Series comparison

-[PULL 00/30] target-arm queue
+[PULL 00/21] target-arm queue
-Hi; this is the latest target-arm queue. Most of the patches
+Hi; here's the latest batch of arm changes. The big thing
-here are RTH's FEAT_HAFDBS finally landing. I've also included
+in here is the SMMUv3 changes to add stage-2 translation support.
 the RNG-seed randomization patches from Jason, as well as a few
 more minor things. The patches include a couple of regression
 fixes:
  * the resettable patch fixes a SCSI reset regression
  * the 'do not re-randomize on snapshot load' patches fix
    record-and-replay regressions
 thanks
 -- PMM
-The following changes since commit e750a7ace492f0b450653d4ad368a77d6f660fb8:
+The following changes since commit aa9bbd865502ed517624ab6fe7d4b5d89ca95e43:
-  Merge tag 'pull-9p-20221024' of https://github.com/cschoenebeck/qemu into staging (2022-10-24 14:27:12 -0400)
+  Merge tag 'pull-ppc-20230528' of https://gitlab.com/danielhb/qemu into staging (2023-05-29 14:31:52 -0700)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20221025
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230530
-for you to fetch changes up to e2114f701c78f76246e4b1872639dad94a6bdd21:
+for you to fetch changes up to b03d0d4f531a8b867e0aac1fab0b876903015680:
-  rx: re-randomize rng-seed on reboot (2022-10-25 17:32:24 +0100)
+  docs: sbsa: correct graphics card name (2023-05-30 13:32:46 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * Implement FEAT_E0PD
+ * fsl-imx6: Add SNVS support for i.MX6 boards
- * Implement FEAT_HAFDBS
+ * smmuv3: Add support for stage 2 translations
- * honor HCR_E2H and HCR_TGE in arm_excp_unmasked()
+ * hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop
- * hw/arm/virt: Fix devicetree warnings about the virtio-iommu node
+ * hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
- * hw/core/resettable: fix reset level counting
+ * cleanups for recent Kconfig changes
- * hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset()
+ * target/arm: Explicitly select short-format FSR for M-profile
- * imx: reload cmp timer outside of the reload ptimer transaction
+ * tests/qtest: Run arm-specific tests only if the required machine is available
- * x86: do not re-randomize RNG seed on snapshot load
+ * hw/arm/sbsa-ref: add GIC node into DT
- * m68k/virt: do not re-randomize RNG seed on snapshot load
+ * docs: sbsa: correct graphics card name
- * m68k/q800: do not re-randomize RNG seed on snapshot load
+ * Update copyright dates to 2023
  * arm: re-randomize rng-seed on reboot
  * riscv: re-randomize rng-seed on reboot
  * mips/boston: re-randomize rng-seed on reboot
  * openrisc: re-randomize rng-seed on reboot
  * rx: re-randomize rng-seed on reboot
 ----------------------------------------------------------------
-Ake Koomsin (1):
+Clément Chigot (1):
-      target/arm: honor HCR_E2H and HCR_TGE in arm_excp_unmasked()
+      hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
-Axel Heider (1):
+Enze Li (1):
-      target/imx: reload cmp timer outside of the reload ptimer transaction
+      Update copyright dates to 2023
-Damien Hedde (1):
+Fabiano Rosas (3):
-      hw/core/resettable: fix reset level counting
+      target/arm: Explain why we need to select ARM_V7M
       arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
       arm/Kconfig: Make TCG dependence explicit
-Jason A. Donenfeld (10):
+Marcin Juszkiewicz (2):
-      reset: allow registering handlers that aren't called by snapshot loading
+      hw/arm/sbsa-ref: add GIC node into DT
-      device-tree: add re-randomization helper function
+      docs: sbsa: correct graphics card name
       x86: do not re-randomize RNG seed on snapshot load
       arm: re-randomize rng-seed on reboot
       riscv: re-randomize rng-seed on reboot
       m68k/virt: do not re-randomize RNG seed on snapshot load
       m68k/q800: do not re-randomize RNG seed on snapshot load
       mips/boston: re-randomize rng-seed on reboot
       openrisc: re-randomize rng-seed on reboot
       rx: re-randomize rng-seed on reboot
-Jean-Philippe Brucker (1):
+Mostafa Saleh (10):
-      hw/arm/virt: Fix devicetree warnings about the virtio-iommu node
+      hw/arm/smmuv3: Add missing fields for IDR0
       hw/arm/smmuv3: Update translation config to hold stage-2
       hw/arm/smmuv3: Refactor stage-1 PTW
       hw/arm/smmuv3: Add page table walk for stage-2
       hw/arm/smmuv3: Parse STE config for stage-2
       hw/arm/smmuv3: Make TLB lookup work for stage-2
       hw/arm/smmuv3: Add VMID to TLB tagging
       hw/arm/smmuv3: Add CMDs related to stage-2
       hw/arm/smmuv3: Add stage-2 support in iova notifier
       hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2
-Peter Maydell (2):
+Peter Maydell (1):
-      target/arm: Implement FEAT_E0PD
+      target/arm: Explicitly select short-format FSR for M-profile
       hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset()
-Richard Henderson (14):
+Thomas Huth (1):
-      target/arm: Introduce regime_is_stage2
+      tests/qtest: Run arm-specific tests only if the required machine is available
       target/arm: Add ptw_idx to S1Translate
       target/arm: Add isar predicates for FEAT_HAFDBS
       target/arm: Extract HA and HD in aa64_va_parameters
       target/arm: Move S1_ptw_translate outside arm_ld[lq]_ptw
       target/arm: Add ARMFault_UnsuppAtomicUpdate
       target/arm: Remove loop from get_phys_addr_lpae
       target/arm: Fix fault reporting in get_phys_addr_lpae
       target/arm: Don't shift attrs in get_phys_addr_lpae
       target/arm: Consider GP an attribute in get_phys_addr_lpae
       target/arm: Tidy merging of attributes from descriptor and table
       target/arm: Implement FEAT_HAFDBS, access flag portion
       target/arm: Implement FEAT_HAFDBS, dirty bit portion
       target/arm: Use the max page size in a 2-stage ptw
- docs/devel/reset.rst          |   8 +-
+Tommy Wu (1):
- docs/system/arm/emulation.rst |   2 +
+      hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.
- qapi/run-state.json           |   6 +-
- include/hw/boards.h           |   2 +-
+Vitaly Cheptsov (1):
- include/sysemu/device_tree.h  |   9 +
+      fsl-imx6: Add SNVS support for i.MX6 boards
- include/sysemu/reset.h        |   5 +-
- target/arm/cpu.h              |  15 ++
+ docs/conf.py                                |   2 +-
- target/arm/internals.h        |  30 +++
+ docs/system/arm/sbsa.rst                    |   2 +-
- hw/arm/aspeed.c               |   4 +-
+ configs/devices/aarch64-softmmu/default.mak |   6 +
- hw/arm/boot.c                 |   2 +
+ configs/devices/arm-softmmu/default.mak     |  40 ++++
- hw/arm/mps2-tz.c              |   4 +-
+ hw/arm/smmu-internal.h                      |  37 +++
- hw/arm/virt.c                 |   5 +-
+ hw/arm/smmuv3-internal.h                    |  12 +-
- hw/core/reset.c               |  17 +-
+ include/hw/arm/fsl-imx6.h                   |   2 +
- hw/core/resettable.c          |   3 +-
+ include/hw/arm/smmu-common.h                |  45 +++-
- hw/hppa/machine.c             |   4 +-
+ include/hw/arm/smmuv3.h                     |   4 +
- hw/hyperv/hyperv.c            |   2 +-
+ include/qemu/help-texts.h                   |   2 +-
- hw/i386/microvm.c             |   4 +-
+ hw/arm/fsl-imx6.c                           |   8 +
- hw/i386/pc.c                  |   6 +-
+ hw/arm/sbsa-ref.c                           |  19 +-
- hw/i386/x86.c                 |   2 +-
+ hw/arm/smmu-common.c                        | 209 ++++++++++++++--
- hw/m68k/q800.c                |  33 ++-
+ hw/arm/smmuv3.c                             | 357 ++++++++++++++++++++++++----
- hw/m68k/virt.c                |  20 +-
+ hw/arm/xlnx-zynqmp.c                        |   2 +-
- hw/mips/boston.c              |   3 +
+ hw/dma/xilinx_axidma.c                      |  11 +-
- hw/openrisc/boot.c            |   3 +
+ target/arm/tcg/tlb_helper.c                 |  13 +-
- hw/ppc/pegasos2.c             |   4 +-
+ hw/arm/Kconfig                              | 123 ++++++----
- hw/ppc/pnv.c                  |   4 +-
+ hw/arm/trace-events                         |  14 +-
- hw/ppc/spapr.c                |   4 +-
+ target/arm/Kconfig                          |   3 +
- hw/riscv/boot.c               |   3 +
+ tests/qtest/meson.build                     |   7 +-
- hw/rx/rx-gdbsim.c             |   3 +
+files changed, 773 insertions(+), 145 deletions(-)
- hw/s390x/s390-virtio-ccw.c    |   4 +-
  hw/timer/imx_epit.c           |   9 +-
  migration/savevm.c            |   2 +-
  softmmu/device_tree.c         |  21 ++
  softmmu/runstate.c            |  11 +-
  target/arm/cpu.c              |  24 +-
  target/arm/cpu64.c            |   2 +
  target/arm/helper.c           |  31 ++-
  target/arm/ptw.c              | 524 +++++++++++++++++++++++++++---------------
 files changed, 572 insertions(+), 263 deletions(-)

-[PULL 30/30] rx: re-randomize rng-seed on reboot
+[PULL 01/21] fsl-imx6: Add SNVS support for i.MX6 boards
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Vitaly Cheptsov <cheptsov@ispras.ru>
-When the system reboots, the rng-seed that the FDT has should be
+SNVS is supported on both i.MX6 and i.MX6UL and is needed
-re-randomized, so that the new boot gets a new seed. Since the FDT is in
+to support shutdown on the board.
 the ROM region at this point, we add a hook right after the ROM has been
 added, so that we have a pointer to that copy of the FDT.
-Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
+Cc: Peter Maydell <peter.maydell@linaro.org> (odd fixer:SABRELITE / i.MX6)
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Cc: Jean-Christophe Dubois <jcd@tribudubois.net> (reviewer:SABRELITE / i.MX6)
-Message-id: 20221025004327.568476-12-Jason@zx2c4.com
+Cc: qemu-arm@nongnu.org (open list:SABRELITE / i.MX6)
 Cc: qemu-devel@nongnu.org (open list:All patches CC here)
 Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>
 Message-id: 20230515095015.66860-1-cheptsov@ispras.ru
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/rx/rx-gdbsim.c | 3 +++
+ include/hw/arm/fsl-imx6.h | 2 ++
-file changed, 3 insertions(+)
+ hw/arm/fsl-imx6.c         | 8 ++++++++
 files changed, 10 insertions(+)
-diff --git a/hw/rx/rx-gdbsim.c b/hw/rx/rx-gdbsim.c
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/rx/rx-gdbsim.c
+--- a/include/hw/arm/fsl-imx6.h
-+++ b/hw/rx/rx-gdbsim.c
++++ b/include/hw/arm/fsl-imx6.h
 @@ -XXX,XX +XXX,XX @@
- #include "hw/rx/rx62n.h"
+ #include "hw/cpu/a9mpcore.h"
- #include "sysemu/qtest.h"
+ #include "hw/misc/imx6_ccm.h"
- #include "sysemu/device_tree.h"
+ #include "hw/misc/imx6_src.h"
-+#include "sysemu/reset.h"
++#include "hw/misc/imx7_snvs.h"
- #include "hw/boards.h"
+ #include "hw/watchdog/wdt_imx2.h"
- #include "qom/object.h"
+ #include "hw/char/imx_serial.h"
+ #include "hw/timer/imx_gpt.h"
-@@ -XXX,XX +XXX,XX @@ static void rx_gdbsim_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
-             dtb_offset = ROUND_DOWN(machine->ram_size - dtb_size, 16);
+     A9MPPrivState  a9mpcore;
-             rom_add_blob_fixed("dtb", dtb, dtb_size,
+     IMX6CCMState   ccm;
-                                SDRAM_BASE + dtb_offset);
+     IMX6SRCState   src;
-+            qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
++    IMX7SNVSState  snvs;
-+                                rom_ptr(SDRAM_BASE + dtb_offset, dtb_size));
+     IMXSerialState uart[FSL_IMX6_NUM_UARTS];
-             /* Set dtb address to R1 */
+     IMXGPTState    gpt;
-             RX_CPU(first_cpu)->env.regs[1] = SDRAM_BASE + dtb_offset;
+     IMXEPITState   epit[FSL_IMX6_NUM_EPITS];
-         }
+diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fsl-imx6.c
 +++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
      object_initialize_child(obj, "src", &s->src, TYPE_IMX6_SRC);
 +    object_initialize_child(obj, "snvs", &s->snvs, TYPE_IMX7_SNVS);
 +
      for (i = 0; i < FSL_IMX6_NUM_UARTS; i++) {
          snprintf(name, NAME_SIZE, "uart%d", i + 1);
          object_initialize_child(obj, name, &s->uart[i], TYPE_IMX_SERIAL);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                         qdev_get_gpio_in(DEVICE(&s->a9mpcore),
                                          FSL_IMX6_ENET_MAC_1588_IRQ));
 +    /*
 +     * SNVS
 +     */
 +    sysbus_realize(SYS_BUS_DEVICE(&s->snvs), &error_abort);
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->snvs), 0, FSL_IMX6_SNVSHP_ADDR);
 +
      /*
       * Watchdog
       */
 --
-.25.1
+.34.1

-[PULL 29/30] openrisc: re-randomize rng-seed on reboot
+[PULL 02/21] hw/arm/smmuv3: Add missing fields for IDR0
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Mostafa Saleh <smostafa@google.com>
-When the system reboots, the rng-seed that the FDT has should be
+In preparation for adding stage-2 support.
-re-randomized, so that the new boot gets a new seed. Since the FDT is in
+Add IDR0 fields related to stage-2.
 the ROM region at this point, we add a hook right after the ROM has been
 added, so that we have a pointer to that copy of the FDT.
-Cc: Stafford Horne <shorne@gmail.com>
+VMID16: 16-bit VMID supported.
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+S2P: Stage-2 translation supported.
-Message-id: 20221025004327.568476-11-Jason@zx2c4.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+They are described in 6.3.1 SMMU_IDR0.
 No functional change intended.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-2-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/openrisc/boot.c | 3 +++
+ hw/arm/smmuv3-internal.h | 2 ++
-file changed, 3 insertions(+)
+file changed, 2 insertions(+)
-diff --git a/hw/openrisc/boot.c b/hw/openrisc/boot.c
+diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/openrisc/boot.c
+--- a/hw/arm/smmuv3-internal.h
-+++ b/hw/openrisc/boot.c
++++ b/hw/arm/smmuv3-internal.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef enum SMMUTranslationStatus {
- #include "hw/openrisc/boot.h"
+ /* MMIO Registers */
- #include "sysemu/device_tree.h"
- #include "sysemu/qtest.h"
+ REG32(IDR0,                0x0)
-+#include "sysemu/reset.h"
++    FIELD(IDR0, S2P,         0 , 1)
+     FIELD(IDR0, S1P,         1 , 1)
- #include <libfdt.h>
+     FIELD(IDR0, TTF,         2 , 2)
+     FIELD(IDR0, COHACC,      4 , 1)
-@@ -XXX,XX +XXX,XX @@ uint32_t openrisc_load_fdt(void *fdt, hwaddr load_start,
+     FIELD(IDR0, ASID16,      12, 1)
++    FIELD(IDR0, VMID16,      18, 1)
-     rom_add_blob_fixed_as("fdt", fdt, fdtsize, fdt_addr,
+     FIELD(IDR0, TTENDIAN,    21, 2)
-                           &address_space_memory);
+     FIELD(IDR0, STALL_MODEL, 24, 2)
-+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+     FIELD(IDR0, TERM_MODEL,  26, 1)
 +                        rom_ptr_for_as(&address_space_memory, fdt_addr, fdtsize));
      return fdt_addr;
  }
 --
-.25.1
+.34.1

-[PULL 27/30] m68k/q800: do not re-randomize RNG seed on snapshot load
+[PULL 03/21] hw/arm/smmuv3: Update translation config to hold stage-2
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Mostafa Saleh <smostafa@google.com>
-Snapshot loading is supposed to be deterministic, so we shouldn't
+In preparation for adding stage-2 support, add a S2 config
-re-randomize the various seeds used.
+struct(SMMUS2Cfg), composed of the following fields and embedded in
 the main SMMUTransCfg:
  -tsz: Size of IPA input region (S2T0SZ)
  -sl0: Start level of translation (S2SL0)
  -affd: AF Fault Disable (S2AFFD)
  -record_faults: Record fault events (S2R)
  -granule_sz: Granule page shift (based on S2TG)
  -vmid: Virtual Machine ID (S2VMID)
  -vttb: Address of translation table base (S2TTB)
  -eff_ps: Effective PA output range (based on S2PS)
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+They will be used in the next patches in stage-2 address translation.
-Message-id: 20221025004327.568476-8-Jason@zx2c4.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+The fields in SMMUS2Cfg, are reordered to make the shared and stage-1
 fields next to each other, this reordering didn't change the struct
 size (104 bytes before and after).
 Stage-1 only fields: aa64, asid, tt, ttb, tbi, record_faults, oas.
 oas is stage-1 output address size. However, it is used to check
 input address in case stage-1 is unimplemented or bypassed according
 to SMMUv3 manual IHI0070.E "3.4. Address sizes"
 Shared fields: stage, disabled, bypassed, aborted, iotlb_*.
 No functional change intended.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-3-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/m68k/q800.c | 33 +++++++++++++--------------------
+ include/hw/arm/smmu-common.h | 22 +++++++++++++++++++---
-file changed, 13 insertions(+), 20 deletions(-)
+file changed, 19 insertions(+), 3 deletions(-)
-diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/m68k/q800.c
+--- a/include/hw/arm/smmu-common.h
-+++ b/hw/m68k/q800.c
++++ b/include/hw/arm/smmu-common.h
-@@ -XXX,XX +XXX,XX @@ static const TypeInfo glue_info = {
+@@ -XXX,XX +XXX,XX @@ typedef struct SMMUTLBEntry {
-     },
+     uint8_t granule;
- };
+ } SMMUTLBEntry;
--typedef struct {
++/* Stage-2 configuration. */
--    M68kCPU *cpu;
++typedef struct SMMUS2Cfg {
--    struct bi_record *rng_seed;
++    uint8_t tsz;            /* Size of IPA input region (S2T0SZ) */
--} ResetInfo;
++    uint8_t sl0;            /* Start level of translation (S2SL0) */
--
++    bool affd;              /* AF Fault Disable (S2AFFD) */
- static void main_cpu_reset(void *opaque)
++    bool record_faults;     /* Record fault events (S2R) */
- {
++    uint8_t granule_sz;     /* Granule page shift (based on S2TG) */
--    ResetInfo *reset_info = opaque;
++    uint8_t eff_ps;         /* Effective PA output range (based on S2PS) */
--    M68kCPU *cpu = reset_info->cpu;
++    uint16_t vmid;          /* Virtual Machine ID (S2VMID) */
-+    M68kCPU *cpu = opaque;
++    uint64_t vttb;          /* Address of translation table base (S2TTB) */
-     CPUState *cs = CPU(cpu);
++} SMMUS2Cfg;
 -    if (reset_info->rng_seed) {
 -        qemu_guest_getrandom_nofail((void *)reset_info->rng_seed->data + 2,
 -            be16_to_cpu(*(uint16_t *)reset_info->rng_seed->data));
 -    }
 -
      cpu_reset(cs);
      cpu->env.aregs[7] = ldl_phys(cs->as, 0);
      cpu->env.pc = ldl_phys(cs->as, 4);
  }
 +static void rerandomize_rng_seed(void *opaque)
 +{
 +    struct bi_record *rng_seed = opaque;
 +    qemu_guest_getrandom_nofail((void *)rng_seed->data + 2,
 +                                be16_to_cpu(*(uint16_t *)rng_seed->data));
 +}
 +
- static uint8_t fake_mac_rom[] = {
+ /*
-, 0, 0, 0, 0, 0, 0, 0, 0, 0,
+  * Generic structure populated by derived SMMU devices
+  * after decoding the configuration information and used as
-@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
+  * input to the page table walk
-     NubusBus *nubus;
+  */
-     DeviceState *glue;
+ typedef struct SMMUTransCfg {
-     DriveInfo *dinfo;
++    /* Shared fields between stage-1 and stage-2. */
--    ResetInfo *reset_info;
+     int stage;                 /* translation stage */
-     uint8_t rng_seed[32];
+-    bool aa64;                 /* arch64 or aarch32 translation table */
+     bool disabled;             /* smmu is disabled */
-     linux_boot = (kernel_filename != NULL);
+     bool bypassed;             /* translation is bypassed */
-@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
+     bool aborted;              /* translation is aborted */
-         exit(1);
++    uint32_t iotlb_hits;       /* counts IOTLB hits */
-     }
++    uint32_t iotlb_misses;     /* counts IOTLB misses*/
++    /* Used by stage-1 only. */
--    reset_info = g_new0(ResetInfo, 1);
++    bool aa64;                 /* arch64 or aarch32 translation table */
--
+     bool record_faults;        /* record fault events */
-     /* init CPUs */
+     uint64_t ttb;              /* TT base address */
-     cpu = M68K_CPU(cpu_create(machine->cpu_type));
+     uint8_t oas;               /* output address width */
--    reset_info->cpu = cpu;
+     uint8_t tbi;               /* Top Byte Ignore */
--    qemu_register_reset(main_cpu_reset, reset_info);
+     uint16_t asid;
-+    qemu_register_reset(main_cpu_reset, cpu);
+     SMMUTransTableInfo tt[2];
+-    uint32_t iotlb_hits;       /* counts IOTLB hits for this asid */
-     /* RAM */
+-    uint32_t iotlb_misses;     /* counts IOTLB misses for this asid */
-     memory_region_add_subregion(get_system_memory(), 0, machine->ram);
++    /* Used by stage-2 only. */
-@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
++    struct SMMUS2Cfg s2cfg;
-         BOOTINFO0(param_ptr, BI_LAST);
+ } SMMUTransCfg;
-         rom_add_blob_fixed_as("bootinfo", param_blob, param_ptr - param_blob,
-                               parameters_base, cs->as);
+ typedef struct SMMUDevice {
 -        reset_info->rng_seed = rom_ptr_for_as(cs->as, parameters_base,
 -                                              param_ptr - param_blob) +
 -                               (param_rng_seed - param_blob);
 +        qemu_register_reset_nosnapshotload(rerandomize_rng_seed,
 +                            rom_ptr_for_as(cs->as, parameters_base,
 +                                           param_ptr - param_blob) +
 +                            (param_rng_seed - param_blob));
          g_free(param_blob);
      } else {
          uint8_t *ptr;
 --
-.25.1
+.34.1

-[PULL 11/30] target/arm: Move S1_ptw_translate outside arm_ld[lq]_ptw
+[PULL 04/21] hw/arm/smmuv3: Refactor stage-1 PTW
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-Separate S1 translation from the actual lookup.
+In preparation for adding stage-2 support, rename smmu_ptw_64 to
-Will enable lpae hardware updates.
+smmu_ptw_64_s1 and refactor some of the code so it can be reused in
 stage-2 page table walk.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Remove AA64 check from PTW as decode_cd already ensures that AA64 is
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+used, otherwise it faults with C_BAD_CD.
-Message-id: 20221024051851.3074715-6-richard.henderson@linaro.org
 A stage member is added to SMMUPTWEventInfo to differentiate
 between stage-1 and stage-2 ptw faults.
 Add stage argument to trace_smmu_ptw_level be consistent with other
 trace events.
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-4-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/ptw.c | 41 ++++++++++++++++++++++-------------------
+ include/hw/arm/smmu-common.h | 16 +++++++++++++---
-file changed, 22 insertions(+), 19 deletions(-)
+ hw/arm/smmu-common.c         | 27 ++++++++++-----------------
  hw/arm/smmuv3.c              |  2 ++
  hw/arm/trace-events          |  2 +-
 files changed, 26 insertions(+), 21 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
+--- a/include/hw/arm/smmu-common.h
-+++ b/target/arm/ptw.c
++++ b/include/hw/arm/smmu-common.h
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
+@@ -XXX,XX +XXX,XX @@
  #include "hw/pci/pci.h"
  #include "qom/object.h"
 -#define SMMU_PCI_BUS_MAX      256
 -#define SMMU_PCI_DEVFN_MAX    256
 -#define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
 +#define SMMU_PCI_BUS_MAX                    256
 +#define SMMU_PCI_DEVFN_MAX                  256
 +#define SMMU_PCI_DEVFN(sid)                 (sid & 0xFF)
 +
 +/* VMSAv8-64 Translation constants and functions */
 +#define VMSA_LEVELS                         4
 +
 +#define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
 +#define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
 +                                             (VMSA_LEVELS - (lvl)))
 +#define VMSA_IDXMSK(isz, strd, lvl)         ((1ULL << \
 +                                             VMSA_BIT_LVL(isz, strd, lvl)) - 1)
  /*
   * Page table walk error types
@@ -XXX,XX +XXX,XX @@ typedef enum {
  } SMMUPTWEventType;
  typedef struct SMMUPTWEventInfo {
 +    int stage;
      SMMUPTWEventType type;
      dma_addr_t addr; /* fetched address that induced an abort, if any */
  } SMMUPTWEventInfo;
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
  }
- /* All loads done in the course of a page table walk go through here. */
+ /**
--static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
+- * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
-+static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
++ * smmu_ptw_64_s1 - VMSAv8-64 Walk of the page tables for a given IOVA
-                             ARMMMUFaultInfo *fi)
+  * @cfg: translation config
   * @iova: iova to translate
   * @perm: access type
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
   * Upon success, @tlbe is filled with translated_addr and entry
   * permission rights.
   */
 -static int smmu_ptw_64(SMMUTransCfg *cfg,
 -                       dma_addr_t iova, IOMMUAccessFlags perm,
 -                       SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 +static int smmu_ptw_64_s1(SMMUTransCfg *cfg,
 +                          dma_addr_t iova, IOMMUAccessFlags perm,
 +                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
  {
-     CPUState *cs = env_cpu(env);
+     dma_addr_t baseaddr, indexmask;
-     uint32_t data;
+     int stage = cfg->stage;
+@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
--    if (!S1_ptw_translate(env, ptw, addr, fi)) {
+     }
--        /* Failure. */
--        assert(fi->s1ptw);
+     granule_sz = tt->granule_sz;
--        return 0;
+-    stride = granule_sz - 3;
 +    stride = VMSA_STRIDE(granule_sz);
      inputsize = 64 - tt->tsz;
      level = 4 - (inputsize - 4) / stride;
 -    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
 +    indexmask = VMSA_IDXMSK(inputsize, stride, level);
      baseaddr = extract64(tt->ttb, 0, 48);
      baseaddr &= ~indexmask;
 -    while (level <= 3) {
 +    while (level < VMSA_LEVELS) {
          uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
          uint64_t mask = subpage_size - 1;
          uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
          if (get_pte(baseaddr, offset, &pte, info)) {
                  goto error;
          }
 -        trace_smmu_ptw_level(level, iova, subpage_size,
 +        trace_smmu_ptw_level(stage, level, iova, subpage_size,
                               baseaddr, offset, pte);
          if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
      info->type = SMMU_PTW_ERR_TRANSLATION;
  error:
 +    info->stage = 1;
      tlbe->entry.perm = IOMMU_NONE;
      return -EINVAL;
  }
@@ -XXX,XX +XXX,XX @@ error:
  int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
               SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
  {
 -    if (!cfg->aa64) {
 -        /*
 -         * This code path is not entered as we check this while decoding
 -         * the configuration data in the derived SMMU model.
 -         */
 -        g_assert_not_reached();
 -    }
 -
-     if (likely(ptw->out_host)) {
+-    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
-         /* Page tables are in RAM, and we have the host address. */
++    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
          if (ptw->out_be) {
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
      return data;
  }
--static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
+ /**
-+static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
-                             ARMMMUFaultInfo *fi)
+index XXXXXXX..XXXXXXX 100644
- {
+--- a/hw/arm/smmuv3.c
-     CPUState *cs = env_cpu(env);
++++ b/hw/arm/smmuv3.c
-     uint64_t data;
+@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
+     cached_entry = g_new0(SMMUTLBEntry, 1);
--    if (!S1_ptw_translate(env, ptw, addr, fi)) {
--        /* Failure. */
+     if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) {
--        assert(fi->s1ptw);
++        /* All faults from PTW has S2 field. */
--        return 0;
++        event.u.f_walk_eabt.s2 = (ptw_info.stage == 2);
--    }
+         g_free(cached_entry);
--
+         switch (ptw_info.type) {
-     if (likely(ptw->out_host)) {
+         case SMMU_PTW_ERR_WALK_EABT:
-         /* Page tables are in RAM, and we have the host address. */
+diff --git a/hw/arm/trace-events b/hw/arm/trace-events
-         if (ptw->out_be) {
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
+--- a/hw/arm/trace-events
-         fi->type = ARMFault_Translation;
++++ b/hw/arm/trace-events
-         goto do_fault;
+@@ -XXX,XX +XXX,XX @@ virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
-     }
--    desc = arm_ldl_ptw(env, ptw, table, fi);
+ # smmu-common.c
-+    if (!S1_ptw_translate(env, ptw, table, fi)) {
+ smmu_add_mr(const char *name) "%s"
-+        goto do_fault;
+-smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
-+    }
++smmu_ptw_level(int stage, int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
-+    desc = arm_ldl_ptw(env, ptw, fi);
+ smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
-     if (fi->type != ARMFault_None) {
+ smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
-         goto do_fault;
+ smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
      }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
              /* Fine pagetable.  */
              table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
          }
 -        desc = arm_ldl_ptw(env, ptw, table, fi);
 +        if (!S1_ptw_translate(env, ptw, table, fi)) {
 +            goto do_fault;
 +        }
 +        desc = arm_ldl_ptw(env, ptw, fi);
          if (fi->type != ARMFault_None) {
              goto do_fault;
          }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
          fi->type = ARMFault_Translation;
          goto do_fault;
      }
 -    desc = arm_ldl_ptw(env, ptw, table, fi);
 +    if (!S1_ptw_translate(env, ptw, table, fi)) {
 +        goto do_fault;
 +    }
 +    desc = arm_ldl_ptw(env, ptw, fi);
      if (fi->type != ARMFault_None) {
          goto do_fault;
      }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
          ns = extract32(desc, 3, 1);
          /* Lookup l2 entry.  */
          table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
 -        desc = arm_ldl_ptw(env, ptw, table, fi);
 +        if (!S1_ptw_translate(env, ptw, table, fi)) {
 +            goto do_fault;
 +        }
 +        desc = arm_ldl_ptw(env, ptw, fi);
          if (fi->type != ARMFault_None) {
              goto do_fault;
          }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
              ptw->in_ptw_idx &= ~1;
              ptw->in_secure = false;
          }
 -        descriptor = arm_ldq_ptw(env, ptw, descaddr, fi);
 +        if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
 +            goto do_fault;
 +        }
 +        descriptor = arm_ldq_ptw(env, ptw, fi);
          if (fi->type != ARMFault_None) {
              goto do_fault;
          }
 --
-.25.1
+.34.1

