
 target/arm/machine.c   | 10 ++++++++++
 target/arm/translate.c |  3 +++
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ int arm_cpu_gdb_write_register(CPUState *cs, uint8_t *mem_buf, int n)
 
     tmp = ldl_p(mem_buf);
 
-    /* Mask out low bit of PC to workaround gdb bugs.  This will probably
-       cause problems if we ever implement the Jazelle DBX extensions.  */
+    /*
+     * Mask out low bits of PC to workaround gdb bugs.
+     * This avoids an assert in thumb_tr_translate_insn, because it is
+     * architecturally impossible to misalign the pc.
+     * This will probably cause problems if we ever implement the
+     * Jazelle DBX extensions.
+     */
     if (n == 15) {
         tmp &= ~1;
     }
diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
             return -1;
         }
     }
+
+    /*
+     * Misaligned thumb pc is architecturally impossible.
+     * We have an assert in thumb_tr_translate_insn to verify this.
+     * Fail an incoming migrate to avoid this assert.
+     */
+    if (!is_a64(env) && env->thumb && (env->regs[15] & 1)) {
+        return -1;
+    }
+
     if (!kvm_enabled()) {
         pmu_op_finish(&cpu->env);
     }
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void thumb_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     uint32_t insn;
     bool is_16bit;
 
+    /* Misaligned thumb PC is architecturally impossible. */
+    assert((dc->base.pc_next & 1) == 0);
+
     if (arm_check_ss_active(dc) || arm_check_kernelpage(dc)) {
         dc->base.pc_next = pc + 2;
         return;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Both single-step and pc alignment faults have priority over
breakpoint exceptions.

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_breakpoint(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
+    target_ulong pc;
     int n;
 
     /*
@@ -XXX,XX +XXX,XX @@ bool arm_debug_check_breakpoint(CPUState *cs)
         return false;
     }
 
+    /*
+     * Single-step exceptions have priority over breakpoint exceptions.
+     * If single-step state is active-pending, suppress the bp.
+     */
+    if (arm_singlestep_active(env) && !(env->pstate & PSTATE_SS)) {
+        return false;
+    }
+
+    /*
+     * PC alignment faults have priority over breakpoint exceptions.
+     */
+    pc = is_a64(env) ? env->pc : env->regs[15];
+    if ((is_a64(env) || !env->thumb) && (pc & 3) != 0) {
+        return false;
+    }
+
+    /*
+     * Instruction aborts have priority over breakpoint exceptions.
+     * TODO: We would need to look up the page for PC and verify that
+     * it is present and executable.
+     */
+
     for (n = 0; n < ARRAY_SIZE(env->cpu_breakpoint); n++) {
         if (bp_wp_matches(cpu, n, false)) {
             return true;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/tcg/aarch64/pcalign-a64.c   | 37 +++++++++++++++++++++++++
 tests/tcg/arm/pcalign-a32.c       | 46 +++++++++++++++++++++++++++++++
 tests/tcg/aarch64/Makefile.target |  4 +--
 tests/tcg/arm/Makefile.target     |  4 +++
 4 files changed, 89 insertions(+), 2 deletions(-)
 create mode 100644 tests/tcg/aarch64/pcalign-a64.c
 create mode 100644 tests/tcg/arm/pcalign-a32.c

diff --git a/tests/tcg/aarch64/pcalign-a64.c b/tests/tcg/aarch64/pcalign-a64.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/aarch64/pcalign-a64.c
@@ -XXX,XX +XXX,XX @@
+/* Test PC misalignment exception */
+
+#include <assert.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void *expected;
+
+static void sigbus(int sig, siginfo_t *info, void *vuc)
+{
+    assert(info->si_code == BUS_ADRALN);
+    assert(info->si_addr == expected);
+    exit(EXIT_SUCCESS);
+}
+
+int main()
+{
+    void *tmp;
+
+    struct sigaction sa = {
+        .sa_sigaction = sigbus,
+        .sa_flags = SA_SIGINFO
+    };
+
+    if (sigaction(SIGBUS, &sa, NULL) < 0) {
+        perror("sigaction");
+        return EXIT_FAILURE;
+    }
+
+    asm volatile("adr %0, 1f + 1\n\t"
+                 "str %0, %1\n\t"
+                 "br  %0\n"
+                 "1:"
+                 : "=&r"(tmp), "=m"(expected));
+    abort();
+}
diff --git a/tests/tcg/arm/pcalign-a32.c b/tests/tcg/arm/pcalign-a32.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/arm/pcalign-a32.c
@@ -XXX,XX +XXX,XX @@
+/* Test PC misalignment exception */
+
+#ifdef __thumb__
+#error "This test must be compiled for ARM"
+#endif
+
+#include <assert.h>
+#include <signal.h>
+#include <stdlib.h>
+#include <stdio.h>
+
+static void *expected;
+
+static void sigbus(int sig, siginfo_t *info, void *vuc)
+{
+    assert(info->si_code == BUS_ADRALN);
+    assert(info->si_addr == expected);
+    exit(EXIT_SUCCESS);
+}
+
+int main()
+{
+    void *tmp;
+
+    struct sigaction sa = {
+        .sa_sigaction = sigbus,
+        .sa_flags = SA_SIGINFO
+    };
+
+    if (sigaction(SIGBUS, &sa, NULL) < 0) {
+        perror("sigaction");
+        return EXIT_FAILURE;
+    }
+
+    asm volatile("adr %0, 1f + 2\n\t"
+                 "str %0, %1\n\t"
+                 "bx  %0\n"
+                 "1:"
+                 : "=&r"(tmp), "=m"(expected));
+
+    /*
+     * From v8, it is CONSTRAINED UNPREDICTABLE whether BXWritePC aligns
+     * the address or not.  If so, we can legitimately fall through.
+     */
+    return EXIT_SUCCESS;
+}
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ VPATH 		+= $(ARM_SRC)
 AARCH64_SRC=$(SRC_PATH)/tests/tcg/aarch64
 VPATH 		+= $(AARCH64_SRC)
 
-# Float-convert Tests
-AARCH64_TESTS=fcvt
+# Base architecture tests
+AARCH64_TESTS=fcvt pcalign-a64
 
 fcvt: LDFLAGS+=-lm
 
diff --git a/tests/tcg/arm/Makefile.target b/tests/tcg/arm/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/arm/Makefile.target
+++ b/tests/tcg/arm/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
 	$(call run-test,fcvt,$(QEMU) $<,"$< on $(TARGET_NAME)")
 	$(call diff-out,fcvt,$(ARM_SRC)/fcvt.ref)
 
+# PC alignment test
+ARM_TESTS += pcalign-a32
+pcalign-a32: CFLAGS+=-marm
+
 ifeq ($(CONFIG_ARM_COMPATIBLE_SEMIHOSTING),y)
 
 # Semihosting smoke test for linux-user
-- 
2.25.1

In the SSE decode function gen_sse(), we combine a byte
'b' and a value 'b1' which can be [0..3], and switch on them:
   b |= (b1 << 8);
   switch (b) {
   ...
   default:
   unknown_op:
       gen_unknown_opcode(env, s);
       return;
   }

In three cases inside this switch, we were then also checking for
 "if (b1 >= 2) { goto unknown_op; }".
However, this can never happen, because the 'case' values in each place
are 0x0nn or 0x1nn and the switch will have directed the b1 == (2, 3)
cases to the default already.

This check was added in commit c045af25a52e9 in 2010; the added code
was unnecessary then as well, and was apparently intended only to
ensure that we never accidentally ended up indexing off the end
of an sse_op_table with only 2 entries as a result of future bugs
in the decode logic.

Change the checks to assert() instead, and make sure they're always
immediately before the array access they are protecting.

Fixes: Coverity CID 1460207
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/i386/tcg/translate.c | 12 +++---------
 1 file changed, 3 insertions(+), 9 deletions(-)

diff --git a/target/i386/tcg/translate.c b/target/i386/tcg/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/i386/tcg/translate.c
+++ b/target/i386/tcg/translate.c
@@ -XXX,XX +XXX,XX @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b,
         case 0x171: /* shift xmm, im */
         case 0x172:
         case 0x173:
-            if (b1 >= 2) {
-                goto unknown_op;
-            }
             val = x86_ldub_code(env, s);
             if (is_xmm) {
                 tcg_gen_movi_tl(s->T0, val);
@@ -XXX,XX +XXX,XX @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b,
                                 offsetof(CPUX86State, mmx_t0.MMX_L(1)));
                 op1_offset = offsetof(CPUX86State,mmx_t0);
             }
+            assert(b1 < 2);
             sse_fn_epp = sse_op_table2[((b - 1) & 3) * 8 +
                                        (((modrm >> 3)) & 7)][b1];
             if (!sse_fn_epp) {
@@ -XXX,XX +XXX,XX @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b,
             rm = modrm & 7;
             reg = ((modrm >> 3) & 7) | REX_R(s);
             mod = (modrm >> 6) & 3;
-            if (b1 >= 2) {
-                goto unknown_op;
-            }
 
+            assert(b1 < 2);
             sse_fn_epp = sse_op_table6[b].op[b1];
             if (!sse_fn_epp) {
                 goto unknown_op;
@@ -XXX,XX +XXX,XX @@ static void gen_sse(CPUX86State *env, DisasContext *s, int b,
             rm = modrm & 7;
             reg = ((modrm >> 3) & 7) | REX_R(s);
             mod = (modrm >> 6) & 3;
-            if (b1 >= 2) {
-                goto unknown_op;
-            }
 
+            assert(b1 < 2);
             sse_fn_eppi = sse_op_table7[b].op[b1];
             if (!sse_fn_eppi) {
                 goto unknown_op;
-- 
2.25.1

The qemu-common.h header is not supposed to be included from any
other header files, only from .c files (as documented in a comment at
the start of it).

include/hw/i386/x86.h and include/hw/i386/microvm.h break this rule.
In fact, the include is not required at all, so we can just drop it
from both files.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20211129200510.1233037-2-peter.maydell@linaro.org
---
 include/hw/i386/microvm.h | 1 -
 include/hw/i386/x86.h     | 1 -
 2 files changed, 2 deletions(-)

diff --git a/include/hw/i386/microvm.h b/include/hw/i386/microvm.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i386/microvm.h
+++ b/include/hw/i386/microvm.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HW_I386_MICROVM_H
 #define HW_I386_MICROVM_H
 
-#include "qemu-common.h"
 #include "exec/hwaddr.h"
 #include "qemu/notify.h"
 
diff --git a/include/hw/i386/x86.h b/include/hw/i386/x86.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/i386/x86.h
+++ b/include/hw/i386/x86.h
@@ -XXX,XX +XXX,XX @@
 #ifndef HW_I386_X86_H
 #define HW_I386_X86_H
 
-#include "qemu-common.h"
 #include "exec/hwaddr.h"
 #include "qemu/notify.h"
 
-- 
2.25.1

The qemu-common.h header is not supposed to be included from any
other header files, only from .c files (as documented in a comment at
the start of it).

Move the include to linux-user/hexagon/cpu_loop.c, which needs it for
the declaration of cpu_exec_step_atomic().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
Message-id: 20211129200510.1233037-3-peter.maydell@linaro.org
---
 target/hexagon/cpu.h          | 1 -
 linux-user/hexagon/cpu_loop.c | 1 +
 2 files changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/hexagon/cpu.h b/target/hexagon/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/hexagon/cpu.h
+++ b/target/hexagon/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUHexagonState CPUHexagonState;
 
 #include "fpu/softfloat-types.h"
 
-#include "qemu-common.h"
 #include "exec/cpu-defs.h"
 #include "hex_regs.h"
 #include "mmvec/mmvec.h"
diff --git a/linux-user/hexagon/cpu_loop.c b/linux-user/hexagon/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/hexagon/cpu_loop.c
+++ b/linux-user/hexagon/cpu_loop.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu-common.h"
 #include "qemu.h"
 #include "user-internals.h"
 #include "cpu_loop-common.h"
-- 
2.25.1

A lot of C files in hw/arm include qemu-common.h when they don't
need anything from it. Drop the include lines.

omap1.c, pxa2xx.c and strongarm.c retain the include because they
use it for the prototype of qemu_get_timedate().

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Taylor Simpson <tsimpson@quicinc.com>
Reviewed-by: Yoshinori Sato <ysato@users.sourceforge.jp>
Message-id: 20211129200510.1233037-5-peter.maydell@linaro.org
---
 hw/arm/boot.c           | 1 -
 hw/arm/digic_boards.c   | 1 -
 hw/arm/highbank.c       | 1 -
 hw/arm/npcm7xx_boards.c | 1 -
 hw/arm/sbsa-ref.c       | 1 -
 hw/arm/stm32f405_soc.c  | 1 -
 hw/arm/vexpress.c       | 1 -
 hw/arm/virt.c           | 1 -
 8 files changed, 8 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/datadir.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
diff --git a/hw/arm/digic_boards.c b/hw/arm/digic_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/digic_boards.c
+++ b/hw/arm/digic_boards.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "qemu-common.h"
 #include "qemu/datadir.h"
 #include "hw/boards.h"
 #include "qemu/error-report.h"
diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/datadir.h"
 #include "qapi/error.h"
 #include "hw/sysbus.h"
diff --git a/hw/arm/npcm7xx_boards.c b/hw/arm/npcm7xx_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx_boards.c
+++ b/hw/arm/npcm7xx_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/qdev-core.h"
 #include "hw/qdev-properties.h"
 #include "qapi/error.h"
-#include "qemu-common.h"
 #include "qemu/datadir.h"
 #include "qemu/units.h"
 #include "sysemu/blockdev.h"
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/datadir.h"
 #include "qapi/error.h"
 #include "qemu/error-report.h"
diff --git a/hw/arm/stm32f405_soc.c b/hw/arm/stm32f405_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f405_soc.c
+++ b/hw/arm/stm32f405_soc.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "qemu-common.h"
 #include "exec/address-spaces.h"
 #include "sysemu/sysemu.h"
 #include "hw/arm/stm32f405_soc.h"
diff --git a/hw/arm/vexpress.c b/hw/arm/vexpress.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/vexpress.c
+++ b/hw/arm/vexpress.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qapi/error.h"
-#include "qemu-common.h"
 #include "qemu/datadir.h"
 #include "cpu.h"
 #include "hw/sysbus.h"
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
-#include "qemu-common.h"
 #include "qemu/datadir.h"
 #include "qemu/units.h"
 #include "qemu/option.h"
-- 
2.25.1

The calculation of the length of TLB range invalidate operations
in tlbi_aa64_range_get_length() is incorrect in two ways:
 * the NUM field is 5 bits, but we read only 4 bits
 * we miscalculate the page_shift value, because of an
   off-by-one error:
    TG 0b00 is invalid
    TG 0b01 is 4K granule size == 4096 == 2^12
    TG 0b10 is 16K granule size == 16384 == 2^14
    TG 0b11 is 64K granule size == 65536 == 2^16
   so page_shift should be (TG - 1) * 2 + 12

Thanks to the bug report submitter Cha HyunSoo for identifying
both these errors.

Fixes: 84940ed82552d3c ("target/arm: Add support for FEAT_TLBIRANGE")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/734
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20211130173257.1274194-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t tlbi_aa64_range_get_length(CPUARMState *env,
     uint64_t exponent;
     uint64_t length;
 
-    num = extract64(value, 39, 4);
+    num = extract64(value, 39, 5);
     scale = extract64(value, 44, 2);
     page_size_granule = extract64(value, 46, 2);
 
-    page_shift = page_size_granule * 2 + 12;
-
     if (page_size_granule == 0) {
         qemu_log_mask(LOG_GUEST_ERROR, "Invalid page size granule %d\n",
                       page_size_granule);
         return 0;
     }
 
+    page_shift = (page_size_granule - 1) * 2 + 12;
+
     exponent = (5 * scale) + 1;
     length = (num + 1) << (exponent + page_shift);
 
-- 
2.25.1

From: Patrick Venture <venture@google.com>

The rx_active boolean change to true should always trigger a try_read
call that flushes the queue.

Signed-off-by: Patrick Venture <venture@google.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20211203221002.1719306-1-venture@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/net/npcm7xx_emc.c | 18 ++++++++----------
 1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/hw/net/npcm7xx_emc.c b/hw/net/npcm7xx_emc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/npcm7xx_emc.c
+++ b/hw/net/npcm7xx_emc.c
@@ -XXX,XX +XXX,XX @@ static void emc_halt_rx(NPCM7xxEMCState *emc, uint32_t mista_flag)
     emc_set_mista(emc, mista_flag);
 }
 
+static void emc_enable_rx_and_flush(NPCM7xxEMCState *emc)
+{
+    emc->rx_active = true;
+    qemu_flush_queued_packets(qemu_get_queue(emc->nic));
+}
+
 static void emc_set_next_tx_descriptor(NPCM7xxEMCState *emc,
                                        const NPCM7xxEMCTxDesc *tx_desc,
                                        uint32_t desc_addr)
@@ -XXX,XX +XXX,XX @@ static ssize_t emc_receive(NetClientState *nc, const uint8_t *buf, size_t len1)
     return len;
 }
 
-static void emc_try_receive_next_packet(NPCM7xxEMCState *emc)
-{
-    if (emc_can_receive(qemu_get_queue(emc->nic))) {
-        qemu_flush_queued_packets(qemu_get_queue(emc->nic));
-    }
-}
-
 static uint64_t npcm7xx_emc_read(void *opaque, hwaddr offset, unsigned size)
 {
     NPCM7xxEMCState *emc = opaque;
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_emc_write(void *opaque, hwaddr offset,
             emc->regs[REG_MGSTA] |= REG_MGSTA_RXHA;
         }
         if (value & REG_MCMDR_RXON) {
-            emc->rx_active = true;
+            emc_enable_rx_and_flush(emc);
         } else {
             emc_halt_rx(emc, 0);
         }
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_emc_write(void *opaque, hwaddr offset,
         break;
     case REG_RSDR:
         if (emc->regs[REG_MCMDR] & REG_MCMDR_RXON) {
-            emc->rx_active = true;
-            emc_try_receive_next_packet(emc);
+            emc_enable_rx_and_flush(emc);
         }
         break;
     case REG_MIIDA:
-- 
2.25.1

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

When a virtio-iommu is instantiated, describe it using the ACPI VIOT
table.

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@
 #include "kvm_arm.h"
 #include "migration/vmstate.h"
 #include "hw/acpi/ghes.h"
+#include "hw/acpi/viot.h"
 
 #define ARM_SPI_BASE 32
 
@@ -XXX,XX +XXX,XX @@ void virt_acpi_build(VirtMachineState *vms, AcpiBuildTables *tables)
     }
 #endif
 
+    if (vms->iommu == VIRT_IOMMU_VIRTIO) {
+        acpi_add_table(table_offsets, tables_blob);
+        build_viot(ms, tables_blob, tables->linker, vms->virtio_iommu_bdf,
+                   vms->oem_id, vms->oem_table_id);
+    }
+
     /* XSDT is pointed to by RSDP */
     xsdt = tables_blob->len;
     build_xsdt(tables_blob, tables->linker, table_offsets, vms->oem_id,
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
     select DIMM
     select ACPI_HW_REDUCED
     select ACPI_APEI
+    select ACPI_VIOT
 
 config CHEETAH
     bool
-- 
2.25.1

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

virtio-iommu is now supported with ACPI VIOT as well as device tree.
Remove the restriction that prevents from instantiating a virtio-iommu
device under ACPI.

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static HotplugHandler *virt_machine_get_hotplug_handler(MachineState *machine,
     MachineClass *mc = MACHINE_GET_CLASS(machine);
 
     if (device_is_dynamic_sysbus(mc, dev) ||
-       (object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM))) {
+        object_dynamic_cast(OBJECT(dev), TYPE_PC_DIMM) ||
+        object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
         return HOTPLUG_HANDLER(machine);
     }
-    if (object_dynamic_cast(OBJECT(dev), TYPE_VIRTIO_IOMMU_PCI)) {
-        VirtMachineState *vms = VIRT_MACHINE(machine);
-
-        if (!vms->bootinfo.firmware_loaded || !virt_is_acpi_enabled(vms)) {
-            return HOTPLUG_HANDLER(machine);
-        }
-    }
     return NULL;
 }
 
diff --git a/hw/virtio/virtio-iommu-pci.c b/hw/virtio/virtio-iommu-pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/virtio-iommu-pci.c
+++ b/hw/virtio/virtio-iommu-pci.c
@@ -XXX,XX +XXX,XX @@ static void virtio_iommu_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     VirtIOIOMMU *s = VIRTIO_IOMMU(vdev);
 
     if (!qdev_get_machine_hotplug_handler(DEVICE(vpci_dev))) {
-        MachineClass *mc = MACHINE_GET_CLASS(qdev_get_machine());
-
-        error_setg(errp,
-                   "%s machine fails to create iommu-map device tree bindings",
-                   mc->name);
-        error_append_hint(errp,
-                          "Check your machine implements a hotplug handler "
-                          "for the virtio-iommu-pci device\n");
-        error_append_hint(errp, "Check the guest is booted without FW or with "
-                          "-no-acpi\n");
+        error_setg(errp, "Check your machine implements a hotplug handler "
+                         "for the virtio-iommu-pci device");
         return;
     }
     for (int i = 0; i < s->nb_reserved_regions; i++) {
-- 
2.25.1

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

We do not support instantiating multiple IOMMUs. Before adding a
virtio-iommu, check that no other IOMMU is present. This will detect
both "iommu=smmuv3" machine parameter and another virtio-iommu instance.

