Series comparison

-[PULL 00/32] target-arm queue
+[PULL 00/21] target-arm queue
-target-arm queue: the big stuff here is the final part of
+Hi; here's the latest batch of arm changes. The big thing
-rth's patches for Cortex-A76 and Neoverse-N1 support;
+in here is the SMMUv3 changes to add stage-2 translation support.
 also present are Gavin's NUMA series and a few other things.
 thanks
 -- PMM
-The following changes since commit 554623226f800acf48a2ed568900c1c968ec9a8b:
+The following changes since commit aa9bbd865502ed517624ab6fe7d4b5d89ca95e43:
-  Merge tag 'qemu-sparc-20220508' of https://github.com/mcayland/qemu into staging (2022-05-08 17:03:26 -0500)
+  Merge tag 'pull-ppc-20230528' of https://gitlab.com/danielhb/qemu into staging (2023-05-29 14:31:52 -0700)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220509
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230530
-for you to fetch changes up to ae9141d4a3265553503bf07d3574b40f84615a34:
+for you to fetch changes up to b03d0d4f531a8b867e0aac1fab0b876903015680:
-  hw/acpi/aml-build: Use existing CPU topology to build PPTT table (2022-05-09 11:47:55 +0100)
+  docs: sbsa: correct graphics card name (2023-05-30 13:32:46 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * MAINTAINERS/.mailmap: update email for Leif Lindholm
+ * fsl-imx6: Add SNVS support for i.MX6 boards
- * hw/arm: add version information to sbsa-ref machine DT
+ * smmuv3: Add support for stage 2 translations
- * Enable new features for -cpu max:
+ * hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop
-   FEAT_Debugv8p2, FEAT_Debugv8p4, FEAT_RAS (minimal version only),
+ * hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
-   FEAT_IESB, FEAT_CSV2, FEAT_CSV2_2, FEAT_CSV3, FEAT_DGH
+ * cleanups for recent Kconfig changes
- * Emulate Cortex-A76
+ * target/arm: Explicitly select short-format FSR for M-profile
- * Emulate Neoverse-N1
+ * tests/qtest: Run arm-specific tests only if the required machine is available
- * Fix the virt board default NUMA topology
+ * hw/arm/sbsa-ref: add GIC node into DT
  * docs: sbsa: correct graphics card name
  * Update copyright dates to 2023
 ----------------------------------------------------------------
-Gavin Shan (6):
+Clément Chigot (1):
-      qapi/machine.json: Add cluster-id
+      hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
       qtest/numa-test: Specify CPU topology in aarch64_numa_cpu()
       hw/arm/virt: Consider SMP configuration in CPU topology
       qtest/numa-test: Correct CPU and NUMA association in aarch64_numa_cpu()
       hw/arm/virt: Fix CPU's default NUMA node ID
       hw/acpi/aml-build: Use existing CPU topology to build PPTT table
-Leif Lindholm (2):
+Enze Li (1):
-      MAINTAINERS/.mailmap: update email for Leif Lindholm
+      Update copyright dates to 2023
       hw/arm: add versioning to sbsa-ref machine DT
-Richard Henderson (24):
+Fabiano Rosas (3):
-      target/arm: Handle cpreg registration for missing EL
+      target/arm: Explain why we need to select ARM_V7M
-      target/arm: Drop EL3 no EL2 fallbacks
+      arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
-      target/arm: Merge zcr reginfo
+      arm/Kconfig: Make TCG dependence explicit
       target/arm: Adjust definition of CONTEXTIDR_EL2
       target/arm: Move cortex impdef sysregs to cpu_tcg.c
       target/arm: Update qemu-system-arm -cpu max to cortex-a57
       target/arm: Set ID_DFR0.PerfMon for qemu-system-arm -cpu max
       target/arm: Split out aa32_max_features
       target/arm: Annotate arm_max_initfn with FEAT identifiers
       target/arm: Use field names for manipulating EL2 and EL3 modes
       target/arm: Enable FEAT_Debugv8p2 for -cpu max
       target/arm: Enable FEAT_Debugv8p4 for -cpu max
       target/arm: Add minimal RAS registers
       target/arm: Enable SCR and HCR bits for RAS
       target/arm: Implement virtual SError exceptions
       target/arm: Implement ESB instruction
       target/arm: Enable FEAT_RAS for -cpu max
       target/arm: Enable FEAT_IESB for -cpu max
       target/arm: Enable FEAT_CSV2 for -cpu max
       target/arm: Enable FEAT_CSV2_2 for -cpu max
       target/arm: Enable FEAT_CSV3 for -cpu max
       target/arm: Enable FEAT_DGH for -cpu max
       target/arm: Define cortex-a76
       target/arm: Define neoverse-n1
- docs/system/arm/emulation.rst |  10 +
+Marcin Juszkiewicz (2):
- docs/system/arm/virt.rst      |   2 +
+      hw/arm/sbsa-ref: add GIC node into DT
- qapi/machine.json             |   6 +-
+      docs: sbsa: correct graphics card name
- target/arm/cpregs.h           |  11 +
- target/arm/cpu.h              |  23 ++
+Mostafa Saleh (10):
- target/arm/helper.h           |   1 +
+      hw/arm/smmuv3: Add missing fields for IDR0
- target/arm/internals.h        |  16 ++
+      hw/arm/smmuv3: Update translation config to hold stage-2
- target/arm/syndrome.h         |   5 +
+      hw/arm/smmuv3: Refactor stage-1 PTW
- target/arm/a32.decode         |  16 +-
+      hw/arm/smmuv3: Add page table walk for stage-2
- target/arm/t32.decode         |  18 +-
+      hw/arm/smmuv3: Parse STE config for stage-2
- hw/acpi/aml-build.c           | 111 ++++----
+      hw/arm/smmuv3: Make TLB lookup work for stage-2
- hw/arm/sbsa-ref.c             |  16 ++
+      hw/arm/smmuv3: Add VMID to TLB tagging
- hw/arm/virt.c                 |  21 +-
+      hw/arm/smmuv3: Add CMDs related to stage-2
- hw/core/machine-hmp-cmds.c    |   4 +
+      hw/arm/smmuv3: Add stage-2 support in iova notifier
- hw/core/machine.c             |  16 ++
+      hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2
- target/arm/cpu.c              |  66 ++++-
- target/arm/cpu64.c            | 353 ++++++++++++++-----------
+Peter Maydell (1):
- target/arm/cpu_tcg.c          | 227 +++++++++++-----
+      target/arm: Explicitly select short-format FSR for M-profile
- target/arm/helper.c           | 600 +++++++++++++++++++++++++-----------------
- target/arm/op_helper.c        |  43 +++
+Thomas Huth (1):
- target/arm/translate-a64.c    |  18 ++
+      tests/qtest: Run arm-specific tests only if the required machine is available
- target/arm/translate.c        |  23 ++
- tests/qtest/numa-test.c       |  19 +-
+Tommy Wu (1):
- .mailmap                      |   3 +-
+      hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.
- MAINTAINERS                   |   2 +-
-files changed, 1068 insertions(+), 562 deletions(-)
+Vitaly Cheptsov (1):
       fsl-imx6: Add SNVS support for i.MX6 boards
  docs/conf.py                                |   2 +-
  docs/system/arm/sbsa.rst                    |   2 +-
  configs/devices/aarch64-softmmu/default.mak |   6 +
  configs/devices/arm-softmmu/default.mak     |  40 ++++
  hw/arm/smmu-internal.h                      |  37 +++
  hw/arm/smmuv3-internal.h                    |  12 +-
  include/hw/arm/fsl-imx6.h                   |   2 +
  include/hw/arm/smmu-common.h                |  45 +++-
  include/hw/arm/smmuv3.h                     |   4 +
  include/qemu/help-texts.h                   |   2 +-
  hw/arm/fsl-imx6.c                           |   8 +
  hw/arm/sbsa-ref.c                           |  19 +-
  hw/arm/smmu-common.c                        | 209 ++++++++++++++--
  hw/arm/smmuv3.c                             | 357 ++++++++++++++++++++++++----
  hw/arm/xlnx-zynqmp.c                        |   2 +-
  hw/dma/xilinx_axidma.c                      |  11 +-
  target/arm/tcg/tlb_helper.c                 |  13 +-
  hw/arm/Kconfig                              | 123 ++++++----
  hw/arm/trace-events                         |  14 +-
  target/arm/Kconfig                          |   3 +
  tests/qtest/meson.build                     |   7 +-
 files changed, 773 insertions(+), 145 deletions(-)

-[PULL 31/32] hw/arm/virt: Fix CPU's default NUMA node ID
+[PULL 01/21] fsl-imx6: Add SNVS support for i.MX6 boards
-From: Gavin Shan <gshan@redhat.com>
+From: Vitaly Cheptsov <cheptsov@ispras.ru>
-When CPU-to-NUMA association isn't explicitly provided by users,
+SNVS is supported on both i.MX6 and i.MX6UL and is needed
-the default one is given by mc->get_default_cpu_node_id(). However,
+to support shutdown on the board.
 the CPU topology isn't fully considered in the default association
 and this causes CPU topology broken warnings on booting Linux guest.
-For example, the following warning messages are observed when the
+Cc: Peter Maydell <peter.maydell@linaro.org> (odd fixer:SABRELITE / i.MX6)
-Linux guest is booted with the following command lines.
+Cc: Jean-Christophe Dubois <jcd@tribudubois.net> (reviewer:SABRELITE / i.MX6)
+Cc: qemu-arm@nongnu.org (open list:SABRELITE / i.MX6)
-  /home/gavin/sandbox/qemu.main/build/qemu-system-aarch64 \
+Cc: qemu-devel@nongnu.org (open list:All patches CC here)
-  -accel kvm -machine virt,gic-version=host               \
+Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>
-  -cpu host                                               \
+Message-id: 20230515095015.66860-1-cheptsov@ispras.ru
-  -smp 6,sockets=2,cores=3,threads=1                      \
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
   -m 1024M,slots=16,maxmem=64G                            \
   -object memory-backend-ram,id=mem0,size=128M            \
   -object memory-backend-ram,id=mem1,size=128M            \
   -object memory-backend-ram,id=mem2,size=128M            \
   -object memory-backend-ram,id=mem3,size=128M            \
   -object memory-backend-ram,id=mem4,size=128M            \
   -object memory-backend-ram,id=mem4,size=384M            \
   -numa node,nodeid=0,memdev=mem0                         \
   -numa node,nodeid=1,memdev=mem1                         \
   -numa node,nodeid=2,memdev=mem2                         \
   -numa node,nodeid=3,memdev=mem3                         \
   -numa node,nodeid=4,memdev=mem4                         \
   -numa node,nodeid=5,memdev=mem5
          :
   alternatives: patching kernel code
   BUG: arch topology borken
   the CLS domain not a subset of the MC domain
   <the above error log repeats>
   BUG: arch topology borken
   the DIE domain not a subset of the NODE domain
 With current implementation of mc->get_default_cpu_node_id(),
 CPU#0 to CPU#5 are associated with NODE#0 to NODE#5 separately.
 That's incorrect because CPU#0/1/2 should be associated with same
 NUMA node because they're seated in same socket.
 This fixes the issue by considering the socket ID when the default
 CPU-to-NUMA association is provided in virt_possible_cpu_arch_ids().
 With this applied, no more CPU topology broken warnings are seen
 from the Linux guest. The 6 CPUs are associated with NODE#0/1, but
 there are no CPUs associated with NODE#2/3/4/5.
 Signed-off-by: Gavin Shan <gshan@redhat.com>
 Reviewed-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
 Message-id: 20220503140304.855514-6-gshan@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 4 +++-
+ include/hw/arm/fsl-imx6.h | 2 ++
-file changed, 3 insertions(+), 1 deletion(-)
+ hw/arm/fsl-imx6.c         | 8 ++++++++
 files changed, 10 insertions(+)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/include/hw/arm/fsl-imx6.h
-+++ b/hw/arm/virt.c
++++ b/include/hw/arm/fsl-imx6.h
-@@ -XXX,XX +XXX,XX @@ virt_cpu_index_to_props(MachineState *ms, unsigned cpu_index)
+@@ -XXX,XX +XXX,XX @@
+ #include "hw/cpu/a9mpcore.h"
- static int64_t virt_get_default_cpu_node_id(const MachineState *ms, int idx)
+ #include "hw/misc/imx6_ccm.h"
- {
+ #include "hw/misc/imx6_src.h"
--    return idx % ms->numa_state->num_nodes;
++#include "hw/misc/imx7_snvs.h"
-+    int64_t socket_id = ms->possible_cpus->cpus[idx].props.socket_id;
+ #include "hw/watchdog/wdt_imx2.h"
  #include "hw/char/imx_serial.h"
  #include "hw/timer/imx_gpt.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
      A9MPPrivState  a9mpcore;
      IMX6CCMState   ccm;
      IMX6SRCState   src;
 +    IMX7SNVSState  snvs;
      IMXSerialState uart[FSL_IMX6_NUM_UARTS];
      IMXGPTState    gpt;
      IMXEPITState   epit[FSL_IMX6_NUM_EPITS];
 diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fsl-imx6.c
 +++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
      object_initialize_child(obj, "src", &s->src, TYPE_IMX6_SRC);
 +    object_initialize_child(obj, "snvs", &s->snvs, TYPE_IMX7_SNVS);
 +
-+    return socket_id % ms->numa_state->num_nodes;
+     for (i = 0; i < FSL_IMX6_NUM_UARTS; i++) {
- }
+         snprintf(name, NAME_SIZE, "uart%d", i + 1);
+         object_initialize_child(obj, name, &s->uart[i], TYPE_IMX_SERIAL);
- static const CPUArchIdList *virt_possible_cpu_arch_ids(MachineState *ms)
+@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                         qdev_get_gpio_in(DEVICE(&s->a9mpcore),
                                          FSL_IMX6_ENET_MAC_1588_IRQ));
 +    /*
 +     * SNVS
 +     */
 +    sysbus_realize(SYS_BUS_DEVICE(&s->snvs), &error_abort);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->snvs), 0, FSL_IMX6_SNVSHP_ADDR);
 +
      /*
       * Watchdog
       */
 --
-.25.1
+.34.1

-[PULL 30/32] qtest/numa-test: Correct CPU and NUMA association in aarch64_numa_cpu()
+[PULL 02/21] hw/arm/smmuv3: Add missing fields for IDR0
-From: Gavin Shan <gshan@redhat.com>
+From: Mostafa Saleh <smostafa@google.com>
-In aarch64_numa_cpu(), the CPU and NUMA association is something
+In preparation for adding stage-2 support.
-like below. Two threads in the same core/cluster/socket are
+Add IDR0 fields related to stage-2.
 associated with two individual NUMA nodes, which is unreal as
 Igor Mammedov mentioned. We don't expect the association to break
 NUMA-to-socket boundary, which matches with the real world.
-    NUMA-node  socket  cluster   core   thread
+VMID16: 16-bit VMID supported.
-    ------------------------------------------
+S2P: Stage-2 translation supported.
 0        0        0      0
 0        0        0      1
-This corrects the topology for CPUs and their association with
+They are described in 6.3.1 SMMU_IDR0.
 NUMA nodes. After this patch is applied, the CPU and NUMA
 association becomes something like below, which looks real.
 Besides, socket/cluster/core/thread IDs are all checked when
 the NUMA node IDs are verified. It helps to check if the CPU
 topology is properly populated or not.
-    NUMA-node  socket  cluster   core   thread
+No functional change intended.
     ------------------------------------------
 1        0        0       0
 0        0        0       0
-Suggested-by: Igor Mammedov <imammedo@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Gavin Shan <gshan@redhat.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Acked-by: Igor Mammedov <imammedo@redhat.com>
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
-Message-id: 20220503140304.855514-5-gshan@redhat.com
+Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-2-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/numa-test.c | 18 ++++++++++++------
+ hw/arm/smmuv3-internal.h | 2 ++
-file changed, 12 insertions(+), 6 deletions(-)
+file changed, 2 insertions(+)
-diff --git a/tests/qtest/numa-test.c b/tests/qtest/numa-test.c
+diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/numa-test.c
+--- a/hw/arm/smmuv3-internal.h
-+++ b/tests/qtest/numa-test.c
++++ b/hw/arm/smmuv3-internal.h
-@@ -XXX,XX +XXX,XX @@ static void aarch64_numa_cpu(const void *data)
+@@ -XXX,XX +XXX,XX @@ typedef enum SMMUTranslationStatus {
-     g_autofree char *cli = NULL;
+ /* MMIO Registers */
-     cli = make_cli(data, "-machine "
+ REG32(IDR0,                0x0)
--        "smp.cpus=2,smp.sockets=1,smp.clusters=1,smp.cores=1,smp.threads=2 "
++    FIELD(IDR0, S2P,         0 , 1)
-+        "smp.cpus=2,smp.sockets=2,smp.clusters=1,smp.cores=1,smp.threads=1 "
+     FIELD(IDR0, S1P,         1 , 1)
-         "-numa node,nodeid=0,memdev=ram -numa node,nodeid=1 "
+     FIELD(IDR0, TTF,         2 , 2)
--        "-numa cpu,node-id=1,thread-id=0 "
+     FIELD(IDR0, COHACC,      4 , 1)
--        "-numa cpu,node-id=0,thread-id=1");
+     FIELD(IDR0, ASID16,      12, 1)
-+        "-numa cpu,node-id=0,socket-id=1,cluster-id=0,core-id=0,thread-id=0 "
++    FIELD(IDR0, VMID16,      18, 1)
-+        "-numa cpu,node-id=1,socket-id=0,cluster-id=0,core-id=0,thread-id=0");
+     FIELD(IDR0, TTENDIAN,    21, 2)
-     qts = qtest_init(cli);
+     FIELD(IDR0, STALL_MODEL, 24, 2)
-     cpus = get_cpus(qts, &resp);
+     FIELD(IDR0, TERM_MODEL,  26, 1)
      g_assert(cpus);
      while ((e = qlist_pop(cpus))) {
          QDict *cpu, *props;
 -        int64_t thread, node;
 +        int64_t socket, cluster, core, thread, node;
          cpu = qobject_to(QDict, e);
          g_assert(qdict_haskey(cpu, "props"));
@@ -XXX,XX +XXX,XX @@ static void aarch64_numa_cpu(const void *data)
          g_assert(qdict_haskey(props, "node-id"));
          node = qdict_get_int(props, "node-id");
 +        g_assert(qdict_haskey(props, "socket-id"));
 +        socket = qdict_get_int(props, "socket-id");
 +        g_assert(qdict_haskey(props, "cluster-id"));
 +        cluster = qdict_get_int(props, "cluster-id");
 +        g_assert(qdict_haskey(props, "core-id"));
 +        core = qdict_get_int(props, "core-id");
          g_assert(qdict_haskey(props, "thread-id"));
          thread = qdict_get_int(props, "thread-id");
 -        if (thread == 0) {
 +        if (socket == 0 && cluster == 0 && core == 0 && thread == 0) {
              g_assert_cmpint(node, ==, 1);
 -        } else if (thread == 1) {
 +        } else if (socket == 1 && cluster == 0 && core == 0 && thread == 0) {
              g_assert_cmpint(node, ==, 0);
          } else {
              g_assert(false);
 --
-.25.1
+.34.1

-[PULL 29/32] hw/arm/virt: Consider SMP configuration in CPU topology
+[PULL 03/21] hw/arm/smmuv3: Update translation config to hold stage-2
-From: Gavin Shan <gshan@redhat.com>
+From: Mostafa Saleh <smostafa@google.com>
-Currently, the SMP configuration isn't considered when the CPU
+In preparation for adding stage-2 support, add a S2 config
-topology is populated. In this case, it's impossible to provide
+struct(SMMUS2Cfg), composed of the following fields and embedded in
-the default CPU-to-NUMA mapping or association based on the socket
+the main SMMUTransCfg:
-ID of the given CPU.
+ -tsz: Size of IPA input region (S2T0SZ)
  -sl0: Start level of translation (S2SL0)
  -affd: AF Fault Disable (S2AFFD)
  -record_faults: Record fault events (S2R)
  -granule_sz: Granule page shift (based on S2TG)
  -vmid: Virtual Machine ID (S2VMID)
  -vttb: Address of translation table base (S2TTB)
  -eff_ps: Effective PA output range (based on S2PS)
-This takes account of SMP configuration when the CPU topology
+They will be used in the next patches in stage-2 address translation.
 is populated. The die ID for the given CPU isn't assigned since
 it's not supported on arm/virt machine. Besides, the used SMP
 configuration in qtest/numa-test/aarch64_numa_cpu() is corrcted
 to avoid testing failure
-Signed-off-by: Gavin Shan <gshan@redhat.com>
+The fields in SMMUS2Cfg, are reordered to make the shared and stage-1
-Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
+fields next to each other, this reordering didn't change the struct
-Acked-by: Igor Mammedov <imammedo@redhat.com>
+size (104 bytes before and after).
-Message-id: 20220503140304.855514-4-gshan@redhat.com
 Stage-1 only fields: aa64, asid, tt, ttb, tbi, record_faults, oas.
 oas is stage-1 output address size. However, it is used to check
 input address in case stage-1 is unimplemented or bypassed according
 to SMMUv3 manual IHI0070.E "3.4. Address sizes"
 Shared fields: stage, disabled, bypassed, aborted, iotlb_*.
 No functional change intended.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-3-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 15 ++++++++++++++-
+ include/hw/arm/smmu-common.h | 22 +++++++++++++++++++---
-file changed, 14 insertions(+), 1 deletion(-)
+file changed, 19 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/include/hw/arm/smmu-common.h
-+++ b/hw/arm/virt.c
++++ b/include/hw/arm/smmu-common.h
-@@ -XXX,XX +XXX,XX @@ static const CPUArchIdList *virt_possible_cpu_arch_ids(MachineState *ms)
+@@ -XXX,XX +XXX,XX @@ typedef struct SMMUTLBEntry {
-     int n;
+     uint8_t granule;
-     unsigned int max_cpus = ms->smp.max_cpus;
+ } SMMUTLBEntry;
-     VirtMachineState *vms = VIRT_MACHINE(ms);
-+    MachineClass *mc = MACHINE_GET_CLASS(vms);
++/* Stage-2 configuration. */
++typedef struct SMMUS2Cfg {
-     if (ms->possible_cpus) {
++    uint8_t tsz;            /* Size of IPA input region (S2T0SZ) */
-         assert(ms->possible_cpus->len == max_cpus);
++    uint8_t sl0;            /* Start level of translation (S2SL0) */
-@@ -XXX,XX +XXX,XX @@ static const CPUArchIdList *virt_possible_cpu_arch_ids(MachineState *ms)
++    bool affd;              /* AF Fault Disable (S2AFFD) */
-         ms->possible_cpus->cpus[n].type = ms->cpu_type;
++    bool record_faults;     /* Record fault events (S2R) */
-         ms->possible_cpus->cpus[n].arch_id =
++    uint8_t granule_sz;     /* Granule page shift (based on S2TG) */
-             virt_cpu_mp_affinity(vms, n);
++    uint8_t eff_ps;         /* Effective PA output range (based on S2PS) */
 +    uint16_t vmid;          /* Virtual Machine ID (S2VMID) */
 +    uint64_t vttb;          /* Address of translation table base (S2TTB) */
 +} SMMUS2Cfg;
 +
-+        assert(!mc->smp_props.dies_supported);
+ /*
-+        ms->possible_cpus->cpus[n].props.has_socket_id = true;
+  * Generic structure populated by derived SMMU devices
-+        ms->possible_cpus->cpus[n].props.socket_id =
+  * after decoding the configuration information and used as
-+            n / (ms->smp.clusters * ms->smp.cores * ms->smp.threads);
+  * input to the page table walk
-+        ms->possible_cpus->cpus[n].props.has_cluster_id = true;
+  */
-+        ms->possible_cpus->cpus[n].props.cluster_id =
+ typedef struct SMMUTransCfg {
-+            (n / (ms->smp.cores * ms->smp.threads)) % ms->smp.clusters;
++    /* Shared fields between stage-1 and stage-2. */
-+        ms->possible_cpus->cpus[n].props.has_core_id = true;
+     int stage;                 /* translation stage */
-+        ms->possible_cpus->cpus[n].props.core_id =
+-    bool aa64;                 /* arch64 or aarch32 translation table */
-+            (n / ms->smp.threads) % ms->smp.cores;
+     bool disabled;             /* smmu is disabled */
-         ms->possible_cpus->cpus[n].props.has_thread_id = true;
+     bool bypassed;             /* translation is bypassed */
--        ms->possible_cpus->cpus[n].props.thread_id = n;
+     bool aborted;              /* translation is aborted */
-+        ms->possible_cpus->cpus[n].props.thread_id =
++    uint32_t iotlb_hits;       /* counts IOTLB hits */
-+            n % ms->smp.threads;
++    uint32_t iotlb_misses;     /* counts IOTLB misses*/
-     }
++    /* Used by stage-1 only. */
-     return ms->possible_cpus;
++    bool aa64;                 /* arch64 or aarch32 translation table */
- }
+     bool record_faults;        /* record fault events */
      uint64_t ttb;              /* TT base address */
      uint8_t oas;               /* output address width */
      uint8_t tbi;               /* Top Byte Ignore */
      uint16_t asid;
      SMMUTransTableInfo tt[2];
 -    uint32_t iotlb_hits;       /* counts IOTLB hits for this asid */
 -    uint32_t iotlb_misses;     /* counts IOTLB misses for this asid */
 +    /* Used by stage-2 only. */
 +    struct SMMUS2Cfg s2cfg;
  } SMMUTransCfg;
  typedef struct SMMUDevice {
 --
-.25.1
+.34.1

-[PULL 32/32] hw/acpi/aml-build: Use existing CPU topology to build PPTT table
+[PULL 04/21] hw/arm/smmuv3: Refactor stage-1 PTW
-From: Gavin Shan <gshan@redhat.com>
+From: Mostafa Saleh <smostafa@google.com>
-When the PPTT table is built, the CPU topology is re-calculated, but
+In preparation for adding stage-2 support, rename smmu_ptw_64 to
-it's unecessary because the CPU topology has been populated in
+smmu_ptw_64_s1 and refactor some of the code so it can be reused in
-virt_possible_cpu_arch_ids() on arm/virt machine.
+stage-2 page table walk.
-This reworks build_pptt() to avoid by reusing the existing IDs in
+Remove AA64 check from PTW as decode_cd already ensures that AA64 is
-ms->possible_cpus. Currently, the only user of build_pptt() is
+used, otherwise it faults with C_BAD_CD.
 arm/virt machine.
-Signed-off-by: Gavin Shan <gshan@redhat.com>
+A stage member is added to SMMUPTWEventInfo to differentiate
-Tested-by: Yanan Wang <wangyanan55@huawei.com>
+between stage-1 and stage-2 ptw faults.
-Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
-Acked-by: Igor Mammedov <imammedo@redhat.com>
+Add stage argument to trace_smmu_ptw_level be consistent with other
-Acked-by: Michael S. Tsirkin <mst@redhat.com>
+trace events.
-Message-id: 20220503140304.855514-7-gshan@redhat.com
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-4-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/acpi/aml-build.c | 111 +++++++++++++++++++-------------------------
+ include/hw/arm/smmu-common.h | 16 +++++++++++++---
-file changed, 48 insertions(+), 63 deletions(-)
+ hw/arm/smmu-common.c         | 27 ++++++++++-----------------
  hw/arm/smmuv3.c              |  2 ++
  hw/arm/trace-events          |  2 +-
 files changed, 26 insertions(+), 21 deletions(-)
-diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/acpi/aml-build.c
+--- a/include/hw/arm/smmu-common.h
-+++ b/hw/acpi/aml-build.c
++++ b/include/hw/arm/smmu-common.h
-@@ -XXX,XX +XXX,XX @@ void build_pptt(GArray *table_data, BIOSLinker *linker, MachineState *ms,
+@@ -XXX,XX +XXX,XX @@
-                 const char *oem_id, const char *oem_table_id)
+ #include "hw/pci/pci.h"
  #include "qom/object.h"
 -#define SMMU_PCI_BUS_MAX      256
 -#define SMMU_PCI_DEVFN_MAX    256
 -#define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
 +#define SMMU_PCI_BUS_MAX                    256
 +#define SMMU_PCI_DEVFN_MAX                  256
 +#define SMMU_PCI_DEVFN(sid)                 (sid & 0xFF)
 +
 +/* VMSAv8-64 Translation constants and functions */
 +#define VMSA_LEVELS                         4
 +
 +#define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
 +#define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
 +                                             (VMSA_LEVELS - (lvl)))
 +#define VMSA_IDXMSK(isz, strd, lvl)         ((1ULL << \
 +                                             VMSA_BIT_LVL(isz, strd, lvl)) - 1)
  /*
   * Page table walk error types
@@ -XXX,XX +XXX,XX @@ typedef enum {
  } SMMUPTWEventType;
  typedef struct SMMUPTWEventInfo {
 +    int stage;
      SMMUPTWEventType type;
      dma_addr_t addr; /* fetched address that induced an abort, if any */
  } SMMUPTWEventInfo;
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
  }
  /**
 - * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
 + * smmu_ptw_64_s1 - VMSAv8-64 Walk of the page tables for a given IOVA
   * @cfg: translation config
   * @iova: iova to translate
   * @perm: access type
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
   * Upon success, @tlbe is filled with translated_addr and entry
   * permission rights.
   */
 -static int smmu_ptw_64(SMMUTransCfg *cfg,
 -                       dma_addr_t iova, IOMMUAccessFlags perm,
 -                       SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 +static int smmu_ptw_64_s1(SMMUTransCfg *cfg,
 +                          dma_addr_t iova, IOMMUAccessFlags perm,
 +                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
  {
-     MachineClass *mc = MACHINE_GET_CLASS(ms);
+     dma_addr_t baseaddr, indexmask;
--    GQueue *list = g_queue_new();
+     int stage = cfg->stage;
--    guint pptt_start = table_data->len;
+@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
--    guint parent_offset;
+     }
--    guint length, i;
--    int uid = 0;
+     granule_sz = tt->granule_sz;
--    int socket;
+-    stride = granule_sz - 3;
-+    CPUArchIdList *cpus = ms->possible_cpus;
++    stride = VMSA_STRIDE(granule_sz);
-+    int64_t socket_id = -1, cluster_id = -1, core_id = -1;
+     inputsize = 64 - tt->tsz;
-+    uint32_t socket_offset = 0, cluster_offset = 0, core_offset = 0;
+     level = 4 - (inputsize - 4) / stride;
-+    uint32_t pptt_start = table_data->len;
+-    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
-+    int n;
++    indexmask = VMSA_IDXMSK(inputsize, stride, level);
-     AcpiTable table = { .sig = "PPTT", .rev = 2,
+     baseaddr = extract64(tt->ttb, 0, 48);
-                         .oem_id = oem_id, .oem_table_id = oem_table_id };
+     baseaddr &= ~indexmask;
-     acpi_table_begin(&table, table_data);
+-    while (level <= 3) {
++    while (level < VMSA_LEVELS) {
--    for (socket = 0; socket < ms->smp.sockets; socket++) {
+         uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
--        g_queue_push_tail(list,
+         uint64_t mask = subpage_size - 1;
--            GUINT_TO_POINTER(table_data->len - pptt_start));
+         uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
--        build_processor_hierarchy_node(
+@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
--            table_data,
+         if (get_pte(baseaddr, offset, &pte, info)) {
--            /*
+                 goto error;
--             * Physical package - represents the boundary
+         }
--             * of a physical package
+-        trace_smmu_ptw_level(level, iova, subpage_size,
--             */
++        trace_smmu_ptw_level(stage, level, iova, subpage_size,
--            (1 << 0),
+                              baseaddr, offset, pte);
--            0, socket, NULL, 0);
          if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
      info->type = SMMU_PTW_ERR_TRANSLATION;
  error:
 +    info->stage = 1;
      tlbe->entry.perm = IOMMU_NONE;
      return -EINVAL;
  }
@@ -XXX,XX +XXX,XX @@ error:
  int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
               SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
  {
 -    if (!cfg->aa64) {
 -        /*
 -         * This code path is not entered as we check this while decoding
 -         * the configuration data in the derived SMMU model.
 -         */
 -        g_assert_not_reached();
 -    }
 -
--    if (mc->smp_props.clusters_supported) {
+-    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
--        length = g_queue_get_length(list);
++    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
 -        for (i = 0; i < length; i++) {
 -            int cluster;
 -
 -            parent_offset = GPOINTER_TO_UINT(g_queue_pop_head(list));
 -            for (cluster = 0; cluster < ms->smp.clusters; cluster++) {
 -                g_queue_push_tail(list,
 -                    GUINT_TO_POINTER(table_data->len - pptt_start));
 -                build_processor_hierarchy_node(
 -                    table_data,
 -                    (0 << 0), /* not a physical package */
 -                    parent_offset, cluster, NULL, 0);
 -            }
 +    /*
 +     * This works with the assumption that cpus[n].props.*_id has been
 +     * sorted from top to down levels in mc->possible_cpu_arch_ids().
 +     * Otherwise, the unexpected and duplicated containers will be
 +     * created.
 +     */
 +    for (n = 0; n < cpus->len; n++) {
 +        if (cpus->cpus[n].props.socket_id != socket_id) {
 +            assert(cpus->cpus[n].props.socket_id > socket_id);
 +            socket_id = cpus->cpus[n].props.socket_id;
 +            cluster_id = -1;
 +            core_id = -1;
 +            socket_offset = table_data->len - pptt_start;
 +            build_processor_hierarchy_node(table_data,
 +                (1 << 0), /* Physical package */
 +                0, socket_id, NULL, 0);
          }
 -    }
 -    length = g_queue_get_length(list);
 -    for (i = 0; i < length; i++) {
 -        int core;
 -
 -        parent_offset = GPOINTER_TO_UINT(g_queue_pop_head(list));
 -        for (core = 0; core < ms->smp.cores; core++) {
 -            if (ms->smp.threads > 1) {
 -                g_queue_push_tail(list,
 -                    GUINT_TO_POINTER(table_data->len - pptt_start));
 -                build_processor_hierarchy_node(
 -                    table_data,
 -                    (0 << 0), /* not a physical package */
 -                    parent_offset, core, NULL, 0);
 -            } else {
 -                build_processor_hierarchy_node(
 -                    table_data,
 -                    (1 << 1) | /* ACPI Processor ID valid */
 -                    (1 << 3),  /* Node is a Leaf */
 -                    parent_offset, uid++, NULL, 0);
 +        if (mc->smp_props.clusters_supported) {
 +            if (cpus->cpus[n].props.cluster_id != cluster_id) {
 +                assert(cpus->cpus[n].props.cluster_id > cluster_id);
 +                cluster_id = cpus->cpus[n].props.cluster_id;
 +                core_id = -1;
 +                cluster_offset = table_data->len - pptt_start;
 +                build_processor_hierarchy_node(table_data,
 +                    (0 << 0), /* Not a physical package */
 +                    socket_offset, cluster_id, NULL, 0);
              }
 +        } else {
 +            cluster_offset = socket_offset;
          }
 -    }
 -    length = g_queue_get_length(list);
 -    for (i = 0; i < length; i++) {
 -        int thread;
 +        if (ms->smp.threads == 1) {
 +            build_processor_hierarchy_node(table_data,
 +                (1 << 1) | /* ACPI Processor ID valid */
 +                (1 << 3),  /* Node is a Leaf */
 +                cluster_offset, n, NULL, 0);
 +        } else {
 +            if (cpus->cpus[n].props.core_id != core_id) {
 +                assert(cpus->cpus[n].props.core_id > core_id);
 +                core_id = cpus->cpus[n].props.core_id;
 +                core_offset = table_data->len - pptt_start;
 +                build_processor_hierarchy_node(table_data,
 +                    (0 << 0), /* Not a physical package */
 +                    cluster_offset, core_id, NULL, 0);
 +            }
 -        parent_offset = GPOINTER_TO_UINT(g_queue_pop_head(list));
 -        for (thread = 0; thread < ms->smp.threads; thread++) {
 -            build_processor_hierarchy_node(
 -                table_data,
 +            build_processor_hierarchy_node(table_data,
                  (1 << 1) | /* ACPI Processor ID valid */
                  (1 << 2) | /* Processor is a Thread */
                  (1 << 3),  /* Node is a Leaf */
 -                parent_offset, uid++, NULL, 0);
 +                core_offset, n, NULL, 0);
          }
      }
 -    g_queue_free(list);
      acpi_table_end(linker, &table);
  }
+ /**
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/smmuv3.c
++++ b/hw/arm/smmuv3.c
+@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
+     cached_entry = g_new0(SMMUTLBEntry, 1);
+     if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) {
++        /* All faults from PTW has S2 field. */
++        event.u.f_walk_eabt.s2 = (ptw_info.stage == 2);
+         g_free(cached_entry);
+         switch (ptw_info.type) {
+         case SMMU_PTW_ERR_WALK_EABT:
+diff --git a/hw/arm/trace-events b/hw/arm/trace-events
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/arm/trace-events
++++ b/hw/arm/trace-events
+@@ -XXX,XX +XXX,XX @@ virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
+ # smmu-common.c
+ smmu_add_mr(const char *name) "%s"
+-smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
++smmu_ptw_level(int stage, int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
+ smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
+ smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
+ smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
 --
-.25.1
+.34.1

-[PULL 16/32] target/arm: Implement virtual SError exceptions
+[PULL 05/21] hw/arm/smmuv3: Add page table walk for stage-2
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-Virtual SError exceptions are raised by setting HCR_EL2.VSE,
+In preparation for adding stage-2 support, add Stage-2 PTW code.
-and are routed to EL1 just like other virtual exceptions.
+Only Aarch64 format is supported as stage-1.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Nesting stage-1 and stage-2 is not supported right now.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-16-richard.henderson@linaro.org
+HTTU is not supported, SW is expected to maintain the Access flag.
 This is described in the SMMUv3 manual(IHI 0070.E.a)
 "5.2. Stream Table Entry" in "[181] S2AFFD".
 This flag determines the behavior on access of a stage-2 page whose
 descriptor has AF == 0:
 - 0b0: An Access flag fault occurs (stall not supported).
 - 0b1: An Access flag fault never occurs.
 An Access fault takes priority over a Permission fault.
 There are 3 address size checks for stage-2 according to
 (IHI 0070.E.a) in "3.4. Address sizes".
 - As nesting is not supported, input address is passed directly to
 stage-2, and is checked against IAS.
 We use cfg->oas to hold the OAS when stage-1 is not used, this is set
 in the next patch.
 This check is done outside of smmu_ptw_64_s2 as it is not part of
 stage-2(it throws stage-1 fault), and the stage-2 function shouldn't
 change it's behavior when nesting is supported.
 When nesting is supported and we figure out how to combine TLB for
 stage-1 and stage-2 we can move this check into the stage-1 function
 as described in ARM DDI0487I.a in pseudocode
 aarch64/translation/vmsa_translation/AArch64.S1Translate
 aarch64/translation/vmsa_translation/AArch64.S1DisabledOutput
 - Input to stage-2 is checked against s2t0sz, and throws stage-2
 transaltion fault if exceeds it.
 - Output of stage-2 is checked against effective PA output range.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-5-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h       |  2 ++
+ hw/arm/smmu-internal.h |  35 ++++++++++
- target/arm/internals.h |  8 ++++++++
+ hw/arm/smmu-common.c   | 142 ++++++++++++++++++++++++++++++++++++++++-
- target/arm/syndrome.h  |  5 +++++
+files changed, 176 insertions(+), 1 deletion(-)
- target/arm/cpu.c       | 38 +++++++++++++++++++++++++++++++++++++-
- target/arm/helper.c    | 40 +++++++++++++++++++++++++++++++++++++++-
+diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
 files changed, 91 insertions(+), 2 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/smmu-internal.h
-+++ b/target/arm/cpu.h
++++ b/hw/arm/smmu-internal.h
 @@ -XXX,XX +XXX,XX @@
- #define EXCP_LSERR          21   /* v8M LSERR SecureFault */
+ #define PTE_APTABLE(pte) \
- #define EXCP_UNALIGNED      22   /* v7M UNALIGNED UsageFault */
+     (extract64(pte, 61, 2))
- #define EXCP_DIVBYZERO      23   /* v7M DIVBYZERO UsageFault */
-+#define EXCP_VSERR          24
++#define PTE_AF(pte) \
- /* NB: add new EXCP_ defines to the array in arm_log_exception() too */
++    (extract64(pte, 10, 1))
+ /*
- #define ARMV7M_EXCP_RESET   1
+  * TODO: At the moment all transactions are considered as privileged (EL1)
-@@ -XXX,XX +XXX,XX @@ enum {
+  * as IOMMU translation callback does not pass user/priv attributes.
- #define CPU_INTERRUPT_FIQ   CPU_INTERRUPT_TGT_EXT_1
+@@ -XXX,XX +XXX,XX @@
- #define CPU_INTERRUPT_VIRQ  CPU_INTERRUPT_TGT_EXT_2
+ #define is_permission_fault(ap, perm) \
- #define CPU_INTERRUPT_VFIQ  CPU_INTERRUPT_TGT_EXT_3
+     (((perm) & IOMMU_WO) && ((ap) & 0x2))
-+#define CPU_INTERRUPT_VSERR CPU_INTERRUPT_TGT_INT_0
++#define is_permission_fault_s2(s2ap, perm) \
- /* The usual mapping for an AArch64 system register to its AArch32
++    (!(((s2ap) & (perm)) == (perm)))
-  * counterpart is for the 32 bit world to have access to the lower
++
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+ #define PTE_AP_TO_PERM(ap) \
      (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
@@ -XXX,XX +XXX,XX @@ uint64_t iova_level_offset(uint64_t iova, int inputsize,
              MAKE_64BIT_MASK(0, gsz - 3);
  }
 +/* FEAT_LPA2 and FEAT_TTST are not implemented. */
 +static inline int get_start_level(int sl0 , int granule_sz)
 +{
 +    /* ARM DDI0487I.a: Table D8-12. */
 +    if (granule_sz == 12) {
 +        return 2 - sl0;
 +    }
 +    /* ARM DDI0487I.a: Table D8-22 and Table D8-31. */
 +    return 3 - sl0;
 +}
 +
 +/*
 + * Index in a concatenated first level stage-2 page table.
 + * ARM DDI0487I.a: D8.2.2 Concatenated translation tables.
 + */
 +static inline int pgd_concat_idx(int start_level, int granule_sz,
 +                                 dma_addr_t ipa)
 +{
 +    uint64_t ret;
 +    /*
 +     * Get the number of bits handled by next levels, then any extra bits in
 +     * the address should index the concatenated tables. This relation can be
 +     * deduced from tables in ARM DDI0487I.a: D8.2.7-9
 +     */
 +    int shift =  level_shift(start_level - 1, granule_sz);
 +
 +    ret = ipa >> shift;
 +    return ret;
 +}
 +
  #define SMMU_IOTLB_ASID(key) ((key).asid)
  typedef struct SMMUIOTLBPageInvInfo {
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/hw/arm/smmu-common.c
-+++ b/target/arm/internals.h
++++ b/hw/arm/smmu-common.c
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_update_virq(ARMCPU *cpu);
+@@ -XXX,XX +XXX,XX @@ error:
-  */
+     return -EINVAL;
- void arm_cpu_update_vfiq(ARMCPU *cpu);
+ }
 +/**
-+ * arm_cpu_update_vserr: Update CPU_INTERRUPT_VSERR bit
++ * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa
 + * for stage-2.
 + * @cfg: translation config
 + * @ipa: ipa to translate
 + * @perm: access type
 + * @tlbe: SMMUTLBEntry (out)
 + * @info: handle to an error info
 + *
-+ * Update the CPU_INTERRUPT_VSERR bit in cs->interrupt_request,
++ * Return 0 on success, < 0 on error. In case of error, @info is filled
-+ * following a change to the HCR_EL2.VSE bit.
++ * and tlbe->perm is set to IOMMU_NONE.
 + * Upon success, @tlbe is filled with translated_addr and entry
 + * permission rights.
 + */
-+void arm_cpu_update_vserr(ARMCPU *cpu);
++static int smmu_ptw_64_s2(SMMUTransCfg *cfg,
 +                          dma_addr_t ipa, IOMMUAccessFlags perm,
 +                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 +{
 +    const int stage = 2;
 +    int granule_sz = cfg->s2cfg.granule_sz;
 +    /* ARM DDI0487I.a: Table D8-7. */
 +    int inputsize = 64 - cfg->s2cfg.tsz;
 +    int level = get_start_level(cfg->s2cfg.sl0, granule_sz);
 +    int stride = VMSA_STRIDE(granule_sz);
 +    int idx = pgd_concat_idx(level, granule_sz, ipa);
 +    /*
 +     * Get the ttb from concatenated structure.
 +     * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte))
 +     */
 +    uint64_t baseaddr = extract64(cfg->s2cfg.vttb, 0, 48) + (1 << stride) *
 +                                  idx * sizeof(uint64_t);
 +    dma_addr_t indexmask = VMSA_IDXMSK(inputsize, stride, level);
 +
 +    baseaddr &= ~indexmask;
 +
 +    /*
 +     * On input, a stage 2 Translation fault occurs if the IPA is outside the
 +     * range configured by the relevant S2T0SZ field of the STE.
 +     */
 +    if (ipa >= (1ULL << inputsize)) {
 +        info->type = SMMU_PTW_ERR_TRANSLATION;
 +        goto error;
 +    }
 +
 +    while (level < VMSA_LEVELS) {
 +        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
 +        uint64_t mask = subpage_size - 1;
 +        uint32_t offset = iova_level_offset(ipa, inputsize, level, granule_sz);
 +        uint64_t pte, gpa;
 +        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
 +        uint8_t s2ap;
 +
 +        if (get_pte(baseaddr, offset, &pte, info)) {
 +                goto error;
 +        }
 +        trace_smmu_ptw_level(stage, level, ipa, subpage_size,
 +                             baseaddr, offset, pte);
 +        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
 +            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
 +                                       pte_addr, offset, pte);
 +            break;
 +        }
 +
 +        if (is_table_pte(pte, level)) {
 +            baseaddr = get_table_pte_address(pte, granule_sz);
 +            level++;
 +            continue;
 +        } else if (is_page_pte(pte, level)) {
 +            gpa = get_page_pte_address(pte, granule_sz);
 +            trace_smmu_ptw_page_pte(stage, level, ipa,
 +                                    baseaddr, pte_addr, pte, gpa);
 +        } else {
 +            uint64_t block_size;
 +
 +            gpa = get_block_pte_address(pte, level, granule_sz,
 +                                        &block_size);
 +            trace_smmu_ptw_block_pte(stage, level, baseaddr,
 +                                     pte_addr, pte, ipa, gpa,
 +                                     block_size >> 20);
 +        }
 +
 +        /*
 +         * If S2AFFD and PTE.AF are 0 => fault. (5.2. Stream Table Entry)
 +         * An Access fault takes priority over a Permission fault.
 +         */
 +        if (!PTE_AF(pte) && !cfg->s2cfg.affd) {
 +            info->type = SMMU_PTW_ERR_ACCESS;
 +            goto error;
 +        }
 +
 +        s2ap = PTE_AP(pte);
 +        if (is_permission_fault_s2(s2ap, perm)) {
 +            info->type = SMMU_PTW_ERR_PERMISSION;
 +            goto error;
 +        }
 +
 +        /*
 +         * The address output from the translation causes a stage 2 Address
 +         * Size fault if it exceeds the effective PA output range.
 +         */
 +        if (gpa >= (1ULL << cfg->s2cfg.eff_ps)) {
 +            info->type = SMMU_PTW_ERR_ADDR_SIZE;
 +            goto error;
 +        }
 +
 +        tlbe->entry.translated_addr = gpa;
 +        tlbe->entry.iova = ipa & ~mask;
 +        tlbe->entry.addr_mask = mask;
 +        tlbe->entry.perm = s2ap;
 +        tlbe->level = level;
 +        tlbe->granule = granule_sz;
 +        return 0;
 +    }
 +    info->type = SMMU_PTW_ERR_TRANSLATION;
 +
 +error:
 +    info->stage = 2;
 +    tlbe->entry.perm = IOMMU_NONE;
 +    return -EINVAL;
 +}
 +
  /**
-  * arm_mmu_idx_el:
+  * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
-  * @env: The cpu environment
+  *
-diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
+@@ -XXX,XX +XXX,XX @@ error:
-index XXXXXXX..XXXXXXX 100644
+ int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
---- a/target/arm/syndrome.h
+              SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
-+++ b/target/arm/syndrome.h
+ {
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_pcalignment(void)
+-    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
-     return (EC_PCALIGNMENT << ARM_EL_EC_SHIFT) | ARM_EL_IL;
++    if (cfg->stage == 1) {
 +        return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
 +    } else if (cfg->stage == 2) {
 +        /*
 +         * If bypassing stage 1(or unimplemented), the input address is passed
 +         * directly to stage 2 as IPA. If the input address of a transaction
 +         * exceeds the size of the IAS, a stage 1 Address Size fault occurs.
 +         * For AA64, IAS = OAS according to (IHI 0070.E.a) "3.4 Address sizes"
 +         */
 +        if (iova >= (1ULL << cfg->oas)) {
 +            info->type = SMMU_PTW_ERR_ADDR_SIZE;
 +            info->stage = 1;
 +            tlbe->entry.perm = IOMMU_NONE;
 +            return -EINVAL;
 +        }
 +
 +        return smmu_ptw_64_s2(cfg, iova, perm, tlbe, info);
 +    }
 +
 +    g_assert_not_reached();
  }
-+static inline uint32_t syn_serror(uint32_t extra)
+ /**
 +{
 +    return (EC_SERROR << ARM_EL_EC_SHIFT) | ARM_EL_IL | extra;
 +}
 +
  #endif /* TARGET_ARM_SYNDROME_H */
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_has_work(CPUState *cs)
      return (cpu->power_state != PSCI_OFF)
          && cs->interrupt_request &
          (CPU_INTERRUPT_FIQ | CPU_INTERRUPT_HARD
 -         | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ
 +         | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ | CPU_INTERRUPT_VSERR
           | CPU_INTERRUPT_EXITTB);
  }
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
              return false;
          }
          return !(env->daif & PSTATE_I);
 +    case EXCP_VSERR:
 +        if (!(hcr_el2 & HCR_AMO) || (hcr_el2 & HCR_TGE)) {
 +            /* VIRQs are only taken when hypervized.  */
 +            return false;
 +        }
 +        return !(env->daif & PSTATE_A);
      default:
          g_assert_not_reached();
      }
@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
              goto found;
          }
      }
 +    if (interrupt_request & CPU_INTERRUPT_VSERR) {
 +        excp_idx = EXCP_VSERR;
 +        target_el = 1;
 +        if (arm_excp_unmasked(cs, excp_idx, target_el,
 +                              cur_el, secure, hcr_el2)) {
 +            /* Taking a virtual abort clears HCR_EL2.VSE */
 +            env->cp15.hcr_el2 &= ~HCR_VSE;
 +            cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
 +            goto found;
 +        }
 +    }
      return false;
   found:
@@ -XXX,XX +XXX,XX @@ void arm_cpu_update_vfiq(ARMCPU *cpu)
      }
  }
 +void arm_cpu_update_vserr(ARMCPU *cpu)
 +{
 +    /*
 +     * Update the interrupt level for VSERR, which is the HCR_EL2.VSE bit.
 +     */
 +    CPUARMState *env = &cpu->env;
 +    CPUState *cs = CPU(cpu);
 +
 +    bool new_state = env->cp15.hcr_el2 & HCR_VSE;
 +
 +    if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VSERR) != 0)) {
 +        if (new_state) {
 +            cpu_interrupt(cs, CPU_INTERRUPT_VSERR);
 +        } else {
 +            cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
 +        }
 +    }
 +}
 +
  #ifndef CONFIG_USER_ONLY
  static void arm_cpu_set_irq(void *opaque, int irq, int level)
  {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
          }
      }
 -    /* External aborts are not possible in QEMU so A bit is always clear */
 +    if (hcr_el2 & HCR_AMO) {
 +        if (cs->interrupt_request & CPU_INTERRUPT_VSERR) {
 +            ret |= CPSR_A;
 +        }
 +    }
 +
      return ret;
  }
@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
      g_assert(qemu_mutex_iothread_locked());
      arm_cpu_update_virq(cpu);
      arm_cpu_update_vfiq(cpu);
 +    arm_cpu_update_vserr(cpu);
  }
  static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void arm_log_exception(CPUState *cs)
              [EXCP_LSERR] = "v8M LSERR UsageFault",
              [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault",
              [EXCP_DIVBYZERO] = "v7M DIVBYZERO UsageFault",
 +            [EXCP_VSERR] = "Virtual SERR",
          };
          if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch32(CPUState *cs)
          mask = CPSR_A | CPSR_I | CPSR_F;
          offset = 4;
          break;
 +    case EXCP_VSERR:
 +        {
 +            /*
 +             * Note that this is reported as a data abort, but the DFAR
 +             * has an UNKNOWN value.  Construct the SError syndrome from
 +             * AET and ExT fields.
 +             */
 +            ARMMMUFaultInfo fi = { .type = ARMFault_AsyncExternal, };
 +
 +            if (extended_addresses_enabled(env)) {
 +                env->exception.fsr = arm_fi_to_lfsc(&fi);
 +            } else {
 +                env->exception.fsr = arm_fi_to_sfsc(&fi);
 +            }
 +            env->exception.fsr |= env->cp15.vsesr_el2 & 0xd000;
 +            A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr);
 +            qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x\n",
 +                          env->exception.fsr);
 +
 +            new_mode = ARM_CPU_MODE_ABT;
 +            addr = 0x10;
 +            mask = CPSR_A | CPSR_I;
 +            offset = 8;
 +        }
 +        break;
      case EXCP_SMC:
          new_mode = ARM_CPU_MODE_MON;
          addr = 0x08;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
      case EXCP_VFIQ:
          addr += 0x100;
          break;
 +    case EXCP_VSERR:
 +        addr += 0x180;
 +        /* Construct the SError syndrome from IDS and ISS fields. */
 +        env->exception.syndrome = syn_serror(env->cp15.vsesr_el2 & 0x1ffffff);
 +        env->cp15.esr_el[new_el] = env->exception.syndrome;
 +        break;
      default:
          cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
      }
 --
-.25.1
+.34.1