-[PULL 09/30] target/arm: Add isar predicates for FEAT_HAFDBS
+[PULL 05/21] hw/arm/smmuv3: Add page table walk for stage-2
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-The MMFR1 field may indicate support for hardware update of
+In preparation for adding stage-2 support, add Stage-2 PTW code.
-access flag alone, or access flag and dirty bit.
+Only Aarch64 format is supported as stage-1.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Nesting stage-1 and stage-2 is not supported right now.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20221024051851.3074715-4-richard.henderson@linaro.org
+HTTU is not supported, SW is expected to maintain the Access flag.
 This is described in the SMMUv3 manual(IHI 0070.E.a)
 "5.2. Stream Table Entry" in "[181] S2AFFD".
 This flag determines the behavior on access of a stage-2 page whose
 descriptor has AF == 0:
 - 0b0: An Access flag fault occurs (stall not supported).
 - 0b1: An Access flag fault never occurs.
 An Access fault takes priority over a Permission fault.
 There are 3 address size checks for stage-2 according to
 (IHI 0070.E.a) in "3.4. Address sizes".
 - As nesting is not supported, input address is passed directly to
 stage-2, and is checked against IAS.
 We use cfg->oas to hold the OAS when stage-1 is not used, this is set
 in the next patch.
 This check is done outside of smmu_ptw_64_s2 as it is not part of
 stage-2(it throws stage-1 fault), and the stage-2 function shouldn't
 change it's behavior when nesting is supported.
 When nesting is supported and we figure out how to combine TLB for
 stage-1 and stage-2 we can move this check into the stage-1 function
 as described in ARM DDI0487I.a in pseudocode
 aarch64/translation/vmsa_translation/AArch64.S1Translate
 aarch64/translation/vmsa_translation/AArch64.S1DisabledOutput
 - Input to stage-2 is checked against s2t0sz, and throws stage-2
 transaltion fault if exceeds it.
 - Output of stage-2 is checked against effective PA output range.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-5-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h | 10 ++++++++++
+ hw/arm/smmu-internal.h |  35 ++++++++++
-file changed, 10 insertions(+)
+ hw/arm/smmu-common.c   | 142 ++++++++++++++++++++++++++++++++++++++++-
+files changed, 176 insertions(+), 1 deletion(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/smmu-internal.h
-+++ b/target/arm/cpu.h
++++ b/hw/arm/smmu-internal.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_e0pd(const ARMISARegisters *id)
+@@ -XXX,XX +XXX,XX @@
-     return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, E0PD) != 0;
+ #define PTE_APTABLE(pte) \
      (extract64(pte, 61, 2))
 +#define PTE_AF(pte) \
 +    (extract64(pte, 10, 1))
  /*
   * TODO: At the moment all transactions are considered as privileged (EL1)
   * as IOMMU translation callback does not pass user/priv attributes.
@@ -XXX,XX +XXX,XX @@
  #define is_permission_fault(ap, perm) \
      (((perm) & IOMMU_WO) && ((ap) & 0x2))
 +#define is_permission_fault_s2(s2ap, perm) \
 +    (!(((s2ap) & (perm)) == (perm)))
 +
  #define PTE_AP_TO_PERM(ap) \
      (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
@@ -XXX,XX +XXX,XX @@ uint64_t iova_level_offset(uint64_t iova, int inputsize,
              MAKE_64BIT_MASK(0, gsz - 3);
  }
-+static inline bool isar_feature_aa64_hafs(const ARMISARegisters *id)
++/* FEAT_LPA2 and FEAT_TTST are not implemented. */
 +static inline int get_start_level(int sl0 , int granule_sz)
 +{
-+    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, HAFDBS) != 0;
++    /* ARM DDI0487I.a: Table D8-12. */
 +    if (granule_sz == 12) {
 +        return 2 - sl0;
 +    }
 +    /* ARM DDI0487I.a: Table D8-22 and Table D8-31. */
 +    return 3 - sl0;
 +}
 +
-+static inline bool isar_feature_aa64_hdbs(const ARMISARegisters *id)
++/*
 + * Index in a concatenated first level stage-2 page table.
 + * ARM DDI0487I.a: D8.2.2 Concatenated translation tables.
 + */
 +static inline int pgd_concat_idx(int start_level, int granule_sz,
 +                                 dma_addr_t ipa)
 +{
-+    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, HAFDBS) >= 2;
++    uint64_t ret;
 +    /*
 +     * Get the number of bits handled by next levels, then any extra bits in
 +     * the address should index the concatenated tables. This relation can be
 +     * deduced from tables in ARM DDI0487I.a: D8.2.7-9
 +     */
 +    int shift =  level_shift(start_level - 1, granule_sz);
 +
 +    ret = ipa >> shift;
 +    return ret;
 +}
 +
- static inline bool isar_feature_aa64_tts2uxn(const ARMISARegisters *id)
+ #define SMMU_IOTLB_ASID(key) ((key).asid)
  typedef struct SMMUIOTLBPageInvInfo {
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ error:
      return -EINVAL;
  }
 +/**
 + * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa
 + * for stage-2.
 + * @cfg: translation config
 + * @ipa: ipa to translate
 + * @perm: access type
 + * @tlbe: SMMUTLBEntry (out)
 + * @info: handle to an error info
 + *
 + * Return 0 on success, < 0 on error. In case of error, @info is filled
 + * and tlbe->perm is set to IOMMU_NONE.
 + * Upon success, @tlbe is filled with translated_addr and entry
 + * permission rights.
 + */
 +static int smmu_ptw_64_s2(SMMUTransCfg *cfg,
 +                          dma_addr_t ipa, IOMMUAccessFlags perm,
 +                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 +{
 +    const int stage = 2;
 +    int granule_sz = cfg->s2cfg.granule_sz;
 +    /* ARM DDI0487I.a: Table D8-7. */
 +    int inputsize = 64 - cfg->s2cfg.tsz;
 +    int level = get_start_level(cfg->s2cfg.sl0, granule_sz);
 +    int stride = VMSA_STRIDE(granule_sz);
 +    int idx = pgd_concat_idx(level, granule_sz, ipa);
 +    /*
 +     * Get the ttb from concatenated structure.
 +     * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte))
 +     */
 +    uint64_t baseaddr = extract64(cfg->s2cfg.vttb, 0, 48) + (1 << stride) *
 +                                  idx * sizeof(uint64_t);
 +    dma_addr_t indexmask = VMSA_IDXMSK(inputsize, stride, level);
 +
 +    baseaddr &= ~indexmask;
 +
 +    /*
 +     * On input, a stage 2 Translation fault occurs if the IPA is outside the
 +     * range configured by the relevant S2T0SZ field of the STE.
 +     */
 +    if (ipa >= (1ULL << inputsize)) {
 +        info->type = SMMU_PTW_ERR_TRANSLATION;
 +        goto error;
 +    }
 +
 +    while (level < VMSA_LEVELS) {
 +        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
 +        uint64_t mask = subpage_size - 1;
 +        uint32_t offset = iova_level_offset(ipa, inputsize, level, granule_sz);
 +        uint64_t pte, gpa;
 +        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
 +        uint8_t s2ap;
 +
 +        if (get_pte(baseaddr, offset, &pte, info)) {
 +                goto error;
 +        }
 +        trace_smmu_ptw_level(stage, level, ipa, subpage_size,
 +                             baseaddr, offset, pte);
 +        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
 +            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
 +                                       pte_addr, offset, pte);
 +            break;
 +        }
 +
 +        if (is_table_pte(pte, level)) {
 +            baseaddr = get_table_pte_address(pte, granule_sz);
 +            level++;
 +            continue;
 +        } else if (is_page_pte(pte, level)) {
 +            gpa = get_page_pte_address(pte, granule_sz);
 +            trace_smmu_ptw_page_pte(stage, level, ipa,
 +                                    baseaddr, pte_addr, pte, gpa);
 +        } else {
 +            uint64_t block_size;
 +
 +            gpa = get_block_pte_address(pte, level, granule_sz,
 +                                        &block_size);
 +            trace_smmu_ptw_block_pte(stage, level, baseaddr,
 +                                     pte_addr, pte, ipa, gpa,
 +                                     block_size >> 20);
 +        }
 +
 +        /*
 +         * If S2AFFD and PTE.AF are 0 => fault. (5.2. Stream Table Entry)
 +         * An Access fault takes priority over a Permission fault.
 +         */
 +        if (!PTE_AF(pte) && !cfg->s2cfg.affd) {
 +            info->type = SMMU_PTW_ERR_ACCESS;
 +            goto error;
 +        }
 +
 +        s2ap = PTE_AP(pte);
 +        if (is_permission_fault_s2(s2ap, perm)) {
 +            info->type = SMMU_PTW_ERR_PERMISSION;
 +            goto error;
 +        }
 +
 +        /*
 +         * The address output from the translation causes a stage 2 Address
 +         * Size fault if it exceeds the effective PA output range.
 +         */
 +        if (gpa >= (1ULL << cfg->s2cfg.eff_ps)) {
 +            info->type = SMMU_PTW_ERR_ADDR_SIZE;
 +            goto error;
 +        }
 +
 +        tlbe->entry.translated_addr = gpa;
 +        tlbe->entry.iova = ipa & ~mask;
 +        tlbe->entry.addr_mask = mask;
 +        tlbe->entry.perm = s2ap;
 +        tlbe->level = level;
 +        tlbe->granule = granule_sz;
 +        return 0;
 +    }
 +    info->type = SMMU_PTW_ERR_TRANSLATION;
 +
 +error:
 +    info->stage = 2;
 +    tlbe->entry.perm = IOMMU_NONE;
 +    return -EINVAL;
 +}
 +
  /**
   * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
   *
@@ -XXX,XX +XXX,XX @@ error:
  int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
               SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
  {
-     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, XNX) != 0;
+-    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
 +    if (cfg->stage == 1) {
 +        return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
 +    } else if (cfg->stage == 2) {
 +        /*
 +         * If bypassing stage 1(or unimplemented), the input address is passed
 +         * directly to stage 2 as IPA. If the input address of a transaction
 +         * exceeds the size of the IAS, a stage 1 Address Size fault occurs.
 +         * For AA64, IAS = OAS according to (IHI 0070.E.a) "3.4 Address sizes"
 +         */
 +        if (iova >= (1ULL << cfg->oas)) {
 +            info->type = SMMU_PTW_ERR_ADDR_SIZE;
 +            info->stage = 1;
 +            tlbe->entry.perm = IOMMU_NONE;
 +            return -EINVAL;
 +        }
 +
 +        return smmu_ptw_64_s2(cfg, iova, perm, tlbe, info);
 +    }
 +
 +    g_assert_not_reached();
  }
  /**
 --
-.25.1
+.34.1

-[PULL 21/30] reset: allow registering handlers that aren't called by snapshot loading
+[PULL 06/21] hw/arm/smmuv3: Parse STE config for stage-2
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Mostafa Saleh <smostafa@google.com>
-Snapshot loading only expects to call deterministic handlers, not
+Parse stage-2 configuration from STE and populate it in SMMUS2Cfg.
-non-deterministic ones. So introduce a way of registering handlers that
+Validity of field values are checked when possible.
-won't be called when reseting for snapshots.
+Only AA64 tables are supported and Small Translation Tables (STT) are
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+not supported.
-Message-id: 20221025004327.568476-2-Jason@zx2c4.com
-[PMM: updated json doc comment with Markus' text; fixed
+According to SMMUv3 UM(IHI0070E) "5.2 Stream Table Entry": All fields
- checkpatch style nit]
+with an S2 prefix (with the exception of S2VMID) are IGNORED when
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+stage-2 bypasses translation (Config[1] == 0).
 Which means that VMID can be used(for TLB tagging) even if stage-2 is
 bypassed, so we parse it unconditionally when S2P exists. Otherwise
 it is set to -1.(only S1P)
 As stall is not supported, if S2S is set the translation would abort.
 For S2R, we reuse the same code used for stage-1 with flag
 record_faults. However when nested translation is supported we would
 need to separate stage-1 and stage-2 faults.
 Fix wrong shift in STE_S2HD, STE_S2HA, STE_S2S.
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 20230516203327.2051088-6-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- qapi/run-state.json        |  6 +++++-
+ hw/arm/smmuv3-internal.h     |  10 +-
- include/hw/boards.h        |  2 +-
+ include/hw/arm/smmu-common.h |   1 +
- include/sysemu/reset.h     |  5 ++++-
+ include/hw/arm/smmuv3.h      |   3 +
- hw/arm/aspeed.c            |  4 ++--
+ hw/arm/smmuv3.c              | 181 +++++++++++++++++++++++++++++++++--
- hw/arm/mps2-tz.c           |  4 ++--
+files changed, 185 insertions(+), 10 deletions(-)
- hw/core/reset.c            | 17 ++++++++++++++++-
- hw/hppa/machine.c          |  4 ++--
+diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
  hw/i386/microvm.c          |  4 ++--
  hw/i386/pc.c               |  6 +++---
  hw/ppc/pegasos2.c          |  4 ++--
  hw/ppc/pnv.c               |  4 ++--
  hw/ppc/spapr.c             |  4 ++--
  hw/s390x/s390-virtio-ccw.c |  4 ++--
  migration/savevm.c         |  2 +-
  softmmu/runstate.c         | 11 ++++++++---
 files changed, 54 insertions(+), 27 deletions(-)
 diff --git a/qapi/run-state.json b/qapi/run-state.json
 index XXXXXXX..XXXXXXX 100644
---- a/qapi/run-state.json
+--- a/hw/arm/smmuv3-internal.h
-+++ b/qapi/run-state.json
++++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef struct CD {
  #define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
  #define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
  #define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
 -#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
 -#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
 -#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
 +#define STE_S2ENDI(x)      extract32((x)->word[5], 20, 1)
 +#define STE_S2AFFD(x)      extract32((x)->word[5], 21, 1)
 +#define STE_S2HD(x)        extract32((x)->word[5], 23, 1)
 +#define STE_S2HA(x)        extract32((x)->word[5], 24, 1)
 +#define STE_S2S(x)         extract32((x)->word[5], 25, 1)
 +#define STE_S2R(x)         extract32((x)->word[5], 26, 1)
 +
  #define STE_CTXPTR(x)                                           \
      ({                                                          \
          unsigned long addr;                                     \
 diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/smmu-common.h
 +++ b/include/hw/arm/smmu-common.h
 @@ -XXX,XX +XXX,XX @@
- #                   ignores --no-reboot. This is useful for sanitizing
- #                   hypercalls on s390 that are used during kexec/kdump/boot
+ /* VMSAv8-64 Translation constants and functions */
- #
+ #define VMSA_LEVELS                         4
-+# @snapshot-load: A snapshot is being loaded by the record & replay
++#define VMSA_MAX_S2_CONCAT                  16
-+#                 subsystem. This value is used only within QEMU.  It
-+#                 doesn't occur in QMP. (since 7.2)
+ #define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
-+#
+ #define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
- ##
+diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
  { 'enum': 'ShutdownCause',
    # Beware, shutdown_caused_by_guest() depends on enumeration order
    'data': [ 'none', 'host-error', 'host-qmp-quit', 'host-qmp-system-reset',
              'host-signal', 'host-ui', 'guest-shutdown', 'guest-reset',
 -            'guest-panic', 'subsystem-reset'] }
 +            'guest-panic', 'subsystem-reset', 'snapshot-load'] }
  ##
  # @StatusInfo:
 diff --git a/include/hw/boards.h b/include/hw/boards.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
+--- a/include/hw/arm/smmuv3.h
-+++ b/include/hw/boards.h
++++ b/include/hw/arm/smmuv3.h
-@@ -XXX,XX +XXX,XX @@ struct MachineClass {
+@@ -XXX,XX +XXX,XX @@ struct SMMUv3Class {
-     const char *deprecation_reason;
+ #define TYPE_ARM_SMMUV3   "arm-smmuv3"
+ OBJECT_DECLARE_TYPE(SMMUv3State, SMMUv3Class, ARM_SMMUV3)
-     void (*init)(MachineState *state);
--    void (*reset)(MachineState *state);
++#define STAGE1_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S1P)
-+    void (*reset)(MachineState *state, ShutdownCause reason);
++#define STAGE2_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S2P)
-     void (*wakeup)(MachineState *state);
++
-     int (*kvm_type)(MachineState *machine, const char *arg);
+ #endif
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 diff --git a/include/sysemu/reset.h b/include/sysemu/reset.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/reset.h
+--- a/hw/arm/smmuv3.c
-+++ b/include/sysemu/reset.h
++++ b/hw/arm/smmuv3.c
 @@ -XXX,XX +XXX,XX @@
- #ifndef QEMU_SYSEMU_RESET_H
+ #include "smmuv3-internal.h"
- #define QEMU_SYSEMU_RESET_H
+ #include "smmu-internal.h"
-+#include "qapi/qapi-events-run-state.h"
++#define PTW_RECORD_FAULT(cfg)   (((cfg)->stage == 1) ? (cfg)->record_faults : \
-+
++                                 (cfg)->s2cfg.record_faults)
- typedef void QEMUResetHandler(void *opaque);
++
+ /**
- void qemu_register_reset(QEMUResetHandler *func, void *opaque);
+  * smmuv3_trigger_irq - pulse @irq if enabled and update
-+void qemu_register_reset_nosnapshotload(QEMUResetHandler *func, void *opaque);
+  * GERROR register in case of GERROR interrupt
- void qemu_unregister_reset(QEMUResetHandler *func, void *opaque);
+@@ -XXX,XX +XXX,XX @@ static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
--void qemu_devices_reset(void);
+     return 0;
 +void qemu_devices_reset(ShutdownCause reason);
  #endif
 diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/aspeed.c
 +++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_bletchley_class_init(ObjectClass *oc, void *data)
          aspeed_soc_num_cpus(amc->soc_name);
  }
--static void fby35_reset(MachineState *state)
++/*
-+static void fby35_reset(MachineState *state, ShutdownCause reason)
++ * Max valid value is 39 when SMMU_IDR3.STT == 0.
- {
++ * In architectures after SMMUv3.0:
-     AspeedMachineState *bmc = ASPEED_MACHINE(state);
++ * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this
-     AspeedGPIOState *gpio = &bmc->soc.gpio;
++ *   field is MAX(16, 64-IAS)
++ * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field
--    qemu_devices_reset();
++ *   is (64-IAS).
-+    qemu_devices_reset(reason);
++ * As we only support AA64, IAS = OAS.
++ */
-     /* Board ID: 7 (Class-1, 4 slots) */
++static bool s2t0sz_valid(SMMUTransCfg *cfg)
      object_property_set_bool(OBJECT(gpio), "gpioV4", true, &error_fatal);
 diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/mps2-tz.c
 +++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2_set_remap(Object *obj, const char *value, Error **errp)
      }
  }
 -static void mps2_machine_reset(MachineState *machine)
 +static void mps2_machine_reset(MachineState *machine, ShutdownCause reason)
  {
      MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
@@ -XXX,XX +XXX,XX @@ static void mps2_machine_reset(MachineState *machine)
       * reset see the correct mapping.
       */
      remap_memory(mms, mms->remap);
 -    qemu_devices_reset();
 +    qemu_devices_reset(reason);
  }
  static void mps2tz_class_init(ObjectClass *oc, void *data)
 diff --git a/hw/core/reset.c b/hw/core/reset.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/core/reset.c
 +++ b/hw/core/reset.c
@@ -XXX,XX +XXX,XX @@ typedef struct QEMUResetEntry {
      QTAILQ_ENTRY(QEMUResetEntry) entry;
      QEMUResetHandler *func;
      void *opaque;
 +    bool skip_on_snapshot_load;
  } QEMUResetEntry;
  static QTAILQ_HEAD(, QEMUResetEntry) reset_handlers =
@@ -XXX,XX +XXX,XX @@ void qemu_register_reset(QEMUResetHandler *func, void *opaque)
      QTAILQ_INSERT_TAIL(&reset_handlers, re, entry);
  }
 +void qemu_register_reset_nosnapshotload(QEMUResetHandler *func, void *opaque)
 +{
-+    QEMUResetEntry *re = g_new0(QEMUResetEntry, 1);
++    if (cfg->s2cfg.tsz > 39) {
-+
++        return false;
-+    re->func = func;
++    }
-+    re->opaque = opaque;
++
-+    re->skip_on_snapshot_load = true;
++    if (cfg->s2cfg.granule_sz == 16) {
-+    QTAILQ_INSERT_TAIL(&reset_handlers, re, entry);
++        return (cfg->s2cfg.tsz >= 64 - oas2bits(SMMU_IDR5_OAS));
 +    }
 +
 +    return (cfg->s2cfg.tsz >= MAX(64 - oas2bits(SMMU_IDR5_OAS), 16));
 +}
 +
- void qemu_unregister_reset(QEMUResetHandler *func, void *opaque)
++/*
- {
++ * Return true if s2 page table config is valid.
-     QEMUResetEntry *re;
++ * This checks with the configured start level, ias_bits and granularity we can
-@@ -XXX,XX +XXX,XX @@ void qemu_unregister_reset(QEMUResetHandler *func, void *opaque)
++ * have a valid page table as described in ARM ARM D8.2 Translation process.
-     }
++ * The idea here is to see for the highest possible number of IPA bits, how
- }
++ * many concatenated tables we would need, if it is more than 16, then this is
++ * not possible.
--void qemu_devices_reset(void)
++ */
-+void qemu_devices_reset(ShutdownCause reason)
++static bool s2_pgtable_config_valid(uint8_t sl0, uint8_t t0sz, uint8_t gran)
- {
++{
-     QEMUResetEntry *re, *nre;
++    int level = get_start_level(sl0, gran);
++    uint64_t ipa_bits = 64 - t0sz;
-     /* reset all devices */
++    uint64_t max_ipa = (1ULL << ipa_bits) - 1;
-     QTAILQ_FOREACH_SAFE(re, &reset_handlers, entry, nre) {
++    int nr_concat = pgd_concat_idx(level, gran, max_ipa) + 1;
-+        if (reason == SHUTDOWN_CAUSE_SNAPSHOT_LOAD &&
++
-+            re->skip_on_snapshot_load) {
++    return nr_concat <= VMSA_MAX_S2_CONCAT;
-+            continue;
++}
-+        }
++
-         re->func(re->opaque);
++static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
-     }
++{
- }
++    cfg->stage = 2;
-diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
++
-index XXXXXXX..XXXXXXX 100644
++    if (STE_S2AA64(ste) == 0x0) {
---- a/hw/hppa/machine.c
++        qemu_log_mask(LOG_UNIMP,
-+++ b/hw/hppa/machine.c
++                      "SMMUv3 AArch32 tables not supported\n");
-@@ -XXX,XX +XXX,XX @@ static void machine_hppa_init(MachineState *machine)
++        g_assert_not_reached();
-     cpu[0]->env.gr[19] = FW_CFG_IO_BASE;
++    }
- }
++
++    switch (STE_S2TG(ste)) {
--static void hppa_machine_reset(MachineState *ms)
++    case 0x0: /* 4KB */
-+static void hppa_machine_reset(MachineState *ms, ShutdownCause reason)
++        cfg->s2cfg.granule_sz = 12;
- {
++        break;
-     unsigned int smp_cpus = ms->smp.cpus;
++    case 0x1: /* 64KB */
-     int i;
++        cfg->s2cfg.granule_sz = 16;
++        break;
--    qemu_devices_reset();
++    case 0x2: /* 16KB */
-+    qemu_devices_reset(reason);
++        cfg->s2cfg.granule_sz = 14;
      /* Start all CPUs at the firmware entry point.
       *  Monarch CPU will initialize firmware, secondary CPUs
 diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/i386/microvm.c
 +++ b/hw/i386/microvm.c
@@ -XXX,XX +XXX,XX @@ static void microvm_machine_state_init(MachineState *machine)
      microvm_devices_init(mms);
  }
 -static void microvm_machine_reset(MachineState *machine)
 +static void microvm_machine_reset(MachineState *machine, ShutdownCause reason)
  {
      MicrovmMachineState *mms = MICROVM_MACHINE(machine);
      CPUState *cs;
@@ -XXX,XX +XXX,XX @@ static void microvm_machine_reset(MachineState *machine)
          mms->kernel_cmdline_fixed = true;
      }
 -    qemu_devices_reset();
 +    qemu_devices_reset(reason);
      CPU_FOREACH(cs) {
          cpu = X86_CPU(cs);
 diff --git a/hw/i386/pc.c b/hw/i386/pc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/i386/pc.c
 +++ b/hw/i386/pc.c
@@ -XXX,XX +XXX,XX @@ static void pc_machine_initfn(Object *obj)
      cxl_machine_init(obj, &pcms->cxl_devices_state);
  }
 -static void pc_machine_reset(MachineState *machine)
 +static void pc_machine_reset(MachineState *machine, ShutdownCause reason)
  {
      CPUState *cs;
      X86CPU *cpu;
 -    qemu_devices_reset();
 +    qemu_devices_reset(reason);
      /* Reset APIC after devices have been reset to cancel
       * any changes that qemu_devices_reset() might have done.
@@ -XXX,XX +XXX,XX @@ static void pc_machine_reset(MachineState *machine)
  static void pc_machine_wakeup(MachineState *machine)
  {
      cpu_synchronize_all_states();
 -    pc_machine_reset(machine);
 +    pc_machine_reset(machine, SHUTDOWN_CAUSE_NONE);
      cpu_synchronize_all_post_reset();
  }
 diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ppc/pegasos2.c
 +++ b/hw/ppc/pegasos2.c
@@ -XXX,XX +XXX,XX @@ static void pegasos2_pci_config_write(Pegasos2MachineState *pm, int bus,
      pegasos2_mv_reg_write(pm, pcicfg + 4, len, val);
  }
 -static void pegasos2_machine_reset(MachineState *machine)
 +static void pegasos2_machine_reset(MachineState *machine, ShutdownCause reason)
  {
      Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
      void *fdt;
      uint64_t d[2];
      int sz;
 -    qemu_devices_reset();
 +    qemu_devices_reset(reason);
      if (!pm->vof) {
          return; /* Firmware should set up machine so nothing to do */
      }
 diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ppc/pnv.c
 +++ b/hw/ppc/pnv.c
@@ -XXX,XX +XXX,XX @@ static void pnv_powerdown_notify(Notifier *n, void *opaque)
      }
  }
 -static void pnv_reset(MachineState *machine)
 +static void pnv_reset(MachineState *machine, ShutdownCause reason)
  {
      PnvMachineState *pnv = PNV_MACHINE(machine);
      IPMIBmc *bmc;
      void *fdt;
 -    qemu_devices_reset();
 +    qemu_devices_reset(reason);
      /*
       * The machine should provide by default an internal BMC simulator.
 diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ppc/spapr.c
 +++ b/hw/ppc/spapr.c
@@ -XXX,XX +XXX,XX @@ void spapr_check_mmu_mode(bool guest_radix)
      }
  }
 -static void spapr_machine_reset(MachineState *machine)
 +static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
  {
      SpaprMachineState *spapr = SPAPR_MACHINE(machine);
      PowerPCCPU *first_ppc_cpu;
@@ -XXX,XX +XXX,XX @@ static void spapr_machine_reset(MachineState *machine)
          spapr_setup_hpt(spapr);
      }
 -    qemu_devices_reset();
 +    qemu_devices_reset(reason);
      spapr_ovec_cleanup(spapr->ov5_cas);
      spapr->ov5_cas = spapr_ovec_new();
 diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/s390x/s390-virtio-ccw.c
 +++ b/hw/s390x/s390-virtio-ccw.c
@@ -XXX,XX +XXX,XX @@ static void s390_pv_prepare_reset(S390CcwMachineState *ms)
      s390_pv_prep_reset();
  }
 -static void s390_machine_reset(MachineState *machine)
 +static void s390_machine_reset(MachineState *machine, ShutdownCause reason)
  {
      S390CcwMachineState *ms = S390_CCW_MACHINE(machine);
      enum s390_reset reset_type;
@@ -XXX,XX +XXX,XX @@ static void s390_machine_reset(MachineState *machine)
              s390_machine_unprotect(ms);
          }
 -        qemu_devices_reset();
 +        qemu_devices_reset(reason);
          s390_crypto_reset();
          /* configure and start the ipl CPU only */
 diff --git a/migration/savevm.c b/migration/savevm.c
 index XXXXXXX..XXXXXXX 100644
 --- a/migration/savevm.c
 +++ b/migration/savevm.c
@@ -XXX,XX +XXX,XX @@ bool load_snapshot(const char *name, const char *vmstate,
          goto err_drain;
      }
 -    qemu_system_reset(SHUTDOWN_CAUSE_NONE);
 +    qemu_system_reset(SHUTDOWN_CAUSE_SNAPSHOT_LOAD);
      mis->from_src_file = f;
      if (!yank_register_instance(MIGRATION_YANK_INSTANCE, errp)) {
 diff --git a/softmmu/runstate.c b/softmmu/runstate.c
 index XXXXXXX..XXXXXXX 100644
 --- a/softmmu/runstate.c
 +++ b/softmmu/runstate.c
@@ -XXX,XX +XXX,XX @@ void qemu_system_reset(ShutdownCause reason)
      cpu_synchronize_all_states();
      if (mc && mc->reset) {
 -        mc->reset(current_machine);
 +        mc->reset(current_machine, reason);
      } else {
 -        qemu_devices_reset();
 +        qemu_devices_reset(reason);
      }
 -    if (reason && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
 +    switch (reason) {
 +    case SHUTDOWN_CAUSE_NONE:
 +    case SHUTDOWN_CAUSE_SUBSYSTEM_RESET:
 +    case SHUTDOWN_CAUSE_SNAPSHOT_LOAD:
 +        break;
 +    default:
-         qapi_event_send_reset(shutdown_caused_by_guest(reason), reason);
++        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste));
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.vttb = STE_S2TTB(ste);
 +
 +    cfg->s2cfg.sl0 = STE_S2SL0(ste);
 +    /* FEAT_TTST not supported. */
 +    if (cfg->s2cfg.sl0 == 0x3) {
 +        qemu_log_mask(LOG_UNIMP, "SMMUv3 S2SL0 = 0x3 has no meaning!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* For AA64, The effective S2PS size is capped to the OAS. */
 +    cfg->s2cfg.eff_ps = oas2bits(MIN(STE_S2PS(ste), SMMU_IDR5_OAS));
 +    /*
 +     * It is ILLEGAL for the address in S2TTB to be outside the range
 +     * described by the effective S2PS value.
 +     */
 +    if (cfg->s2cfg.vttb & ~(MAKE_64BIT_MASK(0, cfg->s2cfg.eff_ps))) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 S2TTB too large 0x%lx, effective PS %d bits\n",
 +                      cfg->s2cfg.vttb,  cfg->s2cfg.eff_ps);
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.tsz = STE_S2T0SZ(ste);
 +
 +    if (!s2t0sz_valid(cfg)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 bad STE S2T0SZ = %d\n",
 +                      cfg->s2cfg.tsz);
 +        goto bad_ste;
 +    }
 +
 +    if (!s2_pgtable_config_valid(cfg->s2cfg.sl0, cfg->s2cfg.tsz,
 +                                    cfg->s2cfg.granule_sz)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 STE stage 2 config not valid!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* Only LE supported(IDR0.TTENDIAN). */
 +    if (STE_S2ENDI(ste)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 STE_S2ENDI only supports LE!\n");
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.affd = STE_S2AFFD(ste);
 +
 +    cfg->s2cfg.record_faults = STE_S2R(ste);
 +    /* As stall is not supported. */
 +    if (STE_S2S(ste)) {
 +        qemu_log_mask(LOG_UNIMP, "SMMUv3 Stall not implemented!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* This is still here as stage 2 has not been fully enabled yet. */
 +    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
 +    goto bad_ste;
 +
 +    return 0;
 +
 +bad_ste:
 +    return -EINVAL;
 +}
 +
  /* Returns < 0 in case of invalid STE, 0 otherwise */
  static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
                        STE *ste, SMMUEventInfo *event)
  {
      uint32_t config;
 +    int ret;
      if (!STE_VALID(ste)) {
          if (!event->inval_ste_allowed) {
@@ -XXX,XX +XXX,XX @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
          return 0;
      }
-     cpu_synchronize_all_post_reset();
 -    if (STE_CFG_S2_ENABLED(config)) {
 -        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
 +    /*
 +     * If a stage is enabled in SW while not advertised, throw bad ste
 +     * according to user manual(IHI0070E) "5.2 Stream Table Entry".
 +     */
 +    if (!STAGE1_SUPPORTED(s) && STE_CFG_S1_ENABLED(config)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S1 used but not supported.\n");
          goto bad_ste;
      }
 +    if (!STAGE2_SUPPORTED(s) && STE_CFG_S2_ENABLED(config)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S2 used but not supported.\n");
 +        goto bad_ste;
 +    }
 +
 +    if (STAGE2_SUPPORTED(s)) {
 +        /* VMID is considered even if s2 is disabled. */
 +        cfg->s2cfg.vmid = STE_S2VMID(ste);
 +    } else {
 +        /* Default to -1 */
 +        cfg->s2cfg.vmid = -1;
 +    }
 +
 +    if (STE_CFG_S2_ENABLED(config)) {
 +        /*
 +         * Stage-1 OAS defaults to OAS even if not enabled as it would be used
 +         * in input address check for stage-2.
 +         */
 +        cfg->oas = oas2bits(SMMU_IDR5_OAS);
 +        ret = decode_ste_s2_cfg(cfg, ste);
 +        if (ret) {
 +            goto bad_ste;
 +        }
 +    }
      if (STE_S1CDMAX(ste) != 0) {
          qemu_log_mask(LOG_UNIMP,
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
      if (cached_entry) {
          if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
              status = SMMU_TRANS_ERROR;
 -            if (cfg->record_faults) {
 +            /*
 +             * We know that the TLB only contains either stage-1 or stage-2 as
 +             * nesting is not supported. So it is sufficient to check the
 +             * translation stage to know the TLB stage for now.
 +             */
 +            event.u.f_walk_eabt.s2 = (cfg->stage == 2);
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_PERMISSION;
                  event.u.f_permission.addr = addr;
                  event.u.f_permission.rnw = flag & 0x1;
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
              event.u.f_walk_eabt.addr2 = ptw_info.addr;
              break;
          case SMMU_PTW_ERR_TRANSLATION:
 -            if (cfg->record_faults) {
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_TRANSLATION;
                  event.u.f_translation.addr = addr;
                  event.u.f_translation.rnw = flag & 0x1;
              }
              break;
          case SMMU_PTW_ERR_ADDR_SIZE:
 -            if (cfg->record_faults) {
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_ADDR_SIZE;
                  event.u.f_addr_size.addr = addr;
                  event.u.f_addr_size.rnw = flag & 0x1;
              }
              break;
          case SMMU_PTW_ERR_ACCESS:
 -            if (cfg->record_faults) {
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_ACCESS;
                  event.u.f_access.addr = addr;
                  event.u.f_access.rnw = flag & 0x1;
              }
              break;
          case SMMU_PTW_ERR_PERMISSION:
 -            if (cfg->record_faults) {
 +            if (PTW_RECORD_FAULT(cfg)) {
                  event.type = SMMU_EVT_F_PERMISSION;
                  event.u.f_permission.addr = addr;
                  event.u.f_permission.rnw = flag & 0x1;
 --
-.25.1
+.34.1