Fixes: 70e89132c9 ("hw/arm/virt: Add the virtio-iommu device tree mappings")
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20211210170415.583179-4-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,
         hwaddr db_start = 0, db_end = 0;
         char *resv_prop_str;
 
+        if (vms->iommu != VIRT_IOMMU_NONE) {
+            error_setg(errp, "virt machine does not support multiple IOMMUs");
+            return;
+        }
+
         switch (vms->msi_controller) {
         case VIRT_MSI_CTRL_NONE:
             return;
-- 
2.25.1

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

To propagate errors to the caller of the pre_plug callback, use the
object_poperty_set*() functions directly instead of the qdev_prop_set*()
helpers.

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20211210170415.583179-5-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_device_pre_plug_cb(HotplugHandler *hotplug_dev,
                                         db_start, db_end,
                                         VIRTIO_IOMMU_RESV_MEM_T_MSI);
 
-        qdev_prop_set_uint32(dev, "len-reserved-regions", 1);
-        qdev_prop_set_string(dev, "reserved-regions[0]", resv_prop_str);
+        object_property_set_uint(OBJECT(dev), "len-reserved-regions", 1, errp);
+        object_property_set_str(OBJECT(dev), "reserved-regions[0]",
+                                resv_prop_str, errp);
         g_free(resv_prop_str);
     }
 }
-- 
2.25.1

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

Create empty data files and allow updates for the upcoming VIOT tests.

Acked-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20211210170415.583179-6-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test-allowed-diff.h | 3 +++
 tests/data/acpi/q35/DSDT.viot               | 0
 tests/data/acpi/q35/VIOT.viot               | 0
 tests/data/acpi/virt/VIOT                   | 0
 4 files changed, 3 insertions(+)
 create mode 100644 tests/data/acpi/q35/DSDT.viot
 create mode 100644 tests/data/acpi/q35/VIOT.viot
 create mode 100644 tests/data/acpi/virt/VIOT

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

Add two test cases for VIOT, one on the q35 machine and the other on
virt. To test complex topologies the q35 test has two PCIe buses that
bypass the IOMMU (and are therefore not described by VIOT), and two
buses that are translated by virtio-iommu.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20211210170415.583179-7-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test.c | 38 ++++++++++++++++++++++++++++++++++
 1 file changed, 38 insertions(+)

diff --git a/tests/qtest/bios-tables-test.c b/tests/qtest/bios-tables-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/bios-tables-test.c
+++ b/tests/qtest/bios-tables-test.c
@@ -XXX,XX +XXX,XX @@ static void test_acpi_virt_tcg(void)
     free_test_data(&data);
 }
 
+static void test_acpi_q35_viot(void)
+{
+    test_data data = {
+        .machine = MACHINE_Q35,
+        .variant = ".viot",
+    };
+
+    /*
+     * To keep things interesting, two buses bypass the IOMMU.
+     * VIOT should only describes the other two buses.
+     */
+    test_acpi_one("-machine default_bus_bypass_iommu=on "
+                  "-device virtio-iommu-pci "
+                  "-device pxb-pcie,bus_nr=0x10,id=pcie.100,bus=pcie.0 "
+                  "-device pxb-pcie,bus_nr=0x20,id=pcie.200,bus=pcie.0,bypass_iommu=on "
+                  "-device pxb-pcie,bus_nr=0x30,id=pcie.300,bus=pcie.0",
+                  &data);
+    free_test_data(&data);
+}
+
+static void test_acpi_virt_viot(void)
+{
+    test_data data = {
+        .machine = "virt",
+        .uefi_fl1 = "pc-bios/edk2-aarch64-code.fd",
+        .uefi_fl2 = "pc-bios/edk2-arm-vars.fd",
+        .cd = "tests/data/uefi-boot-images/bios-tables-test.aarch64.iso.qcow2",
+        .ram_start = 0x40000000ULL,
+        .scan_len = 128ULL * 1024 * 1024,
+    };
+
+    test_acpi_one("-cpu cortex-a57 "
+                  "-device virtio-iommu-pci", &data);
+    free_test_data(&data);
+}
+
 static void test_oem_fields(test_data *data)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
             qtest_add_func("acpi/q35/kvm/xapic", test_acpi_q35_kvm_xapic);
             qtest_add_func("acpi/q35/kvm/dmar", test_acpi_q35_kvm_dmar);
         }
+        qtest_add_func("acpi/q35/viot", test_acpi_q35_viot);
     } else if (strcmp(arch, "aarch64") == 0) {
         if (has_tcg) {
             qtest_add_func("acpi/virt", test_acpi_virt_tcg);
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
             qtest_add_func("acpi/virt/memhp", test_acpi_virt_tcg_memhp);
             qtest_add_func("acpi/virt/pxb", test_acpi_virt_tcg_pxb);
             qtest_add_func("acpi/virt/oem-fields", test_acpi_oem_fields_virt);
+            qtest_add_func("acpi/virt/viot", test_acpi_virt_viot);
         }
     }
     ret = g_test_run();
-- 
2.25.1

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

Add expected blobs of the VIOT and DSDT table for the VIOT test on the
q35 machine.

Since the test instantiates a virtio device and two PCIe expander
bridges, DSDT.viot has more blocks than the base DSDT.

The VIOT table generated for the q35 test is:

[000h 0000   4]                    Signature : "VIOT"    [Virtual I/O Translation Table]
[004h 0004   4]                 Table Length : 00000070
[008h 0008   1]                     Revision : 00
[009h 0009   1]                     Checksum : 3D
[00Ah 0010   6]                       Oem ID : "BOCHS "
[010h 0016   8]                 Oem Table ID : "BXPC    "
[018h 0024   4]                 Oem Revision : 00000001
[01Ch 0028   4]              Asl Compiler ID : "BXPC"
[020h 0032   4]        Asl Compiler Revision : 00000001

[024h 0036   2]                   Node count : 0003
[026h 0038   2]                  Node offset : 0030
[028h 0040   8]                     Reserved : 0000000000000000

[030h 0048   1]                         Type : 03 [VirtIO-PCI IOMMU]
[031h 0049   1]                     Reserved : 00
[032h 0050   2]                       Length : 0010

[034h 0052   2]                  PCI Segment : 0000
[036h 0054   2]               PCI BDF number : 0010
[038h 0056   8]                     Reserved : 0000000000000000

[040h 0064   1]                         Type : 01 [PCI Range]
[041h 0065   1]                     Reserved : 00
[042h 0066   2]                       Length : 0018

[044h 0068   4]               Endpoint start : 00003000
[048h 0072   2]            PCI Segment start : 0000
[04Ah 0074   2]              PCI Segment end : 0000
[04Ch 0076   2]                PCI BDF start : 3000
[04Eh 0078   2]                  PCI BDF end : 30FF
[050h 0080   2]                  Output node : 0030
[052h 0082   6]                     Reserved : 000000000000

[058h 0088   1]                         Type : 01 [PCI Range]
[059h 0089   1]                     Reserved : 00
[05Ah 0090   2]                       Length : 0018

[05Ch 0092   4]               Endpoint start : 00001000
[060h 0096   2]            PCI Segment start : 0000
[062h 0098   2]              PCI Segment end : 0000
[064h 0100   2]                PCI BDF start : 1000
[066h 0102   2]                  PCI BDF end : 10FF
[068h 0104   2]                  Output node : 0030
[06Ah 0106   6]                     Reserved : 000000000000

And the DSDT diff is:

@@ -XXX,XX +XXX,XX @@
  *
  * Disassembling to symbolic ASL+ operators
  *
- * Disassembly of tests/data/acpi/q35/DSDT, Fri Dec 10 15:03:08 2021
+ * Disassembly of /tmp/aml-H9Y5D1, Fri Dec 10 15:02:27 2021
  *
  * Original Table Header:
  *     Signature        "DSDT"
- *     Length           0x00002061 (8289)
+ *     Length           0x000024B6 (9398)
  *     Revision         0x01 **** 32-bit table (V1), no 64-bit math support
- *     Checksum         0xFA
+ *     Checksum         0xA7
  *     OEM ID           "BOCHS "
  *     OEM Table ID     "BXPC    "
  *     OEM Revision     0x00000001 (1)
@@ -XXX,XX +XXX,XX @@
         }
     }

+    Scope (\_SB)
+    {
+        Device (PC30)
+        {
+            Name (_UID, 0x30)  // _UID: Unique ID
+            Name (_BBN, 0x30)  // _BBN: BIOS Bus Number
+            Name (_HID, EisaId ("PNP0A08") /* PCI Express Bus */)  // _HID: Hardware ID
+            Name (_CID, EisaId ("PNP0A03") /* PCI Bus */)  // _CID: Compatible ID
+            Method (_OSC, 4, NotSerialized)  // _OSC: Operating System Capabilities
+            {
+                CreateDWordField (Arg3, Zero, CDW1)
+                If ((Arg0 == ToUUID ("33db4d5b-1ff7-401c-9657-7441c03dd766") /* PCI Host Bridge Device */))
+                {
+                    CreateDWordField (Arg3, 0x04, CDW2)
+                    CreateDWordField (Arg3, 0x08, CDW3)
+                    Local0 = CDW3 /* \_SB_.PC30._OSC.CDW3 */
+                    Local0 &= 0x1F
+                    If ((Arg1 != One))
+                    {
+                        CDW1 |= 0x08
+                    }
+
+                    If ((CDW3 != Local0))
+                    {
+                        CDW1 |= 0x10
+                    }
+
+                    CDW3 = Local0
+                }
+                Else
+                {
+                    CDW1 |= 0x04
+                }
+
+                Return (Arg3)
+            }
+
+            Method (_PRT, 0, NotSerialized)  // _PRT: PCI Routing Table
+            {
+                Local0 = Package (0x80){}
+                Local1 = Zero
+                While ((Local1 < 0x80))
+                {
+                    Local2 = (Local1 >> 0x02)
+                    Local3 = ((Local1 + Local2) & 0x03)
+                    If ((Local3 == Zero))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKD,
+                                Zero
+                            }
+                    }
+
+                    If ((Local3 == One))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKA,
+                                Zero
+                            }
+                    }
+
+                    If ((Local3 == 0x02))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKB,
+                                Zero
+                            }
+                    }
+
+                    If ((Local3 == 0x03))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKC,
+                                Zero
+                            }
+                    }
+
+                    Local4 [Zero] = ((Local2 << 0x10) | 0xFFFF)
+                    Local4 [One] = (Local1 & 0x03)
+                    Local0 [Local1] = Local4
+                    Local1++
+                }
+
+                Return (Local0)
+            }
+
+            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
+            {
+                WordBusNumber (ResourceProducer, MinFixed, MaxFixed, PosDecode,
+                    0x0000,             // Granularity
+                    0x0030,             // Range Minimum
+                    0x0030,             // Range Maximum
+                    0x0000,             // Translation Offset
+                    0x0001,             // Length
+                    ,, )
+            })
+        }
+    }
+
+    Scope (\_SB)
+    {
+        Device (PC20)
+        {
+            Name (_UID, 0x20)  // _UID: Unique ID
+            Name (_BBN, 0x20)  // _BBN: BIOS Bus Number
+            Name (_HID, EisaId ("PNP0A08") /* PCI Express Bus */)  // _HID: Hardware ID
+            Name (_CID, EisaId ("PNP0A03") /* PCI Bus */)  // _CID: Compatible ID
+            Method (_OSC, 4, NotSerialized)  // _OSC: Operating System Capabilities
+            {
+                CreateDWordField (Arg3, Zero, CDW1)
+                If ((Arg0 == ToUUID ("33db4d5b-1ff7-401c-9657-7441c03dd766") /* PCI Host Bridge Device */))
+                {
+                    CreateDWordField (Arg3, 0x04, CDW2)
+                    CreateDWordField (Arg3, 0x08, CDW3)
+                    Local0 = CDW3 /* \_SB_.PC20._OSC.CDW3 */
+                    Local0 &= 0x1F
+                    If ((Arg1 != One))
+                    {
+                        CDW1 |= 0x08
+                    }
+
+                    If ((CDW3 != Local0))
+                    {
+                        CDW1 |= 0x10
+                    }
+
+                    CDW3 = Local0
+                }
+                Else
+                {
+                    CDW1 |= 0x04
+                }
+
+                Return (Arg3)
+            }
+
+            Method (_PRT, 0, NotSerialized)  // _PRT: PCI Routing Table
+            {
+                Local0 = Package (0x80){}
+                Local1 = Zero
+                While ((Local1 < 0x80))
+                {
+                    Local2 = (Local1 >> 0x02)
+                    Local3 = ((Local1 + Local2) & 0x03)
+                    If ((Local3 == Zero))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKD,
+                                Zero
+                            }
+                    }
+
+                    If ((Local3 == One))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKA,
+                                Zero
+                            }
+                    }
+
+                    If ((Local3 == 0x02))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKB,
+                                Zero
+                            }
+                    }
+
+                    If ((Local3 == 0x03))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKC,
+                                Zero
+                            }
+                    }
+
+                    Local4 [Zero] = ((Local2 << 0x10) | 0xFFFF)
+                    Local4 [One] = (Local1 & 0x03)
+                    Local0 [Local1] = Local4
+                    Local1++
+                }
+
+                Return (Local0)
+            }
+
+            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
+            {
+                WordBusNumber (ResourceProducer, MinFixed, MaxFixed, PosDecode,
+                    0x0000,             // Granularity
+                    0x0020,             // Range Minimum
+                    0x0020,             // Range Maximum
+                    0x0000,             // Translation Offset
+                    0x0001,             // Length
+                    ,, )
+            })
+        }
+    }
+
+    Scope (\_SB)
+    {
+        Device (PC10)
+        {
+            Name (_UID, 0x10)  // _UID: Unique ID
+            Name (_BBN, 0x10)  // _BBN: BIOS Bus Number
+            Name (_HID, EisaId ("PNP0A08") /* PCI Express Bus */)  // _HID: Hardware ID
+            Name (_CID, EisaId ("PNP0A03") /* PCI Bus */)  // _CID: Compatible ID
+            Method (_OSC, 4, NotSerialized)  // _OSC: Operating System Capabilities
+            {
+                CreateDWordField (Arg3, Zero, CDW1)
+                If ((Arg0 == ToUUID ("33db4d5b-1ff7-401c-9657-7441c03dd766") /* PCI Host Bridge Device */))
+                {
+                    CreateDWordField (Arg3, 0x04, CDW2)
+                    CreateDWordField (Arg3, 0x08, CDW3)
+                    Local0 = CDW3 /* \_SB_.PC10._OSC.CDW3 */
+                    Local0 &= 0x1F
+                    If ((Arg1 != One))
+                    {
+                        CDW1 |= 0x08
+                    }
+
+                    If ((CDW3 != Local0))
+                    {
+                        CDW1 |= 0x10
+                    }
+
+                    CDW3 = Local0
+                }
+                Else
+                {
+                    CDW1 |= 0x04
+                }
+
+                Return (Arg3)
+            }
+
+            Method (_PRT, 0, NotSerialized)  // _PRT: PCI Routing Table
+            {
+                Local0 = Package (0x80){}
+                Local1 = Zero
+                While ((Local1 < 0x80))
+                {
+                    Local2 = (Local1 >> 0x02)
+                    Local3 = ((Local1 + Local2) & 0x03)
+                    If ((Local3 == Zero))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKD,
+                                Zero
+                            }
+                    }
+
+                    If ((Local3 == One))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKA,
+                                Zero
+                            }
+                    }
+
+                    If ((Local3 == 0x02))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKB,
+                                Zero
+                            }
+                    }
+
+                    If ((Local3 == 0x03))
+                    {
+                        Local4 = Package (0x04)
+                            {
+                                Zero,
+                                Zero,
+                                LNKC,
+                                Zero
+                            }
+                    }
+
+                    Local4 [Zero] = ((Local2 << 0x10) | 0xFFFF)
+                    Local4 [One] = (Local1 & 0x03)
+                    Local0 [Local1] = Local4
+                    Local1++
+                }
+
+                Return (Local0)
+            }
+
+            Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
+            {
+                WordBusNumber (ResourceProducer, MinFixed, MaxFixed, PosDecode,
+                    0x0000,             // Granularity
+                    0x0010,             // Range Minimum
+                    0x0010,             // Range Maximum
+                    0x0000,             // Translation Offset
+                    0x0001,             // Length
+                    ,, )
+            })
+        }
+    }
+
     Scope (\_SB.PCI0)
     {
         Name (_CRS, ResourceTemplate ()  // _CRS: Current Resource Settings
@@ -XXX,XX +XXX,XX @@
             WordBusNumber (ResourceProducer, MinFixed, MaxFixed, PosDecode,
                 0x0000,             // Granularity
                 0x0000,             // Range Minimum
-                0x00FF,             // Range Maximum
+                0x000F,             // Range Maximum
                 0x0000,             // Translation Offset
-                0x0100,             // Length
+                0x0010,             // Length
                 ,, )
             IO (Decode16,
                 0x0CF8,             // Range Minimum
@@ -XXX,XX +XXX,XX @@
                 }
             }

+            Device (S10)
+            {
+                Name (_ADR, 0x00020000)  // _ADR: Address
+            }
+
+            Device (S18)
+            {
+                Name (_ADR, 0x00030000)  // _ADR: Address
+            }
+
+            Device (S20)
+            {
+                Name (_ADR, 0x00040000)  // _ADR: Address
+            }
+
+            Device (S28)
+            {
+                Name (_ADR, 0x00050000)  // _ADR: Address
+            }
+
             Method (PCNT, 0, NotSerialized)
             {
             }