-[PULL 14/32] target/arm: Add minimal RAS registers
+[PULL 06/21] hw/arm/smmuv3: Parse STE config for stage-2
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-Add only the system registers required to implement zero error
+Parse stage-2 configuration from STE and populate it in SMMUS2Cfg.
-records.  This means that all values for ERRSELR are out of range,
+Validity of field values are checked when possible.
-which means that it and all of the indexed error record registers
-need not be implemented.
+Only AA64 tables are supported and Small Translation Tables (STT) are
+not supported.
-Add the EL2 registers required for injecting virtual SError.
+According to SMMUv3 UM(IHI0070E) "5.2 Stream Table Entry": All fields
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+with an S2 prefix (with the exception of S2VMID) are IGNORED when
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+stage-2 bypasses translation (Config[1] == 0).
-Message-id: 20220506180242.216785-14-richard.henderson@linaro.org
 Which means that VMID can be used(for TLB tagging) even if stage-2 is
 bypassed, so we parse it unconditionally when S2P exists. Otherwise
 it is set to -1.(only S1P)
 As stall is not supported, if S2S is set the translation would abort.
 For S2R, we reuse the same code used for stage-1 with flag
 record_faults. However when nested translation is supported we would
 need to separate stage-1 and stage-2 faults.
 Fix wrong shift in STE_S2HD, STE_S2HA, STE_S2S.
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 20230516203327.2051088-6-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h    |  5 +++
+ hw/arm/smmuv3-internal.h     |  10 +-
- target/arm/helper.c | 84 +++++++++++++++++++++++++++++++++++++++++++++
+ include/hw/arm/smmu-common.h |   1 +
-files changed, 89 insertions(+)
+ include/hw/arm/smmuv3.h      |   3 +
+ hw/arm/smmuv3.c              | 181 +++++++++++++++++++++++++++++++++--
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+files changed, 185 insertions(+), 10 deletions(-)
 diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/smmuv3-internal.h
-+++ b/target/arm/cpu.h
++++ b/hw/arm/smmuv3-internal.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+@@ -XXX,XX +XXX,XX @@ typedef struct CD {
-         uint64_t tfsr_el[4]; /* tfsre0_el1 is index 0.  */
+ #define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
-         uint64_t gcr_el1;
+ #define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
-         uint64_t rgsr_el1;
+ #define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
-+
+-#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
-+        /* Minimal RAS registers */
+-#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
-+        uint64_t disr_el1;
+-#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
-+        uint64_t vdisr_el2;
++#define STE_S2ENDI(x)      extract32((x)->word[5], 20, 1)
-+        uint64_t vsesr_el2;
++#define STE_S2AFFD(x)      extract32((x)->word[5], 21, 1)
-     } cp15;
++#define STE_S2HD(x)        extract32((x)->word[5], 23, 1)
++#define STE_S2HA(x)        extract32((x)->word[5], 24, 1)
-     struct {
++#define STE_S2S(x)         extract32((x)->word[5], 25, 1)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
++#define STE_S2R(x)         extract32((x)->word[5], 26, 1)
 +
  #define STE_CTXPTR(x)                                           \
      ({                                                          \
          unsigned long addr;                                     \
 diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/include/hw/arm/smmu-common.h
-+++ b/target/arm/helper.c
++++ b/include/hw/arm/smmu-common.h
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@
-       .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
- };
+ /* VMSAv8-64 Translation constants and functions */
  #define VMSA_LEVELS                         4
 +#define VMSA_MAX_S2_CONCAT                  16
  #define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
  #define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
 diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/smmuv3.h
 +++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@ struct SMMUv3Class {
  #define TYPE_ARM_SMMUV3   "arm-smmuv3"
  OBJECT_DECLARE_TYPE(SMMUv3State, SMMUv3Class, ARM_SMMUV3)
 +#define STAGE1_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S1P)
 +#define STAGE2_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S2P)
 +
  #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
  #include "smmuv3-internal.h"
  #include "smmu-internal.h"
 +#define PTW_RECORD_FAULT(cfg)   (((cfg)->stage == 1) ? (cfg)->record_faults : \
 +                                 (cfg)->s2cfg.record_faults)
 +
  /**
   * smmuv3_trigger_irq - pulse @irq if enabled and update
   * GERROR register in case of GERROR interrupt
@@ -XXX,XX +XXX,XX @@ static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
      return 0;
  }
 +/*
-+ * Check for traps to RAS registers, which are controlled
++ * Max valid value is 39 when SMMU_IDR3.STT == 0.
-+ * by HCR_EL2.TERR and SCR_EL3.TERR.
++ * In architectures after SMMUv3.0:
 + * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this
 + *   field is MAX(16, 64-IAS)
 + * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field
 + *   is (64-IAS).
 + * As we only support AA64, IAS = OAS.
 + */
-+static CPAccessResult access_terr(CPUARMState *env, const ARMCPRegInfo *ri,
++static bool s2t0sz_valid(SMMUTransCfg *cfg)
 +                                  bool isread)
 +{
-+    int el = arm_current_el(env);
++    if (cfg->s2cfg.tsz > 39) {
-+
++        return false;
-+    if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TERR)) {
++    }
-+        return CP_ACCESS_TRAP_EL2;
++
-+    }
++    if (cfg->s2cfg.granule_sz == 16) {
-+    if (el < 3 && (env->cp15.scr_el3 & SCR_TERR)) {
++        return (cfg->s2cfg.tsz >= 64 - oas2bits(SMMU_IDR5_OAS));
-+        return CP_ACCESS_TRAP_EL3;
++    }
-+    }
++
-+    return CP_ACCESS_OK;
++    return (cfg->s2cfg.tsz >= MAX(64 - oas2bits(SMMU_IDR5_OAS), 16));
 +}
 +
-+static uint64_t disr_read(CPUARMState *env, const ARMCPRegInfo *ri)
++/*
 + * Return true if s2 page table config is valid.
 + * This checks with the configured start level, ias_bits and granularity we can
 + * have a valid page table as described in ARM ARM D8.2 Translation process.
 + * The idea here is to see for the highest possible number of IPA bits, how
 + * many concatenated tables we would need, if it is more than 16, then this is
 + * not possible.
 + */
 +static bool s2_pgtable_config_valid(uint8_t sl0, uint8_t t0sz, uint8_t gran)
 +{
-+    int el = arm_current_el(env);
++    int level = get_start_level(sl0, gran);
-+
++    uint64_t ipa_bits = 64 - t0sz;
-+    if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) {
++    uint64_t max_ipa = (1ULL << ipa_bits) - 1;
-+        return env->cp15.vdisr_el2;
++    int nr_concat = pgd_concat_idx(level, gran, max_ipa) + 1;
-+    }
++
-+    if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) {
++    return nr_concat <= VMSA_MAX_S2_CONCAT;
 +        return 0; /* RAZ/WI */
 +    }
 +    return env->cp15.disr_el1;
 +}
 +
-+static void disr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
++static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
 +{
-+    int el = arm_current_el(env);
++    cfg->stage = 2;
 +
-+    if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) {
++    if (STE_S2AA64(ste) == 0x0) {
-+        env->cp15.vdisr_el2 = val;
++        qemu_log_mask(LOG_UNIMP,
-+        return;
++                      "SMMUv3 AArch32 tables not supported\n");
-+    }
++        g_assert_not_reached();
-+    if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) {
++    }
-+        return; /* RAZ/WI */
++
-+    }
++    switch (STE_S2TG(ste)) {
-+    env->cp15.disr_el1 = val;
++    case 0x0: /* 4KB */
 +        cfg->s2cfg.granule_sz = 12;
 +        break;
 +    case 0x1: /* 64KB */
 +        cfg->s2cfg.granule_sz = 16;
 +        break;
 +    case 0x2: /* 16KB */
 +        cfg->s2cfg.granule_sz = 14;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste));
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.vttb = STE_S2TTB(ste);
 +
 +    cfg->s2cfg.sl0 = STE_S2SL0(ste);
 +    /* FEAT_TTST not supported. */
 +    if (cfg->s2cfg.sl0 == 0x3) {
 +        qemu_log_mask(LOG_UNIMP, "SMMUv3 S2SL0 = 0x3 has no meaning!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* For AA64, The effective S2PS size is capped to the OAS. */
 +    cfg->s2cfg.eff_ps = oas2bits(MIN(STE_S2PS(ste), SMMU_IDR5_OAS));
 +    /*
 +     * It is ILLEGAL for the address in S2TTB to be outside the range
 +     * described by the effective S2PS value.
 +     */
 +    if (cfg->s2cfg.vttb & ~(MAKE_64BIT_MASK(0, cfg->s2cfg.eff_ps))) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 S2TTB too large 0x%lx, effective PS %d bits\n",
 +                      cfg->s2cfg.vttb,  cfg->s2cfg.eff_ps);
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.tsz = STE_S2T0SZ(ste);
 +
 +    if (!s2t0sz_valid(cfg)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 bad STE S2T0SZ = %d\n",
 +                      cfg->s2cfg.tsz);
 +        goto bad_ste;
 +    }
 +
 +    if (!s2_pgtable_config_valid(cfg->s2cfg.sl0, cfg->s2cfg.tsz,
 +                                    cfg->s2cfg.granule_sz)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 STE stage 2 config not valid!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* Only LE supported(IDR0.TTENDIAN). */
 +    if (STE_S2ENDI(ste)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 STE_S2ENDI only supports LE!\n");
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.affd = STE_S2AFFD(ste);
 +
 +    cfg->s2cfg.record_faults = STE_S2R(ste);
 +    /* As stall is not supported. */
 +    if (STE_S2S(ste)) {
 +        qemu_log_mask(LOG_UNIMP, "SMMUv3 Stall not implemented!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* This is still here as stage 2 has not been fully enabled yet. */
 +    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
 +    goto bad_ste;
 +
 +    return 0;
 +
 +bad_ste:
 +    return -EINVAL;
 +}
 +
-+/*
+ /* Returns < 0 in case of invalid STE, 0 otherwise */
-+ * Minimal RAS implementation with no Error Records.
+ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
-+ * Which means that all of the Error Record registers:
+                       STE *ste, SMMUEventInfo *event)
-+ *   ERXADDR_EL1
+ {
-+ *   ERXCTLR_EL1
+     uint32_t config;
-+ *   ERXFR_EL1
++    int ret;
-+ *   ERXMISC0_EL1
-+ *   ERXMISC1_EL1
+     if (!STE_VALID(ste)) {
-+ *   ERXMISC2_EL1
+         if (!event->inval_ste_allowed) {
-+ *   ERXMISC3_EL1
+@@ -XXX,XX +XXX,XX @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
-+ *   ERXPFGCDN_EL1  (RASv1p1)
+         return 0;
 + *   ERXPFGCTL_EL1  (RASv1p1)
 + *   ERXPFGF_EL1    (RASv1p1)
 + *   ERXSTATUS_EL1
 + * and
 + *   ERRSELR_EL1
 + * may generate UNDEFINED, which is the effect we get by not
 + * listing them at all.
 + */
 +static const ARMCPRegInfo minimal_ras_reginfo[] = {
 +    { .name = "DISR_EL1", .state = ARM_CP_STATE_BOTH,
 +      .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 1,
 +      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.disr_el1),
 +      .readfn = disr_read, .writefn = disr_write, .raw_writefn = raw_write },
 +    { .name = "ERRIDR_EL1", .state = ARM_CP_STATE_BOTH,
 +      .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 3, .opc2 = 0,
 +      .access = PL1_R, .accessfn = access_terr,
 +      .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "VDISR_EL2", .state = ARM_CP_STATE_BOTH,
 +      .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 1, .opc2 = 1,
 +      .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vdisr_el2) },
 +    { .name = "VSESR_EL2", .state = ARM_CP_STATE_BOTH,
 +      .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 3,
 +      .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vsesr_el2) },
 +};
 +
  /* Return the exception level to which exceptions should be taken
   * via SVEAccessTrap.  If an exception should be routed through
   * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      if (cpu_isar_feature(aa64_ssbs, cpu)) {
          define_one_arm_cp_reg(cpu, &ssbs_reginfo);
      }
-+    if (cpu_isar_feature(any_ras, cpu)) {
-+        define_arm_cp_regs(cpu, minimal_ras_reginfo);
+-    if (STE_CFG_S2_ENABLED(config)) {
-+    }
+-        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
++    /*
-     if (cpu_isar_feature(aa64_vh, cpu) ||
++     * If a stage is enabled in SW while not advertised, throw bad ste
-         cpu_isar_feature(aa64_debugv8p2, cpu)) {
++     * according to user manual(IHI0070E) "5.2 Stream Table Entry".
 +     */
 +    if (!STAGE1_SUPPORTED(s) && STE_CFG_S1_ENABLED(config)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S1 used but not supported.\n");
          goto bad_ste;
      }
 +    if (!STAGE2_SUPPORTED(s) && STE_CFG_S2_ENABLED(config)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S2 used but not supported.\n");
 +        goto bad_ste;
 +    }
 +
 +    if (STAGE2_SUPPORTED(s)) {
 +        /* VMID is considered even if s2 is disabled. */
 +        cfg->s2cfg.vmid = STE_S2VMID(ste);
 +    } else {
 +        /* Default to -1 */
 +        cfg->s2cfg.vmid = -1;
 +    }
 +
 +    if (STE_CFG_S2_ENABLED(config)) {
 +        /*
 +         * Stage-1 OAS defaults to OAS even if not enabled as it would be used
 +         * in input address check for stage-2.
 +         */
 +        cfg->oas = oas2bits(SMMU_IDR5_OAS);
 +        ret = decode_ste_s2_cfg(cfg, ste);
 +        if (ret) {
 +            goto bad_ste;
 +        }
 +    }
      if (STE_S1CDMAX(ste) != 0) {
          qemu_log_mask(LOG_UNIMP,
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
      if (cached_entry) {
          if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
              status = SMMU_TRANS_ERROR;
 -            if (cfg->record_faults) {
 +            /*
 +             * We know that the TLB only contains either stage-1 or stage-2 as
 +             * nesting is not supported. So it is sufficient to check the
 +             * translation stage to know the TLB stage for now.
 +             */
 +            event.u.f_walk_eabt.s2 = (cfg->stage == 2);
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_PERMISSION;
                  event.u.f_permission.addr = addr;
                  event.u.f_permission.rnw = flag & 0x1;
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
              event.u.f_walk_eabt.addr2 = ptw_info.addr;
              break;
          case SMMU_PTW_ERR_TRANSLATION:
 -            if (cfg->record_faults) {
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_TRANSLATION;
                  event.u.f_translation.addr = addr;
                  event.u.f_translation.rnw = flag & 0x1;
              }
              break;
          case SMMU_PTW_ERR_ADDR_SIZE:
 -            if (cfg->record_faults) {
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_ADDR_SIZE;
                  event.u.f_addr_size.addr = addr;
                  event.u.f_addr_size.rnw = flag & 0x1;
              }
              break;
          case SMMU_PTW_ERR_ACCESS:
 -            if (cfg->record_faults) {
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_ACCESS;
                  event.u.f_access.addr = addr;
                  event.u.f_access.rnw = flag & 0x1;
              }
              break;
          case SMMU_PTW_ERR_PERMISSION:
 -            if (cfg->record_faults) {
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_PERMISSION;
                  event.u.f_permission.addr = addr;
                  event.u.f_permission.rnw = flag & 0x1;
 --
-.25.1
+.34.1

-[PULL 05/32] target/arm: Adjust definition of CONTEXTIDR_EL2
+[PULL 07/21] hw/arm/smmuv3: Make TLB lookup work for stage-2
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-This register is present for either VHE or Debugv8p2.
+Right now, either stage-1 or stage-2 are supported, this simplifies
 how we can deal with TLBs.
 This patch makes TLB lookup work if stage-2 is enabled instead of
 stage-1.
 TLB lookup is done before a PTW, if a valid entry is found we won't
 do the PTW.
 To be able to do TLB lookup, we need the correct tagging info, as
 granularity and input size, so we get this based on the supported
 translation stage. The TLB entries are added correctly from each
 stage PTW.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+When nested translation is supported, this would need to change, for
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+example if we go with a combined TLB implementation, we would need to
-Message-id: 20220506180242.216785-5-richard.henderson@linaro.org
+use the min of the granularities in TLB.
 As stage-2 shouldn't be tagged by ASID, it will be set to -1 if S1P
 is not enabled.
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-7-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 15 +++++++++++----
+ hw/arm/smmuv3.c | 44 +++++++++++++++++++++++++++++++++-----------
-file changed, 11 insertions(+), 4 deletions(-)
+file changed, 33 insertions(+), 11 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/arm/smmuv3.c
-+++ b/target/arm/helper.c
++++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo jazelle_regs[] = {
+@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
-       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+     STE ste;
- };
+     CD cd;
-+static const ARMCPRegInfo contextidr_el2 = {
++    /* ASID defaults to -1 (if s1 is not supported). */
-+    .name = "CONTEXTIDR_EL2", .state = ARM_CP_STATE_AA64,
++    cfg->asid = -1;
 +    .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 1,
 +    .access = PL2_RW,
 +    .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[2])
 +};
 +
- static const ARMCPRegInfo vhe_reginfo[] = {
+     ret = smmu_find_ste(s, sid, &ste, event);
--    { .name = "CONTEXTIDR_EL2", .state = ARM_CP_STATE_AA64,
+     if (ret) {
--      .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 1,
+         return ret;
--      .access = PL2_RW,
+@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
--      .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[2]) },
+         .addr_mask = ~(hwaddr)0,
-     { .name = "TTBR1_EL2", .state = ARM_CP_STATE_AA64,
+         .perm = IOMMU_NONE,
-       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 1,
+     };
-       .access = PL2_RW, .writefn = vmsa_tcr_ttbr_el2_write,
++    /*
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
++     * Combined attributes used for TLB lookup, as only one stage is supported,
-         define_one_arm_cp_reg(cpu, &ssbs_reginfo);
++     * it will hold attributes based on the enabled stage.
 +     */
 +    SMMUTransTableInfo tt_combined;
      qemu_mutex_lock(&s->mutex);
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
          goto epilogue;
      }
-+    if (cpu_isar_feature(aa64_vh, cpu) ||
+-    tt = select_tt(cfg, addr);
-+        cpu_isar_feature(aa64_debugv8p2, cpu)) {
+-    if (!tt) {
-+        define_one_arm_cp_reg(cpu, &contextidr_el2);
+-        if (cfg->record_faults) {
 -            event.type = SMMU_EVT_F_TRANSLATION;
 -            event.u.f_translation.addr = addr;
 -            event.u.f_translation.rnw = flag & 0x1;
 +    if (cfg->stage == 1) {
 +        /* Select stage1 translation table. */
 +        tt = select_tt(cfg, addr);
 +        if (!tt) {
 +            if (cfg->record_faults) {
 +                event.type = SMMU_EVT_F_TRANSLATION;
 +                event.u.f_translation.addr = addr;
 +                event.u.f_translation.rnw = flag & 0x1;
 +            }
 +            status = SMMU_TRANS_ERROR;
 +            goto epilogue;
          }
 -        status = SMMU_TRANS_ERROR;
 -        goto epilogue;
 -    }
 +        tt_combined.granule_sz = tt->granule_sz;
 +        tt_combined.tsz = tt->tsz;
 -    page_mask = (1ULL << (tt->granule_sz)) - 1;
 +    } else {
 +        /* Stage2. */
 +        tt_combined.granule_sz = cfg->s2cfg.granule_sz;
 +        tt_combined.tsz = cfg->s2cfg.tsz;
 +    }
-     if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) {
++    /*
-         define_arm_cp_regs(cpu, vhe_reginfo);
++     * TLB lookup looks for granule and input size for a translation stage,
-     }
++     * as only one stage is supported right now, choose the right values
 +     * from the configuration.
 +     */
 +    page_mask = (1ULL << tt_combined.granule_sz) - 1;
      aligned_addr = addr & ~page_mask;
 -    cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr);
 +    cached_entry = smmu_iotlb_lookup(bs, cfg, &tt_combined, aligned_addr);
      if (cached_entry) {
          if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
              status = SMMU_TRANS_ERROR;
 --
-.25.1
+.34.1

-[PULL 25/32] target/arm: Define neoverse-n1
+[PULL 08/21] hw/arm/smmuv3: Add VMID to TLB tagging
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-Enable the n1 for virt and sbsa board use.
+Allow TLB to be tagged with VMID.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+If stage-1 is only supported, VMID is set to -1 and ignored from STE
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+and CMD_TLBI_NH* cmds.
-Message-id: 20220506180242.216785-25-richard.henderson@linaro.org
 Update smmu_iotlb_insert trace event to have vmid.
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-8-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/virt.rst |  1 +
+ hw/arm/smmu-internal.h       |  2 ++
- hw/arm/sbsa-ref.c        |  1 +
+ include/hw/arm/smmu-common.h |  5 +++--
- hw/arm/virt.c            |  1 +
+ hw/arm/smmu-common.c         | 36 ++++++++++++++++++++++--------------
- target/arm/cpu64.c       | 66 ++++++++++++++++++++++++++++++++++++++++
+ hw/arm/smmuv3.c              | 12 +++++++++---
-files changed, 69 insertions(+)
+ hw/arm/trace-events          |  6 +++---
+files changed, 39 insertions(+), 22 deletions(-)
-diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
-index XXXXXXX..XXXXXXX 100644
+diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
---- a/docs/system/arm/virt.rst
+index XXXXXXX..XXXXXXX 100644
-+++ b/docs/system/arm/virt.rst
+--- a/hw/arm/smmu-internal.h
-@@ -XXX,XX +XXX,XX @@ Supported guest CPU types:
++++ b/hw/arm/smmu-internal.h
- - ``cortex-a76`` (64-bit)
+@@ -XXX,XX +XXX,XX @@ static inline int pgd_concat_idx(int start_level, int granule_sz,
- - ``a64fx`` (64-bit)
+ }
- - ``host`` (with KVM only)
-+- ``neoverse-n1`` (64-bit)
+ #define SMMU_IOTLB_ASID(key) ((key).asid)
- - ``max`` (same as ``host`` for KVM; best possible emulation with TCG)
++#define SMMU_IOTLB_VMID(key) ((key).vmid)
- Note that the default is ``cortex-a15``, so for an AArch64 guest you must
+ typedef struct SMMUIOTLBPageInvInfo {
-diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
+     int asid;
-index XXXXXXX..XXXXXXX 100644
++    int vmid;
---- a/hw/arm/sbsa-ref.c
+     uint64_t iova;
-+++ b/hw/arm/sbsa-ref.c
+     uint64_t mask;
-@@ -XXX,XX +XXX,XX @@ static const char * const valid_cpus[] = {
+ } SMMUIOTLBPageInvInfo;
-     ARM_CPU_TYPE_NAME("cortex-a57"),
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
-     ARM_CPU_TYPE_NAME("cortex-a72"),
+index XXXXXXX..XXXXXXX 100644
-     ARM_CPU_TYPE_NAME("cortex-a76"),
+--- a/include/hw/arm/smmu-common.h
-+    ARM_CPU_TYPE_NAME("neoverse-n1"),
++++ b/include/hw/arm/smmu-common.h
-     ARM_CPU_TYPE_NAME("max"),
+@@ -XXX,XX +XXX,XX @@ typedef struct SMMUPciBus {
- };
+ typedef struct SMMUIOTLBKey {
+     uint64_t iova;
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+     uint16_t asid;
-index XXXXXXX..XXXXXXX 100644
++    uint16_t vmid;
---- a/hw/arm/virt.c
+     uint8_t tg;
-+++ b/hw/arm/virt.c
+     uint8_t level;
-@@ -XXX,XX +XXX,XX @@ static const char *valid_cpus[] = {
+ } SMMUIOTLBKey;
-     ARM_CPU_TYPE_NAME("cortex-a72"),
+@@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid);
-     ARM_CPU_TYPE_NAME("cortex-a76"),
+ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
-     ARM_CPU_TYPE_NAME("a64fx"),
+                                 SMMUTransTableInfo *tt, hwaddr iova);
-+    ARM_CPU_TYPE_NAME("neoverse-n1"),
+ void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *entry);
-     ARM_CPU_TYPE_NAME("host"),
+-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
-     ARM_CPU_TYPE_NAME("max"),
++SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
- };
+                                 uint8_t tg, uint8_t level);
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+ void smmu_iotlb_inv_all(SMMUState *s);
-index XXXXXXX..XXXXXXX 100644
+ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
---- a/target/arm/cpu64.c
+-void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
-+++ b/target/arm/cpu64.c
++void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
-@@ -XXX,XX +XXX,XX @@ static void aarch64_a76_initfn(Object *obj)
+                          uint8_t tg, uint64_t num_pages, uint8_t ttl);
-     cpu->isar.mvfr2 = 0x00000043;
- }
+ /* Unmap the range of all the notifiers registered to any IOMMU mr */
+diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
-+static void aarch64_neoverse_n1_initfn(Object *obj)
+index XXXXXXX..XXXXXXX 100644
-+{
+--- a/hw/arm/smmu-common.c
-+    ARMCPU *cpu = ARM_CPU(obj);
++++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static guint smmu_iotlb_key_hash(gconstpointer v)
      /* Jenkins hash */
      a = b = c = JHASH_INITVAL + sizeof(*key);
 -    a += key->asid + key->level + key->tg;
 +    a += key->asid + key->vmid + key->level + key->tg;
      b += extract64(key->iova, 0, 32);
      c += extract64(key->iova, 32, 32);
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
      SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2;
      return (k1->asid == k2->asid) && (k1->iova == k2->iova) &&
 -           (k1->level == k2->level) && (k1->tg == k2->tg);
 +           (k1->level == k2->level) && (k1->tg == k2->tg) &&
 +           (k1->vmid == k2->vmid);
  }
 -SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
 +SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                  uint8_t tg, uint8_t level)
  {
 -    SMMUIOTLBKey key = {.asid = asid, .iova = iova, .tg = tg, .level = level};
 +    SMMUIOTLBKey key = {.asid = asid, .vmid = vmid, .iova = iova,
 +                        .tg = tg, .level = level};
      return key;
  }
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
          uint64_t mask = subpage_size - 1;
          SMMUIOTLBKey key;
 -        key = smmu_get_iotlb_key(cfg->asid, iova & ~mask, tg, level);
 +        key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid,
 +                                 iova & ~mask, tg, level);
          entry = g_hash_table_lookup(bs->iotlb, &key);
          if (entry) {
              break;
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
      if (entry) {
          cfg->iotlb_hits++;
 -        trace_smmu_iotlb_lookup_hit(cfg->asid, iova,
 +        trace_smmu_iotlb_lookup_hit(cfg->asid, cfg->s2cfg.vmid, iova,
                                      cfg->iotlb_hits, cfg->iotlb_misses,
 * cfg->iotlb_hits /
                                      (cfg->iotlb_hits + cfg->iotlb_misses));
      } else {
          cfg->iotlb_misses++;
 -        trace_smmu_iotlb_lookup_miss(cfg->asid, iova,
 +        trace_smmu_iotlb_lookup_miss(cfg->asid, cfg->s2cfg.vmid, iova,
                                       cfg->iotlb_hits, cfg->iotlb_misses,
 * cfg->iotlb_hits /
                                       (cfg->iotlb_hits + cfg->iotlb_misses));
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new)
          smmu_iotlb_inv_all(bs);
      }
 -    *key = smmu_get_iotlb_key(cfg->asid, new->entry.iova, tg, new->level);
 -    trace_smmu_iotlb_insert(cfg->asid, new->entry.iova, tg, new->level);
 +    *key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
 +                              tg, new->level);
 +    trace_smmu_iotlb_insert(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
 +                            tg, new->level);
      g_hash_table_insert(bs->iotlb, key, new);
  }
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
      return SMMU_IOTLB_ASID(*iotlb_key) == asid;
  }
 -
 -static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
 +static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                                gpointer user_data)
  {
      SMMUTLBEntry *iter = (SMMUTLBEntry *)value;
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
      if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) {
          return false;
      }
 +    if (info->vmid >= 0 && info->vmid != SMMU_IOTLB_VMID(iotlb_key)) {
 +        return false;
 +    }
      return ((info->iova & ~entry->addr_mask) == entry->iova) ||
             ((entry->iova & ~info->mask) == info->iova);
  }
 -void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
 +void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                           uint8_t tg, uint64_t num_pages, uint8_t ttl)
  {
      /* if tg is not set we use 4KB range invalidation */
      uint8_t granule = tg ? tg * 2 + 10 : 12;
      if (ttl && (num_pages == 1) && (asid >= 0)) {
 -        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
 +        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, iova, tg, ttl);
          if (g_hash_table_remove(s->iotlb, &key)) {
              return;
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
      SMMUIOTLBPageInvInfo info = {
          .asid = asid, .iova = iova,
 +        .vmid = vmid,
          .mask = (num_pages * 1 << granule) - 1};
      g_hash_table_foreach_remove(s->iotlb,
 -                                smmu_hash_remove_by_asid_iova,
 +                                smmu_hash_remove_by_asid_vmid_iova,
                                  &info);
  }
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
  {
      dma_addr_t end, addr = CMD_ADDR(cmd);
      uint8_t type = CMD_TYPE(cmd);
 -    uint16_t vmid = CMD_VMID(cmd);
 +    int vmid = -1;
      uint8_t scale = CMD_SCALE(cmd);
      uint8_t num = CMD_NUM(cmd);
      uint8_t ttl = CMD_TTL(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
      uint64_t num_pages;
      uint8_t granule;
      int asid = -1;
 +    SMMUv3State *smmuv3 = ARM_SMMUV3(s);
 +
-+    cpu->dtb_compatible = "arm,neoverse-n1";
++    /* Only consider VMID if stage-2 is supported. */
-+    set_feature(&cpu->env, ARM_FEATURE_V8);
++    if (STAGE2_SUPPORTED(smmuv3)) {
-+    set_feature(&cpu->env, ARM_FEATURE_NEON);
++        vmid = CMD_VMID(cmd);
-+    set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
++    }
-+    set_feature(&cpu->env, ARM_FEATURE_AARCH64);
-+    set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+     if (type == SMMU_CMD_TLBI_NH_VA) {
-+    set_feature(&cpu->env, ARM_FEATURE_EL2);
+         asid = CMD_ASID(cmd);
-+    set_feature(&cpu->env, ARM_FEATURE_EL3);
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
-+    set_feature(&cpu->env, ARM_FEATURE_PMU);
+     if (!tg) {
-+
+         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
-+    /* Ordered by B2.4 AArch64 registers by functional group */
+         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
-+    cpu->clidr = 0x82000023;
+-        smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl);
-+    cpu->ctr = 0x8444c004;
++        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
-+    cpu->dcz_blocksize = 4;
+         return;
-+    cpu->isar.id_aa64dfr0  = 0x0000000110305408ull;
+     }
-+    cpu->isar.id_aa64isar0 = 0x0000100010211120ull;
-+    cpu->isar.id_aa64isar1 = 0x0000000000100001ull;
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
-+    cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
+         num_pages = (mask + 1) >> granule;
-+    cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
+         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-+    cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
+         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
-+    cpu->isar.id_aa64pfr0  = 0x1100000010111112ull; /* GIC filled in later */
+-        smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
-+    cpu->isar.id_aa64pfr1  = 0x0000000000000020ull;
++        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
-+    cpu->id_afr0       = 0x00000000;
+         addr += mask + 1;
-+    cpu->isar.id_dfr0  = 0x04010088;
+     }
-+    cpu->isar.id_isar0 = 0x02101110;
+ }
-+    cpu->isar.id_isar1 = 0x13112111;
+diff --git a/hw/arm/trace-events b/hw/arm/trace-events
-+    cpu->isar.id_isar2 = 0x21232042;
+index XXXXXXX..XXXXXXX 100644
-+    cpu->isar.id_isar3 = 0x01112131;
+--- a/hw/arm/trace-events
-+    cpu->isar.id_isar4 = 0x00010142;
++++ b/hw/arm/trace-events
-+    cpu->isar.id_isar5 = 0x01011121;
+@@ -XXX,XX +XXX,XX @@ smmu_iotlb_inv_all(void) "IOTLB invalidate all"
-+    cpu->isar.id_isar6 = 0x00000010;
+ smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
-+    cpu->isar.id_mmfr0 = 0x10201105;
+ smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
-+    cpu->isar.id_mmfr1 = 0x40000000;
+ smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
-+    cpu->isar.id_mmfr2 = 0x01260000;
+-smmu_iotlb_lookup_hit(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-+    cpu->isar.id_mmfr3 = 0x02122211;
+-smmu_iotlb_lookup_miss(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-+    cpu->isar.id_mmfr4 = 0x00021110;
+-smmu_iotlb_insert(uint16_t asid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d addr=0x%"PRIx64" tg=%d level=%d"
-+    cpu->isar.id_pfr0  = 0x10010131;
++smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-+    cpu->isar.id_pfr1  = 0x00010000; /* GIC filled in later */
++smmu_iotlb_lookup_miss(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-+    cpu->isar.id_pfr2  = 0x00000011;
++smmu_iotlb_insert(uint16_t asid, uint16_t vmid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d vmid=%d addr=0x%"PRIx64" tg=%d level=%d"
-+    cpu->midr = 0x414fd0c1;          /* r4p1 */
-+    cpu->revidr = 0;
+ # smmuv3.c
-+
+ smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
 +    /* From B2.23 CCSIDR_EL1 */
 +    cpu->ccsidr[0] = 0x701fe01a; /* 64KB L1 dcache */
 +    cpu->ccsidr[1] = 0x201fe01a; /* 64KB L1 icache */
 +    cpu->ccsidr[2] = 0x70ffe03a; /* 1MB L2 cache */
 +
 +    /* From B2.98 SCTLR_EL3 */
 +    cpu->reset_sctlr = 0x30c50838;
 +
 +    /* From B4.23 ICH_VTR_EL2 */
 +    cpu->gic_num_lrs = 4;
 +    cpu->gic_vpribits = 5;
 +    cpu->gic_vprebits = 5;
 +
 +    /* From B5.1 AdvSIMD AArch64 register summary */
 +    cpu->isar.mvfr0 = 0x10110222;
 +    cpu->isar.mvfr1 = 0x13211111;
 +    cpu->isar.mvfr2 = 0x00000043;
 +}
 +
  void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
  {
      /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo aarch64_cpus[] = {
      { .name = "cortex-a72",         .initfn = aarch64_a72_initfn },
      { .name = "cortex-a76",         .initfn = aarch64_a76_initfn },
      { .name = "a64fx",              .initfn = aarch64_a64fx_initfn },
 +    { .name = "neoverse-n1",        .initfn = aarch64_neoverse_n1_initfn },
      { .name = "max",                .initfn = aarch64_max_initfn },
  #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
      { .name = "host",               .initfn = aarch64_host_initfn },
 --
-.25.1
+.34.1

-[PULL 04/32] target/arm: Merge zcr reginfo
+[PULL 09/21] hw/arm/smmuv3: Add CMDs related to stage-2
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-Drop zcr_no_el2_reginfo and merge the 3 registers into one array,
+CMD_TLBI_S2_IPA: As S1+S2 is not enabled, for now this can be the
-now that ZCR_EL2 can be squashed to RES0 and ZCR_EL3 dropped
+same as CMD_TLBI_NH_VAA.
-while registering.
+CMD_TLBI_S12_VMALL: Added new function to invalidate TLB by VMID.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+For stage-1 only commands, add a check to throw CERROR_ILL if used
-Message-id: 20220506180242.216785-4-richard.henderson@linaro.org
+when stage-1 is not supported.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-9-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 55 ++++++++++++++-------------------------------
+ include/hw/arm/smmu-common.h |  1 +
-file changed, 17 insertions(+), 38 deletions(-)
+ hw/arm/smmu-common.c         | 16 +++++++++++
+ hw/arm/smmuv3.c              | 55 ++++++++++++++++++++++++++++++------
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+ hw/arm/trace-events          |  4 ++-
-index XXXXXXX..XXXXXXX 100644
+files changed, 67 insertions(+), 9 deletions(-)
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
-@@ -XXX,XX +XXX,XX @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/smmu-common.h
 +++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                  uint8_t tg, uint8_t level);
  void smmu_iotlb_inv_all(SMMUState *s);
  void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
 +void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid);
  void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                           uint8_t tg, uint64_t num_pages, uint8_t ttl);
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
      return SMMU_IOTLB_ASID(*iotlb_key) == asid;
  }
 +
 +static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value,
 +                                         gpointer user_data)
 +{
 +    uint16_t vmid = *(uint16_t *)user_data;
 +    SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;
 +
 +    return SMMU_IOTLB_VMID(*iotlb_key) == vmid;
 +}
 +
  static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                                gpointer user_data)
  {
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
      g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
  }
 +inline void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid)
 +{
 +    trace_smmu_iotlb_inv_vmid(vmid);
 +    g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid);
 +}
 +
  /* VMSAv8-64 Translation */
  /**
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
      }
  }
--static const ARMCPRegInfo zcr_el1_reginfo = {
+-static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
--    .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
++static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
--    .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
+ {
--    .access = PL1_RW, .type = ARM_CP_SVE,
+     dma_addr_t end, addr = CMD_ADDR(cmd);
--    .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
+     uint8_t type = CMD_TYPE(cmd);
--    .writefn = zcr_write, .raw_writefn = raw_write
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
 -};
 -
 -static const ARMCPRegInfo zcr_el2_reginfo = {
 -    .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
 -    .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
 -    .access = PL2_RW, .type = ARM_CP_SVE,
 -    .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
 -    .writefn = zcr_write, .raw_writefn = raw_write
 -};
 -
 -static const ARMCPRegInfo zcr_no_el2_reginfo = {
 -    .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
 -    .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
 -    .access = PL2_RW, .type = ARM_CP_SVE,
 -    .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore
 -};
 -
 -static const ARMCPRegInfo zcr_el3_reginfo = {
 -    .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
 -    .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
 -    .access = PL3_RW, .type = ARM_CP_SVE,
 -    .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
 -    .writefn = zcr_write, .raw_writefn = raw_write
 +static const ARMCPRegInfo zcr_reginfo[] = {
 +    { .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
 +      .access = PL1_RW, .type = ARM_CP_SVE,
 +      .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
 +      .writefn = zcr_write, .raw_writefn = raw_write },
 +    { .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
 +      .access = PL2_RW, .type = ARM_CP_SVE,
 +      .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
 +      .writefn = zcr_write, .raw_writefn = raw_write },
 +    { .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
 +      .access = PL3_RW, .type = ARM_CP_SVE,
 +      .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
 +      .writefn = zcr_write, .raw_writefn = raw_write },
  };
  void hw_watchpoint_update(ARMCPU *cpu, int n)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
      }
-     if (cpu_isar_feature(aa64_sve, cpu)) {
+     if (!tg) {
--        define_one_arm_cp_reg(cpu, &zcr_el1_reginfo);
+-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
--        if (arm_feature(env, ARM_FEATURE_EL2)) {
++        trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
--            define_one_arm_cp_reg(cpu, &zcr_el2_reginfo);
+         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
--        } else {
+         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
--            define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo);
+         return;
--        }
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
--        if (arm_feature(env, ARM_FEATURE_EL3)) {
+         uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
--            define_one_arm_cp_reg(cpu, &zcr_el3_reginfo);
--        }
+         num_pages = (mask + 1) >> granule;
-+        define_arm_cp_regs(cpu, zcr_reginfo);
+-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-     }
++        trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
+         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
- #ifdef TARGET_AARCH64
+         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
          addr += mask + 1;
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
          {
              uint16_t asid = CMD_ASID(&cmd);
 +            if (!STAGE1_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +
              trace_smmuv3_cmdq_tlbi_nh_asid(asid);
              smmu_inv_notifiers_all(&s->smmu_state);
              smmu_iotlb_inv_asid(bs, asid);
              break;
          }
          case SMMU_CMD_TLBI_NH_ALL:
 +            if (!STAGE1_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            QEMU_FALLTHROUGH;
          case SMMU_CMD_TLBI_NSNH_ALL:
              trace_smmuv3_cmdq_tlbi_nh();
              smmu_inv_notifiers_all(&s->smmu_state);
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
              break;
          case SMMU_CMD_TLBI_NH_VAA:
          case SMMU_CMD_TLBI_NH_VA:
 -            smmuv3_s1_range_inval(bs, &cmd);
 +            if (!STAGE1_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            smmuv3_range_inval(bs, &cmd);
 +            break;
 +        case SMMU_CMD_TLBI_S12_VMALL:
 +        {
 +            uint16_t vmid = CMD_VMID(&cmd);
 +
 +            if (!STAGE2_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +
 +            trace_smmuv3_cmdq_tlbi_s12_vmid(vmid);
 +            smmu_inv_notifiers_all(&s->smmu_state);
 +            smmu_iotlb_inv_vmid(bs, vmid);
 +            break;
 +        }
 +        case SMMU_CMD_TLBI_S2_IPA:
 +            if (!STAGE2_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            /*
 +             * As currently only either s1 or s2 are supported
 +             * we can reuse same function for s2.
 +             */
 +            smmuv3_range_inval(bs, &cmd);
              break;
          case SMMU_CMD_TLBI_EL3_ALL:
          case SMMU_CMD_TLBI_EL3_VA:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
          case SMMU_CMD_TLBI_EL2_ASID:
          case SMMU_CMD_TLBI_EL2_VA:
          case SMMU_CMD_TLBI_EL2_VAA:
 -        case SMMU_CMD_TLBI_S12_VMALL:
 -        case SMMU_CMD_TLBI_S2_IPA:
          case SMMU_CMD_ATC_INV:
          case SMMU_CMD_PRI_RESP:
          case SMMU_CMD_RESUME:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
              break;
          default:
              cmd_error = SMMU_CERROR_ILL;
 -            qemu_log_mask(LOG_GUEST_ERROR,
 -                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
              break;
          }
          qemu_mutex_unlock(&s->mutex);
          if (cmd_error) {
 +            if (cmd_error == SMMU_CERROR_ILL) {
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "Illegal command type: %d\n", CMD_TYPE(&cmd));
 +            }
              break;
          }
          /*
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, ui
  smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
  smmu_iotlb_inv_all(void) "IOTLB invalidate all"
  smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
 +smmu_iotlb_inv_vmid(uint16_t vmid) "IOTLB invalidate vmid=%d"
  smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
  smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
  smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_cfgi_ste_range(int start, int end) "start=0x%x - end=0x%x"
  smmuv3_cmdq_cfgi_cd(uint32_t sid) "sid=0x%x"
  smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
  smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
 -smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
 +smmuv3_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
  smmuv3_cmdq_tlbi_nh(void) ""
  smmuv3_cmdq_tlbi_nh_asid(uint16_t asid) "asid=%d"
 +smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
  smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
  smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
  smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
 --
-.25.1
+.34.1

-[PULL 27/32] qapi/machine.json: Add cluster-id
+[PULL 10/21] hw/arm/smmuv3: Add stage-2 support in iova notifier
-From: Gavin Shan <gshan@redhat.com>
+From: Mostafa Saleh <smostafa@google.com>
-This adds cluster-id in CPU instance properties, which will be used
+In smmuv3_notify_iova, read the granule based on translation stage
-by arm/virt machine. Besides, the cluster-id is also verified or
+and use VMID if valid value is sent.
 dumped in various spots:
-  * hw/core/machine.c::machine_set_cpu_numa_node() to associate
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
-    CPU with its NUMA node.
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
-  * hw/core/machine.c::machine_numa_finish_cpu_init() to record
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-    CPU slots with no NUMA mapping set.
+Message-id: 20230516203327.2051088-10-smostafa@google.com
   * hw/core/machine-hmp-cmds.c::hmp_hotpluggable_cpus() to dump
     cluster-id.
 Signed-off-by: Gavin Shan <gshan@redhat.com>
 Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
 Acked-by: Igor Mammedov <imammedo@redhat.com>
 Message-id: 20220503140304.855514-2-gshan@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- qapi/machine.json          |  6 ++++--
+ hw/arm/smmuv3.c     | 39 ++++++++++++++++++++++++++-------------
- hw/core/machine-hmp-cmds.c |  4 ++++
+ hw/arm/trace-events |  2 +-
- hw/core/machine.c          | 16 ++++++++++++++++
+files changed, 27 insertions(+), 14 deletions(-)
 files changed, 24 insertions(+), 2 deletions(-)
-diff --git a/qapi/machine.json b/qapi/machine.json
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/qapi/machine.json
+--- a/hw/arm/smmuv3.c
-+++ b/qapi/machine.json
++++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ epilogue:
- # @node-id: NUMA node ID the CPU belongs to
+  * @mr: IOMMU mr region handle
- # @socket-id: socket number within node/board the CPU belongs to
+  * @n: notifier to be called
- # @die-id: die number within socket the CPU belongs to (since 4.1)
+  * @asid: address space ID or negative value if we don't care
--# @core-id: core number within die the CPU belongs to
++ * @vmid: virtual machine ID or negative value if we don't care
-+# @cluster-id: cluster number within die the CPU belongs to (since 7.1)
+  * @iova: iova
-+# @core-id: core number within cluster the CPU belongs to
+  * @tg: translation granule (if communicated through range invalidation)
- # @thread-id: thread number within core the CPU belongs to
+  * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
- #
+  */
--# Note: currently there are 5 properties that could be present
+ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
-+# Note: currently there are 6 properties that could be present
+                                IOMMUNotifier *n,
- #       but management should be prepared to pass through other
+-                               int asid, dma_addr_t iova,
- #       properties with device_add command to allow for future
+-                               uint8_t tg, uint64_t num_pages)
- #       interface extension. This also requires the filed names to be kept in
++                               int asid, int vmid,
-@@ -XXX,XX +XXX,XX @@
++                               dma_addr_t iova, uint8_t tg,
-   'data': { '*node-id': 'int',
++                               uint64_t num_pages)
-             '*socket-id': 'int',
+ {
-             '*die-id': 'int',
+     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
-+            '*cluster-id': 'int',
+     IOMMUTLBEvent event;
-             '*core-id': 'int',
+     uint8_t granule;
-             '*thread-id': 'int'
++    SMMUv3State *s = sdev->smmu;
-   }
-diff --git a/hw/core/machine-hmp-cmds.c b/hw/core/machine-hmp-cmds.c
+     if (!tg) {
-index XXXXXXX..XXXXXXX 100644
+         SMMUEventInfo event = {.inval_ste_allowed = true};
---- a/hw/core/machine-hmp-cmds.c
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
 +++ b/hw/core/machine-hmp-cmds.c
@@ -XXX,XX +XXX,XX @@ void hmp_hotpluggable_cpus(Monitor *mon, const QDict *qdict)
          if (c->has_die_id) {
              monitor_printf(mon, "    die-id: \"%" PRIu64 "\"\n", c->die_id);
          }
 +        if (c->has_cluster_id) {
 +            monitor_printf(mon, "    cluster-id: \"%" PRIu64 "\"\n",
 +                           c->cluster_id);
 +        }
          if (c->has_core_id) {
              monitor_printf(mon, "    core-id: \"%" PRIu64 "\"\n", c->core_id);
          }
 diff --git a/hw/core/machine.c b/hw/core/machine.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/machine.c
 +++ b/hw/core/machine.c
@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
              return;
          }
-+        if (props->has_cluster_id && !slot->props.has_cluster_id) {
+-        tt = select_tt(cfg, iova);
-+            error_setg(errp, "cluster-id is not supported");
+-        if (!tt) {
-+            return;
++        if (vmid >= 0 && cfg->s2cfg.vmid != vmid) {
              return;
          }
 -        granule = tt->granule_sz;
 +
 +        if (STAGE1_SUPPORTED(s)) {
 +            tt = select_tt(cfg, iova);
 +            if (!tt) {
 +                return;
 +            }
 +            granule = tt->granule_sz;
 +        } else {
 +            granule = cfg->s2cfg.granule_sz;
 +        }
 +
-         if (props->has_socket_id && !slot->props.has_socket_id) {
+     } else {
-             error_setg(errp, "socket-id is not supported");
+         granule = tg * 2 + 10;
-             return;
+     }
-@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
-                 continue;
+     memory_region_notify_iommu_one(n, &event);
  }
 -/* invalidate an asid/iova range tuple in all mr's */
 -static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
 -                                      uint8_t tg, uint64_t num_pages)
 +/* invalidate an asid/vmid/iova range tuple in all mr's */
 +static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid,
 +                                      dma_addr_t iova, uint8_t tg,
 +                                      uint64_t num_pages)
  {
      SMMUDevice *sdev;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
          IOMMUMemoryRegion *mr = &sdev->iommu;
          IOMMUNotifier *n;
 -        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova,
 -                                        tg, num_pages);
 +        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid,
 +                                        iova, tg, num_pages);
          IOMMU_NOTIFIER_FOREACH(n, mr) {
 -            smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages);
 +            smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages);
          }
-+        if (props->has_cluster_id &&
-+            props->cluster_id != slot->props.cluster_id) {
-+                continue;
-+        }
-+
-         if (props->has_die_id && props->die_id != slot->props.die_id) {
-                 continue;
-         }
-@@ -XXX,XX +XXX,XX @@ static char *cpu_slot_to_string(const CPUArchId *cpu)
-         }
-         g_string_append_printf(s, "die-id: %"PRId64, cpu->props.die_id);
      }
-+    if (cpu->props.has_cluster_id) {
+ }
-+        if (s->len) {
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
-+            g_string_append_printf(s, ", ");
-+        }
+     if (!tg) {
-+        g_string_append_printf(s, "cluster-id: %"PRId64, cpu->props.cluster_id);
+         trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
-+    }
+-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
-     if (cpu->props.has_core_id) {
++        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1);
-         if (s->len) {
+         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
-             g_string_append_printf(s, ", ");
+         return;
      }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
          num_pages = (mask + 1) >> granule;
          trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
 -        smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
 +        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages);
          smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
          addr += mask + 1;
      }
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
  smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
  smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
  smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
 -smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
 +smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint16_t vmid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d vmid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
 --
-.25.1
+.34.1