-[PULL 20/30] target/arm: Use the max page size in a 2-stage ptw
+[PULL 07/21] hw/arm/smmuv3: Make TLB lookup work for stage-2
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-We had only been reporting the stage2 page size.  This causes
+Right now, either stage-1 or stage-2 are supported, this simplifies
-problems if stage1 is using a larger page size (16k, 2M, etc),
+how we can deal with TLBs.
-but stage2 is using a smaller page size, because cputlb does
+This patch makes TLB lookup work if stage-2 is enabled instead of
-not set large_page_{addr,mask} properly.
+stage-1.
 TLB lookup is done before a PTW, if a valid entry is found we won't
 do the PTW.
 To be able to do TLB lookup, we need the correct tagging info, as
 granularity and input size, so we get this based on the supported
 translation stage. The TLB entries are added correctly from each
 stage PTW.
-Fix by using the max of the two page sizes.
+When nested translation is supported, this would need to change, for
 example if we go with a combined TLB implementation, we would need to
 use the min of the granularities in TLB.
-Reported-by: Marc Zyngier <maz@kernel.org>
+As stage-2 shouldn't be tagged by ASID, it will be set to -1 if S1P
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+is not enabled.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20221024051851.3074715-15-richard.henderson@linaro.org
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-7-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/ptw.c | 11 ++++++++++-
+ hw/arm/smmuv3.c | 44 +++++++++++++++++++++++++++++++++-----------
-file changed, 10 insertions(+), 1 deletion(-)
+file changed, 33 insertions(+), 11 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
+--- a/hw/arm/smmuv3.c
-+++ b/target/arm/ptw.c
++++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
+@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
-                                    ARMMMUFaultInfo *fi)
+     STE ste;
- {
+     CD cd;
-     hwaddr ipa;
--    int s1_prot;
++    /* ASID defaults to -1 (if s1 is not supported). */
-+    int s1_prot, s1_lgpgsz;
++    cfg->asid = -1;
-     bool is_secure = ptw->in_secure;
++
-     bool ret, ipa_secure, s2walk_secure;
+     ret = smmu_find_ste(s, sid, &ste, event);
-     ARMCacheAttrs cacheattrs1;
+     if (ret) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
       * Save the stage1 results so that we may merge prot and cacheattrs later.
       */
      s1_prot = result->f.prot;
 +    s1_lgpgsz = result->f.lg_page_size;
      cacheattrs1 = result->cacheattrs;
      memset(result, 0, sizeof(*result));
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
          return ret;
+@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
+         .addr_mask = ~(hwaddr)0,
+         .perm = IOMMU_NONE,
+     };
++    /*
++     * Combined attributes used for TLB lookup, as only one stage is supported,
++     * it will hold attributes based on the enabled stage.
++     */
++    SMMUTransTableInfo tt_combined;
+     qemu_mutex_lock(&s->mutex);
+@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
+         goto epilogue;
      }
+-    tt = select_tt(cfg, addr);
+-    if (!tt) {
+-        if (cfg->record_faults) {
+-            event.type = SMMU_EVT_F_TRANSLATION;
+-            event.u.f_translation.addr = addr;
+-            event.u.f_translation.rnw = flag & 0x1;
++    if (cfg->stage == 1) {
++        /* Select stage1 translation table. */
++        tt = select_tt(cfg, addr);
++        if (!tt) {
++            if (cfg->record_faults) {
++                event.type = SMMU_EVT_F_TRANSLATION;
++                event.u.f_translation.addr = addr;
++                event.u.f_translation.rnw = flag & 0x1;
++            }
++            status = SMMU_TRANS_ERROR;
++            goto epilogue;
+         }
+-        status = SMMU_TRANS_ERROR;
+-        goto epilogue;
+-    }
++        tt_combined.granule_sz = tt->granule_sz;
++        tt_combined.tsz = tt->tsz;
+-    page_mask = (1ULL << (tt->granule_sz)) - 1;
++    } else {
++        /* Stage2. */
++        tt_combined.granule_sz = cfg->s2cfg.granule_sz;
++        tt_combined.tsz = cfg->s2cfg.tsz;
++    }
 +    /*
-+     * Use the maximum of the S1 & S2 page size, so that invalidation
++     * TLB lookup looks for granule and input size for a translation stage,
-+     * of pages > TARGET_PAGE_SIZE works correctly.
++     * as only one stage is supported right now, choose the right values
 +     * from the configuration.
 +     */
-+    if (result->f.lg_page_size < s1_lgpgsz) {
++    page_mask = (1ULL << tt_combined.granule_sz) - 1;
-+        result->f.lg_page_size = s1_lgpgsz;
+     aligned_addr = addr & ~page_mask;
-+    }
-+
+-    cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr);
-     /* Combine the S1 and S2 cache attributes. */
++    cached_entry = smmu_iotlb_lookup(bs, cfg, &tt_combined, aligned_addr);
-     hcr = arm_hcr_el2_eff_secstate(env, is_secure);
+     if (cached_entry) {
-     if (hcr & HCR_DC) {
+         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
              status = SMMU_TRANS_ERROR;
 --
-.25.1
+.34.1

-[PULL 25/30] riscv: re-randomize rng-seed on reboot
+[PULL 08/21] hw/arm/smmuv3: Add VMID to TLB tagging
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Mostafa Saleh <smostafa@google.com>
-When the system reboots, the rng-seed that the FDT has should be
+Allow TLB to be tagged with VMID.
-re-randomized, so that the new boot gets a new seed. Since the FDT is in
-the ROM region at this point, we add a hook right after the ROM has been
+If stage-1 is only supported, VMID is set to -1 and ignored from STE
-added, so that we have a pointer to that copy of the FDT.
+and CMD_TLBI_NH* cmds.
-Cc: Palmer Dabbelt <palmer@dabbelt.com>
+Update smmu_iotlb_insert trace event to have vmid.
-Cc: Alistair Francis <alistair.francis@wdc.com>
-Cc: Bin Meng <bin.meng@windriver.com>
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
-Cc: qemu-riscv@nongnu.org
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Tested-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Message-id: 20221025004327.568476-6-Jason@zx2c4.com
+Message-id: 20230516203327.2051088-8-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/riscv/boot.c | 3 +++
+ hw/arm/smmu-internal.h       |  2 ++
-file changed, 3 insertions(+)
+ include/hw/arm/smmu-common.h |  5 +++--
+ hw/arm/smmu-common.c         | 36 ++++++++++++++++++++++--------------
-diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
+ hw/arm/smmuv3.c              | 12 +++++++++---
-index XXXXXXX..XXXXXXX 100644
+ hw/arm/trace-events          |  6 +++---
---- a/hw/riscv/boot.c
+files changed, 39 insertions(+), 22 deletions(-)
-+++ b/hw/riscv/boot.c
-@@ -XXX,XX +XXX,XX @@
+diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
- #include "sysemu/device_tree.h"
+index XXXXXXX..XXXXXXX 100644
- #include "sysemu/qtest.h"
+--- a/hw/arm/smmu-internal.h
- #include "sysemu/kvm.h"
++++ b/hw/arm/smmu-internal.h
-+#include "sysemu/reset.h"
+@@ -XXX,XX +XXX,XX @@ static inline int pgd_concat_idx(int start_level, int granule_sz,
+ }
- #include <libfdt.h>
+ #define SMMU_IOTLB_ASID(key) ((key).asid)
-@@ -XXX,XX +XXX,XX @@ uint64_t riscv_load_fdt(hwaddr dram_base, uint64_t mem_size, void *fdt)
++#define SMMU_IOTLB_VMID(key) ((key).vmid)
-     rom_add_blob_fixed_as("fdt", fdt, fdtsize, fdt_addr,
+ typedef struct SMMUIOTLBPageInvInfo {
-                           &address_space_memory);
+     int asid;
-+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
++    int vmid;
-+                        rom_ptr_for_as(&address_space_memory, fdt_addr, fdtsize));
+     uint64_t iova;
+     uint64_t mask;
-     return fdt_addr;
+ } SMMUIOTLBPageInvInfo;
- }
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/smmu-common.h
 +++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUPciBus {
  typedef struct SMMUIOTLBKey {
      uint64_t iova;
      uint16_t asid;
 +    uint16_t vmid;
      uint8_t tg;
      uint8_t level;
  } SMMUIOTLBKey;
@@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid);
  SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
                                  SMMUTransTableInfo *tt, hwaddr iova);
  void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *entry);
 -SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
 +SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                  uint8_t tg, uint8_t level);
  void smmu_iotlb_inv_all(SMMUState *s);
  void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
 -void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
 +void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                           uint8_t tg, uint64_t num_pages, uint8_t ttl);
  /* Unmap the range of all the notifiers registered to any IOMMU mr */
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static guint smmu_iotlb_key_hash(gconstpointer v)
      /* Jenkins hash */
      a = b = c = JHASH_INITVAL + sizeof(*key);
 -    a += key->asid + key->level + key->tg;
 +    a += key->asid + key->vmid + key->level + key->tg;
      b += extract64(key->iova, 0, 32);
      c += extract64(key->iova, 32, 32);
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
      SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2;
      return (k1->asid == k2->asid) && (k1->iova == k2->iova) &&
 -           (k1->level == k2->level) && (k1->tg == k2->tg);
 +           (k1->level == k2->level) && (k1->tg == k2->tg) &&
 +           (k1->vmid == k2->vmid);
  }
 -SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
 +SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                  uint8_t tg, uint8_t level)
  {
 -    SMMUIOTLBKey key = {.asid = asid, .iova = iova, .tg = tg, .level = level};
 +    SMMUIOTLBKey key = {.asid = asid, .vmid = vmid, .iova = iova,
 +                        .tg = tg, .level = level};
      return key;
  }
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
          uint64_t mask = subpage_size - 1;
          SMMUIOTLBKey key;
 -        key = smmu_get_iotlb_key(cfg->asid, iova & ~mask, tg, level);
 +        key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid,
 +                                 iova & ~mask, tg, level);
          entry = g_hash_table_lookup(bs->iotlb, &key);
          if (entry) {
              break;
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
      if (entry) {
          cfg->iotlb_hits++;
 -        trace_smmu_iotlb_lookup_hit(cfg->asid, iova,
 +        trace_smmu_iotlb_lookup_hit(cfg->asid, cfg->s2cfg.vmid, iova,
                                      cfg->iotlb_hits, cfg->iotlb_misses,
 * cfg->iotlb_hits /
                                      (cfg->iotlb_hits + cfg->iotlb_misses));
      } else {
          cfg->iotlb_misses++;
 -        trace_smmu_iotlb_lookup_miss(cfg->asid, iova,
 +        trace_smmu_iotlb_lookup_miss(cfg->asid, cfg->s2cfg.vmid, iova,
                                       cfg->iotlb_hits, cfg->iotlb_misses,
 * cfg->iotlb_hits /
                                       (cfg->iotlb_hits + cfg->iotlb_misses));
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new)
          smmu_iotlb_inv_all(bs);
      }
 -    *key = smmu_get_iotlb_key(cfg->asid, new->entry.iova, tg, new->level);
 -    trace_smmu_iotlb_insert(cfg->asid, new->entry.iova, tg, new->level);
 +    *key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
 +                              tg, new->level);
 +    trace_smmu_iotlb_insert(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
 +                            tg, new->level);
      g_hash_table_insert(bs->iotlb, key, new);
  }
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
      return SMMU_IOTLB_ASID(*iotlb_key) == asid;
  }
 -
 -static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
 +static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                                gpointer user_data)
  {
      SMMUTLBEntry *iter = (SMMUTLBEntry *)value;
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
      if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) {
          return false;
      }
 +    if (info->vmid >= 0 && info->vmid != SMMU_IOTLB_VMID(iotlb_key)) {
 +        return false;
 +    }
      return ((info->iova & ~entry->addr_mask) == entry->iova) ||
             ((entry->iova & ~info->mask) == info->iova);
  }
 -void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
 +void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                           uint8_t tg, uint64_t num_pages, uint8_t ttl)
  {
      /* if tg is not set we use 4KB range invalidation */
      uint8_t granule = tg ? tg * 2 + 10 : 12;
      if (ttl && (num_pages == 1) && (asid >= 0)) {
 -        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
 +        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, iova, tg, ttl);
          if (g_hash_table_remove(s->iotlb, &key)) {
              return;
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
      SMMUIOTLBPageInvInfo info = {
          .asid = asid, .iova = iova,
 +        .vmid = vmid,
          .mask = (num_pages * 1 << granule) - 1};
      g_hash_table_foreach_remove(s->iotlb,
 -                                smmu_hash_remove_by_asid_iova,
 +                                smmu_hash_remove_by_asid_vmid_iova,
                                  &info);
  }
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
  {
      dma_addr_t end, addr = CMD_ADDR(cmd);
      uint8_t type = CMD_TYPE(cmd);
 -    uint16_t vmid = CMD_VMID(cmd);
 +    int vmid = -1;
      uint8_t scale = CMD_SCALE(cmd);
      uint8_t num = CMD_NUM(cmd);
      uint8_t ttl = CMD_TTL(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
      uint64_t num_pages;
      uint8_t granule;
      int asid = -1;
 +    SMMUv3State *smmuv3 = ARM_SMMUV3(s);
 +
 +    /* Only consider VMID if stage-2 is supported. */
 +    if (STAGE2_SUPPORTED(smmuv3)) {
 +        vmid = CMD_VMID(cmd);
 +    }
      if (type == SMMU_CMD_TLBI_NH_VA) {
          asid = CMD_ASID(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
      if (!tg) {
          trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
          smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
 -        smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl);
 +        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
          num_pages = (mask + 1) >> granule;
          trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
          smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
 -        smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
 +        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
          addr += mask + 1;
      }
  }
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_iotlb_inv_all(void) "IOTLB invalidate all"
  smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
  smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
  smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
 -smmu_iotlb_lookup_hit(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 -smmu_iotlb_lookup_miss(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 -smmu_iotlb_insert(uint16_t asid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d addr=0x%"PRIx64" tg=%d level=%d"
 +smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 +smmu_iotlb_lookup_miss(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 +smmu_iotlb_insert(uint16_t asid, uint16_t vmid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d vmid=%d addr=0x%"PRIx64" tg=%d level=%d"
  # smmuv3.c
  smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
 --
-.25.1
+.34.1

-[PULL 01/30] target/arm: Implement FEAT_E0PD
+[PULL 09/21] hw/arm/smmuv3: Add CMDs related to stage-2
-FEAT_E0PD adds new bits E0PD0 and E0PD1 to TCR_EL1, which allow the
+From: Mostafa Saleh <smostafa@google.com>
-OS to forbid EL0 access to half of the address space.  Since this is
-an EL0-specific variation on the existing TCR_ELx.{EPD0,EPD1}, we can
+CMD_TLBI_S2_IPA: As S1+S2 is not enabled, for now this can be the
-implement it entirely in aa64_va_parameters().
+same as CMD_TLBI_NH_VAA.
-This requires moving the existing regime_is_user() to internals.h
+CMD_TLBI_S12_VMALL: Added new function to invalidate TLB by VMID.
-so that the code in helper.c can get at it.
+For stage-1 only commands, add a check to throw CERROR_ILL if used
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+when stage-1 is not supported.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-9-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20221021160131.3531787-1-peter.maydell@linaro.org
 ---
- docs/system/arm/emulation.rst |  1 +
+ include/hw/arm/smmu-common.h |  1 +
- target/arm/cpu.h              |  5 +++++
+ hw/arm/smmu-common.c         | 16 +++++++++++
- target/arm/internals.h        | 19 +++++++++++++++++++
+ hw/arm/smmuv3.c              | 55 ++++++++++++++++++++++++++++++------
- target/arm/cpu64.c            |  1 +
+ hw/arm/trace-events          |  4 ++-
- target/arm/helper.c           |  9 +++++++++
+files changed, 67 insertions(+), 9 deletions(-)
- target/arm/ptw.c              | 19 -------------------
-files changed, 35 insertions(+), 19 deletions(-)
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
+index XXXXXXX..XXXXXXX 100644
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
+--- a/include/hw/arm/smmu-common.h
-index XXXXXXX..XXXXXXX 100644
++++ b/include/hw/arm/smmu-common.h
---- a/docs/system/arm/emulation.rst
+@@ -XXX,XX +XXX,XX @@ SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
-+++ b/docs/system/arm/emulation.rst
+                                 uint8_t tg, uint8_t level);
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
+ void smmu_iotlb_inv_all(SMMUState *s);
- - FEAT_Debugv8p4 (Debug changes for v8.4)
+ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
- - FEAT_DotProd (Advanced SIMD dot product instructions)
++void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid);
- - FEAT_DoubleFault (Double Fault Extension)
+ void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
-+- FEAT_E0PD (Preventing EL0 access to halves of address maps)
+                          uint8_t tg, uint64_t num_pages, uint8_t ttl);
- - FEAT_ETS (Enhanced Translation Synchronization)
- - FEAT_FCMA (Floating-point complex number instructions)
+diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
- - FEAT_FHM (Floating-point half-precision multiplication instructions)
+index XXXXXXX..XXXXXXX 100644
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+--- a/hw/arm/smmu-common.c
-index XXXXXXX..XXXXXXX 100644
++++ b/hw/arm/smmu-common.c
---- a/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_lva(const ARMISARegisters *id)
+     return SMMU_IOTLB_ASID(*iotlb_key) == asid;
      return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, VARANGE) != 0;
  }
++
-+static inline bool isar_feature_aa64_e0pd(const ARMISARegisters *id)
++static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value,
 +                                         gpointer user_data)
 +{
-+    return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, E0PD) != 0;
++    uint16_t vmid = *(uint16_t *)user_data;
 +    SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;
 +
 +    return SMMU_IOTLB_VMID(*iotlb_key) == vmid;
 +}
 +
- static inline bool isar_feature_aa64_tts2uxn(const ARMISARegisters *id)
+ static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                                gpointer user_data)
  {
-     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, XNX) != 0;
+@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+     g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
-index XXXXXXX..XXXXXXX 100644
+ }
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
++inline void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid)
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
++{
 +    trace_smmu_iotlb_inv_vmid(vmid);
 +    g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid);
 +}
 +
  /* VMSAv8-64 Translation */
  /**
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
      }
  }
-+static inline bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
+-static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
-+{
++static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 +    switch (mmu_idx) {
 +    case ARMMMUIdx_E20_0:
 +    case ARMMMUIdx_Stage1_E0:
 +    case ARMMMUIdx_MUser:
 +    case ARMMMUIdx_MSUser:
 +    case ARMMMUIdx_MUserNegPri:
 +    case ARMMMUIdx_MSUserNegPri:
 +        return true;
 +    default:
 +        return false;
 +    case ARMMMUIdx_E10_0:
 +    case ARMMMUIdx_E10_1:
 +    case ARMMMUIdx_E10_1_PAN:
 +        g_assert_not_reached();
 +    }
 +}
 +
  /* Return the SCTLR value which controls this address translation regime */
  static inline uint64_t regime_sctlr(CPUARMState *env, ARMMMUIdx mmu_idx)
  {
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+     dma_addr_t end, addr = CMD_ADDR(cmd);
-index XXXXXXX..XXXXXXX 100644
+     uint8_t type = CMD_TYPE(cmd);
---- a/target/arm/cpu64.c
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
-+++ b/target/arm/cpu64.c
+     }
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
-     t = FIELD_DP64(t, ID_AA64MMFR2, FWB, 1);      /* FEAT_S2FWB */
+     if (!tg) {
-     t = FIELD_DP64(t, ID_AA64MMFR2, TTL, 1);      /* FEAT_TTL */
+-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
-     t = FIELD_DP64(t, ID_AA64MMFR2, BBM, 2);      /* FEAT_BBM at level 2 */
++        trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
-+    t = FIELD_DP64(t, ID_AA64MMFR2, E0PD, 1);     /* FEAT_E0PD */
+         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
-     cpu->isar.id_aa64mmfr2 = t;
+         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
+         return;
-     t = cpu->isar.id_aa64zfr0;
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+         uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+         num_pages = (mask + 1) >> granule;
-+++ b/target/arm/helper.c
+-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
++        trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-         ps = extract32(tcr, 16, 3);
+         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
-         ds = extract64(tcr, 32, 1);
+         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
-     } else {
+         addr += mask + 1;
-+        bool e0pd;
+@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
-+
+         {
              uint16_t asid = CMD_ASID(&cmd);
 +            if (!STAGE1_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +
              trace_smmuv3_cmdq_tlbi_nh_asid(asid);
              smmu_inv_notifiers_all(&s->smmu_state);
              smmu_iotlb_inv_asid(bs, asid);
              break;
          }
          case SMMU_CMD_TLBI_NH_ALL:
 +            if (!STAGE1_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            QEMU_FALLTHROUGH;
          case SMMU_CMD_TLBI_NSNH_ALL:
              trace_smmuv3_cmdq_tlbi_nh();
              smmu_inv_notifiers_all(&s->smmu_state);
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
              break;
          case SMMU_CMD_TLBI_NH_VAA:
          case SMMU_CMD_TLBI_NH_VA:
 -            smmuv3_s1_range_inval(bs, &cmd);
 +            if (!STAGE1_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            smmuv3_range_inval(bs, &cmd);
 +            break;
 +        case SMMU_CMD_TLBI_S12_VMALL:
 +        {
 +            uint16_t vmid = CMD_VMID(&cmd);
 +
 +            if (!STAGE2_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +
 +            trace_smmuv3_cmdq_tlbi_s12_vmid(vmid);
 +            smmu_inv_notifiers_all(&s->smmu_state);
 +            smmu_iotlb_inv_vmid(bs, vmid);
 +            break;
 +        }
 +        case SMMU_CMD_TLBI_S2_IPA:
 +            if (!STAGE2_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            /*
 +             * As currently only either s1 or s2 are supported
 +             * we can reuse same function for s2.
 +             */
 +            smmuv3_range_inval(bs, &cmd);
              break;
          case SMMU_CMD_TLBI_EL3_ALL:
          case SMMU_CMD_TLBI_EL3_VA:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
          case SMMU_CMD_TLBI_EL2_ASID:
          case SMMU_CMD_TLBI_EL2_VA:
          case SMMU_CMD_TLBI_EL2_VAA:
 -        case SMMU_CMD_TLBI_S12_VMALL:
 -        case SMMU_CMD_TLBI_S2_IPA:
          case SMMU_CMD_ATC_INV:
          case SMMU_CMD_PRI_RESP:
          case SMMU_CMD_RESUME:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
              break;
          default:
              cmd_error = SMMU_CERROR_ILL;
 -            qemu_log_mask(LOG_GUEST_ERROR,
 -                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
              break;
          }
          qemu_mutex_unlock(&s->mutex);
          if (cmd_error) {
 +            if (cmd_error == SMMU_CERROR_ILL) {
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "Illegal command type: %d\n", CMD_TYPE(&cmd));
 +            }
              break;
          }
          /*
-          * Bit 55 is always between the two regions, and is canonical for
+diff --git a/hw/arm/trace-events b/hw/arm/trace-events
-          * determining if address tagging is enabled.
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
+--- a/hw/arm/trace-events
-             epd = extract32(tcr, 7, 1);
++++ b/hw/arm/trace-events
-             sh = extract32(tcr, 12, 2);
+@@ -XXX,XX +XXX,XX @@ smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, ui
-             hpd = extract64(tcr, 41, 1);
+ smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
-+            e0pd = extract64(tcr, 55, 1);
+ smmu_iotlb_inv_all(void) "IOTLB invalidate all"
-         } else {
+ smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
-             tsz = extract32(tcr, 16, 6);
++smmu_iotlb_inv_vmid(uint16_t vmid) "IOTLB invalidate vmid=%d"
-             gran = tg1_to_gran_size(extract32(tcr, 30, 2));
+ smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
-             epd = extract32(tcr, 23, 1);
+ smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
-             sh = extract32(tcr, 28, 2);
+ smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-             hpd = extract64(tcr, 42, 1);
+@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_cfgi_ste_range(int start, int end) "start=0x%x - end=0x%x"
-+            e0pd = extract64(tcr, 56, 1);
+ smmuv3_cmdq_cfgi_cd(uint32_t sid) "sid=0x%x"
-         }
+ smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
-         ps = extract64(tcr, 32, 3);
+ smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
-         ds = extract64(tcr, 59, 1);
+-smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
-+
++smmuv3_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
-+        if (e0pd && cpu_isar_feature(aa64_e0pd, cpu) &&
+ smmuv3_cmdq_tlbi_nh(void) ""
-+            regime_is_user(env, mmu_idx)) {
+ smmuv3_cmdq_tlbi_nh_asid(uint16_t asid) "asid=%d"
-+            epd = true;
++smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
-+        }
+ smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
-     }
+ smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
+ smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
      gran = sanitize_gran_size(cpu, gran, stage2);
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool regime_translation_big_endian(CPUARMState *env, ARMMMUIdx mmu_idx)
      return (regime_sctlr(env, mmu_idx) & SCTLR_EE) != 0;
  }
 -static bool regime_is_user(CPUARMState *env, ARMMMUIdx mmu_idx)
 -{
 -    switch (mmu_idx) {
 -    case ARMMMUIdx_E20_0:
 -    case ARMMMUIdx_Stage1_E0:
 -    case ARMMMUIdx_MUser:
 -    case ARMMMUIdx_MSUser:
 -    case ARMMMUIdx_MUserNegPri:
 -    case ARMMMUIdx_MSUserNegPri:
 -        return true;
 -    default:
 -        return false;
 -    case ARMMMUIdx_E10_0:
 -    case ARMMMUIdx_E10_1:
 -    case ARMMMUIdx_E10_1_PAN:
 -        g_assert_not_reached();
 -    }
 -}
 -
  /* Return the TTBR associated with this translation regime */
  static uint64_t regime_ttbr(CPUARMState *env, ARMMMUIdx mmu_idx, int ttbrn)
  {
 --
-.25.1
+.34.1

-[PULL 02/30] hw/arm/virt: Fix devicetree warnings about the virtio-iommu node
+Deleted patch
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
-The "PCI Bus Binding to: IEEE Std 1275-1994" defines the compatible
-string for a PCIe bus or endpoint as "pci<vendorid>,<deviceid>" or
-similar. Since the initial binding for PCI virtio-iommu didn't follow
-this rule, it was modified to accept both strings and ensure backward
-compatibility. Also, the unit-name for the node should be
-"device,function".
-Fix corresponding dt-validate and dtc warnings:
-  pcie@10000000: virtio_iommu@16:compatible: ['virtio,pci-iommu'] does not contain items matching the given schema
-  pcie@10000000: Unevaluated properties are not allowed (... 'virtio_iommu@16' were unexpected)
-  From schema: linux/Documentation/devicetree/bindings/pci/host-generic-pci.yaml
-  virtio_iommu@16: compatible: 'oneOf' conditional failed, one must be fixed:
-        ['virtio,pci-iommu'] is too short
-        'pci1af4,1057' was expected
-  From schema: dtschema/schemas/pci/pci-bus.yaml
-  Warning (pci_device_reg): /pcie@10000000/virtio_iommu@16: PCI unit address format error, expected "2,0"
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/virt.c | 5 +++--
-file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
-+++ b/hw/arm/virt.c
-@@ -XXX,XX +XXX,XX @@ static void create_smmu(const VirtMachineState *vms,
- static void create_virtio_iommu_dt_bindings(VirtMachineState *vms)
- {
--    const char compat[] = "virtio,pci-iommu";
-+    const char compat[] = "virtio,pci-iommu\0pci1af4,1057";
-     uint16_t bdf = vms->virtio_iommu_bdf;
-     MachineState *ms = MACHINE(vms);
-     char *node;
-     vms->iommu_phandle = qemu_fdt_alloc_phandle(ms->fdt);
--    node = g_strdup_printf("%s/virtio_iommu@%d", vms->pciehb_nodename, bdf);
-+    node = g_strdup_printf("%s/virtio_iommu@%x,%x", vms->pciehb_nodename,
-+                           PCI_SLOT(bdf), PCI_FUNC(bdf));
-     qemu_fdt_add_subnode(ms->fdt, node);
-     qemu_fdt_setprop(ms->fdt, node, "compatible", compat, sizeof(compat));
-     qemu_fdt_setprop_sized_cells(ms->fdt, node, "reg",
---
-.25.1