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20211210170415.583179-8-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test-allowed-diff.h |   2 --
 tests/data/acpi/q35/DSDT.viot               | Bin 0 -> 9398 bytes
 tests/data/acpi/q35/VIOT.viot               | Bin 0 -> 112 bytes
 3 files changed, 2 deletions(-)

diff --git a/tests/qtest/bios-tables-test-allowed-diff.h b/tests/qtest/bios-tables-test-allowed-diff.h
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/bios-tables-test-allowed-diff.h
+++ b/tests/qtest/bios-tables-test-allowed-diff.h
@@ -XXX,XX +XXX,XX @@
 /* List of comma-separated changed AML files to ignore */
 "tests/data/acpi/virt/VIOT",
-"tests/data/acpi/q35/DSDT.viot",
-"tests/data/acpi/q35/VIOT.viot",
diff --git a/tests/data/acpi/q35/DSDT.viot b/tests/data/acpi/q35/DSDT.viot
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 9398
zcmeHNO>7&-8J*>iv|O&FB}G~Oi$yp||57BBoWHhc5OS9yDTx$CQgH$r;8Idr*-4Q_
z5(9Az1F`}niVsB-)<KW7p`g9Br(A2Gm-gmc1N78GFS!;)e2V(MnH_0{q<{#yMgn&C
zn|*J-d9yqFhO_H6z19~`FlPL*u<DkZ*}|)JH;X@mF-FI<cPg<fti9tEN*yB^i5czN
zNq&q?!OZ;BE3B7{KWzJ-`Tn~f`9?Qj8~2^N8{Oc8J%57{==w%rS#;nOCp*nTr@iZ1
zb+?i;JLQUJ=O0?8*>S~D)a>NF1~WVB6^~_B#yhJ`H+JU@=6aXs`?Yv)J2h=N?drcS
zeLZ*n<<Bm^n}6`jfBx#u8&(W}1?)}iF9o#mZ~E2+zwdn7yK3AbIzKnxpZ>JRPm3~#
z&ICS{+_OayRW-l=Mtk=~uaS3o8z<_udd|(wqg`&JnVPfCe>BUOO`Su3e>pff_^UW%
z&JE^NO`)=Amg~iqRB1pPscP?(>#ZuY8GHCmlEvD$9g3%4Db~Dfz2SATnddvrR-Oe^
z;s;dJec!hnzi)ri^I6YN9vtkm{^TdUF8h7gX8-<Qe4p)GQ=)AtYx2VcwdLVAEXEjG
z^Mj|UHPqkj-LsWuzQem1>F3atdZn=zv3$#RmZzSHN+6-yyU#8cJb=YDilX&sl}vNm
znkgAR^O<3kj4if>{ly5fwRfMWuC5=lrlvKPX~i#654Cp}R_d*JS$9laZ$ra6)<ns8
zFZy28G%xP(nit&F>LDi%G<tIc=TY=gl$jSD&Uv!Yat~XR46h%rI$!}a%!|xG7u8Zn
zeY8_|n=K>xz_v_W8VX$W-Fg-qFWcT}7MCyz{%%{ia7hZ>Law-k6NOr}VI&_48U=2l
zwqDKFE8eTwwozDdms#e?x?5a|v>&JF;2_v0L~z5n%BYU^52<*cWuD4|GYUm@1+?))
zte^45>Rz)t*<T5V#={r>@t@{%?^i#W{i=HAZ*Dc9y59Va-+#P!jrGs;u38a{fLr`N
zvT@rUu>DljxJ?^&Z?-?vyJn3C>3D=qux{Y*bs5|5n)Qmi$TD^Zdn4GU$ocJS2Hh-<
z`xPI^^+v0nUVdjMos8k`WGl7hA`{03ju%<lrgAHSpd^DRf-*}_#Ly0mB!LSfVgWcQ
z&T$@~G9)JI=hz5m0vkrel+Xy{Oh7pkAu-V!j*W7rY(bO}Q$nMH2`FbGB&N)QaV4<4
zo)~9JXiP9=;}NPl<C@MmXG&;XFlFNrsyfFsonxFSp<}vEgsRSQP3O3#b6nSnP}ON_
zI!#Tdsp~|j>ckUB>FI=~GokB5sOq#dotCE4(sd$KbtW~PNlj-`*NIToiD#j5J#9^=
zt?NXn>YUJYPG~wObe#xQos*i*NloXZt`niEb4t@WrRki~bs|)CI+{*L)9L6s5vn><
zn$DD_Go|Z9sOn5>I@6lYw5}7Os&iV?Ij!lO)^#FOb!If38BJ$K*NIToIiu;E(R9w}
zIuWWmPiZ<&X*y5oIuWWmF_XaEC!a&Jn$B5WCqh-{X-(&8P3LJ{Cqh-{8P3dyPr@^t
zSqL9?X9Uwd3W@23*s~h*tj0X6GZCuHa~kuU#yqDp5vt7d8uPryJg+kms?5hU=3^T3
zF`bD}WnSP+=`t5MQ$FJ_2&Q~+BP6E0f^%BVIW6a$o)e+SX~IDBih-7z6{O~7YTy`&
zLjy&Cv?7QikV#>n0>>@MV8oK`Gmun34-FKdlm-J8SZSaNlnhir4-FI{S|bfqV8e)V
zss<{chX#reE#g=hsKAC%sF6d-Km}BWs!kZFsFpKfpbC@>6rprQGEjt4Ck#|zITHq|
zK*>M_l;<P^MJRQ`Kn0dFVW0|>3{*fllMEE0)CmI>Sk8ojDo`>|0p(0GP=xY&!axO<
zGhv_#lnhirIg<<&q0|Wj6<E%MfhtfkPyyvkGEjt4Ck#|zITHq|K*>M_lrzad5lWpf
zP=V!47^ngz0~JutBm+e#b;3XemNQ|X3X}{~Ksl2P6rt1!0~J`#gn=qhGEf2KOfpb}
zQYQ>lU^x>8szAv=1(Y+%KoLrvFi?TzOc<yFB?A>u&LjgxD0RX>1(q{mpbC@>R6seC
z3>2Z%2?G^a&V+#~P%=;f<xDbAgi<FARA4z12C6{GKn0XD$v_cGoiI>=<xCi;0wn_#
zP|hR+MJRQ`Kn0dFVW0|>3{*fllMEE0)CmI>Sk8ojDo`>|0p(0GP=rz^3{+q_69%e4
z$v_2^Gs!>^N}VuJf#pmXr~)Me6;RG314Srx!axxz28u{EP=u<1B2)}iVZuNaCK;&0
zBm-5LFi?dF167!0pbC==RAItE6($T+VUmF=Ofpb~2?JG_Fi?d_2C6X0Kouqo6p_5T
zFi=FeV!SiSKoR0H$dH(_Z(*Q_WZ%L-5y`$K14StNmJAdjmWs}HV4<vU_xO+1efmLq
zZ;W>N_U)fP6Qy6Nw5mbt9Y(#emWSi66=>tq#xoh#Ue=0qyhxi8ZOUe5y0V7VfPUhp
zwX=;ymc+i5%sg9Ja~lZ&8oAV@mHc>&CHP9v4R(jhtT?un;O4e9#pno)Xkh7OWgK&a
zyj=3Iv0OuoK_;5rOr5f(Kb~ZXDBO+V`OWYo#_C08imwChQxnjdd?wZLDou8aj;$SD
zGDYiA3<$Tu<JnHL(KPOChi#zrR32t83}naR$+ym4P_h?z_5#|cW-nw$XD_sOtE62l
zrD3@*)NVyiklt0&yF9%+klsBey&I<Y2E<!f(E8TuJte)z(|ZHyy<^gQVfx}=`q&B5
z7nSryp1wGczIaUfVwiq$Fn#<4=@*ssi#+|}K>EdF(l3VTOM~ghPLRH&q%ZOGrGfON
zW73zx^yR_y<0nX8R??Sw`tm^f@-gYlNFSp|*<gA{q?Zp5Oe-+l#rmyYmKozi9y=P>
zVReJU*h=ZuVXiS$ohTbw-O#v9>(yZbGE|)?8(H1ZIKvV!jWa0>vy!3eMA^vdhQ>`s
zuMSg{q3T50$m)j1!HixV<}X9liL#N^4c*tL^y)CF8LCc{jjV3yKAqL8!%SzWI#H%q
z=bSrQ&)%JCRttF5g4Zf`6l?y@>PzD7MA^D>wBlcH6r1ucwJ<p0O%rZ?JzIY3-QdmZ
zzs|n>`a5r3e|z)wcUaqS>nqFQ-8x}eCF4u`OWUxqst-@1rSmUs%WmKP5e0dcb?e2N
z;Z|x*!);VwF|Yuhqs^khqOM!@u*jY!WYldISF(V6`BoNd&6Qfk3>X#SuD^7J>p_D=
zBPa51y^_n#=cpOt#Zf$ya$Ae9Mfz56n|<i!a=ELS@)%a{^NIH3SDuN<R~sah1km#P
zU@?*f%<rG=4W1wgfi;C?_n|W@%lm$&8YfvNOJodIg&IcIpIJQRHr<+ej11GQ6)&eF
z2Lam*jIH}#y0>KnY%4JQfOYS$*uU%f#@$U6`N8I3N-lV?5ErFCdv~xDmu2(wexld4
z4v^;aVAT2k6GJ^m*FD(Wqc(Qg^)6a<?}h$zLoj}4;PP!+(O{@!a1y-hoAhF_7!z+6
zslpAmNtYbjHrw-~#SPVk_FUf>-Obg6yV`8o$8_`PyJe_;bY5_EMBfBfWU!Q=*9HsG
z%_Cda{@_Krr!oHVhv9+y+T5qR8zZ2aZ>5r!$*|f$^U%yBUYfR&B!+EYy_PwL!BeUi
zJH^}r3r9Q+B)X@Z)fk=P13w&7x#wBtXTZ)g>WITPg5r&pQc!nmyrmk#S(>>b9xnNr
zx_b#v9Xv-Y><Wb%?S^0Xe&<)bbKl_=Z|3C$tf|F<bYzE*mfHB;uC)`q-?buaBe?l?
zcLTpK*k<49Z32`K?|nSBMFqxTK^_IE-li2fEGdK~(ZdoKBl6ab4a;Hler#`xvEXJG
zb?<E%EZExfX>jcOVhS*0rS~RS1dA#xhkv@Nct@#q?LyeKS<$uFec!bw>{@uu$gZ6a
zyVen1i{1BKd%~`D7|m$;U0a<I*3I7%^N%N%lGYdU_GS!gaR8T$NA@GzFi~z`l7hdl
zarZy6590|88pi(1zq;V(>38zM0sT&<zX;R5$1w3;`_JMG`;&I&0Y23DMx1%@(w(R9
z4M$j;D5J+Gy%fijRQsctzFKf&cv|BAz#YLq3CZJWDdtL4u1u1|mkdcUp7|sxJC+?Y
z_@@s`v3j}Q7*z>6X~cwUxUL8G1KT)_XTp!KAbs;vCp{K3&~_X@+ew=-D}v`2MbFV0
zQsVsL=rXi-pI*G|iiz;VTCutgUs)hDzV1+4?8KcoP3xROf<M%qC6lgVdpFt4<-|uM
z=#rl_b1#YjSIl6Toj2z_hOZcKupkdE(LozC(fN=FY(x|sk)ym|;Rq2E1xJWD%Z!ol
Gu>S+TT-130

literal 0
HcmV?d00001

diff --git a/tests/data/acpi/q35/VIOT.viot b/tests/data/acpi/q35/VIOT.viot
index XXXXXXX..XXXXXXX 100644
GIT binary patch
literal 112
zcmWIZ^baXu00LVle`k+i1*eDrX9XZ&1PX!JAex!M0Hgv8m>C3sGzdcgBZCA3T-xBj
Q0Zb)W9Hva*zW_`e0M!8s0RR91

literal 0
HcmV?d00001

-- 
2.25.1

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

The VIOT blob contains the following:

[000h 0000   4]                    Signature : "VIOT"    [Virtual I/O Translation Table]
[004h 0004   4]                 Table Length : 00000058
[008h 0008   1]                     Revision : 00
[009h 0009   1]                     Checksum : 66
[00Ah 0010   6]                       Oem ID : "BOCHS "
[010h 0016   8]                 Oem Table ID : "BXPC    "
[018h 0024   4]                 Oem Revision : 00000001
[01Ch 0028   4]              Asl Compiler ID : "BXPC"
[020h 0032   4]        Asl Compiler Revision : 00000001

[024h 0036   2]                   Node count : 0002
[026h 0038   2]                  Node offset : 0030
[028h 0040   8]                     Reserved : 0000000000000000

[030h 0048   1]                         Type : 03 [VirtIO-PCI IOMMU]
[031h 0049   1]                     Reserved : 00
[032h 0050   2]                       Length : 0010

[034h 0052   2]                  PCI Segment : 0000
[036h 0054   2]               PCI BDF number : 0008
[038h 0056   8]                     Reserved : 0000000000000000

[040h 0064   1]                         Type : 01 [PCI Range]
[041h 0065   1]                     Reserved : 00
[042h 0066   2]                       Length : 0018

[044h 0068   4]               Endpoint start : 00000000
[048h 0072   2]            PCI Segment start : 0000
[04Ah 0074   2]              PCI Segment end : 0000
[04Ch 0076   2]                PCI BDF start : 0000
[04Eh 0078   2]                  PCI BDF end : 00FF
[050h 0080   2]                  Output node : 0030
[052h 0082   6]                     Reserved : 000000000000

Acked-by: Ani Sinha <ani@anisinha.ca>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20211210170415.583179-9-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/bios-tables-test-allowed-diff.h |   1 -
 tests/data/acpi/virt/VIOT                   | Bin 0 -> 88 bytes
 2 files changed, 1 deletion(-)

literal 0
HcmV?d00001

-- 
2.25.1

target-arm queue: two bug fixes, plus the KVM/SVE patchset,
which is a new feature but one which was in my pre-softfreeze
pullreq (it just had to be dropped due to an unexpected test failure.)

thanks
-- PMM

The following changes since commit b7c9a7f353c0e260519bf735ff0d4aa01e72784b:

Merge remote-tracking branch 'remotes/jnsnow/tags/ide-pull-request' into staging (2019-10-31 15:57:30 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191101-1

for you to fetch changes up to d9ae7624b659362cb2bb2b04fee53bf50829ca56:

target/arm: Allow reading flags from FPSCR for M-profile (2019-11-01 08:49:10 +0000)

----------------------------------------------------------------
target-arm queue:
 * Support SVE in KVM guests
 * Don't UNDEF on M-profile 'vmrs apsr_nzcv, fpscr'
 * Update hflags after boot.c modifies CPU state

----------------------------------------------------------------
Andrew Jones (9):
      target/arm/monitor: Introduce qmp_query_cpu_model_expansion
      tests: arm: Introduce cpu feature tests
      target/arm: Allow SVE to be disabled via a CPU property
      target/arm/cpu64: max cpu: Introduce sve<N> properties
      target/arm/kvm64: Add kvm_arch_get/put_sve
      target/arm/kvm64: max cpu: Enable SVE when available
      target/arm/kvm: scratch vcpu: Preserve input kvm_vcpu_init features
      target/arm/cpu64: max cpu: Support sve properties with KVM
      target/arm/kvm: host cpu: Add support for sve<N> properties

Christophe Lyon (1):
      target/arm: Allow reading flags from FPSCR for M-profile

Edgar E. Iglesias (1):
      hw/arm/boot: Rebuild hflags when modifying CPUState at boot

From: Andrew Jones <drjones@redhat.com>

Add support for the query-cpu-model-expansion QMP command to Arm. We
do this selectively, only exposing CPU properties which represent
optional CPU features which the user may want to enable/disable.
Additionally we restrict the list of queryable cpu models to 'max',
'host', or the current type when KVM is in use. And, finally, we only
implement expansion type 'full', as Arm does not yet have a "base"
CPU type. More details and example queries are described in a new
document (docs/arm-cpu-features.rst).

Note, certainly more features may be added to the list of advertised
features, e.g. 'vfp' and 'neon'. The only requirement is that we can
detect invalid configurations and emit failures at QMP query time.
For 'vfp' and 'neon' this will require some refactoring to share a
validation function between the QMP query and the CPU realize
functions.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
Message-id: 20191031142734.8590-2-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 qapi/machine-target.json  |   6 +-
 target/arm/monitor.c      | 146 ++++++++++++++++++++++++++++++++++++++
 docs/arm-cpu-features.rst | 137 +++++++++++++++++++++++++++++++++++
 3 files changed, 286 insertions(+), 3 deletions(-)
 create mode 100644 docs/arm-cpu-features.rst

diff --git a/qapi/machine-target.json b/qapi/machine-target.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/machine-target.json
+++ b/qapi/machine-target.json
@@ -XXX,XX +XXX,XX @@
 ##
 { 'struct': 'CpuModelExpansionInfo',
   'data': { 'model': 'CpuModelInfo' },
-  'if': 'defined(TARGET_S390X) || defined(TARGET_I386)' }
+  'if': 'defined(TARGET_S390X) || defined(TARGET_I386) || defined(TARGET_ARM)' }
 
 ##
 # @query-cpu-model-expansion:
@@ -XXX,XX +XXX,XX @@
 #   query-cpu-model-expansion while using these is not advised.
 #
 # Some architectures may not support all expansion types. s390x supports
-# "full" and "static".
+# "full" and "static". Arm only supports "full".
 #
 # Returns: a CpuModelExpansionInfo. Returns an error if expanding CPU models is
 #          not supported, if the model cannot be expanded, if the model contains
@@ -XXX,XX +XXX,XX @@
   'data': { 'type': 'CpuModelExpansionType',
             'model': 'CpuModelInfo' },
   'returns': 'CpuModelExpansionInfo',
-  'if': 'defined(TARGET_S390X) || defined(TARGET_I386)' }
+  'if': 'defined(TARGET_S390X) || defined(TARGET_I386) || defined(TARGET_ARM)' }
 
 ##
 # @CpuDefinitionInfo:
diff --git a/target/arm/monitor.c b/target/arm/monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/monitor.c
+++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "hw/boards.h"
 #include "kvm_arm.h"
+#include "qapi/error.h"
+#include "qapi/visitor.h"
+#include "qapi/qobject-input-visitor.h"
+#include "qapi/qapi-commands-machine-target.h"
 #include "qapi/qapi-commands-misc-target.h"
+#include "qapi/qmp/qerror.h"
+#include "qapi/qmp/qdict.h"
+#include "qom/qom-qobject.h"
 
 static GICCapability *gic_cap_new(int version)
 {
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
 