-[PULL 02/32] target/arm: Handle cpreg registration for missing EL
+[PULL 11/21] hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-More gracefully handle cpregs when EL2 and/or EL3 are missing.
+As everything is in place, we can use a new system property to
-If the reg is entirely inaccessible, do not register it at all.
+advertise which stage is supported and remove bad_ste from STE
-If the reg is for EL2, and EL3 is present but EL2 is not,
+stage2 config.
 either discard, squash to res0, const, or keep unchanged.
-Per rule RJFFP, mark the 4 aarch32 hypervisor access registers
+The property added arm-smmuv3.stage can have 3 values:
-with ARM_CP_EL3_NO_EL2_KEEP, and mark all of the EL2 address
+- "1": Stage-1 only is advertised.
-translation and tlb invalidation "regs" ARM_CP_EL3_NO_EL2_UNDEF.
+- "2": Stage-2 only is advertised.
 Mark the 2 virtualization processor id regs ARM_CP_EL3_NO_EL2_C_NZ.
-This will simplify cpreg registration for conditional arm features.
+If not passed or an unsupported value is passed, it will default to
 stage-1.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Advertise VMID16.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-2-richard.henderson@linaro.org
+Don't try to decode CD, if stage-2 is configured.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-11-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpregs.h |  11 +++
+ include/hw/arm/smmuv3.h |  1 +
- target/arm/helper.c | 178 ++++++++++++++++++++++++++++++--------------
+ hw/arm/smmuv3.c         | 32 ++++++++++++++++++++++----------
-files changed, 133 insertions(+), 56 deletions(-)
+files changed, 23 insertions(+), 10 deletions(-)
-diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
+diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpregs.h
+--- a/include/hw/arm/smmuv3.h
-+++ b/target/arm/cpregs.h
++++ b/include/hw/arm/smmuv3.h
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ struct SMMUv3State {
-     ARM_CP_SVE                   = 1 << 14,
-     /* Flag: Do not expose in gdb sysreg xml. */
+     qemu_irq     irq[4];
-     ARM_CP_NO_GDB                = 1 << 15,
+     QemuMutex mutex;
-+    /*
++    char *stage;
 +     * Flags: If EL3 but not EL2...
 +     *   - UNDEF: discard the cpreg,
 +     *   -  KEEP: retain the cpreg as is,
 +     *   -  C_NZ: set const on the cpreg, but retain resetvalue,
 +     *   -  else: set const on the cpreg, zero resetvalue, aka RES0.
 +     * See rule RJFFP in section D1.1.3 of DDI0487H.a.
 +     */
 +    ARM_CP_EL3_NO_EL2_UNDEF      = 1 << 16,
 +    ARM_CP_EL3_NO_EL2_KEEP       = 1 << 17,
 +    ARM_CP_EL3_NO_EL2_C_NZ       = 1 << 18,
  };
- /*
+ typedef enum {
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/arm/smmuv3.c
-+++ b/target/arm/helper.c
++++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@
-       .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
+ #include "hw/irq.h"
-     { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64,
+ #include "hw/sysbus.h"
-       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0,
+ #include "migration/vmstate.h"
--      .access = PL2_RW, .type = ARM_CP_ALIAS | ARM_CP_FPU,
++#include "hw/qdev-properties.h"
-+      .access = PL2_RW,
+ #include "hw/qdev-core.h"
-+      .type = ARM_CP_ALIAS | ARM_CP_FPU | ARM_CP_EL3_NO_EL2_KEEP,
+ #include "hw/pci/pci.h"
-       .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]) },
+ #include "cpu.h"
-     { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64,
+@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
-       .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0,
--      .access = PL2_RW, .resetvalue = 0,
+ static void smmuv3_init_regs(SMMUv3State *s)
 +      .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP,
        .writefn = dacr_write, .raw_writefn = raw_write,
        .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) },
      { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1,
 -      .access = PL2_RW, .resetvalue = 0,
 +      .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP,
        .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) },
      { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64,
        .type = ARM_CP_ALIAS,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
        .writefn = tlbimva_hyp_is_write },
      { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
 -      .type = ARM_CP_NO_RAW, .access = PL2_W,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_alle2_write },
      { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
 -      .type = ARM_CP_NO_RAW, .access = PL2_W,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_vae2_write },
      { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_vae2_write },
      { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_alle2is_write },
      { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
 -      .type = ARM_CP_NO_RAW, .access = PL2_W,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_vae2is_write },
      { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_vae2is_write },
  #ifndef CONFIG_USER_ONLY
      /* Unlike the other EL2-related AT operations, these must
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
      { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
        .access = PL2_W, .accessfn = at_s1e2_access,
 -      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 },
 +      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF,
 +      .writefn = ats_write64 },
      { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
        .access = PL2_W, .accessfn = at_s1e2_access,
 -      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 },
 +      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF,
 +      .writefn = ats_write64 },
      /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
       * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
       * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
      { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
        .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
        .access = PL2_RW, .accessfn = access_tda,
 -      .type = ARM_CP_NOP },
 +      .type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
      /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications
       * Channel but Linux may try to access this register. The 32-bit
       * alias is DBGDCCINT.
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbirange_reginfo[] = {
        .access = PL2_W, .type = ARM_CP_NOP },
      { .name = "TLBI_RVAE2IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 1,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_rvae2is_write },
     { .name = "TLBI_RVALE2IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 5,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_rvae2is_write },
      { .name = "TLBI_RIPAS2E1", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 2,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbirange_reginfo[] = {
        .access = PL2_W, .type = ARM_CP_NOP },
     { .name = "TLBI_RVAE2OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 1,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_rvae2is_write },
     { .name = "TLBI_RVALE2OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 5,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_rvae2is_write },
      { .name = "TLBI_RVAE2", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 1,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_rvae2_write },
     { .name = "TLBI_RVALE2", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 5,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_rvae2_write },
     { .name = "TLBI_RVAE3IS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 2, .opc2 = 1,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbios_reginfo[] = {
        .writefn = tlbi_aa64_vae1is_write },
      { .name = "TLBI_ALLE2OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 0,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_alle2is_write },
      { .name = "TLBI_VAE2OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 1,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_vae2is_write },
     { .name = "TLBI_ALLE1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 4,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbios_reginfo[] = {
        .writefn = tlbi_aa64_alle1is_write },
      { .name = "TLBI_VALE2OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 5,
 -      .access = PL2_W, .type = ARM_CP_NO_RAW,
 +      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
        .writefn = tlbi_aa64_vae2is_write },
      { .name = "TLBI_VMALLS12E1OS", .state = ARM_CP_STATE_AA64,
        .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 6,
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
                .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
                .access = PL2_RW, .accessfn = access_el3_aa32ns,
 -              .resetvalue = cpu->midr, .type = ARM_CP_ALIAS,
 +              .resetvalue = cpu->midr,
 +              .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ,
                .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) },
              { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
                .access = PL2_RW, .resetvalue = cpu->midr,
 +              .type = ARM_CP_EL3_NO_EL2_C_NZ,
                .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
              { .name = "VMPIDR", .state = ARM_CP_STATE_AA32,
                .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
                .access = PL2_RW, .accessfn = access_el3_aa32ns,
 -              .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS,
 +              .resetvalue = vmpidr_def,
 +              .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ,
                .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) },
              { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
 -              .access = PL2_RW,
 -              .resetvalue = vmpidr_def,
 +              .access = PL2_RW, .resetvalue = vmpidr_def,
 +              .type = ARM_CP_EL3_NO_EL2_C_NZ,
                .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
          };
          define_arm_cp_regs(cpu, vpidr_regs);
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
                                     int crm, int opc1, int opc2,
                                     const char *name)
  {
-+    CPUARMState *env = &cpu->env;
+-    /**
-     uint32_t key;
+-     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
-     ARMCPRegInfo *r2;
+-     *       multi-level stream table
-     bool is64 = r->type & ARM_CP_64BIT;
+-     */
-     bool ns = secstate & ARM_CP_SECSTATE_NS;
+-    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
-     int cp = r->cp;
++    /* Based on sys property, the stages supported in smmu will be advertised.*/
--    bool isbanked;
++    if (s->stage && !strcmp("2", s->stage)) {
-     size_t name_len;
++        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
 +    bool make_const;
      switch (state) {
      case ARM_CP_STATE_AA32:
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
          }
      }
 +    /*
 +     * Eliminate registers that are not present because the EL is missing.
 +     * Doing this here makes it easier to put all registers for a given
 +     * feature into the same ARMCPRegInfo array and define them all at once.
 +     */
 +    make_const = false;
 +    if (arm_feature(env, ARM_FEATURE_EL3)) {
 +        /*
 +         * An EL2 register without EL2 but with EL3 is (usually) RES0.
 +         * See rule RJFFP in section D1.1.3 of DDI0487H.a.
 +         */
 +        int min_el = ctz32(r->access) / 2;
 +        if (min_el == 2 && !arm_feature(env, ARM_FEATURE_EL2)) {
 +            if (r->type & ARM_CP_EL3_NO_EL2_UNDEF) {
 +                return;
 +            }
 +            make_const = !(r->type & ARM_CP_EL3_NO_EL2_KEEP);
 +        }
 +    } else {
-+        CPAccessRights max_el = (arm_feature(env, ARM_FEATURE_EL2)
++        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
 +                                 ? PL2_RW : PL1_RW);
 +        if ((r->access & max_el) == 0) {
 +            return;
 +        }
 +    }
 +
-     /* Combine cpreg and name into one allocation. */
+     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
-     name_len = strlen(name) + 1;
+     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
-     r2 = g_malloc(sizeof(*r2) + name_len);
+     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
-@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
++    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, VMID16, 1); /* 16-bit VMID */
-         r2->opaque = opaque;
+     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
      /* terminated transaction will always be aborted/error returned */
@@ -XXX,XX +XXX,XX @@ static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
          goto bad_ste;
      }
--    isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1];
+-    /* This is still here as stage 2 has not been fully enabled yet. */
--    if (isbanked) {
+-    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
-+    if (make_const) {
+-    goto bad_ste;
-+        /* This should not have been a very special register to begin. */
+-
-+        int old_special = r2->type & ARM_CP_SPECIAL_MASK;
+     return 0;
-+        assert(old_special == 0 || old_special == ARM_CP_NOP);
-         /*
+ bad_ste:
--         * Register is banked (using both entries in array).
+@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
--         * Overwriting fieldoffset as the array is only used to define
+         return ret;
 -         * banked registers but later only fieldoffset is used.
 +         * Set the special function to CONST, retaining the other flags.
 +         * This is important for e.g. ARM_CP_SVE so that we still
 +         * take the SVE trap if CPTR_EL3.EZ == 0.
           */
 -        r2->fieldoffset = r->bank_fieldoffsets[ns];
 -    }
 +        r2->type = (r2->type & ~ARM_CP_SPECIAL_MASK) | ARM_CP_CONST;
 +        /*
 +         * Usually, these registers become RES0, but there are a few
 +         * special cases like VPIDR_EL2 which have a constant non-zero
 +         * value with writes ignored.
 +         */
 +        if (!(r->type & ARM_CP_EL3_NO_EL2_C_NZ)) {
 +            r2->resetvalue = 0;
 +        }
 +        /*
 +         * ARM_CP_CONST has precedence, so removing the callbacks and
 +         * offsets are not strictly necessary, but it is potentially
 +         * less confusing to debug later.
 +         */
 +        r2->readfn = NULL;
 +        r2->writefn = NULL;
 +        r2->raw_readfn = NULL;
 +        r2->raw_writefn = NULL;
 +        r2->resetfn = NULL;
 +        r2->fieldoffset = 0;
 +        r2->bank_fieldoffsets[0] = 0;
 +        r2->bank_fieldoffsets[1] = 0;
 +    } else {
 +        bool isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1];
 -    if (state == ARM_CP_STATE_AA32) {
          if (isbanked) {
              /*
 -             * If the register is banked then we don't need to migrate or
 -             * reset the 32-bit instance in certain cases:
 -             *
 -             * 1) If the register has both 32-bit and 64-bit instances then we
 -             *    can count on the 64-bit instance taking care of the
 -             *    non-secure bank.
 -             * 2) If ARMv8 is enabled then we can count on a 64-bit version
 -             *    taking care of the secure bank.  This requires that separate
 -             *    32 and 64-bit definitions are provided.
 +             * Register is banked (using both entries in array).
 +             * Overwriting fieldoffset as the array is only used to define
 +             * banked registers but later only fieldoffset is used.
               */
 -            if ((r->state == ARM_CP_STATE_BOTH && ns) ||
 -                (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) {
 +            r2->fieldoffset = r->bank_fieldoffsets[ns];
 +        }
 +        if (state == ARM_CP_STATE_AA32) {
 +            if (isbanked) {
 +                /*
 +                 * If the register is banked then we don't need to migrate or
 +                 * reset the 32-bit instance in certain cases:
 +                 *
 +                 * 1) If the register has both 32-bit and 64-bit instances
 +                 *    then we can count on the 64-bit instance taking care
 +                 *    of the non-secure bank.
 +                 * 2) If ARMv8 is enabled then we can count on a 64-bit
 +                 *    version taking care of the secure bank.  This requires
 +                 *    that separate 32 and 64-bit definitions are provided.
 +                 */
 +                if ((r->state == ARM_CP_STATE_BOTH && ns) ||
 +                    (arm_feature(env, ARM_FEATURE_V8) && !ns)) {
 +                    r2->type |= ARM_CP_ALIAS;
 +                }
 +            } else if ((secstate != r->secure) && !ns) {
 +                /*
 +                 * The register is not banked so we only want to allow
 +                 * migration of the non-secure instance.
 +                 */
                  r2->type |= ARM_CP_ALIAS;
              }
 -        } else if ((secstate != r->secure) && !ns) {
 -            /*
 -             * The register is not banked so we only want to allow migration
 -             * of the non-secure instance.
 -             */
 -            r2->type |= ARM_CP_ALIAS;
 -        }
 -        if (HOST_BIG_ENDIAN &&
 -            r->state == ARM_CP_STATE_BOTH && r2->fieldoffset) {
 -            r2->fieldoffset += sizeof(uint32_t);
 +            if (HOST_BIG_ENDIAN &&
 +                r->state == ARM_CP_STATE_BOTH && r2->fieldoffset) {
 +                r2->fieldoffset += sizeof(uint32_t);
 +            }
          }
      }
-@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
+-    if (cfg->aborted || cfg->bypassed) {
-      * multiple times. Special registers (ie NOP/WFI) are
++    if (cfg->aborted || cfg->bypassed || (cfg->stage == 2)) {
-      * never migratable and not even raw-accessible.
+         return 0;
       */
 -    if (r->type & ARM_CP_SPECIAL_MASK) {
 +    if (r2->type & ARM_CP_SPECIAL_MASK) {
          r2->type |= ARM_CP_NO_RAW;
      }
-     if (((r->crm == CP_ANY) && crm != 0) ||
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3 = {
      }
  };
 +static Property smmuv3_properties[] = {
 +    /*
 +     * Stages of translation advertised.
 +     * "1": Stage 1
 +     * "2": Stage 2
 +     * Defaults to stage 1
 +     */
 +    DEFINE_PROP_STRING("stage", SMMUv3State, stage),
 +    DEFINE_PROP_END_OF_LIST()
 +};
 +
  static void smmuv3_instance_init(Object *obj)
  {
      /* Nothing much to do here as of now */
@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
                                         &c->parent_phases);
      c->parent_realize = dc->realize;
      dc->realize = smmu_realize;
 +    device_class_set_props(dc, smmuv3_properties);
  }
  static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
 --
-.25.1
+.34.1

-[PULL 21/32] target/arm: Enable FEAT_CSV2_2 for -cpu max
+[PULL 12/21] hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Tommy Wu <tommy.wu@sifive.com>
-There is no branch prediction in TCG, therefore there is no
+When we receive a packet from the xilinx_axienet and then try to s2mem
-need to actually include the context number into the predictor.
+through the xilinx_axidma, if the descriptor ring buffer is full in the
-Therefore all we need to do is add the state for SCXTNUM_ELx.
+xilinx axidma driver, we’ll assert the DMASR.HALTED in the
 function : stream_process_s2mem and return 0. In the end, we’ll be stuck in
 an infinite loop in axienet_eth_rx_notify.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+This patch checks the DMASR.HALTED state when we try to push data
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+from xilinx axi-enet to xilinx axi-dma. When the DMASR.HALTED is asserted,
-Message-id: 20220506180242.216785-21-richard.henderson@linaro.org
+we will not keep pushing the data and then prevent the infinte loop.
 Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
 Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Message-id: 20230519062137.1251741-1-tommy.wu@sifive.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/emulation.rst |  3 ++
+ hw/dma/xilinx_axidma.c | 11 ++++++++---
- target/arm/cpu.h              | 16 +++++++++
+file changed, 8 insertions(+), 3 deletions(-)
  target/arm/cpu.c              |  5 +++
  target/arm/cpu64.c            |  3 +-
  target/arm/helper.c           | 61 ++++++++++++++++++++++++++++++++++-
 files changed, 86 insertions(+), 2 deletions(-)
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
+diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/emulation.rst
+--- a/hw/dma/xilinx_axidma.c
-+++ b/docs/system/arm/emulation.rst
++++ b/hw/dma/xilinx_axidma.c
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
+@@ -XXX,XX +XXX,XX @@ static inline int stream_idle(struct Stream *s)
- - FEAT_BF16 (AArch64 BFloat16 instructions)
+     return !!(s->regs[R_DMASR] & DMASR_IDLE);
  - FEAT_BTI (Branch Target Identification)
  - FEAT_CSV2 (Cache speculation variant 2)
 +- FEAT_CSV2_1p1 (Cache speculation variant 2, version 1.1)
 +- FEAT_CSV2_1p2 (Cache speculation variant 2, version 1.2)
 +- FEAT_CSV2_2 (Cache speculation variant 2, version 2)
  - FEAT_DIT (Data Independent Timing instructions)
  - FEAT_DPB (DC CVAP instruction)
  - FEAT_Debugv8p2 (Debug changes for v8.2)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
          ARMPACKey apdb;
          ARMPACKey apga;
      } keys;
 +
 +    uint64_t scxtnum_el[4];
  #endif
  #if defined(CONFIG_USER_ONLY)
@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
  #define SCTLR_WXN     (1U << 19)
  #define SCTLR_ST      (1U << 20) /* up to ??, RAZ in v6 */
  #define SCTLR_UWXN    (1U << 20) /* v7 onward, AArch32 only */
 +#define SCTLR_TSCXT   (1U << 20) /* FEAT_CSV2_1p2, AArch64 only */
  #define SCTLR_FI      (1U << 21) /* up to v7, v8 RES0 */
  #define SCTLR_IESB    (1U << 21) /* v8.2-IESB, AArch64 only */
  #define SCTLR_U       (1U << 22) /* up to v6, RAO in v7 */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_dit(const ARMISARegisters *id)
      return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, DIT) != 0;
  }
-+static inline bool isar_feature_aa64_scxtnum(const ARMISARegisters *id)
++static inline int stream_halted(struct Stream *s)
 +{
-+    int key = FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, CSV2);
++    return !!(s->regs[R_DMASR] & DMASR_HALTED);
 +    if (key >= 2) {
 +        return true;      /* FEAT_CSV2_2 */
 +    }
 +    if (key == 1) {
 +        key = FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, CSV2_FRAC);
 +        return key >= 2;  /* FEAT_CSV2_1p2 */
 +    }
 +    return false;
 +}
 +
- static inline bool isar_feature_aa64_ssbs(const ARMISARegisters *id)
+ static void stream_reset(struct Stream *s)
  {
-     return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, SSBS) != 0;
+     s->regs[R_DMASR] = DMASR_HALTED;  /* starts up halted.  */
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
+@@ -XXX,XX +XXX,XX @@ static void stream_process_mem2s(struct Stream *s, StreamSink *tx_data_dev,
-index XXXXXXX..XXXXXXX 100644
+     uint64_t addr;
---- a/target/arm/cpu.c
+     bool eop;
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
+-    if (!stream_running(s) || stream_idle(s)) {
-              */
++    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
-             env->cp15.gcr_el1 = 0x1ffff;
+         return;
          }
 +        /*
 +         * Disable access to SCXTNUM_EL0 from CSV2_1p2.
 +         * This is not yet exposed from the Linux kernel in any way.
 +         */
 +        env->cp15.sctlr_el[1] |= SCTLR_TSCXT;
  #else
          /* Reset into the highest available EL */
          if (arm_feature(env, ARM_FEATURE_EL3)) {
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
      t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
      t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1);      /* FEAT_SEL2 */
      t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1);       /* FEAT_DIT */
 -    t = FIELD_DP64(t, ID_AA64PFR0, CSV2, 1);      /* FEAT_CSV2 */
 +    t = FIELD_DP64(t, ID_AA64PFR0, CSV2, 2);      /* FEAT_CSV2_2 */
      cpu->isar.id_aa64pfr0 = t;
      t = cpu->isar.id_aa64pfr1;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
       * we do for EL2 with the virtualization=on property.
       */
      t = FIELD_DP64(t, ID_AA64PFR1, MTE, 3);       /* FEAT_MTE3 */
 +    t = FIELD_DP64(t, ID_AA64PFR1, CSV2_FRAC, 0); /* FEAT_CSV2_2 */
      cpu->isar.id_aa64pfr1 = t;
      t = cpu->isar.id_aa64mmfr0;
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
          if (cpu_isar_feature(aa64_mte, cpu)) {
              valid_mask |= SCR_ATA;
          }
 +        if (cpu_isar_feature(aa64_scxtnum, cpu)) {
 +            valid_mask |= SCR_ENSCXT;
 +        }
      } else {
          valid_mask &= ~(SCR_RW | SCR_ST);
          if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
          if (cpu_isar_feature(aa64_mte, cpu)) {
              valid_mask |= HCR_ATA | HCR_DCT | HCR_TID5;
          }
 +        if (cpu_isar_feature(aa64_scxtnum, cpu)) {
 +            valid_mask |= HCR_ENSCXT;
 +        }
      }
-     /* Clear RES0 bits.  */
+@@ -XXX,XX +XXX,XX @@ static size_t stream_process_s2mem(struct Stream *s, unsigned char *buf,
-@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
+     unsigned int rxlen;
-         { K(3, 0,  5, 6, 0), K(3, 4,  5, 6, 0), K(3, 5, 5, 6, 0),
+     size_t pos = 0;
-           "TFSR_EL1", "TFSR_EL2", "TFSR_EL12", isar_feature_aa64_mte },
+-    if (!stream_running(s) || stream_idle(s)) {
-+        { K(3, 0, 13, 0, 7), K(3, 4, 13, 0, 7), K(3, 5, 13, 0, 7),
++    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
-+          "SCXTNUM_EL1", "SCXTNUM_EL2", "SCXTNUM_EL12",
+         return 0;
 +          isar_feature_aa64_scxtnum },
 +
          /* TODO: ARMv8.2-SPE -- PMSCR_EL2 */
          /* TODO: ARMv8.4-Trace -- TRFCR_EL2 */
      };
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo mte_el0_cacheop_reginfo[] = {
      },
  };
 -#endif
 +static CPAccessResult access_scxtnum(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                     bool isread)
 +{
 +    uint64_t hcr = arm_hcr_el2_eff(env);
 +    int el = arm_current_el(env);
 +
 +    if (el == 0 && !((hcr & HCR_E2H) && (hcr & HCR_TGE))) {
 +        if (env->cp15.sctlr_el[1] & SCTLR_TSCXT) {
 +            if (hcr & HCR_TGE) {
 +                return CP_ACCESS_TRAP_EL2;
 +            }
 +            return CP_ACCESS_TRAP;
 +        }
 +    } else if (el < 2 && (env->cp15.sctlr_el[2] & SCTLR_TSCXT)) {
 +        return CP_ACCESS_TRAP_EL2;
 +    }
 +    if (el < 2 && arm_is_el2_enabled(env) && !(hcr & HCR_ENSCXT)) {
 +        return CP_ACCESS_TRAP_EL2;
 +    }
 +    if (el < 3
 +        && arm_feature(env, ARM_FEATURE_EL3)
 +        && !(env->cp15.scr_el3 & SCR_ENSCXT)) {
 +        return CP_ACCESS_TRAP_EL3;
 +    }
 +    return CP_ACCESS_OK;
 +}
 +
 +static const ARMCPRegInfo scxtnum_reginfo[] = {
 +    { .name = "SCXTNUM_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 7,
 +      .access = PL0_RW, .accessfn = access_scxtnum,
 +      .fieldoffset = offsetof(CPUARMState, scxtnum_el[0]) },
 +    { .name = "SCXTNUM_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 7,
 +      .access = PL1_RW, .accessfn = access_scxtnum,
 +      .fieldoffset = offsetof(CPUARMState, scxtnum_el[1]) },
 +    { .name = "SCXTNUM_EL2", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 7,
 +      .access = PL2_RW, .accessfn = access_scxtnum,
 +      .fieldoffset = offsetof(CPUARMState, scxtnum_el[2]) },
 +    { .name = "SCXTNUM_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 7,
 +      .access = PL3_RW,
 +      .fieldoffset = offsetof(CPUARMState, scxtnum_el[3]) },
 +};
 +#endif /* TARGET_AARCH64 */
  static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri,
                                       bool isread)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
          define_arm_cp_regs(cpu, mte_tco_ro_reginfo);
          define_arm_cp_regs(cpu, mte_el0_cacheop_reginfo);
      }
-+
-+    if (cpu_isar_feature(aa64_scxtnum, cpu)) {
+@@ -XXX,XX +XXX,XX @@ xilinx_axidma_data_stream_can_push(StreamSink *obj,
-+        define_arm_cp_regs(cpu, scxtnum_reginfo);
+     XilinxAXIDMAStreamSink *ds = XILINX_AXI_DMA_DATA_STREAM(obj);
-+    }
+     struct Stream *s = &ds->dma->streams[1];
- #endif
+-    if (!stream_running(s) || stream_idle(s)) {
-     if (cpu_isar_feature(any_predinv, cpu)) {
++    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
          ds->dma->notify = notify;
          ds->dma->notify_opaque = notify_opaque;
          return false;
 --
-.25.1
+.34.1

-[PULL 28/32] qtest/numa-test: Specify CPU topology in aarch64_numa_cpu()
+[PULL 13/21] hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
-From: Gavin Shan <gshan@redhat.com>
+From: Clément Chigot <chigot@adacore.com>
-The CPU topology isn't enabled on arm/virt machine yet, but we're
+When passing --smp with a number lower than XLNX_ZYNQMP_NUM_APU_CPUS,
-going to do it in next patch. After the CPU topology is enabled by
+the expression (ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS) will result
-next patch, "thread-id=1" becomes invalid because the CPU core is
+in a positive number as ms->smp.cpus is a unsigned int.
-preferred on arm/virt machine. It means these two CPUs have 0/1
+This will raise the following error afterwards, as Qemu will try to
-as their core IDs, but their thread IDs are all 0. It will trigger
+instantiate some additional RPUs.
-test failure as the following message indicates:
+  | $ qemu-system-aarch64 --smp 1 -M xlnx-zcu102
   | **
   | ERROR:../src/tcg/tcg.c:777:tcg_register_thread:
   |   assertion failed: (n < tcg_max_ctxs)
-  [14/21 qemu:qtest+qtest-aarch64 / qtest-aarch64/numa-test  ERROR
+Signed-off-by: Clément Chigot <chigot@adacore.com>
-.48s   killed by signal 6 SIGABRT
+Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-  >>> G_TEST_DBUS_DAEMON=/home/gavin/sandbox/qemu.main/tests/dbus-vmstate-daemon.sh \
+Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-      QTEST_QEMU_STORAGE_DAEMON_BINARY=./storage-daemon/qemu-storage-daemon         \
+Message-id: 20230524143714.565792-1-chigot@adacore.com
       QTEST_QEMU_BINARY=./qemu-system-aarch64                                       \
       QTEST_QEMU_IMG=./qemu-img MALLOC_PERTURB_=83                                  \
       /home/gavin/sandbox/qemu.main/build/tests/qtest/numa-test --tap -k
   ――――――――――――――――――――――――――――――――――――――――――――――
   stderr:
   qemu-system-aarch64: -numa cpu,node-id=0,thread-id=1: no match found
 This fixes the issue by providing comprehensive SMP configurations
 in aarch64_numa_cpu(). The SMP configurations aren't used before
 the CPU topology is enabled in next patch.
 Signed-off-by: Gavin Shan <gshan@redhat.com>
 Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
 Message-id: 20220503140304.855514-3-gshan@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/numa-test.c | 3 ++-
+ hw/arm/xlnx-zynqmp.c | 2 +-
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tests/qtest/numa-test.c b/tests/qtest/numa-test.c
+diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/numa-test.c
+--- a/hw/arm/xlnx-zynqmp.c
-+++ b/tests/qtest/numa-test.c
++++ b/hw/arm/xlnx-zynqmp.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_numa_cpu(const void *data)
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(MachineState *ms, XlnxZynqMPState *s,
-     QTestState *qts;
+                                    const char *boot_cpu, Error **errp)
-     g_autofree char *cli = NULL;
+ {
+     int i;
--    cli = make_cli(data, "-machine smp.cpus=2 "
+-    int num_rpus = MIN(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS,
-+    cli = make_cli(data, "-machine "
++    int num_rpus = MIN((int)(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS),
-+        "smp.cpus=2,smp.sockets=1,smp.clusters=1,smp.cores=1,smp.threads=2 "
+                        XLNX_ZYNQMP_NUM_RPU_CPUS);
-         "-numa node,nodeid=0,memdev=ram -numa node,nodeid=1 "
-         "-numa cpu,node-id=1,thread-id=0 "
+     if (num_rpus <= 0) {
          "-numa cpu,node-id=0,thread-id=1");
 --
-.25.1
+.34.1

-[PULL 24/32] target/arm: Define cortex-a76
+[PULL 14/21] tests/qtest: Run arm-specific tests only if the required machine is available
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Thomas Huth <thuth@redhat.com>
-Enable the a76 for virt and sbsa board use.
+pflash-cfi02-test.c always uses the "musicpal" machine for testing,
 test-arm-mptimer.c always uses the "vexpress-a9" machine, and
 microbit-test.c requires the "microbit" machine, so we should only
 run these tests if the machines have been enabled in the configuration.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Message-id: 20220506180242.216785-24-richard.henderson@linaro.org
+Message-id: 20230524080600.1618137-1-thuth@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/virt.rst |  1 +
+ tests/qtest/meson.build | 7 ++++---
- hw/arm/sbsa-ref.c        |  1 +
+file changed, 4 insertions(+), 3 deletions(-)
  hw/arm/virt.c            |  1 +
  target/arm/cpu64.c       | 66 ++++++++++++++++++++++++++++++++++++++++
 files changed, 69 insertions(+)
-diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/virt.rst
+--- a/tests/qtest/meson.build
-+++ b/docs/system/arm/virt.rst
++++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ Supported guest CPU types:
+@@ -XXX,XX +XXX,XX @@ qtests_arm = \
- - ``cortex-a53`` (64-bit)
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
- - ``cortex-a57`` (64-bit)
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
- - ``cortex-a72`` (64-bit)
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
-+- ``cortex-a76`` (64-bit)
+-  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
- - ``a64fx`` (64-bit)
++  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') and
- - ``host`` (with KVM only)
++   config_all_devices.has_key('CONFIG_MUSICPAL') ? ['pflash-cfi02-test'] : []) + \
- - ``max`` (same as ``host`` for KVM; best possible emulation with TCG)
+   (config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed : []) + \
-diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
+   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
-index XXXXXXX..XXXXXXX 100644
+   (config_all_devices.has_key('CONFIG_GENERIC_LOADER') ? ['hexloader-test'] : []) + \
---- a/hw/arm/sbsa-ref.c
+   (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \
-+++ b/hw/arm/sbsa-ref.c
++  (config_all_devices.has_key('CONFIG_VEXPRESS') ? ['test-arm-mptimer'] : []) + \
-@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {
++  (config_all_devices.has_key('CONFIG_MICROBIT') ? ['microbit-test'] : []) + \
- static const char * const valid_cpus[] = {
+   ['arm-cpu-features',
-     ARM_CPU_TYPE_NAME("cortex-a57"),
+-   'microbit-test',
-     ARM_CPU_TYPE_NAME("cortex-a72"),
+-   'test-arm-mptimer',
-+    ARM_CPU_TYPE_NAME("cortex-a76"),
+    'boot-serial-test']
-     ARM_CPU_TYPE_NAME("max"),
- };
+ # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static const char *valid_cpus[] = {
      ARM_CPU_TYPE_NAME("cortex-a53"),
      ARM_CPU_TYPE_NAME("cortex-a57"),
      ARM_CPU_TYPE_NAME("cortex-a72"),
 +    ARM_CPU_TYPE_NAME("cortex-a76"),
      ARM_CPU_TYPE_NAME("a64fx"),
      ARM_CPU_TYPE_NAME("host"),
      ARM_CPU_TYPE_NAME("max"),
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
      define_cortex_a72_a57_a53_cp_reginfo(cpu);
  }
 +static void aarch64_a76_initfn(Object *obj)
 +{
 +    ARMCPU *cpu = ARM_CPU(obj);
 +
 +    cpu->dtb_compatible = "arm,cortex-a76";
 +    set_feature(&cpu->env, ARM_FEATURE_V8);
 +    set_feature(&cpu->env, ARM_FEATURE_NEON);
 +    set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
 +    set_feature(&cpu->env, ARM_FEATURE_AARCH64);
 +    set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
 +    set_feature(&cpu->env, ARM_FEATURE_EL2);
 +    set_feature(&cpu->env, ARM_FEATURE_EL3);
 +    set_feature(&cpu->env, ARM_FEATURE_PMU);
 +
 +    /* Ordered by B2.4 AArch64 registers by functional group */
 +    cpu->clidr = 0x82000023;
 +    cpu->ctr = 0x8444C004;
 +    cpu->dcz_blocksize = 4;
 +    cpu->isar.id_aa64dfr0  = 0x0000000010305408ull;
 +    cpu->isar.id_aa64isar0 = 0x0000100010211120ull;
 +    cpu->isar.id_aa64isar1 = 0x0000000000100001ull;
 +    cpu->isar.id_aa64mmfr0 = 0x0000000000101122ull;
 +    cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
 +    cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
 +    cpu->isar.id_aa64pfr0  = 0x1100000010111112ull; /* GIC filled in later */
 +    cpu->isar.id_aa64pfr1  = 0x0000000000000010ull;
 +    cpu->id_afr0       = 0x00000000;
 +    cpu->isar.id_dfr0  = 0x04010088;
 +    cpu->isar.id_isar0 = 0x02101110;
 +    cpu->isar.id_isar1 = 0x13112111;
 +    cpu->isar.id_isar2 = 0x21232042;
 +    cpu->isar.id_isar3 = 0x01112131;
 +    cpu->isar.id_isar4 = 0x00010142;
 +    cpu->isar.id_isar5 = 0x01011121;
 +    cpu->isar.id_isar6 = 0x00000010;
 +    cpu->isar.id_mmfr0 = 0x10201105;
 +    cpu->isar.id_mmfr1 = 0x40000000;
 +    cpu->isar.id_mmfr2 = 0x01260000;
 +    cpu->isar.id_mmfr3 = 0x02122211;
 +    cpu->isar.id_mmfr4 = 0x00021110;
 +    cpu->isar.id_pfr0  = 0x10010131;
 +    cpu->isar.id_pfr1  = 0x00010000; /* GIC filled in later */
 +    cpu->isar.id_pfr2  = 0x00000011;
 +    cpu->midr = 0x414fd0b1;          /* r4p1 */
 +    cpu->revidr = 0;
 +
 +    /* From B2.18 CCSIDR_EL1 */
 +    cpu->ccsidr[0] = 0x701fe01a; /* 64KB L1 dcache */
 +    cpu->ccsidr[1] = 0x201fe01a; /* 64KB L1 icache */
 +    cpu->ccsidr[2] = 0x707fe03a; /* 512KB L2 cache */
 +
 +    /* From B2.93 SCTLR_EL3 */
 +    cpu->reset_sctlr = 0x30c50838;
 +
 +    /* From B4.23 ICH_VTR_EL2 */
 +    cpu->gic_num_lrs = 4;
 +    cpu->gic_vpribits = 5;
 +    cpu->gic_vprebits = 5;
 +
 +    /* From B5.1 AdvSIMD AArch64 register summary */
 +    cpu->isar.mvfr0 = 0x10110222;
 +    cpu->isar.mvfr1 = 0x13211111;
 +    cpu->isar.mvfr2 = 0x00000043;
 +}
 +
  void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
  {
      /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo aarch64_cpus[] = {
      { .name = "cortex-a57",         .initfn = aarch64_a57_initfn },
      { .name = "cortex-a53",         .initfn = aarch64_a53_initfn },
      { .name = "cortex-a72",         .initfn = aarch64_a72_initfn },
 +    { .name = "cortex-a76",         .initfn = aarch64_a76_initfn },
      { .name = "a64fx",              .initfn = aarch64_a64fx_initfn },
      { .name = "max",                .initfn = aarch64_max_initfn },
  #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
 --
-.25.1
+.34.1

-[PULL 23/32] target/arm: Enable FEAT_DGH for -cpu max
+[PULL 15/21] target/arm: Explicitly select short-format FSR for M-profile
-From: Richard Henderson <richard.henderson@linaro.org>
+For M-profile, there is no guest-facing A-profile format FSR, but we
 still use the env->exception.fsr field to pass fault information from
 the point where a fault is raised to the code in
 arm_v7m_cpu_do_interrupt() which interprets it and sets the M-profile
 specific fault status registers.  So it doesn't matter whether we
 fill in env->exception.fsr in the short format or the LPAE format, as
 long as both sides agree.  As it happens arm_v7m_cpu_do_interrupt()
 assumes short-form.
-This extension concerns not merging memory access, which TCG does
+In compute_fsr_fsc() we weren't explicitly choosing short-form for
-not implement.  Thus we can trivially enable this feature.
+M-profile, but instead relied on it falling out in the wash because
-Add a comment to handle_hint for the DGH instruction, but no code.
+arm_s1_regime_using_lpae_format() would be false.  This was broken in
 commit 452c67a4 when we added v8R support, because we said "PMSAv8 is
 always LPAE format" (as it is for v8R), forgetting that we were
 implicitly using this code path on M-profile. At that point we would
 hit a g_assert_not_reached():
  ERROR:../../target/arm/internals.h:549:arm_fi_to_lfsc: code should not be reached
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+#7  0x0000555555e055f7 in arm_fi_to_lfsc (fi=0x7fffecff9a90) at ../../target/arm/internals.h:549
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+#8  0x0000555555e05a27 in compute_fsr_fsc (env=0x555557356670, fi=0x7fffecff9a90, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff9a1c)
-Message-id: 20220506180242.216785-23-richard.henderson@linaro.org
+    at ../../target/arm/tlb_helper.c:95
 #9  0x0000555555e05b62 in arm_deliver_fault (cpu=0x555557354800, addr=268961344, access_type=MMU_INST_FETCH, mmu_idx=1, fi=0x7fffecff9a90)
     at ../../target/arm/tlb_helper.c:132
 #10 0x0000555555e06095 in arm_cpu_tlb_fill (cs=0x555557354800, address=268961344, size=1, access_type=MMU_INST_FETCH, mmu_idx=1, probe=false, retaddr=0)
     at ../../target/arm/tlb_helper.c:260
 The specific assertion changed when commit fcc7404eff24b4c added
 "assert not M-profile" to arm_is_secure_below_el3(), because the
 conditions being checked in compute_fsr_fsc() include
 arm_el_is_aa64(), which will end up calling arm_is_secure_below_el3()
 and asserting before we try to call arm_fi_to_lfsc():
 #7  0x0000555555efaf43 in arm_is_secure_below_el3 (env=0x5555574665a0) at ../../target/arm/cpu.h:2396
 #8  0x0000555555efb103 in arm_is_el2_enabled (env=0x5555574665a0) at ../../target/arm/cpu.h:2448
 #9  0x0000555555efb204 in arm_el_is_aa64 (env=0x5555574665a0, el=1) at ../../target/arm/cpu.h:2509
 #10 0x0000555555efbdfd in compute_fsr_fsc (env=0x5555574665a0, fi=0x7fffecff99e0, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff996c)
 Avoid the assertion and the incorrect FSR format selection by
 explicitly making M-profile use the short-format in this function.
 Fixes: 452c67a42704 ("target/arm: Enable TTBCR_EAE for ARMv8-R AArch32")a
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1658
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230523131726.866635-1-peter.maydell@linaro.org
 ---
- docs/system/arm/emulation.rst | 1 +
+ target/arm/tcg/tlb_helper.c | 13 +++++++++++--
- target/arm/cpu64.c            | 1 +
+file changed, 11 insertions(+), 2 deletions(-)
  target/arm/translate-a64.c    | 1 +
 files changed, 3 insertions(+)
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
+diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/emulation.rst
+--- a/target/arm/tcg/tlb_helper.c
-+++ b/docs/system/arm/emulation.rst
++++ b/target/arm/tcg/tlb_helper.c
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
+@@ -XXX,XX +XXX,XX @@ static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
- - FEAT_CSV2_1p2 (Cache speculation variant 2, version 1.2)
+     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
- - FEAT_CSV2_2 (Cache speculation variant 2, version 2)
+     uint32_t fsr, fsc;
- - FEAT_CSV3 (Cache speculation variant 3)
-+- FEAT_DGH (Data gathering hint)
+-    if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
- - FEAT_DIT (Data Independent Timing instructions)
+-        arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
- - FEAT_DPB (DC CVAP instruction)
++    /*
- - FEAT_Debugv8p2 (Debug changes for v8.2)
++     * For M-profile there is no guest-facing FSR. We compute a
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
++     * short-form value for env->exception.fsr which we will then
-index XXXXXXX..XXXXXXX 100644
++     * examine in arm_v7m_cpu_do_interrupt(). In theory we could
---- a/target/arm/cpu64.c
++     * use the LPAE format instead as long as both bits of code agree
-+++ b/target/arm/cpu64.c
++     * (and arm_fi_to_lfsc() handled the M-profile specific
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
++     * ARMFault_QEMU_NSCExec and ARMFault_QEMU_SFault cases).
-     t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);       /* FEAT_SB */
++     */
-     t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);  /* FEAT_SPECRES */
++    if (!arm_feature(env, ARM_FEATURE_M) &&
-     t = FIELD_DP64(t, ID_AA64ISAR1, BF16, 1);     /* FEAT_BF16 */
++        (target_el == 2 || arm_el_is_aa64(env, target_el) ||
-+    t = FIELD_DP64(t, ID_AA64ISAR1, DGH, 1);      /* FEAT_DGH */
++         arm_s1_regime_using_lpae_format(env, arm_mmu_idx))) {
-     t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 1);     /* FEAT_I8MM */
+         /*
-     cpu->isar.id_aa64isar1 = t;
+          * LPAE format fault status register : bottom 6 bits are
+          * status code in the same form as needed for syndrome
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-a64.c
 +++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_hint(DisasContext *s, uint32_t insn,
          break;
      case 0b00100: /* SEV */
      case 0b00101: /* SEVL */
 +    case 0b00110: /* DGH */
          /* we treat all as NOP at least for now */
          break;
      case 0b00111: /* XPACLRI */
 --
-.25.1
+.34.1

-[PULL 01/32] MAINTAINERS/.mailmap: update email for Leif Lindholm
+[PULL 16/21] target/arm: Explain why we need to select ARM_V7M
-From: Leif Lindholm <quic_llindhol@quicinc.com>
+From: Fabiano Rosas <farosas@suse.de>
-NUVIA was acquired by Qualcomm in March 2021, but kept functioning on
+We currently need to select ARM_V7M unconditionally when TCG is
-separate infrastructure for a transitional period. We've now switched
+present in the build because some translate.c helpers and the whole of
-over to contributing as Qualcomm Innovation Center (quicinc), so update
+m_helpers.c are not yet under CONFIG_ARM_V7M.
 my email address to reflect this.
-Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
+Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20220505113740.75565-1-quic_llindhol@quicinc.com
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Cc: Leif Lindholm <leif@nuviainc.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Cc: Peter Maydell <peter.maydell@linaro.org>
+Message-id: 20230523180525.29994-2-farosas@suse.de
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 [Fixed commit message typo]
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- .mailmap    | 3 ++-
+ target/arm/Kconfig | 3 +++
- MAINTAINERS | 2 +-
+file changed, 3 insertions(+)
 files changed, 3 insertions(+), 2 deletions(-)
-diff --git a/.mailmap b/.mailmap
+diff --git a/target/arm/Kconfig b/target/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/.mailmap
+--- a/target/arm/Kconfig
-+++ b/.mailmap
++++ b/target/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>
+@@ -XXX,XX +XXX,XX @@
- Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
+ config ARM
- Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
+     bool
- James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
+     select ARM_COMPATIBLE_SEMIHOSTING if TCG
--Leif Lindholm <leif@nuviainc.com> <leif.lindholm@linaro.org>
++
-+Leif Lindholm <quic_llindhol@quicinc.com> <leif.lindholm@linaro.org>
++    # We need to select this until we move m_helper.c and the
-+Leif Lindholm <quic_llindhol@quicinc.com> <leif@nuviainc.com>
++    # translate.c v7m helpers under ARM_V7M.
- Radoslaw Biernacki <rad@semihalf.com> <radoslaw.biernacki@linaro.org>
+     select ARM_V7M if TCG
- Paul Burton <paulburton@kernel.org> <paul.burton@mips.com>
- Paul Burton <paulburton@kernel.org> <paul.burton@imgtec.com>
+ config AARCH64
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/ssi/imx_spi.h
  SBSA-REF
  M: Radoslaw Biernacki <rad@semihalf.com>
  M: Peter Maydell <peter.maydell@linaro.org>
 -R: Leif Lindholm <leif@nuviainc.com>
 +R: Leif Lindholm <quic_llindhol@quicinc.com>
  L: qemu-arm@nongnu.org
  S: Maintained
  F: hw/arm/sbsa-ref.c
 --
-.25.1
+.34.1

-[PULL 03/32] target/arm: Drop EL3 no EL2 fallbacks
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Drop el3_no_el2_cp_reginfo, el3_no_el2_v8_cp_reginfo, and the local
-vpidr_regs definition, and rely on the squashing to ARM_CP_CONST
-while registering for v8.
-This is a behavior change for v7 cpus with Security Extensions and
-without Virtualization Extensions, in that the virtualization cpregs
-are now correctly not present.  This would be a migration compatibility
-break, except that we have an existing bug in which migration of 32-bit
-cpus with Security Extensions enabled does not work.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-3-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 158 ++++----------------------------------------
-file changed, 13 insertions(+), 145 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
-       .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
- };
--/* Used to describe the behaviour of EL2 regs when EL2 does not exist.  */
--static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
--    { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
--      .access = PL2_RW,
--      .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
--    { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
--      .access = PL2_RW,
--      .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
--      .access = PL2_RW,
--      .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
--      .access = PL2_RW, .type = ARM_CP_CONST,
--      .resetvalue = 0 },
--    { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
--      .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
--      .access = PL2_RW, .type = ARM_CP_CONST,
--      .resetvalue = 0 },
--    { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
--      .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
--      .access = PL2_RW, .type = ARM_CP_CONST,
--      .resetvalue = 0 },
--    { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
--      .access = PL2_RW, .type = ARM_CP_CONST,
--      .resetvalue = 0 },
--    { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
--      .access = PL2_RW, .type = ARM_CP_CONST,
--      .resetvalue = 0 },
--    { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
--      .access = PL2_RW, .accessfn = access_el3_aa32ns,
--      .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
--      .cp = 15, .opc1 = 6, .crm = 2,
--      .access = PL2_RW, .accessfn = access_el3_aa32ns,
--      .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
--    { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
--      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
--      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
--      .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
--      .resetvalue = 0 },
--    { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
--      .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
--      .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
--      .resetvalue = 0 },
--    { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
--      .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
--      .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
--      .resetvalue = 0 },
--    { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
--      .access = PL2_RW, .accessfn = access_tda,
--      .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
--      .access = PL2_RW, .accessfn = access_el3_aa32ns,
--      .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
--      .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
--      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
--    { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
--      .type = ARM_CP_CONST,
--      .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
--      .access = PL2_RW, .resetvalue = 0 },
--};
--
--/* Ditto, but for registers which exist in ARMv8 but not v7 */
--static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {
--    { .name = "HCR2", .state = ARM_CP_STATE_AA32,
--      .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
--      .access = PL2_RW,
--      .type = ARM_CP_CONST, .resetvalue = 0 },
--};
--
- static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
- {
-     ARMCPU *cpu = env_archcpu(env);
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-         define_arm_cp_regs(cpu, v8_idregs);
-         define_arm_cp_regs(cpu, v8_cp_reginfo);
-     }
--    if (arm_feature(env, ARM_FEATURE_EL2)) {
-+
-+    /*
-+     * Register the base EL2 cpregs.
-+     * Pre v8, these registers are implemented only as part of the
-+     * Virtualization Extensions (EL2 present).  Beginning with v8,
-+     * if EL2 is missing but EL3 is enabled, mostly these become
-+     * RES0 from EL3, with some specific exceptions.
-+     */
-+    if (arm_feature(env, ARM_FEATURE_EL2)
-+        || (arm_feature(env, ARM_FEATURE_EL3)
-+            && arm_feature(env, ARM_FEATURE_V8))) {
-         uint64_t vmpidr_def = mpidr_read_val(env);
-         ARMCPRegInfo vpidr_regs[] = {
-             { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-             };
-             define_one_arm_cp_reg(cpu, &rvbar);
-         }
--    } else {
--        /* If EL2 is missing but higher ELs are enabled, we need to
--         * register the no_el2 reginfos.
--         */
--        if (arm_feature(env, ARM_FEATURE_EL3)) {
--            /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value
--             * of MIDR_EL1 and MPIDR_EL1.
--             */
--            ARMCPRegInfo vpidr_regs[] = {
--                { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH,
--                  .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
--                  .access = PL2_RW, .accessfn = access_el3_aa32ns,
--                  .type = ARM_CP_CONST, .resetvalue = cpu->midr,
--                  .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
--                { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH,
--                  .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
--                  .access = PL2_RW, .accessfn = access_el3_aa32ns,
--                  .type = ARM_CP_NO_RAW,
--                  .writefn = arm_cp_write_ignore, .readfn = mpidr_read },
--            };
--            define_arm_cp_regs(cpu, vpidr_regs);
--            define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo);
--            if (arm_feature(env, ARM_FEATURE_V8)) {
--                define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo);
--            }
--        }
-     }
-+
-+    /* Register the base EL3 cpregs. */
-     if (arm_feature(env, ARM_FEATURE_EL3)) {
-         define_arm_cp_regs(cpu, el3_cp_reginfo);
-         ARMCPRegInfo el3_regs[] = {
---
-.25.1

-[PULL 22/32] target/arm: Enable FEAT_CSV3 for -cpu max
+[PULL 17/21] arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Fabiano Rosas <farosas@suse.de>
-This extension concerns cache speculation, which TCG does
+When we moved the arm default CONFIGs into Kconfig and removed them
-not implement.  Thus we can trivially enable this feature.
+from default.mak, we made it harder to identify which CONFIGs are
 selected by default in case users want to disable them.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Bring back the default entries into default.mak, but keep them
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+commented out. This way users can keep their workflows of editing
-Message-id: 20220506180242.216785-22-richard.henderson@linaro.org
+default.mak to remove build options without needing to search through
 Kconfig.
 Reported-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Message-id: 20230523180525.29994-3-farosas@suse.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/emulation.rst | 1 +
+ configs/devices/aarch64-softmmu/default.mak |  6 ++++
- target/arm/cpu64.c            | 1 +
+ configs/devices/arm-softmmu/default.mak     | 40 +++++++++++++++++++++
- target/arm/cpu_tcg.c          | 1 +
+files changed, 46 insertions(+)
 files changed, 3 insertions(+)
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
+diff --git a/configs/devices/aarch64-softmmu/default.mak b/configs/devices/aarch64-softmmu/default.mak
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/emulation.rst
+--- a/configs/devices/aarch64-softmmu/default.mak
-+++ b/docs/system/arm/emulation.rst
++++ b/configs/devices/aarch64-softmmu/default.mak
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
+@@ -XXX,XX +XXX,XX @@
- - FEAT_CSV2_1p1 (Cache speculation variant 2, version 1.1)
- - FEAT_CSV2_1p2 (Cache speculation variant 2, version 1.2)
+ # We support all the 32 bit boards so need all their config
- - FEAT_CSV2_2 (Cache speculation variant 2, version 2)
+ include ../arm-softmmu/default.mak
-+- FEAT_CSV3 (Cache speculation variant 3)
++
- - FEAT_DIT (Data Independent Timing instructions)
++# These are selected by default when TCG is enabled, uncomment them to
- - FEAT_DPB (DC CVAP instruction)
++# keep out of the build.
- - FEAT_Debugv8p2 (Debug changes for v8.2)
++# CONFIG_XLNX_ZYNQMP_ARM=n
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
++# CONFIG_XLNX_VERSAL=n
 +# CONFIG_SBSA_REF=n
 diff --git a/configs/devices/arm-softmmu/default.mak b/configs/devices/arm-softmmu/default.mak
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
+--- a/configs/devices/arm-softmmu/default.mak
-+++ b/target/arm/cpu64.c
++++ b/configs/devices/arm-softmmu/default.mak
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@
-     t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1);      /* FEAT_SEL2 */
+ # CONFIG_TEST_DEVICES=n
-     t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1);       /* FEAT_DIT */
-     t = FIELD_DP64(t, ID_AA64PFR0, CSV2, 2);      /* FEAT_CSV2_2 */
+ CONFIG_ARM_VIRT=y
-+    t = FIELD_DP64(t, ID_AA64PFR0, CSV3, 1);      /* FEAT_CSV3 */
++
-     cpu->isar.id_aa64pfr0 = t;
++# These are selected by default when TCG is enabled, uncomment them to
++# keep out of the build.
-     t = cpu->isar.id_aa64pfr1;
++# CONFIG_CUBIEBOARD=n
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
++# CONFIG_EXYNOS4=n
-index XXXXXXX..XXXXXXX 100644
++# CONFIG_HIGHBANK=n
---- a/target/arm/cpu_tcg.c
++# CONFIG_INTEGRATOR=n
-+++ b/target/arm/cpu_tcg.c
++# CONFIG_FSL_IMX31=n
-@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
++# CONFIG_MUSICPAL=n
-     cpu->isar.id_pfr0 = t;
++# CONFIG_MUSCA=n
++# CONFIG_CHEETAH=n
-     t = cpu->isar.id_pfr2;
++# CONFIG_SX1=n
-+    t = FIELD_DP32(t, ID_PFR2, CSV3, 1);          /* FEAT_CSV3 */
++# CONFIG_NSERIES=n
-     t = FIELD_DP32(t, ID_PFR2, SSBS, 1);          /* FEAT_SSBS */
++# CONFIG_STELLARIS=n
-     cpu->isar.id_pfr2 = t;
++# CONFIG_STM32VLDISCOVERY=n
++# CONFIG_REALVIEW=n
 +# CONFIG_VERSATILE=n
 +# CONFIG_VEXPRESS=n
 +# CONFIG_ZYNQ=n
 +# CONFIG_MAINSTONE=n
 +# CONFIG_GUMSTIX=n
 +# CONFIG_SPITZ=n
 +# CONFIG_TOSA=n
 +# CONFIG_Z2=n
 +# CONFIG_NPCM7XX=n
 +# CONFIG_COLLIE=n
 +# CONFIG_ASPEED_SOC=n
 +# CONFIG_NETDUINO2=n
 +# CONFIG_NETDUINOPLUS2=n
 +# CONFIG_OLIMEX_STM32_H405=n
 +# CONFIG_MPS2=n
 +# CONFIG_RASPI=n
 +# CONFIG_DIGIC=n
 +# CONFIG_SABRELITE=n
 +# CONFIG_EMCRAFT_SF2=n
 +# CONFIG_MICROBIT=n
 +# CONFIG_FSL_IMX25=n
 +# CONFIG_FSL_IMX7=n
 +# CONFIG_FSL_IMX6UL=n
 +# CONFIG_ALLWINNER_H3=n
 --
-.25.1
+.34.1