-[PULL 03/30] target/arm: honor HCR_E2H and HCR_TGE in arm_excp_unmasked()
+Deleted patch
-From: Ake Koomsin <ake@igel.co.jp>
-An exception targeting EL2 from lower EL is actually maskable when
-HCR_E2H and HCR_TGE are both set. This applies to both secure and
-non-secure Security state.
-We can remove the conditions that try to suppress masking of
-interrupts when we are Secure and the exception targets EL2 and
-Secure EL2 is disabled.  This is OK because in that situation
-arm_phys_excp_target_el() will never return 2 as the target EL.  The
-'not if secure' check in this function was originally written before
-arm_hcr_el2_eff(), and back then the target EL returned by
-arm_phys_excp_target_el() could be 2 even if we were in Secure
-EL0/EL1; but it is no longer needed.
-Signed-off-by: Ake Koomsin <ake@igel.co.jp>
-Message-id: 20221017092432.546881-1-ake@igel.co.jp
-[PMM: Add commit message paragraph explaining why it's OK to
- remove the checks on secure and SCR_EEL2]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.c | 24 +++++++++++++++++-------
-file changed, 17 insertions(+), 7 deletions(-)
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
-     if ((target_el > cur_el) && (target_el != 1)) {
-         /* Exceptions targeting a higher EL may not be maskable */
-         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
--            /*
--             * 64-bit masking rules are simple: exceptions to EL3
--             * can't be masked, and exceptions to EL2 can only be
--             * masked from Secure state. The HCR and SCR settings
--             * don't affect the masking logic, only the interrupt routing.
--             */
--            if (target_el == 3 || !secure || (env->cp15.scr_el3 & SCR_EEL2)) {
-+            switch (target_el) {
-+            case 2:
-+                /*
-+                 * According to ARM DDI 0487H.a, an interrupt can be masked
-+                 * when HCR_E2H and HCR_TGE are both set regardless of the
-+                 * current Security state. Note that we need to revisit this
-+                 * part again once we need to support NMI.
-+                 */
-+                if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
-+                        unmasked = true;
-+                }
-+                break;
-+            case 3:
-+                /* Interrupt cannot be masked when the target EL is 3 */
-                 unmasked = true;
-+                break;
-+            default:
-+                g_assert_not_reached();
-             }
-         } else {
-             /*
---
-.25.1

-[PULL 04/30] hw/core/resettable: fix reset level counting
+Deleted patch
-From: Damien Hedde <damien.hedde@greensocs.com>
-The code for handling the reset level count in the Resettable code
-has two issues:
-The reset count is only decremented for the 1->0 case.  This means
-that if there's ever a nested reset that takes the count to 2 then it
-will never again be decremented.  Eventually the count will exceed
-the '50' limit in resettable_phase_enter() and QEMU will trip over
-the assertion failure.  The repro case in issue 1266 is an example of
-this that happens now the SCSI subsystem uses three-phase reset.
-Secondly, the count is decremented only after the exit phase handler
-is called.  Moving the reset count decrement from "just after" to
-"just before" calling the exit phase handler allows
-resettable_is_in_reset() to return false during the handler
-execution.
-This simplifies reset handling in resettable devices.  Typically, a
-function that updates the device state will just need to read the
-current reset state and not anymore treat the "in a reset-exit
-transition" as a special case.
-Note that the semantics change to the *_is_in_reset() functions
-will have no effect on the current codebase, because only two
-devices (hw/char/cadence_uart.c and hw/misc/zynq_sclr.c) currently
-call those functions, and in neither case do they do it from the
-device's exit phase methed.
-Fixes: 4a5fc890 ("scsi: Use device_cold_reset() and bus_cold_reset()")
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1266
-Signed-off-by: Damien Hedde <damien.hedde@greensocs.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reported-by: Michael Peter <michael.peter@hensoldt-cyber.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20221020142749.3357951-1-peter.maydell@linaro.org
-Buglink: https://bugs.launchpad.net/qemu/+bug/1905297
-Reported-by: Michael Peter <michael.peter@hensoldt-cyber.com>
-[PMM: adjust the docs paragraph changed to get the name of the
- 'enter' phase right and to clarify exactly when the count is
- adjusted; rewrite the commit message]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/devel/reset.rst | 8 +++++---
- hw/core/resettable.c | 3 +--
-files changed, 6 insertions(+), 5 deletions(-)
-diff --git a/docs/devel/reset.rst b/docs/devel/reset.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/devel/reset.rst
-+++ b/docs/devel/reset.rst
-@@ -XXX,XX +XXX,XX @@ Polling the reset state
- Resettable interface provides the ``resettable_is_in_reset()`` function.
- This function returns true if the object parameter is currently under reset.
--An object is under reset from the beginning of the *init* phase to the end of
--the *exit* phase. During all three phases, the function will return that the
--object is in reset.
-+An object is under reset from the beginning of the *enter* phase (before
-+either its children or its own enter method is called) to the *exit*
-+phase. During *enter* and *hold* phase only, the function will return that the
-+object is in reset. The state is changed after the *exit* is propagated to
-+its children and just before calling the object's own *exit* method.
- This function may be used if the object behavior has to be adapted
- while in reset state. For example if a device has an irq input,
-diff --git a/hw/core/resettable.c b/hw/core/resettable.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/core/resettable.c
-+++ b/hw/core/resettable.c
-@@ -XXX,XX +XXX,XX @@ static void resettable_phase_exit(Object *obj, void *opaque, ResetType type)
-     resettable_child_foreach(rc, obj, resettable_phase_exit, NULL, type);
-     assert(s->count > 0);
--    if (s->count == 1) {
-+    if (--s->count == 0) {
-         trace_resettable_phase_exit_exec(obj, obj_typename, !!rc->phases.exit);
-         if (rc->phases.exit && !resettable_get_tr_func(rc, obj)) {
-             rc->phases.exit(obj);
-         }
--        s->count = 0;
-     }
-     s->exit_phase_in_progress = false;
-     trace_resettable_phase_exit_end(obj, obj_typename, s->count);
---
-.25.1

-[PULL 05/30] hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset()
+Deleted patch
-The semantic difference between the deprecated device_legacy_reset()
-function and the newer device_cold_reset() function is that the new
-function resets both the device itself and any qbuses it owns,
-whereas the legacy function resets just the device itself and nothing
-else.  In hyperv_synic_reset() we reset a SynICState, which has no
-qbuses, so for this purpose the two functions behave identically and
-we can stop using the deprecated one.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
-Message-id: 20221013171817.1447562-1-peter.maydell@linaro.org
----
- hw/hyperv/hyperv.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/hyperv/hyperv.c
-+++ b/hw/hyperv/hyperv.c
-@@ -XXX,XX +XXX,XX @@ void hyperv_synic_reset(CPUState *cs)
-     SynICState *synic = get_synic(cs);
-     if (synic) {
--        device_legacy_reset(DEVICE(synic));
-+        device_cold_reset(DEVICE(synic));
-     }
- }
---
-.25.1

-[PULL 06/30] target/imx: reload cmp timer outside of the reload ptimer transaction
+Deleted patch
-From: Axel Heider <axel.heider@hensoldt.net>
-When running seL4 tests (https://docs.sel4.systems/projects/sel4test)
-on the sabrelight platform, the timer tests fail. The arm/imx6 EPIT
-timer interrupt does not fire properly, instead of a e.g. second in
-can take up to a minute to finally see the interrupt.
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1263
-Signed-off-by: Axel Heider <axel.heider@hensoldt.net>
-Message-id: 166663118138.13362.1229967229046092876-0@git.sr.ht
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/timer/imx_epit.c | 9 +++++++--
-file changed, 7 insertions(+), 2 deletions(-)
-diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/imx_epit.c
-+++ b/hw/timer/imx_epit.c
-@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
-             /* If IOVW bit is set then set the timer value */
-             ptimer_set_count(s->timer_reload, s->lr);
-         }
--
-+        /*
-+         * Commit the change to s->timer_reload, so it can propagate. Otherwise
-+         * the timer interrupt may not fire properly. The commit must happen
-+         * before calling imx_epit_reload_compare_timer(), which reads
-+         * s->timer_reload internally again.
-+         */
-+        ptimer_transaction_commit(s->timer_reload);
-         imx_epit_reload_compare_timer(s);
-         ptimer_transaction_commit(s->timer_cmp);
--        ptimer_transaction_commit(s->timer_reload);
-         break;
-     case 3: /* CMP */
---
-.25.1

-[PULL 18/30] target/arm: Implement FEAT_HAFDBS, access flag portion
+[PULL 10/21] hw/arm/smmuv3: Add stage-2 support in iova notifier
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-Perform the atomic update for hardware management of the access flag.
+In smmuv3_notify_iova, read the granule based on translation stage
 and use VMID if valid value is sent.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20221024051851.3074715-13-richard.henderson@linaro.org
+Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-10-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/emulation.rst |   1 +
+ hw/arm/smmuv3.c     | 39 ++++++++++++++++++++++++++-------------
- target/arm/cpu64.c            |   1 +
+ hw/arm/trace-events |  2 +-
- target/arm/ptw.c              | 176 +++++++++++++++++++++++++++++-----
+files changed, 27 insertions(+), 14 deletions(-)
 files changed, 156 insertions(+), 22 deletions(-)
-diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/emulation.rst
+--- a/hw/arm/smmuv3.c
-+++ b/docs/system/arm/emulation.rst
++++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
+@@ -XXX,XX +XXX,XX @@ epilogue:
- - FEAT_FlagM (Flag manipulation instructions v2)
+  * @mr: IOMMU mr region handle
- - FEAT_FlagM2 (Enhancements to flag manipulation instructions)
+  * @n: notifier to be called
- - FEAT_GTG (Guest translation granule size)
+  * @asid: address space ID or negative value if we don't care
-+- FEAT_HAFDBS (Hardware management of the access flag and dirty bit state)
++ * @vmid: virtual machine ID or negative value if we don't care
- - FEAT_HCX (Support for the HCRX_EL2 register)
+  * @iova: iova
- - FEAT_HPDS (Hierarchical permission disables)
+  * @tg: translation granule (if communicated through range invalidation)
- - FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
+  * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+  */
-index XXXXXXX..XXXXXXX 100644
+ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
---- a/target/arm/cpu64.c
+                                IOMMUNotifier *n,
-+++ b/target/arm/cpu64.c
+-                               int asid, dma_addr_t iova,
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+-                               uint8_t tg, uint64_t num_pages)
-     cpu->isar.id_aa64mmfr0 = t;
++                               int asid, int vmid,
++                               dma_addr_t iova, uint8_t tg,
-     t = cpu->isar.id_aa64mmfr1;
++                               uint64_t num_pages)
-+    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 1);   /* FEAT_HAFDBS, AF only */
+ {
-     t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
+     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
-     t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
+     IOMMUTLBEvent event;
-     t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1);     /* FEAT_HPDS */
+     uint8_t granule;
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
++    SMMUv3State *s = sdev->smmu;
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
+     if (!tg) {
-+++ b/target/arm/ptw.c
+         SMMUEventInfo event = {.inval_ste_allowed = true};
-@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
-     bool in_secure;
+             return;
-     bool in_debug;
+         }
-     bool out_secure;
-+    bool out_rw;
+-        tt = select_tt(cfg, iova);
-     bool out_be;
+-        if (!tt) {
-+    hwaddr out_virt;
++        if (vmid >= 0 && cfg->s2cfg.vmid != vmid) {
-     hwaddr out_phys;
+             return;
-     void *out_host;
+         }
- } S1Translate;
+-        granule = tt->granule_sz;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
      uint8_t pte_attrs;
      bool pte_secure;
 +    ptw->out_virt = addr;
 +
-     if (unlikely(ptw->in_debug)) {
++        if (STAGE1_SUPPORTED(s)) {
-         /*
++            tt = select_tt(cfg, iova);
-          * From gdbstub, do not use softmmu so that we don't modify the
++            if (!tt) {
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
++                return;
-             pte_secure = is_secure;
++            }
-         }
++            granule = tt->granule_sz;
          ptw->out_host = NULL;
 +        ptw->out_rw = false;
      } else {
          CPUTLBEntryFull *full;
          int flags;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
              goto fail;
          }
          ptw->out_phys = full->phys_addr;
 +        ptw->out_rw = full->prot & PROT_WRITE;
          pte_attrs = full->pte_attrs;
          pte_secure = full->attrs.secure;
      }
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
                              ARMMMUFaultInfo *fi)
  {
      CPUState *cs = env_cpu(env);
 +    void *host = ptw->out_host;
      uint32_t data;
 -    if (likely(ptw->out_host)) {
 +    if (likely(host)) {
          /* Page tables are in RAM, and we have the host address. */
 +        data = qatomic_read((uint32_t *)host);
          if (ptw->out_be) {
 -            data = ldl_be_p(ptw->out_host);
 +            data = be32_to_cpu(data);
          } else {
 -            data = ldl_le_p(ptw->out_host);
 +            data = le32_to_cpu(data);
          }
      } else {
          /* Page tables are in MMIO. */
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
                              ARMMMUFaultInfo *fi)
  {
      CPUState *cs = env_cpu(env);
 +    void *host = ptw->out_host;
      uint64_t data;
 -    if (likely(ptw->out_host)) {
 +    if (likely(host)) {
          /* Page tables are in RAM, and we have the host address. */
 +#ifdef CONFIG_ATOMIC64
 +        data = qatomic_read__nocheck((uint64_t *)host);
          if (ptw->out_be) {
 -            data = ldq_be_p(ptw->out_host);
 +            data = be64_to_cpu(data);
          } else {
 -            data = ldq_le_p(ptw->out_host);
 +            data = le64_to_cpu(data);
          }
 +#else
 +        if (ptw->out_be) {
 +            data = ldq_be_p(host);
 +        } else {
-+            data = ldq_le_p(host);
++            granule = cfg->s2cfg.granule_sz;
 +        }
 +#endif
      } else {
          /* Page tables are in MMIO. */
          MemTxAttrs attrs = { .secure = ptw->out_secure };
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
      return data;
  }
 +static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
 +                             uint64_t new_val, S1Translate *ptw,
 +                             ARMMMUFaultInfo *fi)
 +{
 +    uint64_t cur_val;
 +    void *host = ptw->out_host;
 +
 +    if (unlikely(!host)) {
 +        fi->type = ARMFault_UnsuppAtomicUpdate;
 +        fi->s1ptw = true;
 +        return 0;
 +    }
 +
 +    /*
 +     * Raising a stage2 Protection fault for an atomic update to a read-only
 +     * page is delayed until it is certain that there is a change to make.
 +     */
 +    if (unlikely(!ptw->out_rw)) {
 +        int flags;
 +        void *discard;
 +
 +        env->tlb_fi = fi;
 +        flags = probe_access_flags(env, ptw->out_virt, MMU_DATA_STORE,
 +                                   arm_to_core_mmu_idx(ptw->in_ptw_idx),
 +                                   true, &discard, 0);
 +        env->tlb_fi = NULL;
 +
 +        if (unlikely(flags & TLB_INVALID_MASK)) {
 +            assert(fi->type != ARMFault_None);
 +            fi->s2addr = ptw->out_virt;
 +            fi->stage2 = true;
 +            fi->s1ptw = true;
 +            fi->s1ns = !ptw->in_secure;
 +            return 0;
 +        }
 +
-+        /* In case CAS mismatches and we loop, remember writability. */
+     } else {
-+        ptw->out_rw = true;
+         granule = tg * 2 + 10;
-+    }
+     }
-+
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
-+#ifdef CONFIG_ATOMIC64
+     memory_region_notify_iommu_one(n, &event);
-+    if (ptw->out_be) {
+ }
-+        old_val = cpu_to_be64(old_val);
-+        new_val = cpu_to_be64(new_val);
+-/* invalidate an asid/iova range tuple in all mr's */
-+        cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
+-static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
-+        cur_val = be64_to_cpu(cur_val);
+-                                      uint8_t tg, uint64_t num_pages)
-+    } else {
++/* invalidate an asid/vmid/iova range tuple in all mr's */
-+        old_val = cpu_to_le64(old_val);
++static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid,
-+        new_val = cpu_to_le64(new_val);
++                                      dma_addr_t iova, uint8_t tg,
-+        cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
++                                      uint64_t num_pages)
 +        cur_val = le64_to_cpu(cur_val);
 +    }
 +#else
 +    /*
 +     * We can't support the full 64-bit atomic cmpxchg on the host.
 +     * Because this is only used for FEAT_HAFDBS, which is only for AA64,
 +     * we know that TCG_OVERSIZED_GUEST is set, which means that we are
 +     * running in round-robin mode and could only race with dma i/o.
 +     */
 +#ifndef TCG_OVERSIZED_GUEST
 +# error "Unexpected configuration"
 +#endif
 +    bool locked = qemu_mutex_iothread_locked();
 +    if (!locked) {
 +       qemu_mutex_lock_iothread();
 +    }
 +    if (ptw->out_be) {
 +        cur_val = ldq_be_p(host);
 +        if (cur_val == old_val) {
 +            stq_be_p(host, new_val);
 +        }
 +    } else {
 +        cur_val = ldq_le_p(host);
 +        if (cur_val == old_val) {
 +            stq_le_p(host, new_val);
 +        }
 +    }
 +    if (!locked) {
 +        qemu_mutex_unlock_iothread();
 +    }
 +#endif
 +
 +    return cur_val;
 +}
 +
  static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
                                       uint32_t *table, uint32_t address)
  {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
+     SMMUDevice *sdev;
-     uint32_t el = regime_el(env, mmu_idx);
-     uint64_t descaddrmask;
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
-     bool aarch64 = arm_el_is_aa64(env, el);
+         IOMMUMemoryRegion *mr = &sdev->iommu;
--    uint64_t descriptor;
+         IOMMUNotifier *n;
-+    uint64_t descriptor, new_descriptor;
-     bool nstable;
+-        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova,
+-                                        tg, num_pages);
-     /* TODO: This code does not support shareability levels. */
++        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid,
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
++                                        iova, tg, num_pages);
-     if (fi->type != ARMFault_None) {
-         goto do_fault;
+         IOMMU_NOTIFIER_FOREACH(n, mr) {
-     }
+-            smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages);
-+    new_descriptor = descriptor;
++            smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages);
 + restart_atomic_update:
      if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
          /* Invalid, or the Reserved level 3 encoding */
          goto do_translation_fault;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
       * to give a correct page or table address, the address field
       * in a block descriptor is smaller; so we need to explicitly
       * clear the lower bits here before ORing in the low vaddr bits.
 +     *
 +     * Afterward, descaddr is the final physical address.
       */
      page_size = (1ULL << ((stride * (4 - level)) + 3));
      descaddr &= ~(hwaddr)(page_size - 1);
      descaddr |= (address & (page_size - 1));
 +    if (likely(!ptw->in_debug)) {
 +        /*
 +         * Access flag.
 +         * If HA is enabled, prepare to update the descriptor below.
 +         * Otherwise, pass the access fault on to software.
 +         */
 +        if (!(descriptor & (1 << 10))) {
 +            if (param.ha) {
 +                new_descriptor |= 1 << 10; /* AF */
 +            } else {
 +                fi->type = ARMFault_AccessFlag;
 +                goto do_fault;
 +            }
 +        }
 +    }
 +
      /*
 -     * Extract attributes from the descriptor, and apply table descriptors.
 -     * Stage 2 table descriptors do not include any attribute fields.
 -     * HPD disables all the table attributes except NSTable.
 +     * Extract attributes from the (modified) descriptor, and apply
 +     * table descriptors. Stage 2 table descriptors do not include
 +     * any attribute fields. HPD disables all the table attributes
 +     * except NSTable.
       */
 -    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
 +    attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
      if (!regime_is_stage2(mmu_idx)) {
          attrs |= nstable << 5; /* NS */
          if (!param.hpd) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          }
      }
+ }
--    /*
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
--     * Here descaddr is the final physical address, and attributes
--     * are all in attrs.
+     if (!tg) {
--     */
+         trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
--    if ((attrs & (1 << 10)) == 0) {
+-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
--        /* Access flag */
++        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1);
--        fi->type = ARMFault_AccessFlag;
+         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
--        goto do_fault;
+         return;
 -    }
 -
      ap = extract32(attrs, 6, 2);
 -
      if (regime_is_stage2(mmu_idx)) {
          ns = mmu_idx == ARMMMUIdx_Stage2;
          xn = extract64(attrs, 53, 2);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          goto do_fault;
      }
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
-+    /* If FEAT_HAFDBS has made changes, update the PTE. */
-+    if (new_descriptor != descriptor) {
+         num_pages = (mask + 1) >> granule;
-+        new_descriptor = arm_casq_ptw(env, descriptor, new_descriptor, ptw, fi);
+         trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-+        if (fi->type != ARMFault_None) {
+-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
-+            goto do_fault;
++        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages);
-+        }
+         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
-+        /*
+         addr += mask + 1;
-+         * I_YZSVV says that if the in-memory descriptor has changed,
+     }
-+         * then we must use the information in that new value
+diff --git a/hw/arm/trace-events b/hw/arm/trace-events
-+         * (which might include a different output address, different
+index XXXXXXX..XXXXXXX 100644
-+         * attributes, or generate a fault).
+--- a/hw/arm/trace-events
-+         * Restart the handling of the descriptor value from scratch.
++++ b/hw/arm/trace-events
-+         */
+@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
-+        if (new_descriptor != descriptor) {
+ smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
-+            descriptor = new_descriptor;
+ smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
-+            goto restart_atomic_update;
+ smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
-+        }
+-smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
-+    }
++smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint16_t vmid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d vmid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
-+
      if (ns) {
          /*
           * The NS bit will (as required by the architecture) have no effect if
 --
-.25.1
+.34.1

-[PULL 14/30] target/arm: Fix fault reporting in get_phys_addr_lpae
+[PULL 11/21] hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-Always overriding fi->type was incorrect, as we would not properly
+As everything is in place, we can use a new system property to
-propagate the fault type from S1_ptw_translate, or arm_ldq_ptw.
+advertise which stage is supported and remove bad_ste from STE
-Simplify things by providing a new label for a translation fault.
+stage2 config.
 For other faults, store into fi directly.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+The property added arm-smmuv3.stage can have 3 values:
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+- "1": Stage-1 only is advertised.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+- "2": Stage-2 only is advertised.
-Message-id: 20221024051851.3074715-9-richard.henderson@linaro.org
 If not passed or an unsupported value is passed, it will default to
 stage-1.
 Advertise VMID16.
 Don't try to decode CD, if stage-2 is configured.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-11-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/ptw.c | 31 +++++++++++++------------------
+ include/hw/arm/smmuv3.h |  1 +
-file changed, 13 insertions(+), 18 deletions(-)
+ hw/arm/smmuv3.c         | 32 ++++++++++++++++++++++----------
 files changed, 23 insertions(+), 10 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
+--- a/include/hw/arm/smmuv3.h
-+++ b/target/arm/ptw.c
++++ b/include/hw/arm/smmuv3.h
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
+@@ -XXX,XX +XXX,XX @@ struct SMMUv3State {
-     ARMCPU *cpu = env_archcpu(env);
-     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
+     qemu_irq     irq[4];
-     bool is_secure = ptw->in_secure;
+     QemuMutex mutex;
--    /* Read an LPAE long-descriptor translation table. */
++    char *stage;
--    ARMFaultType fault_type = ARMFault_Translation;
+ };
-     uint32_t level;
-     ARMVAParameters param;
+ typedef enum {
-     uint64_t ttbr;
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
+index XXXXXXX..XXXXXXX 100644
-          * so our choice is to always raise the fault.
+--- a/hw/arm/smmuv3.c
-          */
++++ b/hw/arm/smmuv3.c
-         if (param.tsz_oob) {
+@@ -XXX,XX +XXX,XX @@
--            fault_type = ARMFault_Translation;
+ #include "hw/irq.h"
--            goto do_fault;
+ #include "hw/sysbus.h"
-+            goto do_translation_fault;
+ #include "migration/vmstate.h"
-         }
++#include "hw/qdev-properties.h"
+ #include "hw/qdev-core.h"
-         addrsize = 64 - 8 * param.tbi;
+ #include "hw/pci/pci.h"
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
+ #include "cpu.h"
-                                            addrsize - inputsize);
+@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
-         if (-top_bits != param.select) {
-             /* The gap between the two regions is a Translation fault */
+ static void smmuv3_init_regs(SMMUv3State *s)
--            fault_type = ARMFault_Translation;
+ {
--            goto do_fault;
+-    /**
-+            goto do_translation_fault;
+-     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
-         }
+-     *       multi-level stream table
 -     */
 -    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
 +    /* Based on sys property, the stages supported in smmu will be advertised.*/
 +    if (s->stage && !strcmp("2", s->stage)) {
 +        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
 +    } else {
 +        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
 +    }
 +
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
 +    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, VMID16, 1); /* 16-bit VMID */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
      /* terminated transaction will always be aborted/error returned */
@@ -XXX,XX +XXX,XX @@ static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
          goto bad_ste;
      }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
+-    /* This is still here as stage 2 has not been fully enabled yet. */
-          * Translation table walk disabled => Translation fault on TLB miss
+-    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
-          * Note: This is always 0 on 64-bit EL2 and EL3.
+-    goto bad_ste;
-          */
+-
--        goto do_fault;
+     return 0;
-+        goto do_translation_fault;
  bad_ste:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
          return ret;
      }
-     if (!regime_is_stage2(mmu_idx)) {
+-    if (cfg->aborted || cfg->bypassed) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
++    if (cfg->aborted || cfg->bypassed || (cfg->stage == 2)) {
-         if (param.ds && stride == 9 && sl2) {
+         return 0;
              if (sl0 != 0) {
                  level = 0;
 -                fault_type = ARMFault_Translation;
 -                goto do_fault;
 +                goto do_translation_fault;
              }
              startlevel = -1;
          } else if (!aarch64 || stride == 9) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
                                  inputsize, stride, outputsize);
          if (!ok) {
 -            fault_type = ARMFault_Translation;
 -            goto do_fault;
 +            goto do_translation_fault;
          }
          level = startlevel;
      }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-         descaddr |= extract64(ttbr, 2, 4) << 48;
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3 = {
      } else if (descaddr >> outputsize) {
          level = 0;
 -        fault_type = ARMFault_AddressSize;
 +        fi->type = ARMFault_AddressSize;
          goto do_fault;
      }
+ };
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
++static Property smmuv3_properties[] = {
-     if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
++    /*
-         /* Invalid, or the Reserved level 3 encoding */
++     * Stages of translation advertised.
--        goto do_fault;
++     * "1": Stage 1
-+        goto do_translation_fault;
++     * "2": Stage 2
-     }
++     * Defaults to stage 1
++     */
-     descaddr = descriptor & descaddrmask;
++    DEFINE_PROP_STRING("stage", SMMUv3State, stage),
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
++    DEFINE_PROP_END_OF_LIST()
-             descaddr |= extract64(descriptor, 12, 4) << 48;
++};
-         }
++
-     } else if (descaddr >> outputsize) {
+ static void smmuv3_instance_init(Object *obj)
--        fault_type = ARMFault_AddressSize;
+ {
-+        fi->type = ARMFault_AddressSize;
+     /* Nothing much to do here as of now */
-         goto do_fault;
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
-     }
+                                        &c->parent_phases);
+     c->parent_realize = dc->realize;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
+     dc->realize = smmu_realize;
-      * Here descaddr is the final physical address, and attributes
++    device_class_set_props(dc, smmuv3_properties);
-      * are all in attrs.
+ }
-      */
--    fault_type = ARMFault_AccessFlag;
+ static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
      if ((attrs & (1 << 8)) == 0) {
          /* Access flag */
 +        fi->type = ARMFault_AccessFlag;
          goto do_fault;
      }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
      }
 -    fault_type = ARMFault_Permission;
      if (!(result->f.prot & (1 << access_type))) {
 +        fi->type = ARMFault_Permission;
          goto do_fault;
      }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      result->f.lg_page_size = ctz64(page_size);
      return false;
 -do_fault:
 -    fi->type = fault_type;
 + do_translation_fault:
 +    fi->type = ARMFault_Translation;
 + do_fault:
      fi->level = level;
      /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
      fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
 --
-.25.1
+.34.1