     return head;
 }
+
+/*
+ * These are cpu model features we want to advertise. The order here
+ * matters as this is the order in which qmp_query_cpu_model_expansion
+ * will attempt to set them. If there are dependencies between features,
+ * then the order that considers those dependencies must be used.
+ */
+static const char *cpu_model_advertised_features[] = {
+    "aarch64", "pmu",
+    NULL
+};
+
+CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
+                                                     CpuModelInfo *model,
+                                                     Error **errp)
+{
+    CpuModelExpansionInfo *expansion_info;
+    const QDict *qdict_in = NULL;
+    QDict *qdict_out;
+    ObjectClass *oc;
+    Object *obj;
+    const char *name;
+    int i;
+
+    if (type != CPU_MODEL_EXPANSION_TYPE_FULL) {
+        error_setg(errp, "The requested expansion type is not supported");
+        return NULL;
+    }
+
+    if (!kvm_enabled() && !strcmp(model->name, "host")) {
+        error_setg(errp, "The CPU type '%s' requires KVM", model->name);
+        return NULL;
+    }
+
+    oc = cpu_class_by_name(TYPE_ARM_CPU, model->name);
+    if (!oc) {
+        error_setg(errp, "The CPU type '%s' is not a recognized ARM CPU type",
+                   model->name);
+        return NULL;
+    }
+
+    if (kvm_enabled()) {
+        const char *cpu_type = current_machine->cpu_type;
+        int len = strlen(cpu_type) - strlen(ARM_CPU_TYPE_SUFFIX);
+        bool supported = false;
+
+        if (!strcmp(model->name, "host") || !strcmp(model->name, "max")) {
+            /* These are kvmarm's recommended cpu types */
+            supported = true;
+        } else if (strlen(model->name) == len &&
+                   !strncmp(model->name, cpu_type, len)) {
+            /* KVM is enabled and we're using this type, so it works. */
+            supported = true;
+        }
+        if (!supported) {
+            error_setg(errp, "We cannot guarantee the CPU type '%s' works "
+                             "with KVM on this host", model->name);
+            return NULL;
+        }
+    }
+
+    if (model->props) {
+        qdict_in = qobject_to(QDict, model->props);
+        if (!qdict_in) {
+            error_setg(errp, QERR_INVALID_PARAMETER_TYPE, "props", "dict");
+            return NULL;
+        }
+    }
+
+    obj = object_new(object_class_get_name(oc));
+
+    if (qdict_in) {
+        Visitor *visitor;
+        Error *err = NULL;
+
+        visitor = qobject_input_visitor_new(model->props);
+        visit_start_struct(visitor, NULL, NULL, 0, &err);
+        if (err) {
+            visit_free(visitor);
+            object_unref(obj);
+            error_propagate(errp, err);
+            return NULL;
+        }
+
+        i = 0;
+        while ((name = cpu_model_advertised_features[i++]) != NULL) {
+            if (qdict_get(qdict_in, name)) {
+                object_property_set(obj, visitor, name, &err);
+                if (err) {
+                    break;
+                }
+            }
+        }
+
+        if (!err) {
+            visit_check_struct(visitor, &err);
+        }
+        visit_end_struct(visitor, NULL);
+        visit_free(visitor);
+        if (err) {
+            object_unref(obj);
+            error_propagate(errp, err);
+            return NULL;
+        }
+    }
+
+    expansion_info = g_new0(CpuModelExpansionInfo, 1);
+    expansion_info->model = g_malloc0(sizeof(*expansion_info->model));
+    expansion_info->model->name = g_strdup(model->name);
+
+    qdict_out = qdict_new();
+
+    i = 0;
+    while ((name = cpu_model_advertised_features[i++]) != NULL) {
+        ObjectProperty *prop = object_property_find(obj, name, NULL);
+        if (prop) {
+            Error *err = NULL;
+            QObject *value;
+
+            assert(prop->get);
+            value = object_property_get_qobject(obj, name, &err);
+            assert(!err);
+
+            qdict_put_obj(qdict_out, name, value);
+        }
+    }
+
+    if (!qdict_size(qdict_out)) {
+        qobject_unref(qdict_out);
+    } else {
+        expansion_info->model->props = QOBJECT(qdict_out);
+        expansion_info->model->has_props = true;
+    }
+
+    object_unref(obj);
+
+    return expansion_info;
+}
diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/arm-cpu-features.rst
@@ -XXX,XX +XXX,XX @@
+================
+ARM CPU Features
+================
+
+Examples of probing and using ARM CPU features
+
+Introduction
+============
+
+CPU features are optional features that a CPU of supporting type may
+choose to implement or not.  In QEMU, optional CPU features have
+corresponding boolean CPU proprieties that, when enabled, indicate
+that the feature is implemented, and, conversely, when disabled,
+indicate that it is not implemented. An example of an ARM CPU feature
+is the Performance Monitoring Unit (PMU).  CPU types such as the
+Cortex-A15 and the Cortex-A57, which respectively implement ARM
+architecture reference manuals ARMv7-A and ARMv8-A, may both optionally
+implement PMUs.  For example, if a user wants to use a Cortex-A15 without
+a PMU, then the `-cpu` parameter should contain `pmu=off` on the QEMU
+command line, i.e. `-cpu cortex-a15,pmu=off`.
+
+As not all CPU types support all optional CPU features, then whether or
+not a CPU property exists depends on the CPU type.  For example, CPUs
+that implement the ARMv8-A architecture reference manual may optionally
+support the AArch32 CPU feature, which may be enabled by disabling the
+`aarch64` CPU property.  A CPU type such as the Cortex-A15, which does
+not implement ARMv8-A, will not have the `aarch64` CPU property.
+
+QEMU's support may be limited for some CPU features, only partially
+supporting the feature or only supporting the feature under certain
+configurations.  For example, the `aarch64` CPU feature, which, when
+disabled, enables the optional AArch32 CPU feature, is only supported
+when using the KVM accelerator and when running on a host CPU type that
+supports the feature.
+
+CPU Feature Probing
+===================
+
+Determining which CPU features are available and functional for a given
+CPU type is possible with the `query-cpu-model-expansion` QMP command.
+Below are some examples where `scripts/qmp/qmp-shell` (see the top comment
+block in the script for usage) is used to issue the QMP commands.
+
+(1) Determine which CPU features are available for the `max` CPU type
+    (Note, we started QEMU with qemu-system-aarch64, so `max` is
+     implementing the ARMv8-A reference manual in this case)::
+
+      (QEMU) query-cpu-model-expansion type=full model={"name":"max"}
+      { "return": {
+        "model": { "name": "max", "props": {
+        "pmu": true, "aarch64": true
+      }}}}
+
+We see that the `max` CPU type has the `pmu` and `aarch64` CPU features.
+We also see that the CPU features are enabled, as they are all `true`.
+
+(2) Let's try to disable the PMU::
+
+      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"pmu":false}}
+      { "return": {
+        "model": { "name": "max", "props": {
+        "pmu": false, "aarch64": true
+      }}}}
+
+We see it worked, as `pmu` is now `false`.
+
+(3) Let's try to disable `aarch64`, which enables the AArch32 CPU feature::
+
+      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"aarch64":false}}
+      {"error": {
+       "class": "GenericError", "desc":
+       "'aarch64' feature cannot be disabled unless KVM is enabled and 32-bit EL1 is supported"
+      }}
+
+It looks like this feature is limited to a configuration we do not
+currently have.
+
+(4) Let's try probing CPU features for the Cortex-A15 CPU type::
+
+      (QEMU) query-cpu-model-expansion type=full model={"name":"cortex-a15"}
+      {"return": {"model": {"name": "cortex-a15", "props": {"pmu": true}}}}
+
+Only the `pmu` CPU feature is available.
+
+A note about CPU feature dependencies
+-------------------------------------
+
+It's possible for features to have dependencies on other features. I.e.
+it may be possible to change one feature at a time without error, but
+when attempting to change all features at once an error could occur
+depending on the order they are processed.  It's also possible changing
+all at once doesn't generate an error, because a feature's dependencies
+are satisfied with other features, but the same feature cannot be changed
+independently without error.  For these reasons callers should always
+attempt to make their desired changes all at once in order to ensure the
+collection is valid.
+
+A note about CPU models and KVM
+-------------------------------
+
+Named CPU models generally do not work with KVM.  There are a few cases
+that do work, e.g. using the named CPU model `cortex-a57` with KVM on a
+seattle host, but mostly if KVM is enabled the `host` CPU type must be
+used.  This means the guest is provided all the same CPU features as the
+host CPU type has.  And, for this reason, the `host` CPU type should
+enable all CPU features that the host has by default.  Indeed it's even
+a bit strange to allow disabling CPU features that the host has when using
+the `host` CPU type, but in the absence of CPU models it's the best we can
+do if we want to launch guests without all the host's CPU features enabled.
+
+Enabling KVM also affects the `query-cpu-model-expansion` QMP command.  The
+affect is not only limited to specific features, as pointed out in example
+(3) of "CPU Feature Probing", but also to which CPU types may be expanded.
+When KVM is enabled, only the `max`, `host`, and current CPU type may be
+expanded.  This restriction is necessary as it's not possible to know all
+CPU types that may work with KVM, but it does impose a small risk of users
+experiencing unexpected errors.  For example on a seattle, as mentioned
+above, the `cortex-a57` CPU type is also valid when KVM is enabled.
+Therefore a user could use the `host` CPU type for the current type, but
+then attempt to query `cortex-a57`, however that query will fail with our
+restrictions.  This shouldn't be an issue though as management layers and
+users have been preferring the `host` CPU type for use with KVM for quite
+some time.  Additionally, if the KVM-enabled QEMU instance running on a
+seattle host is using the `cortex-a57` CPU type, then querying `cortex-a57`
+will work.
+
+Using CPU Features
+==================
+
+After determining which CPU features are available and supported for a
+given CPU type, then they may be selectively enabled or disabled on the
+QEMU command line with that CPU type::
+
+  $ qemu-system-aarch64 -M virt -cpu max,pmu=off
+
+The example above disables the PMU for the `max` CPU type.
+
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Now that Arm CPUs have advertised features lets add tests to ensure
we maintain their expected availability with and without KVM.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20191031142734.8590-3-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/Makefile.include   |   5 +-
 tests/arm-cpu-features.c | 253 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 257 insertions(+), 1 deletion(-)
 create mode 100644 tests/arm-cpu-features.c

diff --git a/tests/Makefile.include b/tests/Makefile.include
index XXXXXXX..XXXXXXX 100644
--- a/tests/Makefile.include
+++ b/tests/Makefile.include
@@ -XXX,XX +XXX,XX @@ check-qtest-sparc64-$(CONFIG_ISA_TESTDEV) = tests/endianness-test$(EXESUF)
 check-qtest-sparc64-y += tests/prom-env-test$(EXESUF)
 check-qtest-sparc64-y += tests/boot-serial-test$(EXESUF)
 
+check-qtest-arm-y += tests/arm-cpu-features$(EXESUF)
 check-qtest-arm-y += tests/microbit-test$(EXESUF)
 check-qtest-arm-y += tests/m25p80-test$(EXESUF)
 check-qtest-arm-y += tests/test-arm-mptimer$(EXESUF)
@@ -XXX,XX +XXX,XX @@ check-qtest-arm-y += tests/boot-serial-test$(EXESUF)
 check-qtest-arm-y += tests/hexloader-test$(EXESUF)
 check-qtest-arm-$(CONFIG_PFLASH_CFI02) += tests/pflash-cfi02-test$(EXESUF)
 
-check-qtest-aarch64-y = tests/numa-test$(EXESUF)
+check-qtest-aarch64-y += tests/arm-cpu-features$(EXESUF)
+check-qtest-aarch64-y += tests/numa-test$(EXESUF)
 check-qtest-aarch64-y += tests/boot-serial-test$(EXESUF)
 check-qtest-aarch64-y += tests/migration-test$(EXESUF)
 # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make test unconditional
@@ -XXX,XX +XXX,XX @@ tests/test-qapi-util$(EXESUF): tests/test-qapi-util.o $(test-util-obj-y)
 tests/numa-test$(EXESUF): tests/numa-test.o
 tests/vmgenid-test$(EXESUF): tests/vmgenid-test.o tests/boot-sector.o tests/acpi-utils.o
 tests/cdrom-test$(EXESUF): tests/cdrom-test.o tests/boot-sector.o $(libqos-obj-y)
+tests/arm-cpu-features$(EXESUF): tests/arm-cpu-features.o
 
 tests/migration/stress$(EXESUF): tests/migration/stress.o
 	$(call quiet-command, $(LINKPROG) -static -O3 $(PTHREAD_LIB) -o $@ $< ,"LINK","$(TARGET_DIR)$@")
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Arm CPU feature test cases
+ *
+ * Copyright (c) 2019 Red Hat Inc.
+ * Authors:
+ *  Andrew Jones <drjones@redhat.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "libqtest.h"
+#include "qapi/qmp/qdict.h"
+#include "qapi/qmp/qjson.h"
+
+#define MACHINE     "-machine virt,gic-version=max,accel=tcg "
+#define MACHINE_KVM "-machine virt,gic-version=max,accel=kvm:tcg "
+#define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
+                    "  'arguments': { 'type': 'full', "
+#define QUERY_TAIL  "}}"
+
+static bool kvm_enabled(QTestState *qts)
+{
+    QDict *resp, *qdict;
+    bool enabled;
+
+    resp = qtest_qmp(qts, "{ 'execute': 'query-kvm' }");
+    g_assert(qdict_haskey(resp, "return"));
+    qdict = qdict_get_qdict(resp, "return");
+    g_assert(qdict_haskey(qdict, "enabled"));
+    enabled = qdict_get_bool(qdict, "enabled");
+    qobject_unref(resp);
+
+    return enabled;
+}
+
+static QDict *do_query_no_props(QTestState *qts, const char *cpu_type)
+{
+    return qtest_qmp(qts, QUERY_HEAD "'model': { 'name': %s }"
+                          QUERY_TAIL, cpu_type);
+}
+
+static QDict *do_query(QTestState *qts, const char *cpu_type,
+                       const char *fmt, ...)
+{
+    QDict *resp;
+
+    if (fmt) {
+        QDict *args;
+        va_list ap;
+
+        va_start(ap, fmt);
+        args = qdict_from_vjsonf_nofail(fmt, ap);
+        va_end(ap);
+
+        resp = qtest_qmp(qts, QUERY_HEAD "'model': { 'name': %s, "
+                                                    "'props': %p }"
+                              QUERY_TAIL, cpu_type, args);
+    } else {
+        resp = do_query_no_props(qts, cpu_type);
+    }
+
+    return resp;
+}
+
+static const char *resp_get_error(QDict *resp)
+{
+    QDict *qdict;
+
+    g_assert(resp);
+
+    qdict = qdict_get_qdict(resp, "error");
+    if (qdict) {
+        return qdict_get_str(qdict, "desc");
+    }
+
+    return NULL;
+}
+
+#define assert_error(qts, cpu_type, expected_error, fmt, ...)          \
+({                                                                     \
+    QDict *_resp;                                                      \
+    const char *_error;                                                \
+                                                                       \
+    _resp = do_query(qts, cpu_type, fmt, ##__VA_ARGS__);               \
+    g_assert(_resp);                                                   \
+    _error = resp_get_error(_resp);                                    \
+    g_assert(_error);                                                  \
+    g_assert(g_str_equal(_error, expected_error));                     \
+    qobject_unref(_resp);                                              \
+})
+
+static bool resp_has_props(QDict *resp)
+{
+    QDict *qdict;
+
+    g_assert(resp);
+
+    if (!qdict_haskey(resp, "return")) {
+        return false;
+    }
+    qdict = qdict_get_qdict(resp, "return");
+
+    if (!qdict_haskey(qdict, "model")) {
+        return false;
+    }
+    qdict = qdict_get_qdict(qdict, "model");
+
+    return qdict_haskey(qdict, "props");
+}
+
+static QDict *resp_get_props(QDict *resp)
+{
+    QDict *qdict;
+
+    g_assert(resp);
+    g_assert(resp_has_props(resp));
+
+    qdict = qdict_get_qdict(resp, "return");
+    qdict = qdict_get_qdict(qdict, "model");
+    qdict = qdict_get_qdict(qdict, "props");
+
+    return qdict;
+}
+
+#define assert_has_feature(qts, cpu_type, feature)                     \
+({                                                                     \
+    QDict *_resp = do_query_no_props(qts, cpu_type);                   \
+    g_assert(_resp);                                                   \
+    g_assert(resp_has_props(_resp));                                   \
+    g_assert(qdict_get(resp_get_props(_resp), feature));               \
+    qobject_unref(_resp);                                              \
+})
+
+#define assert_has_not_feature(qts, cpu_type, feature)                 \
+({                                                                     \
+    QDict *_resp = do_query_no_props(qts, cpu_type);                   \
+    g_assert(_resp);                                                   \
+    g_assert(!resp_has_props(_resp) ||                                 \
+             !qdict_get(resp_get_props(_resp), feature));              \
+    qobject_unref(_resp);                                              \
+})
+
+static void assert_type_full(QTestState *qts)
+{
+    const char *error;
+    QDict *resp;
+
+    resp = qtest_qmp(qts, "{ 'execute': 'query-cpu-model-expansion', "
+                            "'arguments': { 'type': 'static', "
+                                           "'model': { 'name': 'foo' }}}");
+    g_assert(resp);
+    error = resp_get_error(resp);
+    g_assert(error);
+    g_assert(g_str_equal(error,
+                         "The requested expansion type is not supported"));
+    qobject_unref(resp);
+}
+
+static void assert_bad_props(QTestState *qts, const char *cpu_type)
+{
+    const char *error;
+    QDict *resp;
+
+    resp = qtest_qmp(qts, "{ 'execute': 'query-cpu-model-expansion', "
+                            "'arguments': { 'type': 'full', "
+                                           "'model': { 'name': %s, "
+                                                      "'props': false }}}",
+                     cpu_type);
+    g_assert(resp);
+    error = resp_get_error(resp);
+    g_assert(error);
+    g_assert(g_str_equal(error,
+                         "Invalid parameter type for 'props', expected: dict"));
+    qobject_unref(resp);
+}
+
+static void test_query_cpu_model_expansion(const void *data)
+{
+    QTestState *qts;
+
+    qts = qtest_init(MACHINE "-cpu max");
+
+    /* Test common query-cpu-model-expansion input validation */
+    assert_type_full(qts);
+    assert_bad_props(qts, "max");
+    assert_error(qts, "foo", "The CPU type 'foo' is not a recognized "
+                 "ARM CPU type", NULL);
+    assert_error(qts, "max", "Parameter 'not-a-prop' is unexpected",
+                 "{ 'not-a-prop': false }");
+    assert_error(qts, "host", "The CPU type 'host' requires KVM", NULL);
+
+    /* Test expected feature presence/absence for some cpu types */
+    assert_has_feature(qts, "max", "pmu");
+    assert_has_feature(qts, "cortex-a15", "pmu");
+    assert_has_not_feature(qts, "cortex-a15", "aarch64");
+
+    if (g_str_equal(qtest_get_arch(), "aarch64")) {
+        assert_has_feature(qts, "max", "aarch64");
+        assert_has_feature(qts, "cortex-a57", "pmu");
+        assert_has_feature(qts, "cortex-a57", "aarch64");
+
+        /* Test that features that depend on KVM generate errors without. */
+        assert_error(qts, "max",
+                     "'aarch64' feature cannot be disabled "
+                     "unless KVM is enabled and 32-bit EL1 "
+                     "is supported",
+                     "{ 'aarch64': false }");
+    }
+
+    qtest_quit(qts);
+}
+
+static void test_query_cpu_model_expansion_kvm(const void *data)
+{
+    QTestState *qts;
+
+    qts = qtest_init(MACHINE_KVM "-cpu max");
+
+    /*
+     * These tests target the 'host' CPU type, so KVM must be enabled.
+     */
+    if (!kvm_enabled(qts)) {
+        qtest_quit(qts);
+        return;
+    }
+
+    if (g_str_equal(qtest_get_arch(), "aarch64")) {
+        assert_has_feature(qts, "host", "aarch64");
+        assert_has_feature(qts, "host", "pmu");
+
+        assert_error(qts, "cortex-a15",
+            "We cannot guarantee the CPU type 'cortex-a15' works "
+            "with KVM on this host", NULL);
+    } else {
+        assert_has_not_feature(qts, "host", "aarch64");
+        assert_has_not_feature(qts, "host", "pmu");
+    }
+
+    qtest_quit(qts);
+}
+
+int main(int argc, char **argv)
+{
+    g_test_init(&argc, &argv, NULL);
+
+    qtest_add_data_func("/arm/query-cpu-model-expansion",
+                        NULL, test_query_cpu_model_expansion);
+    qtest_add_data_func("/arm/kvm/query-cpu-model-expansion",
+                        NULL, test_query_cpu_model_expansion_kvm);
+
+    return g_test_run();
+}
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Since 97a28b0eeac14 ("target/arm: Allow VFP and Neon to be disabled via
a CPU property") we can disable the 'max' cpu model's VFP and neon
features, but there's no way to disable SVE. Add the 'sve=on|off'
property to give it that flexibility. We also rename
cpu_max_get/set_sve_vq to cpu_max_get/set_sve_max_vq in order for them
to follow the typical *_get/set_<property-name> pattern.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
Message-id: 20191031142734.8590-4-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c         |  3 ++-
 target/arm/cpu64.c       | 52 ++++++++++++++++++++++++++++++++++------
 target/arm/monitor.c     |  2 +-
 tests/arm-cpu-features.c |  1 +
 4 files changed, 49 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(CPUState *s)
         env->cp15.cpacr_el1 = deposit64(env->cp15.cpacr_el1, 16, 2, 3);
         env->cp15.cptr_el[3] |= CPTR_EZ;
         /* with maximum vector length */
-        env->vfp.zcr_el[1] = cpu->sve_max_vq - 1;
+        env->vfp.zcr_el[1] = cpu_isar_feature(aa64_sve, cpu) ?
+                             cpu->sve_max_vq - 1 : 0;
         env->vfp.zcr_el[2] = env->vfp.zcr_el[1];
         env->vfp.zcr_el[3] = env->vfp.zcr_el[1];
         /*
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
-static void cpu_max_get_sve_vq(Object *obj, Visitor *v, const char *name,
-                               void *opaque, Error **errp)
+static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    visit_type_uint32(v, name, &cpu->sve_max_vq, errp);
+    uint32_t value;
+
+    /* All vector lengths are disabled when SVE is off. */
+    if (!cpu_isar_feature(aa64_sve, cpu)) {
+        value = 0;
+    } else {
+        value = cpu->sve_max_vq;
+    }
+    visit_type_uint32(v, name, &value, errp);
 }
 
-static void cpu_max_set_sve_vq(Object *obj, Visitor *v, const char *name,
-                               void *opaque, Error **errp)
+static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
+                                   void *opaque, Error **errp)
 {
     ARMCPU *cpu = ARM_CPU(obj);
     Error *err = NULL;
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_vq(Object *obj, Visitor *v, const char *name,
     error_propagate(errp, err);
 }
 
+static void cpu_arm_get_sve(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    bool value = cpu_isar_feature(aa64_sve, cpu);
+
+    visit_type_bool(v, name, &value, errp);
+}
+
+static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    Error *err = NULL;
+    bool value;
+    uint64_t t;
+
+    visit_type_bool(v, name, &value, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    t = cpu->isar.id_aa64pfr0;
+    t = FIELD_DP64(t, ID_AA64PFR0, SVE, value);
+    cpu->isar.id_aa64pfr0 = t;
+}
+
 /* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
  * otherwise, a CPU with as many features enabled as our emulation supports.
  * The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 #endif
 
         cpu->sve_max_vq = ARM_MAX_VQ;
-        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_vq,
-                            cpu_max_set_sve_vq, NULL, NULL, &error_fatal);
+        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
+                            cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
+        object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
+                            cpu_arm_set_sve, NULL, NULL, &error_fatal);
     }
 }
 
diff --git a/target/arm/monitor.c b/target/arm/monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/monitor.c
+++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
  * then the order that considers those dependencies must be used.
  */
 static const char *cpu_model_advertised_features[] = {
-    "aarch64", "pmu",
+    "aarch64", "pmu", "sve",
     NULL
 };
 
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/arm-cpu-features.c
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
 
     if (g_str_equal(qtest_get_arch(), "aarch64")) {
         assert_has_feature(qts, "max", "aarch64");
+        assert_has_feature(qts, "max", "sve");
         assert_has_feature(qts, "cortex-a57", "pmu");
         assert_has_feature(qts, "cortex-a57", "aarch64");
 
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Introduce cpu properties to give fine control over SVE vector lengths.
We introduce a property for each valid length up to the current
maximum supported, which is 2048-bits. The properties are named, e.g.
sve128, sve256, sve384, sve512, ..., where the number is the number of
bits. See the updates to docs/arm-cpu-features.rst for a description
of the semantics and for example uses.

Note, as sve-max-vq is still present and we'd like to be able to
support qmp_query_cpu_model_expansion with guests launched with e.g.
-cpu max,sve-max-vq=8 on their command lines, then we do allow
sve-max-vq and sve<N> properties to be provided at the same time, but
this is not recommended, and is why sve-max-vq is not mentioned in the
document.  If sve-max-vq is provided then it enables all lengths smaller
than and including the max and disables all lengths larger. It also has
the side-effect that no larger lengths may be enabled and that the max
itself cannot be disabled. Smaller non-power-of-two lengths may,
however, be disabled, e.g. -cpu max,sve-max-vq=4,sve384=off provides a
guest the vector lengths 128, 256, and 512 bits.