-[PULL 07/32] target/arm: Update qemu-system-arm -cpu max to cortex-a57
+[PULL 18/21] arm/Kconfig: Make TCG dependence explicit
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Fabiano Rosas <farosas@suse.de>
-Instead of starting with cortex-a15 and adding v8 features to
+Replace the 'default y if TCG' pattern with 'default y; depends on
-a v7 cpu, begin with a v8 cpu stripped of its aarch64 features.
+TCG'.
-This fixes the long-standing to-do where we only enabled v8
-features for user-only.
+That makes explict that there is a dependence on TCG and enabling
+these CONFIGs via .mak files without TCG present will fail earlier.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-id: 20220506180242.216785-7-richard.henderson@linaro.org
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20230523180525.29994-4-farosas@suse.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu_tcg.c | 151 ++++++++++++++++++++++++++-----------------
+ hw/arm/Kconfig | 123 ++++++++++++++++++++++++++++++++-----------------
-file changed, 92 insertions(+), 59 deletions(-)
+file changed, 82 insertions(+), 41 deletions(-)
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu_tcg.c
+--- a/hw/arm/Kconfig
-+++ b/target/arm/cpu_tcg.c
++++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
- static void arm_max_initfn(Object *obj)
- {
+ config CHEETAH
-     ARMCPU *cpu = ARM_CPU(obj);
+     bool
-+    uint32_t t;
+-    default y if TCG && ARM
++    default y
--    cortex_a15_initfn(obj);
++    depends on TCG && ARM
-+    /* aarch64_a57_initfn, advertising none of the aarch64 features */
+     select OMAP
-+    cpu->dtb_compatible = "arm,cortex-a57";
+     select TSC210X
-+    set_feature(&cpu->env, ARM_FEATURE_V8);
-+    set_feature(&cpu->env, ARM_FEATURE_NEON);
+ config CUBIEBOARD
-+    set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
+     bool
-+    set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+-    default y if TCG && ARM
-+    set_feature(&cpu->env, ARM_FEATURE_EL2);
++    default y
-+    set_feature(&cpu->env, ARM_FEATURE_EL3);
++    depends on TCG && ARM
-+    set_feature(&cpu->env, ARM_FEATURE_PMU);
+     select ALLWINNER_A10
-+    cpu->midr = 0x411fd070;
-+    cpu->revidr = 0x00000000;
+ config DIGIC
-+    cpu->reset_fpsid = 0x41034070;
+     bool
-+    cpu->isar.mvfr0 = 0x10110222;
+-    default y if TCG && ARM
-+    cpu->isar.mvfr1 = 0x12111111;
++    default y
-+    cpu->isar.mvfr2 = 0x00000043;
++    depends on TCG && ARM
-+    cpu->ctr = 0x8444c004;
+     select PTIMER
-+    cpu->reset_sctlr = 0x00c50838;
+     select PFLASH_CFI02
-+    cpu->isar.id_pfr0 = 0x00000131;
-+    cpu->isar.id_pfr1 = 0x00011011;
+ config EXYNOS4
-+    cpu->isar.id_dfr0 = 0x03010066;
+     bool
-+    cpu->id_afr0 = 0x00000000;
+-    default y if TCG && ARM
-+    cpu->isar.id_mmfr0 = 0x10101105;
++    default y
-+    cpu->isar.id_mmfr1 = 0x40000000;
++    depends on TCG && ARM
-+    cpu->isar.id_mmfr2 = 0x01260000;
+     imply I2C_DEVICES
-+    cpu->isar.id_mmfr3 = 0x02102211;
+     select A9MPCORE
-+    cpu->isar.id_isar0 = 0x02101110;
+     select I2C
-+    cpu->isar.id_isar1 = 0x13112111;
+@@ -XXX,XX +XXX,XX @@ config EXYNOS4
-+    cpu->isar.id_isar2 = 0x21232042;
-+    cpu->isar.id_isar3 = 0x01112131;
+ config HIGHBANK
-+    cpu->isar.id_isar4 = 0x00011142;
+     bool
-+    cpu->isar.id_isar5 = 0x00011121;
+-    default y if TCG && ARM
-+    cpu->isar.id_isar6 = 0;
++    default y
-+    cpu->isar.dbgdidr = 0x3516d000;
++    depends on TCG && ARM
-+    cpu->clidr = 0x0a200023;
+     select A9MPCORE
-+    cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
+     select A15MPCORE
-+    cpu->ccsidr[1] = 0x201fe012; /* 48KB L1 icache */
+     select AHCI
-+    cpu->ccsidr[2] = 0x70ffe07a; /* 2048KB L2 cache */
+@@ -XXX,XX +XXX,XX @@ config HIGHBANK
-+    define_cortex_a72_a57_a53_cp_reginfo(cpu);
+ config INTEGRATOR
--    /* old-style VFP short-vector support */
+     bool
--    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
+-    default y if TCG && ARM
-+    /* Add additional features supported by QEMU */
++    default y
-+    t = cpu->isar.id_isar5;
++    depends on TCG && ARM
-+    t = FIELD_DP32(t, ID_ISAR5, AES, 2);
+     select ARM_TIMER
-+    t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);
+     select INTEGRATOR_DEBUG
-+    t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);
+     select PL011 # UART
-+    t = FIELD_DP32(t, ID_ISAR5, CRC32, 1);
+@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
-+    t = FIELD_DP32(t, ID_ISAR5, RDM, 1);
-+    t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);
+ config MAINSTONE
-+    cpu->isar.id_isar5 = t;
+     bool
-+
+-    default y if TCG && ARM
-+    t = cpu->isar.id_isar6;
++    default y
-+    t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
++    depends on TCG && ARM
-+    t = FIELD_DP32(t, ID_ISAR6, DP, 1);
+     select PXA2XX
-+    t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
+     select PFLASH_CFI01
-+    t = FIELD_DP32(t, ID_ISAR6, SB, 1);
+     select SMC91C111
-+    t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
-+    t = FIELD_DP32(t, ID_ISAR6, BF16, 1);
+ config MUSCA
-+    t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);
+     bool
-+    cpu->isar.id_isar6 = t;
+-    default y if TCG && ARM
-+
++    default y
-+    t = cpu->isar.mvfr1;
++    depends on TCG && ARM
-+    t = FIELD_DP32(t, MVFR1, FPHP, 3);     /* v8.2-FP16 */
+     select ARMSSE
-+    t = FIELD_DP32(t, MVFR1, SIMDHP, 2);   /* v8.2-FP16 */
+     select PL011
-+    cpu->isar.mvfr1 = t;
+     select PL031
-+
+@@ -XXX,XX +XXX,XX @@ config MARVELL_88W8618
-+    t = cpu->isar.mvfr2;
-+    t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
+ config MUSICPAL
-+    t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
+     bool
-+    cpu->isar.mvfr2 = t;
+-    default y if TCG && ARM
-+
++    default y
-+    t = cpu->isar.id_mmfr3;
++    depends on TCG && ARM
-+    t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */
+     select OR_IRQ
-+    cpu->isar.id_mmfr3 = t;
+     select BITBANG_I2C
-+
+     select MARVELL_88W8618
-+    t = cpu->isar.id_mmfr4;
+@@ -XXX,XX +XXX,XX @@ config MUSICPAL
-+    t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
-+    t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
+ config NETDUINO2
-+    t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
+     bool
-+    t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
+-    default y if TCG && ARM
-+    cpu->isar.id_mmfr4 = t;
++    default y
-+
++    depends on TCG && ARM
-+    t = cpu->isar.id_pfr0;
+     select STM32F205_SOC
-+    t = FIELD_DP32(t, ID_PFR0, DIT, 1);
-+    cpu->isar.id_pfr0 = t;
+ config NETDUINOPLUS2
-+
+     bool
-+    t = cpu->isar.id_pfr2;
+-    default y if TCG && ARM
-+    t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
++    default y
-+    cpu->isar.id_pfr2 = t;
++    depends on TCG && ARM
+     select STM32F405_SOC
- #ifdef CONFIG_USER_ONLY
-     /*
+ config OLIMEX_STM32_H405
--     * We don't set these in system emulation mode for the moment,
+     bool
--     * since we don't correctly set (all of) the ID registers to
+-    default y if TCG && ARM
--     * advertise them.
++    default y
-+     * Break with true ARMv8 and add back old-style VFP short-vector support.
++    depends on TCG && ARM
-+     * Only do this for user-mode, where -cpu max is the default, so that
+     select STM32F405_SOC
-+     * older v6 and v7 programs are more likely to work without adjustment.
-      */
+ config NSERIES
--    set_feature(&cpu->env, ARM_FEATURE_V8);
+     bool
--    {
+-    default y if TCG && ARM
--        uint32_t t;
++    default y
--
++    depends on TCG && ARM
--        t = cpu->isar.id_isar5;
+     select OMAP
--        t = FIELD_DP32(t, ID_ISAR5, AES, 2);
+     select TMP105   # temperature sensor
--        t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);
+     select BLIZZARD # LCD/TV controller
--        t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);
+@@ -XXX,XX +XXX,XX @@ config PXA2XX
--        t = FIELD_DP32(t, ID_ISAR5, CRC32, 1);
--        t = FIELD_DP32(t, ID_ISAR5, RDM, 1);
+ config GUMSTIX
--        t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);
+     bool
--        cpu->isar.id_isar5 = t;
+-    default y if TCG && ARM
--
++    default y
--        t = cpu->isar.id_isar6;
++    depends on TCG && ARM
--        t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
+     select PFLASH_CFI01
--        t = FIELD_DP32(t, ID_ISAR6, DP, 1);
+     select SMC91C111
--        t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
+     select PXA2XX
--        t = FIELD_DP32(t, ID_ISAR6, SB, 1);
--        t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
+ config TOSA
--        t = FIELD_DP32(t, ID_ISAR6, BF16, 1);
+     bool
--        t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);
+-    default y if TCG && ARM
--        cpu->isar.id_isar6 = t;
++    default y
--
++    depends on TCG && ARM
--        t = cpu->isar.mvfr1;
+     select ZAURUS  # scoop
--        t = FIELD_DP32(t, MVFR1, FPHP, 3);     /* v8.2-FP16 */
+     select MICRODRIVE
--        t = FIELD_DP32(t, MVFR1, SIMDHP, 2);   /* v8.2-FP16 */
+     select PXA2XX
--        cpu->isar.mvfr1 = t;
+@@ -XXX,XX +XXX,XX @@ config TOSA
--
--        t = cpu->isar.mvfr2;
+ config SPITZ
--        t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
+     bool
--        t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
+-    default y if TCG && ARM
--        cpu->isar.mvfr2 = t;
++    default y
--
++    depends on TCG && ARM
--        t = cpu->isar.id_mmfr3;
+     select ADS7846 # touch-screen controller
--        t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */
+     select MAX111X # A/D converter
--        cpu->isar.id_mmfr3 = t;
+     select WM8750  # audio codec
--
+@@ -XXX,XX +XXX,XX @@ config SPITZ
--        t = cpu->isar.id_mmfr4;
--        t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
+ config Z2
--        t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
+     bool
--        t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
+-    default y if TCG && ARM
--        t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
++    default y
--        cpu->isar.id_mmfr4 = t;
++    depends on TCG && ARM
--
+     select PFLASH_CFI01
--        t = cpu->isar.id_pfr0;
+     select WM8750
--        t = FIELD_DP32(t, ID_PFR0, DIT, 1);
+     select PL011 # UART
--        cpu->isar.id_pfr0 = t;
+@@ -XXX,XX +XXX,XX @@ config Z2
--
--        t = cpu->isar.id_pfr2;
+ config REALVIEW
--        t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
+     bool
--        cpu->isar.id_pfr2 = t;
+-    default y if TCG && ARM
--    }
++    default y
--#endif /* CONFIG_USER_ONLY */
++    depends on TCG && ARM
-+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
+     imply PCI_DEVICES
-+#endif
+     imply PCI_TESTDEV
- }
+     imply I2C_DEVICES
- #endif /* !TARGET_AARCH64 */
+@@ -XXX,XX +XXX,XX @@ config REALVIEW
  config SBSA_REF
      bool
 -    default y if TCG && AARCH64
 +    default y
 +    depends on TCG && AARCH64
      imply PCI_DEVICES
      select AHCI
      select ARM_SMMUV3
@@ -XXX,XX +XXX,XX @@ config SBSA_REF
  config SABRELITE
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select FSL_IMX6
      select SSI_M25P80
  config STELLARIS
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select ARM_V7M
      select CMSDK_APB_WATCHDOG
@@ -XXX,XX +XXX,XX @@ config STELLARIS
  config STM32VLDISCOVERY
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select STM32F100_SOC
  config STRONGARM
@@ -XXX,XX +XXX,XX @@ config STRONGARM
  config COLLIE
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select PFLASH_CFI01
      select ZAURUS  # scoop
      select STRONGARM
  config SX1
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select OMAP
  config VERSATILE
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select ARM_TIMER # sp804
      select PFLASH_CFI01
      select LSI_SCSI_PCI
@@ -XXX,XX +XXX,XX @@ config VERSATILE
  config VEXPRESS
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select A9MPCORE
      select A15MPCORE
      select ARM_MPTIMER
@@ -XXX,XX +XXX,XX @@ config VEXPRESS
  config ZYNQ
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select A9MPCORE
      select CADENCE # UART
      select PFLASH_CFI02
@@ -XXX,XX +XXX,XX @@ config ZYNQ
  config ARM_V7M
      bool
      # currently v7M must be included in a TCG build due to translate.c
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select PTIMER
  config ALLWINNER_A10
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
  config ALLWINNER_H3
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select ALLWINNER_A10_PIT
      select ALLWINNER_SUN8I_EMAC
      select ALLWINNER_I2C
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
  config RASPI
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select FRAMEBUFFER
      select PL011 # UART
      select SDHCI
@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
  config XLNX_ZYNQMP_ARM
      bool
 -    default y if TCG && AARCH64
 +    default y
 +    depends on TCG && AARCH64
      select AHCI
      select ARM_GIC
      select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_ZYNQMP_ARM
  config XLNX_VERSAL
      bool
 -    default y if TCG && AARCH64
 +    default y
 +    depends on TCG && AARCH64
      select ARM_GIC
      select PL011
      select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_VERSAL
  config NPCM7XX
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select A9MPCORE
      select ADM1272
      select ARM_GIC
@@ -XXX,XX +XXX,XX @@ config NPCM7XX
  config FSL_IMX25
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select IMX
      select IMX_FEC
@@ -XXX,XX +XXX,XX @@ config FSL_IMX25
  config FSL_IMX31
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select SERIAL
      select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
  config ASPEED_SOC
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select DS1338
      select FTGMAC100
      select I2C
@@ -XXX,XX +XXX,XX @@ config ASPEED_SOC
  config MPS2
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select ARMSSE
      select LAN9118
@@ -XXX,XX +XXX,XX @@ config MPS2
  config FSL_IMX7
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply PCI_DEVICES
      imply TEST_DEVICES
      imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config ARM_SMMUV3
  config FSL_IMX6UL
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select A15MPCORE
      select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6UL
  config MICROBIT
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select NRF51_SOC
  config NRF51_SOC
@@ -XXX,XX +XXX,XX @@ config NRF51_SOC
  config EMCRAFT_SF2
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select MSF2
      select SSI_M25P80
 --
-.25.1
+.34.1

-[PULL 20/32] target/arm: Enable FEAT_CSV2 for -cpu max
+[PULL 19/21] Update copyright dates to 2023
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Enze Li <lienze@kylinos.cn>
-This extension concerns branch speculation, which TCG does
+I noticed that in the latest version, the copyright string is still
-not implement.  Thus we can trivially enable this feature.
+, even though 2023 is halfway through.  This patch fixes that and
 fixes the documentation along with it.
+Signed-off-by: Enze Li <lienze@kylinos.cn>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230525064345.1152801-1-lienze@kylinos.cn
 Message-id: 20220506180242.216785-20-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/emulation.rst | 1 +
+ docs/conf.py              | 2 +-
- target/arm/cpu64.c            | 1 +
+ include/qemu/help-texts.h | 2 +-
- target/arm/cpu_tcg.c          | 1 +
+files changed, 2 insertions(+), 2 deletions(-)
 files changed, 3 insertions(+)
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
+diff --git a/docs/conf.py b/docs/conf.py
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/emulation.rst
+--- a/docs/conf.py
-+++ b/docs/system/arm/emulation.rst
++++ b/docs/conf.py
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
+@@ -XXX,XX +XXX,XX @@
- - FEAT_BBM at level 2 (Translation table break-before-make levels)
- - FEAT_BF16 (AArch64 BFloat16 instructions)
+ # General information about the project.
- - FEAT_BTI (Branch Target Identification)
+ project = u'QEMU'
-+- FEAT_CSV2 (Cache speculation variant 2)
+-copyright = u'2022, The QEMU Project Developers'
- - FEAT_DIT (Data Independent Timing instructions)
++copyright = u'2023, The QEMU Project Developers'
- - FEAT_DPB (DC CVAP instruction)
+ author = u'The QEMU Project Developers'
- - FEAT_Debugv8p2 (Debug changes for v8.2)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+ # The version info for the project you're documenting, acts as replacement for
 diff --git a/include/qemu/help-texts.h b/include/qemu/help-texts.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
+--- a/include/qemu/help-texts.h
-+++ b/target/arm/cpu64.c
++++ b/include/qemu/help-texts.h
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@
-     t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
+ #define QEMU_HELP_TEXTS_H
-     t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1);      /* FEAT_SEL2 */
-     t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1);       /* FEAT_DIT */
+ /* Copyright string for -version arguments, About dialogs, etc */
-+    t = FIELD_DP64(t, ID_AA64PFR0, CSV2, 1);      /* FEAT_CSV2 */
+-#define QEMU_COPYRIGHT "Copyright (c) 2003-2022 " \
-     cpu->isar.id_aa64pfr0 = t;
++#define QEMU_COPYRIGHT "Copyright (c) 2003-2023 " \
+     "Fabrice Bellard and the QEMU Project developers"
-     t = cpu->isar.id_aa64pfr1;
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
+ /* Bug reporting information for --help arguments, About dialogs, etc */
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
      cpu->isar.id_mmfr4 = t;
      t = cpu->isar.id_pfr0;
 +    t = FIELD_DP32(t, ID_PFR0, CSV2, 2);          /* FEAT_CVS2 */
      t = FIELD_DP32(t, ID_PFR0, DIT, 1);           /* FEAT_DIT */
      t = FIELD_DP32(t, ID_PFR0, RAS, 1);           /* FEAT_RAS */
      cpu->isar.id_pfr0 = t;
 --
-.25.1
+.34.1

-[PULL 26/32] hw/arm: add versioning to sbsa-ref machine DT
+[PULL 20/21] hw/arm/sbsa-ref: add GIC node into DT
-From: Leif Lindholm <quic_llindhol@quicinc.com>
+From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-The sbsa-ref machine is continuously evolving. Some of the changes we
+Let add GIC information into DeviceTree as part of SBSA-REF versioning.
 want to make in the near future, to align with real components (e.g.
 the GIC-700), will break compatibility for existing firmware.
-Introduce two new properties to the DT generated on machine generation:
+Trusted Firmware will read it and provide to next firmware level.
 - machine-version-major
   To be incremented when a platform change makes the machine
   incompatible with existing firmware.
 - machine-version-minor
   To be incremented when functionality is added to the machine
   without causing incompatibility with existing firmware.
   to be reset to 0 when machine-version-major is incremented.
-This versioning scheme is *neither*:
+Bumps platform version to 0.1 one so we can check is node is present.
 - A QEMU versioned machine type; a given version of QEMU will emulate
   a given version of the platform.
 - A reflection of level of SBSA (now SystemReady SR) support provided.
-The version will increment on guest-visible functional changes only,
+Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 akin to a revision ID register found on a physical platform.
 These properties are both introduced with the value 0.
 (Hence, a machine where the DT is lacking these nodes is equivalent
 to version 0.0.)
 Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
 Message-id: 20220505113947.75714-1-quic_llindhol@quicinc.com
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Cc: Radoslaw Biernacki <rad@semihalf.com>
 Cc: Cédric Le Goater <clg@kaod.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/sbsa-ref.c | 14 ++++++++++++++
+ hw/arm/sbsa-ref.c | 19 ++++++++++++++++++-
-file changed, 14 insertions(+)
+file changed, 18 insertions(+), 1 deletion(-)
 diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/sbsa-ref.c
 +++ b/hw/arm/sbsa-ref.c
+@@ -XXX,XX +XXX,XX @@
+ #include "exec/hwaddr.h"
+ #include "kvm_arm.h"
+ #include "hw/arm/boot.h"
++#include "hw/arm/fdt.h"
+ #include "hw/arm/smmuv3.h"
+ #include "hw/block/flash.h"
+ #include "hw/boards.h"
+@@ -XXX,XX +XXX,XX @@ static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
+     return arm_cpu_mp_affinity(idx, clustersz);
+ }
++static void sbsa_fdt_add_gic_node(SBSAMachineState *sms)
++{
++    char *nodename;
++
++    nodename = g_strdup_printf("/intc");
++    qemu_fdt_add_subnode(sms->fdt, nodename);
++    qemu_fdt_setprop_sized_cells(sms->fdt, nodename, "reg",
++                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].base,
++                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].size,
++                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].base,
++                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].size);
++
++    g_free(nodename);
++}
+ /*
+  * Firmware on this machine only uses ACPI table to load OS, these limited
+  * device tree nodes are just to let firmware know the info which varies from
 @@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
-     qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 0x2);
+      *                        fw compatibility.
-     qemu_fdt_setprop_cell(fdt, "/", "#size-cells", 0x2);
+      */
+     qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
-+    /*
+-    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 0);
-+     * This versioning scheme is for informing platform fw only. It is neither:
++    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 1);
-+     * - A QEMU versioned machine type; a given version of QEMU will emulate
 +     *   a given version of the platform.
 +     * - A reflection of level of SBSA (now SystemReady SR) support provided.
 +     *
 +     * machine-version-major: updated when changes breaking fw compatibility
 +     *                        are introduced.
 +     * machine-version-minor: updated when features are added that don't break
 +     *                        fw compatibility.
 +     */
 +    qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
 +    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 0);
 +
      if (ms->numa_state->have_numa_distance) {
          int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
-         uint32_t *matrix = g_malloc0(size);
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
          g_free(nodename);
      }
 +
 +    sbsa_fdt_add_gic_node(sms);
  }
  #define SBSA_FLASH_SECTOR_SIZE (256 * KiB)
 --
-.25.1
+.34.1

-[PULL 06/32] target/arm: Move cortex impdef sysregs to cpu_tcg.c
+[PULL 21/21] docs: sbsa: correct graphics card name
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-Previously we were defining some of these in user-only mode,
+We moved from VGA to Bochs to have PCIe card.
 but none of them are accessible from user-only, therefore
 define them only in system mode.
-This will shortly be used from cpu_tcg.c also.
+Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-6-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h |  6 ++++
+ docs/system/arm/sbsa.rst | 2 +-
- target/arm/cpu64.c     | 64 +++---------------------------------------
+file changed, 1 insertion(+), 1 deletion(-)
  target/arm/cpu_tcg.c   | 59 ++++++++++++++++++++++++++++++++++++++
 files changed, 69 insertions(+), 60 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/docs/system/arm/sbsa.rst
-+++ b/target/arm/internals.h
++++ b/docs/system/arm/sbsa.rst
-@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
+@@ -XXX,XX +XXX,XX @@ The sbsa-ref board supports:
- int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
+   - System bus EHCI controller
- #endif
+   - CDROM and hard disc on AHCI bus
+   - E1000E ethernet card on PCIe bus
-+#ifdef CONFIG_USER_ONLY
+-  - VGA display adaptor on PCIe bus
-+static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
++  - Bochs display adapter on PCIe bus
-+#else
+   - A generic SBSA watchdog device
 +void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu);
 +#endif
 +
  #endif
 diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu64.c
 +++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
  #include "hvf_arm.h"
  #include "qapi/visitor.h"
  #include "hw/qdev-properties.h"
 -#include "cpregs.h"
 +#include "internals.h"
 -#ifndef CONFIG_USER_ONLY
 -static uint64_t a57_a53_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
 -{
 -    ARMCPU *cpu = env_archcpu(env);
 -
 -    /* Number of cores is in [25:24]; otherwise we RAZ */
 -    return (cpu->core_count - 1) << 24;
 -}
 -#endif
 -
 -static const ARMCPRegInfo cortex_a72_a57_a53_cp_reginfo[] = {
 -#ifndef CONFIG_USER_ONLY
 -    { .name = "L2CTLR_EL1", .state = ARM_CP_STATE_AA64,
 -      .opc0 = 3, .opc1 = 1, .crn = 11, .crm = 0, .opc2 = 2,
 -      .access = PL1_RW, .readfn = a57_a53_l2ctlr_read,
 -      .writefn = arm_cp_write_ignore },
 -    { .name = "L2CTLR",
 -      .cp = 15, .opc1 = 1, .crn = 9, .crm = 0, .opc2 = 2,
 -      .access = PL1_RW, .readfn = a57_a53_l2ctlr_read,
 -      .writefn = arm_cp_write_ignore },
 -#endif
 -    { .name = "L2ECTLR_EL1", .state = ARM_CP_STATE_AA64,
 -      .opc0 = 3, .opc1 = 1, .crn = 11, .crm = 0, .opc2 = 3,
 -      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 -    { .name = "L2ECTLR",
 -      .cp = 15, .opc1 = 1, .crn = 9, .crm = 0, .opc2 = 3,
 -      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 -    { .name = "L2ACTLR", .state = ARM_CP_STATE_BOTH,
 -      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 0, .opc2 = 0,
 -      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 -    { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64,
 -      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 0,
 -      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 -    { .name = "CPUACTLR",
 -      .cp = 15, .opc1 = 0, .crm = 15,
 -      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 -    { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64,
 -      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 1,
 -      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 -    { .name = "CPUECTLR",
 -      .cp = 15, .opc1 = 1, .crm = 15,
 -      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 -    { .name = "CPUMERRSR_EL1", .state = ARM_CP_STATE_AA64,
 -      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 2,
 -      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 -    { .name = "CPUMERRSR",
 -      .cp = 15, .opc1 = 2, .crm = 15,
 -      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 -    { .name = "L2MERRSR_EL1", .state = ARM_CP_STATE_AA64,
 -      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 3,
 -      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 -    { .name = "L2MERRSR",
 -      .cp = 15, .opc1 = 3, .crm = 15,
 -      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 -};
 -
  static void aarch64_a57_initfn(Object *obj)
  {
      ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
      cpu->gic_num_lrs = 4;
      cpu->gic_vpribits = 5;
      cpu->gic_vprebits = 5;
 -    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 +    define_cortex_a72_a57_a53_cp_reginfo(cpu);
  }
  static void aarch64_a53_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
      cpu->gic_num_lrs = 4;
      cpu->gic_vpribits = 5;
      cpu->gic_vprebits = 5;
 -    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 +    define_cortex_a72_a57_a53_cp_reginfo(cpu);
  }
  static void aarch64_a72_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
      cpu->gic_num_lrs = 4;
      cpu->gic_vpribits = 5;
      cpu->gic_vprebits = 5;
 -    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 +    define_cortex_a72_a57_a53_cp_reginfo(cpu);
  }
  void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
  #endif
  #include "cpregs.h"
 +#ifndef CONFIG_USER_ONLY
 +static uint64_t l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
 +{
 +    ARMCPU *cpu = env_archcpu(env);
 +
 +    /* Number of cores is in [25:24]; otherwise we RAZ */
 +    return (cpu->core_count - 1) << 24;
 +}
 +
 +static const ARMCPRegInfo cortex_a72_a57_a53_cp_reginfo[] = {
 +    { .name = "L2CTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 1, .crn = 11, .crm = 0, .opc2 = 2,
 +      .access = PL1_RW, .readfn = l2ctlr_read,
 +      .writefn = arm_cp_write_ignore },
 +    { .name = "L2CTLR",
 +      .cp = 15, .opc1 = 1, .crn = 9, .crm = 0, .opc2 = 2,
 +      .access = PL1_RW, .readfn = l2ctlr_read,
 +      .writefn = arm_cp_write_ignore },
 +    { .name = "L2ECTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 1, .crn = 11, .crm = 0, .opc2 = 3,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "L2ECTLR",
 +      .cp = 15, .opc1 = 1, .crn = 9, .crm = 0, .opc2 = 3,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "L2ACTLR", .state = ARM_CP_STATE_BOTH,
 +      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 0, .opc2 = 0,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 0,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUACTLR",
 +      .cp = 15, .opc1 = 0, .crm = 15,
 +      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 +    { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 1,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUECTLR",
 +      .cp = 15, .opc1 = 1, .crm = 15,
 +      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 +    { .name = "CPUMERRSR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 2,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUMERRSR",
 +      .cp = 15, .opc1 = 2, .crm = 15,
 +      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 +    { .name = "L2MERRSR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 3,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "L2MERRSR",
 +      .cp = 15, .opc1 = 3, .crm = 15,
 +      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 +};
 +
 +void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu)
 +{
 +    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
 +}
 +#endif /* !CONFIG_USER_ONLY */
 +
  /* CPU models. These are not needed for the AArch64 linux-user build. */
  #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 --
-.25.1
+.34.1

-[PULL 08/32] target/arm: Set ID_DFR0.PerfMon for qemu-system-arm -cpu max
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-We set this for qemu-system-aarch64, but failed to do so
-for the strictly 32-bit emulation.
-Fixes: 3bec78447a9 ("target/arm: Provide ARMv8.4-PMU in '-cpu max'")
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-8-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu_tcg.c | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
-     t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
-     cpu->isar.id_pfr2 = t;
-+    t = cpu->isar.id_dfr0;
-+    t = FIELD_DP32(t, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
-+    cpu->isar.id_dfr0 = t;
-+
- #ifdef CONFIG_USER_ONLY
-     /*
-      * Break with true ARMv8 and add back old-style VFP short-vector support.
---
-.25.1

-[PULL 09/32] target/arm: Split out aa32_max_features
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Share the code to set AArch32 max features so that we no
-longer have code drift between qemu{-system,}-{arm,aarch64}.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-9-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/internals.h |   2 +
- target/arm/cpu64.c     |  50 +-----------------
- target/arm/cpu_tcg.c   | 114 ++++++++++++++++++++++-------------------
-files changed, 65 insertions(+), 101 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
- void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu);
- #endif
-+void aa32_max_features(ARMCPU *cpu);
-+
- #endif
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
-     uint64_t t;
--    uint32_t u;
-     if (kvm_enabled() || hvf_enabled()) {
-         /* With KVM or HVF, '-cpu max' is identical to '-cpu host' */
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     t = FIELD_DP64(t, ID_AA64ZFR0, F64MM, 1);
-     cpu->isar.id_aa64zfr0 = t;
--    /* Replicate the same data to the 32-bit id registers.  */
--    u = cpu->isar.id_isar5;
--    u = FIELD_DP32(u, ID_ISAR5, AES, 2); /* AES + PMULL */
--    u = FIELD_DP32(u, ID_ISAR5, SHA1, 1);
--    u = FIELD_DP32(u, ID_ISAR5, SHA2, 1);
--    u = FIELD_DP32(u, ID_ISAR5, CRC32, 1);
--    u = FIELD_DP32(u, ID_ISAR5, RDM, 1);
--    u = FIELD_DP32(u, ID_ISAR5, VCMA, 1);
--    cpu->isar.id_isar5 = u;
--
--    u = cpu->isar.id_isar6;
--    u = FIELD_DP32(u, ID_ISAR6, JSCVT, 1);
--    u = FIELD_DP32(u, ID_ISAR6, DP, 1);
--    u = FIELD_DP32(u, ID_ISAR6, FHM, 1);
--    u = FIELD_DP32(u, ID_ISAR6, SB, 1);
--    u = FIELD_DP32(u, ID_ISAR6, SPECRES, 1);
--    u = FIELD_DP32(u, ID_ISAR6, BF16, 1);
--    u = FIELD_DP32(u, ID_ISAR6, I8MM, 1);
--    cpu->isar.id_isar6 = u;
--
--    u = cpu->isar.id_pfr0;
--    u = FIELD_DP32(u, ID_PFR0, DIT, 1);
--    cpu->isar.id_pfr0 = u;
--
--    u = cpu->isar.id_pfr2;
--    u = FIELD_DP32(u, ID_PFR2, SSBS, 1);
--    cpu->isar.id_pfr2 = u;
--
--    u = cpu->isar.id_mmfr3;
--    u = FIELD_DP32(u, ID_MMFR3, PAN, 2); /* ATS1E1 */
--    cpu->isar.id_mmfr3 = u;
--
--    u = cpu->isar.id_mmfr4;
--    u = FIELD_DP32(u, ID_MMFR4, HPDS, 1); /* AA32HPD */
--    u = FIELD_DP32(u, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
--    u = FIELD_DP32(u, ID_MMFR4, CNP, 1); /* TTCNP */
--    u = FIELD_DP32(u, ID_MMFR4, XNX, 1); /* TTS2UXN */
--    cpu->isar.id_mmfr4 = u;
--
-     t = cpu->isar.id_aa64dfr0;
-     t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 5); /* v8.4-PMU */
-     cpu->isar.id_aa64dfr0 = t;
--    u = cpu->isar.id_dfr0;
--    u = FIELD_DP32(u, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
--    cpu->isar.id_dfr0 = u;
--
--    u = cpu->isar.mvfr1;
--    u = FIELD_DP32(u, MVFR1, FPHP, 3);      /* v8.2-FP16 */
--    u = FIELD_DP32(u, MVFR1, SIMDHP, 2);    /* v8.2-FP16 */
--    cpu->isar.mvfr1 = u;
-+    /* Replicate the same data to the 32-bit id registers.  */
-+    aa32_max_features(cpu);
- #ifdef CONFIG_USER_ONLY
-     /*
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -XXX,XX +XXX,XX @@
- #endif
- #include "cpregs.h"
-+
-+/* Share AArch32 -cpu max features with AArch64. */
-+void aa32_max_features(ARMCPU *cpu)
-+{
-+    uint32_t t;
-+
-+    /* Add additional features supported by QEMU */
-+    t = cpu->isar.id_isar5;
-+    t = FIELD_DP32(t, ID_ISAR5, AES, 2);
-+    t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);
-+    t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);
-+    t = FIELD_DP32(t, ID_ISAR5, CRC32, 1);
-+    t = FIELD_DP32(t, ID_ISAR5, RDM, 1);
-+    t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);
-+    cpu->isar.id_isar5 = t;
-+
-+    t = cpu->isar.id_isar6;
-+    t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
-+    t = FIELD_DP32(t, ID_ISAR6, DP, 1);
-+    t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
-+    t = FIELD_DP32(t, ID_ISAR6, SB, 1);
-+    t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
-+    t = FIELD_DP32(t, ID_ISAR6, BF16, 1);
-+    t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);
-+    cpu->isar.id_isar6 = t;
-+
-+    t = cpu->isar.mvfr1;
-+    t = FIELD_DP32(t, MVFR1, FPHP, 3);     /* v8.2-FP16 */
-+    t = FIELD_DP32(t, MVFR1, SIMDHP, 2);   /* v8.2-FP16 */
-+    cpu->isar.mvfr1 = t;
-+
-+    t = cpu->isar.mvfr2;
-+    t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
-+    t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
-+    cpu->isar.mvfr2 = t;
-+
-+    t = cpu->isar.id_mmfr3;
-+    t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */
-+    cpu->isar.id_mmfr3 = t;
-+
-+    t = cpu->isar.id_mmfr4;
-+    t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
-+    t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
-+    t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
-+    t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
-+    cpu->isar.id_mmfr4 = t;
-+
-+    t = cpu->isar.id_pfr0;
-+    t = FIELD_DP32(t, ID_PFR0, DIT, 1);
-+    cpu->isar.id_pfr0 = t;
-+
-+    t = cpu->isar.id_pfr2;
-+    t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
-+    cpu->isar.id_pfr2 = t;
-+
-+    t = cpu->isar.id_dfr0;
-+    t = FIELD_DP32(t, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
-+    cpu->isar.id_dfr0 = t;
-+}
-+
- #ifndef CONFIG_USER_ONLY
- static uint64_t l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
- {
-@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
- static void arm_max_initfn(Object *obj)
- {
-     ARMCPU *cpu = ARM_CPU(obj);
--    uint32_t t;
-     /* aarch64_a57_initfn, advertising none of the aarch64 features */
-     cpu->dtb_compatible = "arm,cortex-a57";
-@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
-     cpu->ccsidr[2] = 0x70ffe07a; /* 2048KB L2 cache */
-     define_cortex_a72_a57_a53_cp_reginfo(cpu);
--    /* Add additional features supported by QEMU */
--    t = cpu->isar.id_isar5;
--    t = FIELD_DP32(t, ID_ISAR5, AES, 2);
--    t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);
--    t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);
--    t = FIELD_DP32(t, ID_ISAR5, CRC32, 1);
--    t = FIELD_DP32(t, ID_ISAR5, RDM, 1);
--    t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);
--    cpu->isar.id_isar5 = t;
--
--    t = cpu->isar.id_isar6;
--    t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
--    t = FIELD_DP32(t, ID_ISAR6, DP, 1);
--    t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
--    t = FIELD_DP32(t, ID_ISAR6, SB, 1);
--    t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
--    t = FIELD_DP32(t, ID_ISAR6, BF16, 1);
--    t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);
--    cpu->isar.id_isar6 = t;
--
--    t = cpu->isar.mvfr1;
--    t = FIELD_DP32(t, MVFR1, FPHP, 3);     /* v8.2-FP16 */
--    t = FIELD_DP32(t, MVFR1, SIMDHP, 2);   /* v8.2-FP16 */
--    cpu->isar.mvfr1 = t;
--
--    t = cpu->isar.mvfr2;
--    t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
--    t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
--    cpu->isar.mvfr2 = t;
--
--    t = cpu->isar.id_mmfr3;
--    t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */
--    cpu->isar.id_mmfr3 = t;
--
--    t = cpu->isar.id_mmfr4;
--    t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
--    t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
--    t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
--    t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
--    cpu->isar.id_mmfr4 = t;
--
--    t = cpu->isar.id_pfr0;
--    t = FIELD_DP32(t, ID_PFR0, DIT, 1);
--    cpu->isar.id_pfr0 = t;
--
--    t = cpu->isar.id_pfr2;
--    t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
--    cpu->isar.id_pfr2 = t;
--
--    t = cpu->isar.id_dfr0;
--    t = FIELD_DP32(t, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
--    cpu->isar.id_dfr0 = t;
-+    aa32_max_features(cpu);
- #ifdef CONFIG_USER_ONLY
-     /*
---
-.25.1

-[PULL 10/32] target/arm: Annotate arm_max_initfn with FEAT identifiers
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Update the legacy feature names to the current names.
-Provide feature names for id changes that were not marked.
-Sort the field updates into increasing bitfield order.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-10-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu64.c   | 100 +++++++++++++++++++++----------------------
- target/arm/cpu_tcg.c |  48 ++++++++++-----------
-files changed, 74 insertions(+), 74 deletions(-)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     cpu->midr = t;
-     t = cpu->isar.id_aa64isar0;
--    t = FIELD_DP64(t, ID_AA64ISAR0, AES, 2); /* AES + PMULL */
--    t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR0, SHA2, 2); /* SHA512 */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, AES, 2);      /* FEAT_PMULL */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 1);     /* FEAT_SHA1 */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, SHA2, 2);     /* FEAT_SHA512 */
-     t = FIELD_DP64(t, ID_AA64ISAR0, CRC32, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR0, ATOMIC, 2);
--    t = FIELD_DP64(t, ID_AA64ISAR0, RDM, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR0, SHA3, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR0, SM3, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR0, SM4, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR0, DP, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR0, TS, 2); /* v8.5-CondM */
--    t = FIELD_DP64(t, ID_AA64ISAR0, TLB, 2); /* FEAT_TLBIRANGE */
--    t = FIELD_DP64(t, ID_AA64ISAR0, RNDR, 1);
-+    t = FIELD_DP64(t, ID_AA64ISAR0, ATOMIC, 2);   /* FEAT_LSE */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, RDM, 1);      /* FEAT_RDM */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, SHA3, 1);     /* FEAT_SHA3 */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, SM3, 1);      /* FEAT_SM3 */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, SM4, 1);      /* FEAT_SM4 */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, DP, 1);       /* FEAT_DotProd */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 1);      /* FEAT_FHM */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, TS, 2);       /* FEAT_FlagM2 */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, TLB, 2);      /* FEAT_TLBIRANGE */
-+    t = FIELD_DP64(t, ID_AA64ISAR0, RNDR, 1);     /* FEAT_RNG */
-     cpu->isar.id_aa64isar0 = t;
-     t = cpu->isar.id_aa64isar1;
--    t = FIELD_DP64(t, ID_AA64ISAR1, DPB, 2);
--    t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR1, BF16, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 1);
--    t = FIELD_DP64(t, ID_AA64ISAR1, LRCPC, 2); /* ARMv8.4-RCPC */
--    t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 1);
-+    t = FIELD_DP64(t, ID_AA64ISAR1, DPB, 2);      /* FEAT_DPB2 */
-+    t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 1);    /* FEAT_JSCVT */
-+    t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 1);     /* FEAT_FCMA */
-+    t = FIELD_DP64(t, ID_AA64ISAR1, LRCPC, 2);    /* FEAT_LRCPC2 */
-+    t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 1);  /* FEAT_FRINTTS */
-+    t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);       /* FEAT_SB */
-+    t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);  /* FEAT_SPECRES */
-+    t = FIELD_DP64(t, ID_AA64ISAR1, BF16, 1);     /* FEAT_BF16 */
-+    t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 1);     /* FEAT_I8MM */
-     cpu->isar.id_aa64isar1 = t;
-     t = cpu->isar.id_aa64pfr0;
-+    t = FIELD_DP64(t, ID_AA64PFR0, FP, 1);        /* FEAT_FP16 */
-+    t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 1);   /* FEAT_FP16 */
-     t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
--    t = FIELD_DP64(t, ID_AA64PFR0, FP, 1);
--    t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 1);
--    t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1);
--    t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1);
-+    t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1);      /* FEAT_SEL2 */
-+    t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1);       /* FEAT_DIT */
-     cpu->isar.id_aa64pfr0 = t;
-     t = cpu->isar.id_aa64pfr1;
--    t = FIELD_DP64(t, ID_AA64PFR1, BT, 1);
--    t = FIELD_DP64(t, ID_AA64PFR1, SSBS, 2);
-+    t = FIELD_DP64(t, ID_AA64PFR1, BT, 1);        /* FEAT_BTI */
-+    t = FIELD_DP64(t, ID_AA64PFR1, SSBS, 2);      /* FEAT_SSBS2 */
-     /*
-      * Begin with full support for MTE. This will be downgraded to MTE=0
-      * during realize if the board provides no tag memory, much like
-      * we do for EL2 with the virtualization=on property.
-      */
--    t = FIELD_DP64(t, ID_AA64PFR1, MTE, 3);
-+    t = FIELD_DP64(t, ID_AA64PFR1, MTE, 3);       /* FEAT_MTE3 */
-     cpu->isar.id_aa64pfr1 = t;
-     t = cpu->isar.id_aa64mmfr0;
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     cpu->isar.id_aa64mmfr0 = t;
-     t = cpu->isar.id_aa64mmfr1;
--    t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1); /* HPD */
--    t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1);
--    t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);
--    t = FIELD_DP64(t, ID_AA64MMFR1, PAN, 2); /* ATS1E1 */
--    t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* VMID16 */
--    t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1); /* TTS2UXN */
-+    t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
-+    t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
-+    t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1);     /* FEAT_HPDS */
-+    t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1);       /* FEAT_LOR */
-+    t = FIELD_DP64(t, ID_AA64MMFR1, PAN, 2);      /* FEAT_PAN2 */
-+    t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1);      /* FEAT_XNX */
-     cpu->isar.id_aa64mmfr1 = t;
-     t = cpu->isar.id_aa64mmfr2;
--    t = FIELD_DP64(t, ID_AA64MMFR2, UAO, 1);
--    t = FIELD_DP64(t, ID_AA64MMFR2, CNP, 1); /* TTCNP */
--    t = FIELD_DP64(t, ID_AA64MMFR2, ST, 1); /* TTST */
--    t = FIELD_DP64(t, ID_AA64MMFR2, VARANGE, 1); /* FEAT_LVA */
--    t = FIELD_DP64(t, ID_AA64MMFR2, TTL, 1); /* FEAT_TTL */
--    t = FIELD_DP64(t, ID_AA64MMFR2, BBM, 2); /* FEAT_BBM at level 2 */
-+    t = FIELD_DP64(t, ID_AA64MMFR2, CNP, 1);      /* FEAT_TTCNP */
-+    t = FIELD_DP64(t, ID_AA64MMFR2, UAO, 1);      /* FEAT_UAO */
-+    t = FIELD_DP64(t, ID_AA64MMFR2, VARANGE, 1);  /* FEAT_LVA */
-+    t = FIELD_DP64(t, ID_AA64MMFR2, ST, 1);       /* FEAT_TTST */
-+    t = FIELD_DP64(t, ID_AA64MMFR2, TTL, 1);      /* FEAT_TTL */
-+    t = FIELD_DP64(t, ID_AA64MMFR2, BBM, 2);      /* FEAT_BBM at level 2 */
-     cpu->isar.id_aa64mmfr2 = t;
-     t = cpu->isar.id_aa64zfr0;
-     t = FIELD_DP64(t, ID_AA64ZFR0, SVEVER, 1);
--    t = FIELD_DP64(t, ID_AA64ZFR0, AES, 2);  /* PMULL */
--    t = FIELD_DP64(t, ID_AA64ZFR0, BITPERM, 1);
--    t = FIELD_DP64(t, ID_AA64ZFR0, BFLOAT16, 1);
--    t = FIELD_DP64(t, ID_AA64ZFR0, SHA3, 1);
--    t = FIELD_DP64(t, ID_AA64ZFR0, SM4, 1);
--    t = FIELD_DP64(t, ID_AA64ZFR0, I8MM, 1);
--    t = FIELD_DP64(t, ID_AA64ZFR0, F32MM, 1);
--    t = FIELD_DP64(t, ID_AA64ZFR0, F64MM, 1);
-+    t = FIELD_DP64(t, ID_AA64ZFR0, AES, 2);       /* FEAT_SVE_PMULL128 */
-+    t = FIELD_DP64(t, ID_AA64ZFR0, BITPERM, 1);   /* FEAT_SVE_BitPerm */
-+    t = FIELD_DP64(t, ID_AA64ZFR0, BFLOAT16, 1);  /* FEAT_BF16 */
-+    t = FIELD_DP64(t, ID_AA64ZFR0, SHA3, 1);      /* FEAT_SVE_SHA3 */
-+    t = FIELD_DP64(t, ID_AA64ZFR0, SM4, 1);       /* FEAT_SVE_SM4 */
-+    t = FIELD_DP64(t, ID_AA64ZFR0, I8MM, 1);      /* FEAT_I8MM */
-+    t = FIELD_DP64(t, ID_AA64ZFR0, F32MM, 1);     /* FEAT_F32MM */
-+    t = FIELD_DP64(t, ID_AA64ZFR0, F64MM, 1);     /* FEAT_F64MM */
-     cpu->isar.id_aa64zfr0 = t;
-     t = cpu->isar.id_aa64dfr0;
--    t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 5); /* v8.4-PMU */
-+    t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 5);    /* FEAT_PMUv3p4 */
-     cpu->isar.id_aa64dfr0 = t;
-     /* Replicate the same data to the 32-bit id registers.  */
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
-     /* Add additional features supported by QEMU */
-     t = cpu->isar.id_isar5;
--    t = FIELD_DP32(t, ID_ISAR5, AES, 2);
--    t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);
--    t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);
-+    t = FIELD_DP32(t, ID_ISAR5, AES, 2);          /* FEAT_PMULL */
-+    t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);         /* FEAT_SHA1 */
-+    t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);         /* FEAT_SHA256 */
-     t = FIELD_DP32(t, ID_ISAR5, CRC32, 1);
--    t = FIELD_DP32(t, ID_ISAR5, RDM, 1);
--    t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);
-+    t = FIELD_DP32(t, ID_ISAR5, RDM, 1);          /* FEAT_RDM */
-+    t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);         /* FEAT_FCMA */
-     cpu->isar.id_isar5 = t;
-     t = cpu->isar.id_isar6;
--    t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
--    t = FIELD_DP32(t, ID_ISAR6, DP, 1);
--    t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
--    t = FIELD_DP32(t, ID_ISAR6, SB, 1);
--    t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
--    t = FIELD_DP32(t, ID_ISAR6, BF16, 1);
--    t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);
-+    t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);        /* FEAT_JSCVT */
-+    t = FIELD_DP32(t, ID_ISAR6, DP, 1);           /* Feat_DotProd */
-+    t = FIELD_DP32(t, ID_ISAR6, FHM, 1);          /* FEAT_FHM */
-+    t = FIELD_DP32(t, ID_ISAR6, SB, 1);           /* FEAT_SB */
-+    t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);      /* FEAT_SPECRES */
-+    t = FIELD_DP32(t, ID_ISAR6, BF16, 1);         /* FEAT_AA32BF16 */
-+    t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);         /* FEAT_AA32I8MM */
-     cpu->isar.id_isar6 = t;
-     t = cpu->isar.mvfr1;
--    t = FIELD_DP32(t, MVFR1, FPHP, 3);     /* v8.2-FP16 */
--    t = FIELD_DP32(t, MVFR1, SIMDHP, 2);   /* v8.2-FP16 */
-+    t = FIELD_DP32(t, MVFR1, FPHP, 3);            /* FEAT_FP16 */
-+    t = FIELD_DP32(t, MVFR1, SIMDHP, 2);          /* FEAT_FP16 */
-     cpu->isar.mvfr1 = t;
-     t = cpu->isar.mvfr2;
--    t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
--    t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
-+    t = FIELD_DP32(t, MVFR2, SIMDMISC, 3);        /* SIMD MaxNum */
-+    t = FIELD_DP32(t, MVFR2, FPMISC, 4);          /* FP MaxNum */
-     cpu->isar.mvfr2 = t;
-     t = cpu->isar.id_mmfr3;
--    t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */
-+    t = FIELD_DP32(t, ID_MMFR3, PAN, 2);          /* FEAT_PAN2 */
-     cpu->isar.id_mmfr3 = t;
-     t = cpu->isar.id_mmfr4;
--    t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
--    t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
--    t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
--    t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
-+    t = FIELD_DP32(t, ID_MMFR4, HPDS, 1);         /* FEAT_AA32HPD */
-+    t = FIELD_DP32(t, ID_MMFR4, AC2, 1);          /* ACTLR2, HACTLR2 */
-+    t = FIELD_DP32(t, ID_MMFR4, CNP, 1);          /* FEAT_TTCNP */
-+    t = FIELD_DP32(t, ID_MMFR4, XNX, 1);          /* FEAT_XNX*/
-     cpu->isar.id_mmfr4 = t;
-     t = cpu->isar.id_pfr0;
--    t = FIELD_DP32(t, ID_PFR0, DIT, 1);
-+    t = FIELD_DP32(t, ID_PFR0, DIT, 1);           /* FEAT_DIT */
-     cpu->isar.id_pfr0 = t;
-     t = cpu->isar.id_pfr2;
--    t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
-+    t = FIELD_DP32(t, ID_PFR2, SSBS, 1);          /* FEAT_SSBS */
-     cpu->isar.id_pfr2 = t;
-     t = cpu->isar.id_dfr0;
--    t = FIELD_DP32(t, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
-+    t = FIELD_DP32(t, ID_DFR0, PERFMON, 5);       /* FEAT_PMUv3p4 */
-     cpu->isar.id_dfr0 = t;
- }
---
-.25.1

-[PULL 11/32] target/arm: Use field names for manipulating EL2 and EL3 modes
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Use FIELD_DP{32,64} to manipulate id_pfr1 and id_aa64pfr0
-during arm_cpu_realizefn.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-11-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.c | 22 +++++++++++++---------
-file changed, 13 insertions(+), 9 deletions(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-          */
-         unset_feature(env, ARM_FEATURE_EL3);
--        /* Disable the security extension feature bits in the processor feature
--         * registers as well. These are id_pfr1[7:4] and id_aa64pfr0[15:12].
-+        /*
-+         * Disable the security extension feature bits in the processor
-+         * feature registers as well.
-          */
--        cpu->isar.id_pfr1 &= ~0xf0;
--        cpu->isar.id_aa64pfr0 &= ~0xf000;
-+        cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1, ID_PFR1, SECURITY, 0);
-+        cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
-+                                           ID_AA64PFR0, EL3, 0);
-     }
-     if (!cpu->has_el2) {
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-     }
-     if (!arm_feature(env, ARM_FEATURE_EL2)) {
--        /* Disable the hypervisor feature bits in the processor feature
--         * registers if we don't have EL2. These are id_pfr1[15:12] and
--         * id_aa64pfr0_el1[11:8].
-+        /*
-+         * Disable the hypervisor feature bits in the processor feature
-+         * registers if we don't have EL2.
-          */
--        cpu->isar.id_aa64pfr0 &= ~0xf00;
--        cpu->isar.id_pfr1 &= ~0xf000;
-+        cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
-+                                           ID_AA64PFR0, EL2, 0);
-+        cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1,
-+                                       ID_PFR1, VIRTUALIZATION, 0);
-     }
- #ifndef CONFIG_USER_ONLY
---
-.25.1

-[PULL 12/32] target/arm: Enable FEAT_Debugv8p2 for -cpu max
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-The only portion of FEAT_Debugv8p2 that is relevant to QEMU
-is CONTEXTIDR_EL2, which is also conditionally implemented
-with FEAT_VHE.  The rest of the debug extension concerns the
-External debug interface, which is outside the scope of QEMU.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-12-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/emulation.rst | 1 +
- target/arm/cpu.c              | 1 +
- target/arm/cpu64.c            | 1 +
- target/arm/cpu_tcg.c          | 2 ++
-files changed, 5 insertions(+)
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/emulation.rst
-+++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
- - FEAT_BTI (Branch Target Identification)
- - FEAT_DIT (Data Independent Timing instructions)
- - FEAT_DPB (DC CVAP instruction)
-+- FEAT_Debugv8p2 (Debug changes for v8.2)
- - FEAT_DotProd (Advanced SIMD dot product instructions)
- - FEAT_FCMA (Floating-point complex number instructions)
- - FEAT_FHM (Floating-point half-precision multiplication instructions)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
-          * feature registers as well.
-          */
-         cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1, ID_PFR1, SECURITY, 0);
-+        cpu->isar.id_dfr0 = FIELD_DP32(cpu->isar.id_dfr0, ID_DFR0, COPSDBG, 0);
-         cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
-                                            ID_AA64PFR0, EL3, 0);
-     }
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     cpu->isar.id_aa64zfr0 = t;
-     t = cpu->isar.id_aa64dfr0;
-+    t = FIELD_DP64(t, ID_AA64DFR0, DEBUGVER, 8);  /* FEAT_Debugv8p2 */
-     t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 5);    /* FEAT_PMUv3p4 */
-     cpu->isar.id_aa64dfr0 = t;
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
-     cpu->isar.id_pfr2 = t;
-     t = cpu->isar.id_dfr0;
-+    t = FIELD_DP32(t, ID_DFR0, COPDBG, 8);        /* FEAT_Debugv8p2 */
-+    t = FIELD_DP32(t, ID_DFR0, COPSDBG, 8);       /* FEAT_Debugv8p2 */
-     t = FIELD_DP32(t, ID_DFR0, PERFMON, 5);       /* FEAT_PMUv3p4 */
-     cpu->isar.id_dfr0 = t;
- }
---
-.25.1