-[PULL 07/30] target/arm: Introduce regime_is_stage2
+[PULL 12/21] hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Tommy Wu <tommy.wu@sifive.com>
-Reduce the amount of typing required for this check.
+When we receive a packet from the xilinx_axienet and then try to s2mem
 through the xilinx_axidma, if the descriptor ring buffer is full in the
 xilinx axidma driver, we’ll assert the DMASR.HALTED in the
 function : stream_process_s2mem and return 0. In the end, we’ll be stuck in
 an infinite loop in axienet_eth_rx_notify.
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+This patch checks the DMASR.HALTED state when we try to push data
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+from xilinx axi-enet to xilinx axi-dma. When the DMASR.HALTED is asserted,
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+we will not keep pushing the data and then prevent the infinte loop.
-Message-id: 20221024051851.3074715-2-richard.henderson@linaro.org
 Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
 Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Message-id: 20230519062137.1251741-1-tommy.wu@sifive.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h |  5 +++++
+ hw/dma/xilinx_axidma.c | 11 ++++++++---
- target/arm/helper.c    | 14 +++++---------
+file changed, 8 insertions(+), 3 deletions(-)
  target/arm/ptw.c       | 14 ++++++--------
 files changed, 16 insertions(+), 17 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/hw/dma/xilinx_axidma.c
-+++ b/target/arm/internals.h
++++ b/hw/dma/xilinx_axidma.c
-@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
+@@ -XXX,XX +XXX,XX @@ static inline int stream_idle(struct Stream *s)
-     }
+     return !!(s->regs[R_DMASR] & DMASR_IDLE);
  }
-+static inline bool regime_is_stage2(ARMMMUIdx mmu_idx)
++static inline int stream_halted(struct Stream *s)
 +{
-+    return mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
++    return !!(s->regs[R_DMASR] & DMASR_HALTED);
 +}
 +
- /* Return the exception level which controls this address translation regime */
+ static void stream_reset(struct Stream *s)
  static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
  {
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+     s->regs[R_DMASR] = DMASR_HALTED;  /* starts up halted.  */
-index XXXXXXX..XXXXXXX 100644
+@@ -XXX,XX +XXX,XX @@ static void stream_process_mem2s(struct Stream *s, StreamSink *tx_data_dev,
---- a/target/arm/helper.c
+     uint64_t addr;
-+++ b/target/arm/helper.c
+     bool eop;
-@@ -XXX,XX +XXX,XX @@ int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx)
- {
+-    if (!stream_running(s) || stream_idle(s)) {
-     if (regime_has_2_ranges(mmu_idx)) {
++    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
-         return extract64(tcr, 37, 2);
+         return;
 -    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
 +    } else if (regime_is_stage2(mmu_idx)) {
          return 0; /* VTCR_EL2 */
      } else {
          /* Replicate the single TBI bit so we always have 2 bits.  */
@@ -XXX,XX +XXX,XX @@ int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx)
  {
      if (regime_has_2_ranges(mmu_idx)) {
          return extract64(tcr, 51, 2);
 -    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
 +    } else if (regime_is_stage2(mmu_idx)) {
          return 0; /* VTCR_EL2 */
      } else {
          /* Replicate the single TBID bit so we always have 2 bits.  */
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
      int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
      ARMGranuleSize gran;
      ARMCPU *cpu = env_archcpu(env);
 -    bool stage2 = mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
 +    bool stage2 = regime_is_stage2(mmu_idx);
      if (!regime_has_2_ranges(mmu_idx)) {
          select = 0;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
          }
          ds = false;
      } else if (ds) {
 -        switch (mmu_idx) {
 -        case ARMMMUIdx_Stage2:
 -        case ARMMMUIdx_Stage2_S:
 +        if (regime_is_stage2(mmu_idx)) {
              if (gran == Gran16K) {
                  ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu);
              } else {
                  ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu);
              }
 -            break;
 -        default:
 +        } else {
              if (gran == Gran16K) {
                  ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu);
              } else {
                  ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu);
              }
 -            break;
          }
          if (ds) {
              min_tsz = 12;
 diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/ptw.c
 +++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
      bool have_wxn;
      int wxn = 0;
 -    assert(mmu_idx != ARMMMUIdx_Stage2);
 -    assert(mmu_idx != ARMMMUIdx_Stage2_S);
 +    assert(!regime_is_stage2(mmu_idx));
      user_rw = simple_ap_to_rw_prot_is_user(ap, true);
      if (is_user) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          goto do_fault;
      }
--    if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
+@@ -XXX,XX +XXX,XX @@ static size_t stream_process_s2mem(struct Stream *s, unsigned char *buf,
-+    if (!regime_is_stage2(mmu_idx)) {
+     unsigned int rxlen;
-         /*
+     size_t pos = 0;
-          * The starting level depends on the virtual address size (which can
-          * be up to 48 bits) and the translation granule size. It indicates
+-    if (!stream_running(s) || stream_idle(s)) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
++    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
-         attrs = extract64(descriptor, 2, 10)
+         return 0;
              | (extract64(descriptor, 52, 12) << 10);
 -        if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
 +        if (regime_is_stage2(mmu_idx)) {
              /* Stage 2 table descriptors do not include any attribute fields */
              break;
          }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      ap = extract32(attrs, 4, 2);
 -    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
 +    if (regime_is_stage2(mmu_idx)) {
          ns = mmu_idx == ARMMMUIdx_Stage2;
          xn = extract32(attrs, 11, 2);
          result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          result->f.guarded = guarded;
      }
--    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+@@ -XXX,XX +XXX,XX @@ xilinx_axidma_data_stream_can_push(StreamSink *obj,
-+    if (regime_is_stage2(mmu_idx)) {
+     XilinxAXIDMAStreamSink *ds = XILINX_AXI_DMA_DATA_STREAM(obj);
-         result->cacheattrs.is_s2_format = true;
+     struct Stream *s = &ds->dma->streams[1];
-         result->cacheattrs.attrs = extract32(attrs, 0, 4);
-     } else {
+-    if (!stream_running(s) || stream_idle(s)) {
-@@ -XXX,XX +XXX,XX @@ do_fault:
++    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
-     fi->type = fault_type;
+         ds->dma->notify = notify;
-     fi->level = level;
+         ds->dma->notify_opaque = notify_opaque;
-     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
+         return false;
 -    fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2 ||
 -                               mmu_idx == ARMMMUIdx_Stage2_S);
 +    fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
      fi->s1ns = mmu_idx == ARMMMUIdx_Stage2;
      return true;
  }
 --
-.25.1
+.34.1

-[PULL 17/30] target/arm: Tidy merging of attributes from descriptor and table
+[PULL 13/21] hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Clément Chigot <chigot@adacore.com>
-Replace some gotos with some nested if statements.
+When passing --smp with a number lower than XLNX_ZYNQMP_NUM_APU_CPUS,
 the expression (ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS) will result
 in a positive number as ms->smp.cpus is a unsigned int.
 This will raise the following error afterwards, as Qemu will try to
 instantiate some additional RPUs.
   | $ qemu-system-aarch64 --smp 1 -M xlnx-zcu102
   | **
   | ERROR:../src/tcg/tcg.c:777:tcg_register_thread:
   |   assertion failed: (n < tcg_max_ctxs)
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Clément Chigot <chigot@adacore.com>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-Message-id: 20221024051851.3074715-12-richard.henderson@linaro.org
+Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Message-id: 20230524143714.565792-1-chigot@adacore.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/ptw.c | 34 ++++++++++++++++------------------
+ hw/arm/xlnx-zynqmp.c | 2 +-
-file changed, 16 insertions(+), 18 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
+--- a/hw/arm/xlnx-zynqmp.c
-+++ b/target/arm/ptw.c
++++ b/hw/arm/xlnx-zynqmp.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(MachineState *ms, XlnxZynqMPState *s,
-     page_size = (1ULL << ((stride * (4 - level)) + 3));
+                                    const char *boot_cpu, Error **errp)
-     descaddr &= ~(hwaddr)(page_size - 1);
+ {
-     descaddr |= (address & (page_size - 1));
+     int i;
--    /* Extract attributes from the descriptor */
+-    int num_rpus = MIN(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS,
--    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
++    int num_rpus = MIN((int)(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS),
+                        XLNX_ZYNQMP_NUM_RPU_CPUS);
--    if (regime_is_stage2(mmu_idx)) {
--        /* Stage 2 table descriptors do not include any attribute fields */
+     if (num_rpus <= 0) {
 -        goto skip_attrs;
 -    }
 -    /* Merge in attributes from table descriptors */
 -    attrs |= nstable << 5; /* NS */
 -    if (param.hpd) {
 -        /* HPD disables all the table attributes except NSTable.  */
 -        goto skip_attrs;
 -    }
 -    attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
      /*
 -     * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
 -     * means "force PL1 access only", which means forcing AP[1] to 0.
 +     * Extract attributes from the descriptor, and apply table descriptors.
 +     * Stage 2 table descriptors do not include any attribute fields.
 +     * HPD disables all the table attributes except NSTable.
       */
 -    attrs &= ~(extract64(tableattrs, 2, 1) << 6);   /* !APT[0] => AP[1] */
 -    attrs |= extract32(tableattrs, 3, 1) << 7;      /* APT[1] => AP[2] */
 - skip_attrs:
 +    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
 +    if (!regime_is_stage2(mmu_idx)) {
 +        attrs |= nstable << 5; /* NS */
 +        if (!param.hpd) {
 +            attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
 +            /*
 +             * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
 +             * means "force PL1 access only", which means forcing AP[1] to 0.
 +             */
 +            attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */
 +            attrs |= extract32(tableattrs, 3, 1) << 7;    /* APT[1] => AP[2] */
 +        }
 +    }
      /*
       * Here descaddr is the final physical address, and attributes
 --
-.25.1
+.34.1

-[PULL 22/30] device-tree: add re-randomization helper function
+[PULL 14/21] tests/qtest: Run arm-specific tests only if the required machine is available
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Thomas Huth <thuth@redhat.com>
-When the system reboots, the rng-seed that the FDT has should be
+pflash-cfi02-test.c always uses the "musicpal" machine for testing,
-re-randomized, so that the new boot gets a new seed. Several
+test-arm-mptimer.c always uses the "vexpress-a9" machine, and
-architectures require this functionality, so export a function for
+microbit-test.c requires the "microbit" machine, so we should only
-injecting a new seed into the given FDT.
+run these tests if the machines have been enabled in the configuration.
-Cc: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
-Cc: David Gibson <david@gibson.dropbear.id.au>
+Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Message-id: 20230524080600.1618137-1-thuth@redhat.com
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Message-id: 20221025004327.568476-3-Jason@zx2c4.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/sysemu/device_tree.h |  9 +++++++++
+ tests/qtest/meson.build | 7 ++++---
- softmmu/device_tree.c        | 21 +++++++++++++++++++++
+file changed, 4 insertions(+), 3 deletions(-)
 files changed, 30 insertions(+)
-diff --git a/include/sysemu/device_tree.h b/include/sysemu/device_tree.h
+diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/device_tree.h
+--- a/tests/qtest/meson.build
-+++ b/include/sysemu/device_tree.h
++++ b/tests/qtest/meson.build
-@@ -XXX,XX +XXX,XX @@ int qemu_fdt_setprop_sized_cells_from_array(void *fdt,
+@@ -XXX,XX +XXX,XX @@ qtests_arm = \
-                                                 qdt_tmp);                 \
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
-     })
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
-+
+-  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
-+/**
++  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') and
-+ * qemu_fdt_randomize_seeds:
++   config_all_devices.has_key('CONFIG_MUSICPAL') ? ['pflash-cfi02-test'] : []) + \
-+ * @fdt: device tree blob
+   (config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed : []) + \
-+ *
+   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
-+ * Re-randomize all "rng-seed" properties with new seeds.
+   (config_all_devices.has_key('CONFIG_GENERIC_LOADER') ? ['hexloader-test'] : []) + \
-+ */
+   (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \
-+void qemu_fdt_randomize_seeds(void *fdt);
++  (config_all_devices.has_key('CONFIG_VEXPRESS') ? ['test-arm-mptimer'] : []) + \
-+
++  (config_all_devices.has_key('CONFIG_MICROBIT') ? ['microbit-test'] : []) + \
- #define FDT_PCI_RANGE_RELOCATABLE          0x80000000
+   ['arm-cpu-features',
- #define FDT_PCI_RANGE_PREFETCHABLE         0x40000000
+-   'microbit-test',
- #define FDT_PCI_RANGE_ALIASED              0x20000000
+-   'test-arm-mptimer',
-diff --git a/softmmu/device_tree.c b/softmmu/device_tree.c
+    'boot-serial-test']
-index XXXXXXX..XXXXXXX 100644
---- a/softmmu/device_tree.c
+ # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional
 +++ b/softmmu/device_tree.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/option.h"
  #include "qemu/bswap.h"
  #include "qemu/cutils.h"
 +#include "qemu/guest-random.h"
  #include "sysemu/device_tree.h"
  #include "hw/loader.h"
  #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ void hmp_dumpdtb(Monitor *mon, const QDict *qdict)
      info_report("dtb dumped to %s", filename);
  }
 +
 +void qemu_fdt_randomize_seeds(void *fdt)
 +{
 +    int noffset, poffset, len;
 +    const char *name;
 +    uint8_t *data;
 +
 +    for (noffset = fdt_next_node(fdt, 0, NULL);
 +         noffset >= 0;
 +         noffset = fdt_next_node(fdt, noffset, NULL)) {
 +        for (poffset = fdt_first_property_offset(fdt, noffset);
 +             poffset >= 0;
 +             poffset = fdt_next_property_offset(fdt, poffset)) {
 +            data = (uint8_t *)fdt_getprop_by_offset(fdt, poffset, &name, &len);
 +            if (!data || strcmp(name, "rng-seed"))
 +                continue;
 +            qemu_guest_getrandom_nofail(data, len);
 +        }
 +    }
 +}
 --
-.25.1
+.34.1

-[PULL 19/30] target/arm: Implement FEAT_HAFDBS, dirty bit portion
+[PULL 15/21] target/arm: Explicitly select short-format FSR for M-profile
-From: Richard Henderson <richard.henderson@linaro.org>
+For M-profile, there is no guest-facing A-profile format FSR, but we
 still use the env->exception.fsr field to pass fault information from
 the point where a fault is raised to the code in
 arm_v7m_cpu_do_interrupt() which interprets it and sets the M-profile
 specific fault status registers.  So it doesn't matter whether we
 fill in env->exception.fsr in the short format or the LPAE format, as
 long as both sides agree.  As it happens arm_v7m_cpu_do_interrupt()
 assumes short-form.
-Perform the atomic update for hardware management of the dirty bit.
+In compute_fsr_fsc() we weren't explicitly choosing short-form for
 M-profile, but instead relied on it falling out in the wash because
 arm_s1_regime_using_lpae_format() would be false.  This was broken in
 commit 452c67a4 when we added v8R support, because we said "PMSAv8 is
 always LPAE format" (as it is for v8R), forgetting that we were
 implicitly using this code path on M-profile. At that point we would
 hit a g_assert_not_reached():
  ERROR:../../target/arm/internals.h:549:arm_fi_to_lfsc: code should not be reached
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+#7  0x0000555555e055f7 in arm_fi_to_lfsc (fi=0x7fffecff9a90) at ../../target/arm/internals.h:549
-Message-id: 20221024051851.3074715-14-richard.henderson@linaro.org
+#8  0x0000555555e05a27 in compute_fsr_fsc (env=0x555557356670, fi=0x7fffecff9a90, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff9a1c)
     at ../../target/arm/tlb_helper.c:95
 #9  0x0000555555e05b62 in arm_deliver_fault (cpu=0x555557354800, addr=268961344, access_type=MMU_INST_FETCH, mmu_idx=1, fi=0x7fffecff9a90)
     at ../../target/arm/tlb_helper.c:132
 #10 0x0000555555e06095 in arm_cpu_tlb_fill (cs=0x555557354800, address=268961344, size=1, access_type=MMU_INST_FETCH, mmu_idx=1, probe=false, retaddr=0)
     at ../../target/arm/tlb_helper.c:260
 The specific assertion changed when commit fcc7404eff24b4c added
 "assert not M-profile" to arm_is_secure_below_el3(), because the
 conditions being checked in compute_fsr_fsc() include
 arm_el_is_aa64(), which will end up calling arm_is_secure_below_el3()
 and asserting before we try to call arm_fi_to_lfsc():
 #7  0x0000555555efaf43 in arm_is_secure_below_el3 (env=0x5555574665a0) at ../../target/arm/cpu.h:2396
 #8  0x0000555555efb103 in arm_is_el2_enabled (env=0x5555574665a0) at ../../target/arm/cpu.h:2448
 #9  0x0000555555efb204 in arm_el_is_aa64 (env=0x5555574665a0, el=1) at ../../target/arm/cpu.h:2509
 #10 0x0000555555efbdfd in compute_fsr_fsc (env=0x5555574665a0, fi=0x7fffecff99e0, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff996c)
 Avoid the assertion and the incorrect FSR format selection by
 explicitly making M-profile use the short-format in this function.
 Fixes: 452c67a42704 ("target/arm: Enable TTBCR_EAE for ARMv8-R AArch32")a
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1658
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230523131726.866635-1-peter.maydell@linaro.org
 ---
- target/arm/cpu64.c |  2 +-
+ target/arm/tcg/tlb_helper.c | 13 +++++++++++--
- target/arm/ptw.c   | 16 ++++++++++++++++
+file changed, 11 insertions(+), 2 deletions(-)
 files changed, 17 insertions(+), 1 deletion(-)
-diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu64.c
+--- a/target/arm/tcg/tlb_helper.c
-+++ b/target/arm/cpu64.c
++++ b/target/arm/tcg/tlb_helper.c
-@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
-     cpu->isar.id_aa64mmfr0 = t;
+     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
+     uint32_t fsr, fsc;
-     t = cpu->isar.id_aa64mmfr1;
--    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 1);   /* FEAT_HAFDBS, AF only */
+-    if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
-+    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 2);   /* FEAT_HAFDBS */
+-        arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
-     t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
++    /*
-     t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
++     * For M-profile there is no guest-facing FSR. We compute a
-     t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1);     /* FEAT_HPDS */
++     * short-form value for env->exception.fsr which we will then
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
++     * examine in arm_v7m_cpu_do_interrupt(). In theory we could
-index XXXXXXX..XXXXXXX 100644
++     * use the LPAE format instead as long as both bits of code agree
---- a/target/arm/ptw.c
++     * (and arm_fi_to_lfsc() handled the M-profile specific
-+++ b/target/arm/ptw.c
++     * ARMFault_QEMU_NSCExec and ARMFault_QEMU_SFault cases).
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
++     */
-                 goto do_fault;
++    if (!arm_feature(env, ARM_FEATURE_M) &&
-             }
++        (target_el == 2 || arm_el_is_aa64(env, target_el) ||
-         }
++         arm_s1_regime_using_lpae_format(env, arm_mmu_idx))) {
-+
+         /*
-+        /*
+          * LPAE format fault status register : bottom 6 bits are
-+         * Dirty Bit.
+          * status code in the same form as needed for syndrome
 +         * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP
 +         * bit for writeback. The actual write protection test may still be
 +         * overridden by tableattrs, to be merged below.
 +         */
 +        if (param.hd
 +            && extract64(descriptor, 51, 1)  /* DBM */
 +            && access_type == MMU_DATA_STORE) {
 +            if (regime_is_stage2(mmu_idx)) {
 +                new_descriptor |= 1ull << 7;    /* set S2AP[1] */
 +            } else {
 +                new_descriptor &= ~(1ull << 7); /* clear AP[2] */
 +            }
 +        }
      }
      /*
 --
-.25.1
+.34.1

-[PULL 28/30] mips/boston: re-randomize rng-seed on reboot
+[PULL 16/21] target/arm: Explain why we need to select ARM_V7M
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Fabiano Rosas <farosas@suse.de>
-When the system reboots, the rng-seed that the FDT has should be
+We currently need to select ARM_V7M unconditionally when TCG is
-re-randomized, so that the new boot gets a new seed. Since the FDT is in
+present in the build because some translate.c helpers and the whole of
-the ROM region at this point, we add a hook right after the ROM has been
+m_helpers.c are not yet under CONFIG_ARM_V7M.
 added, so that we have a pointer to that copy of the FDT.
-Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com>
+Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Cc: Paul Burton <paulburton@kernel.org>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Message-id: 20230523180525.29994-2-farosas@suse.de
 Message-id: 20221025004327.568476-9-Jason@zx2c4.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/mips/boston.c | 3 +++
+ target/arm/Kconfig | 3 +++
 file changed, 3 insertions(+)
-diff --git a/hw/mips/boston.c b/hw/mips/boston.c
+diff --git a/target/arm/Kconfig b/target/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/mips/boston.c
+--- a/target/arm/Kconfig
-+++ b/hw/mips/boston.c
++++ b/target/arm/Kconfig
 @@ -XXX,XX +XXX,XX @@
- #include "sysemu/sysemu.h"
+ config ARM
- #include "sysemu/qtest.h"
+     bool
- #include "sysemu/runstate.h"
+     select ARM_COMPATIBLE_SEMIHOSTING if TCG
-+#include "sysemu/reset.h"
++
++    # We need to select this until we move m_helper.c and the
- #include <libfdt.h>
++    # translate.c v7m helpers under ARM_V7M.
- #include "qom/object.h"
+     select ARM_V7M if TCG
-@@ -XXX,XX +XXX,XX @@ static void boston_mach_init(MachineState *machine)
-             /* Calculate real fdt size after filter */
+ config AARCH64
              dt_size = fdt_totalsize(dtb_load_data);
              rom_add_blob_fixed("dtb", dtb_load_data, dt_size, dtb_paddr);
 +            qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
 +                                rom_ptr(dtb_paddr, dt_size));
          } else {
              /* Try to load file as FIT */
              fit_err = load_fit(&boston_fit_loader, machine->kernel_filename, s);
 --
-.25.1
+.34.1

-[PULL 16/30] target/arm: Consider GP an attribute in get_phys_addr_lpae
+[PULL 17/21] arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Fabiano Rosas <farosas@suse.de>
-Both GP and DBM are in the upper attribute block.
+When we moved the arm default CONFIGs into Kconfig and removed them
-Extend the computation of attrs to include them,
+from default.mak, we made it harder to identify which CONFIGs are
-then simplify the setting of guarded.
+selected by default in case users want to disable them.
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Bring back the default entries into default.mak, but keep them
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+commented out. This way users can keep their workflows of editing
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+default.mak to remove build options without needing to search through
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Kconfig.
-Message-id: 20221024051851.3074715-11-richard.henderson@linaro.org
 Reported-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Message-id: 20230523180525.29994-3-farosas@suse.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/ptw.c | 6 ++----
+ configs/devices/aarch64-softmmu/default.mak |  6 ++++
-file changed, 2 insertions(+), 4 deletions(-)
+ configs/devices/arm-softmmu/default.mak     | 40 +++++++++++++++++++++
 files changed, 46 insertions(+)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+diff --git a/configs/devices/aarch64-softmmu/default.mak b/configs/devices/aarch64-softmmu/default.mak
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
+--- a/configs/devices/aarch64-softmmu/default.mak
-+++ b/target/arm/ptw.c
++++ b/configs/devices/aarch64-softmmu/default.mak
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
+@@ -XXX,XX +XXX,XX @@
-     uint32_t el = regime_el(env, mmu_idx);
-     uint64_t descaddrmask;
+ # We support all the 32 bit boards so need all their config
-     bool aarch64 = arm_el_is_aa64(env, el);
+ include ../arm-softmmu/default.mak
--    bool guarded = false;
++
-     uint64_t descriptor;
++# These are selected by default when TCG is enabled, uncomment them to
-     bool nstable;
++# keep out of the build.
++# CONFIG_XLNX_ZYNQMP_ARM=n
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
++# CONFIG_XLNX_VERSAL=n
-     descaddr &= ~(hwaddr)(page_size - 1);
++# CONFIG_SBSA_REF=n
-     descaddr |= (address & (page_size - 1));
+diff --git a/configs/devices/arm-softmmu/default.mak b/configs/devices/arm-softmmu/default.mak
-     /* Extract attributes from the descriptor */
+index XXXXXXX..XXXXXXX 100644
--    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(52, 12));
+--- a/configs/devices/arm-softmmu/default.mak
-+    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
++++ b/configs/devices/arm-softmmu/default.mak
+@@ -XXX,XX +XXX,XX @@
-     if (regime_is_stage2(mmu_idx)) {
+ # CONFIG_TEST_DEVICES=n
-         /* Stage 2 table descriptors do not include any attribute fields */
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
+ CONFIG_ARM_VIRT=y
-     }
++
-     /* Merge in attributes from table descriptors */
++# These are selected by default when TCG is enabled, uncomment them to
-     attrs |= nstable << 5; /* NS */
++# keep out of the build.
--    guarded = extract64(descriptor, 50, 1);  /* GP */
++# CONFIG_CUBIEBOARD=n
-     if (param.hpd) {
++# CONFIG_EXYNOS4=n
-         /* HPD disables all the table attributes except NSTable.  */
++# CONFIG_HIGHBANK=n
-         goto skip_attrs;
++# CONFIG_INTEGRATOR=n
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
++# CONFIG_FSL_IMX31=n
++# CONFIG_MUSICPAL=n
-     /* When in aarch64 mode, and BTI is enabled, remember GP in the TLB.  */
++# CONFIG_MUSCA=n
-     if (aarch64 && cpu_isar_feature(aa64_bti, cpu)) {
++# CONFIG_CHEETAH=n
--        result->f.guarded = guarded;
++# CONFIG_SX1=n
-+        result->f.guarded = extract64(attrs, 50, 1); /* GP */
++# CONFIG_NSERIES=n
-     }
++# CONFIG_STELLARIS=n
++# CONFIG_STM32VLDISCOVERY=n
-     if (regime_is_stage2(mmu_idx)) {
++# CONFIG_REALVIEW=n
 +# CONFIG_VERSATILE=n
 +# CONFIG_VEXPRESS=n
 +# CONFIG_ZYNQ=n
 +# CONFIG_MAINSTONE=n
 +# CONFIG_GUMSTIX=n
 +# CONFIG_SPITZ=n
 +# CONFIG_TOSA=n
 +# CONFIG_Z2=n
 +# CONFIG_NPCM7XX=n
 +# CONFIG_COLLIE=n
 +# CONFIG_ASPEED_SOC=n
 +# CONFIG_NETDUINO2=n
 +# CONFIG_NETDUINOPLUS2=n
 +# CONFIG_OLIMEX_STM32_H405=n
 +# CONFIG_MPS2=n
 +# CONFIG_RASPI=n
 +# CONFIG_DIGIC=n
 +# CONFIG_SABRELITE=n
 +# CONFIG_EMCRAFT_SF2=n
 +# CONFIG_MICROBIT=n
 +# CONFIG_FSL_IMX25=n
 +# CONFIG_FSL_IMX7=n
 +# CONFIG_FSL_IMX6UL=n
 +# CONFIG_ALLWINNER_H3=n
 --
-.25.1
+.34.1

-[PULL 24/30] arm: re-randomize rng-seed on reboot
+[PULL 18/21] arm/Kconfig: Make TCG dependence explicit
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Fabiano Rosas <farosas@suse.de>
-When the system reboots, the rng-seed that the FDT has should be
+Replace the 'default y if TCG' pattern with 'default y; depends on
-re-randomized, so that the new boot gets a new seed. Since the FDT is in
+TCG'.
-the ROM region at this point, we add a hook right after the ROM has been
-added, so that we have a pointer to that copy of the FDT.
+That makes explict that there is a dependence on TCG and enabling
+these CONFIGs via .mak files without TCG present will fail earlier.
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Cc: qemu-arm@nongnu.org
+Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Message-id: 20221025004327.568476-5-Jason@zx2c4.com
+Reviewed-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20230523180525.29994-4-farosas@suse.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/boot.c | 2 ++
+ hw/arm/Kconfig | 123 ++++++++++++++++++++++++++++++++-----------------
-file changed, 2 insertions(+)
+file changed, 82 insertions(+), 41 deletions(-)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/hw/arm/Kconfig
-+++ b/hw/arm/boot.c
++++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
-      * the DTB is copied again upon reset, even if addr points into RAM.
-      */
+ config CHEETAH
-     rom_add_blob_fixed_as("dtb", fdt, size, addr, as);
+     bool
-+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+-    default y if TCG && ARM
-+                                       rom_ptr_for_as(as, addr, size));
++    default y
++    depends on TCG && ARM
-     g_free(fdt);
+     select OMAP
      select TSC210X
  config CUBIEBOARD
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select ALLWINNER_A10
  config DIGIC
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select PTIMER
      select PFLASH_CFI02
  config EXYNOS4
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select A9MPCORE
      select I2C
@@ -XXX,XX +XXX,XX @@ config EXYNOS4
  config HIGHBANK
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select A9MPCORE
      select A15MPCORE
      select AHCI
@@ -XXX,XX +XXX,XX @@ config HIGHBANK
  config INTEGRATOR
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select ARM_TIMER
      select INTEGRATOR_DEBUG
      select PL011 # UART
@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
  config MAINSTONE
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select PXA2XX
      select PFLASH_CFI01
      select SMC91C111
  config MUSCA
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select ARMSSE
      select PL011
      select PL031
@@ -XXX,XX +XXX,XX @@ config MARVELL_88W8618
  config MUSICPAL
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select OR_IRQ
      select BITBANG_I2C
      select MARVELL_88W8618
@@ -XXX,XX +XXX,XX @@ config MUSICPAL
  config NETDUINO2
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select STM32F205_SOC
  config NETDUINOPLUS2
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select STM32F405_SOC
  config OLIMEX_STM32_H405
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select STM32F405_SOC
  config NSERIES
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select OMAP
      select TMP105   # temperature sensor
      select BLIZZARD # LCD/TV controller
@@ -XXX,XX +XXX,XX @@ config PXA2XX
  config GUMSTIX
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select PFLASH_CFI01
      select SMC91C111
      select PXA2XX
  config TOSA
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select ZAURUS  # scoop
      select MICRODRIVE
      select PXA2XX
@@ -XXX,XX +XXX,XX @@ config TOSA
  config SPITZ
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select ADS7846 # touch-screen controller
      select MAX111X # A/D converter
      select WM8750  # audio codec
@@ -XXX,XX +XXX,XX @@ config SPITZ
  config Z2
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select PFLASH_CFI01
      select WM8750
      select PL011 # UART
@@ -XXX,XX +XXX,XX @@ config Z2
  config REALVIEW
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply PCI_DEVICES
      imply PCI_TESTDEV
      imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config REALVIEW
  config SBSA_REF
      bool
 -    default y if TCG && AARCH64
 +    default y
 +    depends on TCG && AARCH64
      imply PCI_DEVICES
      select AHCI
      select ARM_SMMUV3
@@ -XXX,XX +XXX,XX @@ config SBSA_REF
  config SABRELITE
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select FSL_IMX6
      select SSI_M25P80
  config STELLARIS
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select ARM_V7M
      select CMSDK_APB_WATCHDOG
@@ -XXX,XX +XXX,XX @@ config STELLARIS
  config STM32VLDISCOVERY
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select STM32F100_SOC
  config STRONGARM
@@ -XXX,XX +XXX,XX @@ config STRONGARM
  config COLLIE
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select PFLASH_CFI01
      select ZAURUS  # scoop
      select STRONGARM
  config SX1
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select OMAP
  config VERSATILE
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select ARM_TIMER # sp804
      select PFLASH_CFI01
      select LSI_SCSI_PCI
@@ -XXX,XX +XXX,XX @@ config VERSATILE
  config VEXPRESS
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select A9MPCORE
      select A15MPCORE
      select ARM_MPTIMER
@@ -XXX,XX +XXX,XX @@ config VEXPRESS
  config ZYNQ
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select A9MPCORE
      select CADENCE # UART
      select PFLASH_CFI02
@@ -XXX,XX +XXX,XX @@ config ZYNQ
  config ARM_V7M
      bool
      # currently v7M must be included in a TCG build due to translate.c
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select PTIMER
  config ALLWINNER_A10
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
  config ALLWINNER_H3
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select ALLWINNER_A10_PIT
      select ALLWINNER_SUN8I_EMAC
      select ALLWINNER_I2C
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
  config RASPI
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select FRAMEBUFFER
      select PL011 # UART
      select SDHCI
@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
  config XLNX_ZYNQMP_ARM
      bool
 -    default y if TCG && AARCH64
 +    default y
 +    depends on TCG && AARCH64
      select AHCI
      select ARM_GIC
      select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_ZYNQMP_ARM
  config XLNX_VERSAL
      bool
 -    default y if TCG && AARCH64
 +    default y
 +    depends on TCG && AARCH64
      select ARM_GIC
      select PL011
      select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_VERSAL
  config NPCM7XX
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select A9MPCORE
      select ADM1272
      select ARM_GIC
@@ -XXX,XX +XXX,XX @@ config NPCM7XX
  config FSL_IMX25
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select IMX
      select IMX_FEC
@@ -XXX,XX +XXX,XX @@ config FSL_IMX25
  config FSL_IMX31
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select SERIAL
      select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
  config ASPEED_SOC
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select DS1338
      select FTGMAC100
      select I2C
@@ -XXX,XX +XXX,XX @@ config ASPEED_SOC
  config MPS2
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select ARMSSE
      select LAN9118
@@ -XXX,XX +XXX,XX @@ config MPS2
  config FSL_IMX7
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply PCI_DEVICES
      imply TEST_DEVICES
      imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config ARM_SMMUV3
  config FSL_IMX6UL
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      imply I2C_DEVICES
      select A15MPCORE
      select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6UL
  config MICROBIT
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select NRF51_SOC
  config NRF51_SOC
@@ -XXX,XX +XXX,XX @@ config NRF51_SOC
  config EMCRAFT_SF2
      bool
 -    default y if TCG && ARM
 +    default y
 +    depends on TCG && ARM
      select MSF2
      select SSI_M25P80
 --
-.25.1
+.34.1