This patch has been co-authored with Richard Henderson, who reworked
the target/arm/cpu64.c changes in order to push all the validation and
auto-enabling/disabling steps into the finalizer, resulting in a nice
LOC reduction.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
Message-id: 20191031142734.8590-5-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qemu/bitops.h     |   1 +
 target/arm/cpu.h          |  19 ++++
 target/arm/cpu.c          |  19 ++++
 target/arm/cpu64.c        | 192 ++++++++++++++++++++++++++++++++++++-
 target/arm/helper.c       |  10 +-
 target/arm/monitor.c      |  12 +++
 tests/arm-cpu-features.c  | 194 ++++++++++++++++++++++++++++++++++++++
 docs/arm-cpu-features.rst | 168 +++++++++++++++++++++++++++++++--
 8 files changed, 606 insertions(+), 9 deletions(-)

diff --git a/include/qemu/bitops.h b/include/qemu/bitops.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/bitops.h
+++ b/include/qemu/bitops.h
@@ -XXX,XX +XXX,XX @@
 #define BITS_PER_LONG           (sizeof (unsigned long) * BITS_PER_BYTE)
 
 #define BIT(nr)                 (1UL << (nr))
+#define BIT_ULL(nr)             (1ULL << (nr))
 #define BIT_MASK(nr)            (1UL << ((nr) % BITS_PER_LONG))
 #define BIT_WORD(nr)            ((nr) / BITS_PER_LONG)
 #define BITS_TO_LONGS(nr)       DIV_ROUND_UP(nr, BITS_PER_BYTE * sizeof(long))
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 #ifdef TARGET_AARCH64
 # define ARM_MAX_VQ    16
+void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp);
+uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq);
 #else
 # define ARM_MAX_VQ    1
+static inline void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp) { }
+static inline uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq)
+{ return 0; }
 #endif
 
 typedef struct ARMVectorReg {
@@ -XXX,XX +XXX,XX @@ struct ARMCPU {
 
     /* Used to set the maximum vector length the cpu will support.  */
     uint32_t sve_max_vq;
+
+    /*
+     * In sve_vq_map each set bit is a supported vector length of
+     * (bit-number + 1) * 16 bytes, i.e. each bit number + 1 is the vector
+     * length in quadwords.
+     *
+     * While processing properties during initialization, corresponding
+     * sve_vq_init bits are set for bits in sve_vq_map that have been
+     * set by properties.
+     */
+    DECLARE_BITMAP(sve_vq_map, ARM_MAX_VQ);
+    DECLARE_BITMAP(sve_vq_init, ARM_MAX_VQ);
 };
 
 void arm_cpu_post_init(Object *obj);
@@ -XXX,XX +XXX,XX @@ static inline int arm_feature(CPUARMState *env, int feature)
     return (env->features & (1ULL << feature)) != 0;
 }
 
+void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp);
+
 #if !defined(CONFIG_USER_ONLY)
 /* Return true if exception levels below EL3 are in secure state,
  * or would be following an exception return to that level.
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_finalizefn(Object *obj)
 #endif
 }
 
+void arm_cpu_finalize_features(ARMCPU *cpu, Error **errp)
+{
+    Error *local_err = NULL;
+
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        arm_cpu_sve_finalize(cpu, &local_err);
+        if (local_err != NULL) {
+            error_propagate(errp, local_err);
+            return;
+        }
+    }
+}
+
 static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
 {
     CPUState *cs = CPU(dev);
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
         return;
     }
 
+    arm_cpu_finalize_features(cpu, &local_err);
+    if (local_err != NULL) {
+        error_propagate(errp, local_err);
+        return;
+    }
+
     if (arm_feature(env, ARM_FEATURE_AARCH64) &&
         cpu->has_vfp != cpu->has_neon) {
         /*
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
     define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 }
 
+void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
+{
+    /*
+     * If any vector lengths are explicitly enabled with sve<N> properties,
+     * then all other lengths are implicitly disabled.  If sve-max-vq is
+     * specified then it is the same as explicitly enabling all lengths
+     * up to and including the specified maximum, which means all larger
+     * lengths will be implicitly disabled.  If no sve<N> properties
+     * are enabled and sve-max-vq is not specified, then all lengths not
+     * explicitly disabled will be enabled.  Additionally, all power-of-two
+     * vector lengths less than the maximum enabled length will be
+     * automatically enabled and all vector lengths larger than the largest
+     * disabled power-of-two vector length will be automatically disabled.
+     * Errors are generated if the user provided input that interferes with
+     * any of the above.  Finally, if SVE is not disabled, then at least one
+     * vector length must be enabled.
+     */
+    DECLARE_BITMAP(tmp, ARM_MAX_VQ);
+    uint32_t vq, max_vq = 0;
+
+    /*
+     * Process explicit sve<N> properties.
+     * From the properties, sve_vq_map<N> implies sve_vq_init<N>.
+     * Check first for any sve<N> enabled.
+     */
+    if (!bitmap_empty(cpu->sve_vq_map, ARM_MAX_VQ)) {
+        max_vq = find_last_bit(cpu->sve_vq_map, ARM_MAX_VQ) + 1;
+
+        if (cpu->sve_max_vq && max_vq > cpu->sve_max_vq) {
+            error_setg(errp, "cannot enable sve%d", max_vq * 128);
+            error_append_hint(errp, "sve%d is larger than the maximum vector "
+                              "length, sve-max-vq=%d (%d bits)\n",
+                              max_vq * 128, cpu->sve_max_vq,
+                              cpu->sve_max_vq * 128);
+            return;
+        }
+
+        /* Propagate enabled bits down through required powers-of-two. */
+        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
+            if (!test_bit(vq - 1, cpu->sve_vq_init)) {
+                set_bit(vq - 1, cpu->sve_vq_map);
+            }
+        }
+    } else if (cpu->sve_max_vq == 0) {
+        /*
+         * No explicit bits enabled, and no implicit bits from sve-max-vq.
+         */
+        if (!cpu_isar_feature(aa64_sve, cpu)) {
+            /* SVE is disabled and so are all vector lengths.  Good. */
+            return;
+        }
+
+        /* Disabling a power-of-two disables all larger lengths. */
+        if (test_bit(0, cpu->sve_vq_init)) {
+            error_setg(errp, "cannot disable sve128");
+            error_append_hint(errp, "Disabling sve128 results in all vector "
+                              "lengths being disabled.\n");
+            error_append_hint(errp, "With SVE enabled, at least one vector "
+                              "length must be enabled.\n");
+            return;
+        }
+        for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
+            if (test_bit(vq - 1, cpu->sve_vq_init)) {
+                break;
+            }
+        }
+        max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
+
+        bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
+        max_vq = find_last_bit(cpu->sve_vq_map, max_vq) + 1;
+    }
+
+    /*
+     * Process the sve-max-vq property.
+     * Note that we know from the above that no bit above
+     * sve-max-vq is currently set.
+     */
+    if (cpu->sve_max_vq != 0) {
+        max_vq = cpu->sve_max_vq;
+
+        if (!test_bit(max_vq - 1, cpu->sve_vq_map) &&
+            test_bit(max_vq - 1, cpu->sve_vq_init)) {
+            error_setg(errp, "cannot disable sve%d", max_vq * 128);
+            error_append_hint(errp, "The maximum vector length must be "
+                              "enabled, sve-max-vq=%d (%d bits)\n",
+                              max_vq, max_vq * 128);
+            return;
+        }
+
+        /* Set all bits not explicitly set within sve-max-vq. */
+        bitmap_complement(tmp, cpu->sve_vq_init, max_vq);
+        bitmap_or(cpu->sve_vq_map, cpu->sve_vq_map, tmp, max_vq);
+    }
+
+    /*
+     * We should know what max-vq is now.  Also, as we're done
+     * manipulating sve-vq-map, we ensure any bits above max-vq
+     * are clear, just in case anybody looks.
+     */
+    assert(max_vq != 0);
+    bitmap_clear(cpu->sve_vq_map, max_vq, ARM_MAX_VQ - max_vq);
+
+    /* Ensure all required powers-of-two are enabled. */
+    for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
+        if (!test_bit(vq - 1, cpu->sve_vq_map)) {
+            error_setg(errp, "cannot disable sve%d", vq * 128);
+            error_append_hint(errp, "sve%d is required as it "
+                              "is a power-of-two length smaller than "
+                              "the maximum, sve%d\n",
+                              vq * 128, max_vq * 128);
+            return;
+        }
+    }
+
+    /*
+     * Now that we validated all our vector lengths, the only question
+     * left to answer is if we even want SVE at all.
+     */
+    if (!cpu_isar_feature(aa64_sve, cpu)) {
+        error_setg(errp, "cannot enable sve%d", max_vq * 128);
+        error_append_hint(errp, "SVE must be enabled to enable vector "
+                          "lengths.\n");
+        error_append_hint(errp, "Add sve=on to the CPU property list.\n");
+        return;
+    }
+
+    /* From now on sve_max_vq is the actual maximum supported length. */
+    cpu->sve_max_vq = max_vq;
+}
+
+uint32_t arm_cpu_vq_map_next_smaller(ARMCPU *cpu, uint32_t vq)
+{
+    uint32_t bitnum;
+
+    /*
+     * We allow vq == ARM_MAX_VQ + 1 to be input because the caller may want
+     * to find the maximum vq enabled, which may be ARM_MAX_VQ, but this
+     * function always returns the next smaller than the input.
+     */
+    assert(vq && vq <= ARM_MAX_VQ + 1);
+
+    bitnum = find_last_bit(cpu->sve_vq_map, vq - 1);
+    return bitnum == vq - 1 ? 0 : bitnum + 1;
+}
+
 static void cpu_max_get_sve_max_vq(Object *obj, Visitor *v, const char *name,
                                    void *opaque, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
     error_propagate(errp, err);
 }
 
+static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
+                               void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t vq = atoi(&name[3]) / 128;
+    bool value;
+
+    /* All vector lengths are disabled when SVE is off. */
+    if (!cpu_isar_feature(aa64_sve, cpu)) {
+        value = false;
+    } else {
+        value = test_bit(vq - 1, cpu->sve_vq_map);
+    }
+    visit_type_bool(v, name, &value, errp);
+}
+
+static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
+                               void *opaque, Error **errp)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t vq = atoi(&name[3]) / 128;
+    Error *err = NULL;
+    bool value;
+
+    visit_type_bool(v, name, &value, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+
+    if (value) {
+        set_bit(vq - 1, cpu->sve_vq_map);
+    } else {
+        clear_bit(vq - 1, cpu->sve_vq_map);
+    }
+    set_bit(vq - 1, cpu->sve_vq_init);
+}
+
 static void cpu_arm_get_sve(Object *obj, Visitor *v, const char *name,
                             void *opaque, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
 static void aarch64_max_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t vq;
 
     if (kvm_enabled()) {
         kvm_arm_set_cpu_features_from_host(cpu);
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         cpu->dcz_blocksize = 7; /*  512 bytes */
 #endif
 
-        cpu->sve_max_vq = ARM_MAX_VQ;
         object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                             cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
         object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
                             cpu_arm_set_sve, NULL, NULL, &error_fatal);
+
+        for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
+            char name[8];
+            sprintf(name, "sve%d", vq * 128);
+            object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
+                                cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
+        }
     }
 }
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int sve_exception_el(CPUARMState *env, int el)
     return 0;
 }
 
+static uint32_t sve_zcr_get_valid_len(ARMCPU *cpu, uint32_t start_len)
+{
+    uint32_t start_vq = (start_len & 0xf) + 1;
+
+    return arm_cpu_vq_map_next_smaller(cpu, start_vq + 1) - 1;
+}
+
 /*
  * Given that SVE is enabled, return the vector length for EL.
  */
@@ -XXX,XX +XXX,XX @@ uint32_t sve_zcr_len_for_el(CPUARMState *env, int el)
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         zcr_len = MIN(zcr_len, 0xf & (uint32_t)env->vfp.zcr_el[3]);
     }
-    return zcr_len;
+
+    return sve_zcr_get_valid_len(cpu, zcr_len);
 }
 
 static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
diff --git a/target/arm/monitor.c b/target/arm/monitor.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/monitor.c
+++ b/target/arm/monitor.c
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
     return head;
 }
 
+QEMU_BUILD_BUG_ON(ARM_MAX_VQ > 16);
+
 /*
  * These are cpu model features we want to advertise. The order here
  * matters as this is the order in which qmp_query_cpu_model_expansion
@@ -XXX,XX +XXX,XX @@ GICCapabilityList *qmp_query_gic_capabilities(Error **errp)
  */
 static const char *cpu_model_advertised_features[] = {
     "aarch64", "pmu", "sve",
+    "sve128", "sve256", "sve384", "sve512",
+    "sve640", "sve768", "sve896", "sve1024", "sve1152", "sve1280",
+    "sve1408", "sve1536", "sve1664", "sve1792", "sve1920", "sve2048",
     NULL
 };
 
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
         if (!err) {
             visit_check_struct(visitor, &err);
         }
+        if (!err) {
+            arm_cpu_finalize_features(ARM_CPU(obj), &err);
+        }
         visit_end_struct(visitor, NULL);
         visit_free(visitor);
         if (err) {
@@ -XXX,XX +XXX,XX @@ CpuModelExpansionInfo *qmp_query_cpu_model_expansion(CpuModelExpansionType type,
             error_propagate(errp, err);
             return NULL;
         }
+    } else {
+        Error *err = NULL;
+        arm_cpu_finalize_features(ARM_CPU(obj), &err);
+        assert(err == NULL);
     }
 
     expansion_info = g_new0(CpuModelExpansionInfo, 1);
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/arm-cpu-features.c
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@
  * See the COPYING file in the top-level directory.
  */
 #include "qemu/osdep.h"
+#include "qemu/bitops.h"
 #include "libqtest.h"
 #include "qapi/qmp/qdict.h"
 #include "qapi/qmp/qjson.h"
 
+/*
+ * We expect the SVE max-vq to be 16. Also it must be <= 64
+ * for our test code, otherwise 'vls' can't just be a uint64_t.
+ */
+#define SVE_MAX_VQ 16
+
 #define MACHINE     "-machine virt,gic-version=max,accel=tcg "
 #define MACHINE_KVM "-machine virt,gic-version=max,accel=kvm:tcg "
 #define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
@@ -XXX,XX +XXX,XX @@ static void assert_bad_props(QTestState *qts, const char *cpu_type)
     qobject_unref(resp);
 }
 
+static uint64_t resp_get_sve_vls(QDict *resp)
+{
+    QDict *props;
+    const QDictEntry *e;
+    uint64_t vls = 0;
+    int n = 0;
+
+    g_assert(resp);
+    g_assert(resp_has_props(resp));
+
+    props = resp_get_props(resp);
+
+    for (e = qdict_first(props); e; e = qdict_next(props, e)) {
+        if (strlen(e->key) > 3 && !strncmp(e->key, "sve", 3) &&
+            g_ascii_isdigit(e->key[3])) {
+            char *endptr;
+            int bits;
+
+            bits = g_ascii_strtoll(&e->key[3], &endptr, 10);
+            if (!bits || *endptr != '\0') {
+                continue;
+            }
+
+            if (qdict_get_bool(props, e->key)) {
+                vls |= BIT_ULL((bits / 128) - 1);
+            }
+            ++n;
+        }
+    }
+
+    g_assert(n == SVE_MAX_VQ);
+
+    return vls;
+}
+
+#define assert_sve_vls(qts, cpu_type, expected_vls, fmt, ...)          \
+({                                                                     \
+    QDict *_resp = do_query(qts, cpu_type, fmt, ##__VA_ARGS__);        \
+    g_assert(_resp);                                                   \
+    g_assert(resp_has_props(_resp));                                   \
+    g_assert(resp_get_sve_vls(_resp) == expected_vls);                 \
+    qobject_unref(_resp);                                              \
+})
+
+static void sve_tests_default(QTestState *qts, const char *cpu_type)
+{
+    /*
+     * With no sve-max-vq or sve<N> properties on the command line
+     * the default is to have all vector lengths enabled. This also
+     * tests that 'sve' is 'on' by default.
+     */
+    assert_sve_vls(qts, cpu_type, BIT_ULL(SVE_MAX_VQ) - 1, NULL);
+
+    /* With SVE off, all vector lengths should also be off. */
+    assert_sve_vls(qts, cpu_type, 0, "{ 'sve': false }");
+
+    /* With SVE on, we must have at least one vector length enabled. */
+    assert_error(qts, cpu_type, "cannot disable sve128", "{ 'sve128': false }");
+
+    /* Basic enable/disable tests. */
+    assert_sve_vls(qts, cpu_type, 0x7, "{ 'sve384': true }");
+    assert_sve_vls(qts, cpu_type, ((BIT_ULL(SVE_MAX_VQ) - 1) & ~BIT_ULL(2)),
+                   "{ 'sve384': false }");
+
+    /*
+     * ---------------------------------------------------------------------
+     *               power-of-two(vq)   all-power-            can      can
+     *                                  of-two(< vq)        enable   disable
+     * ---------------------------------------------------------------------
+     * vq < max_vq      no                MUST*              yes      yes
+     * vq < max_vq      yes               MUST*              yes      no
+     * ---------------------------------------------------------------------
+     * vq == max_vq     n/a               MUST*              yes**    yes**
+     * ---------------------------------------------------------------------
+     * vq > max_vq      n/a               no                 no       yes
+     * vq > max_vq      n/a               yes                yes      yes
+     * ---------------------------------------------------------------------
+     *
+     * [*] "MUST" means this requirement must already be satisfied,
+     *     otherwise 'max_vq' couldn't itself be enabled.
+     *
+     * [**] Not testable with the QMP interface, only with the command line.
+     */
+
+    /* max_vq := 8 */
+    assert_sve_vls(qts, cpu_type, 0x8b, "{ 'sve1024': true }");
+
+    /* max_vq := 8, vq < max_vq, !power-of-two(vq) */
+    assert_sve_vls(qts, cpu_type, 0x8f,
+                   "{ 'sve1024': true, 'sve384': true }");
+    assert_sve_vls(qts, cpu_type, 0x8b,
+                   "{ 'sve1024': true, 'sve384': false }");
+
+    /* max_vq := 8, vq < max_vq, power-of-two(vq) */
+    assert_sve_vls(qts, cpu_type, 0x8b,
+                   "{ 'sve1024': true, 'sve256': true }");
+    assert_error(qts, cpu_type, "cannot disable sve256",
+                 "{ 'sve1024': true, 'sve256': false }");
+
+    /* max_vq := 3, vq > max_vq, !all-power-of-two(< vq) */
+    assert_error(qts, cpu_type, "cannot disable sve512",
+                 "{ 'sve384': true, 'sve512': false, 'sve640': true }");
+
+    /*
+     * We can disable power-of-two vector lengths when all larger lengths
+     * are also disabled. We only need to disable the power-of-two length,
+     * as all non-enabled larger lengths will then be auto-disabled.
+     */
+    assert_sve_vls(qts, cpu_type, 0x7, "{ 'sve512': false }");
+
+    /* max_vq := 3, vq > max_vq, all-power-of-two(< vq) */
+    assert_sve_vls(qts, cpu_type, 0x1f,
+                   "{ 'sve384': true, 'sve512': true, 'sve640': true }");
+    assert_sve_vls(qts, cpu_type, 0xf,
+                   "{ 'sve384': true, 'sve512': true, 'sve640': false }");
+}
+
+static void sve_tests_sve_max_vq_8(const void *data)
+{
+    QTestState *qts;
+
+    qts = qtest_init(MACHINE "-cpu max,sve-max-vq=8");
+
+    assert_sve_vls(qts, "max", BIT_ULL(8) - 1, NULL);
+
+    /*
+     * Disabling the max-vq set by sve-max-vq is not allowed, but
+     * of course enabling it is OK.
+     */
+    assert_error(qts, "max", "cannot disable sve1024", "{ 'sve1024': false }");
+    assert_sve_vls(qts, "max", 0xff, "{ 'sve1024': true }");
+
+    /*
+     * Enabling anything larger than max-vq set by sve-max-vq is not
+     * allowed, but of course disabling everything larger is OK.
+     */
+    assert_error(qts, "max", "cannot enable sve1152", "{ 'sve1152': true }");
+    assert_sve_vls(qts, "max", 0xff, "{ 'sve1152': false }");
+
+    /*
+     * We can enable/disable non power-of-two lengths smaller than the
+     * max-vq set by sve-max-vq, but, while we can enable power-of-two
+     * lengths, we can't disable them.
+     */
+    assert_sve_vls(qts, "max", 0xff, "{ 'sve384': true }");
+    assert_sve_vls(qts, "max", 0xfb, "{ 'sve384': false }");
+    assert_sve_vls(qts, "max", 0xff, "{ 'sve256': true }");
+    assert_error(qts, "max", "cannot disable sve256", "{ 'sve256': false }");
+
+    qtest_quit(qts);
+}
+
+static void sve_tests_sve_off(const void *data)
+{
+    QTestState *qts;
+
+    qts = qtest_init(MACHINE "-cpu max,sve=off");
+
+    /* SVE is off, so the map should be empty. */
+    assert_sve_vls(qts, "max", 0, NULL);
+
+    /* The map stays empty even if we turn lengths off. */
+    assert_sve_vls(qts, "max", 0, "{ 'sve128': false }");
+
+    /* It's an error to enable lengths when SVE is off. */
+    assert_error(qts, "max", "cannot enable sve128", "{ 'sve128': true }");
+
+    /* With SVE re-enabled we should get all vector lengths enabled. */
+    assert_sve_vls(qts, "max", BIT_ULL(SVE_MAX_VQ) - 1, "{ 'sve': true }");
+
+    /* Or enable SVE with just specific vector lengths. */
+    assert_sve_vls(qts, "max", 0x3,
+                   "{ 'sve': true, 'sve128': true, 'sve256': true }");
+
+    qtest_quit(qts);
+}
+
 static void test_query_cpu_model_expansion(const void *data)
 {
     QTestState *qts;
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion(const void *data)
     if (g_str_equal(qtest_get_arch(), "aarch64")) {
         assert_has_feature(qts, "max", "aarch64");
         assert_has_feature(qts, "max", "sve");
+        assert_has_feature(qts, "max", "sve128");
         assert_has_feature(qts, "cortex-a57", "pmu");
         assert_has_feature(qts, "cortex-a57", "aarch64");
 