-[PULL 13/32] target/arm: Enable FEAT_Debugv8p4 for -cpu max
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-This extension concerns changes to the External Debug interface,
-with Secure and Non-secure access to the debug registers, and all
-of it is outside the scope of QEMU.  Indicating support for this
-is mandatory with FEAT_SEL2, which we do implement.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-13-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/emulation.rst | 1 +
- target/arm/cpu64.c            | 2 +-
- target/arm/cpu_tcg.c          | 4 ++--
-files changed, 4 insertions(+), 3 deletions(-)
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/emulation.rst
-+++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
- - FEAT_DIT (Data Independent Timing instructions)
- - FEAT_DPB (DC CVAP instruction)
- - FEAT_Debugv8p2 (Debug changes for v8.2)
-+- FEAT_Debugv8p4 (Debug changes for v8.4)
- - FEAT_DotProd (Advanced SIMD dot product instructions)
- - FEAT_FCMA (Floating-point complex number instructions)
- - FEAT_FHM (Floating-point half-precision multiplication instructions)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     cpu->isar.id_aa64zfr0 = t;
-     t = cpu->isar.id_aa64dfr0;
--    t = FIELD_DP64(t, ID_AA64DFR0, DEBUGVER, 8);  /* FEAT_Debugv8p2 */
-+    t = FIELD_DP64(t, ID_AA64DFR0, DEBUGVER, 9);  /* FEAT_Debugv8p4 */
-     t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 5);    /* FEAT_PMUv3p4 */
-     cpu->isar.id_aa64dfr0 = t;
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
-     cpu->isar.id_pfr2 = t;
-     t = cpu->isar.id_dfr0;
--    t = FIELD_DP32(t, ID_DFR0, COPDBG, 8);        /* FEAT_Debugv8p2 */
--    t = FIELD_DP32(t, ID_DFR0, COPSDBG, 8);       /* FEAT_Debugv8p2 */
-+    t = FIELD_DP32(t, ID_DFR0, COPDBG, 9);        /* FEAT_Debugv8p4 */
-+    t = FIELD_DP32(t, ID_DFR0, COPSDBG, 9);       /* FEAT_Debugv8p4 */
-     t = FIELD_DP32(t, ID_DFR0, PERFMON, 5);       /* FEAT_PMUv3p4 */
-     cpu->isar.id_dfr0 = t;
- }
---
-.25.1

-[PULL 15/32] target/arm: Enable SCR and HCR bits for RAS
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Enable writes to the TERR and TEA bits when RAS is enabled.
-These bits are otherwise RES0.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-15-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 9 +++++++++
-file changed, 9 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-         }
-         valid_mask &= ~SCR_NET;
-+        if (cpu_isar_feature(aa64_ras, cpu)) {
-+            valid_mask |= SCR_TERR;
-+        }
-         if (cpu_isar_feature(aa64_lor, cpu)) {
-             valid_mask |= SCR_TLOR;
-         }
-@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-         }
-     } else {
-         valid_mask &= ~(SCR_RW | SCR_ST);
-+        if (cpu_isar_feature(aa32_ras, cpu)) {
-+            valid_mask |= SCR_TERR;
-+        }
-     }
-     if (!arm_feature(env, ARM_FEATURE_EL2)) {
-@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
-         if (cpu_isar_feature(aa64_vh, cpu)) {
-             valid_mask |= HCR_E2H;
-         }
-+        if (cpu_isar_feature(aa64_ras, cpu)) {
-+            valid_mask |= HCR_TERR | HCR_TEA;
-+        }
-         if (cpu_isar_feature(aa64_lor, cpu)) {
-             valid_mask |= HCR_TLOR;
-         }
---
-.25.1

-[PULL 17/32] target/arm: Implement ESB instruction
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Check for and defer any pending virtual SError.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-17-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.h        |  1 +
- target/arm/a32.decode      | 16 ++++++++------
- target/arm/t32.decode      | 18 ++++++++--------
- target/arm/op_helper.c     | 43 ++++++++++++++++++++++++++++++++++++++
- target/arm/translate-a64.c | 17 +++++++++++++++
- target/arm/translate.c     | 23 ++++++++++++++++++++
-files changed, 103 insertions(+), 15 deletions(-)
-diff --git a/target/arm/helper.h b/target/arm/helper.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
-+++ b/target/arm/helper.h
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(wfe, void, env)
- DEF_HELPER_1(yield, void, env)
- DEF_HELPER_1(pre_hvc, void, env)
- DEF_HELPER_2(pre_smc, void, env, i32)
-+DEF_HELPER_1(vesb, void, env)
- DEF_HELPER_3(cpsr_write, void, env, i32, i32)
- DEF_HELPER_2(cpsr_write_eret, void, env, i32)
-diff --git a/target/arm/a32.decode b/target/arm/a32.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/a32.decode
-+++ b/target/arm/a32.decode
-@@ -XXX,XX +XXX,XX @@ SMULTT           .... 0001 0110 .... 0000 .... 1110 ....      @rd0mn
- {
-   {
--    YIELD        ---- 0011 0010 0000 1111 ---- 0000 0001
--    WFE          ---- 0011 0010 0000 1111 ---- 0000 0010
--    WFI          ---- 0011 0010 0000 1111 ---- 0000 0011
-+    [
-+      YIELD      ---- 0011 0010 0000 1111 ---- 0000 0001
-+      WFE        ---- 0011 0010 0000 1111 ---- 0000 0010
-+      WFI        ---- 0011 0010 0000 1111 ---- 0000 0011
--    # TODO: Implement SEV, SEVL; may help SMP performance.
--    # SEV        ---- 0011 0010 0000 1111 ---- 0000 0100
--    # SEVL       ---- 0011 0010 0000 1111 ---- 0000 0101
-+      # TODO: Implement SEV, SEVL; may help SMP performance.
-+      # SEV      ---- 0011 0010 0000 1111 ---- 0000 0100
-+      # SEVL     ---- 0011 0010 0000 1111 ---- 0000 0101
-+
-+      ESB        ---- 0011 0010 0000 1111 ---- 0001 0000
-+    ]
-     # The canonical nop ends in 00000000, but the whole of the
-     # rest of the space executes as nop if otherwise unsupported.
-diff --git a/target/arm/t32.decode b/target/arm/t32.decode
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/t32.decode
-+++ b/target/arm/t32.decode
-@@ -XXX,XX +XXX,XX @@ CLZ              1111 1010 1011 ---- 1111 .... 1000 ....      @rdm
-   [
-     # Hints, and CPS
-     {
--      YIELD      1111 0011 1010 1111 1000 0000 0000 0001
--      WFE        1111 0011 1010 1111 1000 0000 0000 0010
--      WFI        1111 0011 1010 1111 1000 0000 0000 0011
-+      [
-+        YIELD    1111 0011 1010 1111 1000 0000 0000 0001
-+        WFE      1111 0011 1010 1111 1000 0000 0000 0010
-+        WFI      1111 0011 1010 1111 1000 0000 0000 0011
--      # TODO: Implement SEV, SEVL; may help SMP performance.
--      # SEV      1111 0011 1010 1111 1000 0000 0000 0100
--      # SEVL     1111 0011 1010 1111 1000 0000 0000 0101
-+        # TODO: Implement SEV, SEVL; may help SMP performance.
-+        # SEV    1111 0011 1010 1111 1000 0000 0000 0100
-+        # SEVL   1111 0011 1010 1111 1000 0000 0000 0101
--      # For M-profile minimal-RAS ESB can be a NOP, which is the
--      # default behaviour since it is in the hint space.
--      # ESB      1111 0011 1010 1111 1000 0000 0001 0000
-+        ESB      1111 0011 1010 1111 1000 0000 0001 0000
-+      ]
-       # The canonical nop ends in 0000 0000, but the whole rest
-       # of the space is "reserved hint, behaves as nop".
-diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/op_helper.c
-+++ b/target/arm/op_helper.c
-@@ -XXX,XX +XXX,XX @@ void HELPER(probe_access)(CPUARMState *env, target_ulong ptr,
-                      access_type, mmu_idx, ra);
-     }
- }
-+
-+/*
-+ * This function corresponds to AArch64.vESBOperation().
-+ * Note that the AArch32 version is not functionally different.
-+ */
-+void HELPER(vesb)(CPUARMState *env)
-+{
-+    /*
-+     * The EL2Enabled() check is done inside arm_hcr_el2_eff,
-+     * and will return HCR_EL2.VSE == 0, so nothing happens.
-+     */
-+    uint64_t hcr = arm_hcr_el2_eff(env);
-+    bool enabled = !(hcr & HCR_TGE) && (hcr & HCR_AMO);
-+    bool pending = enabled && (hcr & HCR_VSE);
-+    bool masked  = (env->daif & PSTATE_A);
-+
-+    /* If VSE pending and masked, defer the exception.  */
-+    if (pending && masked) {
-+        uint32_t syndrome;
-+
-+        if (arm_el_is_aa64(env, 1)) {
-+            /* Copy across IDS and ISS from VSESR. */
-+            syndrome = env->cp15.vsesr_el2 & 0x1ffffff;
-+        } else {
-+            ARMMMUFaultInfo fi = { .type = ARMFault_AsyncExternal };
-+
-+            if (extended_addresses_enabled(env)) {
-+                syndrome = arm_fi_to_lfsc(&fi);
-+            } else {
-+                syndrome = arm_fi_to_sfsc(&fi);
-+            }
-+            /* Copy across AET and ExT from VSESR. */
-+            syndrome |= env->cp15.vsesr_el2 & 0xd000;
-+        }
-+
-+        /* Set VDISR_EL2.A along with the syndrome. */
-+        env->cp15.vdisr_el2 = syndrome | (1u << 31);
-+
-+        /* Clear pending virtual SError */
-+        env->cp15.hcr_el2 &= ~HCR_VSE;
-+        cpu_reset_interrupt(env_cpu(env), CPU_INTERRUPT_VSERR);
-+    }
-+}
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void handle_hint(DisasContext *s, uint32_t insn,
-             gen_helper_autib(cpu_X[17], cpu_env, cpu_X[17], cpu_X[16]);
-         }
-         break;
-+    case 0b10000: /* ESB */
-+        /* Without RAS, we must implement this as NOP. */
-+        if (dc_isar_feature(aa64_ras, s)) {
-+            /*
-+             * QEMU does not have a source of physical SErrors,
-+             * so we are only concerned with virtual SErrors.
-+             * The pseudocode in the ARM for this case is
-+             *   if PSTATE.EL IN {EL0, EL1} && EL2Enabled() then
-+             *      AArch64.vESBOperation();
-+             * Most of the condition can be evaluated at translation time.
-+             * Test for EL2 present, and defer test for SEL2 to runtime.
-+             */
-+            if (s->current_el <= 1 && arm_dc_feature(s, ARM_FEATURE_EL2)) {
-+                gen_helper_vesb(cpu_env);
-+            }
-+        }
-+        break;
-     case 0b11000: /* PACIAZ */
-         if (s->pauth_active) {
-             gen_helper_pacia(cpu_X[30], cpu_env, cpu_X[30],
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_WFI(DisasContext *s, arg_WFI *a)
-     return true;
- }
-+static bool trans_ESB(DisasContext *s, arg_ESB *a)
-+{
-+    /*
-+     * For M-profile, minimal-RAS ESB can be a NOP.
-+     * Without RAS, we must implement this as NOP.
-+     */
-+    if (!arm_dc_feature(s, ARM_FEATURE_M) && dc_isar_feature(aa32_ras, s)) {
-+        /*
-+         * QEMU does not have a source of physical SErrors,
-+         * so we are only concerned with virtual SErrors.
-+         * The pseudocode in the ARM for this case is
-+         *   if PSTATE.EL IN {EL0, EL1} && EL2Enabled() then
-+         *      AArch32.vESBOperation();
-+         * Most of the condition can be evaluated at translation time.
-+         * Test for EL2 present, and defer test for SEL2 to runtime.
-+         */
-+        if (s->current_el <= 1 && arm_dc_feature(s, ARM_FEATURE_EL2)) {
-+            gen_helper_vesb(cpu_env);
-+        }
-+    }
-+    return true;
-+}
-+
- static bool trans_NOP(DisasContext *s, arg_NOP *a)
- {
-     return true;
---
-.25.1

-[PULL 18/32] target/arm: Enable FEAT_RAS for -cpu max
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-18-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/emulation.rst | 1 +
- target/arm/cpu64.c            | 1 +
- target/arm/cpu_tcg.c          | 1 +
-files changed, 3 insertions(+)
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/emulation.rst
-+++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
- - FEAT_PMULL (PMULL, PMULL2 instructions)
- - FEAT_PMUv3p1 (PMU Extensions v3.1)
- - FEAT_PMUv3p4 (PMU Extensions v3.4)
-+- FEAT_RAS (Reliability, availability, and serviceability)
- - FEAT_RDM (Advanced SIMD rounding double multiply accumulate instructions)
- - FEAT_RNG (Random number generator)
- - FEAT_SB (Speculation Barrier)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     t = cpu->isar.id_aa64pfr0;
-     t = FIELD_DP64(t, ID_AA64PFR0, FP, 1);        /* FEAT_FP16 */
-     t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 1);   /* FEAT_FP16 */
-+    t = FIELD_DP64(t, ID_AA64PFR0, RAS, 1);       /* FEAT_RAS */
-     t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-     t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1);      /* FEAT_SEL2 */
-     t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1);       /* FEAT_DIT */
-diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu_tcg.c
-+++ b/target/arm/cpu_tcg.c
-@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
-     t = cpu->isar.id_pfr0;
-     t = FIELD_DP32(t, ID_PFR0, DIT, 1);           /* FEAT_DIT */
-+    t = FIELD_DP32(t, ID_PFR0, RAS, 1);           /* FEAT_RAS */
-     cpu->isar.id_pfr0 = t;
-     t = cpu->isar.id_pfr2;
---
-.25.1

-[PULL 19/32] target/arm: Enable FEAT_IESB for -cpu max
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-This feature is AArch64 only, and applies to physical SErrors,
-which QEMU does not implement, thus the feature is a nop.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220506180242.216785-19-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/emulation.rst | 1 +
- target/arm/cpu64.c            | 1 +
-files changed, 2 insertions(+)
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/emulation.rst
-+++ b/docs/system/arm/emulation.rst
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
- - FEAT_FlagM2 (Enhancements to flag manipulation instructions)
- - FEAT_HPDS (Hierarchical permission disables)
- - FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
-+- FEAT_IESB (Implicit error synchronization event)
- - FEAT_JSCVT (JavaScript conversion instructions)
- - FEAT_LOR (Limited ordering regions)
- - FEAT_LPA (Large Physical Address space)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
-+++ b/target/arm/cpu64.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     t = cpu->isar.id_aa64mmfr2;
-     t = FIELD_DP64(t, ID_AA64MMFR2, CNP, 1);      /* FEAT_TTCNP */
-     t = FIELD_DP64(t, ID_AA64MMFR2, UAO, 1);      /* FEAT_UAO */
-+    t = FIELD_DP64(t, ID_AA64MMFR2, IESB, 1);     /* FEAT_IESB */
-     t = FIELD_DP64(t, ID_AA64MMFR2, VARANGE, 1);  /* FEAT_LVA */
-     t = FIELD_DP64(t, ID_AA64MMFR2, ST, 1);       /* FEAT_TTST */
-     t = FIELD_DP64(t, ID_AA64MMFR2, TTL, 1);      /* FEAT_TTL */
---
-.25.1

target-arm queue: the big stuff here is the final part of
rth's patches for Cortex-A76 and Neoverse-N1 support;
also present are Gavin's NUMA series and a few other things.

thanks
-- PMM

The following changes since commit 554623226f800acf48a2ed568900c1c968ec9a8b:

Merge tag 'qemu-sparc-20220508' of https://github.com/mcayland/qemu into staging (2022-05-08 17:03:26 -0500)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220509

for you to fetch changes up to ae9141d4a3265553503bf07d3574b40f84615a34:

hw/acpi/aml-build: Use existing CPU topology to build PPTT table (2022-05-09 11:47:55 +0100)

----------------------------------------------------------------
target-arm queue:
 * MAINTAINERS/.mailmap: update email for Leif Lindholm
 * hw/arm: add version information to sbsa-ref machine DT
 * Enable new features for -cpu max:
   FEAT_Debugv8p2, FEAT_Debugv8p4, FEAT_RAS (minimal version only),
   FEAT_IESB, FEAT_CSV2, FEAT_CSV2_2, FEAT_CSV3, FEAT_DGH
 * Emulate Cortex-A76
 * Emulate Neoverse-N1
 * Fix the virt board default NUMA topology

----------------------------------------------------------------
Gavin Shan (6):
      qapi/machine.json: Add cluster-id
      qtest/numa-test: Specify CPU topology in aarch64_numa_cpu()
      hw/arm/virt: Consider SMP configuration in CPU topology
      qtest/numa-test: Correct CPU and NUMA association in aarch64_numa_cpu()
      hw/arm/virt: Fix CPU's default NUMA node ID
      hw/acpi/aml-build: Use existing CPU topology to build PPTT table

Leif Lindholm (2):
      MAINTAINERS/.mailmap: update email for Leif Lindholm
      hw/arm: add versioning to sbsa-ref machine DT

Richard Henderson (24):
      target/arm: Handle cpreg registration for missing EL
      target/arm: Drop EL3 no EL2 fallbacks
      target/arm: Merge zcr reginfo
      target/arm: Adjust definition of CONTEXTIDR_EL2
      target/arm: Move cortex impdef sysregs to cpu_tcg.c
      target/arm: Update qemu-system-arm -cpu max to cortex-a57
      target/arm: Set ID_DFR0.PerfMon for qemu-system-arm -cpu max
      target/arm: Split out aa32_max_features
      target/arm: Annotate arm_max_initfn with FEAT identifiers
      target/arm: Use field names for manipulating EL2 and EL3 modes
      target/arm: Enable FEAT_Debugv8p2 for -cpu max
      target/arm: Enable FEAT_Debugv8p4 for -cpu max
      target/arm: Add minimal RAS registers
      target/arm: Enable SCR and HCR bits for RAS
      target/arm: Implement virtual SError exceptions
      target/arm: Implement ESB instruction
      target/arm: Enable FEAT_RAS for -cpu max
      target/arm: Enable FEAT_IESB for -cpu max
      target/arm: Enable FEAT_CSV2 for -cpu max
      target/arm: Enable FEAT_CSV2_2 for -cpu max
      target/arm: Enable FEAT_CSV3 for -cpu max
      target/arm: Enable FEAT_DGH for -cpu max
      target/arm: Define cortex-a76
      target/arm: Define neoverse-n1

From: Leif Lindholm <quic_llindhol@quicinc.com>

NUVIA was acquired by Qualcomm in March 2021, but kept functioning on
separate infrastructure for a transitional period. We've now switched
over to contributing as Qualcomm Innovation Center (quicinc), so update
my email address to reflect this.

Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
Message-id: 20220505113740.75565-1-quic_llindhol@quicinc.com
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
[Fixed commit message typo]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 .mailmap    | 3 ++-
 MAINTAINERS | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.mailmap b/.mailmap
index XXXXXXX..XXXXXXX 100644
--- a/.mailmap
+++ b/.mailmap
@@ -XXX,XX +XXX,XX @@ Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>
 Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
 Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
 James Hogan <jhogan@kernel.org> <james.hogan@imgtec.com>
-Leif Lindholm <leif@nuviainc.com> <leif.lindholm@linaro.org>
+Leif Lindholm <quic_llindhol@quicinc.com> <leif.lindholm@linaro.org>
+Leif Lindholm <quic_llindhol@quicinc.com> <leif@nuviainc.com>
 Radoslaw Biernacki <rad@semihalf.com> <radoslaw.biernacki@linaro.org>
 Paul Burton <paulburton@kernel.org> <paul.burton@mips.com>
 Paul Burton <paulburton@kernel.org> <paul.burton@imgtec.com>
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/ssi/imx_spi.h
 SBSA-REF
 M: Radoslaw Biernacki <rad@semihalf.com>
 M: Peter Maydell <peter.maydell@linaro.org>
-R: Leif Lindholm <leif@nuviainc.com>
+R: Leif Lindholm <quic_llindhol@quicinc.com>
 L: qemu-arm@nongnu.org
 S: Maintained
 F: hw/arm/sbsa-ref.c
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

More gracefully handle cpregs when EL2 and/or EL3 are missing.
If the reg is entirely inaccessible, do not register it at all.
If the reg is for EL2, and EL3 is present but EL2 is not,
either discard, squash to res0, const, or keep unchanged.

Per rule RJFFP, mark the 4 aarch32 hypervisor access registers
with ARM_CP_EL3_NO_EL2_KEEP, and mark all of the EL2 address
translation and tlb invalidation "regs" ARM_CP_EL3_NO_EL2_UNDEF.
Mark the 2 virtualization processor id regs ARM_CP_EL3_NO_EL2_C_NZ.

This will simplify cpreg registration for conditional arm features.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h |  11 +++
 target/arm/helper.c | 178 ++++++++++++++++++++++++++++++--------------
 2 files changed, 133 insertions(+), 56 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@ enum {
     ARM_CP_SVE                   = 1 << 14,
     /* Flag: Do not expose in gdb sysreg xml. */
     ARM_CP_NO_GDB                = 1 << 15,
+    /*
+     * Flags: If EL3 but not EL2...
+     *   - UNDEF: discard the cpreg,
+     *   -  KEEP: retain the cpreg as is,
+     *   -  C_NZ: set const on the cpreg, but retain resetvalue,
+     *   -  else: set const on the cpreg, zero resetvalue, aka RES0.
+     * See rule RJFFP in section D1.1.3 of DDI0487H.a.
+     */
+    ARM_CP_EL3_NO_EL2_UNDEF      = 1 << 16,
+    ARM_CP_EL3_NO_EL2_KEEP       = 1 << 17,
+    ARM_CP_EL3_NO_EL2_C_NZ       = 1 << 18,
 };
 
 /*
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .access = PL1_RW, .readfn = spsel_read, .writefn = spsel_write },
     { .name = "FPEXC32_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 3, .opc2 = 0,
-      .access = PL2_RW, .type = ARM_CP_ALIAS | ARM_CP_FPU,
+      .access = PL2_RW,
+      .type = ARM_CP_ALIAS | ARM_CP_FPU | ARM_CP_EL3_NO_EL2_KEEP,
       .fieldoffset = offsetof(CPUARMState, vfp.xregs[ARM_VFP_FPEXC]) },
     { .name = "DACR32_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 3, .crm = 0, .opc2 = 0,
-      .access = PL2_RW, .resetvalue = 0,
+      .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP,
       .writefn = dacr_write, .raw_writefn = raw_write,
       .fieldoffset = offsetof(CPUARMState, cp15.dacr32_el2) },
     { .name = "IFSR32_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 0, .opc2 = 1,
-      .access = PL2_RW, .resetvalue = 0,
+      .access = PL2_RW, .resetvalue = 0, .type = ARM_CP_EL3_NO_EL2_KEEP,
       .fieldoffset = offsetof(CPUARMState, cp15.ifsr32_el2) },
     { .name = "SPSR_IRQ", .state = ARM_CP_STATE_AA64,
       .type = ARM_CP_ALIAS,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .writefn = tlbimva_hyp_is_write },
     { .name = "TLBI_ALLE2", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 0,
-      .type = ARM_CP_NO_RAW, .access = PL2_W,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_alle2_write },
     { .name = "TLBI_VAE2", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 1,
-      .type = ARM_CP_NO_RAW, .access = PL2_W,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_vae2_write },
     { .name = "TLBI_VALE2", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_vae2_write },
     { .name = "TLBI_ALLE2IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 0,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_alle2is_write },
     { .name = "TLBI_VAE2IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 1,
-      .type = ARM_CP_NO_RAW, .access = PL2_W,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_vae2is_write },
     { .name = "TLBI_VALE2IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_vae2is_write },
 #ifndef CONFIG_USER_ONLY
     /* Unlike the other EL2-related AT operations, these must
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
     { .name = "AT_S1E2R", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 0,
       .access = PL2_W, .accessfn = at_s1e2_access,
-      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 },
+      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF,
+      .writefn = ats_write64 },
     { .name = "AT_S1E2W", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 7, .crm = 8, .opc2 = 1,
       .access = PL2_W, .accessfn = at_s1e2_access,
-      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC, .writefn = ats_write64 },
+      .type = ARM_CP_NO_RAW | ARM_CP_RAISES_EXC | ARM_CP_EL3_NO_EL2_UNDEF,
+      .writefn = ats_write64 },
     /* The AArch32 ATS1H* operations are CONSTRAINED UNPREDICTABLE
      * if EL2 is not implemented; we choose to UNDEF. Behaviour at EL3
      * with SCR.NS == 0 outside Monitor mode is UNPREDICTABLE; we choose
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
     { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
       .access = PL2_RW, .accessfn = access_tda,
-      .type = ARM_CP_NOP },
+      .type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
     /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications
      * Channel but Linux may try to access this register. The 32-bit
      * alias is DBGDCCINT.
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbirange_reginfo[] = {
       .access = PL2_W, .type = ARM_CP_NOP },
     { .name = "TLBI_RVAE2IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 1,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_rvae2is_write },
    { .name = "TLBI_RVALE2IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 5,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_rvae2is_write },
     { .name = "TLBI_RIPAS2E1", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 2,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbirange_reginfo[] = {
       .access = PL2_W, .type = ARM_CP_NOP },
    { .name = "TLBI_RVAE2OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 1,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_rvae2is_write },
    { .name = "TLBI_RVALE2OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 5,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_rvae2is_write },
     { .name = "TLBI_RVAE2", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 1,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_rvae2_write },
    { .name = "TLBI_RVALE2", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 5,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_rvae2_write },
    { .name = "TLBI_RVAE3IS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 2, .opc2 = 1,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbios_reginfo[] = {
       .writefn = tlbi_aa64_vae1is_write },
     { .name = "TLBI_ALLE2OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 0,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_alle2is_write },
     { .name = "TLBI_VAE2OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 1,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_vae2is_write },
    { .name = "TLBI_ALLE1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 4,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo tlbios_reginfo[] = {
       .writefn = tlbi_aa64_alle1is_write },
     { .name = "TLBI_VALE2OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 5,
-      .access = PL2_W, .type = ARM_CP_NO_RAW,
+      .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
       .writefn = tlbi_aa64_vae2is_write },
     { .name = "TLBI_VMALLS12E1OS", .state = ARM_CP_STATE_AA64,
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 6,
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
               .access = PL2_RW, .accessfn = access_el3_aa32ns,
-              .resetvalue = cpu->midr, .type = ARM_CP_ALIAS,
+              .resetvalue = cpu->midr,
+              .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ,
               .fieldoffset = offsetoflow32(CPUARMState, cp15.vpidr_el2) },
             { .name = "VPIDR_EL2", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
               .access = PL2_RW, .resetvalue = cpu->midr,
+              .type = ARM_CP_EL3_NO_EL2_C_NZ,
               .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
             { .name = "VMPIDR", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
               .access = PL2_RW, .accessfn = access_el3_aa32ns,
-              .resetvalue = vmpidr_def, .type = ARM_CP_ALIAS,
+              .resetvalue = vmpidr_def,
+              .type = ARM_CP_ALIAS | ARM_CP_EL3_NO_EL2_C_NZ,
               .fieldoffset = offsetoflow32(CPUARMState, cp15.vmpidr_el2) },
             { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
-              .access = PL2_RW,
-              .resetvalue = vmpidr_def,
+              .access = PL2_RW, .resetvalue = vmpidr_def,
+              .type = ARM_CP_EL3_NO_EL2_C_NZ,
               .fieldoffset = offsetof(CPUARMState, cp15.vmpidr_el2) },
         };
         define_arm_cp_regs(cpu, vpidr_regs);
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
                                    int crm, int opc1, int opc2,
                                    const char *name)
 {
+    CPUARMState *env = &cpu->env;
     uint32_t key;
     ARMCPRegInfo *r2;
     bool is64 = r->type & ARM_CP_64BIT;
     bool ns = secstate & ARM_CP_SECSTATE_NS;
     int cp = r->cp;
-    bool isbanked;
     size_t name_len;
+    bool make_const;
 
     switch (state) {
     case ARM_CP_STATE_AA32:
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
         }
     }
 
+    /*
+     * Eliminate registers that are not present because the EL is missing.
+     * Doing this here makes it easier to put all registers for a given
+     * feature into the same ARMCPRegInfo array and define them all at once.
+     */
+    make_const = false;
+    if (arm_feature(env, ARM_FEATURE_EL3)) {
+        /*
+         * An EL2 register without EL2 but with EL3 is (usually) RES0.
+         * See rule RJFFP in section D1.1.3 of DDI0487H.a.
+         */
+        int min_el = ctz32(r->access) / 2;
+        if (min_el == 2 && !arm_feature(env, ARM_FEATURE_EL2)) {
+            if (r->type & ARM_CP_EL3_NO_EL2_UNDEF) {
+                return;
+            }
+            make_const = !(r->type & ARM_CP_EL3_NO_EL2_KEEP);
+        }
+    } else {
+        CPAccessRights max_el = (arm_feature(env, ARM_FEATURE_EL2)
+                                 ? PL2_RW : PL1_RW);
+        if ((r->access & max_el) == 0) {
+            return;
+        }
+    }
+
     /* Combine cpreg and name into one allocation. */
     name_len = strlen(name) + 1;
     r2 = g_malloc(sizeof(*r2) + name_len);
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
         r2->opaque = opaque;
     }
 
-    isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1];
-    if (isbanked) {
+    if (make_const) {
+        /* This should not have been a very special register to begin. */
+        int old_special = r2->type & ARM_CP_SPECIAL_MASK;
+        assert(old_special == 0 || old_special == ARM_CP_NOP);
         /*
-         * Register is banked (using both entries in array).
-         * Overwriting fieldoffset as the array is only used to define
-         * banked registers but later only fieldoffset is used.
+         * Set the special function to CONST, retaining the other flags.
+         * This is important for e.g. ARM_CP_SVE so that we still
+         * take the SVE trap if CPTR_EL3.EZ == 0.
          */
-        r2->fieldoffset = r->bank_fieldoffsets[ns];
-    }
+        r2->type = (r2->type & ~ARM_CP_SPECIAL_MASK) | ARM_CP_CONST;
+        /*
+         * Usually, these registers become RES0, but there are a few
+         * special cases like VPIDR_EL2 which have a constant non-zero
+         * value with writes ignored.
+         */
+        if (!(r->type & ARM_CP_EL3_NO_EL2_C_NZ)) {
+            r2->resetvalue = 0;
+        }
+        /*
+         * ARM_CP_CONST has precedence, so removing the callbacks and
+         * offsets are not strictly necessary, but it is potentially
+         * less confusing to debug later.
+         */
+        r2->readfn = NULL;
+        r2->writefn = NULL;
+        r2->raw_readfn = NULL;
+        r2->raw_writefn = NULL;
+        r2->resetfn = NULL;
+        r2->fieldoffset = 0;
+        r2->bank_fieldoffsets[0] = 0;
+        r2->bank_fieldoffsets[1] = 0;
+    } else {
+        bool isbanked = r->bank_fieldoffsets[0] && r->bank_fieldoffsets[1];
 
-    if (state == ARM_CP_STATE_AA32) {
         if (isbanked) {
             /*
-             * If the register is banked then we don't need to migrate or
-             * reset the 32-bit instance in certain cases:
-             *
-             * 1) If the register has both 32-bit and 64-bit instances then we
-             *    can count on the 64-bit instance taking care of the
-             *    non-secure bank.
-             * 2) If ARMv8 is enabled then we can count on a 64-bit version
-             *    taking care of the secure bank.  This requires that separate
-             *    32 and 64-bit definitions are provided.
+             * Register is banked (using both entries in array).
+             * Overwriting fieldoffset as the array is only used to define
+             * banked registers but later only fieldoffset is used.
              */
-            if ((r->state == ARM_CP_STATE_BOTH && ns) ||
-                (arm_feature(&cpu->env, ARM_FEATURE_V8) && !ns)) {
+            r2->fieldoffset = r->bank_fieldoffsets[ns];
+        }
+        if (state == ARM_CP_STATE_AA32) {
+            if (isbanked) {
+                /*
+                 * If the register is banked then we don't need to migrate or
+                 * reset the 32-bit instance in certain cases:
+                 *
+                 * 1) If the register has both 32-bit and 64-bit instances
+                 *    then we can count on the 64-bit instance taking care
+                 *    of the non-secure bank.
+                 * 2) If ARMv8 is enabled then we can count on a 64-bit
+                 *    version taking care of the secure bank.  This requires
+                 *    that separate 32 and 64-bit definitions are provided.
+                 */
+                if ((r->state == ARM_CP_STATE_BOTH && ns) ||
+                    (arm_feature(env, ARM_FEATURE_V8) && !ns)) {
+                    r2->type |= ARM_CP_ALIAS;
+                }
+            } else if ((secstate != r->secure) && !ns) {
+                /*
+                 * The register is not banked so we only want to allow
+                 * migration of the non-secure instance.
+                 */
                 r2->type |= ARM_CP_ALIAS;
             }
-        } else if ((secstate != r->secure) && !ns) {
-            /*
-             * The register is not banked so we only want to allow migration
-             * of the non-secure instance.
-             */
-            r2->type |= ARM_CP_ALIAS;
-        }
 
-        if (HOST_BIG_ENDIAN &&
-            r->state == ARM_CP_STATE_BOTH && r2->fieldoffset) {
-            r2->fieldoffset += sizeof(uint32_t);
+            if (HOST_BIG_ENDIAN &&
+                r->state == ARM_CP_STATE_BOTH && r2->fieldoffset) {
+                r2->fieldoffset += sizeof(uint32_t);
+            }
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void add_cpreg_to_hashtable(ARMCPU *cpu, const ARMCPRegInfo *r,
      * multiple times. Special registers (ie NOP/WFI) are
      * never migratable and not even raw-accessible.
      */
-    if (r->type & ARM_CP_SPECIAL_MASK) {
+    if (r2->type & ARM_CP_SPECIAL_MASK) {
         r2->type |= ARM_CP_NO_RAW;
     }
     if (((r->crm == CP_ANY) && crm != 0) ||
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Drop el3_no_el2_cp_reginfo, el3_no_el2_v8_cp_reginfo, and the local
vpidr_regs definition, and rely on the squashing to ARM_CP_CONST
while registering for v8.

This is a behavior change for v7 cpus with Security Extensions and
without Virtualization Extensions, in that the virtualization cpregs
are now correctly not present.  This would be a migration compatibility
break, except that we have an existing bug in which migration of 32-bit
cpus with Security Extensions enabled does not work.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 158 ++++----------------------------------------
 1 file changed, 13 insertions(+), 145 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .fieldoffset = offsetoflow32(CPUARMState, cp15.mdcr_el3) },
 };
 
-/* Used to describe the behaviour of EL2 regs when EL2 does not exist.  */
-static const ARMCPRegInfo el3_no_el2_cp_reginfo[] = {
-    { .name = "VBAR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 0, .opc2 = 0,
-      .access = PL2_RW,
-      .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore },
-    { .name = "HCR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
-      .access = PL2_RW,
-      .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "HACR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 7,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "ESR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 0,
-      .access = PL2_RW,
-      .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "CPTR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 2,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "MAIR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 0,
-      .access = PL2_RW, .type = ARM_CP_CONST,
-      .resetvalue = 0 },
-    { .name = "HMAIR1", .state = ARM_CP_STATE_AA32,
-      .cp = 15, .opc1 = 4, .crn = 10, .crm = 2, .opc2 = 1,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "AMAIR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 0,
-      .access = PL2_RW, .type = ARM_CP_CONST,
-      .resetvalue = 0 },
-    { .name = "HAMAIR1", .state = ARM_CP_STATE_AA32,
-      .cp = 15, .opc1 = 4, .crn = 10, .crm = 3, .opc2 = 1,
-      .access = PL2_RW, .type = ARM_CP_CONST,
-      .resetvalue = 0 },
-    { .name = "AFSR0_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 0,
-      .access = PL2_RW, .type = ARM_CP_CONST,
-      .resetvalue = 0 },
-    { .name = "AFSR1_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 1, .opc2 = 1,
-      .access = PL2_RW, .type = ARM_CP_CONST,
-      .resetvalue = 0 },
-    { .name = "TCR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 2,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "VTCR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 2,
-      .access = PL2_RW, .accessfn = access_el3_aa32ns,
-      .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "VTTBR", .state = ARM_CP_STATE_AA32,
-      .cp = 15, .opc1 = 6, .crm = 2,
-      .access = PL2_RW, .accessfn = access_el3_aa32ns,
-      .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
-    { .name = "VTTBR_EL2", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 1, .opc2 = 0,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "SCTLR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 0, .opc2 = 0,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "TPIDR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 2,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "TTBR0_EL2", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 0,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "HTTBR", .cp = 15, .opc1 = 4, .crm = 2,
-      .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
-      .resetvalue = 0 },
-    { .name = "CNTHCTL_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 1, .opc2 = 0,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "CNTVOFF_EL2", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 0, .opc2 = 3,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "CNTVOFF", .cp = 15, .opc1 = 4, .crm = 14,
-      .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
-      .resetvalue = 0 },
-    { .name = "CNTHP_CVAL_EL2", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 2,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "CNTHP_CVAL", .cp = 15, .opc1 = 6, .crm = 14,
-      .access = PL2_RW, .type = ARM_CP_64BIT | ARM_CP_CONST,
-      .resetvalue = 0 },
-    { .name = "CNTHP_TVAL_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 0,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "CNTHP_CTL_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 14, .crm = 2, .opc2 = 1,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "MDCR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 1,
-      .access = PL2_RW, .accessfn = access_tda,
-      .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "HPFAR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 4,
-      .access = PL2_RW, .accessfn = access_el3_aa32ns,
-      .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "HSTR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 3,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "FAR_EL2", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 0,
-      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "HIFAR", .state = ARM_CP_STATE_AA32,
-      .type = ARM_CP_CONST,
-      .cp = 15, .opc1 = 4, .crn = 6, .crm = 0, .opc2 = 2,
-      .access = PL2_RW, .resetvalue = 0 },
-};
-
-/* Ditto, but for registers which exist in ARMv8 but not v7 */
-static const ARMCPRegInfo el3_no_el2_v8_cp_reginfo[] = {
-    { .name = "HCR2", .state = ARM_CP_STATE_AA32,
-      .cp = 15, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 4,
-      .access = PL2_RW,
-      .type = ARM_CP_CONST, .resetvalue = 0 },
-};
-
 static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
 {
     ARMCPU *cpu = env_archcpu(env);
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, v8_idregs);
         define_arm_cp_regs(cpu, v8_cp_reginfo);
     }
-    if (arm_feature(env, ARM_FEATURE_EL2)) {
+
+    /*
+     * Register the base EL2 cpregs.
+     * Pre v8, these registers are implemented only as part of the
+     * Virtualization Extensions (EL2 present).  Beginning with v8,
+     * if EL2 is missing but EL3 is enabled, mostly these become
+     * RES0 from EL3, with some specific exceptions.
+     */
+    if (arm_feature(env, ARM_FEATURE_EL2)
+        || (arm_feature(env, ARM_FEATURE_EL3)
+            && arm_feature(env, ARM_FEATURE_V8))) {
         uint64_t vmpidr_def = mpidr_read_val(env);
         ARMCPRegInfo vpidr_regs[] = {
             { .name = "VPIDR", .state = ARM_CP_STATE_AA32,
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             };
             define_one_arm_cp_reg(cpu, &rvbar);
         }
-    } else {
-        /* If EL2 is missing but higher ELs are enabled, we need to
-         * register the no_el2 reginfos.
-         */
-        if (arm_feature(env, ARM_FEATURE_EL3)) {
-            /* When EL3 exists but not EL2, VPIDR and VMPIDR take the value
-             * of MIDR_EL1 and MPIDR_EL1.
-             */
-            ARMCPRegInfo vpidr_regs[] = {
-                { .name = "VPIDR_EL2", .state = ARM_CP_STATE_BOTH,
-                  .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 0,
-                  .access = PL2_RW, .accessfn = access_el3_aa32ns,
-                  .type = ARM_CP_CONST, .resetvalue = cpu->midr,
-                  .fieldoffset = offsetof(CPUARMState, cp15.vpidr_el2) },
-                { .name = "VMPIDR_EL2", .state = ARM_CP_STATE_BOTH,
-                  .opc0 = 3, .opc1 = 4, .crn = 0, .crm = 0, .opc2 = 5,
-                  .access = PL2_RW, .accessfn = access_el3_aa32ns,
-                  .type = ARM_CP_NO_RAW,
-                  .writefn = arm_cp_write_ignore, .readfn = mpidr_read },
-            };
-            define_arm_cp_regs(cpu, vpidr_regs);
-            define_arm_cp_regs(cpu, el3_no_el2_cp_reginfo);
-            if (arm_feature(env, ARM_FEATURE_V8)) {
-                define_arm_cp_regs(cpu, el3_no_el2_v8_cp_reginfo);
-            }
-        }
     }
+
+    /* Register the base EL3 cpregs. */
     if (arm_feature(env, ARM_FEATURE_EL3)) {
         define_arm_cp_regs(cpu, el3_cp_reginfo);
         ARMCPRegInfo el3_regs[] = {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Drop zcr_no_el2_reginfo and merge the 3 registers into one array,
now that ZCR_EL2 can be squashed to RES0 and ZCR_EL3 dropped
while registering.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 55 ++++++++++++++-------------------------------
 1 file changed, 17 insertions(+), 38 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void zcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     }
 }
 
-static const ARMCPRegInfo zcr_el1_reginfo = {
-    .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
-    .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL1_RW, .type = ARM_CP_SVE,
-    .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
-    .writefn = zcr_write, .raw_writefn = raw_write
-};
-
-static const ARMCPRegInfo zcr_el2_reginfo = {
-    .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
-    .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL2_RW, .type = ARM_CP_SVE,
-    .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
-    .writefn = zcr_write, .raw_writefn = raw_write
-};
-
-static const ARMCPRegInfo zcr_no_el2_reginfo = {
-    .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
-    .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL2_RW, .type = ARM_CP_SVE,
-    .readfn = arm_cp_read_zero, .writefn = arm_cp_write_ignore
-};
-
-static const ARMCPRegInfo zcr_el3_reginfo = {
-    .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
-    .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
-    .access = PL3_RW, .type = ARM_CP_SVE,
-    .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
-    .writefn = zcr_write, .raw_writefn = raw_write
+static const ARMCPRegInfo zcr_reginfo[] = {
+    { .name = "ZCR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 1, .crm = 2, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_SVE,
+      .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[1]),
+      .writefn = zcr_write, .raw_writefn = raw_write },
+    { .name = "ZCR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 2, .opc2 = 0,
+      .access = PL2_RW, .type = ARM_CP_SVE,
+      .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[2]),
+      .writefn = zcr_write, .raw_writefn = raw_write },
+    { .name = "ZCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 1, .crm = 2, .opc2 = 0,
+      .access = PL3_RW, .type = ARM_CP_SVE,
+      .fieldoffset = offsetof(CPUARMState, vfp.zcr_el[3]),
+      .writefn = zcr_write, .raw_writefn = raw_write },
 };
 
 void hw_watchpoint_update(ARMCPU *cpu, int n)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     }
 
     if (cpu_isar_feature(aa64_sve, cpu)) {
-        define_one_arm_cp_reg(cpu, &zcr_el1_reginfo);
-        if (arm_feature(env, ARM_FEATURE_EL2)) {
-            define_one_arm_cp_reg(cpu, &zcr_el2_reginfo);
-        } else {
-            define_one_arm_cp_reg(cpu, &zcr_no_el2_reginfo);
-        }
-        if (arm_feature(env, ARM_FEATURE_EL3)) {
-            define_one_arm_cp_reg(cpu, &zcr_el3_reginfo);
-        }
+        define_arm_cp_regs(cpu, zcr_reginfo);
     }
 
 #ifdef TARGET_AARCH64
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This register is present for either VHE or Debugv8p2.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo jazelle_regs[] = {
       .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 };
 
+static const ARMCPRegInfo contextidr_el2 = {
+    .name = "CONTEXTIDR_EL2", .state = ARM_CP_STATE_AA64,
+    .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 1,
+    .access = PL2_RW,
+    .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[2])
+};
+
 static const ARMCPRegInfo vhe_reginfo[] = {
-    { .name = "CONTEXTIDR_EL2", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 1,
-      .access = PL2_RW,
-      .fieldoffset = offsetof(CPUARMState, cp15.contextidr_el[2]) },
     { .name = "TTBR1_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 4, .crn = 2, .crm = 0, .opc2 = 1,
       .access = PL2_RW, .writefn = vmsa_tcr_ttbr_el2_write,
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_one_arm_cp_reg(cpu, &ssbs_reginfo);
     }
 
+    if (cpu_isar_feature(aa64_vh, cpu) ||
+        cpu_isar_feature(aa64_debugv8p2, cpu)) {
+        define_one_arm_cp_reg(cpu, &contextidr_el2);
+    }
     if (arm_feature(env, ARM_FEATURE_EL2) && cpu_isar_feature(aa64_vh, cpu)) {
         define_arm_cp_regs(cpu, vhe_reginfo);
     }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Previously we were defining some of these in user-only mode,
but none of them are accessible from user-only, therefore
define them only in system mode.

This will shortly be used from cpu_tcg.c also.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h |  6 ++++
 target/arm/cpu64.c     | 64 +++---------------------------------------
 target/arm/cpu_tcg.c   | 59 ++++++++++++++++++++++++++++++++++++++
 3 files changed, 69 insertions(+), 60 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int aarch64_fpu_gdb_get_reg(CPUARMState *env, GByteArray *buf, int reg);
 int aarch64_fpu_gdb_set_reg(CPUARMState *env, uint8_t *buf, int reg);
 #endif
 
+#ifdef CONFIG_USER_ONLY
+static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
+#else
+void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu);
+#endif
+
 #endif
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #include "hvf_arm.h"
 #include "qapi/visitor.h"
 #include "hw/qdev-properties.h"
-#include "cpregs.h"
+#include "internals.h"
 
 
-#ifndef CONFIG_USER_ONLY
-static uint64_t a57_a53_l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-{
-    ARMCPU *cpu = env_archcpu(env);
-
-    /* Number of cores is in [25:24]; otherwise we RAZ */
-    return (cpu->core_count - 1) << 24;
-}
-#endif
-
-static const ARMCPRegInfo cortex_a72_a57_a53_cp_reginfo[] = {
-#ifndef CONFIG_USER_ONLY
-    { .name = "L2CTLR_EL1", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 1, .crn = 11, .crm = 0, .opc2 = 2,
-      .access = PL1_RW, .readfn = a57_a53_l2ctlr_read,
-      .writefn = arm_cp_write_ignore },
-    { .name = "L2CTLR",
-      .cp = 15, .opc1 = 1, .crn = 9, .crm = 0, .opc2 = 2,
-      .access = PL1_RW, .readfn = a57_a53_l2ctlr_read,
-      .writefn = arm_cp_write_ignore },
-#endif
-    { .name = "L2ECTLR_EL1", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 1, .crn = 11, .crm = 0, .opc2 = 3,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "L2ECTLR",
-      .cp = 15, .opc1 = 1, .crn = 9, .crm = 0, .opc2 = 3,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "L2ACTLR", .state = ARM_CP_STATE_BOTH,
-      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 0, .opc2 = 0,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 0,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "CPUACTLR",
-      .cp = 15, .opc1 = 0, .crm = 15,
-      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
-    { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 1,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "CPUECTLR",
-      .cp = 15, .opc1 = 1, .crm = 15,
-      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
-    { .name = "CPUMERRSR_EL1", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 2,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "CPUMERRSR",
-      .cp = 15, .opc1 = 2, .crm = 15,
-      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
-    { .name = "L2MERRSR_EL1", .state = ARM_CP_STATE_AA64,
-      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 3,
-      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "L2MERRSR",
-      .cp = 15, .opc1 = 3, .crm = 15,
-      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
-};
-
 static void aarch64_a57_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
     cpu->gic_num_lrs = 4;
     cpu->gic_vpribits = 5;
     cpu->gic_vprebits = 5;
-    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
+    define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 
 static void aarch64_a53_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
     cpu->gic_num_lrs = 4;
     cpu->gic_vpribits = 5;
     cpu->gic_vprebits = 5;
-    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
+    define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 
 static void aarch64_a72_initfn(Object *obj)
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
     cpu->gic_num_lrs = 4;
     cpu->gic_vpribits = 5;
     cpu->gic_vprebits = 5;
-    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
+    define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
 #endif
 #include "cpregs.h"
 
+#ifndef CONFIG_USER_ONLY
+static uint64_t l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    ARMCPU *cpu = env_archcpu(env);
+
+    /* Number of cores is in [25:24]; otherwise we RAZ */
+    return (cpu->core_count - 1) << 24;
+}
+
+static const ARMCPRegInfo cortex_a72_a57_a53_cp_reginfo[] = {
+    { .name = "L2CTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 1, .crn = 11, .crm = 0, .opc2 = 2,
+      .access = PL1_RW, .readfn = l2ctlr_read,
+      .writefn = arm_cp_write_ignore },
+    { .name = "L2CTLR",
+      .cp = 15, .opc1 = 1, .crn = 9, .crm = 0, .opc2 = 2,
+      .access = PL1_RW, .readfn = l2ctlr_read,
+      .writefn = arm_cp_write_ignore },
+    { .name = "L2ECTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 1, .crn = 11, .crm = 0, .opc2 = 3,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "L2ECTLR",
+      .cp = 15, .opc1 = 1, .crn = 9, .crm = 0, .opc2 = 3,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "L2ACTLR", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 0, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUACTLR",
+      .cp = 15, .opc1 = 0, .crm = 15,
+      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
+    { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 1,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUECTLR",
+      .cp = 15, .opc1 = 1, .crm = 15,
+      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
+    { .name = "CPUMERRSR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 2,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUMERRSR",
+      .cp = 15, .opc1 = 2, .crm = 15,
+      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
+    { .name = "L2MERRSR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 2, .opc2 = 3,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "L2MERRSR",
+      .cp = 15, .opc1 = 3, .crm = 15,
+      .access = PL1_RW, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
+};
+
+void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu)
+{
+    define_arm_cp_regs(cpu, cortex_a72_a57_a53_cp_reginfo);
+}
+#endif /* !CONFIG_USER_ONLY */
+
 /* CPU models. These are not needed for the AArch64 linux-user build. */
 #if !defined(CONFIG_USER_ONLY) || !defined(TARGET_AARCH64)
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Instead of starting with cortex-a15 and adding v8 features to
a v7 cpu, begin with a v8 cpu stripped of its aarch64 features.
This fixes the long-standing to-do where we only enabled v8
features for user-only.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu_tcg.c | 151 ++++++++++++++++++++++++++-----------------
 1 file changed, 92 insertions(+), 59 deletions(-)

diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
 static void arm_max_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
+    uint32_t t;
 
-    cortex_a15_initfn(obj);
+    /* aarch64_a57_initfn, advertising none of the aarch64 features */
+    cpu->dtb_compatible = "arm,cortex-a57";
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_NEON);
+    set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
+    set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+    set_feature(&cpu->env, ARM_FEATURE_EL2);
+    set_feature(&cpu->env, ARM_FEATURE_EL3);
+    set_feature(&cpu->env, ARM_FEATURE_PMU);
+    cpu->midr = 0x411fd070;
+    cpu->revidr = 0x00000000;
+    cpu->reset_fpsid = 0x41034070;
+    cpu->isar.mvfr0 = 0x10110222;
+    cpu->isar.mvfr1 = 0x12111111;
+    cpu->isar.mvfr2 = 0x00000043;
+    cpu->ctr = 0x8444c004;
+    cpu->reset_sctlr = 0x00c50838;
+    cpu->isar.id_pfr0 = 0x00000131;
+    cpu->isar.id_pfr1 = 0x00011011;
+    cpu->isar.id_dfr0 = 0x03010066;
+    cpu->id_afr0 = 0x00000000;
+    cpu->isar.id_mmfr0 = 0x10101105;
+    cpu->isar.id_mmfr1 = 0x40000000;
+    cpu->isar.id_mmfr2 = 0x01260000;
+    cpu->isar.id_mmfr3 = 0x02102211;
+    cpu->isar.id_isar0 = 0x02101110;
+    cpu->isar.id_isar1 = 0x13112111;
+    cpu->isar.id_isar2 = 0x21232042;
+    cpu->isar.id_isar3 = 0x01112131;
+    cpu->isar.id_isar4 = 0x00011142;
+    cpu->isar.id_isar5 = 0x00011121;
+    cpu->isar.id_isar6 = 0;
+    cpu->isar.dbgdidr = 0x3516d000;
+    cpu->clidr = 0x0a200023;
+    cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
+    cpu->ccsidr[1] = 0x201fe012; /* 48KB L1 icache */
+    cpu->ccsidr[2] = 0x70ffe07a; /* 2048KB L2 cache */
+    define_cortex_a72_a57_a53_cp_reginfo(cpu);
 
-    /* old-style VFP short-vector support */
-    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
+    /* Add additional features supported by QEMU */
+    t = cpu->isar.id_isar5;
+    t = FIELD_DP32(t, ID_ISAR5, AES, 2);
+    t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);
+    t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);
+    t = FIELD_DP32(t, ID_ISAR5, CRC32, 1);
+    t = FIELD_DP32(t, ID_ISAR5, RDM, 1);
+    t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);
+    cpu->isar.id_isar5 = t;
+
+    t = cpu->isar.id_isar6;
+    t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
+    t = FIELD_DP32(t, ID_ISAR6, DP, 1);
+    t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
+    t = FIELD_DP32(t, ID_ISAR6, SB, 1);
+    t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
+    t = FIELD_DP32(t, ID_ISAR6, BF16, 1);
+    t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);
+    cpu->isar.id_isar6 = t;
+
+    t = cpu->isar.mvfr1;
+    t = FIELD_DP32(t, MVFR1, FPHP, 3);     /* v8.2-FP16 */
+    t = FIELD_DP32(t, MVFR1, SIMDHP, 2);   /* v8.2-FP16 */
+    cpu->isar.mvfr1 = t;
+
+    t = cpu->isar.mvfr2;
+    t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
+    t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
+    cpu->isar.mvfr2 = t;
+
+    t = cpu->isar.id_mmfr3;
+    t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */
+    cpu->isar.id_mmfr3 = t;
+
+    t = cpu->isar.id_mmfr4;
+    t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
+    t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
+    t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
+    t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
+    cpu->isar.id_mmfr4 = t;
+
+    t = cpu->isar.id_pfr0;
+    t = FIELD_DP32(t, ID_PFR0, DIT, 1);
+    cpu->isar.id_pfr0 = t;
+
+    t = cpu->isar.id_pfr2;
+    t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
+    cpu->isar.id_pfr2 = t;
 
 #ifdef CONFIG_USER_ONLY
     /*
-     * We don't set these in system emulation mode for the moment,
-     * since we don't correctly set (all of) the ID registers to
-     * advertise them.
+     * Break with true ARMv8 and add back old-style VFP short-vector support.
+     * Only do this for user-mode, where -cpu max is the default, so that
+     * older v6 and v7 programs are more likely to work without adjustment.
      */
-    set_feature(&cpu->env, ARM_FEATURE_V8);
-    {
-        uint32_t t;
-
-        t = cpu->isar.id_isar5;
-        t = FIELD_DP32(t, ID_ISAR5, AES, 2);
-        t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);
-        t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);
-        t = FIELD_DP32(t, ID_ISAR5, CRC32, 1);
-        t = FIELD_DP32(t, ID_ISAR5, RDM, 1);
-        t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);
-        cpu->isar.id_isar5 = t;
-
-        t = cpu->isar.id_isar6;
-        t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
-        t = FIELD_DP32(t, ID_ISAR6, DP, 1);
-        t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
-        t = FIELD_DP32(t, ID_ISAR6, SB, 1);
-        t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
-        t = FIELD_DP32(t, ID_ISAR6, BF16, 1);
-        t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);
-        cpu->isar.id_isar6 = t;
-
-        t = cpu->isar.mvfr1;
-        t = FIELD_DP32(t, MVFR1, FPHP, 3);     /* v8.2-FP16 */
-        t = FIELD_DP32(t, MVFR1, SIMDHP, 2);   /* v8.2-FP16 */
-        cpu->isar.mvfr1 = t;
-
-        t = cpu->isar.mvfr2;
-        t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
-        t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
-        cpu->isar.mvfr2 = t;
-
-        t = cpu->isar.id_mmfr3;
-        t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */
-        cpu->isar.id_mmfr3 = t;
-
-        t = cpu->isar.id_mmfr4;
-        t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
-        t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
-        t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
-        t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
-        cpu->isar.id_mmfr4 = t;
-
-        t = cpu->isar.id_pfr0;
-        t = FIELD_DP32(t, ID_PFR0, DIT, 1);
-        cpu->isar.id_pfr0 = t;
-
-        t = cpu->isar.id_pfr2;
-        t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
-        cpu->isar.id_pfr2 = t;
-    }
-#endif /* CONFIG_USER_ONLY */
+    cpu->isar.mvfr0 = FIELD_DP32(cpu->isar.mvfr0, MVFR0, FPSHVEC, 1);
+#endif
 }
 #endif /* !TARGET_AARCH64 */
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We set this for qemu-system-aarch64, but failed to do so
for the strictly 32-bit emulation.