-[PULL 08/30] target/arm: Add ptw_idx to S1Translate
+[PULL 19/21] Update copyright dates to 2023
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Enze Li <lienze@kylinos.cn>
-Hoist the computation of the mmu_idx for the ptw up to
+I noticed that in the latest version, the copyright string is still
-get_phys_addr_with_struct and get_phys_addr_twostage.
+, even though 2023 is halfway through.  This patch fixes that and
-This removes the duplicate check for stage2 disabled
+fixes the documentation along with it.
 from the middle of the walk, performing it only once.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Enze Li <lienze@kylinos.cn>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20230525064345.1152801-1-lienze@kylinos.cn
 Message-id: 20221024051851.3074715-3-richard.henderson@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/ptw.c | 71 ++++++++++++++++++++++++++++++++++++------------
+ docs/conf.py              | 2 +-
-file changed, 54 insertions(+), 17 deletions(-)
+ include/qemu/help-texts.h | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+diff --git a/docs/conf.py b/docs/conf.py
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
+--- a/docs/conf.py
-+++ b/target/arm/ptw.c
++++ b/docs/conf.py
 @@ -XXX,XX +XXX,XX @@
- typedef struct S1Translate {
+ # General information about the project.
-     ARMMMUIdx in_mmu_idx;
+ project = u'QEMU'
-+    ARMMMUIdx in_ptw_idx;
+-copyright = u'2022, The QEMU Project Developers'
-     bool in_secure;
++copyright = u'2023, The QEMU Project Developers'
-     bool in_debug;
+ author = u'The QEMU Project Developers'
-     bool out_secure;
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
+ # The version info for the project you're documenting, acts as replacement for
- {
+diff --git a/include/qemu/help-texts.h b/include/qemu/help-texts.h
-     bool is_secure = ptw->in_secure;
+index XXXXXXX..XXXXXXX 100644
-     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
+--- a/include/qemu/help-texts.h
--    ARMMMUIdx s2_mmu_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
++++ b/include/qemu/help-texts.h
--    bool s2_phys = false;
+@@ -XXX,XX +XXX,XX @@
-+    ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
+ #define QEMU_HELP_TEXTS_H
-     uint8_t pte_attrs;
-     bool pte_secure;
+ /* Copyright string for -version arguments, About dialogs, etc */
+-#define QEMU_COPYRIGHT "Copyright (c) 2003-2022 " \
--    if (!arm_mmu_idx_is_stage1_of_2(mmu_idx)
++#define QEMU_COPYRIGHT "Copyright (c) 2003-2023 " \
--        || regime_translation_disabled(env, s2_mmu_idx, is_secure)) {
+     "Fabrice Bellard and the QEMU Project developers"
--        s2_mmu_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
--        s2_phys = true;
+ /* Bug reporting information for --help arguments, About dialogs, etc */
 -    }
 -
      if (unlikely(ptw->in_debug)) {
          /*
           * From gdbstub, do not use softmmu so that we don't modify the
           * state of the cpu at all, including softmmu tlb contents.
           */
 -        if (s2_phys) {
 -            ptw->out_phys = addr;
 -            pte_attrs = 0;
 -            pte_secure = is_secure;
 -        } else {
 +        if (regime_is_stage2(s2_mmu_idx)) {
              S1Translate s2ptw = {
                  .in_mmu_idx = s2_mmu_idx,
 +                .in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS,
                  .in_secure = is_secure,
                  .in_debug = true,
              };
              GetPhysAddrResult s2 = { };
 +
              if (!get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD,
                                      false, &s2, fi)) {
                  goto fail;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
              ptw->out_phys = s2.f.phys_addr;
              pte_attrs = s2.cacheattrs.attrs;
              pte_secure = s2.f.attrs.secure;
 +        } else {
 +            /* Regime is physical. */
 +            ptw->out_phys = addr;
 +            pte_attrs = 0;
 +            pte_secure = is_secure;
          }
          ptw->out_host = NULL;
      } else {
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
          pte_secure = full->attrs.secure;
      }
 -    if (!s2_phys) {
 +    if (regime_is_stage2(s2_mmu_idx)) {
          uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
          if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          descaddr |= (address >> (stride * (4 - level))) & indexmask;
          descaddr &= ~7ULL;
          nstable = extract32(tableattrs, 4, 1);
 -        ptw->in_secure = !nstable;
 +        if (!nstable) {
 +            /*
 +             * Stage2_S -> Stage2 or Phys_S -> Phys_NS
 +             * Assert that the non-secure idx are even, and relative order.
 +             */
 +            QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
 +            QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
 +            QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
 +            QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
 +            ptw->in_ptw_idx &= ~1;
 +            ptw->in_secure = false;
 +        }
          descriptor = arm_ldq_ptw(env, ptw, descaddr, fi);
          if (fi->type != ARMFault_None) {
              goto do_fault;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
      ptw->in_mmu_idx = s2walk_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
 +    ptw->in_ptw_idx = s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
      ptw->in_secure = s2walk_secure;
      /*
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
                                        ARMMMUFaultInfo *fi)
  {
      ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
 -    ARMMMUIdx s1_mmu_idx = stage_1_mmu_idx(mmu_idx);
      bool is_secure = ptw->in_secure;
 +    ARMMMUIdx s1_mmu_idx;
 -    if (mmu_idx != s1_mmu_idx) {
 +    switch (mmu_idx) {
 +    case ARMMMUIdx_Phys_S:
 +    case ARMMMUIdx_Phys_NS:
 +        /* Checking Phys early avoids special casing later vs regime_el. */
 +        return get_phys_addr_disabled(env, address, access_type, mmu_idx,
 +                                      is_secure, result, fi);
 +
 +    case ARMMMUIdx_Stage1_E0:
 +    case ARMMMUIdx_Stage1_E1:
 +    case ARMMMUIdx_Stage1_E1_PAN:
 +        /* First stage lookup uses second stage for ptw. */
 +        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
 +        break;
 +
 +    case ARMMMUIdx_E10_0:
 +        s1_mmu_idx = ARMMMUIdx_Stage1_E0;
 +        goto do_twostage;
 +    case ARMMMUIdx_E10_1:
 +        s1_mmu_idx = ARMMMUIdx_Stage1_E1;
 +        goto do_twostage;
 +    case ARMMMUIdx_E10_1_PAN:
 +        s1_mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
 +    do_twostage:
          /*
           * Call ourselves recursively to do the stage 1 and then stage 2
           * translations if mmu_idx is a two-stage regime, and EL2 present.
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
              return get_phys_addr_twostage(env, ptw, address, access_type,
                                            result, fi);
          }
 +        /* fall through */
 +
 +    default:
 +        /* Single stage and second stage uses physical for ptw. */
 +        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
 +        break;
      }
      /*
 --
-.25.1
+.34.1

-[PULL 10/30] target/arm: Extract HA and HD in aa64_va_parameters
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20221024051851.3074715-5-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/internals.h | 2 ++
- target/arm/helper.c    | 8 +++++++-
-files changed, 9 insertions(+), 1 deletion(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
-     bool hpd        : 1;
-     bool tsz_oob    : 1;  /* tsz has been clamped to legal range */
-     bool ds         : 1;
-+    bool ha         : 1;
-+    bool hd         : 1;
-     ARMGranuleSize gran : 2;
- } ARMVAParameters;
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-                                    ARMMMUIdx mmu_idx, bool data)
- {
-     uint64_t tcr = regime_tcr(env, mmu_idx);
--    bool epd, hpd, tsz_oob, ds;
-+    bool epd, hpd, tsz_oob, ds, ha, hd;
-     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
-     ARMGranuleSize gran;
-     ARMCPU *cpu = env_archcpu(env);
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-         epd = false;
-         sh = extract32(tcr, 12, 2);
-         ps = extract32(tcr, 16, 3);
-+        ha = extract32(tcr, 21, 1) && cpu_isar_feature(aa64_hafs, cpu);
-+        hd = extract32(tcr, 22, 1) && cpu_isar_feature(aa64_hdbs, cpu);
-         ds = extract64(tcr, 32, 1);
-     } else {
-         bool e0pd;
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-             e0pd = extract64(tcr, 56, 1);
-         }
-         ps = extract64(tcr, 32, 3);
-+        ha = extract64(tcr, 39, 1) && cpu_isar_feature(aa64_hafs, cpu);
-+        hd = extract64(tcr, 40, 1) && cpu_isar_feature(aa64_hdbs, cpu);
-         ds = extract64(tcr, 59, 1);
-         if (e0pd && cpu_isar_feature(aa64_e0pd, cpu) &&
-@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
-         .hpd = hpd,
-         .tsz_oob = tsz_oob,
-         .ds = ds,
-+        .ha = ha,
-+        .hd = ha && hd,
-         .gran = gran,
-     };
- }
---
-.25.1

-[PULL 12/30] target/arm: Add ARMFault_UnsuppAtomicUpdate
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-This fault type is to be used with FEAT_HAFDBS when
-the guest enables hw updates, but places the tables
-in memory where atomic updates are unsupported.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20221024051851.3074715-7-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/internals.h | 4 ++++
-file changed, 4 insertions(+)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
-+++ b/target/arm/internals.h
-@@ -XXX,XX +XXX,XX @@ typedef enum ARMFaultType {
-     ARMFault_AsyncExternal,
-     ARMFault_Debug,
-     ARMFault_TLBConflict,
-+    ARMFault_UnsuppAtomicUpdate,
-     ARMFault_Lockdown,
-     ARMFault_Exclusive,
-     ARMFault_ICacheMaint,
-@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
-     case ARMFault_TLBConflict:
-         fsc = 0x30;
-         break;
-+    case ARMFault_UnsuppAtomicUpdate:
-+        fsc = 0x31;
-+        break;
-     case ARMFault_Lockdown:
-         fsc = 0x34;
-         break;
---
-.25.1

-[PULL 13/30] target/arm: Remove loop from get_phys_addr_lpae
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-The unconditional loop was used both to iterate over levels
-and to control parsing of attributes.  Use an explicit goto
-in both cases.
-While this appears less clean for iterating over levels, we
-will need to jump back into the middle of this loop for
-atomic updates, which is even uglier.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20221024051851.3074715-8-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 192 +++++++++++++++++++++++------------------------
-file changed, 96 insertions(+), 96 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     uint64_t descaddrmask;
-     bool aarch64 = arm_el_is_aa64(env, el);
-     bool guarded = false;
-+    uint64_t descriptor;
-+    bool nstable;
-     /* TODO: This code does not support shareability levels. */
-     if (aarch64) {
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-      * bits at each step.
-      */
-     tableattrs = is_secure ? 0 : (1 << 4);
--    for (;;) {
--        uint64_t descriptor;
--        bool nstable;
--
--        descaddr |= (address >> (stride * (4 - level))) & indexmask;
--        descaddr &= ~7ULL;
--        nstable = extract32(tableattrs, 4, 1);
--        if (!nstable) {
--            /*
--             * Stage2_S -> Stage2 or Phys_S -> Phys_NS
--             * Assert that the non-secure idx are even, and relative order.
--             */
--            QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
--            QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
--            QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
--            QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
--            ptw->in_ptw_idx &= ~1;
--            ptw->in_secure = false;
--        }
--        if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
--            goto do_fault;
--        }
--        descriptor = arm_ldq_ptw(env, ptw, fi);
--        if (fi->type != ARMFault_None) {
--            goto do_fault;
--        }
--
--        if (!(descriptor & 1) ||
--            (!(descriptor & 2) && (level == 3))) {
--            /* Invalid, or the Reserved level 3 encoding */
--            goto do_fault;
--        }
--
--        descaddr = descriptor & descaddrmask;
-+ next_level:
-+    descaddr |= (address >> (stride * (4 - level))) & indexmask;
-+    descaddr &= ~7ULL;
-+    nstable = extract32(tableattrs, 4, 1);
-+    if (!nstable) {
-         /*
--         * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
--         * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
--         * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
--         * raise AddressSizeFault.
-+         * Stage2_S -> Stage2 or Phys_S -> Phys_NS
-+         * Assert that the non-secure idx are even, and relative order.
-          */
--        if (outputsize > 48) {
--            if (param.ds) {
--                descaddr |= extract64(descriptor, 8, 2) << 50;
--            } else {
--                descaddr |= extract64(descriptor, 12, 4) << 48;
--            }
--        } else if (descaddr >> outputsize) {
--            fault_type = ARMFault_AddressSize;
--            goto do_fault;
--        }
--
--        if ((descriptor & 2) && (level < 3)) {
--            /*
--             * Table entry. The top five bits are attributes which may
--             * propagate down through lower levels of the table (and
--             * which are all arranged so that 0 means "no effect", so
--             * we can gather them up by ORing in the bits at each level).
--             */
--            tableattrs |= extract64(descriptor, 59, 5);
--            level++;
--            indexmask = indexmask_grainsize;
--            continue;
--        }
--        /*
--         * Block entry at level 1 or 2, or page entry at level 3.
--         * These are basically the same thing, although the number
--         * of bits we pull in from the vaddr varies. Note that although
--         * descaddrmask masks enough of the low bits of the descriptor
--         * to give a correct page or table address, the address field
--         * in a block descriptor is smaller; so we need to explicitly
--         * clear the lower bits here before ORing in the low vaddr bits.
--         */
--        page_size = (1ULL << ((stride * (4 - level)) + 3));
--        descaddr &= ~(hwaddr)(page_size - 1);
--        descaddr |= (address & (page_size - 1));
--        /* Extract attributes from the descriptor */
--        attrs = extract64(descriptor, 2, 10)
--            | (extract64(descriptor, 52, 12) << 10);
--
--        if (regime_is_stage2(mmu_idx)) {
--            /* Stage 2 table descriptors do not include any attribute fields */
--            break;
--        }
--        /* Merge in attributes from table descriptors */
--        attrs |= nstable << 3; /* NS */
--        guarded = extract64(descriptor, 50, 1);  /* GP */
--        if (param.hpd) {
--            /* HPD disables all the table attributes except NSTable.  */
--            break;
--        }
--        attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
--        /*
--         * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
--         * means "force PL1 access only", which means forcing AP[1] to 0.
--         */
--        attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
--        attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
--        break;
-+        QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
-+        QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
-+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
-+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
-+        ptw->in_ptw_idx &= ~1;
-+        ptw->in_secure = false;
-     }
-+    if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
-+        goto do_fault;
-+    }
-+    descriptor = arm_ldq_ptw(env, ptw, fi);
-+    if (fi->type != ARMFault_None) {
-+        goto do_fault;
-+    }
-+
-+    if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
-+        /* Invalid, or the Reserved level 3 encoding */
-+        goto do_fault;
-+    }
-+
-+    descaddr = descriptor & descaddrmask;
-+
-+    /*
-+     * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
-+     * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
-+     * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
-+     * raise AddressSizeFault.
-+     */
-+    if (outputsize > 48) {
-+        if (param.ds) {
-+            descaddr |= extract64(descriptor, 8, 2) << 50;
-+        } else {
-+            descaddr |= extract64(descriptor, 12, 4) << 48;
-+        }
-+    } else if (descaddr >> outputsize) {
-+        fault_type = ARMFault_AddressSize;
-+        goto do_fault;
-+    }
-+
-+    if ((descriptor & 2) && (level < 3)) {
-+        /*
-+         * Table entry. The top five bits are attributes which may
-+         * propagate down through lower levels of the table (and
-+         * which are all arranged so that 0 means "no effect", so
-+         * we can gather them up by ORing in the bits at each level).
-+         */
-+        tableattrs |= extract64(descriptor, 59, 5);
-+        level++;
-+        indexmask = indexmask_grainsize;
-+        goto next_level;
-+    }
-+
-+    /*
-+     * Block entry at level 1 or 2, or page entry at level 3.
-+     * These are basically the same thing, although the number
-+     * of bits we pull in from the vaddr varies. Note that although
-+     * descaddrmask masks enough of the low bits of the descriptor
-+     * to give a correct page or table address, the address field
-+     * in a block descriptor is smaller; so we need to explicitly
-+     * clear the lower bits here before ORing in the low vaddr bits.
-+     */
-+    page_size = (1ULL << ((stride * (4 - level)) + 3));
-+    descaddr &= ~(hwaddr)(page_size - 1);
-+    descaddr |= (address & (page_size - 1));
-+    /* Extract attributes from the descriptor */
-+    attrs = extract64(descriptor, 2, 10)
-+        | (extract64(descriptor, 52, 12) << 10);
-+
-+    if (regime_is_stage2(mmu_idx)) {
-+        /* Stage 2 table descriptors do not include any attribute fields */
-+        goto skip_attrs;
-+    }
-+    /* Merge in attributes from table descriptors */
-+    attrs |= nstable << 3; /* NS */
-+    guarded = extract64(descriptor, 50, 1);  /* GP */
-+    if (param.hpd) {
-+        /* HPD disables all the table attributes except NSTable.  */
-+        goto skip_attrs;
-+    }
-+    attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
-+    /*
-+     * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
-+     * means "force PL1 access only", which means forcing AP[1] to 0.
-+     */
-+    attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
-+    attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
-+ skip_attrs:
-+
-     /*
-      * Here descaddr is the final physical address, and attributes
-      * are all in attrs.
---
-.25.1

-[PULL 15/30] target/arm: Don't shift attrs in get_phys_addr_lpae
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Leave the upper and lower attributes in the place they originate
-from in the descriptor.  Shifting them around is confusing, since
-one cannot read the bit numbers out of the manual.  Also, new
-attributes have been added which would alter the shifts.
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20221024051851.3074715-10-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 31 +++++++++++++++----------------
-file changed, 15 insertions(+), 16 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     hwaddr descaddr, indexmask, indexmask_grainsize;
-     uint32_t tableattrs;
-     target_ulong page_size;
--    uint32_t attrs;
-+    uint64_t attrs;
-     int32_t stride;
-     int addrsize, inputsize, outputsize;
-     uint64_t tcr = regime_tcr(env, mmu_idx);
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     descaddr &= ~(hwaddr)(page_size - 1);
-     descaddr |= (address & (page_size - 1));
-     /* Extract attributes from the descriptor */
--    attrs = extract64(descriptor, 2, 10)
--        | (extract64(descriptor, 52, 12) << 10);
-+    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(52, 12));
-     if (regime_is_stage2(mmu_idx)) {
-         /* Stage 2 table descriptors do not include any attribute fields */
-         goto skip_attrs;
-     }
-     /* Merge in attributes from table descriptors */
--    attrs |= nstable << 3; /* NS */
-+    attrs |= nstable << 5; /* NS */
-     guarded = extract64(descriptor, 50, 1);  /* GP */
-     if (param.hpd) {
-         /* HPD disables all the table attributes except NSTable.  */
-         goto skip_attrs;
-     }
--    attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
-+    attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
-     /*
-      * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
-      * means "force PL1 access only", which means forcing AP[1] to 0.
-      */
--    attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
--    attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
-+    attrs &= ~(extract64(tableattrs, 2, 1) << 6);   /* !APT[0] => AP[1] */
-+    attrs |= extract32(tableattrs, 3, 1) << 7;      /* APT[1] => AP[2] */
-  skip_attrs:
-     /*
-      * Here descaddr is the final physical address, and attributes
-      * are all in attrs.
-      */
--    if ((attrs & (1 << 8)) == 0) {
-+    if ((attrs & (1 << 10)) == 0) {
-         /* Access flag */
-         fi->type = ARMFault_AccessFlag;
-         goto do_fault;
-     }
--    ap = extract32(attrs, 4, 2);
-+    ap = extract32(attrs, 6, 2);
-     if (regime_is_stage2(mmu_idx)) {
-         ns = mmu_idx == ARMMMUIdx_Stage2;
--        xn = extract32(attrs, 11, 2);
-+        xn = extract64(attrs, 53, 2);
-         result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
-     } else {
--        ns = extract32(attrs, 3, 1);
--        xn = extract32(attrs, 12, 1);
--        pxn = extract32(attrs, 11, 1);
-+        ns = extract32(attrs, 5, 1);
-+        xn = extract64(attrs, 54, 1);
-+        pxn = extract64(attrs, 53, 1);
-         result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
-     }
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     if (regime_is_stage2(mmu_idx)) {
-         result->cacheattrs.is_s2_format = true;
--        result->cacheattrs.attrs = extract32(attrs, 0, 4);
-+        result->cacheattrs.attrs = extract32(attrs, 2, 4);
-     } else {
-         /* Index into MAIR registers for cache attributes */
--        uint8_t attrindx = extract32(attrs, 0, 3);
-+        uint8_t attrindx = extract32(attrs, 2, 3);
-         uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
-         assert(attrindx <= 7);
-         result->cacheattrs.is_s2_format = false;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
-     if (param.ds) {
-         result->cacheattrs.shareability = param.sh;
-     } else {
--        result->cacheattrs.shareability = extract32(attrs, 6, 2);
-+        result->cacheattrs.shareability = extract32(attrs, 8, 2);
-     }
-     result->f.phys_addr = descaddr;
---
-.25.1

-[PULL 26/30] m68k/virt: do not re-randomize RNG seed on snapshot load
+[PULL 20/21] hw/arm/sbsa-ref: add GIC node into DT
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-Snapshot loading is supposed to be deterministic, so we shouldn't
+Let add GIC information into DeviceTree as part of SBSA-REF versioning.
 re-randomize the various seeds used.
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Trusted Firmware will read it and provide to next firmware level.
-Message-id: 20221025004327.568476-7-Jason@zx2c4.com
 Bumps platform version to 0.1 one so we can check is node is present.
 Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/m68k/virt.c | 20 +++++++++++---------
+ hw/arm/sbsa-ref.c | 19 ++++++++++++++++++-
-file changed, 11 insertions(+), 9 deletions(-)
+file changed, 18 insertions(+), 1 deletion(-)
-diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
+diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/m68k/virt.c
+--- a/hw/arm/sbsa-ref.c
-+++ b/hw/m68k/virt.c
++++ b/hw/arm/sbsa-ref.c
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+@@ -XXX,XX +XXX,XX @@
-     M68kCPU *cpu;
+ #include "exec/hwaddr.h"
-     hwaddr initial_pc;
+ #include "kvm_arm.h"
-     hwaddr initial_stack;
+ #include "hw/arm/boot.h"
--    struct bi_record *rng_seed;
++#include "hw/arm/fdt.h"
- } ResetInfo;
+ #include "hw/arm/smmuv3.h"
+ #include "hw/block/flash.h"
- static void main_cpu_reset(void *opaque)
+ #include "hw/boards.h"
-@@ -XXX,XX +XXX,XX @@ static void main_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
-     M68kCPU *cpu = reset_info->cpu;
+     return arm_cpu_mp_affinity(idx, clustersz);
      CPUState *cs = CPU(cpu);
 -    if (reset_info->rng_seed) {
 -        qemu_guest_getrandom_nofail((void *)reset_info->rng_seed->data + 2,
 -            be16_to_cpu(*(uint16_t *)reset_info->rng_seed->data));
 -    }
 -
      cpu_reset(cs);
      cpu->env.aregs[7] = reset_info->initial_stack;
      cpu->env.pc = reset_info->initial_pc;
  }
-+static void rerandomize_rng_seed(void *opaque)
++static void sbsa_fdt_add_gic_node(SBSAMachineState *sms)
 +{
-+    struct bi_record *rng_seed = opaque;
++    char *nodename;
-+    qemu_guest_getrandom_nofail((void *)rng_seed->data + 2,
++
-+                                be16_to_cpu(*(uint16_t *)rng_seed->data));
++    nodename = g_strdup_printf("/intc");
 +    qemu_fdt_add_subnode(sms->fdt, nodename);
 +    qemu_fdt_setprop_sized_cells(sms->fdt, nodename, "reg",
 +                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].base,
 +                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].size,
 +                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].base,
 +                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].size);
 +
 +    g_free(nodename);
 +}
+ /*
+  * Firmware on this machine only uses ACPI table to load OS, these limited
+  * device tree nodes are just to let firmware know the info which varies from
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
+      *                        fw compatibility.
+      */
+     qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
+-    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 0);
++    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 1);
+     if (ms->numa_state->have_numa_distance) {
+         int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
+@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
+         g_free(nodename);
+     }
 +
- static void virt_init(MachineState *machine)
++    sbsa_fdt_add_gic_node(sms);
  {
      M68kCPU *cpu = NULL;
@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
          BOOTINFO0(param_ptr, BI_LAST);
          rom_add_blob_fixed_as("bootinfo", param_blob, param_ptr - param_blob,
                                parameters_base, cs->as);
 -        reset_info->rng_seed = rom_ptr_for_as(cs->as, parameters_base,
 -                                              param_ptr - param_blob) +
 -                               (param_rng_seed - param_blob);
 +        qemu_register_reset_nosnapshotload(rerandomize_rng_seed,
 +                            rom_ptr_for_as(cs->as, parameters_base,
 +                                           param_ptr - param_blob) +
 +                            (param_rng_seed - param_blob));
          g_free(param_blob);
      }
  }
+ #define SBSA_FLASH_SECTOR_SIZE (256 * KiB)
 --
-.25.1
+.34.1

-[PULL 23/30] x86: do not re-randomize RNG seed on snapshot load
+[PULL 21/21] docs: sbsa: correct graphics card name
-From: "Jason A. Donenfeld" <Jason@zx2c4.com>
+From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-Snapshot loading is supposed to be deterministic, so we shouldn't
+We moved from VGA to Bochs to have PCIe card.
 re-randomize the various seeds used.
-Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
+Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 Message-id: 20221025004327.568476-4-Jason@zx2c4.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/i386/x86.c | 2 +-
+ docs/system/arm/sbsa.rst | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/i386/x86.c b/hw/i386/x86.c
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/i386/x86.c
+--- a/docs/system/arm/sbsa.rst
-+++ b/hw/i386/x86.c
++++ b/docs/system/arm/sbsa.rst
-@@ -XXX,XX +XXX,XX @@ void x86_load_linux(X86MachineState *x86ms,
+@@ -XXX,XX +XXX,XX @@ The sbsa-ref board supports:
-         setup_data->type = cpu_to_le32(SETUP_RNG_SEED);
+   - System bus EHCI controller
-         setup_data->len = cpu_to_le32(RNG_SEED_LENGTH);
+   - CDROM and hard disc on AHCI bus
-         qemu_guest_getrandom_nofail(setup_data->data, RNG_SEED_LENGTH);
+   - E1000E ethernet card on PCIe bus
--        qemu_register_reset(reset_rng_seed, setup_data);
+-  - VGA display adaptor on PCIe bus
-+        qemu_register_reset_nosnapshotload(reset_rng_seed, setup_data);
++  - Bochs display adapter on PCIe bus
-         fw_cfg_add_bytes_callback(fw_cfg, FW_CFG_KERNEL_DATA, reset_rng_seed, NULL,
+   - A generic SBSA watchdog device
-                                   setup_data, kernel, kernel_size, true);
      } else {
 --
-.25.1
+.34.1

Hi; this is the latest target-arm queue. Most of the patches
here are RTH's FEAT_HAFDBS finally landing. I've also included
the RNG-seed randomization patches from Jason, as well as a few
more minor things. The patches include a couple of regression
fixes:
 * the resettable patch fixes a SCSI reset regression
 * the 'do not re-randomize on snapshot load' patches fix
   record-and-replay regressions

thanks
-- PMM

The following changes since commit e750a7ace492f0b450653d4ad368a77d6f660fb8:

Merge tag 'pull-9p-20221024' of https://github.com/cschoenebeck/qemu into staging (2022-10-24 14:27:12 -0400)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20221025

for you to fetch changes up to e2114f701c78f76246e4b1872639dad94a6bdd21:

rx: re-randomize rng-seed on reboot (2022-10-25 17:32:24 +0100)

----------------------------------------------------------------
target-arm queue:
 * Implement FEAT_E0PD
 * Implement FEAT_HAFDBS
 * honor HCR_E2H and HCR_TGE in arm_excp_unmasked()
 * hw/arm/virt: Fix devicetree warnings about the virtio-iommu node
 * hw/core/resettable: fix reset level counting
 * hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset()
 * imx: reload cmp timer outside of the reload ptimer transaction
 * x86: do not re-randomize RNG seed on snapshot load
 * m68k/virt: do not re-randomize RNG seed on snapshot load
 * m68k/q800: do not re-randomize RNG seed on snapshot load
 * arm: re-randomize rng-seed on reboot
 * riscv: re-randomize rng-seed on reboot
 * mips/boston: re-randomize rng-seed on reboot
 * openrisc: re-randomize rng-seed on reboot
 * rx: re-randomize rng-seed on reboot

----------------------------------------------------------------
Ake Koomsin (1):
      target/arm: honor HCR_E2H and HCR_TGE in arm_excp_unmasked()

Axel Heider (1):
      target/imx: reload cmp timer outside of the reload ptimer transaction

Damien Hedde (1):
      hw/core/resettable: fix reset level counting

Jason A. Donenfeld (10):
      reset: allow registering handlers that aren't called by snapshot loading
      device-tree: add re-randomization helper function
      x86: do not re-randomize RNG seed on snapshot load
      arm: re-randomize rng-seed on reboot
      riscv: re-randomize rng-seed on reboot
      m68k/virt: do not re-randomize RNG seed on snapshot load
      m68k/q800: do not re-randomize RNG seed on snapshot load
      mips/boston: re-randomize rng-seed on reboot
      openrisc: re-randomize rng-seed on reboot
      rx: re-randomize rng-seed on reboot

Jean-Philippe Brucker (1):
      hw/arm/virt: Fix devicetree warnings about the virtio-iommu node

Peter Maydell (2):
      target/arm: Implement FEAT_E0PD
      hw/hyperv/hyperv.c: Use device_cold_reset() instead of device_legacy_reset()

Richard Henderson (14):
      target/arm: Introduce regime_is_stage2
      target/arm: Add ptw_idx to S1Translate
      target/arm: Add isar predicates for FEAT_HAFDBS
      target/arm: Extract HA and HD in aa64_va_parameters
      target/arm: Move S1_ptw_translate outside arm_ld[lq]_ptw
      target/arm: Add ARMFault_UnsuppAtomicUpdate
      target/arm: Remove loop from get_phys_addr_lpae
      target/arm: Fix fault reporting in get_phys_addr_lpae
      target/arm: Don't shift attrs in get_phys_addr_lpae
      target/arm: Consider GP an attribute in get_phys_addr_lpae
      target/arm: Tidy merging of attributes from descriptor and table
      target/arm: Implement FEAT_HAFDBS, access flag portion
      target/arm: Implement FEAT_HAFDBS, dirty bit portion
      target/arm: Use the max page size in a 2-stage ptw

FEAT_E0PD adds new bits E0PD0 and E0PD1 to TCR_EL1, which allow the
OS to forbid EL0 access to half of the address space.  Since this is
an EL0-specific variation on the existing TCR_ELx.{EPD0,EPD1}, we can
implement it entirely in aa64_va_parameters().