+        sve_tests_default(qts, "max");
+
         /* Test that features that depend on KVM generate errors without. */
         assert_error(qts, "max",
                      "'aarch64' feature cannot be disabled "
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     qtest_add_data_func("/arm/kvm/query-cpu-model-expansion",
                         NULL, test_query_cpu_model_expansion_kvm);
 
+    if (g_str_equal(qtest_get_arch(), "aarch64")) {
+        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-max-vq-8",
+                            NULL, sve_tests_sve_max_vq_8);
+        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
+                            NULL, sve_tests_sve_off);
+    }
+
     return g_test_run();
 }
diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/arm-cpu-features.rst
+++ b/docs/arm-cpu-features.rst
@@ -XXX,XX +XXX,XX @@ block in the script for usage) is used to issue the QMP commands.
       (QEMU) query-cpu-model-expansion type=full model={"name":"max"}
       { "return": {
         "model": { "name": "max", "props": {
-        "pmu": true, "aarch64": true
+        "sve1664": true, "pmu": true, "sve1792": true, "sve1920": true,
+        "sve128": true, "aarch64": true, "sve1024": true, "sve": true,
+        "sve640": true, "sve768": true, "sve1408": true, "sve256": true,
+        "sve1152": true, "sve512": true, "sve384": true, "sve1536": true,
+        "sve896": true, "sve1280": true, "sve2048": true
       }}}}
 
-We see that the `max` CPU type has the `pmu` and `aarch64` CPU features.
-We also see that the CPU features are enabled, as they are all `true`.
+We see that the `max` CPU type has the `pmu`, `aarch64`, `sve`, and many
+`sve<N>` CPU features.  We also see that all the CPU features are
+enabled, as they are all `true`.  (The `sve<N>` CPU features are all
+optional SVE vector lengths (see "SVE CPU Properties").  While with TCG
+all SVE vector lengths can be supported, when KVM is in use it's more
+likely that only a few lengths will be supported, if SVE is supported at
+all.)
 
 (2) Let's try to disable the PMU::
 
       (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"pmu":false}}
       { "return": {
         "model": { "name": "max", "props": {
-        "pmu": false, "aarch64": true
+        "sve1664": true, "pmu": false, "sve1792": true, "sve1920": true,
+        "sve128": true, "aarch64": true, "sve1024": true, "sve": true,
+        "sve640": true, "sve768": true, "sve1408": true, "sve256": true,
+        "sve1152": true, "sve512": true, "sve384": true, "sve1536": true,
+        "sve896": true, "sve1280": true, "sve2048": true
       }}}}
 
 We see it worked, as `pmu` is now `false`.
@@ -XXX,XX +XXX,XX @@ We see it worked, as `pmu` is now `false`.
 It looks like this feature is limited to a configuration we do not
 currently have.
 
-(4) Let's try probing CPU features for the Cortex-A15 CPU type::
+(4) Let's disable `sve` and see what happens to all the optional SVE
+    vector lengths::
+
+      (QEMU) query-cpu-model-expansion type=full model={"name":"max","props":{"sve":false}}
+      { "return": {
+        "model": { "name": "max", "props": {
+        "sve1664": false, "pmu": true, "sve1792": false, "sve1920": false,
+        "sve128": false, "aarch64": true, "sve1024": false, "sve": false,
+        "sve640": false, "sve768": false, "sve1408": false, "sve256": false,
+        "sve1152": false, "sve512": false, "sve384": false, "sve1536": false,
+        "sve896": false, "sve1280": false, "sve2048": false
+      }}}}
+
+As expected they are now all `false`.
+
+(5) Let's try probing CPU features for the Cortex-A15 CPU type::
 
       (QEMU) query-cpu-model-expansion type=full model={"name":"cortex-a15"}
       {"return": {"model": {"name": "cortex-a15", "props": {"pmu": true}}}}
@@ -XXX,XX +XXX,XX @@ After determining which CPU features are available and supported for a
 given CPU type, then they may be selectively enabled or disabled on the
 QEMU command line with that CPU type::
 
-  $ qemu-system-aarch64 -M virt -cpu max,pmu=off
+  $ qemu-system-aarch64 -M virt -cpu max,pmu=off,sve=on,sve128=on,sve256=on
 
-The example above disables the PMU for the `max` CPU type.
+The example above disables the PMU and enables the first two SVE vector
+lengths for the `max` CPU type.  Note, the `sve=on` isn't actually
+necessary, because, as we observed above with our probe of the `max` CPU
+type, `sve` is already on by default.  Also, based on our probe of
+defaults, it would seem we need to disable many SVE vector lengths, rather
+than only enabling the two we want.  This isn't the case, because, as
+disabling many SVE vector lengths would be quite verbose, the `sve<N>` CPU
+properties have special semantics (see "SVE CPU Property Parsing
+Semantics").
+
+SVE CPU Properties
+==================
+
+There are two types of SVE CPU properties: `sve` and `sve<N>`.  The first
+is used to enable or disable the entire SVE feature, just as the `pmu`
+CPU property completely enables or disables the PMU.  The second type
+is used to enable or disable specific vector lengths, where `N` is the
+number of bits of the length.  The `sve<N>` CPU properties have special
+dependencies and constraints, see "SVE CPU Property Dependencies and
+Constraints" below.  Additionally, as we want all supported vector lengths
+to be enabled by default, then, in order to avoid overly verbose command
+lines (command lines full of `sve<N>=off`, for all `N` not wanted), we
+provide the parsing semantics listed in "SVE CPU Property Parsing
+Semantics".
+
+SVE CPU Property Dependencies and Constraints
+---------------------------------------------
+
+  1) At least one vector length must be enabled when `sve` is enabled.
+
+  2) If a vector length `N` is enabled, then all power-of-two vector
+     lengths smaller than `N` must also be enabled.  E.g. if `sve512`
+     is enabled, then the 128-bit and 256-bit vector lengths must also
+     be enabled.
+
+SVE CPU Property Parsing Semantics
+----------------------------------
+
+  1) If SVE is disabled (`sve=off`), then which SVE vector lengths
+     are enabled or disabled is irrelevant to the guest, as the entire
+     SVE feature is disabled and that disables all vector lengths for
+     the guest.  However QEMU will still track any `sve<N>` CPU
+     properties provided by the user.  If later an `sve=on` is provided,
+     then the guest will get only the enabled lengths.  If no `sve=on`
+     is provided and there are explicitly enabled vector lengths, then
+     an error is generated.
+
+  2) If SVE is enabled (`sve=on`), but no `sve<N>` CPU properties are
+     provided, then all supported vector lengths are enabled, including
+     the non-power-of-two lengths.
+
+  3) If SVE is enabled, then an error is generated when attempting to
+     disable the last enabled vector length (see constraint (1) of "SVE
+     CPU Property Dependencies and Constraints").
+
+  4) If one or more vector lengths have been explicitly enabled and at
+     at least one of the dependency lengths of the maximum enabled length
+     has been explicitly disabled, then an error is generated (see
+     constraint (2) of "SVE CPU Property Dependencies and Constraints").
+
+  5) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
+     CPU properties are set `on`, then the specified vector lengths are
+     disabled but the default for any unspecified lengths remains enabled.
+     Disabling a power-of-two vector length also disables all vector
+     lengths larger than the power-of-two length (see constraint (2) of
+     "SVE CPU Property Dependencies and Constraints").
+
+  6) If one or more `sve<N>` CPU properties are set to `on`, then they
+     are enabled and all unspecified lengths default to disabled, except
+     for the required lengths per constraint (2) of "SVE CPU Property
+     Dependencies and Constraints", which will even be auto-enabled if
+     they were not explicitly enabled.
+
+  7) If SVE was disabled (`sve=off`), allowing all vector lengths to be
+     explicitly disabled (i.e. avoiding the error specified in (3) of
+     "SVE CPU Property Parsing Semantics"), then if later an `sve=on` is
+     provided an error will be generated.  To avoid this error, one must
+     enable at least one vector length prior to enabling SVE.
+
+SVE CPU Property Examples
+-------------------------
+
+  1) Disable SVE::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve=off
+
+  2) Implicitly enable all vector lengths for the `max` CPU type::
+
+     $ qemu-system-aarch64 -M virt -cpu max
+
+  3) Only enable the 128-bit vector length::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve128=on
+
+  4) Disable the 512-bit vector length and all larger vector lengths,
+     since 512 is a power-of-two.  This results in all the smaller,
+     uninitialized lengths (128, 256, and 384) defaulting to enabled::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve512=off
+
+  5) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve128=on,sve256=on,sve512=on
+
+  6) The same as (5), but since the 128-bit and 256-bit vector
+     lengths are required for the 512-bit vector length to be enabled,
+     then allow them to be auto-enabled::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve512=on
+
+  7) Do the same as (6), but by first disabling SVE and then re-enabling it::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve512=on,sve=on
+
+  8) Force errors regarding the last vector length::
+
+     $ qemu-system-aarch64 -M virt -cpu max,sve128=off
+     $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve128=off,sve=on
+
+SVE CPU Property Recommendations
+--------------------------------
+
+The examples in "SVE CPU Property Examples" exhibit many ways to select
+vector lengths which developers may find useful in order to avoid overly
+verbose command lines.  However, the recommended way to select vector
+lengths is to explicitly enable each desired length.  Therefore only
+example's (1), (3), and (5) exhibit recommended uses of the properties.
 
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

These are the SVE equivalents to kvm_arch_get/put_fpsimd. Note, the
swabbing is different than it is for fpsmid because the vector format
is a little-endian stream of words.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Message-id: 20191031142734.8590-6-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 185 ++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 156 insertions(+), 29 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ int kvm_arch_destroy_vcpu(CPUState *cs)
 bool kvm_arm_reg_syncs_via_cpreg_list(uint64_t regidx)
 {
     /* Return true if the regidx is a register we should synchronize
-     * via the cpreg_tuples array (ie is not a core reg we sync by
-     * hand in kvm_arch_get/put_registers())
+     * via the cpreg_tuples array (ie is not a core or sve reg that
+     * we sync by hand in kvm_arch_get/put_registers())
      */
     switch (regidx & KVM_REG_ARM_COPROC_MASK) {
     case KVM_REG_ARM_CORE:
+    case KVM_REG_ARM64_SVE:
         return false;
     default:
         return true;
@@ -XXX,XX +XXX,XX @@ int kvm_arm_cpreg_level(uint64_t regidx)
 
 static int kvm_arch_put_fpsimd(CPUState *cs)
 {
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
+    CPUARMState *env = &ARM_CPU(cs)->env;
     struct kvm_one_reg reg;
-    uint32_t fpr;
     int i, ret;
 
     for (i = 0; i < 32; i++) {
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_put_fpsimd(CPUState *cs)
         }
     }
 
-    reg.addr = (uintptr_t)(&fpr);
-    fpr = vfp_get_fpsr(env);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
-    if (ret) {
-        return ret;
+    return 0;
+}
+
+/*
+ * SVE registers are encoded in KVM's memory in an endianness-invariant format.
+ * The byte at offset i from the start of the in-memory representation contains
+ * the bits [(7 + 8 * i) : (8 * i)] of the register value. As this means the
+ * lowest offsets are stored in the lowest memory addresses, then that nearly
+ * matches QEMU's representation, which is to use an array of host-endian
+ * uint64_t's, where the lower offsets are at the lower indices. To complete
+ * the translation we just need to byte swap the uint64_t's on big-endian hosts.
+ */
+static uint64_t *sve_bswap64(uint64_t *dst, uint64_t *src, int nr)
+{
+#ifdef HOST_WORDS_BIGENDIAN
+    int i;
+
+    for (i = 0; i < nr; ++i) {
+        dst[i] = bswap64(src[i]);
     }
 
-    reg.addr = (uintptr_t)(&fpr);
-    fpr = vfp_get_fpcr(env);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
+    return dst;
+#else
+    return src;
+#endif
+}
+
+/*
+ * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
+ * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
+ * code the slice index to zero for now as it's unlikely we'll need more than
+ * one slice for quite some time.
+ */
+static int kvm_arch_put_sve(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    uint64_t tmp[ARM_MAX_VQ * 2];
+    uint64_t *r;
+    struct kvm_one_reg reg;
+    int n, ret;
+
+    for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
+        r = sve_bswap64(tmp, &env->vfp.zregs[n].d[0], cpu->sve_max_vq * 2);
+        reg.addr = (uintptr_t)r;
+        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
+        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+        if (ret) {
+            return ret;
+        }
+    }
+
+    for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
+        r = sve_bswap64(tmp, r = &env->vfp.pregs[n].p[0],
+                        DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
+        reg.addr = (uintptr_t)r;
+        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
+        ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+        if (ret) {
+            return ret;
+        }
+    }
+
+    r = sve_bswap64(tmp, &env->vfp.pregs[FFR_PRED_NUM].p[0],
+                    DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
+    reg.addr = (uintptr_t)r;
+    reg.id = KVM_REG_ARM64_SVE_FFR(0);
     ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
     if (ret) {
         return ret;
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
 {
     struct kvm_one_reg reg;
     uint64_t val;
+    uint32_t fpr;
     int i, ret;
     unsigned int el;
 
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
         }
     }
 
-    ret = kvm_arch_put_fpsimd(cs);
+    if (cpu_isar_feature(aa64_sve, cpu)) {
+        ret = kvm_arch_put_sve(cs);
+    } else {
+        ret = kvm_arch_put_fpsimd(cs);
+    }
+    if (ret) {
+        return ret;
+    }
+
+    reg.addr = (uintptr_t)(&fpr);
+    fpr = vfp_get_fpsr(env);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
+    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+    if (ret) {
+        return ret;
+    }
+
+    reg.addr = (uintptr_t)(&fpr);
+    fpr = vfp_get_fpcr(env);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
+    ret = kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
     if (ret) {
         return ret;
     }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_put_registers(CPUState *cs, int level)
 
 static int kvm_arch_get_fpsimd(CPUState *cs)
 {
-    ARMCPU *cpu = ARM_CPU(cs);
-    CPUARMState *env = &cpu->env;
+    CPUARMState *env = &ARM_CPU(cs)->env;
     struct kvm_one_reg reg;
-    uint32_t fpr;
     int i, ret;
 
     for (i = 0; i < 32; i++) {
@@ -XXX,XX +XXX,XX @@ static int kvm_arch_get_fpsimd(CPUState *cs)
         }
     }
 
-    reg.addr = (uintptr_t)(&fpr);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
-    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
-    if (ret) {
-        return ret;
-    }
-    vfp_set_fpsr(env, fpr);
+    return 0;
+}
 
-    reg.addr = (uintptr_t)(&fpr);
-    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
+/*
+ * KVM SVE registers come in slices where ZREGs have a slice size of 2048 bits
+ * and PREGS and the FFR have a slice size of 256 bits. However we simply hard
+ * code the slice index to zero for now as it's unlikely we'll need more than
+ * one slice for quite some time.
+ */
+static int kvm_arch_get_sve(CPUState *cs)
+{
+    ARMCPU *cpu = ARM_CPU(cs);
+    CPUARMState *env = &cpu->env;
+    struct kvm_one_reg reg;
+    uint64_t *r;
+    int n, ret;
+
+    for (n = 0; n < KVM_ARM64_SVE_NUM_ZREGS; ++n) {
+        r = &env->vfp.zregs[n].d[0];
+        reg.addr = (uintptr_t)r;
+        reg.id = KVM_REG_ARM64_SVE_ZREG(n, 0);
+        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+        if (ret) {
+            return ret;
+        }
+        sve_bswap64(r, r, cpu->sve_max_vq * 2);
+    }
+
+    for (n = 0; n < KVM_ARM64_SVE_NUM_PREGS; ++n) {
+        r = &env->vfp.pregs[n].p[0];
+        reg.addr = (uintptr_t)r;
+        reg.id = KVM_REG_ARM64_SVE_PREG(n, 0);
+        ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+        if (ret) {
+            return ret;
+        }
+        sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
+    }
+
+    r = &env->vfp.pregs[FFR_PRED_NUM].p[0];
+    reg.addr = (uintptr_t)r;
+    reg.id = KVM_REG_ARM64_SVE_FFR(0);
     ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
     if (ret) {
         return ret;
     }
-    vfp_set_fpcr(env, fpr);
+    sve_bswap64(r, r, DIV_ROUND_UP(cpu->sve_max_vq * 2, 8));
 
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
     struct kvm_one_reg reg;
     uint64_t val;
     unsigned int el;
+    uint32_t fpr;
     int i, ret;
 
     ARMCPU *cpu = ARM_CPU(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_get_registers(CPUState *cs)
         env->spsr = env->banked_spsr[i];
     }
 
-    ret = kvm_arch_get_fpsimd(cs);
+    if (cpu_isar_feature(aa64_sve, cpu)) {
+        ret = kvm_arch_get_sve(cs);
+    } else {
+        ret = kvm_arch_get_fpsimd(cs);
+    }
     if (ret) {
         return ret;
     }
 
+    reg.addr = (uintptr_t)(&fpr);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpsr);
+    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    if (ret) {
+        return ret;
+    }
+    vfp_set_fpsr(env, fpr);
+
+    reg.addr = (uintptr_t)(&fpr);
+    reg.id = AARCH64_SIMD_CTRL_REG(fp_regs.fpcr);
+    ret = kvm_vcpu_ioctl(cs, KVM_GET_ONE_REG, &reg);
+    if (ret) {
+        return ret;
+    }
+    vfp_set_fpcr(env, fpr);
+
     ret = kvm_get_vcpu_events(cpu);
     if (ret) {
         return ret;
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Enable SVE in the KVM guest when the 'max' cpu type is configured
and KVM supports it. KVM SVE requires use of the new finalize
vcpu ioctl, so we add that now too. For starters SVE can only be
turned on or off, getting all vector lengths the host CPU supports
when on. We'll add the other SVE CPU properties in later patches.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Reviewed-by: Beata Michalska <beata.michalska@linaro.org>
Message-id: 20191031142734.8590-7-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h     | 27 +++++++++++++++++++++++++++
 target/arm/cpu64.c       | 17 ++++++++++++++---
 target/arm/kvm.c         |  5 +++++
 target/arm/kvm64.c       | 20 +++++++++++++++++++-
 tests/arm-cpu-features.c |  4 ++++
 5 files changed, 69 insertions(+), 4 deletions(-)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@
  */
 int kvm_arm_vcpu_init(CPUState *cs);
 
+/**
+ * kvm_arm_vcpu_finalize
+ * @cs: CPUState
+ * @feature: int
+ *
+ * Finalizes the configuration of the specified VCPU feature by
+ * invoking the KVM_ARM_VCPU_FINALIZE ioctl. Features requiring
+ * this are documented in the "KVM_ARM_VCPU_FINALIZE" section of
+ * KVM's API documentation.
+ *
+ * Returns: 0 if success else < 0 error code
+ */
+int kvm_arm_vcpu_finalize(CPUState *cs, int feature);
+
 /**
  * kvm_arm_register_device:
  * @mr: memory region for this device
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_aarch32_supported(CPUState *cs);
  */
 bool kvm_arm_pmu_supported(CPUState *cs);
 
+/**
+ * bool kvm_arm_sve_supported:
+ * @cs: CPUState
+ *
+ * Returns true if the KVM VCPU can enable SVE and false otherwise.
+ */
+bool kvm_arm_sve_supported(CPUState *cs);
+
 /**
  * kvm_arm_get_max_vm_ipa_size - Returns the number of bits in the
  * IPA address space supported by KVM
@@ -XXX,XX +XXX,XX @@ static inline bool kvm_arm_pmu_supported(CPUState *cs)
     return false;
 }
 