Fixes: 3bec78447a9 ("target/arm: Provide ARMv8.4-PMU in '-cpu max'")
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu_tcg.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
     t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
     cpu->isar.id_pfr2 = t;
 
+    t = cpu->isar.id_dfr0;
+    t = FIELD_DP32(t, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
+    cpu->isar.id_dfr0 = t;
+
 #ifdef CONFIG_USER_ONLY
     /*
      * Break with true ARMv8 and add back old-style VFP short-vector support.
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Share the code to set AArch32 max features so that we no
longer have code drift between qemu{-system,}-{arm,aarch64}.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h |   2 +
 target/arm/cpu64.c     |  50 +-----------------
 target/arm/cpu_tcg.c   | 114 ++++++++++++++++++++++-------------------
 3 files changed, 65 insertions(+), 101 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu) { }
 void define_cortex_a72_a57_a53_cp_reginfo(ARMCPU *cpu);
 #endif
 
+void aa32_max_features(ARMCPU *cpu);
+
 #endif
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
     uint64_t t;
-    uint32_t u;
 
     if (kvm_enabled() || hvf_enabled()) {
         /* With KVM or HVF, '-cpu max' is identical to '-cpu host' */
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ZFR0, F64MM, 1);
     cpu->isar.id_aa64zfr0 = t;
 
-    /* Replicate the same data to the 32-bit id registers.  */
-    u = cpu->isar.id_isar5;
-    u = FIELD_DP32(u, ID_ISAR5, AES, 2); /* AES + PMULL */
-    u = FIELD_DP32(u, ID_ISAR5, SHA1, 1);
-    u = FIELD_DP32(u, ID_ISAR5, SHA2, 1);
-    u = FIELD_DP32(u, ID_ISAR5, CRC32, 1);
-    u = FIELD_DP32(u, ID_ISAR5, RDM, 1);
-    u = FIELD_DP32(u, ID_ISAR5, VCMA, 1);
-    cpu->isar.id_isar5 = u;
-
-    u = cpu->isar.id_isar6;
-    u = FIELD_DP32(u, ID_ISAR6, JSCVT, 1);
-    u = FIELD_DP32(u, ID_ISAR6, DP, 1);
-    u = FIELD_DP32(u, ID_ISAR6, FHM, 1);
-    u = FIELD_DP32(u, ID_ISAR6, SB, 1);
-    u = FIELD_DP32(u, ID_ISAR6, SPECRES, 1);
-    u = FIELD_DP32(u, ID_ISAR6, BF16, 1);
-    u = FIELD_DP32(u, ID_ISAR6, I8MM, 1);
-    cpu->isar.id_isar6 = u;
-
-    u = cpu->isar.id_pfr0;
-    u = FIELD_DP32(u, ID_PFR0, DIT, 1);
-    cpu->isar.id_pfr0 = u;
-
-    u = cpu->isar.id_pfr2;
-    u = FIELD_DP32(u, ID_PFR2, SSBS, 1);
-    cpu->isar.id_pfr2 = u;
-
-    u = cpu->isar.id_mmfr3;
-    u = FIELD_DP32(u, ID_MMFR3, PAN, 2); /* ATS1E1 */
-    cpu->isar.id_mmfr3 = u;
-
-    u = cpu->isar.id_mmfr4;
-    u = FIELD_DP32(u, ID_MMFR4, HPDS, 1); /* AA32HPD */
-    u = FIELD_DP32(u, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
-    u = FIELD_DP32(u, ID_MMFR4, CNP, 1); /* TTCNP */
-    u = FIELD_DP32(u, ID_MMFR4, XNX, 1); /* TTS2UXN */
-    cpu->isar.id_mmfr4 = u;
-
     t = cpu->isar.id_aa64dfr0;
     t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 5); /* v8.4-PMU */
     cpu->isar.id_aa64dfr0 = t;
 
-    u = cpu->isar.id_dfr0;
-    u = FIELD_DP32(u, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
-    cpu->isar.id_dfr0 = u;
-
-    u = cpu->isar.mvfr1;
-    u = FIELD_DP32(u, MVFR1, FPHP, 3);      /* v8.2-FP16 */
-    u = FIELD_DP32(u, MVFR1, SIMDHP, 2);    /* v8.2-FP16 */
-    cpu->isar.mvfr1 = u;
+    /* Replicate the same data to the 32-bit id registers.  */
+    aa32_max_features(cpu);
 
 #ifdef CONFIG_USER_ONLY
     /*
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
 #endif
 #include "cpregs.h"
 
+
+/* Share AArch32 -cpu max features with AArch64. */
+void aa32_max_features(ARMCPU *cpu)
+{
+    uint32_t t;
+
+    /* Add additional features supported by QEMU */
+    t = cpu->isar.id_isar5;
+    t = FIELD_DP32(t, ID_ISAR5, AES, 2);
+    t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);
+    t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);
+    t = FIELD_DP32(t, ID_ISAR5, CRC32, 1);
+    t = FIELD_DP32(t, ID_ISAR5, RDM, 1);
+    t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);
+    cpu->isar.id_isar5 = t;
+
+    t = cpu->isar.id_isar6;
+    t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
+    t = FIELD_DP32(t, ID_ISAR6, DP, 1);
+    t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
+    t = FIELD_DP32(t, ID_ISAR6, SB, 1);
+    t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
+    t = FIELD_DP32(t, ID_ISAR6, BF16, 1);
+    t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);
+    cpu->isar.id_isar6 = t;
+
+    t = cpu->isar.mvfr1;
+    t = FIELD_DP32(t, MVFR1, FPHP, 3);     /* v8.2-FP16 */
+    t = FIELD_DP32(t, MVFR1, SIMDHP, 2);   /* v8.2-FP16 */
+    cpu->isar.mvfr1 = t;
+
+    t = cpu->isar.mvfr2;
+    t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
+    t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
+    cpu->isar.mvfr2 = t;
+
+    t = cpu->isar.id_mmfr3;
+    t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */
+    cpu->isar.id_mmfr3 = t;
+
+    t = cpu->isar.id_mmfr4;
+    t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
+    t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
+    t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
+    t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
+    cpu->isar.id_mmfr4 = t;
+
+    t = cpu->isar.id_pfr0;
+    t = FIELD_DP32(t, ID_PFR0, DIT, 1);
+    cpu->isar.id_pfr0 = t;
+
+    t = cpu->isar.id_pfr2;
+    t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
+    cpu->isar.id_pfr2 = t;
+
+    t = cpu->isar.id_dfr0;
+    t = FIELD_DP32(t, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
+    cpu->isar.id_dfr0 = t;
+}
+
 #ifndef CONFIG_USER_ONLY
 static uint64_t l2ctlr_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
@@ -XXX,XX +XXX,XX @@ static void arm_v7m_class_init(ObjectClass *oc, void *data)
 static void arm_max_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
-    uint32_t t;
 
     /* aarch64_a57_initfn, advertising none of the aarch64 features */
     cpu->dtb_compatible = "arm,cortex-a57";
@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
     cpu->ccsidr[2] = 0x70ffe07a; /* 2048KB L2 cache */
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 
-    /* Add additional features supported by QEMU */
-    t = cpu->isar.id_isar5;
-    t = FIELD_DP32(t, ID_ISAR5, AES, 2);
-    t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);
-    t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);
-    t = FIELD_DP32(t, ID_ISAR5, CRC32, 1);
-    t = FIELD_DP32(t, ID_ISAR5, RDM, 1);
-    t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);
-    cpu->isar.id_isar5 = t;
-
-    t = cpu->isar.id_isar6;
-    t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
-    t = FIELD_DP32(t, ID_ISAR6, DP, 1);
-    t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
-    t = FIELD_DP32(t, ID_ISAR6, SB, 1);
-    t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
-    t = FIELD_DP32(t, ID_ISAR6, BF16, 1);
-    t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);
-    cpu->isar.id_isar6 = t;
-
-    t = cpu->isar.mvfr1;
-    t = FIELD_DP32(t, MVFR1, FPHP, 3);     /* v8.2-FP16 */
-    t = FIELD_DP32(t, MVFR1, SIMDHP, 2);   /* v8.2-FP16 */
-    cpu->isar.mvfr1 = t;
-
-    t = cpu->isar.mvfr2;
-    t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
-    t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
-    cpu->isar.mvfr2 = t;
-
-    t = cpu->isar.id_mmfr3;
-    t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */
-    cpu->isar.id_mmfr3 = t;
-
-    t = cpu->isar.id_mmfr4;
-    t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
-    t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
-    t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
-    t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
-    cpu->isar.id_mmfr4 = t;
-
-    t = cpu->isar.id_pfr0;
-    t = FIELD_DP32(t, ID_PFR0, DIT, 1);
-    cpu->isar.id_pfr0 = t;
-
-    t = cpu->isar.id_pfr2;
-    t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
-    cpu->isar.id_pfr2 = t;
-
-    t = cpu->isar.id_dfr0;
-    t = FIELD_DP32(t, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
-    cpu->isar.id_dfr0 = t;
+    aa32_max_features(cpu);
 
 #ifdef CONFIG_USER_ONLY
     /*
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Update the legacy feature names to the current names.
Provide feature names for id changes that were not marked.
Sort the field updates into increasing bitfield order.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c   | 100 +++++++++++++++++++++----------------------
 target/arm/cpu_tcg.c |  48 ++++++++++-----------
 2 files changed, 74 insertions(+), 74 deletions(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
     cpu->midr = t;
 
     t = cpu->isar.id_aa64isar0;
-    t = FIELD_DP64(t, ID_AA64ISAR0, AES, 2); /* AES + PMULL */
-    t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR0, SHA2, 2); /* SHA512 */
+    t = FIELD_DP64(t, ID_AA64ISAR0, AES, 2);      /* FEAT_PMULL */
+    t = FIELD_DP64(t, ID_AA64ISAR0, SHA1, 1);     /* FEAT_SHA1 */
+    t = FIELD_DP64(t, ID_AA64ISAR0, SHA2, 2);     /* FEAT_SHA512 */
     t = FIELD_DP64(t, ID_AA64ISAR0, CRC32, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR0, ATOMIC, 2);
-    t = FIELD_DP64(t, ID_AA64ISAR0, RDM, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR0, SHA3, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR0, SM3, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR0, SM4, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR0, DP, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR0, TS, 2); /* v8.5-CondM */
-    t = FIELD_DP64(t, ID_AA64ISAR0, TLB, 2); /* FEAT_TLBIRANGE */
-    t = FIELD_DP64(t, ID_AA64ISAR0, RNDR, 1);
+    t = FIELD_DP64(t, ID_AA64ISAR0, ATOMIC, 2);   /* FEAT_LSE */
+    t = FIELD_DP64(t, ID_AA64ISAR0, RDM, 1);      /* FEAT_RDM */
+    t = FIELD_DP64(t, ID_AA64ISAR0, SHA3, 1);     /* FEAT_SHA3 */
+    t = FIELD_DP64(t, ID_AA64ISAR0, SM3, 1);      /* FEAT_SM3 */
+    t = FIELD_DP64(t, ID_AA64ISAR0, SM4, 1);      /* FEAT_SM4 */
+    t = FIELD_DP64(t, ID_AA64ISAR0, DP, 1);       /* FEAT_DotProd */
+    t = FIELD_DP64(t, ID_AA64ISAR0, FHM, 1);      /* FEAT_FHM */
+    t = FIELD_DP64(t, ID_AA64ISAR0, TS, 2);       /* FEAT_FlagM2 */
+    t = FIELD_DP64(t, ID_AA64ISAR0, TLB, 2);      /* FEAT_TLBIRANGE */
+    t = FIELD_DP64(t, ID_AA64ISAR0, RNDR, 1);     /* FEAT_RNG */
     cpu->isar.id_aa64isar0 = t;
 
     t = cpu->isar.id_aa64isar1;
-    t = FIELD_DP64(t, ID_AA64ISAR1, DPB, 2);
-    t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR1, BF16, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 1);
-    t = FIELD_DP64(t, ID_AA64ISAR1, LRCPC, 2); /* ARMv8.4-RCPC */
-    t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 1);
+    t = FIELD_DP64(t, ID_AA64ISAR1, DPB, 2);      /* FEAT_DPB2 */
+    t = FIELD_DP64(t, ID_AA64ISAR1, JSCVT, 1);    /* FEAT_JSCVT */
+    t = FIELD_DP64(t, ID_AA64ISAR1, FCMA, 1);     /* FEAT_FCMA */
+    t = FIELD_DP64(t, ID_AA64ISAR1, LRCPC, 2);    /* FEAT_LRCPC2 */
+    t = FIELD_DP64(t, ID_AA64ISAR1, FRINTTS, 1);  /* FEAT_FRINTTS */
+    t = FIELD_DP64(t, ID_AA64ISAR1, SB, 1);       /* FEAT_SB */
+    t = FIELD_DP64(t, ID_AA64ISAR1, SPECRES, 1);  /* FEAT_SPECRES */
+    t = FIELD_DP64(t, ID_AA64ISAR1, BF16, 1);     /* FEAT_BF16 */
+    t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 1);     /* FEAT_I8MM */
     cpu->isar.id_aa64isar1 = t;
 
     t = cpu->isar.id_aa64pfr0;
+    t = FIELD_DP64(t, ID_AA64PFR0, FP, 1);        /* FEAT_FP16 */
+    t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 1);   /* FEAT_FP16 */
     t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-    t = FIELD_DP64(t, ID_AA64PFR0, FP, 1);
-    t = FIELD_DP64(t, ID_AA64PFR0, ADVSIMD, 1);
-    t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1);
-    t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1);
+    t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1);      /* FEAT_SEL2 */
+    t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1);       /* FEAT_DIT */
     cpu->isar.id_aa64pfr0 = t;
 
     t = cpu->isar.id_aa64pfr1;
-    t = FIELD_DP64(t, ID_AA64PFR1, BT, 1);
-    t = FIELD_DP64(t, ID_AA64PFR1, SSBS, 2);
+    t = FIELD_DP64(t, ID_AA64PFR1, BT, 1);        /* FEAT_BTI */
+    t = FIELD_DP64(t, ID_AA64PFR1, SSBS, 2);      /* FEAT_SSBS2 */
     /*
      * Begin with full support for MTE. This will be downgraded to MTE=0
      * during realize if the board provides no tag memory, much like
      * we do for EL2 with the virtualization=on property.
      */
-    t = FIELD_DP64(t, ID_AA64PFR1, MTE, 3);
+    t = FIELD_DP64(t, ID_AA64PFR1, MTE, 3);       /* FEAT_MTE3 */
     cpu->isar.id_aa64pfr1 = t;
 
     t = cpu->isar.id_aa64mmfr0;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
-    t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1); /* HPD */
-    t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1);
-    t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);
-    t = FIELD_DP64(t, ID_AA64MMFR1, PAN, 2); /* ATS1E1 */
-    t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* VMID16 */
-    t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1); /* TTS2UXN */
+    t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
+    t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
+    t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1);     /* FEAT_HPDS */
+    t = FIELD_DP64(t, ID_AA64MMFR1, LO, 1);       /* FEAT_LOR */
+    t = FIELD_DP64(t, ID_AA64MMFR1, PAN, 2);      /* FEAT_PAN2 */
+    t = FIELD_DP64(t, ID_AA64MMFR1, XNX, 1);      /* FEAT_XNX */
     cpu->isar.id_aa64mmfr1 = t;
 
     t = cpu->isar.id_aa64mmfr2;
-    t = FIELD_DP64(t, ID_AA64MMFR2, UAO, 1);
-    t = FIELD_DP64(t, ID_AA64MMFR2, CNP, 1); /* TTCNP */
-    t = FIELD_DP64(t, ID_AA64MMFR2, ST, 1); /* TTST */
-    t = FIELD_DP64(t, ID_AA64MMFR2, VARANGE, 1); /* FEAT_LVA */
-    t = FIELD_DP64(t, ID_AA64MMFR2, TTL, 1); /* FEAT_TTL */
-    t = FIELD_DP64(t, ID_AA64MMFR2, BBM, 2); /* FEAT_BBM at level 2 */
+    t = FIELD_DP64(t, ID_AA64MMFR2, CNP, 1);      /* FEAT_TTCNP */
+    t = FIELD_DP64(t, ID_AA64MMFR2, UAO, 1);      /* FEAT_UAO */
+    t = FIELD_DP64(t, ID_AA64MMFR2, VARANGE, 1);  /* FEAT_LVA */
+    t = FIELD_DP64(t, ID_AA64MMFR2, ST, 1);       /* FEAT_TTST */
+    t = FIELD_DP64(t, ID_AA64MMFR2, TTL, 1);      /* FEAT_TTL */
+    t = FIELD_DP64(t, ID_AA64MMFR2, BBM, 2);      /* FEAT_BBM at level 2 */
     cpu->isar.id_aa64mmfr2 = t;
 
     t = cpu->isar.id_aa64zfr0;
     t = FIELD_DP64(t, ID_AA64ZFR0, SVEVER, 1);
-    t = FIELD_DP64(t, ID_AA64ZFR0, AES, 2);  /* PMULL */
-    t = FIELD_DP64(t, ID_AA64ZFR0, BITPERM, 1);
-    t = FIELD_DP64(t, ID_AA64ZFR0, BFLOAT16, 1);
-    t = FIELD_DP64(t, ID_AA64ZFR0, SHA3, 1);
-    t = FIELD_DP64(t, ID_AA64ZFR0, SM4, 1);
-    t = FIELD_DP64(t, ID_AA64ZFR0, I8MM, 1);
-    t = FIELD_DP64(t, ID_AA64ZFR0, F32MM, 1);
-    t = FIELD_DP64(t, ID_AA64ZFR0, F64MM, 1);
+    t = FIELD_DP64(t, ID_AA64ZFR0, AES, 2);       /* FEAT_SVE_PMULL128 */
+    t = FIELD_DP64(t, ID_AA64ZFR0, BITPERM, 1);   /* FEAT_SVE_BitPerm */
+    t = FIELD_DP64(t, ID_AA64ZFR0, BFLOAT16, 1);  /* FEAT_BF16 */
+    t = FIELD_DP64(t, ID_AA64ZFR0, SHA3, 1);      /* FEAT_SVE_SHA3 */
+    t = FIELD_DP64(t, ID_AA64ZFR0, SM4, 1);       /* FEAT_SVE_SM4 */
+    t = FIELD_DP64(t, ID_AA64ZFR0, I8MM, 1);      /* FEAT_I8MM */
+    t = FIELD_DP64(t, ID_AA64ZFR0, F32MM, 1);     /* FEAT_F32MM */
+    t = FIELD_DP64(t, ID_AA64ZFR0, F64MM, 1);     /* FEAT_F64MM */
     cpu->isar.id_aa64zfr0 = t;
 
     t = cpu->isar.id_aa64dfr0;
-    t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 5); /* v8.4-PMU */
+    t = FIELD_DP64(t, ID_AA64DFR0, PMUVER, 5);    /* FEAT_PMUv3p4 */
     cpu->isar.id_aa64dfr0 = t;
 
     /* Replicate the same data to the 32-bit id registers.  */
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ void aa32_max_features(ARMCPU *cpu)
 
     /* Add additional features supported by QEMU */
     t = cpu->isar.id_isar5;
-    t = FIELD_DP32(t, ID_ISAR5, AES, 2);
-    t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);
-    t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);
+    t = FIELD_DP32(t, ID_ISAR5, AES, 2);          /* FEAT_PMULL */
+    t = FIELD_DP32(t, ID_ISAR5, SHA1, 1);         /* FEAT_SHA1 */
+    t = FIELD_DP32(t, ID_ISAR5, SHA2, 1);         /* FEAT_SHA256 */
     t = FIELD_DP32(t, ID_ISAR5, CRC32, 1);
-    t = FIELD_DP32(t, ID_ISAR5, RDM, 1);
-    t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);
+    t = FIELD_DP32(t, ID_ISAR5, RDM, 1);          /* FEAT_RDM */
+    t = FIELD_DP32(t, ID_ISAR5, VCMA, 1);         /* FEAT_FCMA */
     cpu->isar.id_isar5 = t;
 
     t = cpu->isar.id_isar6;
-    t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);
-    t = FIELD_DP32(t, ID_ISAR6, DP, 1);
-    t = FIELD_DP32(t, ID_ISAR6, FHM, 1);
-    t = FIELD_DP32(t, ID_ISAR6, SB, 1);
-    t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);
-    t = FIELD_DP32(t, ID_ISAR6, BF16, 1);
-    t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);
+    t = FIELD_DP32(t, ID_ISAR6, JSCVT, 1);        /* FEAT_JSCVT */
+    t = FIELD_DP32(t, ID_ISAR6, DP, 1);           /* Feat_DotProd */
+    t = FIELD_DP32(t, ID_ISAR6, FHM, 1);          /* FEAT_FHM */
+    t = FIELD_DP32(t, ID_ISAR6, SB, 1);           /* FEAT_SB */
+    t = FIELD_DP32(t, ID_ISAR6, SPECRES, 1);      /* FEAT_SPECRES */
+    t = FIELD_DP32(t, ID_ISAR6, BF16, 1);         /* FEAT_AA32BF16 */
+    t = FIELD_DP32(t, ID_ISAR6, I8MM, 1);         /* FEAT_AA32I8MM */
     cpu->isar.id_isar6 = t;
 
     t = cpu->isar.mvfr1;
-    t = FIELD_DP32(t, MVFR1, FPHP, 3);     /* v8.2-FP16 */
-    t = FIELD_DP32(t, MVFR1, SIMDHP, 2);   /* v8.2-FP16 */
+    t = FIELD_DP32(t, MVFR1, FPHP, 3);            /* FEAT_FP16 */
+    t = FIELD_DP32(t, MVFR1, SIMDHP, 2);          /* FEAT_FP16 */
     cpu->isar.mvfr1 = t;
 
     t = cpu->isar.mvfr2;
-    t = FIELD_DP32(t, MVFR2, SIMDMISC, 3); /* SIMD MaxNum */
-    t = FIELD_DP32(t, MVFR2, FPMISC, 4);   /* FP MaxNum */
+    t = FIELD_DP32(t, MVFR2, SIMDMISC, 3);        /* SIMD MaxNum */
+    t = FIELD_DP32(t, MVFR2, FPMISC, 4);          /* FP MaxNum */
     cpu->isar.mvfr2 = t;
 
     t = cpu->isar.id_mmfr3;
-    t = FIELD_DP32(t, ID_MMFR3, PAN, 2); /* ATS1E1 */
+    t = FIELD_DP32(t, ID_MMFR3, PAN, 2);          /* FEAT_PAN2 */
     cpu->isar.id_mmfr3 = t;
 
     t = cpu->isar.id_mmfr4;
-    t = FIELD_DP32(t, ID_MMFR4, HPDS, 1); /* AA32HPD */
-    t = FIELD_DP32(t, ID_MMFR4, AC2, 1); /* ACTLR2, HACTLR2 */
-    t = FIELD_DP32(t, ID_MMFR4, CNP, 1); /* TTCNP */
-    t = FIELD_DP32(t, ID_MMFR4, XNX, 1); /* TTS2UXN */
+    t = FIELD_DP32(t, ID_MMFR4, HPDS, 1);         /* FEAT_AA32HPD */
+    t = FIELD_DP32(t, ID_MMFR4, AC2, 1);          /* ACTLR2, HACTLR2 */
+    t = FIELD_DP32(t, ID_MMFR4, CNP, 1);          /* FEAT_TTCNP */
+    t = FIELD_DP32(t, ID_MMFR4, XNX, 1);          /* FEAT_XNX*/
     cpu->isar.id_mmfr4 = t;
 
     t = cpu->isar.id_pfr0;
-    t = FIELD_DP32(t, ID_PFR0, DIT, 1);
+    t = FIELD_DP32(t, ID_PFR0, DIT, 1);           /* FEAT_DIT */
     cpu->isar.id_pfr0 = t;
 
     t = cpu->isar.id_pfr2;
-    t = FIELD_DP32(t, ID_PFR2, SSBS, 1);
+    t = FIELD_DP32(t, ID_PFR2, SSBS, 1);          /* FEAT_SSBS */
     cpu->isar.id_pfr2 = t;
 
     t = cpu->isar.id_dfr0;
-    t = FIELD_DP32(t, ID_DFR0, PERFMON, 5); /* v8.4-PMU */
+    t = FIELD_DP32(t, ID_DFR0, PERFMON, 5);       /* FEAT_PMUv3p4 */
     cpu->isar.id_dfr0 = t;
 }
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Use FIELD_DP{32,64} to manipulate id_pfr1 and id_aa64pfr0
during arm_cpu_realizefn.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
          */
         unset_feature(env, ARM_FEATURE_EL3);
 
-        /* Disable the security extension feature bits in the processor feature
-         * registers as well. These are id_pfr1[7:4] and id_aa64pfr0[15:12].
+        /*
+         * Disable the security extension feature bits in the processor
+         * feature registers as well.
          */
-        cpu->isar.id_pfr1 &= ~0xf0;
-        cpu->isar.id_aa64pfr0 &= ~0xf000;
+        cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1, ID_PFR1, SECURITY, 0);
+        cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
+                                           ID_AA64PFR0, EL3, 0);
     }
 
     if (!cpu->has_el2) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_realizefn(DeviceState *dev, Error **errp)
     }
 
     if (!arm_feature(env, ARM_FEATURE_EL2)) {
-        /* Disable the hypervisor feature bits in the processor feature
-         * registers if we don't have EL2. These are id_pfr1[15:12] and
-         * id_aa64pfr0_el1[11:8].
+        /*
+         * Disable the hypervisor feature bits in the processor feature
+         * registers if we don't have EL2.
          */
-        cpu->isar.id_aa64pfr0 &= ~0xf00;
-        cpu->isar.id_pfr1 &= ~0xf000;
+        cpu->isar.id_aa64pfr0 = FIELD_DP64(cpu->isar.id_aa64pfr0,
+                                           ID_AA64PFR0, EL2, 0);
+        cpu->isar.id_pfr1 = FIELD_DP32(cpu->isar.id_pfr1,
+                                       ID_PFR1, VIRTUALIZATION, 0);
     }
 
 #ifndef CONFIG_USER_ONLY
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The only portion of FEAT_Debugv8p2 that is relevant to QEMU
is CONTEXTIDR_EL2, which is also conditionally implemented
with FEAT_VHE.  The rest of the debug extension concerns the
External debug interface, which is outside the scope of QEMU.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/cpu.c              | 1 +
 target/arm/cpu64.c            | 1 +
 target/arm/cpu_tcg.c          | 2 ++
 4 files changed, 5 insertions(+)

From: Richard Henderson <richard.henderson@linaro.org>

This extension concerns changes to the External Debug interface,
with Secure and Non-secure access to the debug registers, and all
of it is outside the scope of QEMU.  Indicating support for this
is mandatory with FEAT_SEL2, which we do implement.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/cpu64.c            | 2 +-
 target/arm/cpu_tcg.c          | 4 ++--
 3 files changed, 4 insertions(+), 3 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Add only the system registers required to implement zero error
records.  This means that all values for ERRSELR are out of range,
which means that it and all of the indexed error record registers
need not be implemented.

Add the EL2 registers required for injecting virtual SError.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h    |  5 +++
 target/arm/helper.c | 84 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 89 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint64_t tfsr_el[4]; /* tfsre0_el1 is index 0.  */
         uint64_t gcr_el1;
         uint64_t rgsr_el1;
+
+        /* Minimal RAS registers */
+        uint64_t disr_el1;
+        uint64_t vdisr_el2;
+        uint64_t vsesr_el2;
     } cp15;
 
     struct {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
       .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
 };
 
+/*
+ * Check for traps to RAS registers, which are controlled
+ * by HCR_EL2.TERR and SCR_EL3.TERR.
+ */
+static CPAccessResult access_terr(CPUARMState *env, const ARMCPRegInfo *ri,
+                                  bool isread)
+{
+    int el = arm_current_el(env);
+
+    if (el < 2 && (arm_hcr_el2_eff(env) & HCR_TERR)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+    if (el < 3 && (env->cp15.scr_el3 & SCR_TERR)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static uint64_t disr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    int el = arm_current_el(env);
+
+    if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) {
+        return env->cp15.vdisr_el2;
+    }
+    if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) {
+        return 0; /* RAZ/WI */
+    }
+    return env->cp15.disr_el1;
+}
+
+static void disr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t val)
+{
+    int el = arm_current_el(env);
+
+    if (el < 2 && (arm_hcr_el2_eff(env) & HCR_AMO)) {
+        env->cp15.vdisr_el2 = val;
+        return;
+    }
+    if (el < 3 && (env->cp15.scr_el3 & SCR_EA)) {
+        return; /* RAZ/WI */
+    }
+    env->cp15.disr_el1 = val;
+}
+
+/*
+ * Minimal RAS implementation with no Error Records.
+ * Which means that all of the Error Record registers:
+ *   ERXADDR_EL1
+ *   ERXCTLR_EL1
+ *   ERXFR_EL1
+ *   ERXMISC0_EL1
+ *   ERXMISC1_EL1
+ *   ERXMISC2_EL1
+ *   ERXMISC3_EL1
+ *   ERXPFGCDN_EL1  (RASv1p1)
+ *   ERXPFGCTL_EL1  (RASv1p1)
+ *   ERXPFGF_EL1    (RASv1p1)
+ *   ERXSTATUS_EL1
+ * and
+ *   ERRSELR_EL1
+ * may generate UNDEFINED, which is the effect we get by not
+ * listing them at all.
+ */
+static const ARMCPRegInfo minimal_ras_reginfo[] = {
+    { .name = "DISR_EL1", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 0, .crn = 12, .crm = 1, .opc2 = 1,
+      .access = PL1_RW, .fieldoffset = offsetof(CPUARMState, cp15.disr_el1),
+      .readfn = disr_read, .writefn = disr_write, .raw_writefn = raw_write },
+    { .name = "ERRIDR_EL1", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 0, .crn = 5, .crm = 3, .opc2 = 0,
+      .access = PL1_R, .accessfn = access_terr,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "VDISR_EL2", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 4, .crn = 12, .crm = 1, .opc2 = 1,
+      .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vdisr_el2) },
+    { .name = "VSESR_EL2", .state = ARM_CP_STATE_BOTH,
+      .opc0 = 3, .opc1 = 4, .crn = 5, .crm = 2, .opc2 = 3,
+      .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.vsesr_el2) },
+};
+
 /* Return the exception level to which exceptions should be taken
  * via SVEAccessTrap.  If an exception should be routed through
  * AArch64.AdvSIMDFPAccessTrap, return 0; fp_exception_el should
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     if (cpu_isar_feature(aa64_ssbs, cpu)) {
         define_one_arm_cp_reg(cpu, &ssbs_reginfo);
     }
+    if (cpu_isar_feature(any_ras, cpu)) {
+        define_arm_cp_regs(cpu, minimal_ras_reginfo);
+    }
 
     if (cpu_isar_feature(aa64_vh, cpu) ||
         cpu_isar_feature(aa64_debugv8p2, cpu)) {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Enable writes to the TERR and TEA bits when RAS is enabled.
These bits are otherwise RES0.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         }
         valid_mask &= ~SCR_NET;
 
+        if (cpu_isar_feature(aa64_ras, cpu)) {
+            valid_mask |= SCR_TERR;
+        }
         if (cpu_isar_feature(aa64_lor, cpu)) {
             valid_mask |= SCR_TLOR;
         }
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
+        if (cpu_isar_feature(aa32_ras, cpu)) {
+            valid_mask |= SCR_TERR;
+        }
     }
 
     if (!arm_feature(env, ARM_FEATURE_EL2)) {
@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
         if (cpu_isar_feature(aa64_vh, cpu)) {
             valid_mask |= HCR_E2H;
         }
+        if (cpu_isar_feature(aa64_ras, cpu)) {
+            valid_mask |= HCR_TERR | HCR_TEA;
+        }
         if (cpu_isar_feature(aa64_lor, cpu)) {
             valid_mask |= HCR_TLOR;
         }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Virtual SError exceptions are raised by setting HCR_EL2.VSE,
and are routed to EL1 just like other virtual exceptions.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-16-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h       |  2 ++
 target/arm/internals.h |  8 ++++++++
 target/arm/syndrome.h  |  5 +++++
 target/arm/cpu.c       | 38 +++++++++++++++++++++++++++++++++++++-
 target/arm/helper.c    | 40 +++++++++++++++++++++++++++++++++++++++-
 5 files changed, 91 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@
 #define EXCP_LSERR          21   /* v8M LSERR SecureFault */
 #define EXCP_UNALIGNED      22   /* v7M UNALIGNED UsageFault */
 #define EXCP_DIVBYZERO      23   /* v7M DIVBYZERO UsageFault */
+#define EXCP_VSERR          24
 /* NB: add new EXCP_ defines to the array in arm_log_exception() too */
 
 #define ARMV7M_EXCP_RESET   1
@@ -XXX,XX +XXX,XX @@ enum {
 #define CPU_INTERRUPT_FIQ   CPU_INTERRUPT_TGT_EXT_1
 #define CPU_INTERRUPT_VIRQ  CPU_INTERRUPT_TGT_EXT_2
 #define CPU_INTERRUPT_VFIQ  CPU_INTERRUPT_TGT_EXT_3
+#define CPU_INTERRUPT_VSERR CPU_INTERRUPT_TGT_INT_0
 
 /* The usual mapping for an AArch64 system register to its AArch32
  * counterpart is for the 32 bit world to have access to the lower
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_update_virq(ARMCPU *cpu);
  */
 void arm_cpu_update_vfiq(ARMCPU *cpu);
 
+/**
+ * arm_cpu_update_vserr: Update CPU_INTERRUPT_VSERR bit
+ *
+ * Update the CPU_INTERRUPT_VSERR bit in cs->interrupt_request,
+ * following a change to the HCR_EL2.VSE bit.
+ */
+void arm_cpu_update_vserr(ARMCPU *cpu);
+
 /**
  * arm_mmu_idx_el:
  * @env: The cpu environment
diff --git a/target/arm/syndrome.h b/target/arm/syndrome.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/syndrome.h
+++ b/target/arm/syndrome.h
@@ -XXX,XX +XXX,XX @@ static inline uint32_t syn_pcalignment(void)
     return (EC_PCALIGNMENT << ARM_EL_EC_SHIFT) | ARM_EL_IL;
 }
 
+static inline uint32_t syn_serror(uint32_t extra)
+{
+    return (EC_SERROR << ARM_EL_EC_SHIFT) | ARM_EL_IL | extra;
+}
+
 #endif /* TARGET_ARM_SYNDROME_H */
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_has_work(CPUState *cs)
     return (cpu->power_state != PSCI_OFF)
         && cs->interrupt_request &
         (CPU_INTERRUPT_FIQ | CPU_INTERRUPT_HARD
-         | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ
+         | CPU_INTERRUPT_VFIQ | CPU_INTERRUPT_VIRQ | CPU_INTERRUPT_VSERR
          | CPU_INTERRUPT_EXITTB);
 }
 
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
             return false;
         }
         return !(env->daif & PSTATE_I);
+    case EXCP_VSERR:
+        if (!(hcr_el2 & HCR_AMO) || (hcr_el2 & HCR_TGE)) {
+            /* VIRQs are only taken when hypervized.  */
+            return false;
+        }
+        return !(env->daif & PSTATE_A);
     default:
         g_assert_not_reached();
     }
@@ -XXX,XX +XXX,XX @@ static bool arm_cpu_exec_interrupt(CPUState *cs, int interrupt_request)
             goto found;
         }
     }
+    if (interrupt_request & CPU_INTERRUPT_VSERR) {
+        excp_idx = EXCP_VSERR;
+        target_el = 1;
+        if (arm_excp_unmasked(cs, excp_idx, target_el,
+                              cur_el, secure, hcr_el2)) {
+            /* Taking a virtual abort clears HCR_EL2.VSE */
+            env->cp15.hcr_el2 &= ~HCR_VSE;
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
+            goto found;
+        }
+    }
     return false;
 
  found:
@@ -XXX,XX +XXX,XX @@ void arm_cpu_update_vfiq(ARMCPU *cpu)
     }
 }
 
+void arm_cpu_update_vserr(ARMCPU *cpu)
+{
+    /*
+     * Update the interrupt level for VSERR, which is the HCR_EL2.VSE bit.
+     */
+    CPUARMState *env = &cpu->env;
+    CPUState *cs = CPU(cpu);
+
+    bool new_state = env->cp15.hcr_el2 & HCR_VSE;
+
+    if (new_state != ((cs->interrupt_request & CPU_INTERRUPT_VSERR) != 0)) {
+        if (new_state) {
+            cpu_interrupt(cs, CPU_INTERRUPT_VSERR);
+        } else {
+            cpu_reset_interrupt(cs, CPU_INTERRUPT_VSERR);
+        }
+    }
+}
+
 #ifndef CONFIG_USER_ONLY
 static void arm_cpu_set_irq(void *opaque, int irq, int level)
 {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
         }
     }
 
-    /* External aborts are not possible in QEMU so A bit is always clear */
+    if (hcr_el2 & HCR_AMO) {
+        if (cs->interrupt_request & CPU_INTERRUPT_VSERR) {
+            ret |= CPSR_A;
+        }
+    }
+
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
     g_assert(qemu_mutex_iothread_locked());
     arm_cpu_update_virq(cpu);
     arm_cpu_update_vfiq(cpu);
+    arm_cpu_update_vserr(cpu);
 }
 
 static void hcr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
@@ -XXX,XX +XXX,XX @@ void arm_log_exception(CPUState *cs)
             [EXCP_LSERR] = "v8M LSERR UsageFault",
             [EXCP_UNALIGNED] = "v7M UNALIGNED UsageFault",
             [EXCP_DIVBYZERO] = "v7M DIVBYZERO UsageFault",
+            [EXCP_VSERR] = "Virtual SERR",
         };
 
         if (idx >= 0 && idx < ARRAY_SIZE(excnames)) {
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch32(CPUState *cs)
         mask = CPSR_A | CPSR_I | CPSR_F;
         offset = 4;
         break;
+    case EXCP_VSERR:
+        {
+            /*
+             * Note that this is reported as a data abort, but the DFAR
+             * has an UNKNOWN value.  Construct the SError syndrome from
+             * AET and ExT fields.
+             */
+            ARMMMUFaultInfo fi = { .type = ARMFault_AsyncExternal, };
+
+            if (extended_addresses_enabled(env)) {
+                env->exception.fsr = arm_fi_to_lfsc(&fi);
+            } else {
+                env->exception.fsr = arm_fi_to_sfsc(&fi);
+            }
+            env->exception.fsr |= env->cp15.vsesr_el2 & 0xd000;
+            A32_BANKED_CURRENT_REG_SET(env, dfsr, env->exception.fsr);
+            qemu_log_mask(CPU_LOG_INT, "...with IFSR 0x%x\n",
+                          env->exception.fsr);
+
+            new_mode = ARM_CPU_MODE_ABT;
+            addr = 0x10;
+            mask = CPSR_A | CPSR_I;
+            offset = 8;
+        }
+        break;
     case EXCP_SMC:
         new_mode = ARM_CPU_MODE_MON;
         addr = 0x08;
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
     case EXCP_VFIQ:
         addr += 0x100;
         break;
+    case EXCP_VSERR:
+        addr += 0x180;
+        /* Construct the SError syndrome from IDS and ISS fields. */
+        env->exception.syndrome = syn_serror(env->cp15.vsesr_el2 & 0x1ffffff);
+        env->cp15.esr_el[new_el] = env->exception.syndrome;
+        break;
     default:
         cpu_abort(cs, "Unhandled exception 0x%x\n", cs->exception_index);
     }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Check for and defer any pending virtual SError.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-17-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h        |  1 +
 target/arm/a32.decode      | 16 ++++++++------
 target/arm/t32.decode      | 18 ++++++++--------
 target/arm/op_helper.c     | 43 ++++++++++++++++++++++++++++++++++++++
 target/arm/translate-a64.c | 17 +++++++++++++++
 target/arm/translate.c     | 23 ++++++++++++++++++++
 6 files changed, 103 insertions(+), 15 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_1(wfe, void, env)
 DEF_HELPER_1(yield, void, env)
 DEF_HELPER_1(pre_hvc, void, env)
 DEF_HELPER_2(pre_smc, void, env, i32)
+DEF_HELPER_1(vesb, void, env)
 
 DEF_HELPER_3(cpsr_write, void, env, i32, i32)
 DEF_HELPER_2(cpsr_write_eret, void, env, i32)
diff --git a/target/arm/a32.decode b/target/arm/a32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/a32.decode
+++ b/target/arm/a32.decode
@@ -XXX,XX +XXX,XX @@ SMULTT           .... 0001 0110 .... 0000 .... 1110 ....      @rd0mn
 
 {
   {
-    YIELD        ---- 0011 0010 0000 1111 ---- 0000 0001
-    WFE          ---- 0011 0010 0000 1111 ---- 0000 0010
-    WFI          ---- 0011 0010 0000 1111 ---- 0000 0011
+    [
+      YIELD      ---- 0011 0010 0000 1111 ---- 0000 0001
+      WFE        ---- 0011 0010 0000 1111 ---- 0000 0010
+      WFI        ---- 0011 0010 0000 1111 ---- 0000 0011
 
-    # TODO: Implement SEV, SEVL; may help SMP performance.
-    # SEV        ---- 0011 0010 0000 1111 ---- 0000 0100
-    # SEVL       ---- 0011 0010 0000 1111 ---- 0000 0101
+      # TODO: Implement SEV, SEVL; may help SMP performance.
+      # SEV      ---- 0011 0010 0000 1111 ---- 0000 0100
+      # SEVL     ---- 0011 0010 0000 1111 ---- 0000 0101
+
+      ESB        ---- 0011 0010 0000 1111 ---- 0001 0000
+    ]
 
     # The canonical nop ends in 00000000, but the whole of the
     # rest of the space executes as nop if otherwise unsupported.
diff --git a/target/arm/t32.decode b/target/arm/t32.decode
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/t32.decode
+++ b/target/arm/t32.decode
@@ -XXX,XX +XXX,XX @@ CLZ              1111 1010 1011 ---- 1111 .... 1000 ....      @rdm
   [
     # Hints, and CPS
     {
-      YIELD      1111 0011 1010 1111 1000 0000 0000 0001
-      WFE        1111 0011 1010 1111 1000 0000 0000 0010
-      WFI        1111 0011 1010 1111 1000 0000 0000 0011
+      [
+        YIELD    1111 0011 1010 1111 1000 0000 0000 0001
+        WFE      1111 0011 1010 1111 1000 0000 0000 0010
+        WFI      1111 0011 1010 1111 1000 0000 0000 0011
 
-      # TODO: Implement SEV, SEVL; may help SMP performance.
-      # SEV      1111 0011 1010 1111 1000 0000 0000 0100
-      # SEVL     1111 0011 1010 1111 1000 0000 0000 0101
+        # TODO: Implement SEV, SEVL; may help SMP performance.
+        # SEV    1111 0011 1010 1111 1000 0000 0000 0100
+        # SEVL   1111 0011 1010 1111 1000 0000 0000 0101
 
-      # For M-profile minimal-RAS ESB can be a NOP, which is the
-      # default behaviour since it is in the hint space.
-      # ESB      1111 0011 1010 1111 1000 0000 0001 0000
+        ESB      1111 0011 1010 1111 1000 0000 0001 0000
+      ]
 
       # The canonical nop ends in 0000 0000, but the whole rest
       # of the space is "reserved hint, behaves as nop".
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void HELPER(probe_access)(CPUARMState *env, target_ulong ptr,
                      access_type, mmu_idx, ra);
     }
 }
+
+/*
+ * This function corresponds to AArch64.vESBOperation().
+ * Note that the AArch32 version is not functionally different.
+ */
+void HELPER(vesb)(CPUARMState *env)
+{
+    /*
+     * The EL2Enabled() check is done inside arm_hcr_el2_eff,
+     * and will return HCR_EL2.VSE == 0, so nothing happens.
+     */
+    uint64_t hcr = arm_hcr_el2_eff(env);
+    bool enabled = !(hcr & HCR_TGE) && (hcr & HCR_AMO);
+    bool pending = enabled && (hcr & HCR_VSE);
+    bool masked  = (env->daif & PSTATE_A);
+
+    /* If VSE pending and masked, defer the exception.  */
+    if (pending && masked) {
+        uint32_t syndrome;
+
+        if (arm_el_is_aa64(env, 1)) {
+            /* Copy across IDS and ISS from VSESR. */
+            syndrome = env->cp15.vsesr_el2 & 0x1ffffff;
+        } else {
+            ARMMMUFaultInfo fi = { .type = ARMFault_AsyncExternal };
+
+            if (extended_addresses_enabled(env)) {
+                syndrome = arm_fi_to_lfsc(&fi);
+            } else {
+                syndrome = arm_fi_to_sfsc(&fi);
+            }
+            /* Copy across AET and ExT from VSESR. */
+            syndrome |= env->cp15.vsesr_el2 & 0xd000;
+        }
+
+        /* Set VDISR_EL2.A along with the syndrome. */
+        env->cp15.vdisr_el2 = syndrome | (1u << 31);
+
+        /* Clear pending virtual SError */
+        env->cp15.hcr_el2 &= ~HCR_VSE;
+        cpu_reset_interrupt(env_cpu(env), CPU_INTERRUPT_VSERR);
+    }
+}
diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_hint(DisasContext *s, uint32_t insn,
             gen_helper_autib(cpu_X[17], cpu_env, cpu_X[17], cpu_X[16]);
         }
         break;
+    case 0b10000: /* ESB */
+        /* Without RAS, we must implement this as NOP. */
+        if (dc_isar_feature(aa64_ras, s)) {
+            /*
+             * QEMU does not have a source of physical SErrors,
+             * so we are only concerned with virtual SErrors.
+             * The pseudocode in the ARM for this case is
+             *   if PSTATE.EL IN {EL0, EL1} && EL2Enabled() then
+             *      AArch64.vESBOperation();
+             * Most of the condition can be evaluated at translation time.
+             * Test for EL2 present, and defer test for SEL2 to runtime.
+             */
+            if (s->current_el <= 1 && arm_dc_feature(s, ARM_FEATURE_EL2)) {
+                gen_helper_vesb(cpu_env);
+            }
+        }
+        break;
     case 0b11000: /* PACIAZ */
         if (s->pauth_active) {
             gen_helper_pacia(cpu_X[30], cpu_env, cpu_X[30],
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_WFI(DisasContext *s, arg_WFI *a)
     return true;
 }
 
+static bool trans_ESB(DisasContext *s, arg_ESB *a)
+{
+    /*
+     * For M-profile, minimal-RAS ESB can be a NOP.
+     * Without RAS, we must implement this as NOP.
+     */
+    if (!arm_dc_feature(s, ARM_FEATURE_M) && dc_isar_feature(aa32_ras, s)) {
+        /*
+         * QEMU does not have a source of physical SErrors,
+         * so we are only concerned with virtual SErrors.
+         * The pseudocode in the ARM for this case is
+         *   if PSTATE.EL IN {EL0, EL1} && EL2Enabled() then
+         *      AArch32.vESBOperation();
+         * Most of the condition can be evaluated at translation time.
+         * Test for EL2 present, and defer test for SEL2 to runtime.
+         */
+        if (s->current_el <= 1 && arm_dc_feature(s, ARM_FEATURE_EL2)) {
+            gen_helper_vesb(cpu_env);
+        }
+    }
+    return true;
+}
+
 static bool trans_NOP(DisasContext *s, arg_NOP *a)
 {
     return true;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-18-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/cpu64.c            | 1 +
 target/arm/cpu_tcg.c          | 1 +
 3 files changed, 3 insertions(+)

From: Richard Henderson <richard.henderson@linaro.org>

This feature is AArch64 only, and applies to physical SErrors,
which QEMU does not implement, thus the feature is a nop.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-19-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/cpu64.c            | 1 +
 2 files changed, 2 insertions(+)

From: Richard Henderson <richard.henderson@linaro.org>

This extension concerns branch speculation, which TCG does
not implement.  Thus we can trivially enable this feature.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-20-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/cpu64.c            | 1 +
 target/arm/cpu_tcg.c          | 1 +
 3 files changed, 3 insertions(+)

From: Richard Henderson <richard.henderson@linaro.org>

There is no branch prediction in TCG, therefore there is no
need to actually include the context number into the predictor.
Therefore all we need to do is add the state for SCXTNUM_ELx.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-21-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst |  3 ++
 target/arm/cpu.h              | 16 +++++++++
 target/arm/cpu.c              |  5 +++
 target/arm/cpu64.c            |  3 +-
 target/arm/helper.c           | 61 ++++++++++++++++++++++++++++++++++-
 5 files changed, 86 insertions(+), 2 deletions(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_BF16 (AArch64 BFloat16 instructions)
 - FEAT_BTI (Branch Target Identification)
 - FEAT_CSV2 (Cache speculation variant 2)
+- FEAT_CSV2_1p1 (Cache speculation variant 2, version 1.1)
+- FEAT_CSV2_1p2 (Cache speculation variant 2, version 1.2)
+- FEAT_CSV2_2 (Cache speculation variant 2, version 2)
 - FEAT_DIT (Data Independent Timing instructions)
 - FEAT_DPB (DC CVAP instruction)
 - FEAT_Debugv8p2 (Debug changes for v8.2)
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         ARMPACKey apdb;
         ARMPACKey apga;
     } keys;
+
+    uint64_t scxtnum_el[4];
 #endif
 
 #if defined(CONFIG_USER_ONLY)
@@ -XXX,XX +XXX,XX @@ void pmu_init(ARMCPU *cpu);
 #define SCTLR_WXN     (1U << 19)
 #define SCTLR_ST      (1U << 20) /* up to ??, RAZ in v6 */
 #define SCTLR_UWXN    (1U << 20) /* v7 onward, AArch32 only */
+#define SCTLR_TSCXT   (1U << 20) /* FEAT_CSV2_1p2, AArch64 only */
 #define SCTLR_FI      (1U << 21) /* up to v7, v8 RES0 */
 #define SCTLR_IESB    (1U << 21) /* v8.2-IESB, AArch64 only */
 #define SCTLR_U       (1U << 22) /* up to v6, RAO in v7 */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_dit(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, DIT) != 0;
 }
 