This requires moving the existing regime_is_user() to internals.h
so that the code in helper.c can get at it.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20221021160131.3531787-1-peter.maydell@linaro.org
---
 docs/system/arm/emulation.rst |  1 +
 target/arm/cpu.h              |  5 +++++
 target/arm/internals.h        | 19 +++++++++++++++++++
 target/arm/cpu64.c            |  1 +
 target/arm/helper.c           |  9 +++++++++
 target/arm/ptw.c              | 19 -------------------
 6 files changed, 35 insertions(+), 19 deletions(-)

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

The "PCI Bus Binding to: IEEE Std 1275-1994" defines the compatible
string for a PCIe bus or endpoint as "pci<vendorid>,<deviceid>" or
similar. Since the initial binding for PCI virtio-iommu didn't follow
this rule, it was modified to accept both strings and ensure backward
compatibility. Also, the unit-name for the node should be
"device,function".

Fix corresponding dt-validate and dtc warnings:

pcie@10000000: virtio_iommu@16:compatible: ['virtio,pci-iommu'] does not contain items matching the given schema
  pcie@10000000: Unevaluated properties are not allowed (... 'virtio_iommu@16' were unexpected)
  From schema: linux/Documentation/devicetree/bindings/pci/host-generic-pci.yaml
  virtio_iommu@16: compatible: 'oneOf' conditional failed, one must be fixed:
        ['virtio,pci-iommu'] is too short
        'pci1af4,1057' was expected
  From schema: dtschema/schemas/pci/pci-bus.yaml

Warning (pci_device_reg): /pcie@10000000/virtio_iommu@16: PCI unit address format error, expected "2,0"

Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void create_smmu(const VirtMachineState *vms,
 
 static void create_virtio_iommu_dt_bindings(VirtMachineState *vms)
 {
-    const char compat[] = "virtio,pci-iommu";
+    const char compat[] = "virtio,pci-iommu\0pci1af4,1057";
     uint16_t bdf = vms->virtio_iommu_bdf;
     MachineState *ms = MACHINE(vms);
     char *node;
 
     vms->iommu_phandle = qemu_fdt_alloc_phandle(ms->fdt);
 
-    node = g_strdup_printf("%s/virtio_iommu@%d", vms->pciehb_nodename, bdf);
+    node = g_strdup_printf("%s/virtio_iommu@%x,%x", vms->pciehb_nodename,
+                           PCI_SLOT(bdf), PCI_FUNC(bdf));
     qemu_fdt_add_subnode(ms->fdt, node);
     qemu_fdt_setprop(ms->fdt, node, "compatible", compat, sizeof(compat));
     qemu_fdt_setprop_sized_cells(ms->fdt, node, "reg",
-- 
2.25.1

From: Ake Koomsin <ake@igel.co.jp>

An exception targeting EL2 from lower EL is actually maskable when
HCR_E2H and HCR_TGE are both set. This applies to both secure and
non-secure Security state.

We can remove the conditions that try to suppress masking of
interrupts when we are Secure and the exception targets EL2 and
Secure EL2 is disabled.  This is OK because in that situation
arm_phys_excp_target_el() will never return 2 as the target EL.  The
'not if secure' check in this function was originally written before
arm_hcr_el2_eff(), and back then the target EL returned by
arm_phys_excp_target_el() could be 2 even if we were in Secure
EL0/EL1; but it is no longer needed.

Signed-off-by: Ake Koomsin <ake@igel.co.jp>
Message-id: 20221017092432.546881-1-ake@igel.co.jp
[PMM: Add commit message paragraph explaining why it's OK to
 remove the checks on secure and SCR_EEL2]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.c | 24 +++++++++++++++++-------
 1 file changed, 17 insertions(+), 7 deletions(-)

diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@ static inline bool arm_excp_unmasked(CPUState *cs, unsigned int excp_idx,
     if ((target_el > cur_el) && (target_el != 1)) {
         /* Exceptions targeting a higher EL may not be maskable */
         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
-            /*
-             * 64-bit masking rules are simple: exceptions to EL3
-             * can't be masked, and exceptions to EL2 can only be
-             * masked from Secure state. The HCR and SCR settings
-             * don't affect the masking logic, only the interrupt routing.
-             */
-            if (target_el == 3 || !secure || (env->cp15.scr_el3 & SCR_EEL2)) {
+            switch (target_el) {
+            case 2:
+                /*
+                 * According to ARM DDI 0487H.a, an interrupt can be masked
+                 * when HCR_E2H and HCR_TGE are both set regardless of the
+                 * current Security state. Note that we need to revisit this
+                 * part again once we need to support NMI.
+                 */
+                if ((hcr_el2 & (HCR_E2H | HCR_TGE)) != (HCR_E2H | HCR_TGE)) {
+                        unmasked = true;
+                }
+                break;
+            case 3:
+                /* Interrupt cannot be masked when the target EL is 3 */
                 unmasked = true;
+                break;
+            default:
+                g_assert_not_reached();
             }
         } else {
             /*
-- 
2.25.1

From: Damien Hedde <damien.hedde@greensocs.com>

The code for handling the reset level count in the Resettable code
has two issues:

The reset count is only decremented for the 1->0 case.  This means
that if there's ever a nested reset that takes the count to 2 then it
will never again be decremented.  Eventually the count will exceed
the '50' limit in resettable_phase_enter() and QEMU will trip over
the assertion failure.  The repro case in issue 1266 is an example of
this that happens now the SCSI subsystem uses three-phase reset.

Secondly, the count is decremented only after the exit phase handler
is called.  Moving the reset count decrement from "just after" to
"just before" calling the exit phase handler allows
resettable_is_in_reset() to return false during the handler
execution.

This simplifies reset handling in resettable devices.  Typically, a
function that updates the device state will just need to read the
current reset state and not anymore treat the "in a reset-exit
transition" as a special case.

Note that the semantics change to the *_is_in_reset() functions
will have no effect on the current codebase, because only two
devices (hw/char/cadence_uart.c and hw/misc/zynq_sclr.c) currently
call those functions, and in neither case do they do it from the
device's exit phase methed.

Fixes: 4a5fc890 ("scsi: Use device_cold_reset() and bus_cold_reset()")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1266
Signed-off-by: Damien Hedde <damien.hedde@greensocs.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reported-by: Michael Peter <michael.peter@hensoldt-cyber.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20221020142749.3357951-1-peter.maydell@linaro.org
Buglink: https://bugs.launchpad.net/qemu/+bug/1905297
Reported-by: Michael Peter <michael.peter@hensoldt-cyber.com>
[PMM: adjust the docs paragraph changed to get the name of the
 'enter' phase right and to clarify exactly when the count is
 adjusted; rewrite the commit message]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/devel/reset.rst | 8 +++++---
 hw/core/resettable.c | 3 +--
 2 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/docs/devel/reset.rst b/docs/devel/reset.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/reset.rst
+++ b/docs/devel/reset.rst
@@ -XXX,XX +XXX,XX @@ Polling the reset state
 Resettable interface provides the ``resettable_is_in_reset()`` function.
 This function returns true if the object parameter is currently under reset.
 
-An object is under reset from the beginning of the *init* phase to the end of
-the *exit* phase. During all three phases, the function will return that the
-object is in reset.
+An object is under reset from the beginning of the *enter* phase (before
+either its children or its own enter method is called) to the *exit*
+phase. During *enter* and *hold* phase only, the function will return that the
+object is in reset. The state is changed after the *exit* is propagated to
+its children and just before calling the object's own *exit* method.
 
 This function may be used if the object behavior has to be adapted
 while in reset state. For example if a device has an irq input,
diff --git a/hw/core/resettable.c b/hw/core/resettable.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/resettable.c
+++ b/hw/core/resettable.c
@@ -XXX,XX +XXX,XX @@ static void resettable_phase_exit(Object *obj, void *opaque, ResetType type)
     resettable_child_foreach(rc, obj, resettable_phase_exit, NULL, type);
 
     assert(s->count > 0);
-    if (s->count == 1) {
+    if (--s->count == 0) {
         trace_resettable_phase_exit_exec(obj, obj_typename, !!rc->phases.exit);
         if (rc->phases.exit && !resettable_get_tr_func(rc, obj)) {
             rc->phases.exit(obj);
         }
-        s->count = 0;
     }
     s->exit_phase_in_progress = false;
     trace_resettable_phase_exit_end(obj, obj_typename, s->count);
-- 
2.25.1

The semantic difference between the deprecated device_legacy_reset()
function and the newer device_cold_reset() function is that the new
function resets both the device itself and any qbuses it owns,
whereas the legacy function resets just the device itself and nothing
else.  In hyperv_synic_reset() we reset a SynICState, which has no
qbuses, so for this purpose the two functions behave identically and
we can stop using the deprecated one.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Maciej S. Szmigiero <maciej.szmigiero@oracle.com>
Message-id: 20221013171817.1447562-1-peter.maydell@linaro.org
---
 hw/hyperv/hyperv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/hyperv/hyperv.c b/hw/hyperv/hyperv.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/hyperv/hyperv.c
+++ b/hw/hyperv/hyperv.c
@@ -XXX,XX +XXX,XX @@ void hyperv_synic_reset(CPUState *cs)
     SynICState *synic = get_synic(cs);
 
     if (synic) {
-        device_legacy_reset(DEVICE(synic));
+        device_cold_reset(DEVICE(synic));
     }
 }
 
-- 
2.25.1

From: Axel Heider <axel.heider@hensoldt.net>

When running seL4 tests (https://docs.sel4.systems/projects/sel4test)
on the sabrelight platform, the timer tests fail. The arm/imx6 EPIT
timer interrupt does not fire properly, instead of a e.g. second in
can take up to a minute to finally see the interrupt.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1263

Signed-off-by: Axel Heider <axel.heider@hensoldt.net>
Message-id: 166663118138.13362.1229967229046092876-0@git.sr.ht
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/imx_epit.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/hw/timer/imx_epit.c b/hw/timer/imx_epit.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/imx_epit.c
+++ b/hw/timer/imx_epit.c
@@ -XXX,XX +XXX,XX @@ static void imx_epit_write(void *opaque, hwaddr offset, uint64_t value,
             /* If IOVW bit is set then set the timer value */
             ptimer_set_count(s->timer_reload, s->lr);
         }
-
+        /*
+         * Commit the change to s->timer_reload, so it can propagate. Otherwise
+         * the timer interrupt may not fire properly. The commit must happen
+         * before calling imx_epit_reload_compare_timer(), which reads
+         * s->timer_reload internally again.
+         */
+        ptimer_transaction_commit(s->timer_reload);
         imx_epit_reload_compare_timer(s);
         ptimer_transaction_commit(s->timer_cmp);
-        ptimer_transaction_commit(s->timer_reload);
         break;
 
     case 3: /* CMP */
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reduce the amount of typing required for this check.

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h |  5 +++++
 target/arm/helper.c    | 14 +++++---------
 target/arm/ptw.c       | 14 ++++++--------
 3 files changed, 16 insertions(+), 17 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline bool regime_is_pan(CPUARMState *env, ARMMMUIdx mmu_idx)
     }
 }
 
+static inline bool regime_is_stage2(ARMMMUIdx mmu_idx)
+{
+    return mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
+}
+
 /* Return the exception level which controls this address translation regime */
 static inline uint32_t regime_el(CPUARMState *env, ARMMMUIdx mmu_idx)
 {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ int aa64_va_parameter_tbi(uint64_t tcr, ARMMMUIdx mmu_idx)
 {
     if (regime_has_2_ranges(mmu_idx)) {
         return extract64(tcr, 37, 2);
-    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+    } else if (regime_is_stage2(mmu_idx)) {
         return 0; /* VTCR_EL2 */
     } else {
         /* Replicate the single TBI bit so we always have 2 bits.  */
@@ -XXX,XX +XXX,XX @@ int aa64_va_parameter_tbid(uint64_t tcr, ARMMMUIdx mmu_idx)
 {
     if (regime_has_2_ranges(mmu_idx)) {
         return extract64(tcr, 51, 2);
-    } else if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+    } else if (regime_is_stage2(mmu_idx)) {
         return 0; /* VTCR_EL2 */
     } else {
         /* Replicate the single TBID bit so we always have 2 bits.  */
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
     ARMGranuleSize gran;
     ARMCPU *cpu = env_archcpu(env);
-    bool stage2 = mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S;
+    bool stage2 = regime_is_stage2(mmu_idx);
 
     if (!regime_has_2_ranges(mmu_idx)) {
         select = 0;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         }
         ds = false;
     } else if (ds) {
-        switch (mmu_idx) {
-        case ARMMMUIdx_Stage2:
-        case ARMMMUIdx_Stage2_S:
+        if (regime_is_stage2(mmu_idx)) {
             if (gran == Gran16K) {
                 ds = cpu_isar_feature(aa64_tgran16_2_lpa2, cpu);
             } else {
                 ds = cpu_isar_feature(aa64_tgran4_2_lpa2, cpu);
             }
-            break;
-        default:
+        } else {
             if (gran == Gran16K) {
                 ds = cpu_isar_feature(aa64_tgran16_lpa2, cpu);
             } else {
                 ds = cpu_isar_feature(aa64_tgran4_lpa2, cpu);
             }
-            break;
         }
         if (ds) {
             min_tsz = 12;
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
     bool have_wxn;
     int wxn = 0;
 
-    assert(mmu_idx != ARMMMUIdx_Stage2);
-    assert(mmu_idx != ARMMMUIdx_Stage2_S);
+    assert(!regime_is_stage2(mmu_idx));
 
     user_rw = simple_ap_to_rw_prot_is_user(ap, true);
     if (is_user) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         goto do_fault;
     }
 
-    if (mmu_idx != ARMMMUIdx_Stage2 && mmu_idx != ARMMMUIdx_Stage2_S) {
+    if (!regime_is_stage2(mmu_idx)) {
         /*
          * The starting level depends on the virtual address size (which can
          * be up to 48 bits) and the translation granule size. It indicates
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         attrs = extract64(descriptor, 2, 10)
             | (extract64(descriptor, 52, 12) << 10);
 
-        if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+        if (regime_is_stage2(mmu_idx)) {
             /* Stage 2 table descriptors do not include any attribute fields */
             break;
         }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 
     ap = extract32(attrs, 4, 2);
 
-    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+    if (regime_is_stage2(mmu_idx)) {
         ns = mmu_idx == ARMMMUIdx_Stage2;
         xn = extract32(attrs, 11, 2);
         result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         result->f.guarded = guarded;
     }
 
-    if (mmu_idx == ARMMMUIdx_Stage2 || mmu_idx == ARMMMUIdx_Stage2_S) {
+    if (regime_is_stage2(mmu_idx)) {
         result->cacheattrs.is_s2_format = true;
         result->cacheattrs.attrs = extract32(attrs, 0, 4);
     } else {
@@ -XXX,XX +XXX,XX @@ do_fault:
     fi->type = fault_type;
     fi->level = level;
     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
-    fi->stage2 = fi->s1ptw || (mmu_idx == ARMMMUIdx_Stage2 ||
-                               mmu_idx == ARMMMUIdx_Stage2_S);
+    fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
     fi->s1ns = mmu_idx == ARMMMUIdx_Stage2;
     return true;
 }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Hoist the computation of the mmu_idx for the ptw up to
get_phys_addr_with_struct and get_phys_addr_twostage.
This removes the duplicate check for stage2 disabled
from the middle of the walk, performing it only once.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 71 ++++++++++++++++++++++++++++++++++++------------
 1 file changed, 54 insertions(+), 17 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@
 
 typedef struct S1Translate {
     ARMMMUIdx in_mmu_idx;
+    ARMMMUIdx in_ptw_idx;
     bool in_secure;
     bool in_debug;
     bool out_secure;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
 {
     bool is_secure = ptw->in_secure;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-    ARMMMUIdx s2_mmu_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
-    bool s2_phys = false;
+    ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
     uint8_t pte_attrs;
     bool pte_secure;
 
-    if (!arm_mmu_idx_is_stage1_of_2(mmu_idx)
-        || regime_translation_disabled(env, s2_mmu_idx, is_secure)) {
-        s2_mmu_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
-        s2_phys = true;
-    }
-
     if (unlikely(ptw->in_debug)) {
         /*
          * From gdbstub, do not use softmmu so that we don't modify the
          * state of the cpu at all, including softmmu tlb contents.
          */
-        if (s2_phys) {
-            ptw->out_phys = addr;
-            pte_attrs = 0;
-            pte_secure = is_secure;
-        } else {
+        if (regime_is_stage2(s2_mmu_idx)) {
             S1Translate s2ptw = {
                 .in_mmu_idx = s2_mmu_idx,
+                .in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS,
                 .in_secure = is_secure,
                 .in_debug = true,
             };
             GetPhysAddrResult s2 = { };
+
             if (!get_phys_addr_lpae(env, &s2ptw, addr, MMU_DATA_LOAD,
                                     false, &s2, fi)) {
                 goto fail;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
             ptw->out_phys = s2.f.phys_addr;
             pte_attrs = s2.cacheattrs.attrs;
             pte_secure = s2.f.attrs.secure;
+        } else {
+            /* Regime is physical. */
+            ptw->out_phys = addr;
+            pte_attrs = 0;
+            pte_secure = is_secure;
         }
         ptw->out_host = NULL;
     } else {
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
         pte_secure = full->attrs.secure;
     }
 
-    if (!s2_phys) {
+    if (regime_is_stage2(s2_mmu_idx)) {
         uint64_t hcr = arm_hcr_el2_eff_secstate(env, is_secure);
 
         if ((hcr & HCR_PTW) && S2_attrs_are_device(hcr, pte_attrs)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         descaddr |= (address >> (stride * (4 - level))) & indexmask;
         descaddr &= ~7ULL;
         nstable = extract32(tableattrs, 4, 1);
-        ptw->in_secure = !nstable;
+        if (!nstable) {
+            /*
+             * Stage2_S -> Stage2 or Phys_S -> Phys_NS
+             * Assert that the non-secure idx are even, and relative order.
+             */
+            QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
+            QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
+            QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
+            QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
+            ptw->in_ptw_idx &= ~1;
+            ptw->in_secure = false;
+        }
         descriptor = arm_ldq_ptw(env, ptw, descaddr, fi);
         if (fi->type != ARMFault_None) {
             goto do_fault;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
 
     is_el0 = ptw->in_mmu_idx == ARMMMUIdx_Stage1_E0;
     ptw->in_mmu_idx = s2walk_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
+    ptw->in_ptw_idx = s2walk_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
     ptw->in_secure = s2walk_secure;
 
     /*
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
                                       ARMMMUFaultInfo *fi)
 {
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-    ARMMMUIdx s1_mmu_idx = stage_1_mmu_idx(mmu_idx);
     bool is_secure = ptw->in_secure;
+    ARMMMUIdx s1_mmu_idx;
 
-    if (mmu_idx != s1_mmu_idx) {
+    switch (mmu_idx) {
+    case ARMMMUIdx_Phys_S:
+    case ARMMMUIdx_Phys_NS:
+        /* Checking Phys early avoids special casing later vs regime_el. */
+        return get_phys_addr_disabled(env, address, access_type, mmu_idx,
+                                      is_secure, result, fi);
+
+    case ARMMMUIdx_Stage1_E0:
+    case ARMMMUIdx_Stage1_E1:
+    case ARMMMUIdx_Stage1_E1_PAN:
+        /* First stage lookup uses second stage for ptw. */
+        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
+        break;
+
+    case ARMMMUIdx_E10_0:
+        s1_mmu_idx = ARMMMUIdx_Stage1_E0;
+        goto do_twostage;
+    case ARMMMUIdx_E10_1:
+        s1_mmu_idx = ARMMMUIdx_Stage1_E1;
+        goto do_twostage;
+    case ARMMMUIdx_E10_1_PAN:
+        s1_mmu_idx = ARMMMUIdx_Stage1_E1_PAN;
+    do_twostage:
         /*
          * Call ourselves recursively to do the stage 1 and then stage 2
          * translations if mmu_idx is a two-stage regime, and EL2 present.
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_with_struct(CPUARMState *env, S1Translate *ptw,
             return get_phys_addr_twostage(env, ptw, address, access_type,
                                           result, fi);
         }
+        /* fall through */
+
+    default:
+        /* Single stage and second stage uses physical for ptw. */
+        ptw->in_ptw_idx = is_secure ? ARMMMUIdx_Phys_S : ARMMMUIdx_Phys_NS;
+        break;
     }
 
     /*
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The MMFR1 field may indicate support for hardware update of
access flag alone, or access flag and dirty bit.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-4-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_e0pd(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64mmfr2, ID_AA64MMFR2, E0PD) != 0;
 }
 
+static inline bool isar_feature_aa64_hafs(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, HAFDBS) != 0;
+}
+
+static inline bool isar_feature_aa64_hdbs(const ARMISARegisters *id)
+{
+    return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, HAFDBS) >= 2;
+}
+
 static inline bool isar_feature_aa64_tts2uxn(const ARMISARegisters *id)
 {
     return FIELD_EX64(id->id_aa64mmfr1, ID_AA64MMFR1, XNX) != 0;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-5-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 2 ++
 target/arm/helper.c    | 8 +++++++-
 2 files changed, 9 insertions(+), 1 deletion(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ typedef struct ARMVAParameters {
     bool hpd        : 1;
     bool tsz_oob    : 1;  /* tsz has been clamped to legal range */
     bool ds         : 1;
+    bool ha         : 1;
+    bool hd         : 1;
     ARMGranuleSize gran : 2;
 } ARMVAParameters;
 
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
                                    ARMMMUIdx mmu_idx, bool data)
 {
     uint64_t tcr = regime_tcr(env, mmu_idx);
-    bool epd, hpd, tsz_oob, ds;
+    bool epd, hpd, tsz_oob, ds, ha, hd;
     int select, tsz, tbi, max_tsz, min_tsz, ps, sh;
     ARMGranuleSize gran;
     ARMCPU *cpu = env_archcpu(env);
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         epd = false;
         sh = extract32(tcr, 12, 2);
         ps = extract32(tcr, 16, 3);
+        ha = extract32(tcr, 21, 1) && cpu_isar_feature(aa64_hafs, cpu);
+        hd = extract32(tcr, 22, 1) && cpu_isar_feature(aa64_hdbs, cpu);
         ds = extract64(tcr, 32, 1);
     } else {
         bool e0pd;
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
             e0pd = extract64(tcr, 56, 1);
         }
         ps = extract64(tcr, 32, 3);
+        ha = extract64(tcr, 39, 1) && cpu_isar_feature(aa64_hafs, cpu);
+        hd = extract64(tcr, 40, 1) && cpu_isar_feature(aa64_hdbs, cpu);
         ds = extract64(tcr, 59, 1);
 
         if (e0pd && cpu_isar_feature(aa64_e0pd, cpu) &&
@@ -XXX,XX +XXX,XX @@ ARMVAParameters aa64_va_parameters(CPUARMState *env, uint64_t va,
         .hpd = hpd,
         .tsz_oob = tsz_oob,
         .ds = ds,
+        .ha = ha,
+        .hd = ha && hd,
         .gran = gran,
     };
 }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Separate S1 translation from the actual lookup.
Will enable lpae hardware updates.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-6-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 41 ++++++++++++++++++++++-------------------
 1 file changed, 22 insertions(+), 19 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
 }
 
 /* All loads done in the course of a page table walk go through here. */
-static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
+static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
                             ARMMMUFaultInfo *fi)
 {
     CPUState *cs = env_cpu(env);
     uint32_t data;
 
-    if (!S1_ptw_translate(env, ptw, addr, fi)) {
-        /* Failure. */
-        assert(fi->s1ptw);
-        return 0;
-    }
-
     if (likely(ptw->out_host)) {
         /* Page tables are in RAM, and we have the host address. */
         if (ptw->out_be) {
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
     return data;
 }
 
-static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw, hwaddr addr,
+static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
                             ARMMMUFaultInfo *fi)
 {
     CPUState *cs = env_cpu(env);
     uint64_t data;
 
-    if (!S1_ptw_translate(env, ptw, addr, fi)) {
-        /* Failure. */
-        assert(fi->s1ptw);
-        return 0;
-    }
-
     if (likely(ptw->out_host)) {
         /* Page tables are in RAM, and we have the host address. */
         if (ptw->out_be) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
         fi->type = ARMFault_Translation;
         goto do_fault;
     }
-    desc = arm_ldl_ptw(env, ptw, table, fi);
+    if (!S1_ptw_translate(env, ptw, table, fi)) {
+        goto do_fault;
+    }
+    desc = arm_ldl_ptw(env, ptw, fi);
     if (fi->type != ARMFault_None) {
         goto do_fault;
     }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v5(CPUARMState *env, S1Translate *ptw,
             /* Fine pagetable.  */
             table = (desc & 0xfffff000) | ((address >> 8) & 0xffc);
         }
-        desc = arm_ldl_ptw(env, ptw, table, fi);
+        if (!S1_ptw_translate(env, ptw, table, fi)) {
+            goto do_fault;
+        }
+        desc = arm_ldl_ptw(env, ptw, fi);
         if (fi->type != ARMFault_None) {
             goto do_fault;
         }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
         fi->type = ARMFault_Translation;
         goto do_fault;
     }
-    desc = arm_ldl_ptw(env, ptw, table, fi);
+    if (!S1_ptw_translate(env, ptw, table, fi)) {
+        goto do_fault;
+    }
+    desc = arm_ldl_ptw(env, ptw, fi);
     if (fi->type != ARMFault_None) {
         goto do_fault;
     }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_v6(CPUARMState *env, S1Translate *ptw,
         ns = extract32(desc, 3, 1);
         /* Lookup l2 entry.  */
         table = (desc & 0xfffffc00) | ((address >> 10) & 0x3fc);
-        desc = arm_ldl_ptw(env, ptw, table, fi);
+        if (!S1_ptw_translate(env, ptw, table, fi)) {
+            goto do_fault;
+        }
+        desc = arm_ldl_ptw(env, ptw, fi);
         if (fi->type != ARMFault_None) {
             goto do_fault;
         }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
             ptw->in_ptw_idx &= ~1;
             ptw->in_secure = false;
         }
-        descriptor = arm_ldq_ptw(env, ptw, descaddr, fi);
+        if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
+            goto do_fault;
+        }
+        descriptor = arm_ldq_ptw(env, ptw, fi);
         if (fi->type != ARMFault_None) {
             goto do_fault;
         }
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

This fault type is to be used with FEAT_HAFDBS when
the guest enables hw updates, but places the tables
in memory where atomic updates are unsupported.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-7-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ typedef enum ARMFaultType {
     ARMFault_AsyncExternal,
     ARMFault_Debug,
     ARMFault_TLBConflict,
+    ARMFault_UnsuppAtomicUpdate,
     ARMFault_Lockdown,
     ARMFault_Exclusive,
     ARMFault_ICacheMaint,
@@ -XXX,XX +XXX,XX @@ static inline uint32_t arm_fi_to_lfsc(ARMMMUFaultInfo *fi)
     case ARMFault_TLBConflict:
         fsc = 0x30;
         break;
+    case ARMFault_UnsuppAtomicUpdate:
+        fsc = 0x31;
+        break;
     case ARMFault_Lockdown:
         fsc = 0x34;
         break;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The unconditional loop was used both to iterate over levels
and to control parsing of attributes.  Use an explicit goto
in both cases.