+static inline bool kvm_arm_sve_supported(CPUState *cs)
+{
+    return false;
+}
+
 static inline int kvm_arm_get_max_vm_ipa_size(MachineState *ms)
 {
     return -ENOENT;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
         return;
     }
 
+    if (value && kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
+        error_setg(errp, "'sve' feature not supported by KVM on this host");
+        return;
+    }
+
     t = cpu->isar.id_aa64pfr0;
     t = FIELD_DP64(t, ID_AA64PFR0, SVE, value);
     cpu->isar.id_aa64pfr0 = t;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
     uint32_t vq;
+    uint64_t t;
 
     if (kvm_enabled()) {
         kvm_arm_set_cpu_features_from_host(cpu);
+        if (kvm_arm_sve_supported(CPU(cpu))) {
+            t = cpu->isar.id_aa64pfr0;
+            t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
+            cpu->isar.id_aa64pfr0 = t;
+        }
     } else {
-        uint64_t t;
         uint32_t u;
         aarch64_a57_initfn(obj);
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 
         object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                             cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
-        object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
-                            cpu_arm_set_sve, NULL, NULL, &error_fatal);
 
         for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
             char name[8];
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
                                 cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
         }
     }
+
+    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
+                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
 }
 
 struct ARMCPUInfo {
diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ int kvm_arm_vcpu_init(CPUState *cs)
     return kvm_vcpu_ioctl(cs, KVM_ARM_VCPU_INIT, &init);
 }
 
+int kvm_arm_vcpu_finalize(CPUState *cs, int feature)
+{
+    return kvm_vcpu_ioctl(cs, KVM_ARM_VCPU_FINALIZE, &feature);
+}
+
 void kvm_arm_init_serror_injection(CPUState *cs)
 {
     cap_has_inject_serror_esr = kvm_check_extension(cs->kvm_state,
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_aarch32_supported(CPUState *cpu)
     return kvm_check_extension(s, KVM_CAP_ARM_EL1_32BIT);
 }
 
+bool kvm_arm_sve_supported(CPUState *cpu)
+{
+    KVMState *s = KVM_STATE(current_machine->accelerator);
+
+    return kvm_check_extension(s, KVM_CAP_ARM_SVE);
+}
+
 #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
 
 int kvm_arch_init_vcpu(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_EL1_32BIT;
     }
     if (!kvm_check_extension(cs->kvm_state, KVM_CAP_ARM_PMU_V3)) {
-            cpu->has_pmu = false;
+        cpu->has_pmu = false;
     }
     if (cpu->has_pmu) {
         cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_PMU_V3;
     } else {
         unset_feature(&env->features, ARM_FEATURE_PMU);
     }
+    if (cpu_isar_feature(aa64_sve, cpu)) {
+        assert(kvm_arm_sve_supported(cs));
+        cpu->kvm_init_features[0] |= 1 << KVM_ARM_VCPU_SVE;
+    }
 
     /* Do KVM_ARM_VCPU_INIT ioctl */
     ret = kvm_arm_vcpu_init(cs);
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
         return ret;
     }
 
+    if (cpu_isar_feature(aa64_sve, cpu)) {
+        ret = kvm_arm_vcpu_finalize(cs, KVM_ARM_VCPU_SVE);
+        if (ret) {
+            return ret;
+        }
+    }
+
     /*
      * When KVM is in use, PSCI is emulated in-kernel and not by qemu.
      * Currently KVM has its own idea about MPIDR assignment, so we
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/arm-cpu-features.c
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
         assert_has_feature(qts, "host", "aarch64");
         assert_has_feature(qts, "host", "pmu");
 
+        assert_has_feature(qts, "max", "sve");
+
         assert_error(qts, "cortex-a15",
             "We cannot guarantee the CPU type 'cortex-a15' works "
             "with KVM on this host", NULL);
     } else {
         assert_has_not_feature(qts, "host", "aarch64");
         assert_has_not_feature(qts, "host", "pmu");
+
+        assert_has_not_feature(qts, "max", "sve");
     }
 
     qtest_quit(qts);
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

kvm_arm_create_scratch_host_vcpu() takes a struct kvm_vcpu_init
parameter. Rather than just using it as an output parameter to
pass back the preferred target, use it also as an input parameter,
allowing a caller to pass a selected target if they wish and to
also pass cpu features. If the caller doesn't want to select a
target they can pass -1 for the target which indicates they want
to use the preferred target and have it passed back like before.

diff --git a/target/arm/kvm.c b/target/arm/kvm.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm.c
+++ b/target/arm/kvm.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
                                       int *fdarray,
                                       struct kvm_vcpu_init *init)
 {
-    int ret, kvmfd = -1, vmfd = -1, cpufd = -1;
+    int ret = 0, kvmfd = -1, vmfd = -1, cpufd = -1;
 
     kvmfd = qemu_open("/dev/kvm", O_RDWR);
     if (kvmfd < 0) {
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
         goto finish;
     }
 
-    ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, init);
+    if (init->target == -1) {
+        struct kvm_vcpu_init preferred;
+
+        ret = ioctl(vmfd, KVM_ARM_PREFERRED_TARGET, &preferred);
+        if (!ret) {
+            init->target = preferred.target;
+        }
+    }
     if (ret >= 0) {
         ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
         if (ret < 0) {
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
          * creating one kind of guest CPU which is its preferred
          * CPU type.
          */
+        struct kvm_vcpu_init try;
+
         while (*cpus_to_try != QEMU_KVM_ARM_TARGET_NONE) {
-            init->target = *cpus_to_try++;
-            memset(init->features, 0, sizeof(init->features));
-            ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, init);
+            try.target = *cpus_to_try++;
+            memcpy(try.features, init->features, sizeof(init->features));
+            ret = ioctl(cpufd, KVM_ARM_VCPU_INIT, &try);
             if (ret >= 0) {
                 break;
             }
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_create_scratch_host_vcpu(const uint32_t *cpus_to_try,
         if (ret < 0) {
             goto err;
         }
+        init->target = try.target;
     } else {
         /* Treat a NULL cpus_to_try argument the same as an empty
          * list, which means we will fail the call since this must
diff --git a/target/arm/kvm32.c b/target/arm/kvm32.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm32.c
+++ b/target/arm/kvm32.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         QEMU_KVM_ARM_TARGET_CORTEX_A15,
         QEMU_KVM_ARM_TARGET_NONE
     };
-    struct kvm_vcpu_init init;
+    /*
+     * target = -1 informs kvm_arm_create_scratch_host_vcpu()
+     * to use the preferred target
+     */
+    struct kvm_vcpu_init init = { .target = -1, };
 
     if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
         return false;
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         KVM_ARM_TARGET_CORTEX_A57,
         QEMU_KVM_ARM_TARGET_NONE
     };
-    struct kvm_vcpu_init init;
+    /*
+     * target = -1 informs kvm_arm_create_scratch_host_vcpu()
+     * to use the preferred target
+     */
+    struct kvm_vcpu_init init = { .target = -1, };
 
     if (!kvm_arm_create_scratch_host_vcpu(cpus_to_try, fdarray, &init)) {
         return false;
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Extend the SVE vq map initialization and validation with KVM's
supported vector lengths when KVM is enabled. In order to determine
and select supported lengths we add two new KVM functions for getting
and setting the KVM_REG_ARM64_SVE_VLS pseudo-register.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Message-id: 20191031142734.8590-9-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm_arm.h      |  12 +++
 target/arm/cpu64.c        | 176 ++++++++++++++++++++++++++++----------
 target/arm/kvm64.c        | 100 +++++++++++++++++++++-
 tests/arm-cpu-features.c  | 104 +++++++++++++++++++++-
 docs/arm-cpu-features.rst |  45 +++++++---
 5 files changed, 379 insertions(+), 58 deletions(-)

diff --git a/target/arm/kvm_arm.h b/target/arm/kvm_arm.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm_arm.h
+++ b/target/arm/kvm_arm.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMHostCPUFeatures {
  */
 bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf);
 
+/**
+ * kvm_arm_sve_get_vls:
+ * @cs: CPUState
+ * @map: bitmap to fill in
+ *
+ * Get all the SVE vector lengths supported by the KVM host, setting
+ * the bits corresponding to their length in quadwords minus one
+ * (vq - 1) in @map up to ARM_MAX_VQ.
+ */
+void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map);
+
 /**
  * kvm_arm_set_cpu_features_from_host:
  * @cpu: ARMCPU to set the features for
@@ -XXX,XX +XXX,XX @@ static inline int kvm_arm_vgic_probe(void)
 static inline void kvm_arm_pmu_set_irq(CPUState *cs, int irq) {}
 static inline void kvm_arm_pmu_init(CPUState *cs) {}
 
+static inline void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map) {}
 #endif
 
 static inline const char *gic_class_name(void)
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
      * any of the above.  Finally, if SVE is not disabled, then at least one
      * vector length must be enabled.
      */
+    DECLARE_BITMAP(kvm_supported, ARM_MAX_VQ);
     DECLARE_BITMAP(tmp, ARM_MAX_VQ);
     uint32_t vq, max_vq = 0;
 
+    /* Collect the set of vector lengths supported by KVM. */
+    bitmap_zero(kvm_supported, ARM_MAX_VQ);
+    if (kvm_enabled() && kvm_arm_sve_supported(CPU(cpu))) {
+        kvm_arm_sve_get_vls(CPU(cpu), kvm_supported);
+    } else if (kvm_enabled()) {
+        assert(!cpu_isar_feature(aa64_sve, cpu));
+    }
+
     /*
      * Process explicit sve<N> properties.
      * From the properties, sve_vq_map<N> implies sve_vq_init<N>.
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
             return;
         }
 
-        /* Propagate enabled bits down through required powers-of-two. */
-        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
-            if (!test_bit(vq - 1, cpu->sve_vq_init)) {
-                set_bit(vq - 1, cpu->sve_vq_map);
+        if (kvm_enabled()) {
+            /*
+             * For KVM we have to automatically enable all supported unitialized
+             * lengths, even when the smaller lengths are not all powers-of-two.
+             */
+            bitmap_andnot(tmp, kvm_supported, cpu->sve_vq_init, max_vq);
+            bitmap_or(cpu->sve_vq_map, cpu->sve_vq_map, tmp, max_vq);
+        } else {
+            /* Propagate enabled bits down through required powers-of-two. */
+            for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
+                if (!test_bit(vq - 1, cpu->sve_vq_init)) {
+                    set_bit(vq - 1, cpu->sve_vq_map);
+                }
             }
         }
     } else if (cpu->sve_max_vq == 0) {
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
             return;
         }
 
-        /* Disabling a power-of-two disables all larger lengths. */
-        if (test_bit(0, cpu->sve_vq_init)) {
-            error_setg(errp, "cannot disable sve128");
-            error_append_hint(errp, "Disabling sve128 results in all vector "
-                              "lengths being disabled.\n");
-            error_append_hint(errp, "With SVE enabled, at least one vector "
-                              "length must be enabled.\n");
-            return;
-        }
-        for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
-            if (test_bit(vq - 1, cpu->sve_vq_init)) {
-                break;
+        if (kvm_enabled()) {
+            /* Disabling a supported length disables all larger lengths. */
+            for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
+                if (test_bit(vq - 1, cpu->sve_vq_init) &&
+                    test_bit(vq - 1, kvm_supported)) {
+                    break;
+                }
             }
+            max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
+            bitmap_andnot(cpu->sve_vq_map, kvm_supported,
+                          cpu->sve_vq_init, max_vq);
+            if (max_vq == 0 || bitmap_empty(cpu->sve_vq_map, max_vq)) {
+                error_setg(errp, "cannot disable sve%d", vq * 128);
+                error_append_hint(errp, "Disabling sve%d results in all "
+                                  "vector lengths being disabled.\n",
+                                  vq * 128);
+                error_append_hint(errp, "With SVE enabled, at least one "
+                                  "vector length must be enabled.\n");
+                return;
+            }
+        } else {
+            /* Disabling a power-of-two disables all larger lengths. */
+            if (test_bit(0, cpu->sve_vq_init)) {
+                error_setg(errp, "cannot disable sve128");
+                error_append_hint(errp, "Disabling sve128 results in all "
+                                  "vector lengths being disabled.\n");
+                error_append_hint(errp, "With SVE enabled, at least one "
+                                  "vector length must be enabled.\n");
+                return;
+            }
+            for (vq = 2; vq <= ARM_MAX_VQ; vq <<= 1) {
+                if (test_bit(vq - 1, cpu->sve_vq_init)) {
+                    break;
+                }
+            }
+            max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
+            bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
         }
-        max_vq = vq <= ARM_MAX_VQ ? vq - 1 : ARM_MAX_VQ;
 
-        bitmap_complement(cpu->sve_vq_map, cpu->sve_vq_init, max_vq);
         max_vq = find_last_bit(cpu->sve_vq_map, max_vq) + 1;
     }
 
@@ -XXX,XX +XXX,XX @@ void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
     assert(max_vq != 0);
     bitmap_clear(cpu->sve_vq_map, max_vq, ARM_MAX_VQ - max_vq);
 
-    /* Ensure all required powers-of-two are enabled. */
-    for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
-        if (!test_bit(vq - 1, cpu->sve_vq_map)) {
-            error_setg(errp, "cannot disable sve%d", vq * 128);
-            error_append_hint(errp, "sve%d is required as it "
-                              "is a power-of-two length smaller than "
-                              "the maximum, sve%d\n",
-                              vq * 128, max_vq * 128);
+    if (kvm_enabled()) {
+        /* Ensure the set of lengths matches what KVM supports. */
+        bitmap_xor(tmp, cpu->sve_vq_map, kvm_supported, max_vq);
+        if (!bitmap_empty(tmp, max_vq)) {
+            vq = find_last_bit(tmp, max_vq) + 1;
+            if (test_bit(vq - 1, cpu->sve_vq_map)) {
+                if (cpu->sve_max_vq) {
+                    error_setg(errp, "cannot set sve-max-vq=%d",
+                               cpu->sve_max_vq);
+                    error_append_hint(errp, "This KVM host does not support "
+                                      "the vector length %d-bits.\n",
+                                      vq * 128);
+                    error_append_hint(errp, "It may not be possible to use "
+                                      "sve-max-vq with this KVM host. Try "
+                                      "using only sve<N> properties.\n");
+                } else {
+                    error_setg(errp, "cannot enable sve%d", vq * 128);
+                    error_append_hint(errp, "This KVM host does not support "
+                                      "the vector length %d-bits.\n",
+                                      vq * 128);
+                }
+            } else {
+                error_setg(errp, "cannot disable sve%d", vq * 128);
+                error_append_hint(errp, "The KVM host requires all "
+                                  "supported vector lengths smaller "
+                                  "than %d bits to also be enabled.\n",
+                                  max_vq * 128);
+            }
             return;
         }
+    } else {
+        /* Ensure all required powers-of-two are enabled. */
+        for (vq = pow2floor(max_vq); vq >= 1; vq >>= 1) {
+            if (!test_bit(vq - 1, cpu->sve_vq_map)) {
+                error_setg(errp, "cannot disable sve%d", vq * 128);
+                error_append_hint(errp, "sve%d is required as it "
+                                  "is a power-of-two length smaller than "
+                                  "the maximum, sve%d\n",
+                                  vq * 128, max_vq * 128);
+                return;
+            }
+        }
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static void cpu_max_set_sve_max_vq(Object *obj, Visitor *v, const char *name,
 {
     ARMCPU *cpu = ARM_CPU(obj);
     Error *err = NULL;
+    uint32_t max_vq;
 
-    visit_type_uint32(v, name, &cpu->sve_max_vq, &err);
-
-    if (!err && (cpu->sve_max_vq == 0 || cpu->sve_max_vq > ARM_MAX_VQ)) {
-        error_setg(&err, "unsupported SVE vector length");
-        error_append_hint(&err, "Valid sve-max-vq in range [1-%d]\n",
-                          ARM_MAX_VQ);
+    visit_type_uint32(v, name, &max_vq, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
     }
-    error_propagate(errp, err);
+
+    if (kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
+        error_setg(errp, "cannot set sve-max-vq");
+        error_append_hint(errp, "SVE not supported by KVM on this host\n");
+        return;
+    }
+
+    if (max_vq == 0 || max_vq > ARM_MAX_VQ) {
+        error_setg(errp, "unsupported SVE vector length");
+        error_append_hint(errp, "Valid sve-max-vq in range [1-%d]\n",
+                          ARM_MAX_VQ);
+        return;
+    }
+
+    cpu->sve_max_vq = max_vq;
 }
 
 static void cpu_arm_get_sve_vq(Object *obj, Visitor *v, const char *name,
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve_vq(Object *obj, Visitor *v, const char *name,
         return;
     }
 
+    if (value && kvm_enabled() && !kvm_arm_sve_supported(CPU(cpu))) {
+        error_setg(errp, "cannot enable %s", name);
+        error_append_hint(errp, "SVE not supported by KVM on this host\n");
+        return;
+    }
+
     if (value) {
         set_bit(vq - 1, cpu->sve_vq_map);
     } else {
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
         cpu->ctr = 0x80038003; /* 32 byte I and D cacheline size, VIPT icache */
         cpu->dcz_blocksize = 7; /*  512 bytes */
 #endif
-
-        object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
-                            cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
-
-        for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
-            char name[8];
-            sprintf(name, "sve%d", vq * 128);
-            object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
-                                cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
-        }
     }
 
     object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
                         cpu_arm_set_sve, NULL, NULL, &error_fatal);
+    object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
+                        cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
+
+    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
+        char name[8];
+        sprintf(name, "sve%d", vq * 128);
+        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
+                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
+    }
 }
 
 struct ARMCPUInfo {
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_sve_supported(CPUState *cpu)
     return kvm_check_extension(s, KVM_CAP_ARM_SVE);
 }
 
+QEMU_BUILD_BUG_ON(KVM_ARM64_SVE_VQ_MIN != 1);
+
+void kvm_arm_sve_get_vls(CPUState *cs, unsigned long *map)
+{
+    /* Only call this function if kvm_arm_sve_supported() returns true. */
+    static uint64_t vls[KVM_ARM64_SVE_VLS_WORDS];
+    static bool probed;
+    uint32_t vq = 0;
+    int i, j;
+
+    bitmap_clear(map, 0, ARM_MAX_VQ);
+
+    /*
+     * KVM ensures all host CPUs support the same set of vector lengths.
+     * So we only need to create the scratch VCPUs once and then cache
+     * the results.
+     */
+    if (!probed) {
+        struct kvm_vcpu_init init = {
+            .target = -1,
+            .features[0] = (1 << KVM_ARM_VCPU_SVE),
+        };
+        struct kvm_one_reg reg = {
+            .id = KVM_REG_ARM64_SVE_VLS,
+            .addr = (uint64_t)&vls[0],
+        };
+        int fdarray[3], ret;
+
+        probed = true;
+
+        if (!kvm_arm_create_scratch_host_vcpu(NULL, fdarray, &init)) {
+            error_report("failed to create scratch VCPU with SVE enabled");
+            abort();
+        }
+        ret = ioctl(fdarray[2], KVM_GET_ONE_REG, &reg);
+        kvm_arm_destroy_scratch_host_vcpu(fdarray);
+        if (ret) {
+            error_report("failed to get KVM_REG_ARM64_SVE_VLS: %s",
+                         strerror(errno));
+            abort();
+        }
+
+        for (i = KVM_ARM64_SVE_VLS_WORDS - 1; i >= 0; --i) {
+            if (vls[i]) {
+                vq = 64 - clz64(vls[i]) + i * 64;
+                break;
+            }
+        }
+        if (vq > ARM_MAX_VQ) {
+            warn_report("KVM supports vector lengths larger than "
+                        "QEMU can enable");
+        }
+    }
+
+    for (i = 0; i < KVM_ARM64_SVE_VLS_WORDS; ++i) {
+        if (!vls[i]) {
+            continue;
+        }
+        for (j = 1; j <= 64; ++j) {
+            vq = j + i * 64;
+            if (vq > ARM_MAX_VQ) {
+                return;
+            }
+            if (vls[i] & (1UL << (j - 1))) {
+                set_bit(vq - 1, map);
+            }
+        }
+    }
+}
+
+static int kvm_arm_sve_set_vls(CPUState *cs)
+{
+    uint64_t vls[KVM_ARM64_SVE_VLS_WORDS] = {0};
+    struct kvm_one_reg reg = {
+        .id = KVM_REG_ARM64_SVE_VLS,
+        .addr = (uint64_t)&vls[0],
+    };
+    ARMCPU *cpu = ARM_CPU(cs);
+    uint32_t vq;
+    int i, j;
+
+    assert(cpu->sve_max_vq <= KVM_ARM64_SVE_VQ_MAX);
+
+    for (vq = 1; vq <= cpu->sve_max_vq; ++vq) {
+        if (test_bit(vq - 1, cpu->sve_vq_map)) {
+            i = (vq - 1) / 64;
+            j = (vq - 1) % 64;
+            vls[i] |= 1UL << j;
+        }
+    }
+
+    return kvm_vcpu_ioctl(cs, KVM_SET_ONE_REG, &reg);
+}
+
 #define ARM_CPU_ID_MPIDR       3, 0, 0, 0, 5
 
 int kvm_arch_init_vcpu(CPUState *cs)
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
 
     if (cpu->kvm_target == QEMU_KVM_ARM_TARGET_NONE ||
         !object_dynamic_cast(OBJECT(cpu), TYPE_AARCH64_CPU)) {
-        fprintf(stderr, "KVM is not supported for this guest CPU type\n");
+        error_report("KVM is not supported for this guest CPU type");
         return -EINVAL;
     }
 