+static inline bool isar_feature_aa64_scxtnum(const ARMISARegisters *id)
+{
+    int key = FIELD_EX64(id->id_aa64pfr0, ID_AA64PFR0, CSV2);
+    if (key >= 2) {
+        return true;      /* FEAT_CSV2_2 */
+    }
+    if (key == 1) {
+        key = FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, CSV2_FRAC);
+        return key >= 2;  /* FEAT_CSV2_1p2 */
+    }
+    return false;
+}
+
 static inline bool isar_feature_aa64_ssbs(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64pfr1, ID_AA64PFR1, SSBS) != 0;
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_reset(DeviceState *dev)
              */
             env->cp15.gcr_el1 = 0x1ffff;
         }
+        /*
+         * Disable access to SCXTNUM_EL0 from CSV2_1p2.
+         * This is not yet exposed from the Linux kernel in any way.
+         */
+        env->cp15.sctlr_el[1] |= SCTLR_TSCXT;
 #else
         /* Reset into the highest available EL */
         if (arm_feature(env, ARM_FEATURE_EL3)) {
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
     t = FIELD_DP64(t, ID_AA64PFR0, SEL2, 1);      /* FEAT_SEL2 */
     t = FIELD_DP64(t, ID_AA64PFR0, DIT, 1);       /* FEAT_DIT */
-    t = FIELD_DP64(t, ID_AA64PFR0, CSV2, 1);      /* FEAT_CSV2 */
+    t = FIELD_DP64(t, ID_AA64PFR0, CSV2, 2);      /* FEAT_CSV2_2 */
     cpu->isar.id_aa64pfr0 = t;
 
     t = cpu->isar.id_aa64pfr1;
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
      * we do for EL2 with the virtualization=on property.
      */
     t = FIELD_DP64(t, ID_AA64PFR1, MTE, 3);       /* FEAT_MTE3 */
+    t = FIELD_DP64(t, ID_AA64PFR1, CSV2_FRAC, 0); /* FEAT_CSV2_2 */
     cpu->isar.id_aa64pfr1 = t;
 
     t = cpu->isar.id_aa64mmfr0;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void scr_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
         if (cpu_isar_feature(aa64_mte, cpu)) {
             valid_mask |= SCR_ATA;
         }
+        if (cpu_isar_feature(aa64_scxtnum, cpu)) {
+            valid_mask |= SCR_ENSCXT;
+        }
     } else {
         valid_mask &= ~(SCR_RW | SCR_ST);
         if (cpu_isar_feature(aa32_ras, cpu)) {
@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
         if (cpu_isar_feature(aa64_mte, cpu)) {
             valid_mask |= HCR_ATA | HCR_DCT | HCR_TID5;
         }
+        if (cpu_isar_feature(aa64_scxtnum, cpu)) {
+            valid_mask |= HCR_ENSCXT;
+        }
     }
 
     /* Clear RES0 bits.  */
@@ -XXX,XX +XXX,XX @@ static void define_arm_vh_e2h_redirects_aliases(ARMCPU *cpu)
         { K(3, 0,  5, 6, 0), K(3, 4,  5, 6, 0), K(3, 5, 5, 6, 0),
           "TFSR_EL1", "TFSR_EL2", "TFSR_EL12", isar_feature_aa64_mte },
 
+        { K(3, 0, 13, 0, 7), K(3, 4, 13, 0, 7), K(3, 5, 13, 0, 7),
+          "SCXTNUM_EL1", "SCXTNUM_EL2", "SCXTNUM_EL12",
+          isar_feature_aa64_scxtnum },
+
         /* TODO: ARMv8.2-SPE -- PMSCR_EL2 */
         /* TODO: ARMv8.4-Trace -- TRFCR_EL2 */
     };
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo mte_el0_cacheop_reginfo[] = {
     },
 };
 
-#endif
+static CPAccessResult access_scxtnum(CPUARMState *env, const ARMCPRegInfo *ri,
+                                     bool isread)
+{
+    uint64_t hcr = arm_hcr_el2_eff(env);
+    int el = arm_current_el(env);
+
+    if (el == 0 && !((hcr & HCR_E2H) && (hcr & HCR_TGE))) {
+        if (env->cp15.sctlr_el[1] & SCTLR_TSCXT) {
+            if (hcr & HCR_TGE) {
+                return CP_ACCESS_TRAP_EL2;
+            }
+            return CP_ACCESS_TRAP;
+        }
+    } else if (el < 2 && (env->cp15.sctlr_el[2] & SCTLR_TSCXT)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+    if (el < 2 && arm_is_el2_enabled(env) && !(hcr & HCR_ENSCXT)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+    if (el < 3
+        && arm_feature(env, ARM_FEATURE_EL3)
+        && !(env->cp15.scr_el3 & SCR_ENSCXT)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static const ARMCPRegInfo scxtnum_reginfo[] = {
+    { .name = "SCXTNUM_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 3, .crn = 13, .crm = 0, .opc2 = 7,
+      .access = PL0_RW, .accessfn = access_scxtnum,
+      .fieldoffset = offsetof(CPUARMState, scxtnum_el[0]) },
+    { .name = "SCXTNUM_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 13, .crm = 0, .opc2 = 7,
+      .access = PL1_RW, .accessfn = access_scxtnum,
+      .fieldoffset = offsetof(CPUARMState, scxtnum_el[1]) },
+    { .name = "SCXTNUM_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 13, .crm = 0, .opc2 = 7,
+      .access = PL2_RW, .accessfn = access_scxtnum,
+      .fieldoffset = offsetof(CPUARMState, scxtnum_el[2]) },
+    { .name = "SCXTNUM_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 13, .crm = 0, .opc2 = 7,
+      .access = PL3_RW,
+      .fieldoffset = offsetof(CPUARMState, scxtnum_el[3]) },
+};
+#endif /* TARGET_AARCH64 */
 
 static CPAccessResult access_predinv(CPUARMState *env, const ARMCPRegInfo *ri,
                                      bool isread)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
         define_arm_cp_regs(cpu, mte_tco_ro_reginfo);
         define_arm_cp_regs(cpu, mte_el0_cacheop_reginfo);
     }
+
+    if (cpu_isar_feature(aa64_scxtnum, cpu)) {
+        define_arm_cp_regs(cpu, scxtnum_reginfo);
+    }
 #endif
 
     if (cpu_isar_feature(any_predinv, cpu)) {
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This extension concerns cache speculation, which TCG does
not implement.  Thus we can trivially enable this feature.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-22-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/cpu64.c            | 1 +
 target/arm/cpu_tcg.c          | 1 +
 3 files changed, 3 insertions(+)

From: Richard Henderson <richard.henderson@linaro.org>

This extension concerns not merging memory access, which TCG does
not implement.  Thus we can trivially enable this feature.
Add a comment to handle_hint for the DGH instruction, but no code.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-23-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst | 1 +
 target/arm/cpu64.c            | 1 +
 target/arm/translate-a64.c    | 1 +
 3 files changed, 3 insertions(+)

From: Richard Henderson <richard.henderson@linaro.org>

Enable the a76 for virt and sbsa board use.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-24-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/virt.rst |  1 +
 hw/arm/sbsa-ref.c        |  1 +
 hw/arm/virt.c            |  1 +
 target/arm/cpu64.c       | 66 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 69 insertions(+)

diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/virt.rst
+++ b/docs/system/arm/virt.rst
@@ -XXX,XX +XXX,XX @@ Supported guest CPU types:
 - ``cortex-a53`` (64-bit)
 - ``cortex-a57`` (64-bit)
 - ``cortex-a72`` (64-bit)
+- ``cortex-a76`` (64-bit)
 - ``a64fx`` (64-bit)
 - ``host`` (with KVM only)
 - ``max`` (same as ``host`` for KVM; best possible emulation with TCG)
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static const int sbsa_ref_irqmap[] = {
 static const char * const valid_cpus[] = {
     ARM_CPU_TYPE_NAME("cortex-a57"),
     ARM_CPU_TYPE_NAME("cortex-a72"),
+    ARM_CPU_TYPE_NAME("cortex-a76"),
     ARM_CPU_TYPE_NAME("max"),
 };
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static const char *valid_cpus[] = {
     ARM_CPU_TYPE_NAME("cortex-a53"),
     ARM_CPU_TYPE_NAME("cortex-a57"),
     ARM_CPU_TYPE_NAME("cortex-a72"),
+    ARM_CPU_TYPE_NAME("cortex-a76"),
     ARM_CPU_TYPE_NAME("a64fx"),
     ARM_CPU_TYPE_NAME("host"),
     ARM_CPU_TYPE_NAME("max"),
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
     define_cortex_a72_a57_a53_cp_reginfo(cpu);
 }
 
+static void aarch64_a76_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    cpu->dtb_compatible = "arm,cortex-a76";
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_NEON);
+    set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
+    set_feature(&cpu->env, ARM_FEATURE_AARCH64);
+    set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+    set_feature(&cpu->env, ARM_FEATURE_EL2);
+    set_feature(&cpu->env, ARM_FEATURE_EL3);
+    set_feature(&cpu->env, ARM_FEATURE_PMU);
+
+    /* Ordered by B2.4 AArch64 registers by functional group */
+    cpu->clidr = 0x82000023;
+    cpu->ctr = 0x8444C004;
+    cpu->dcz_blocksize = 4;
+    cpu->isar.id_aa64dfr0  = 0x0000000010305408ull;
+    cpu->isar.id_aa64isar0 = 0x0000100010211120ull;
+    cpu->isar.id_aa64isar1 = 0x0000000000100001ull;
+    cpu->isar.id_aa64mmfr0 = 0x0000000000101122ull;
+    cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
+    cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
+    cpu->isar.id_aa64pfr0  = 0x1100000010111112ull; /* GIC filled in later */
+    cpu->isar.id_aa64pfr1  = 0x0000000000000010ull;
+    cpu->id_afr0       = 0x00000000;
+    cpu->isar.id_dfr0  = 0x04010088;
+    cpu->isar.id_isar0 = 0x02101110;
+    cpu->isar.id_isar1 = 0x13112111;
+    cpu->isar.id_isar2 = 0x21232042;
+    cpu->isar.id_isar3 = 0x01112131;
+    cpu->isar.id_isar4 = 0x00010142;
+    cpu->isar.id_isar5 = 0x01011121;
+    cpu->isar.id_isar6 = 0x00000010;
+    cpu->isar.id_mmfr0 = 0x10201105;
+    cpu->isar.id_mmfr1 = 0x40000000;
+    cpu->isar.id_mmfr2 = 0x01260000;
+    cpu->isar.id_mmfr3 = 0x02122211;
+    cpu->isar.id_mmfr4 = 0x00021110;
+    cpu->isar.id_pfr0  = 0x10010131;
+    cpu->isar.id_pfr1  = 0x00010000; /* GIC filled in later */
+    cpu->isar.id_pfr2  = 0x00000011;
+    cpu->midr = 0x414fd0b1;          /* r4p1 */
+    cpu->revidr = 0;
+
+    /* From B2.18 CCSIDR_EL1 */
+    cpu->ccsidr[0] = 0x701fe01a; /* 64KB L1 dcache */
+    cpu->ccsidr[1] = 0x201fe01a; /* 64KB L1 icache */
+    cpu->ccsidr[2] = 0x707fe03a; /* 512KB L2 cache */
+
+    /* From B2.93 SCTLR_EL3 */
+    cpu->reset_sctlr = 0x30c50838;
+
+    /* From B4.23 ICH_VTR_EL2 */
+    cpu->gic_num_lrs = 4;
+    cpu->gic_vpribits = 5;
+    cpu->gic_vprebits = 5;
+
+    /* From B5.1 AdvSIMD AArch64 register summary */
+    cpu->isar.mvfr0 = 0x10110222;
+    cpu->isar.mvfr1 = 0x13211111;
+    cpu->isar.mvfr2 = 0x00000043;
+}
+
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "cortex-a57",         .initfn = aarch64_a57_initfn },
     { .name = "cortex-a53",         .initfn = aarch64_a53_initfn },
     { .name = "cortex-a72",         .initfn = aarch64_a72_initfn },
+    { .name = "cortex-a76",         .initfn = aarch64_a76_initfn },
     { .name = "a64fx",              .initfn = aarch64_a64fx_initfn },
     { .name = "max",                .initfn = aarch64_max_initfn },
 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Enable the n1 for virt and sbsa board use.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220506180242.216785-25-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/virt.rst |  1 +
 hw/arm/sbsa-ref.c        |  1 +
 hw/arm/virt.c            |  1 +
 target/arm/cpu64.c       | 66 ++++++++++++++++++++++++++++++++++++++++
 4 files changed, 69 insertions(+)

diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/virt.rst
+++ b/docs/system/arm/virt.rst
@@ -XXX,XX +XXX,XX @@ Supported guest CPU types:
 - ``cortex-a76`` (64-bit)
 - ``a64fx`` (64-bit)
 - ``host`` (with KVM only)
+- ``neoverse-n1`` (64-bit)
 - ``max`` (same as ``host`` for KVM; best possible emulation with TCG)
 
 Note that the default is ``cortex-a15``, so for an AArch64 guest you must
diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static const char * const valid_cpus[] = {
     ARM_CPU_TYPE_NAME("cortex-a57"),
     ARM_CPU_TYPE_NAME("cortex-a72"),
     ARM_CPU_TYPE_NAME("cortex-a76"),
+    ARM_CPU_TYPE_NAME("neoverse-n1"),
     ARM_CPU_TYPE_NAME("max"),
 };
 
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static const char *valid_cpus[] = {
     ARM_CPU_TYPE_NAME("cortex-a72"),
     ARM_CPU_TYPE_NAME("cortex-a76"),
     ARM_CPU_TYPE_NAME("a64fx"),
+    ARM_CPU_TYPE_NAME("neoverse-n1"),
     ARM_CPU_TYPE_NAME("host"),
     ARM_CPU_TYPE_NAME("max"),
 };
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a76_initfn(Object *obj)
     cpu->isar.mvfr2 = 0x00000043;
 }
 
+static void aarch64_neoverse_n1_initfn(Object *obj)
+{
+    ARMCPU *cpu = ARM_CPU(obj);
+
+    cpu->dtb_compatible = "arm,neoverse-n1";
+    set_feature(&cpu->env, ARM_FEATURE_V8);
+    set_feature(&cpu->env, ARM_FEATURE_NEON);
+    set_feature(&cpu->env, ARM_FEATURE_GENERIC_TIMER);
+    set_feature(&cpu->env, ARM_FEATURE_AARCH64);
+    set_feature(&cpu->env, ARM_FEATURE_CBAR_RO);
+    set_feature(&cpu->env, ARM_FEATURE_EL2);
+    set_feature(&cpu->env, ARM_FEATURE_EL3);
+    set_feature(&cpu->env, ARM_FEATURE_PMU);
+
+    /* Ordered by B2.4 AArch64 registers by functional group */
+    cpu->clidr = 0x82000023;
+    cpu->ctr = 0x8444c004;
+    cpu->dcz_blocksize = 4;
+    cpu->isar.id_aa64dfr0  = 0x0000000110305408ull;
+    cpu->isar.id_aa64isar0 = 0x0000100010211120ull;
+    cpu->isar.id_aa64isar1 = 0x0000000000100001ull;
+    cpu->isar.id_aa64mmfr0 = 0x0000000000101125ull;
+    cpu->isar.id_aa64mmfr1 = 0x0000000010212122ull;
+    cpu->isar.id_aa64mmfr2 = 0x0000000000001011ull;
+    cpu->isar.id_aa64pfr0  = 0x1100000010111112ull; /* GIC filled in later */
+    cpu->isar.id_aa64pfr1  = 0x0000000000000020ull;
+    cpu->id_afr0       = 0x00000000;
+    cpu->isar.id_dfr0  = 0x04010088;
+    cpu->isar.id_isar0 = 0x02101110;
+    cpu->isar.id_isar1 = 0x13112111;
+    cpu->isar.id_isar2 = 0x21232042;
+    cpu->isar.id_isar3 = 0x01112131;
+    cpu->isar.id_isar4 = 0x00010142;
+    cpu->isar.id_isar5 = 0x01011121;
+    cpu->isar.id_isar6 = 0x00000010;
+    cpu->isar.id_mmfr0 = 0x10201105;
+    cpu->isar.id_mmfr1 = 0x40000000;
+    cpu->isar.id_mmfr2 = 0x01260000;
+    cpu->isar.id_mmfr3 = 0x02122211;
+    cpu->isar.id_mmfr4 = 0x00021110;
+    cpu->isar.id_pfr0  = 0x10010131;
+    cpu->isar.id_pfr1  = 0x00010000; /* GIC filled in later */
+    cpu->isar.id_pfr2  = 0x00000011;
+    cpu->midr = 0x414fd0c1;          /* r4p1 */
+    cpu->revidr = 0;
+
+    /* From B2.23 CCSIDR_EL1 */
+    cpu->ccsidr[0] = 0x701fe01a; /* 64KB L1 dcache */
+    cpu->ccsidr[1] = 0x201fe01a; /* 64KB L1 icache */
+    cpu->ccsidr[2] = 0x70ffe03a; /* 1MB L2 cache */
+
+    /* From B2.98 SCTLR_EL3 */
+    cpu->reset_sctlr = 0x30c50838;
+
+    /* From B4.23 ICH_VTR_EL2 */
+    cpu->gic_num_lrs = 4;
+    cpu->gic_vpribits = 5;
+    cpu->gic_vprebits = 5;
+
+    /* From B5.1 AdvSIMD AArch64 register summary */
+    cpu->isar.mvfr0 = 0x10110222;
+    cpu->isar.mvfr1 = 0x13211111;
+    cpu->isar.mvfr2 = 0x00000043;
+}
+
 void arm_cpu_sve_finalize(ARMCPU *cpu, Error **errp)
 {
     /*
@@ -XXX,XX +XXX,XX @@ static const ARMCPUInfo aarch64_cpus[] = {
     { .name = "cortex-a72",         .initfn = aarch64_a72_initfn },
     { .name = "cortex-a76",         .initfn = aarch64_a76_initfn },
     { .name = "a64fx",              .initfn = aarch64_a64fx_initfn },
+    { .name = "neoverse-n1",        .initfn = aarch64_neoverse_n1_initfn },
     { .name = "max",                .initfn = aarch64_max_initfn },
 #if defined(CONFIG_KVM) || defined(CONFIG_HVF)
     { .name = "host",               .initfn = aarch64_host_initfn },
-- 
2.25.1

From: Leif Lindholm <quic_llindhol@quicinc.com>

The sbsa-ref machine is continuously evolving. Some of the changes we
want to make in the near future, to align with real components (e.g.
the GIC-700), will break compatibility for existing firmware.

Introduce two new properties to the DT generated on machine generation:
- machine-version-major
  To be incremented when a platform change makes the machine
  incompatible with existing firmware.
- machine-version-minor
  To be incremented when functionality is added to the machine
  without causing incompatibility with existing firmware.
  to be reset to 0 when machine-version-major is incremented.

This versioning scheme is *neither*:
- A QEMU versioned machine type; a given version of QEMU will emulate
  a given version of the platform.
- A reflection of level of SBSA (now SystemReady SR) support provided.

The version will increment on guest-visible functional changes only,
akin to a revision ID register found on a physical platform.

These properties are both introduced with the value 0.
(Hence, a machine where the DT is lacking these nodes is equivalent
to version 0.0.)

Signed-off-by: Leif Lindholm <quic_llindhol@quicinc.com>
Message-id: 20220505113947.75714-1-quic_llindhol@quicinc.com
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Radoslaw Biernacki <rad@semihalf.com>
Cc: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
     qemu_fdt_setprop_cell(fdt, "/", "#address-cells", 0x2);
     qemu_fdt_setprop_cell(fdt, "/", "#size-cells", 0x2);
 
+    /*
+     * This versioning scheme is for informing platform fw only. It is neither:
+     * - A QEMU versioned machine type; a given version of QEMU will emulate
+     *   a given version of the platform.
+     * - A reflection of level of SBSA (now SystemReady SR) support provided.
+     *
+     * machine-version-major: updated when changes breaking fw compatibility
+     *                        are introduced.
+     * machine-version-minor: updated when features are added that don't break
+     *                        fw compatibility.
+     */
+    qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
+    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 0);
+
     if (ms->numa_state->have_numa_distance) {
         int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
         uint32_t *matrix = g_malloc0(size);
-- 
2.25.1

From: Gavin Shan <gshan@redhat.com>

This adds cluster-id in CPU instance properties, which will be used
by arm/virt machine. Besides, the cluster-id is also verified or
dumped in various spots:

* hw/core/machine.c::machine_set_cpu_numa_node() to associate
    CPU with its NUMA node.

* hw/core/machine.c::machine_numa_finish_cpu_init() to record
    CPU slots with no NUMA mapping set.

* hw/core/machine-hmp-cmds.c::hmp_hotpluggable_cpus() to dump
    cluster-id.

Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20220503140304.855514-2-gshan@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 qapi/machine.json          |  6 ++++--
 hw/core/machine-hmp-cmds.c |  4 ++++
 hw/core/machine.c          | 16 ++++++++++++++++
 3 files changed, 24 insertions(+), 2 deletions(-)

diff --git a/qapi/machine.json b/qapi/machine.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/machine.json
+++ b/qapi/machine.json
@@ -XXX,XX +XXX,XX @@
 # @node-id: NUMA node ID the CPU belongs to
 # @socket-id: socket number within node/board the CPU belongs to
 # @die-id: die number within socket the CPU belongs to (since 4.1)
-# @core-id: core number within die the CPU belongs to
+# @cluster-id: cluster number within die the CPU belongs to (since 7.1)
+# @core-id: core number within cluster the CPU belongs to
 # @thread-id: thread number within core the CPU belongs to
 #
-# Note: currently there are 5 properties that could be present
+# Note: currently there are 6 properties that could be present
 #       but management should be prepared to pass through other
 #       properties with device_add command to allow for future
 #       interface extension. This also requires the filed names to be kept in
@@ -XXX,XX +XXX,XX @@
   'data': { '*node-id': 'int',
             '*socket-id': 'int',
             '*die-id': 'int',
+            '*cluster-id': 'int',
             '*core-id': 'int',
             '*thread-id': 'int'
   }
diff --git a/hw/core/machine-hmp-cmds.c b/hw/core/machine-hmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/machine-hmp-cmds.c
+++ b/hw/core/machine-hmp-cmds.c
@@ -XXX,XX +XXX,XX @@ void hmp_hotpluggable_cpus(Monitor *mon, const QDict *qdict)
         if (c->has_die_id) {
             monitor_printf(mon, "    die-id: \"%" PRIu64 "\"\n", c->die_id);
         }
+        if (c->has_cluster_id) {
+            monitor_printf(mon, "    cluster-id: \"%" PRIu64 "\"\n",
+                           c->cluster_id);
+        }
         if (c->has_core_id) {
             monitor_printf(mon, "    core-id: \"%" PRIu64 "\"\n", c->core_id);
         }
diff --git a/hw/core/machine.c b/hw/core/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
             return;
         }
 
+        if (props->has_cluster_id && !slot->props.has_cluster_id) {
+            error_setg(errp, "cluster-id is not supported");
+            return;
+        }
+
         if (props->has_socket_id && !slot->props.has_socket_id) {
             error_setg(errp, "socket-id is not supported");
             return;
@@ -XXX,XX +XXX,XX @@ void machine_set_cpu_numa_node(MachineState *machine,
                 continue;
         }
 
+        if (props->has_cluster_id &&
+            props->cluster_id != slot->props.cluster_id) {
+                continue;
+        }
+
         if (props->has_die_id && props->die_id != slot->props.die_id) {
                 continue;
         }
@@ -XXX,XX +XXX,XX @@ static char *cpu_slot_to_string(const CPUArchId *cpu)
         }
         g_string_append_printf(s, "die-id: %"PRId64, cpu->props.die_id);
     }
+    if (cpu->props.has_cluster_id) {
+        if (s->len) {
+            g_string_append_printf(s, ", ");
+        }
+        g_string_append_printf(s, "cluster-id: %"PRId64, cpu->props.cluster_id);
+    }
     if (cpu->props.has_core_id) {
         if (s->len) {
             g_string_append_printf(s, ", ");
-- 
2.25.1

From: Gavin Shan <gshan@redhat.com>

The CPU topology isn't enabled on arm/virt machine yet, but we're
going to do it in next patch. After the CPU topology is enabled by
next patch, "thread-id=1" becomes invalid because the CPU core is
preferred on arm/virt machine. It means these two CPUs have 0/1
as their core IDs, but their thread IDs are all 0. It will trigger
test failure as the following message indicates:

[14/21 qemu:qtest+qtest-aarch64 / qtest-aarch64/numa-test  ERROR
  1.48s   killed by signal 6 SIGABRT
  >>> G_TEST_DBUS_DAEMON=/home/gavin/sandbox/qemu.main/tests/dbus-vmstate-daemon.sh \
      QTEST_QEMU_STORAGE_DAEMON_BINARY=./storage-daemon/qemu-storage-daemon         \
      QTEST_QEMU_BINARY=./qemu-system-aarch64                                       \
      QTEST_QEMU_IMG=./qemu-img MALLOC_PERTURB_=83                                  \
      /home/gavin/sandbox/qemu.main/build/tests/qtest/numa-test --tap -k
  ――――――――――――――――――――――――――――――――――――――――――――――
  stderr:
  qemu-system-aarch64: -numa cpu,node-id=0,thread-id=1: no match found

This fixes the issue by providing comprehensive SMP configurations
in aarch64_numa_cpu(). The SMP configurations aren't used before
the CPU topology is enabled in next patch.

Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
Message-id: 20220503140304.855514-3-gshan@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/numa-test.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

From: Gavin Shan <gshan@redhat.com>

Currently, the SMP configuration isn't considered when the CPU
topology is populated. In this case, it's impossible to provide
the default CPU-to-NUMA mapping or association based on the socket
ID of the given CPU.

This takes account of SMP configuration when the CPU topology
is populated. The die ID for the given CPU isn't assigned since
it's not supported on arm/virt machine. Besides, the used SMP
configuration in qtest/numa-test/aarch64_numa_cpu() is corrcted
to avoid testing failure

Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20220503140304.855514-4-gshan@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static const CPUArchIdList *virt_possible_cpu_arch_ids(MachineState *ms)
     int n;
     unsigned int max_cpus = ms->smp.max_cpus;
     VirtMachineState *vms = VIRT_MACHINE(ms);
+    MachineClass *mc = MACHINE_GET_CLASS(vms);
 
     if (ms->possible_cpus) {
         assert(ms->possible_cpus->len == max_cpus);
@@ -XXX,XX +XXX,XX @@ static const CPUArchIdList *virt_possible_cpu_arch_ids(MachineState *ms)
         ms->possible_cpus->cpus[n].type = ms->cpu_type;
         ms->possible_cpus->cpus[n].arch_id =
             virt_cpu_mp_affinity(vms, n);
+
+        assert(!mc->smp_props.dies_supported);
+        ms->possible_cpus->cpus[n].props.has_socket_id = true;
+        ms->possible_cpus->cpus[n].props.socket_id =
+            n / (ms->smp.clusters * ms->smp.cores * ms->smp.threads);
+        ms->possible_cpus->cpus[n].props.has_cluster_id = true;
+        ms->possible_cpus->cpus[n].props.cluster_id =
+            (n / (ms->smp.cores * ms->smp.threads)) % ms->smp.clusters;
+        ms->possible_cpus->cpus[n].props.has_core_id = true;
+        ms->possible_cpus->cpus[n].props.core_id =
+            (n / ms->smp.threads) % ms->smp.cores;
         ms->possible_cpus->cpus[n].props.has_thread_id = true;
-        ms->possible_cpus->cpus[n].props.thread_id = n;
+        ms->possible_cpus->cpus[n].props.thread_id =
+            n % ms->smp.threads;
     }
     return ms->possible_cpus;
 }
-- 
2.25.1

From: Gavin Shan <gshan@redhat.com>

In aarch64_numa_cpu(), the CPU and NUMA association is something
like below. Two threads in the same core/cluster/socket are
associated with two individual NUMA nodes, which is unreal as
Igor Mammedov mentioned. We don't expect the association to break
NUMA-to-socket boundary, which matches with the real world.

NUMA-node  socket  cluster   core   thread
    ------------------------------------------
        0       0        0        0      0
        1       0        0        0      1

This corrects the topology for CPUs and their association with
NUMA nodes. After this patch is applied, the CPU and NUMA
association becomes something like below, which looks real.
Besides, socket/cluster/core/thread IDs are all checked when
the NUMA node IDs are verified. It helps to check if the CPU
topology is properly populated or not.

NUMA-node  socket  cluster   core   thread
    ------------------------------------------
       0        1        0        0       0
       1        0        0        0       0

Suggested-by: Igor Mammedov <imammedo@redhat.com>
Signed-off-by: Gavin Shan <gshan@redhat.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20220503140304.855514-5-gshan@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/numa-test.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/tests/qtest/numa-test.c b/tests/qtest/numa-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/numa-test.c
+++ b/tests/qtest/numa-test.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_numa_cpu(const void *data)
     g_autofree char *cli = NULL;
 
     cli = make_cli(data, "-machine "
-        "smp.cpus=2,smp.sockets=1,smp.clusters=1,smp.cores=1,smp.threads=2 "
+        "smp.cpus=2,smp.sockets=2,smp.clusters=1,smp.cores=1,smp.threads=1 "
         "-numa node,nodeid=0,memdev=ram -numa node,nodeid=1 "
-        "-numa cpu,node-id=1,thread-id=0 "
-        "-numa cpu,node-id=0,thread-id=1");
+        "-numa cpu,node-id=0,socket-id=1,cluster-id=0,core-id=0,thread-id=0 "
+        "-numa cpu,node-id=1,socket-id=0,cluster-id=0,core-id=0,thread-id=0");
     qts = qtest_init(cli);
     cpus = get_cpus(qts, &resp);
     g_assert(cpus);
 
     while ((e = qlist_pop(cpus))) {
         QDict *cpu, *props;
-        int64_t thread, node;
+        int64_t socket, cluster, core, thread, node;
 
         cpu = qobject_to(QDict, e);
         g_assert(qdict_haskey(cpu, "props"));
@@ -XXX,XX +XXX,XX @@ static void aarch64_numa_cpu(const void *data)
 
         g_assert(qdict_haskey(props, "node-id"));
         node = qdict_get_int(props, "node-id");
+        g_assert(qdict_haskey(props, "socket-id"));
+        socket = qdict_get_int(props, "socket-id");
+        g_assert(qdict_haskey(props, "cluster-id"));
+        cluster = qdict_get_int(props, "cluster-id");
+        g_assert(qdict_haskey(props, "core-id"));
+        core = qdict_get_int(props, "core-id");
         g_assert(qdict_haskey(props, "thread-id"));
         thread = qdict_get_int(props, "thread-id");
 
-        if (thread == 0) {
+        if (socket == 0 && cluster == 0 && core == 0 && thread == 0) {
             g_assert_cmpint(node, ==, 1);
-        } else if (thread == 1) {
+        } else if (socket == 1 && cluster == 0 && core == 0 && thread == 0) {
             g_assert_cmpint(node, ==, 0);
         } else {
             g_assert(false);
-- 
2.25.1

From: Gavin Shan <gshan@redhat.com>

When CPU-to-NUMA association isn't explicitly provided by users,
the default one is given by mc->get_default_cpu_node_id(). However,
the CPU topology isn't fully considered in the default association
and this causes CPU topology broken warnings on booting Linux guest.

For example, the following warning messages are observed when the
Linux guest is booted with the following command lines.

/home/gavin/sandbox/qemu.main/build/qemu-system-aarch64 \
  -accel kvm -machine virt,gic-version=host               \
  -cpu host                                               \
  -smp 6,sockets=2,cores=3,threads=1                      \
  -m 1024M,slots=16,maxmem=64G                            \
  -object memory-backend-ram,id=mem0,size=128M            \
  -object memory-backend-ram,id=mem1,size=128M            \
  -object memory-backend-ram,id=mem2,size=128M            \
  -object memory-backend-ram,id=mem3,size=128M            \
  -object memory-backend-ram,id=mem4,size=128M            \
  -object memory-backend-ram,id=mem4,size=384M            \
  -numa node,nodeid=0,memdev=mem0                         \
  -numa node,nodeid=1,memdev=mem1                         \
  -numa node,nodeid=2,memdev=mem2                         \
  -numa node,nodeid=3,memdev=mem3                         \
  -numa node,nodeid=4,memdev=mem4                         \
  -numa node,nodeid=5,memdev=mem5
         :
  alternatives: patching kernel code
  BUG: arch topology borken
  the CLS domain not a subset of the MC domain
  <the above error log repeats>
  BUG: arch topology borken
  the DIE domain not a subset of the NODE domain

With current implementation of mc->get_default_cpu_node_id(),
CPU#0 to CPU#5 are associated with NODE#0 to NODE#5 separately.
That's incorrect because CPU#0/1/2 should be associated with same
NUMA node because they're seated in same socket.

This fixes the issue by considering the socket ID when the default
CPU-to-NUMA association is provided in virt_possible_cpu_arch_ids().
With this applied, no more CPU topology broken warnings are seen
from the Linux guest. The 6 CPUs are associated with NODE#0/1, but
there are no CPUs associated with NODE#2/3/4/5.

Signed-off-by: Gavin Shan <gshan@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
Message-id: 20220503140304.855514-6-gshan@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ virt_cpu_index_to_props(MachineState *ms, unsigned cpu_index)
 
 static int64_t virt_get_default_cpu_node_id(const MachineState *ms, int idx)
 {
-    return idx % ms->numa_state->num_nodes;
+    int64_t socket_id = ms->possible_cpus->cpus[idx].props.socket_id;
+
+    return socket_id % ms->numa_state->num_nodes;
 }
 
 static const CPUArchIdList *virt_possible_cpu_arch_ids(MachineState *ms)
-- 
2.25.1

From: Gavin Shan <gshan@redhat.com>

When the PPTT table is built, the CPU topology is re-calculated, but
it's unecessary because the CPU topology has been populated in
virt_possible_cpu_arch_ids() on arm/virt machine.

This reworks build_pptt() to avoid by reusing the existing IDs in
ms->possible_cpus. Currently, the only user of build_pptt() is
arm/virt machine.

Signed-off-by: Gavin Shan <gshan@redhat.com>
Tested-by: Yanan Wang <wangyanan55@huawei.com>
Reviewed-by: Yanan Wang <wangyanan55@huawei.com>
Acked-by: Igor Mammedov <imammedo@redhat.com>
Acked-by: Michael S. Tsirkin <mst@redhat.com>
Message-id: 20220503140304.855514-7-gshan@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/acpi/aml-build.c | 111 +++++++++++++++++++-------------------------
 1 file changed, 48 insertions(+), 63 deletions(-)

diff --git a/hw/acpi/aml-build.c b/hw/acpi/aml-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/acpi/aml-build.c
+++ b/hw/acpi/aml-build.c
@@ -XXX,XX +XXX,XX @@ void build_pptt(GArray *table_data, BIOSLinker *linker, MachineState *ms,
                 const char *oem_id, const char *oem_table_id)
 {
     MachineClass *mc = MACHINE_GET_CLASS(ms);
-    GQueue *list = g_queue_new();
-    guint pptt_start = table_data->len;
-    guint parent_offset;
-    guint length, i;
-    int uid = 0;
-    int socket;
+    CPUArchIdList *cpus = ms->possible_cpus;
+    int64_t socket_id = -1, cluster_id = -1, core_id = -1;
+    uint32_t socket_offset = 0, cluster_offset = 0, core_offset = 0;
+    uint32_t pptt_start = table_data->len;
+    int n;
     AcpiTable table = { .sig = "PPTT", .rev = 2,
                         .oem_id = oem_id, .oem_table_id = oem_table_id };
 
     acpi_table_begin(&table, table_data);
 
-    for (socket = 0; socket < ms->smp.sockets; socket++) {
-        g_queue_push_tail(list,
-            GUINT_TO_POINTER(table_data->len - pptt_start));
-        build_processor_hierarchy_node(
-            table_data,
-            /*
-             * Physical package - represents the boundary
-             * of a physical package
-             */
-            (1 << 0),
-            0, socket, NULL, 0);
-    }
-
-    if (mc->smp_props.clusters_supported) {
-        length = g_queue_get_length(list);
-        for (i = 0; i < length; i++) {
-            int cluster;
-
-            parent_offset = GPOINTER_TO_UINT(g_queue_pop_head(list));
-            for (cluster = 0; cluster < ms->smp.clusters; cluster++) {
-                g_queue_push_tail(list,
-                    GUINT_TO_POINTER(table_data->len - pptt_start));
-                build_processor_hierarchy_node(
-                    table_data,
-                    (0 << 0), /* not a physical package */
-                    parent_offset, cluster, NULL, 0);
-            }
+    /*
+     * This works with the assumption that cpus[n].props.*_id has been
+     * sorted from top to down levels in mc->possible_cpu_arch_ids().
+     * Otherwise, the unexpected and duplicated containers will be
+     * created.
+     */
+    for (n = 0; n < cpus->len; n++) {
+        if (cpus->cpus[n].props.socket_id != socket_id) {
+            assert(cpus->cpus[n].props.socket_id > socket_id);
+            socket_id = cpus->cpus[n].props.socket_id;
+            cluster_id = -1;
+            core_id = -1;
+            socket_offset = table_data->len - pptt_start;
+            build_processor_hierarchy_node(table_data,
+                (1 << 0), /* Physical package */
+                0, socket_id, NULL, 0);
         }
-    }
 
-    length = g_queue_get_length(list);
-    for (i = 0; i < length; i++) {
-        int core;
-
-        parent_offset = GPOINTER_TO_UINT(g_queue_pop_head(list));
-        for (core = 0; core < ms->smp.cores; core++) {
-            if (ms->smp.threads > 1) {
-                g_queue_push_tail(list,
-                    GUINT_TO_POINTER(table_data->len - pptt_start));
-                build_processor_hierarchy_node(
-                    table_data,
-                    (0 << 0), /* not a physical package */
-                    parent_offset, core, NULL, 0);
-            } else {
-                build_processor_hierarchy_node(
-                    table_data,
-                    (1 << 1) | /* ACPI Processor ID valid */
-                    (1 << 3),  /* Node is a Leaf */
-                    parent_offset, uid++, NULL, 0);
+        if (mc->smp_props.clusters_supported) {
+            if (cpus->cpus[n].props.cluster_id != cluster_id) {
+                assert(cpus->cpus[n].props.cluster_id > cluster_id);
+                cluster_id = cpus->cpus[n].props.cluster_id;
+                core_id = -1;
+                cluster_offset = table_data->len - pptt_start;
+                build_processor_hierarchy_node(table_data,
+                    (0 << 0), /* Not a physical package */
+                    socket_offset, cluster_id, NULL, 0);
             }
+        } else {
+            cluster_offset = socket_offset;
         }
-    }
 
-    length = g_queue_get_length(list);
-    for (i = 0; i < length; i++) {
-        int thread;
+        if (ms->smp.threads == 1) {
+            build_processor_hierarchy_node(table_data,
+                (1 << 1) | /* ACPI Processor ID valid */
+                (1 << 3),  /* Node is a Leaf */
+                cluster_offset, n, NULL, 0);
+        } else {
+            if (cpus->cpus[n].props.core_id != core_id) {
+                assert(cpus->cpus[n].props.core_id > core_id);
+                core_id = cpus->cpus[n].props.core_id;
+                core_offset = table_data->len - pptt_start;
+                build_processor_hierarchy_node(table_data,
+                    (0 << 0), /* Not a physical package */
+                    cluster_offset, core_id, NULL, 0);
+            }
 
-        parent_offset = GPOINTER_TO_UINT(g_queue_pop_head(list));
-        for (thread = 0; thread < ms->smp.threads; thread++) {
-            build_processor_hierarchy_node(
-                table_data,
+            build_processor_hierarchy_node(table_data,
                 (1 << 1) | /* ACPI Processor ID valid */
                 (1 << 2) | /* Processor is a Thread */
                 (1 << 3),  /* Node is a Leaf */
-                parent_offset, uid++, NULL, 0);
+                core_offset, n, NULL, 0);
         }
     }
 
-    g_queue_free(list);
     acpi_table_end(linker, &table);
 }
 
-- 
2.25.1

Hi; here's the latest batch of arm changes. The big thing
in here is the SMMUv3 changes to add stage-2 translation support.

thanks
-- PMM

The following changes since commit aa9bbd865502ed517624ab6fe7d4b5d89ca95e43:

Merge tag 'pull-ppc-20230528' of https://gitlab.com/danielhb/qemu into staging (2023-05-29 14:31:52 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230530

for you to fetch changes up to b03d0d4f531a8b867e0aac1fab0b876903015680:

docs: sbsa: correct graphics card name (2023-05-30 13:32:46 +0100)

----------------------------------------------------------------
target-arm queue:
 * fsl-imx6: Add SNVS support for i.MX6 boards
 * smmuv3: Add support for stage 2 translations
 * hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop
 * hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
 * cleanups for recent Kconfig changes
 * target/arm: Explicitly select short-format FSR for M-profile
 * tests/qtest: Run arm-specific tests only if the required machine is available
 * hw/arm/sbsa-ref: add GIC node into DT
 * docs: sbsa: correct graphics card name
 * Update copyright dates to 2023

----------------------------------------------------------------
Clément Chigot (1):
      hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number

Enze Li (1):
      Update copyright dates to 2023

Fabiano Rosas (3):
      target/arm: Explain why we need to select ARM_V7M
      arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
      arm/Kconfig: Make TCG dependence explicit

Marcin Juszkiewicz (2):
      hw/arm/sbsa-ref: add GIC node into DT
      docs: sbsa: correct graphics card name

Mostafa Saleh (10):
      hw/arm/smmuv3: Add missing fields for IDR0
      hw/arm/smmuv3: Update translation config to hold stage-2
      hw/arm/smmuv3: Refactor stage-1 PTW
      hw/arm/smmuv3: Add page table walk for stage-2
      hw/arm/smmuv3: Parse STE config for stage-2
      hw/arm/smmuv3: Make TLB lookup work for stage-2
      hw/arm/smmuv3: Add VMID to TLB tagging
      hw/arm/smmuv3: Add CMDs related to stage-2
      hw/arm/smmuv3: Add stage-2 support in iova notifier
      hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2

Peter Maydell (1):
      target/arm: Explicitly select short-format FSR for M-profile

Thomas Huth (1):
      tests/qtest: Run arm-specific tests only if the required machine is available

Tommy Wu (1):
      hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.

Vitaly Cheptsov (1):
      fsl-imx6: Add SNVS support for i.MX6 boards

From: Vitaly Cheptsov <cheptsov@ispras.ru>

SNVS is supported on both i.MX6 and i.MX6UL and is needed
to support shutdown on the board.

Cc: Peter Maydell <peter.maydell@linaro.org> (odd fixer:SABRELITE / i.MX6)
Cc: Jean-Christophe Dubois <jcd@tribudubois.net> (reviewer:SABRELITE / i.MX6)
Cc: qemu-arm@nongnu.org (open list:SABRELITE / i.MX6)
Cc: qemu-devel@nongnu.org (open list:All patches CC here)
Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>
Message-id: 20230515095015.66860-1-cheptsov@ispras.ru
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h | 2 ++
 hw/arm/fsl-imx6.c         | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/cpu/a9mpcore.h"
 #include "hw/misc/imx6_ccm.h"
 #include "hw/misc/imx6_src.h"
+#include "hw/misc/imx7_snvs.h"
 #include "hw/watchdog/wdt_imx2.h"
 #include "hw/char/imx_serial.h"
 #include "hw/timer/imx_gpt.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
     A9MPPrivState  a9mpcore;
     IMX6CCMState   ccm;
     IMX6SRCState   src;
+    IMX7SNVSState  snvs;
     IMXSerialState uart[FSL_IMX6_NUM_UARTS];
     IMXGPTState    gpt;
     IMXEPITState   epit[FSL_IMX6_NUM_EPITS];
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
 
     object_initialize_child(obj, "src", &s->src, TYPE_IMX6_SRC);
 
+    object_initialize_child(obj, "snvs", &s->snvs, TYPE_IMX7_SNVS);
+
     for (i = 0; i < FSL_IMX6_NUM_UARTS; i++) {
         snprintf(name, NAME_SIZE, "uart%d", i + 1);
         object_initialize_child(obj, name, &s->uart[i], TYPE_IMX_SERIAL);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                        qdev_get_gpio_in(DEVICE(&s->a9mpcore),
                                         FSL_IMX6_ENET_MAC_1588_IRQ));
 
+    /*
+     * SNVS
+     */
+    sysbus_realize(SYS_BUS_DEVICE(&s->snvs), &error_abort);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->snvs), 0, FSL_IMX6_SNVSHP_ADDR);
+
     /*
      * Watchdog
      */
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support.
Add IDR0 fields related to stage-2.

VMID16: 16-bit VMID supported.
S2P: Stage-2 translation supported.

They are described in 6.3.1 SMMU_IDR0.

No functional change intended.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-2-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef enum SMMUTranslationStatus {
 /* MMIO Registers */
 
 REG32(IDR0,                0x0)
+    FIELD(IDR0, S2P,         0 , 1)
     FIELD(IDR0, S1P,         1 , 1)
     FIELD(IDR0, TTF,         2 , 2)
     FIELD(IDR0, COHACC,      4 , 1)
     FIELD(IDR0, ASID16,      12, 1)
+    FIELD(IDR0, VMID16,      18, 1)
     FIELD(IDR0, TTENDIAN,    21, 2)
     FIELD(IDR0, STALL_MODEL, 24, 2)
     FIELD(IDR0, TERM_MODEL,  26, 1)
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, add a S2 config
struct(SMMUS2Cfg), composed of the following fields and embedded in
the main SMMUTransCfg:
 -tsz: Size of IPA input region (S2T0SZ)
 -sl0: Start level of translation (S2SL0)
 -affd: AF Fault Disable (S2AFFD)
 -record_faults: Record fault events (S2R)
 -granule_sz: Granule page shift (based on S2TG)
 -vmid: Virtual Machine ID (S2VMID)
 -vttb: Address of translation table base (S2TTB)
 -eff_ps: Effective PA output range (based on S2PS)

They will be used in the next patches in stage-2 address translation.

The fields in SMMUS2Cfg, are reordered to make the shared and stage-1
fields next to each other, this reordering didn't change the struct
size (104 bytes before and after).

Stage-1 only fields: aa64, asid, tt, ttb, tbi, record_faults, oas.
oas is stage-1 output address size. However, it is used to check
input address in case stage-1 is unimplemented or bypassed according
to SMMUv3 manual IHI0070.E "3.4. Address sizes"

Shared fields: stage, disabled, bypassed, aborted, iotlb_*.

No functional change intended.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-3-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUTLBEntry {
     uint8_t granule;
 } SMMUTLBEntry;
 
+/* Stage-2 configuration. */
+typedef struct SMMUS2Cfg {
+    uint8_t tsz;            /* Size of IPA input region (S2T0SZ) */
+    uint8_t sl0;            /* Start level of translation (S2SL0) */
+    bool affd;              /* AF Fault Disable (S2AFFD) */
+    bool record_faults;     /* Record fault events (S2R) */
+    uint8_t granule_sz;     /* Granule page shift (based on S2TG) */
+    uint8_t eff_ps;         /* Effective PA output range (based on S2PS) */
+    uint16_t vmid;          /* Virtual Machine ID (S2VMID) */
+    uint64_t vttb;          /* Address of translation table base (S2TTB) */
+} SMMUS2Cfg;
+
 /*
  * Generic structure populated by derived SMMU devices
  * after decoding the configuration information and used as
  * input to the page table walk
  */
 typedef struct SMMUTransCfg {
+    /* Shared fields between stage-1 and stage-2. */
     int stage;                 /* translation stage */
-    bool aa64;                 /* arch64 or aarch32 translation table */
     bool disabled;             /* smmu is disabled */
     bool bypassed;             /* translation is bypassed */
     bool aborted;              /* translation is aborted */
+    uint32_t iotlb_hits;       /* counts IOTLB hits */
+    uint32_t iotlb_misses;     /* counts IOTLB misses*/
+    /* Used by stage-1 only. */
+    bool aa64;                 /* arch64 or aarch32 translation table */
     bool record_faults;        /* record fault events */
     uint64_t ttb;              /* TT base address */
     uint8_t oas;               /* output address width */
     uint8_t tbi;               /* Top Byte Ignore */
     uint16_t asid;
     SMMUTransTableInfo tt[2];
-    uint32_t iotlb_hits;       /* counts IOTLB hits for this asid */
-    uint32_t iotlb_misses;     /* counts IOTLB misses for this asid */
+    /* Used by stage-2 only. */
+    struct SMMUS2Cfg s2cfg;
 } SMMUTransCfg;
 
 typedef struct SMMUDevice {
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, rename smmu_ptw_64 to
smmu_ptw_64_s1 and refactor some of the code so it can be reused in
stage-2 page table walk.

Remove AA64 check from PTW as decode_cd already ensures that AA64 is
used, otherwise it faults with C_BAD_CD.

A stage member is added to SMMUPTWEventInfo to differentiate
between stage-1 and stage-2 ptw faults.

Add stage argument to trace_smmu_ptw_level be consistent with other
trace events.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-4-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h | 16 +++++++++++++---
 hw/arm/smmu-common.c         | 27 ++++++++++-----------------
 hw/arm/smmuv3.c              |  2 ++
 hw/arm/trace-events          |  2 +-
 4 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/pci/pci.h"
 #include "qom/object.h"
 
-#define SMMU_PCI_BUS_MAX      256
-#define SMMU_PCI_DEVFN_MAX    256
-#define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
+#define SMMU_PCI_BUS_MAX                    256
+#define SMMU_PCI_DEVFN_MAX                  256
+#define SMMU_PCI_DEVFN(sid)                 (sid & 0xFF)
+
+/* VMSAv8-64 Translation constants and functions */
+#define VMSA_LEVELS                         4
+
+#define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
+#define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
+                                             (VMSA_LEVELS - (lvl)))
+#define VMSA_IDXMSK(isz, strd, lvl)         ((1ULL << \
+                                             VMSA_BIT_LVL(isz, strd, lvl)) - 1)
 
 /*
  * Page table walk error types
@@ -XXX,XX +XXX,XX @@ typedef enum {
 } SMMUPTWEventType;
 
 typedef struct SMMUPTWEventInfo {
+    int stage;
     SMMUPTWEventType type;
     dma_addr_t addr; /* fetched address that induced an abort, if any */
 } SMMUPTWEventInfo;
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
 }
 
 /**
- * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
+ * smmu_ptw_64_s1 - VMSAv8-64 Walk of the page tables for a given IOVA
  * @cfg: translation config
  * @iova: iova to translate
  * @perm: access type
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
  * Upon success, @tlbe is filled with translated_addr and entry
  * permission rights.
  */
-static int smmu_ptw_64(SMMUTransCfg *cfg,
-                       dma_addr_t iova, IOMMUAccessFlags perm,
-                       SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+static int smmu_ptw_64_s1(SMMUTransCfg *cfg,
+                          dma_addr_t iova, IOMMUAccessFlags perm,
+                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
     dma_addr_t baseaddr, indexmask;
     int stage = cfg->stage;
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
     }
 
     granule_sz = tt->granule_sz;
-    stride = granule_sz - 3;
+    stride = VMSA_STRIDE(granule_sz);
     inputsize = 64 - tt->tsz;
     level = 4 - (inputsize - 4) / stride;
-    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
+    indexmask = VMSA_IDXMSK(inputsize, stride, level);
     baseaddr = extract64(tt->ttb, 0, 48);
     baseaddr &= ~indexmask;
 
-    while (level <= 3) {
+    while (level < VMSA_LEVELS) {
         uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
         uint64_t mask = subpage_size - 1;
         uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
         if (get_pte(baseaddr, offset, &pte, info)) {
                 goto error;
         }
-        trace_smmu_ptw_level(level, iova, subpage_size,
+        trace_smmu_ptw_level(stage, level, iova, subpage_size,
                              baseaddr, offset, pte);
 
         if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
     info->type = SMMU_PTW_ERR_TRANSLATION;
 
 error:
+    info->stage = 1;
     tlbe->entry.perm = IOMMU_NONE;
     return -EINVAL;
 }
@@ -XXX,XX +XXX,XX @@ error:
 int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
              SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
-    if (!cfg->aa64) {
-        /*
-         * This code path is not entered as we check this while decoding
-         * the configuration data in the derived SMMU model.
-         */
-        g_assert_not_reached();
-    }
-
-    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
+    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
 }
 
 /**
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
     cached_entry = g_new0(SMMUTLBEntry, 1);
 
     if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) {
+        /* All faults from PTW has S2 field. */
+        event.u.f_walk_eabt.s2 = (ptw_info.stage == 2);
         g_free(cached_entry);
         switch (ptw_info.type) {
         case SMMU_PTW_ERR_WALK_EABT:
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
 
 # smmu-common.c
 smmu_add_mr(const char *name) "%s"
-smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
+smmu_ptw_level(int stage, int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
 smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
 smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
 smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, add Stage-2 PTW code.
Only Aarch64 format is supported as stage-1.

Nesting stage-1 and stage-2 is not supported right now.

HTTU is not supported, SW is expected to maintain the Access flag.
This is described in the SMMUv3 manual(IHI 0070.E.a)
"5.2. Stream Table Entry" in "[181] S2AFFD".
This flag determines the behavior on access of a stage-2 page whose
descriptor has AF == 0:
- 0b0: An Access flag fault occurs (stall not supported).
- 0b1: An Access flag fault never occurs.
An Access fault takes priority over a Permission fault.

There are 3 address size checks for stage-2 according to
(IHI 0070.E.a) in "3.4. Address sizes".
- As nesting is not supported, input address is passed directly to
stage-2, and is checked against IAS.
We use cfg->oas to hold the OAS when stage-1 is not used, this is set
in the next patch.
This check is done outside of smmu_ptw_64_s2 as it is not part of
stage-2(it throws stage-1 fault), and the stage-2 function shouldn't
change it's behavior when nesting is supported.
When nesting is supported and we figure out how to combine TLB for
stage-1 and stage-2 we can move this check into the stage-1 function
as described in ARM DDI0487I.a in pseudocode
aarch64/translation/vmsa_translation/AArch64.S1Translate
aarch64/translation/vmsa_translation/AArch64.S1DisabledOutput

- Input to stage-2 is checked against s2t0sz, and throws stage-2
transaltion fault if exceeds it.