@@ -XXX,XX +XXX,XX @@ int kvm_arch_init_vcpu(CPUState *cs)
     }
 
     if (cpu_isar_feature(aa64_sve, cpu)) {
+        ret = kvm_arm_sve_set_vls(cs);
+        if (ret) {
+            return ret;
+        }
         ret = kvm_arm_vcpu_finalize(cs, KVM_ARM_VCPU_SVE);
         if (ret) {
             return ret;
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/arm-cpu-features.c
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static QDict *resp_get_props(QDict *resp)
     return qdict;
 }
 
+static bool resp_get_feature(QDict *resp, const char *feature)
+{
+    QDict *props;
+
+    g_assert(resp);
+    g_assert(resp_has_props(resp));
+    props = resp_get_props(resp);
+    g_assert(qdict_get(props, feature));
+    return qdict_get_bool(props, feature);
+}
+
 #define assert_has_feature(qts, cpu_type, feature)                     \
 ({                                                                     \
     QDict *_resp = do_query_no_props(qts, cpu_type);                   \
@@ -XXX,XX +XXX,XX @@ static void sve_tests_sve_off(const void *data)
     qtest_quit(qts);
 }
 
+static void sve_tests_sve_off_kvm(const void *data)
+{
+    QTestState *qts;
+
+    qts = qtest_init(MACHINE_KVM "-cpu max,sve=off");
+
+    /*
+     * We don't know if this host supports SVE so we don't
+     * attempt to test enabling anything. We only test that
+     * everything is disabled (as it should be with sve=off)
+     * and that using sve<N>=off to explicitly disable vector
+     * lengths is OK too.
+     */
+    assert_sve_vls(qts, "max", 0, NULL);
+    assert_sve_vls(qts, "max", 0, "{ 'sve128': false }");
+
+    qtest_quit(qts);
+}
+
 static void test_query_cpu_model_expansion(const void *data)
 {
     QTestState *qts;
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
     }
 
     if (g_str_equal(qtest_get_arch(), "aarch64")) {
+        bool kvm_supports_sve;
+        char max_name[8], name[8];
+        uint32_t max_vq, vq;
+        uint64_t vls;
+        QDict *resp;
+        char *error;
+
         assert_has_feature(qts, "host", "aarch64");
         assert_has_feature(qts, "host", "pmu");
 
-        assert_has_feature(qts, "max", "sve");
-
         assert_error(qts, "cortex-a15",
             "We cannot guarantee the CPU type 'cortex-a15' works "
             "with KVM on this host", NULL);
+
+        assert_has_feature(qts, "max", "sve");
+        resp = do_query_no_props(qts, "max");
+        kvm_supports_sve = resp_get_feature(resp, "sve");
+        vls = resp_get_sve_vls(resp);
+        qobject_unref(resp);
+
+        if (kvm_supports_sve) {
+            g_assert(vls != 0);
+            max_vq = 64 - __builtin_clzll(vls);
+            sprintf(max_name, "sve%d", max_vq * 128);
+
+            /* Enabling a supported length is of course fine. */
+            assert_sve_vls(qts, "max", vls, "{ %s: true }", max_name);
+
+            /* Get the next supported length smaller than max-vq. */
+            vq = 64 - __builtin_clzll(vls & ~BIT_ULL(max_vq - 1));
+            if (vq) {
+                /*
+                 * We have at least one length smaller than max-vq,
+                 * so we can disable max-vq.
+                 */
+                assert_sve_vls(qts, "max", (vls & ~BIT_ULL(max_vq - 1)),
+                               "{ %s: false }", max_name);
+
+                /*
+                 * Smaller, supported vector lengths cannot be disabled
+                 * unless all larger, supported vector lengths are also
+                 * disabled.
+                 */
+                sprintf(name, "sve%d", vq * 128);
+                error = g_strdup_printf("cannot disable %s", name);
+                assert_error(qts, "max", error,
+                             "{ %s: true, %s: false }",
+                             max_name, name);
+                g_free(error);
+            }
+
+            /*
+             * The smallest, supported vector length is required, because
+             * we need at least one vector length enabled.
+             */
+            vq = __builtin_ffsll(vls);
+            sprintf(name, "sve%d", vq * 128);
+            error = g_strdup_printf("cannot disable %s", name);
+            assert_error(qts, "max", error, "{ %s: false }", name);
+            g_free(error);
+
+            /* Get an unsupported length. */
+            for (vq = 1; vq <= max_vq; ++vq) {
+                if (!(vls & BIT_ULL(vq - 1))) {
+                    break;
+                }
+            }
+            if (vq <= SVE_MAX_VQ) {
+                sprintf(name, "sve%d", vq * 128);
+                error = g_strdup_printf("cannot enable %s", name);
+                assert_error(qts, "max", error, "{ %s: true }", name);
+                g_free(error);
+            }
+        } else {
+            g_assert(vls == 0);
+        }
     } else {
         assert_has_not_feature(qts, "host", "aarch64");
         assert_has_not_feature(qts, "host", "pmu");
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
                             NULL, sve_tests_sve_max_vq_8);
         qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
                             NULL, sve_tests_sve_off);
+        qtest_add_data_func("/arm/kvm/query-cpu-model-expansion/sve-off",
+                            NULL, sve_tests_sve_off_kvm);
     }
 
     return g_test_run();
diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/arm-cpu-features.rst
+++ b/docs/arm-cpu-features.rst
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Dependencies and Constraints
 
   1) At least one vector length must be enabled when `sve` is enabled.
 
-  2) If a vector length `N` is enabled, then all power-of-two vector
-     lengths smaller than `N` must also be enabled.  E.g. if `sve512`
-     is enabled, then the 128-bit and 256-bit vector lengths must also
-     be enabled.
+  2) If a vector length `N` is enabled, then, when KVM is enabled, all
+     smaller, host supported vector lengths must also be enabled.  If
+     KVM is not enabled, then only all the smaller, power-of-two vector
+     lengths must be enabled.  E.g. with KVM if the host supports all
+     vector lengths up to 512-bits (128, 256, 384, 512), then if `sve512`
+     is enabled, the 128-bit vector length, 256-bit vector length, and
+     384-bit vector length must also be enabled. Without KVM, the 384-bit
+     vector length would not be required.
+
+  3) If KVM is enabled then only vector lengths that the host CPU type
+     support may be enabled.  If SVE is not supported by the host, then
+     no `sve*` properties may be enabled.
 
 SVE CPU Property Parsing Semantics
 ----------------------------------
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Parsing Semantics
      an error is generated.
 
   2) If SVE is enabled (`sve=on`), but no `sve<N>` CPU properties are
-     provided, then all supported vector lengths are enabled, including
-     the non-power-of-two lengths.
+     provided, then all supported vector lengths are enabled, which when
+     KVM is not in use means including the non-power-of-two lengths, and,
+     when KVM is in use, it means all vector lengths supported by the host
+     processor.
 
   3) If SVE is enabled, then an error is generated when attempting to
      disable the last enabled vector length (see constraint (1) of "SVE
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Parsing Semantics
      has been explicitly disabled, then an error is generated (see
      constraint (2) of "SVE CPU Property Dependencies and Constraints").
 
-  5) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
+  5) When KVM is enabled, if the host does not support SVE, then an error
+     is generated when attempting to enable any `sve*` properties (see
+     constraint (3) of "SVE CPU Property Dependencies and Constraints").
+
+  6) When KVM is enabled, if the host does support SVE, then an error is
+     generated when attempting to enable any vector lengths not supported
+     by the host (see constraint (3) of "SVE CPU Property Dependencies and
+     Constraints").
+
+  7) If one or more `sve<N>` CPU properties are set `off`, but no `sve<N>`,
      CPU properties are set `on`, then the specified vector lengths are
      disabled but the default for any unspecified lengths remains enabled.
-     Disabling a power-of-two vector length also disables all vector
-     lengths larger than the power-of-two length (see constraint (2) of
-     "SVE CPU Property Dependencies and Constraints").
+     When KVM is not enabled, disabling a power-of-two vector length also
+     disables all vector lengths larger than the power-of-two length.
+     When KVM is enabled, then disabling any supported vector length also
+     disables all larger vector lengths (see constraint (2) of "SVE CPU
+     Property Dependencies and Constraints").
 
-  6) If one or more `sve<N>` CPU properties are set to `on`, then they
+  8) If one or more `sve<N>` CPU properties are set to `on`, then they
      are enabled and all unspecified lengths default to disabled, except
      for the required lengths per constraint (2) of "SVE CPU Property
      Dependencies and Constraints", which will even be auto-enabled if
      they were not explicitly enabled.
 
-  7) If SVE was disabled (`sve=off`), allowing all vector lengths to be
+  9) If SVE was disabled (`sve=off`), allowing all vector lengths to be
      explicitly disabled (i.e. avoiding the error specified in (3) of
      "SVE CPU Property Parsing Semantics"), then if later an `sve=on` is
      provided an error will be generated.  To avoid this error, one must
-- 
2.20.1

From: Andrew Jones <drjones@redhat.com>

Allow cpu 'host' to enable SVE when it's available, unless the
user chooses to disable it with the added 'sve=off' cpu property.
Also give the user the ability to select vector lengths with the
sve<N> properties. We don't adopt 'max' cpu's other sve property,
sve-max-vq, because that property is difficult to use with KVM.
That property assumes all vector lengths in the range from 1 up
to and including the specified maximum length are supported, but
there may be optional lengths not supported by the host in that
range. With KVM one must be more specific when enabling vector
lengths.

Signed-off-by: Andrew Jones <drjones@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Masayoshi Mizuma <m.mizuma@jp.fujitsu.com>
Message-id: 20191031142734.8590-10-drjones@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h          |  2 ++
 target/arm/cpu.c          |  3 +++
 target/arm/cpu64.c        | 33 +++++++++++++++++----------------
 target/arm/kvm64.c        | 14 +++++++++++++-
 tests/arm-cpu-features.c  | 17 ++++++++---------
 docs/arm-cpu-features.rst | 19 ++++++++++++-------
 6 files changed, 55 insertions(+), 33 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ int aarch64_cpu_gdb_write_register(CPUState *cpu, uint8_t *buf, int reg);
 void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq);
 void aarch64_sve_change_el(CPUARMState *env, int old_el,
                            int new_el, bool el0_a64);
+void aarch64_add_sve_properties(Object *obj);
 #else
 static inline void aarch64_sve_narrow_vq(CPUARMState *env, unsigned vq) { }
 static inline void aarch64_sve_change_el(CPUARMState *env, int o,
                                          int n, bool a)
 { }
+static inline void aarch64_add_sve_properties(Object *obj) { }
 #endif
 
 #if !defined(CONFIG_TCG)
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_host_initfn(Object *obj)
     ARMCPU *cpu = ARM_CPU(obj);
 
     kvm_arm_set_cpu_features_from_host(cpu);
+    if (arm_feature(&cpu->env, ARM_FEATURE_AARCH64)) {
+        aarch64_add_sve_properties(obj);
+    }
     arm_cpu_post_init(obj);
 }
 
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
     cpu->isar.id_aa64pfr0 = t;
 }
 
+void aarch64_add_sve_properties(Object *obj)
+{
+    uint32_t vq;
+
+    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
+                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
+
+    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
+        char name[8];
+        sprintf(name, "sve%d", vq * 128);
+        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
+                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
+    }
+}
+
 /* -cpu max: if KVM is enabled, like -cpu host (best possible with this host);
  * otherwise, a CPU with as many features enabled as our emulation supports.
  * The version of '-cpu max' for qemu-system-arm is defined in cpu.c;
@@ -XXX,XX +XXX,XX @@ static void cpu_arm_set_sve(Object *obj, Visitor *v, const char *name,
 static void aarch64_max_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    uint32_t vq;
-    uint64_t t;
 
     if (kvm_enabled()) {
         kvm_arm_set_cpu_features_from_host(cpu);
-        if (kvm_arm_sve_supported(CPU(cpu))) {
-            t = cpu->isar.id_aa64pfr0;
-            t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-            cpu->isar.id_aa64pfr0 = t;
-        }
     } else {
+        uint64_t t;
         uint32_t u;
         aarch64_a57_initfn(obj);
 
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 #endif
     }
 
-    object_property_add(obj, "sve", "bool", cpu_arm_get_sve,
-                        cpu_arm_set_sve, NULL, NULL, &error_fatal);
+    aarch64_add_sve_properties(obj);
     object_property_add(obj, "sve-max-vq", "uint32", cpu_max_get_sve_max_vq,
                         cpu_max_set_sve_max_vq, NULL, NULL, &error_fatal);
-
-    for (vq = 1; vq <= ARM_MAX_VQ; ++vq) {
-        char name[8];
-        sprintf(name, "sve%d", vq * 128);
-        object_property_add(obj, name, "bool", cpu_arm_get_sve_vq,
-                            cpu_arm_set_sve_vq, NULL, NULL, &error_fatal);
-    }
 }
 
 struct ARMCPUInfo {
diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
      * and then query that CPU for the relevant ID registers.
      */
     int fdarray[3];
+    bool sve_supported;
     uint64_t features = 0;
+    uint64_t t;
     int err;
 
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
                               ARM64_SYS_REG(3, 0, 0, 3, 2));
     }
 
+    sve_supported = ioctl(fdarray[0], KVM_CHECK_EXTENSION, KVM_CAP_ARM_SVE) > 0;
+
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
 
     if (err < 0) {
         return false;
     }
 
-   /* We can assume any KVM supporting CPU is at least a v8
+    /* Add feature bits that can't appear until after VCPU init. */
+    if (sve_supported) {
+        t = ahcf->isar.id_aa64pfr0;
+        t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
+        ahcf->isar.id_aa64pfr0 = t;
+    }
+
+    /*
+     * We can assume any KVM supporting CPU is at least a v8
      * with VFPv4+Neon; this in turn implies most of the other
      * feature bits.
      */
diff --git a/tests/arm-cpu-features.c b/tests/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/arm-cpu-features.c
+++ b/tests/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
             "We cannot guarantee the CPU type 'cortex-a15' works "
             "with KVM on this host", NULL);
 
-        assert_has_feature(qts, "max", "sve");
-        resp = do_query_no_props(qts, "max");
+        assert_has_feature(qts, "host", "sve");
+        resp = do_query_no_props(qts, "host");
         kvm_supports_sve = resp_get_feature(resp, "sve");
         vls = resp_get_sve_vls(resp);
         qobject_unref(resp);
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
             sprintf(max_name, "sve%d", max_vq * 128);
 
             /* Enabling a supported length is of course fine. */
-            assert_sve_vls(qts, "max", vls, "{ %s: true }", max_name);
+            assert_sve_vls(qts, "host", vls, "{ %s: true }", max_name);
 
             /* Get the next supported length smaller than max-vq. */
             vq = 64 - __builtin_clzll(vls & ~BIT_ULL(max_vq - 1));
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
                  * We have at least one length smaller than max-vq,
                  * so we can disable max-vq.
                  */
-                assert_sve_vls(qts, "max", (vls & ~BIT_ULL(max_vq - 1)),
+                assert_sve_vls(qts, "host", (vls & ~BIT_ULL(max_vq - 1)),
                                "{ %s: false }", max_name);
 
                 /*
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
                  */
                 sprintf(name, "sve%d", vq * 128);
                 error = g_strdup_printf("cannot disable %s", name);
-                assert_error(qts, "max", error,
+                assert_error(qts, "host", error,
                              "{ %s: true, %s: false }",
                              max_name, name);
                 g_free(error);
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
             vq = __builtin_ffsll(vls);
             sprintf(name, "sve%d", vq * 128);
             error = g_strdup_printf("cannot disable %s", name);
-            assert_error(qts, "max", error, "{ %s: false }", name);
+            assert_error(qts, "host", error, "{ %s: false }", name);
             g_free(error);
 
             /* Get an unsupported length. */
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
             if (vq <= SVE_MAX_VQ) {
                 sprintf(name, "sve%d", vq * 128);
                 error = g_strdup_printf("cannot enable %s", name);
-                assert_error(qts, "max", error, "{ %s: true }", name);
+                assert_error(qts, "host", error, "{ %s: true }", name);
                 g_free(error);
             }
         } else {
@@ -XXX,XX +XXX,XX @@ static void test_query_cpu_model_expansion_kvm(const void *data)
     } else {
         assert_has_not_feature(qts, "host", "aarch64");
         assert_has_not_feature(qts, "host", "pmu");
-
-        assert_has_not_feature(qts, "max", "sve");
+        assert_has_not_feature(qts, "host", "sve");
     }
 
     qtest_quit(qts);
diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/arm-cpu-features.rst
+++ b/docs/arm-cpu-features.rst
@@ -XXX,XX +XXX,XX @@ SVE CPU Property Examples
 
      $ qemu-system-aarch64 -M virt -cpu max
 
-  3) Only enable the 128-bit vector length::
+  3) When KVM is enabled, implicitly enable all host CPU supported vector
+     lengths with the `host` CPU type::
+
+     $ qemu-system-aarch64 -M virt,accel=kvm -cpu host
+
+  4) Only enable the 128-bit vector length::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve128=on
 
-  4) Disable the 512-bit vector length and all larger vector lengths,
+  5) Disable the 512-bit vector length and all larger vector lengths,
      since 512 is a power-of-two.  This results in all the smaller,
      uninitialized lengths (128, 256, and 384) defaulting to enabled::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve512=off
 
-  5) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
+  6) Enable the 128-bit, 256-bit, and 512-bit vector lengths::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve128=on,sve256=on,sve512=on
 
-  6) The same as (5), but since the 128-bit and 256-bit vector
+  7) The same as (6), but since the 128-bit and 256-bit vector
      lengths are required for the 512-bit vector length to be enabled,
      then allow them to be auto-enabled::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve512=on
 
-  7) Do the same as (6), but by first disabling SVE and then re-enabling it::
+  8) Do the same as (7), but by first disabling SVE and then re-enabling it::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve512=on,sve=on
 
-  8) Force errors regarding the last vector length::
+  9) Force errors regarding the last vector length::
 
      $ qemu-system-aarch64 -M virt -cpu max,sve128=off
      $ qemu-system-aarch64 -M virt -cpu max,sve=off,sve128=off,sve=on
@@ -XXX,XX +XXX,XX @@ The examples in "SVE CPU Property Examples" exhibit many ways to select
 vector lengths which developers may find useful in order to avoid overly
 verbose command lines.  However, the recommended way to select vector
 lengths is to explicitly enable each desired length.  Therefore only
-example's (1), (3), and (5) exhibit recommended uses of the properties.
+example's (1), (4), and (6) exhibit recommended uses of the properties.
 
-- 
2.20.1

From: Christophe Lyon <christophe.lyon@linaro.org>

rt==15 is a special case when reading the flags: it means the
destination is APSR. This patch avoids rejecting
vmrs apsr_nzcv, fpscr
as illegal instruction.

Cc: qemu-stable@nongnu.org
Signed-off-by: Christophe Lyon <christophe.lyon@linaro.org>
Message-id: 20191025095711.10853-1-christophe.lyon@linaro.org
[PMM: updated the comment]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-vfp.inc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-vfp.inc.c b/target/arm/translate-vfp.inc.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-vfp.inc.c
+++ b/target/arm/translate-vfp.inc.c
@@ -XXX,XX +XXX,XX @@ static bool trans_VMSR_VMRS(DisasContext *s, arg_VMSR_VMRS *a)
     if (arm_dc_feature(s, ARM_FEATURE_M)) {
         /*
          * The only M-profile VFP vmrs/vmsr sysreg is FPSCR.
-         * Writes to R15 are UNPREDICTABLE; we choose to undef.
+         * Accesses to R15 are UNPREDICTABLE; we choose to undef.
+         * (FPSCR -> r15 is a special case which writes to the PSR flags.)
          */
-        if (a->rt == 15 || a->reg != ARM_VFP_FPSCR) {
+        if (a->rt == 15 && (!a->l || a->reg != ARM_VFP_FPSCR)) {
             return false;
         }
     }
-- 
2.20.1