- Output of stage-2 is checked against effective PA output range.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-5-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-internal.h |  35 ++++++++++
 hw/arm/smmu-common.c   | 142 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 176 insertions(+), 1 deletion(-)

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-internal.h
+++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@
 #define PTE_APTABLE(pte) \
     (extract64(pte, 61, 2))
 
+#define PTE_AF(pte) \
+    (extract64(pte, 10, 1))
 /*
  * TODO: At the moment all transactions are considered as privileged (EL1)
  * as IOMMU translation callback does not pass user/priv attributes.
@@ -XXX,XX +XXX,XX @@
 #define is_permission_fault(ap, perm) \
     (((perm) & IOMMU_WO) && ((ap) & 0x2))
 
+#define is_permission_fault_s2(s2ap, perm) \
+    (!(((s2ap) & (perm)) == (perm)))
+
 #define PTE_AP_TO_PERM(ap) \
     (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
 
@@ -XXX,XX +XXX,XX @@ uint64_t iova_level_offset(uint64_t iova, int inputsize,
             MAKE_64BIT_MASK(0, gsz - 3);
 }
 
+/* FEAT_LPA2 and FEAT_TTST are not implemented. */
+static inline int get_start_level(int sl0 , int granule_sz)
+{
+    /* ARM DDI0487I.a: Table D8-12. */
+    if (granule_sz == 12) {
+        return 2 - sl0;
+    }
+    /* ARM DDI0487I.a: Table D8-22 and Table D8-31. */
+    return 3 - sl0;
+}
+
+/*
+ * Index in a concatenated first level stage-2 page table.
+ * ARM DDI0487I.a: D8.2.2 Concatenated translation tables.
+ */
+static inline int pgd_concat_idx(int start_level, int granule_sz,
+                                 dma_addr_t ipa)
+{
+    uint64_t ret;
+    /*
+     * Get the number of bits handled by next levels, then any extra bits in
+     * the address should index the concatenated tables. This relation can be
+     * deduced from tables in ARM DDI0487I.a: D8.2.7-9
+     */
+    int shift =  level_shift(start_level - 1, granule_sz);
+
+    ret = ipa >> shift;
+    return ret;
+}
+
 #define SMMU_IOTLB_ASID(key) ((key).asid)
 
 typedef struct SMMUIOTLBPageInvInfo {
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ error:
     return -EINVAL;
 }
 
+/**
+ * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa
+ * for stage-2.
+ * @cfg: translation config
+ * @ipa: ipa to translate
+ * @perm: access type
+ * @tlbe: SMMUTLBEntry (out)
+ * @info: handle to an error info
+ *
+ * Return 0 on success, < 0 on error. In case of error, @info is filled
+ * and tlbe->perm is set to IOMMU_NONE.
+ * Upon success, @tlbe is filled with translated_addr and entry
+ * permission rights.
+ */
+static int smmu_ptw_64_s2(SMMUTransCfg *cfg,
+                          dma_addr_t ipa, IOMMUAccessFlags perm,
+                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+{
+    const int stage = 2;
+    int granule_sz = cfg->s2cfg.granule_sz;
+    /* ARM DDI0487I.a: Table D8-7. */
+    int inputsize = 64 - cfg->s2cfg.tsz;
+    int level = get_start_level(cfg->s2cfg.sl0, granule_sz);
+    int stride = VMSA_STRIDE(granule_sz);
+    int idx = pgd_concat_idx(level, granule_sz, ipa);
+    /*
+     * Get the ttb from concatenated structure.
+     * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte))
+     */
+    uint64_t baseaddr = extract64(cfg->s2cfg.vttb, 0, 48) + (1 << stride) *
+                                  idx * sizeof(uint64_t);
+    dma_addr_t indexmask = VMSA_IDXMSK(inputsize, stride, level);
+
+    baseaddr &= ~indexmask;
+
+    /*
+     * On input, a stage 2 Translation fault occurs if the IPA is outside the
+     * range configured by the relevant S2T0SZ field of the STE.
+     */
+    if (ipa >= (1ULL << inputsize)) {
+        info->type = SMMU_PTW_ERR_TRANSLATION;
+        goto error;
+    }
+
+    while (level < VMSA_LEVELS) {
+        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
+        uint64_t mask = subpage_size - 1;
+        uint32_t offset = iova_level_offset(ipa, inputsize, level, granule_sz);
+        uint64_t pte, gpa;
+        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
+        uint8_t s2ap;
+
+        if (get_pte(baseaddr, offset, &pte, info)) {
+                goto error;
+        }
+        trace_smmu_ptw_level(stage, level, ipa, subpage_size,
+                             baseaddr, offset, pte);
+        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
+            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
+                                       pte_addr, offset, pte);
+            break;
+        }
+
+        if (is_table_pte(pte, level)) {
+            baseaddr = get_table_pte_address(pte, granule_sz);
+            level++;
+            continue;
+        } else if (is_page_pte(pte, level)) {
+            gpa = get_page_pte_address(pte, granule_sz);
+            trace_smmu_ptw_page_pte(stage, level, ipa,
+                                    baseaddr, pte_addr, pte, gpa);
+        } else {
+            uint64_t block_size;
+
+            gpa = get_block_pte_address(pte, level, granule_sz,
+                                        &block_size);
+            trace_smmu_ptw_block_pte(stage, level, baseaddr,
+                                     pte_addr, pte, ipa, gpa,
+                                     block_size >> 20);
+        }
+
+        /*
+         * If S2AFFD and PTE.AF are 0 => fault. (5.2. Stream Table Entry)
+         * An Access fault takes priority over a Permission fault.
+         */
+        if (!PTE_AF(pte) && !cfg->s2cfg.affd) {
+            info->type = SMMU_PTW_ERR_ACCESS;
+            goto error;
+        }
+
+        s2ap = PTE_AP(pte);
+        if (is_permission_fault_s2(s2ap, perm)) {
+            info->type = SMMU_PTW_ERR_PERMISSION;
+            goto error;
+        }
+
+        /*
+         * The address output from the translation causes a stage 2 Address
+         * Size fault if it exceeds the effective PA output range.
+         */
+        if (gpa >= (1ULL << cfg->s2cfg.eff_ps)) {
+            info->type = SMMU_PTW_ERR_ADDR_SIZE;
+            goto error;
+        }
+
+        tlbe->entry.translated_addr = gpa;
+        tlbe->entry.iova = ipa & ~mask;
+        tlbe->entry.addr_mask = mask;
+        tlbe->entry.perm = s2ap;
+        tlbe->level = level;
+        tlbe->granule = granule_sz;
+        return 0;
+    }
+    info->type = SMMU_PTW_ERR_TRANSLATION;
+
+error:
+    info->stage = 2;
+    tlbe->entry.perm = IOMMU_NONE;
+    return -EINVAL;
+}
+
 /**
  * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
  *
@@ -XXX,XX +XXX,XX @@ error:
 int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
              SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
-    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
+    if (cfg->stage == 1) {
+        return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
+    } else if (cfg->stage == 2) {
+        /*
+         * If bypassing stage 1(or unimplemented), the input address is passed
+         * directly to stage 2 as IPA. If the input address of a transaction
+         * exceeds the size of the IAS, a stage 1 Address Size fault occurs.
+         * For AA64, IAS = OAS according to (IHI 0070.E.a) "3.4 Address sizes"
+         */
+        if (iova >= (1ULL << cfg->oas)) {
+            info->type = SMMU_PTW_ERR_ADDR_SIZE;
+            info->stage = 1;
+            tlbe->entry.perm = IOMMU_NONE;
+            return -EINVAL;
+        }
+
+        return smmu_ptw_64_s2(cfg, iova, perm, tlbe, info);
+    }
+
+    g_assert_not_reached();
 }
 
 /**
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Parse stage-2 configuration from STE and populate it in SMMUS2Cfg.
Validity of field values are checked when possible.

Only AA64 tables are supported and Small Translation Tables (STT) are
not supported.

According to SMMUv3 UM(IHI0070E) "5.2 Stream Table Entry": All fields
with an S2 prefix (with the exception of S2VMID) are IGNORED when
stage-2 bypasses translation (Config[1] == 0).

Which means that VMID can be used(for TLB tagging) even if stage-2 is
bypassed, so we parse it unconditionally when S2P exists. Otherwise
it is set to -1.(only S1P)

As stall is not supported, if S2S is set the translation would abort.
For S2R, we reuse the same code used for stage-1 with flag
record_faults. However when nested translation is supported we would
need to separate stage-1 and stage-2 faults.

Fix wrong shift in STE_S2HD, STE_S2HA, STE_S2S.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20230516203327.2051088-6-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h     |  10 +-
 include/hw/arm/smmu-common.h |   1 +
 include/hw/arm/smmuv3.h      |   3 +
 hw/arm/smmuv3.c              | 181 +++++++++++++++++++++++++++++++++--
 4 files changed, 185 insertions(+), 10 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef struct CD {
 #define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
 #define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
 #define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
-#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
-#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
-#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
+#define STE_S2ENDI(x)      extract32((x)->word[5], 20, 1)
+#define STE_S2AFFD(x)      extract32((x)->word[5], 21, 1)
+#define STE_S2HD(x)        extract32((x)->word[5], 23, 1)
+#define STE_S2HA(x)        extract32((x)->word[5], 24, 1)
+#define STE_S2S(x)         extract32((x)->word[5], 25, 1)
+#define STE_S2R(x)         extract32((x)->word[5], 26, 1)
+
 #define STE_CTXPTR(x)                                           \
     ({                                                          \
         unsigned long addr;                                     \
diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@
 
 /* VMSAv8-64 Translation constants and functions */
 #define VMSA_LEVELS                         4
+#define VMSA_MAX_S2_CONCAT                  16
 
 #define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
 #define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmuv3.h
+++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@ struct SMMUv3Class {
 #define TYPE_ARM_SMMUV3   "arm-smmuv3"
 OBJECT_DECLARE_TYPE(SMMUv3State, SMMUv3Class, ARM_SMMUV3)
 
+#define STAGE1_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S1P)
+#define STAGE2_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S2P)
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 #include "smmuv3-internal.h"
 #include "smmu-internal.h"
 
+#define PTW_RECORD_FAULT(cfg)   (((cfg)->stage == 1) ? (cfg)->record_faults : \
+                                 (cfg)->s2cfg.record_faults)
+
 /**
  * smmuv3_trigger_irq - pulse @irq if enabled and update
  * GERROR register in case of GERROR interrupt
@@ -XXX,XX +XXX,XX @@ static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
     return 0;
 }
 
+/*
+ * Max valid value is 39 when SMMU_IDR3.STT == 0.
+ * In architectures after SMMUv3.0:
+ * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this
+ *   field is MAX(16, 64-IAS)
+ * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field
+ *   is (64-IAS).
+ * As we only support AA64, IAS = OAS.
+ */
+static bool s2t0sz_valid(SMMUTransCfg *cfg)
+{
+    if (cfg->s2cfg.tsz > 39) {
+        return false;
+    }
+
+    if (cfg->s2cfg.granule_sz == 16) {
+        return (cfg->s2cfg.tsz >= 64 - oas2bits(SMMU_IDR5_OAS));
+    }
+
+    return (cfg->s2cfg.tsz >= MAX(64 - oas2bits(SMMU_IDR5_OAS), 16));
+}
+
+/*
+ * Return true if s2 page table config is valid.
+ * This checks with the configured start level, ias_bits and granularity we can
+ * have a valid page table as described in ARM ARM D8.2 Translation process.
+ * The idea here is to see for the highest possible number of IPA bits, how
+ * many concatenated tables we would need, if it is more than 16, then this is
+ * not possible.
+ */
+static bool s2_pgtable_config_valid(uint8_t sl0, uint8_t t0sz, uint8_t gran)
+{
+    int level = get_start_level(sl0, gran);
+    uint64_t ipa_bits = 64 - t0sz;
+    uint64_t max_ipa = (1ULL << ipa_bits) - 1;
+    int nr_concat = pgd_concat_idx(level, gran, max_ipa) + 1;
+
+    return nr_concat <= VMSA_MAX_S2_CONCAT;
+}
+
+static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
+{
+    cfg->stage = 2;
+
+    if (STE_S2AA64(ste) == 0x0) {
+        qemu_log_mask(LOG_UNIMP,
+                      "SMMUv3 AArch32 tables not supported\n");
+        g_assert_not_reached();
+    }
+
+    switch (STE_S2TG(ste)) {
+    case 0x0: /* 4KB */
+        cfg->s2cfg.granule_sz = 12;
+        break;
+    case 0x1: /* 64KB */
+        cfg->s2cfg.granule_sz = 16;
+        break;
+    case 0x2: /* 16KB */
+        cfg->s2cfg.granule_sz = 14;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste));
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.vttb = STE_S2TTB(ste);
+
+    cfg->s2cfg.sl0 = STE_S2SL0(ste);
+    /* FEAT_TTST not supported. */
+    if (cfg->s2cfg.sl0 == 0x3) {
+        qemu_log_mask(LOG_UNIMP, "SMMUv3 S2SL0 = 0x3 has no meaning!\n");
+        goto bad_ste;
+    }
+
+    /* For AA64, The effective S2PS size is capped to the OAS. */
+    cfg->s2cfg.eff_ps = oas2bits(MIN(STE_S2PS(ste), SMMU_IDR5_OAS));
+    /*
+     * It is ILLEGAL for the address in S2TTB to be outside the range
+     * described by the effective S2PS value.
+     */
+    if (cfg->s2cfg.vttb & ~(MAKE_64BIT_MASK(0, cfg->s2cfg.eff_ps))) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 S2TTB too large 0x%lx, effective PS %d bits\n",
+                      cfg->s2cfg.vttb,  cfg->s2cfg.eff_ps);
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.tsz = STE_S2T0SZ(ste);
+
+    if (!s2t0sz_valid(cfg)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 bad STE S2T0SZ = %d\n",
+                      cfg->s2cfg.tsz);
+        goto bad_ste;
+    }
+
+    if (!s2_pgtable_config_valid(cfg->s2cfg.sl0, cfg->s2cfg.tsz,
+                                    cfg->s2cfg.granule_sz)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 STE stage 2 config not valid!\n");
+        goto bad_ste;
+    }
+
+    /* Only LE supported(IDR0.TTENDIAN). */
+    if (STE_S2ENDI(ste)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 STE_S2ENDI only supports LE!\n");
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.affd = STE_S2AFFD(ste);
+
+    cfg->s2cfg.record_faults = STE_S2R(ste);
+    /* As stall is not supported. */
+    if (STE_S2S(ste)) {
+        qemu_log_mask(LOG_UNIMP, "SMMUv3 Stall not implemented!\n");
+        goto bad_ste;
+    }
+
+    /* This is still here as stage 2 has not been fully enabled yet. */
+    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
+    goto bad_ste;
+
+    return 0;
+
+bad_ste:
+    return -EINVAL;
+}
+
 /* Returns < 0 in case of invalid STE, 0 otherwise */
 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
                       STE *ste, SMMUEventInfo *event)
 {
     uint32_t config;
+    int ret;
 
     if (!STE_VALID(ste)) {
         if (!event->inval_ste_allowed) {
@@ -XXX,XX +XXX,XX @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
         return 0;
     }
 
-    if (STE_CFG_S2_ENABLED(config)) {
-        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
+    /*
+     * If a stage is enabled in SW while not advertised, throw bad ste
+     * according to user manual(IHI0070E) "5.2 Stream Table Entry".
+     */
+    if (!STAGE1_SUPPORTED(s) && STE_CFG_S1_ENABLED(config)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S1 used but not supported.\n");
         goto bad_ste;
     }
+    if (!STAGE2_SUPPORTED(s) && STE_CFG_S2_ENABLED(config)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S2 used but not supported.\n");
+        goto bad_ste;
+    }
+
+    if (STAGE2_SUPPORTED(s)) {
+        /* VMID is considered even if s2 is disabled. */
+        cfg->s2cfg.vmid = STE_S2VMID(ste);
+    } else {
+        /* Default to -1 */
+        cfg->s2cfg.vmid = -1;
+    }
+
+    if (STE_CFG_S2_ENABLED(config)) {
+        /*
+         * Stage-1 OAS defaults to OAS even if not enabled as it would be used
+         * in input address check for stage-2.
+         */
+        cfg->oas = oas2bits(SMMU_IDR5_OAS);
+        ret = decode_ste_s2_cfg(cfg, ste);
+        if (ret) {
+            goto bad_ste;
+        }
+    }
 
     if (STE_S1CDMAX(ste) != 0) {
         qemu_log_mask(LOG_UNIMP,
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
     if (cached_entry) {
         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
             status = SMMU_TRANS_ERROR;
-            if (cfg->record_faults) {
+            /*
+             * We know that the TLB only contains either stage-1 or stage-2 as
+             * nesting is not supported. So it is sufficient to check the
+             * translation stage to know the TLB stage for now.
+             */
+            event.u.f_walk_eabt.s2 = (cfg->stage == 2);
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_PERMISSION;
                 event.u.f_permission.addr = addr;
                 event.u.f_permission.rnw = flag & 0x1;
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
             event.u.f_walk_eabt.addr2 = ptw_info.addr;
             break;
         case SMMU_PTW_ERR_TRANSLATION:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_TRANSLATION;
                 event.u.f_translation.addr = addr;
                 event.u.f_translation.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_ADDR_SIZE:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_ADDR_SIZE;
                 event.u.f_addr_size.addr = addr;
                 event.u.f_addr_size.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_ACCESS:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_ACCESS;
                 event.u.f_access.addr = addr;
                 event.u.f_access.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_PERMISSION:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_PERMISSION;
                 event.u.f_permission.addr = addr;
                 event.u.f_permission.rnw = flag & 0x1;
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Right now, either stage-1 or stage-2 are supported, this simplifies
how we can deal with TLBs.
This patch makes TLB lookup work if stage-2 is enabled instead of
stage-1.
TLB lookup is done before a PTW, if a valid entry is found we won't
do the PTW.
To be able to do TLB lookup, we need the correct tagging info, as
granularity and input size, so we get this based on the supported
translation stage. The TLB entries are added correctly from each
stage PTW.

When nested translation is supported, this would need to change, for
example if we go with a combined TLB implementation, we would need to
use the min of the granularities in TLB.

As stage-2 shouldn't be tagged by ASID, it will be set to -1 if S1P
is not enabled.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-7-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c | 44 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 33 insertions(+), 11 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
     STE ste;
     CD cd;
 
+    /* ASID defaults to -1 (if s1 is not supported). */
+    cfg->asid = -1;
+
     ret = smmu_find_ste(s, sid, &ste, event);
     if (ret) {
         return ret;
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
         .addr_mask = ~(hwaddr)0,
         .perm = IOMMU_NONE,
     };
+    /*
+     * Combined attributes used for TLB lookup, as only one stage is supported,
+     * it will hold attributes based on the enabled stage.
+     */
+    SMMUTransTableInfo tt_combined;
 
     qemu_mutex_lock(&s->mutex);
 
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
         goto epilogue;
     }
 
-    tt = select_tt(cfg, addr);
-    if (!tt) {
-        if (cfg->record_faults) {
-            event.type = SMMU_EVT_F_TRANSLATION;
-            event.u.f_translation.addr = addr;
-            event.u.f_translation.rnw = flag & 0x1;
+    if (cfg->stage == 1) {
+        /* Select stage1 translation table. */
+        tt = select_tt(cfg, addr);
+        if (!tt) {
+            if (cfg->record_faults) {
+                event.type = SMMU_EVT_F_TRANSLATION;
+                event.u.f_translation.addr = addr;
+                event.u.f_translation.rnw = flag & 0x1;
+            }
+            status = SMMU_TRANS_ERROR;
+            goto epilogue;
         }
-        status = SMMU_TRANS_ERROR;
-        goto epilogue;
-    }
+        tt_combined.granule_sz = tt->granule_sz;
+        tt_combined.tsz = tt->tsz;
 
-    page_mask = (1ULL << (tt->granule_sz)) - 1;
+    } else {
+        /* Stage2. */
+        tt_combined.granule_sz = cfg->s2cfg.granule_sz;
+        tt_combined.tsz = cfg->s2cfg.tsz;
+    }
+    /*
+     * TLB lookup looks for granule and input size for a translation stage,
+     * as only one stage is supported right now, choose the right values
+     * from the configuration.
+     */
+    page_mask = (1ULL << tt_combined.granule_sz) - 1;
     aligned_addr = addr & ~page_mask;
 
-    cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr);
+    cached_entry = smmu_iotlb_lookup(bs, cfg, &tt_combined, aligned_addr);
     if (cached_entry) {
         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
             status = SMMU_TRANS_ERROR;
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Allow TLB to be tagged with VMID.

If stage-1 is only supported, VMID is set to -1 and ignored from STE
and CMD_TLBI_NH* cmds.

Update smmu_iotlb_insert trace event to have vmid.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-8-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-internal.h       |  2 ++
 include/hw/arm/smmu-common.h |  5 +++--
 hw/arm/smmu-common.c         | 36 ++++++++++++++++++++++--------------
 hw/arm/smmuv3.c              | 12 +++++++++---
 hw/arm/trace-events          |  6 +++---
 5 files changed, 39 insertions(+), 22 deletions(-)

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-internal.h
+++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@ static inline int pgd_concat_idx(int start_level, int granule_sz,
 }
 
 #define SMMU_IOTLB_ASID(key) ((key).asid)
+#define SMMU_IOTLB_VMID(key) ((key).vmid)
 
 typedef struct SMMUIOTLBPageInvInfo {
     int asid;
+    int vmid;
     uint64_t iova;
     uint64_t mask;
 } SMMUIOTLBPageInvInfo;
diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUPciBus {
 typedef struct SMMUIOTLBKey {
     uint64_t iova;
     uint16_t asid;
+    uint16_t vmid;
     uint8_t tg;
     uint8_t level;
 } SMMUIOTLBKey;
@@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid);
 SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
                                 SMMUTransTableInfo *tt, hwaddr iova);
 void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *entry);
-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
+SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level);
 void smmu_iotlb_inv_all(SMMUState *s);
 void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
-void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
+void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl);
 
 /* Unmap the range of all the notifiers registered to any IOMMU mr */
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static guint smmu_iotlb_key_hash(gconstpointer v)
 
     /* Jenkins hash */
     a = b = c = JHASH_INITVAL + sizeof(*key);
-    a += key->asid + key->level + key->tg;
+    a += key->asid + key->vmid + key->level + key->tg;
     b += extract64(key->iova, 0, 32);
     c += extract64(key->iova, 32, 32);
 
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
     SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2;
 
     return (k1->asid == k2->asid) && (k1->iova == k2->iova) &&
-           (k1->level == k2->level) && (k1->tg == k2->tg);
+           (k1->level == k2->level) && (k1->tg == k2->tg) &&
+           (k1->vmid == k2->vmid);
 }
 
-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
+SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level)
 {
-    SMMUIOTLBKey key = {.asid = asid, .iova = iova, .tg = tg, .level = level};
+    SMMUIOTLBKey key = {.asid = asid, .vmid = vmid, .iova = iova,
+                        .tg = tg, .level = level};
 
     return key;
 }
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
         uint64_t mask = subpage_size - 1;
         SMMUIOTLBKey key;
 
-        key = smmu_get_iotlb_key(cfg->asid, iova & ~mask, tg, level);
+        key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid,
+                                 iova & ~mask, tg, level);
         entry = g_hash_table_lookup(bs->iotlb, &key);
         if (entry) {
             break;
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
 
     if (entry) {
         cfg->iotlb_hits++;
-        trace_smmu_iotlb_lookup_hit(cfg->asid, iova,
+        trace_smmu_iotlb_lookup_hit(cfg->asid, cfg->s2cfg.vmid, iova,
                                     cfg->iotlb_hits, cfg->iotlb_misses,
                                     100 * cfg->iotlb_hits /
                                     (cfg->iotlb_hits + cfg->iotlb_misses));
     } else {
         cfg->iotlb_misses++;
-        trace_smmu_iotlb_lookup_miss(cfg->asid, iova,
+        trace_smmu_iotlb_lookup_miss(cfg->asid, cfg->s2cfg.vmid, iova,
                                      cfg->iotlb_hits, cfg->iotlb_misses,
                                      100 * cfg->iotlb_hits /
                                      (cfg->iotlb_hits + cfg->iotlb_misses));
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new)
         smmu_iotlb_inv_all(bs);
     }
 
-    *key = smmu_get_iotlb_key(cfg->asid, new->entry.iova, tg, new->level);
-    trace_smmu_iotlb_insert(cfg->asid, new->entry.iova, tg, new->level);
+    *key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
+                              tg, new->level);
+    trace_smmu_iotlb_insert(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
+                            tg, new->level);
     g_hash_table_insert(bs->iotlb, key, new);
 }
 
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
 
     return SMMU_IOTLB_ASID(*iotlb_key) == asid;
 }
-
-static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
+static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                               gpointer user_data)
 {
     SMMUTLBEntry *iter = (SMMUTLBEntry *)value;
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
     if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) {
         return false;
     }
+    if (info->vmid >= 0 && info->vmid != SMMU_IOTLB_VMID(iotlb_key)) {
+        return false;
+    }
     return ((info->iova & ~entry->addr_mask) == entry->iova) ||
            ((entry->iova & ~info->mask) == info->iova);
 }
 
-void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
+void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl)
 {
     /* if tg is not set we use 4KB range invalidation */
     uint8_t granule = tg ? tg * 2 + 10 : 12;
 
     if (ttl && (num_pages == 1) && (asid >= 0)) {
-        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
+        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, iova, tg, ttl);
 
         if (g_hash_table_remove(s->iotlb, &key)) {
             return;
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
 
     SMMUIOTLBPageInvInfo info = {
         .asid = asid, .iova = iova,
+        .vmid = vmid,
         .mask = (num_pages * 1 << granule) - 1};
 
     g_hash_table_foreach_remove(s->iotlb,
-                                smmu_hash_remove_by_asid_iova,
+                                smmu_hash_remove_by_asid_vmid_iova,
                                 &info);
 }
 
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
 {
     dma_addr_t end, addr = CMD_ADDR(cmd);
     uint8_t type = CMD_TYPE(cmd);
-    uint16_t vmid = CMD_VMID(cmd);
+    int vmid = -1;
     uint8_t scale = CMD_SCALE(cmd);
     uint8_t num = CMD_NUM(cmd);
     uint8_t ttl = CMD_TTL(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     uint64_t num_pages;
     uint8_t granule;
     int asid = -1;
+    SMMUv3State *smmuv3 = ARM_SMMUV3(s);
+
+    /* Only consider VMID if stage-2 is supported. */
+    if (STAGE2_SUPPORTED(smmuv3)) {
+        vmid = CMD_VMID(cmd);
+    }
 
     if (type == SMMU_CMD_TLBI_NH_VA) {
         asid = CMD_ASID(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     if (!tg) {
         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
-        smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl);
+        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
         num_pages = (mask + 1) >> granule;
         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
-        smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
+        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
     }
 }
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_iotlb_inv_all(void) "IOTLB invalidate all"
 smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
 smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
 smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
-smmu_iotlb_lookup_hit(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-smmu_iotlb_lookup_miss(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-smmu_iotlb_insert(uint16_t asid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d addr=0x%"PRIx64" tg=%d level=%d"
+smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
+smmu_iotlb_lookup_miss(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
+smmu_iotlb_insert(uint16_t asid, uint16_t vmid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d vmid=%d addr=0x%"PRIx64" tg=%d level=%d"
 
 # smmuv3.c
 smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

CMD_TLBI_S2_IPA: As S1+S2 is not enabled, for now this can be the
same as CMD_TLBI_NH_VAA.

CMD_TLBI_S12_VMALL: Added new function to invalidate TLB by VMID.

For stage-1 only commands, add a check to throw CERROR_ILL if used
when stage-1 is not supported.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-9-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h |  1 +
 hw/arm/smmu-common.c         | 16 +++++++++++
 hw/arm/smmuv3.c              | 55 ++++++++++++++++++++++++++++++------
 hw/arm/trace-events          |  4 ++-
 4 files changed, 67 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level);
 void smmu_iotlb_inv_all(SMMUState *s);
 void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
+void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid);
 void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl);
 
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
 
     return SMMU_IOTLB_ASID(*iotlb_key) == asid;
 }
+
+static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value,
+                                         gpointer user_data)
+{
+    uint16_t vmid = *(uint16_t *)user_data;
+    SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;
+
+    return SMMU_IOTLB_VMID(*iotlb_key) == vmid;
+}
+
 static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                               gpointer user_data)
 {
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
     g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
 }
 
+inline void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid)
+{
+    trace_smmu_iotlb_inv_vmid(vmid);
+    g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid);
+}
+
 /* VMSAv8-64 Translation */
 
 /**
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
     }
 }
 
-static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
+static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 {
     dma_addr_t end, addr = CMD_ADDR(cmd);
     uint8_t type = CMD_TYPE(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     }
 
     if (!tg) {
-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
+        trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
         uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
 
         num_pages = (mask + 1) >> granule;
-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
+        trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
         {
             uint16_t asid = CMD_ASID(&cmd);
 
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+
             trace_smmuv3_cmdq_tlbi_nh_asid(asid);
             smmu_inv_notifiers_all(&s->smmu_state);
             smmu_iotlb_inv_asid(bs, asid);
             break;
         }
         case SMMU_CMD_TLBI_NH_ALL:
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            QEMU_FALLTHROUGH;
         case SMMU_CMD_TLBI_NSNH_ALL:
             trace_smmuv3_cmdq_tlbi_nh();
             smmu_inv_notifiers_all(&s->smmu_state);
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
             break;
         case SMMU_CMD_TLBI_NH_VAA:
         case SMMU_CMD_TLBI_NH_VA:
-            smmuv3_s1_range_inval(bs, &cmd);
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            smmuv3_range_inval(bs, &cmd);
+            break;
+        case SMMU_CMD_TLBI_S12_VMALL:
+        {
+            uint16_t vmid = CMD_VMID(&cmd);
+
+            if (!STAGE2_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+
+            trace_smmuv3_cmdq_tlbi_s12_vmid(vmid);
+            smmu_inv_notifiers_all(&s->smmu_state);
+            smmu_iotlb_inv_vmid(bs, vmid);
+            break;
+        }
+        case SMMU_CMD_TLBI_S2_IPA:
+            if (!STAGE2_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            /*
+             * As currently only either s1 or s2 are supported
+             * we can reuse same function for s2.
+             */
+            smmuv3_range_inval(bs, &cmd);
             break;
         case SMMU_CMD_TLBI_EL3_ALL:
         case SMMU_CMD_TLBI_EL3_VA:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
         case SMMU_CMD_TLBI_EL2_ASID:
         case SMMU_CMD_TLBI_EL2_VA:
         case SMMU_CMD_TLBI_EL2_VAA:
-        case SMMU_CMD_TLBI_S12_VMALL:
-        case SMMU_CMD_TLBI_S2_IPA:
         case SMMU_CMD_ATC_INV:
         case SMMU_CMD_PRI_RESP:
         case SMMU_CMD_RESUME:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
             break;
         default:
             cmd_error = SMMU_CERROR_ILL;
-            qemu_log_mask(LOG_GUEST_ERROR,
-                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
             break;
         }
         qemu_mutex_unlock(&s->mutex);
         if (cmd_error) {
+            if (cmd_error == SMMU_CERROR_ILL) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Illegal command type: %d\n", CMD_TYPE(&cmd));
+            }
             break;
         }
         /*
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, ui
 smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
 smmu_iotlb_inv_all(void) "IOTLB invalidate all"
 smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
+smmu_iotlb_inv_vmid(uint16_t vmid) "IOTLB invalidate vmid=%d"
 smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
 smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
 smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_cfgi_ste_range(int start, int end) "start=0x%x - end=0x%x"
 smmuv3_cmdq_cfgi_cd(uint32_t sid) "sid=0x%x"
 smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
 smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
-smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
+smmuv3_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
 smmuv3_cmdq_tlbi_nh(void) ""
 smmuv3_cmdq_tlbi_nh_asid(uint16_t asid) "asid=%d"
+smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
 smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
 smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
 smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In smmuv3_notify_iova, read the granule based on translation stage
and use VMID if valid value is sent.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-10-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c     | 39 ++++++++++++++++++++++++++-------------
 hw/arm/trace-events |  2 +-
 2 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ epilogue:
  * @mr: IOMMU mr region handle
  * @n: notifier to be called
  * @asid: address space ID or negative value if we don't care
+ * @vmid: virtual machine ID or negative value if we don't care
  * @iova: iova
  * @tg: translation granule (if communicated through range invalidation)
  * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
  */
 static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
                                IOMMUNotifier *n,
-                               int asid, dma_addr_t iova,
-                               uint8_t tg, uint64_t num_pages)
+                               int asid, int vmid,
+                               dma_addr_t iova, uint8_t tg,
+                               uint64_t num_pages)
 {
     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
     IOMMUTLBEvent event;
     uint8_t granule;
+    SMMUv3State *s = sdev->smmu;
 
     if (!tg) {
         SMMUEventInfo event = {.inval_ste_allowed = true};
@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
             return;
         }
 
-        tt = select_tt(cfg, iova);
-        if (!tt) {
+        if (vmid >= 0 && cfg->s2cfg.vmid != vmid) {
             return;
         }
-        granule = tt->granule_sz;
+
+        if (STAGE1_SUPPORTED(s)) {
+            tt = select_tt(cfg, iova);
+            if (!tt) {
+                return;
+            }
+            granule = tt->granule_sz;
+        } else {
+            granule = cfg->s2cfg.granule_sz;
+        }
+
     } else {
         granule = tg * 2 + 10;
     }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
     memory_region_notify_iommu_one(n, &event);
 }
 
-/* invalidate an asid/iova range tuple in all mr's */
-static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
-                                      uint8_t tg, uint64_t num_pages)
+/* invalidate an asid/vmid/iova range tuple in all mr's */
+static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid,
+                                      dma_addr_t iova, uint8_t tg,
+                                      uint64_t num_pages)
 {
     SMMUDevice *sdev;
 
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
         IOMMUMemoryRegion *mr = &sdev->iommu;
         IOMMUNotifier *n;
 
-        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova,
-                                        tg, num_pages);
+        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid,
+                                        iova, tg, num_pages);
 
         IOMMU_NOTIFIER_FOREACH(n, mr) {
-            smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages);
+            smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 
     if (!tg) {
         trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
+        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 
         num_pages = (mask + 1) >> granule;
         trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
+        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
     }
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
 smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
 smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
 smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
-smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
+smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint16_t vmid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d vmid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
 
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

As everything is in place, we can use a new system property to
advertise which stage is supported and remove bad_ste from STE
stage2 config.

The property added arm-smmuv3.stage can have 3 values:
- "1": Stage-1 only is advertised.
- "2": Stage-2 only is advertised.

If not passed or an unsupported value is passed, it will default to
stage-1.

Advertise VMID16.

Don't try to decode CD, if stage-2 is configured.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-11-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmuv3.h |  1 +
 hw/arm/smmuv3.c         | 32 ++++++++++++++++++++++----------
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmuv3.h
+++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@ struct SMMUv3State {
 
     qemu_irq     irq[4];
     QemuMutex mutex;
+    char *stage;
 };
 
 typedef enum {
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
 #include "hw/qdev-core.h"
 #include "hw/pci/pci.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
 
 static void smmuv3_init_regs(SMMUv3State *s)
 {
-    /**
-     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
-     *       multi-level stream table
-     */
-    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
+    /* Based on sys property, the stages supported in smmu will be advertised.*/
+    if (s->stage && !strcmp("2", s->stage)) {
+        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
+    } else {
+        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
+    }
+
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, VMID16, 1); /* 16-bit VMID */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
     /* terminated transaction will always be aborted/error returned */
@@ -XXX,XX +XXX,XX @@ static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
         goto bad_ste;
     }
 
-    /* This is still here as stage 2 has not been fully enabled yet. */
-    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
-    goto bad_ste;
-
     return 0;
 
 bad_ste:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
         return ret;
     }
 
-    if (cfg->aborted || cfg->bypassed) {
+    if (cfg->aborted || cfg->bypassed || (cfg->stage == 2)) {
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3 = {
     }
 };
 
+static Property smmuv3_properties[] = {
+    /*
+     * Stages of translation advertised.
+     * "1": Stage 1
+     * "2": Stage 2
+     * Defaults to stage 1
+     */
+    DEFINE_PROP_STRING("stage", SMMUv3State, stage),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void smmuv3_instance_init(Object *obj)
 {
     /* Nothing much to do here as of now */
@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
                                        &c->parent_phases);
     c->parent_realize = dc->realize;
     dc->realize = smmu_realize;
+    device_class_set_props(dc, smmuv3_properties);
 }
 
 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
-- 
2.34.1

From: Tommy Wu <tommy.wu@sifive.com>

When we receive a packet from the xilinx_axienet and then try to s2mem
through the xilinx_axidma, if the descriptor ring buffer is full in the
xilinx axidma driver, we’ll assert the DMASR.HALTED in the
function : stream_process_s2mem and return 0. In the end, we’ll be stuck in
an infinite loop in axienet_eth_rx_notify.

This patch checks the DMASR.HALTED state when we try to push data
from xilinx axi-enet to xilinx axi-dma. When the DMASR.HALTED is asserted,
we will not keep pushing the data and then prevent the infinte loop.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-id: 20230519062137.1251741-1-tommy.wu@sifive.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/dma/xilinx_axidma.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -XXX,XX +XXX,XX @@ static inline int stream_idle(struct Stream *s)
     return !!(s->regs[R_DMASR] & DMASR_IDLE);
 }
 
+static inline int stream_halted(struct Stream *s)
+{
+    return !!(s->regs[R_DMASR] & DMASR_HALTED);
+}
+
 static void stream_reset(struct Stream *s)
 {
     s->regs[R_DMASR] = DMASR_HALTED;  /* starts up halted.  */
@@ -XXX,XX +XXX,XX @@ static void stream_process_mem2s(struct Stream *s, StreamSink *tx_data_dev,
     uint64_t addr;
     bool eop;
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static size_t stream_process_s2mem(struct Stream *s, unsigned char *buf,
     unsigned int rxlen;
     size_t pos = 0;
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ xilinx_axidma_data_stream_can_push(StreamSink *obj,
     XilinxAXIDMAStreamSink *ds = XILINX_AXI_DMA_DATA_STREAM(obj);
     struct Stream *s = &ds->dma->streams[1];
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         ds->dma->notify = notify;
         ds->dma->notify_opaque = notify_opaque;
         return false;
-- 
2.34.1

From: Clément Chigot <chigot@adacore.com>

When passing --smp with a number lower than XLNX_ZYNQMP_NUM_APU_CPUS,
the expression (ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS) will result
in a positive number as ms->smp.cpus is a unsigned int.
This will raise the following error afterwards, as Qemu will try to
instantiate some additional RPUs.
  | $ qemu-system-aarch64 --smp 1 -M xlnx-zcu102
  | **
  | ERROR:../src/tcg/tcg.c:777:tcg_register_thread:
  |   assertion failed: (n < tcg_max_ctxs)

Signed-off-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20230524143714.565792-1-chigot@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zynqmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(MachineState *ms, XlnxZynqMPState *s,
                                    const char *boot_cpu, Error **errp)
 {
     int i;
-    int num_rpus = MIN(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS,
+    int num_rpus = MIN((int)(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS),
                        XLNX_ZYNQMP_NUM_RPU_CPUS);
 
     if (num_rpus <= 0) {
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

pflash-cfi02-test.c always uses the "musicpal" machine for testing,
test-arm-mptimer.c always uses the "vexpress-a9" machine, and
microbit-test.c requires the "microbit" machine, so we should only
run these tests if the machines have been enabled in the configuration.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-id: 20230524080600.1618137-1-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/meson.build | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_arm = \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
-  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
+  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') and
+   config_all_devices.has_key('CONFIG_MUSICPAL') ? ['pflash-cfi02-test'] : []) + \
   (config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed : []) + \
   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
   (config_all_devices.has_key('CONFIG_GENERIC_LOADER') ? ['hexloader-test'] : []) + \
   (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \
+  (config_all_devices.has_key('CONFIG_VEXPRESS') ? ['test-arm-mptimer'] : []) + \
+  (config_all_devices.has_key('CONFIG_MICROBIT') ? ['microbit-test'] : []) + \
   ['arm-cpu-features',
-   'microbit-test',
-   'test-arm-mptimer',
    'boot-serial-test']
 
 # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional
-- 
2.34.1

For M-profile, there is no guest-facing A-profile format FSR, but we
still use the env->exception.fsr field to pass fault information from
the point where a fault is raised to the code in
arm_v7m_cpu_do_interrupt() which interprets it and sets the M-profile
specific fault status registers.  So it doesn't matter whether we
fill in env->exception.fsr in the short format or the LPAE format, as
long as both sides agree.  As it happens arm_v7m_cpu_do_interrupt()
assumes short-form.

In compute_fsr_fsc() we weren't explicitly choosing short-form for
M-profile, but instead relied on it falling out in the wash because
arm_s1_regime_using_lpae_format() would be false.  This was broken in
commit 452c67a4 when we added v8R support, because we said "PMSAv8 is
always LPAE format" (as it is for v8R), forgetting that we were
implicitly using this code path on M-profile. At that point we would
hit a g_assert_not_reached():
 ERROR:../../target/arm/internals.h:549:arm_fi_to_lfsc: code should not be reached

#7  0x0000555555e055f7 in arm_fi_to_lfsc (fi=0x7fffecff9a90) at ../../target/arm/internals.h:549
#8  0x0000555555e05a27 in compute_fsr_fsc (env=0x555557356670, fi=0x7fffecff9a90, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff9a1c)
    at ../../target/arm/tlb_helper.c:95
#9  0x0000555555e05b62 in arm_deliver_fault (cpu=0x555557354800, addr=268961344, access_type=MMU_INST_FETCH, mmu_idx=1, fi=0x7fffecff9a90)
    at ../../target/arm/tlb_helper.c:132
#10 0x0000555555e06095 in arm_cpu_tlb_fill (cs=0x555557354800, address=268961344, size=1, access_type=MMU_INST_FETCH, mmu_idx=1, probe=false, retaddr=0)
    at ../../target/arm/tlb_helper.c:260

The specific assertion changed when commit fcc7404eff24b4c added
"assert not M-profile" to arm_is_secure_below_el3(), because the
conditions being checked in compute_fsr_fsc() include
arm_el_is_aa64(), which will end up calling arm_is_secure_below_el3()
and asserting before we try to call arm_fi_to_lfsc():

#7  0x0000555555efaf43 in arm_is_secure_below_el3 (env=0x5555574665a0) at ../../target/arm/cpu.h:2396
#8  0x0000555555efb103 in arm_is_el2_enabled (env=0x5555574665a0) at ../../target/arm/cpu.h:2448
#9  0x0000555555efb204 in arm_el_is_aa64 (env=0x5555574665a0, el=1) at ../../target/arm/cpu.h:2509
#10 0x0000555555efbdfd in compute_fsr_fsc (env=0x5555574665a0, fi=0x7fffecff99e0, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff996c)

Avoid the assertion and the incorrect FSR format selection by
explicitly making M-profile use the short-format in this function.

Fixes: 452c67a42704 ("target/arm: Enable TTBCR_EAE for ARMv8-R AArch32")a
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1658
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230523131726.866635-1-peter.maydell@linaro.org
---
 target/arm/tcg/tlb_helper.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
     uint32_t fsr, fsc;
 
-    if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
-        arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
+    /*
+     * For M-profile there is no guest-facing FSR. We compute a
+     * short-form value for env->exception.fsr which we will then
+     * examine in arm_v7m_cpu_do_interrupt(). In theory we could
+     * use the LPAE format instead as long as both bits of code agree
+     * (and arm_fi_to_lfsc() handled the M-profile specific
+     * ARMFault_QEMU_NSCExec and ARMFault_QEMU_SFault cases).
+     */
+    if (!arm_feature(env, ARM_FEATURE_M) &&
+        (target_el == 2 || arm_el_is_aa64(env, target_el) ||
+         arm_s1_regime_using_lpae_format(env, arm_mmu_idx))) {
         /*
          * LPAE format fault status register : bottom 6 bits are
          * status code in the same form as needed for syndrome
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

When we moved the arm default CONFIGs into Kconfig and removed them
from default.mak, we made it harder to identify which CONFIGs are
selected by default in case users want to disable them.

Bring back the default entries into default.mak, but keep them
commented out. This way users can keep their workflows of editing
default.mak to remove build options without needing to search through
Kconfig.

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20230523180525.29994-3-farosas@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configs/devices/aarch64-softmmu/default.mak |  6 ++++
 configs/devices/arm-softmmu/default.mak     | 40 +++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/configs/devices/aarch64-softmmu/default.mak b/configs/devices/aarch64-softmmu/default.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/devices/aarch64-softmmu/default.mak
+++ b/configs/devices/aarch64-softmmu/default.mak
@@ -XXX,XX +XXX,XX @@
 
 # We support all the 32 bit boards so need all their config
 include ../arm-softmmu/default.mak
+
+# These are selected by default when TCG is enabled, uncomment them to
+# keep out of the build.
+# CONFIG_XLNX_ZYNQMP_ARM=n
+# CONFIG_XLNX_VERSAL=n
+# CONFIG_SBSA_REF=n
diff --git a/configs/devices/arm-softmmu/default.mak b/configs/devices/arm-softmmu/default.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/devices/arm-softmmu/default.mak
+++ b/configs/devices/arm-softmmu/default.mak
@@ -XXX,XX +XXX,XX @@
 # CONFIG_TEST_DEVICES=n
 
 CONFIG_ARM_VIRT=y
+
+# These are selected by default when TCG is enabled, uncomment them to
+# keep out of the build.
+# CONFIG_CUBIEBOARD=n
+# CONFIG_EXYNOS4=n
+# CONFIG_HIGHBANK=n
+# CONFIG_INTEGRATOR=n
+# CONFIG_FSL_IMX31=n
+# CONFIG_MUSICPAL=n
+# CONFIG_MUSCA=n
+# CONFIG_CHEETAH=n
+# CONFIG_SX1=n
+# CONFIG_NSERIES=n
+# CONFIG_STELLARIS=n
+# CONFIG_STM32VLDISCOVERY=n
+# CONFIG_REALVIEW=n
+# CONFIG_VERSATILE=n
+# CONFIG_VEXPRESS=n
+# CONFIG_ZYNQ=n
+# CONFIG_MAINSTONE=n
+# CONFIG_GUMSTIX=n
+# CONFIG_SPITZ=n
+# CONFIG_TOSA=n
+# CONFIG_Z2=n
+# CONFIG_NPCM7XX=n
+# CONFIG_COLLIE=n
+# CONFIG_ASPEED_SOC=n
+# CONFIG_NETDUINO2=n
+# CONFIG_NETDUINOPLUS2=n
+# CONFIG_OLIMEX_STM32_H405=n
+# CONFIG_MPS2=n
+# CONFIG_RASPI=n
+# CONFIG_DIGIC=n
+# CONFIG_SABRELITE=n
+# CONFIG_EMCRAFT_SF2=n
+# CONFIG_MICROBIT=n
+# CONFIG_FSL_IMX25=n
+# CONFIG_FSL_IMX7=n
+# CONFIG_FSL_IMX6UL=n
+# CONFIG_ALLWINNER_H3=n
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

Replace the 'default y if TCG' pattern with 'default y; depends on
TCG'.

That makes explict that there is a dependence on TCG and enabling
these CONFIGs via .mak files without TCG present will fail earlier.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230523180525.29994-4-farosas@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Kconfig | 123 ++++++++++++++++++++++++++++++++-----------------
 1 file changed, 82 insertions(+), 41 deletions(-)

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
 
 config CHEETAH
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
     select TSC210X
 
 config CUBIEBOARD
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ALLWINNER_A10
 
 config DIGIC
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PTIMER
     select PFLASH_CFI02
 
 config EXYNOS4
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select A9MPCORE
     select I2C
@@ -XXX,XX +XXX,XX @@ config EXYNOS4
 
 config HIGHBANK
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select A15MPCORE
     select AHCI
@@ -XXX,XX +XXX,XX @@ config HIGHBANK
 
 config INTEGRATOR
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARM_TIMER
     select INTEGRATOR_DEBUG
     select PL011 # UART
@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
 
 config MAINSTONE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PXA2XX
     select PFLASH_CFI01
     select SMC91C111
 
 config MUSCA
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARMSSE
     select PL011
     select PL031
@@ -XXX,XX +XXX,XX @@ config MARVELL_88W8618
 
 config MUSICPAL
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
@@ -XXX,XX +XXX,XX @@ config MUSICPAL
 
 config NETDUINO2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F205_SOC
 
 config NETDUINOPLUS2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F405_SOC
 
 config OLIMEX_STM32_H405
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F405_SOC
 
 config NSERIES
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
     select TMP105   # temperature sensor
     select BLIZZARD # LCD/TV controller
@@ -XXX,XX +XXX,XX @@ config PXA2XX
 
 config GUMSTIX
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select SMC91C111
     select PXA2XX
 
 config TOSA
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ZAURUS  # scoop
     select MICRODRIVE
     select PXA2XX
@@ -XXX,XX +XXX,XX @@ config TOSA
 
 config SPITZ
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ADS7846 # touch-screen controller
     select MAX111X # A/D converter
     select WM8750  # audio codec
@@ -XXX,XX +XXX,XX @@ config SPITZ
 
 config Z2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select WM8750
     select PL011 # UART
@@ -XXX,XX +XXX,XX @@ config Z2
 
 config REALVIEW
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply PCI_DEVICES
     imply PCI_TESTDEV
     imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config REALVIEW
 
 config SBSA_REF
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     imply PCI_DEVICES
     select AHCI
     select ARM_SMMUV3
@@ -XXX,XX +XXX,XX @@ config SBSA_REF
 
 config SABRELITE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select FSL_IMX6
     select SSI_M25P80
 
 config STELLARIS
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select ARM_V7M
     select CMSDK_APB_WATCHDOG
@@ -XXX,XX +XXX,XX @@ config STELLARIS
 
 config STM32VLDISCOVERY
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F100_SOC
 
 config STRONGARM
@@ -XXX,XX +XXX,XX @@ config STRONGARM
 
 config COLLIE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select ZAURUS  # scoop
     select STRONGARM
 
 config SX1
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
 
 config VERSATILE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARM_TIMER # sp804
     select PFLASH_CFI01
     select LSI_SCSI_PCI
@@ -XXX,XX +XXX,XX @@ config VERSATILE
 
 config VEXPRESS
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select A15MPCORE
     select ARM_MPTIMER
@@ -XXX,XX +XXX,XX @@ config VEXPRESS
 
 config ZYNQ
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select CADENCE # UART
     select PFLASH_CFI02
@@ -XXX,XX +XXX,XX @@ config ZYNQ
 config ARM_V7M
     bool
     # currently v7M must be included in a TCG build due to translate.c
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PTIMER
 
 config ALLWINNER_A10
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
 
 config ALLWINNER_H3
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ALLWINNER_A10_PIT
     select ALLWINNER_SUN8I_EMAC
     select ALLWINNER_I2C
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
 
 config RASPI
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select FRAMEBUFFER
     select PL011 # UART
     select SDHCI
@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
 
 config XLNX_ZYNQMP_ARM
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     select AHCI
     select ARM_GIC
     select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_ZYNQMP_ARM
 
 config XLNX_VERSAL
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     select ARM_GIC
     select PL011
     select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_VERSAL
 
 config NPCM7XX
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select ADM1272
     select ARM_GIC
@@ -XXX,XX +XXX,XX @@ config NPCM7XX
 
 config FSL_IMX25
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select IMX
     select IMX_FEC
@@ -XXX,XX +XXX,XX @@ config FSL_IMX25
 
 config FSL_IMX31
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select SERIAL
     select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
 
 config ASPEED_SOC
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select DS1338
     select FTGMAC100
     select I2C
@@ -XXX,XX +XXX,XX @@ config ASPEED_SOC
 
 config MPS2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select ARMSSE
     select LAN9118
@@ -XXX,XX +XXX,XX @@ config MPS2
 
 config FSL_IMX7
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply PCI_DEVICES
     imply TEST_DEVICES
     imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config ARM_SMMUV3
 
 config FSL_IMX6UL
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select A15MPCORE
     select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6UL
 
 config MICROBIT
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select NRF51_SOC
 
 config NRF51_SOC
@@ -XXX,XX +XXX,XX @@ config NRF51_SOC
 
 config EMCRAFT_SF2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select MSF2
     select SSI_M25P80
 
-- 
2.34.1

From: Enze Li <lienze@kylinos.cn>

I noticed that in the latest version, the copyright string is still
2022, even though 2023 is halfway through.  This patch fixes that and
fixes the documentation along with it.

Signed-off-by: Enze Li <lienze@kylinos.cn>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230525064345.1152801-1-lienze@kylinos.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/conf.py              | 2 +-
 include/qemu/help-texts.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@
 
 # General information about the project.
 project = u'QEMU'
-copyright = u'2022, The QEMU Project Developers'
+copyright = u'2023, The QEMU Project Developers'
 author = u'The QEMU Project Developers'
 
 # The version info for the project you're documenting, acts as replacement for
diff --git a/include/qemu/help-texts.h b/include/qemu/help-texts.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/help-texts.h
+++ b/include/qemu/help-texts.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_HELP_TEXTS_H
 
 /* Copyright string for -version arguments, About dialogs, etc */
-#define QEMU_COPYRIGHT "Copyright (c) 2003-2022 " \
+#define QEMU_COPYRIGHT "Copyright (c) 2003-2023 " \
     "Fabrice Bellard and the QEMU Project developers"
 
 /* Bug reporting information for --help arguments, About dialogs, etc */
-- 
2.34.1

From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>

Let add GIC information into DeviceTree as part of SBSA-REF versioning.

Trusted Firmware will read it and provide to next firmware level.

Bumps platform version to 0.1 one so we can check is node is present.

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "kvm_arm.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/fdt.h"
 #include "hw/arm/smmuv3.h"
 #include "hw/block/flash.h"
 #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
     return arm_cpu_mp_affinity(idx, clustersz);
 }
 
+static void sbsa_fdt_add_gic_node(SBSAMachineState *sms)
+{
+    char *nodename;
+
+    nodename = g_strdup_printf("/intc");
+    qemu_fdt_add_subnode(sms->fdt, nodename);
+    qemu_fdt_setprop_sized_cells(sms->fdt, nodename, "reg",
+                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].base,
+                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].size,
+                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].base,
+                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].size);
+
+    g_free(nodename);
+}
 /*
  * Firmware on this machine only uses ACPI table to load OS, these limited
  * device tree nodes are just to let firmware know the info which varies from
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
      *                        fw compatibility.
      */
     qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
-    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 0);
+    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 1);
 
     if (ms->numa_state->have_numa_distance) {
         int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
 
         g_free(nodename);
     }
+
+    sbsa_fdt_add_gic_node(sms);
 }
 
 #define SBSA_FLASH_SECTOR_SIZE (256 * KiB)
-- 
2.34.1