While this appears less clean for iterating over levels, we
will need to jump back into the middle of this loop for
atomic updates, which is even uglier.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-8-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 192 +++++++++++++++++++++++------------------------
 1 file changed, 96 insertions(+), 96 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     uint64_t descaddrmask;
     bool aarch64 = arm_el_is_aa64(env, el);
     bool guarded = false;
+    uint64_t descriptor;
+    bool nstable;
 
     /* TODO: This code does not support shareability levels. */
     if (aarch64) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      * bits at each step.
      */
     tableattrs = is_secure ? 0 : (1 << 4);
-    for (;;) {
-        uint64_t descriptor;
-        bool nstable;
-
-        descaddr |= (address >> (stride * (4 - level))) & indexmask;
-        descaddr &= ~7ULL;
-        nstable = extract32(tableattrs, 4, 1);
-        if (!nstable) {
-            /*
-             * Stage2_S -> Stage2 or Phys_S -> Phys_NS
-             * Assert that the non-secure idx are even, and relative order.
-             */
-            QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
-            QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
-            QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
-            QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
-            ptw->in_ptw_idx &= ~1;
-            ptw->in_secure = false;
-        }
-        if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
-            goto do_fault;
-        }
-        descriptor = arm_ldq_ptw(env, ptw, fi);
-        if (fi->type != ARMFault_None) {
-            goto do_fault;
-        }
-
-        if (!(descriptor & 1) ||
-            (!(descriptor & 2) && (level == 3))) {
-            /* Invalid, or the Reserved level 3 encoding */
-            goto do_fault;
-        }
-
-        descaddr = descriptor & descaddrmask;
 
+ next_level:
+    descaddr |= (address >> (stride * (4 - level))) & indexmask;
+    descaddr &= ~7ULL;
+    nstable = extract32(tableattrs, 4, 1);
+    if (!nstable) {
         /*
-         * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
-         * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
-         * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
-         * raise AddressSizeFault.
+         * Stage2_S -> Stage2 or Phys_S -> Phys_NS
+         * Assert that the non-secure idx are even, and relative order.
          */
-        if (outputsize > 48) {
-            if (param.ds) {
-                descaddr |= extract64(descriptor, 8, 2) << 50;
-            } else {
-                descaddr |= extract64(descriptor, 12, 4) << 48;
-            }
-        } else if (descaddr >> outputsize) {
-            fault_type = ARMFault_AddressSize;
-            goto do_fault;
-        }
-
-        if ((descriptor & 2) && (level < 3)) {
-            /*
-             * Table entry. The top five bits are attributes which may
-             * propagate down through lower levels of the table (and
-             * which are all arranged so that 0 means "no effect", so
-             * we can gather them up by ORing in the bits at each level).
-             */
-            tableattrs |= extract64(descriptor, 59, 5);
-            level++;
-            indexmask = indexmask_grainsize;
-            continue;
-        }
-        /*
-         * Block entry at level 1 or 2, or page entry at level 3.
-         * These are basically the same thing, although the number
-         * of bits we pull in from the vaddr varies. Note that although
-         * descaddrmask masks enough of the low bits of the descriptor
-         * to give a correct page or table address, the address field
-         * in a block descriptor is smaller; so we need to explicitly
-         * clear the lower bits here before ORing in the low vaddr bits.
-         */
-        page_size = (1ULL << ((stride * (4 - level)) + 3));
-        descaddr &= ~(hwaddr)(page_size - 1);
-        descaddr |= (address & (page_size - 1));
-        /* Extract attributes from the descriptor */
-        attrs = extract64(descriptor, 2, 10)
-            | (extract64(descriptor, 52, 12) << 10);
-
-        if (regime_is_stage2(mmu_idx)) {
-            /* Stage 2 table descriptors do not include any attribute fields */
-            break;
-        }
-        /* Merge in attributes from table descriptors */
-        attrs |= nstable << 3; /* NS */
-        guarded = extract64(descriptor, 50, 1);  /* GP */
-        if (param.hpd) {
-            /* HPD disables all the table attributes except NSTable.  */
-            break;
-        }
-        attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
-        /*
-         * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
-         * means "force PL1 access only", which means forcing AP[1] to 0.
-         */
-        attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
-        attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
-        break;
+        QEMU_BUILD_BUG_ON((ARMMMUIdx_Phys_NS & 1) != 0);
+        QEMU_BUILD_BUG_ON((ARMMMUIdx_Stage2 & 1) != 0);
+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Phys_NS + 1 != ARMMMUIdx_Phys_S);
+        QEMU_BUILD_BUG_ON(ARMMMUIdx_Stage2 + 1 != ARMMMUIdx_Stage2_S);
+        ptw->in_ptw_idx &= ~1;
+        ptw->in_secure = false;
     }
+    if (!S1_ptw_translate(env, ptw, descaddr, fi)) {
+        goto do_fault;
+    }
+    descriptor = arm_ldq_ptw(env, ptw, fi);
+    if (fi->type != ARMFault_None) {
+        goto do_fault;
+    }
+
+    if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
+        /* Invalid, or the Reserved level 3 encoding */
+        goto do_fault;
+    }
+
+    descaddr = descriptor & descaddrmask;
+
+    /*
+     * For FEAT_LPA and PS=6, bits [51:48] of descaddr are in [15:12]
+     * of descriptor.  For FEAT_LPA2 and effective DS, bits [51:50] of
+     * descaddr are in [9:8].  Otherwise, if descaddr is out of range,
+     * raise AddressSizeFault.
+     */
+    if (outputsize > 48) {
+        if (param.ds) {
+            descaddr |= extract64(descriptor, 8, 2) << 50;
+        } else {
+            descaddr |= extract64(descriptor, 12, 4) << 48;
+        }
+    } else if (descaddr >> outputsize) {
+        fault_type = ARMFault_AddressSize;
+        goto do_fault;
+    }
+
+    if ((descriptor & 2) && (level < 3)) {
+        /*
+         * Table entry. The top five bits are attributes which may
+         * propagate down through lower levels of the table (and
+         * which are all arranged so that 0 means "no effect", so
+         * we can gather them up by ORing in the bits at each level).
+         */
+        tableattrs |= extract64(descriptor, 59, 5);
+        level++;
+        indexmask = indexmask_grainsize;
+        goto next_level;
+    }
+
+    /*
+     * Block entry at level 1 or 2, or page entry at level 3.
+     * These are basically the same thing, although the number
+     * of bits we pull in from the vaddr varies. Note that although
+     * descaddrmask masks enough of the low bits of the descriptor
+     * to give a correct page or table address, the address field
+     * in a block descriptor is smaller; so we need to explicitly
+     * clear the lower bits here before ORing in the low vaddr bits.
+     */
+    page_size = (1ULL << ((stride * (4 - level)) + 3));
+    descaddr &= ~(hwaddr)(page_size - 1);
+    descaddr |= (address & (page_size - 1));
+    /* Extract attributes from the descriptor */
+    attrs = extract64(descriptor, 2, 10)
+        | (extract64(descriptor, 52, 12) << 10);
+
+    if (regime_is_stage2(mmu_idx)) {
+        /* Stage 2 table descriptors do not include any attribute fields */
+        goto skip_attrs;
+    }
+    /* Merge in attributes from table descriptors */
+    attrs |= nstable << 3; /* NS */
+    guarded = extract64(descriptor, 50, 1);  /* GP */
+    if (param.hpd) {
+        /* HPD disables all the table attributes except NSTable.  */
+        goto skip_attrs;
+    }
+    attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
+    /*
+     * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
+     * means "force PL1 access only", which means forcing AP[1] to 0.
+     */
+    attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
+    attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
+ skip_attrs:
+
     /*
      * Here descaddr is the final physical address, and attributes
      * are all in attrs.
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Always overriding fi->type was incorrect, as we would not properly
propagate the fault type from S1_ptw_translate, or arm_ldq_ptw.
Simplify things by providing a new label for a translation fault.
For other faults, store into fi directly.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-9-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 31 +++++++++++++------------------
 1 file changed, 13 insertions(+), 18 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     ARMCPU *cpu = env_archcpu(env);
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     bool is_secure = ptw->in_secure;
-    /* Read an LPAE long-descriptor translation table. */
-    ARMFaultType fault_type = ARMFault_Translation;
     uint32_t level;
     ARMVAParameters param;
     uint64_t ttbr;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          * so our choice is to always raise the fault.
          */
         if (param.tsz_oob) {
-            fault_type = ARMFault_Translation;
-            goto do_fault;
+            goto do_translation_fault;
         }
 
         addrsize = 64 - 8 * param.tbi;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
                                            addrsize - inputsize);
         if (-top_bits != param.select) {
             /* The gap between the two regions is a Translation fault */
-            fault_type = ARMFault_Translation;
-            goto do_fault;
+            goto do_translation_fault;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
          * Translation table walk disabled => Translation fault on TLB miss
          * Note: This is always 0 on 64-bit EL2 and EL3.
          */
-        goto do_fault;
+        goto do_translation_fault;
     }
 
     if (!regime_is_stage2(mmu_idx)) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         if (param.ds && stride == 9 && sl2) {
             if (sl0 != 0) {
                 level = 0;
-                fault_type = ARMFault_Translation;
-                goto do_fault;
+                goto do_translation_fault;
             }
             startlevel = -1;
         } else if (!aarch64 || stride == 9) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         ok = check_s2_mmu_setup(cpu, aarch64, startlevel,
                                 inputsize, stride, outputsize);
         if (!ok) {
-            fault_type = ARMFault_Translation;
-            goto do_fault;
+            goto do_translation_fault;
         }
         level = startlevel;
     }
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         descaddr |= extract64(ttbr, 2, 4) << 48;
     } else if (descaddr >> outputsize) {
         level = 0;
-        fault_type = ARMFault_AddressSize;
+        fi->type = ARMFault_AddressSize;
         goto do_fault;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 
     if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
         /* Invalid, or the Reserved level 3 encoding */
-        goto do_fault;
+        goto do_translation_fault;
     }
 
     descaddr = descriptor & descaddrmask;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
             descaddr |= extract64(descriptor, 12, 4) << 48;
         }
     } else if (descaddr >> outputsize) {
-        fault_type = ARMFault_AddressSize;
+        fi->type = ARMFault_AddressSize;
         goto do_fault;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      * Here descaddr is the final physical address, and attributes
      * are all in attrs.
      */
-    fault_type = ARMFault_AccessFlag;
     if ((attrs & (1 << 8)) == 0) {
         /* Access flag */
+        fi->type = ARMFault_AccessFlag;
         goto do_fault;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
     }
 
-    fault_type = ARMFault_Permission;
     if (!(result->f.prot & (1 << access_type))) {
+        fi->type = ARMFault_Permission;
         goto do_fault;
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     result->f.lg_page_size = ctz64(page_size);
     return false;
 
-do_fault:
-    fi->type = fault_type;
+ do_translation_fault:
+    fi->type = ARMFault_Translation;
+ do_fault:
     fi->level = level;
     /* Tag the error as S2 for failed S1 PTW at S2 or ordinary S2.  */
     fi->stage2 = fi->s1ptw || regime_is_stage2(mmu_idx);
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Leave the upper and lower attributes in the place they originate
from in the descriptor.  Shifting them around is confusing, since
one cannot read the bit numbers out of the manual.  Also, new
attributes have been added which would alter the shifts.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20221024051851.3074715-10-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 31 +++++++++++++++----------------
 1 file changed, 15 insertions(+), 16 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     hwaddr descaddr, indexmask, indexmask_grainsize;
     uint32_t tableattrs;
     target_ulong page_size;
-    uint32_t attrs;
+    uint64_t attrs;
     int32_t stride;
     int addrsize, inputsize, outputsize;
     uint64_t tcr = regime_tcr(env, mmu_idx);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     descaddr &= ~(hwaddr)(page_size - 1);
     descaddr |= (address & (page_size - 1));
     /* Extract attributes from the descriptor */
-    attrs = extract64(descriptor, 2, 10)
-        | (extract64(descriptor, 52, 12) << 10);
+    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(52, 12));
 
     if (regime_is_stage2(mmu_idx)) {
         /* Stage 2 table descriptors do not include any attribute fields */
         goto skip_attrs;
     }
     /* Merge in attributes from table descriptors */
-    attrs |= nstable << 3; /* NS */
+    attrs |= nstable << 5; /* NS */
     guarded = extract64(descriptor, 50, 1);  /* GP */
     if (param.hpd) {
         /* HPD disables all the table attributes except NSTable.  */
         goto skip_attrs;
     }
-    attrs |= extract32(tableattrs, 0, 2) << 11;     /* XN, PXN */
+    attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
     /*
      * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
      * means "force PL1 access only", which means forcing AP[1] to 0.
      */
-    attrs &= ~(extract32(tableattrs, 2, 1) << 4);   /* !APT[0] => AP[1] */
-    attrs |= extract32(tableattrs, 3, 1) << 5;      /* APT[1] => AP[2] */
+    attrs &= ~(extract64(tableattrs, 2, 1) << 6);   /* !APT[0] => AP[1] */
+    attrs |= extract32(tableattrs, 3, 1) << 7;      /* APT[1] => AP[2] */
  skip_attrs:
 
     /*
      * Here descaddr is the final physical address, and attributes
      * are all in attrs.
      */
-    if ((attrs & (1 << 8)) == 0) {
+    if ((attrs & (1 << 10)) == 0) {
         /* Access flag */
         fi->type = ARMFault_AccessFlag;
         goto do_fault;
     }
 
-    ap = extract32(attrs, 4, 2);
+    ap = extract32(attrs, 6, 2);
 
     if (regime_is_stage2(mmu_idx)) {
         ns = mmu_idx == ARMMMUIdx_Stage2;
-        xn = extract32(attrs, 11, 2);
+        xn = extract64(attrs, 53, 2);
         result->f.prot = get_S2prot(env, ap, xn, s1_is_el0);
     } else {
-        ns = extract32(attrs, 3, 1);
-        xn = extract32(attrs, 12, 1);
-        pxn = extract32(attrs, 11, 1);
+        ns = extract32(attrs, 5, 1);
+        xn = extract64(attrs, 54, 1);
+        pxn = extract64(attrs, 53, 1);
         result->f.prot = get_S1prot(env, mmu_idx, aarch64, ap, ns, xn, pxn);
     }
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
 
     if (regime_is_stage2(mmu_idx)) {
         result->cacheattrs.is_s2_format = true;
-        result->cacheattrs.attrs = extract32(attrs, 0, 4);
+        result->cacheattrs.attrs = extract32(attrs, 2, 4);
     } else {
         /* Index into MAIR registers for cache attributes */
-        uint8_t attrindx = extract32(attrs, 0, 3);
+        uint8_t attrindx = extract32(attrs, 2, 3);
         uint64_t mair = env->cp15.mair_el[regime_el(env, mmu_idx)];
         assert(attrindx <= 7);
         result->cacheattrs.is_s2_format = false;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     if (param.ds) {
         result->cacheattrs.shareability = param.sh;
     } else {
-        result->cacheattrs.shareability = extract32(attrs, 6, 2);
+        result->cacheattrs.shareability = extract32(attrs, 8, 2);
     }
 
     result->f.phys_addr = descaddr;
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Both GP and DBM are in the upper attribute block.
Extend the computation of attrs to include them,
then simplify the setting of guarded.

Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-11-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Replace some gotos with some nested if statements.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20221024051851.3074715-12-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 34 ++++++++++++++++------------------
 1 file changed, 16 insertions(+), 18 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     page_size = (1ULL << ((stride * (4 - level)) + 3));
     descaddr &= ~(hwaddr)(page_size - 1);
     descaddr |= (address & (page_size - 1));
-    /* Extract attributes from the descriptor */
-    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
 
-    if (regime_is_stage2(mmu_idx)) {
-        /* Stage 2 table descriptors do not include any attribute fields */
-        goto skip_attrs;
-    }
-    /* Merge in attributes from table descriptors */
-    attrs |= nstable << 5; /* NS */
-    if (param.hpd) {
-        /* HPD disables all the table attributes except NSTable.  */
-        goto skip_attrs;
-    }
-    attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
     /*
-     * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
-     * means "force PL1 access only", which means forcing AP[1] to 0.
+     * Extract attributes from the descriptor, and apply table descriptors.
+     * Stage 2 table descriptors do not include any attribute fields.
+     * HPD disables all the table attributes except NSTable.
      */
-    attrs &= ~(extract64(tableattrs, 2, 1) << 6);   /* !APT[0] => AP[1] */
-    attrs |= extract32(tableattrs, 3, 1) << 7;      /* APT[1] => AP[2] */
- skip_attrs:
+    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
+    if (!regime_is_stage2(mmu_idx)) {
+        attrs |= nstable << 5; /* NS */
+        if (!param.hpd) {
+            attrs |= extract64(tableattrs, 0, 2) << 53;     /* XN, PXN */
+            /*
+             * The sense of AP[1] vs APTable[0] is reversed, as APTable[0] == 1
+             * means "force PL1 access only", which means forcing AP[1] to 0.
+             */
+            attrs &= ~(extract64(tableattrs, 2, 1) << 6); /* !APT[0] => AP[1] */
+            attrs |= extract32(tableattrs, 3, 1) << 7;    /* APT[1] => AP[2] */
+        }
+    }
 
     /*
      * Here descaddr is the final physical address, and attributes
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Perform the atomic update for hardware management of the access flag.

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-13-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/emulation.rst |   1 +
 target/arm/cpu64.c            |   1 +
 target/arm/ptw.c              | 176 +++++++++++++++++++++++++++++-----
 3 files changed, 156 insertions(+), 22 deletions(-)

diff --git a/docs/system/arm/emulation.rst b/docs/system/arm/emulation.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/emulation.rst
+++ b/docs/system/arm/emulation.rst
@@ -XXX,XX +XXX,XX @@ the following architecture extensions:
 - FEAT_FlagM (Flag manipulation instructions v2)
 - FEAT_FlagM2 (Enhancements to flag manipulation instructions)
 - FEAT_GTG (Guest translation granule size)
+- FEAT_HAFDBS (Hardware management of the access flag and dirty bit state)
 - FEAT_HCX (Support for the HCRX_EL2 register)
 - FEAT_HPDS (Hierarchical permission disables)
 - FEAT_I8MM (AArch64 Int8 matrix multiplication instructions)
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
+    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 1);   /* FEAT_HAFDBS, AF only */
     t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
     t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
     t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1);     /* FEAT_HPDS */
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ typedef struct S1Translate {
     bool in_secure;
     bool in_debug;
     bool out_secure;
+    bool out_rw;
     bool out_be;
+    hwaddr out_virt;
     hwaddr out_phys;
     void *out_host;
 } S1Translate;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
     uint8_t pte_attrs;
     bool pte_secure;
 
+    ptw->out_virt = addr;
+
     if (unlikely(ptw->in_debug)) {
         /*
          * From gdbstub, do not use softmmu so that we don't modify the
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
             pte_secure = is_secure;
         }
         ptw->out_host = NULL;
+        ptw->out_rw = false;
     } else {
         CPUTLBEntryFull *full;
         int flags;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
             goto fail;
         }
         ptw->out_phys = full->phys_addr;
+        ptw->out_rw = full->prot & PROT_WRITE;
         pte_attrs = full->pte_attrs;
         pte_secure = full->attrs.secure;
     }
@@ -XXX,XX +XXX,XX @@ static uint32_t arm_ldl_ptw(CPUARMState *env, S1Translate *ptw,
                             ARMMMUFaultInfo *fi)
 {
     CPUState *cs = env_cpu(env);
+    void *host = ptw->out_host;
     uint32_t data;
 
-    if (likely(ptw->out_host)) {
+    if (likely(host)) {
         /* Page tables are in RAM, and we have the host address. */
+        data = qatomic_read((uint32_t *)host);
         if (ptw->out_be) {
-            data = ldl_be_p(ptw->out_host);
+            data = be32_to_cpu(data);
         } else {
-            data = ldl_le_p(ptw->out_host);
+            data = le32_to_cpu(data);
         }
     } else {
         /* Page tables are in MMIO. */
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
                             ARMMMUFaultInfo *fi)
 {
     CPUState *cs = env_cpu(env);
+    void *host = ptw->out_host;
     uint64_t data;
 
-    if (likely(ptw->out_host)) {
+    if (likely(host)) {
         /* Page tables are in RAM, and we have the host address. */
+#ifdef CONFIG_ATOMIC64
+        data = qatomic_read__nocheck((uint64_t *)host);
         if (ptw->out_be) {
-            data = ldq_be_p(ptw->out_host);
+            data = be64_to_cpu(data);
         } else {
-            data = ldq_le_p(ptw->out_host);
+            data = le64_to_cpu(data);
         }
+#else
+        if (ptw->out_be) {
+            data = ldq_be_p(host);
+        } else {
+            data = ldq_le_p(host);
+        }
+#endif
     } else {
         /* Page tables are in MMIO. */
         MemTxAttrs attrs = { .secure = ptw->out_secure };
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_ldq_ptw(CPUARMState *env, S1Translate *ptw,
     return data;
 }
 
+static uint64_t arm_casq_ptw(CPUARMState *env, uint64_t old_val,
+                             uint64_t new_val, S1Translate *ptw,
+                             ARMMMUFaultInfo *fi)
+{
+    uint64_t cur_val;
+    void *host = ptw->out_host;
+
+    if (unlikely(!host)) {
+        fi->type = ARMFault_UnsuppAtomicUpdate;
+        fi->s1ptw = true;
+        return 0;
+    }
+
+    /*
+     * Raising a stage2 Protection fault for an atomic update to a read-only
+     * page is delayed until it is certain that there is a change to make.
+     */
+    if (unlikely(!ptw->out_rw)) {
+        int flags;
+        void *discard;
+
+        env->tlb_fi = fi;
+        flags = probe_access_flags(env, ptw->out_virt, MMU_DATA_STORE,
+                                   arm_to_core_mmu_idx(ptw->in_ptw_idx),
+                                   true, &discard, 0);
+        env->tlb_fi = NULL;
+
+        if (unlikely(flags & TLB_INVALID_MASK)) {
+            assert(fi->type != ARMFault_None);
+            fi->s2addr = ptw->out_virt;
+            fi->stage2 = true;
+            fi->s1ptw = true;
+            fi->s1ns = !ptw->in_secure;
+            return 0;
+        }
+
+        /* In case CAS mismatches and we loop, remember writability. */
+        ptw->out_rw = true;
+    }
+
+#ifdef CONFIG_ATOMIC64
+    if (ptw->out_be) {
+        old_val = cpu_to_be64(old_val);
+        new_val = cpu_to_be64(new_val);
+        cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
+        cur_val = be64_to_cpu(cur_val);
+    } else {
+        old_val = cpu_to_le64(old_val);
+        new_val = cpu_to_le64(new_val);
+        cur_val = qatomic_cmpxchg__nocheck((uint64_t *)host, old_val, new_val);
+        cur_val = le64_to_cpu(cur_val);
+    }
+#else
+    /*
+     * We can't support the full 64-bit atomic cmpxchg on the host.
+     * Because this is only used for FEAT_HAFDBS, which is only for AA64,
+     * we know that TCG_OVERSIZED_GUEST is set, which means that we are
+     * running in round-robin mode and could only race with dma i/o.
+     */
+#ifndef TCG_OVERSIZED_GUEST
+# error "Unexpected configuration"
+#endif
+    bool locked = qemu_mutex_iothread_locked();
+    if (!locked) {
+       qemu_mutex_lock_iothread();
+    }
+    if (ptw->out_be) {
+        cur_val = ldq_be_p(host);
+        if (cur_val == old_val) {
+            stq_be_p(host, new_val);
+        }
+    } else {
+        cur_val = ldq_le_p(host);
+        if (cur_val == old_val) {
+            stq_le_p(host, new_val);
+        }
+    }
+    if (!locked) {
+        qemu_mutex_unlock_iothread();
+    }
+#endif
+
+    return cur_val;
+}
+
 static bool get_level1_table_address(CPUARMState *env, ARMMMUIdx mmu_idx,
                                      uint32_t *table, uint32_t address)
 {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     uint32_t el = regime_el(env, mmu_idx);
     uint64_t descaddrmask;
     bool aarch64 = arm_el_is_aa64(env, el);
-    uint64_t descriptor;
+    uint64_t descriptor, new_descriptor;
     bool nstable;
 
     /* TODO: This code does not support shareability levels. */
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
     if (fi->type != ARMFault_None) {
         goto do_fault;
     }
+    new_descriptor = descriptor;
 
+ restart_atomic_update:
     if (!(descriptor & 1) || (!(descriptor & 2) && (level == 3))) {
         /* Invalid, or the Reserved level 3 encoding */
         goto do_translation_fault;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
      * to give a correct page or table address, the address field
      * in a block descriptor is smaller; so we need to explicitly
      * clear the lower bits here before ORing in the low vaddr bits.
+     *
+     * Afterward, descaddr is the final physical address.
      */
     page_size = (1ULL << ((stride * (4 - level)) + 3));
     descaddr &= ~(hwaddr)(page_size - 1);
     descaddr |= (address & (page_size - 1));
 
+    if (likely(!ptw->in_debug)) {
+        /*
+         * Access flag.
+         * If HA is enabled, prepare to update the descriptor below.
+         * Otherwise, pass the access fault on to software.
+         */
+        if (!(descriptor & (1 << 10))) {
+            if (param.ha) {
+                new_descriptor |= 1 << 10; /* AF */
+            } else {
+                fi->type = ARMFault_AccessFlag;
+                goto do_fault;
+            }
+        }
+    }
+
     /*
-     * Extract attributes from the descriptor, and apply table descriptors.
-     * Stage 2 table descriptors do not include any attribute fields.
-     * HPD disables all the table attributes except NSTable.
+     * Extract attributes from the (modified) descriptor, and apply
+     * table descriptors. Stage 2 table descriptors do not include
+     * any attribute fields. HPD disables all the table attributes
+     * except NSTable.
      */
-    attrs = descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
+    attrs = new_descriptor & (MAKE_64BIT_MASK(2, 10) | MAKE_64BIT_MASK(50, 14));
     if (!regime_is_stage2(mmu_idx)) {
         attrs |= nstable << 5; /* NS */
         if (!param.hpd) {
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         }
     }
 
-    /*
-     * Here descaddr is the final physical address, and attributes
-     * are all in attrs.
-     */
-    if ((attrs & (1 << 10)) == 0) {
-        /* Access flag */
-        fi->type = ARMFault_AccessFlag;
-        goto do_fault;
-    }
-
     ap = extract32(attrs, 6, 2);
-
     if (regime_is_stage2(mmu_idx)) {
         ns = mmu_idx == ARMMMUIdx_Stage2;
         xn = extract64(attrs, 53, 2);
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
         goto do_fault;
     }
 
+    /* If FEAT_HAFDBS has made changes, update the PTE. */
+    if (new_descriptor != descriptor) {
+        new_descriptor = arm_casq_ptw(env, descriptor, new_descriptor, ptw, fi);
+        if (fi->type != ARMFault_None) {
+            goto do_fault;
+        }
+        /*
+         * I_YZSVV says that if the in-memory descriptor has changed,
+         * then we must use the information in that new value
+         * (which might include a different output address, different
+         * attributes, or generate a fault).
+         * Restart the handling of the descriptor value from scratch.
+         */
+        if (new_descriptor != descriptor) {
+            descriptor = new_descriptor;
+            goto restart_atomic_update;
+        }
+    }
+
     if (ns) {
         /*
          * The NS bit will (as required by the architecture) have no effect if
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Perform the atomic update for hardware management of the dirty bit.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-14-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c |  2 +-
 target/arm/ptw.c   | 16 ++++++++++++++++
 2 files changed, 17 insertions(+), 1 deletion(-)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_max_initfn(Object *obj)
     cpu->isar.id_aa64mmfr0 = t;
 
     t = cpu->isar.id_aa64mmfr1;
-    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 1);   /* FEAT_HAFDBS, AF only */
+    t = FIELD_DP64(t, ID_AA64MMFR1, HAFDBS, 2);   /* FEAT_HAFDBS */
     t = FIELD_DP64(t, ID_AA64MMFR1, VMIDBITS, 2); /* FEAT_VMID16 */
     t = FIELD_DP64(t, ID_AA64MMFR1, VH, 1);       /* FEAT_VHE */
     t = FIELD_DP64(t, ID_AA64MMFR1, HPDS, 1);     /* FEAT_HPDS */
diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, S1Translate *ptw,
                 goto do_fault;
             }
         }
+
+        /*
+         * Dirty Bit.
+         * If HD is enabled, pre-emptively set/clear the appropriate AP/S2AP
+         * bit for writeback. The actual write protection test may still be
+         * overridden by tableattrs, to be merged below.
+         */
+        if (param.hd
+            && extract64(descriptor, 51, 1)  /* DBM */
+            && access_type == MMU_DATA_STORE) {
+            if (regime_is_stage2(mmu_idx)) {
+                new_descriptor |= 1ull << 7;    /* set S2AP[1] */
+            } else {
+                new_descriptor &= ~(1ull << 7); /* clear AP[2] */
+            }
+        }
     }
 
     /*
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

We had only been reporting the stage2 page size.  This causes
problems if stage1 is using a larger page size (16k, 2M, etc),
but stage2 is using a smaller page size, because cputlb does
not set large_page_{addr,mask} properly.

Fix by using the max of the two page sizes.

Reported-by: Marc Zyngier <maz@kernel.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20221024051851.3074715-15-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
                                    ARMMMUFaultInfo *fi)
 {
     hwaddr ipa;
-    int s1_prot;
+    int s1_prot, s1_lgpgsz;
     bool is_secure = ptw->in_secure;
     bool ret, ipa_secure, s2walk_secure;
     ARMCacheAttrs cacheattrs1;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      * Save the stage1 results so that we may merge prot and cacheattrs later.
      */
     s1_prot = result->f.prot;
+    s1_lgpgsz = result->f.lg_page_size;
     cacheattrs1 = result->cacheattrs;
     memset(result, 0, sizeof(*result));
 
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
         return ret;
     }
 
+    /*
+     * Use the maximum of the S1 & S2 page size, so that invalidation
+     * of pages > TARGET_PAGE_SIZE works correctly.
+     */
+    if (result->f.lg_page_size < s1_lgpgsz) {
+        result->f.lg_page_size = s1_lgpgsz;
+    }
+
     /* Combine the S1 and S2 cache attributes. */
     hcr = arm_hcr_el2_eff_secstate(env, is_secure);
     if (hcr & HCR_DC) {
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Snapshot loading only expects to call deterministic handlers, not
non-deterministic ones. So introduce a way of registering handlers that
won't be called when reseting for snapshots.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-2-Jason@zx2c4.com
[PMM: updated json doc comment with Markus' text; fixed
 checkpatch style nit]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 qapi/run-state.json        |  6 +++++-
 include/hw/boards.h        |  2 +-
 include/sysemu/reset.h     |  5 ++++-
 hw/arm/aspeed.c            |  4 ++--
 hw/arm/mps2-tz.c           |  4 ++--
 hw/core/reset.c            | 17 ++++++++++++++++-
 hw/hppa/machine.c          |  4 ++--
 hw/i386/microvm.c          |  4 ++--
 hw/i386/pc.c               |  6 +++---
 hw/ppc/pegasos2.c          |  4 ++--
 hw/ppc/pnv.c               |  4 ++--
 hw/ppc/spapr.c             |  4 ++--
 hw/s390x/s390-virtio-ccw.c |  4 ++--
 migration/savevm.c         |  2 +-
 softmmu/runstate.c         | 11 ++++++++---
 15 files changed, 54 insertions(+), 27 deletions(-)

diff --git a/qapi/run-state.json b/qapi/run-state.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/run-state.json
+++ b/qapi/run-state.json
@@ -XXX,XX +XXX,XX @@
 #                   ignores --no-reboot. This is useful for sanitizing
 #                   hypercalls on s390 that are used during kexec/kdump/boot
 #
+# @snapshot-load: A snapshot is being loaded by the record & replay
+#                 subsystem. This value is used only within QEMU.  It
+#                 doesn't occur in QMP. (since 7.2)
+#
 ##
 { 'enum': 'ShutdownCause',
   # Beware, shutdown_caused_by_guest() depends on enumeration order
   'data': [ 'none', 'host-error', 'host-qmp-quit', 'host-qmp-system-reset',
             'host-signal', 'host-ui', 'guest-shutdown', 'guest-reset',
-            'guest-panic', 'subsystem-reset'] }
+            'guest-panic', 'subsystem-reset', 'snapshot-load'] }
 
 ##
 # @StatusInfo:
diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@ struct MachineClass {
     const char *deprecation_reason;
 
     void (*init)(MachineState *state);
-    void (*reset)(MachineState *state);
+    void (*reset)(MachineState *state, ShutdownCause reason);
     void (*wakeup)(MachineState *state);
     int (*kvm_type)(MachineState *machine, const char *arg);
 
diff --git a/include/sysemu/reset.h b/include/sysemu/reset.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/reset.h
+++ b/include/sysemu/reset.h
@@ -XXX,XX +XXX,XX @@
 #ifndef QEMU_SYSEMU_RESET_H
 #define QEMU_SYSEMU_RESET_H
 
+#include "qapi/qapi-events-run-state.h"
+
 typedef void QEMUResetHandler(void *opaque);
 
 void qemu_register_reset(QEMUResetHandler *func, void *opaque);
+void qemu_register_reset_nosnapshotload(QEMUResetHandler *func, void *opaque);
 void qemu_unregister_reset(QEMUResetHandler *func, void *opaque);
-void qemu_devices_reset(void);
+void qemu_devices_reset(ShutdownCause reason);
 
 #endif
diff --git a/hw/arm/aspeed.c b/hw/arm/aspeed.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed.c
+++ b/hw/arm/aspeed.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_machine_bletchley_class_init(ObjectClass *oc, void *data)
         aspeed_soc_num_cpus(amc->soc_name);
 }
 
-static void fby35_reset(MachineState *state)
+static void fby35_reset(MachineState *state, ShutdownCause reason)
 {
     AspeedMachineState *bmc = ASPEED_MACHINE(state);
     AspeedGPIOState *gpio = &bmc->soc.gpio;
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     /* Board ID: 7 (Class-1, 4 slots) */
     object_property_set_bool(OBJECT(gpio), "gpioV4", true, &error_fatal);
diff --git a/hw/arm/mps2-tz.c b/hw/arm/mps2-tz.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/mps2-tz.c
+++ b/hw/arm/mps2-tz.c
@@ -XXX,XX +XXX,XX @@ static void mps2_set_remap(Object *obj, const char *value, Error **errp)
     }
 }
 
-static void mps2_machine_reset(MachineState *machine)
+static void mps2_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     MPS2TZMachineState *mms = MPS2TZ_MACHINE(machine);
 
@@ -XXX,XX +XXX,XX @@ static void mps2_machine_reset(MachineState *machine)
      * reset see the correct mapping.
      */
     remap_memory(mms, mms->remap);
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 }
 
 static void mps2tz_class_init(ObjectClass *oc, void *data)
diff --git a/hw/core/reset.c b/hw/core/reset.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/reset.c
+++ b/hw/core/reset.c
@@ -XXX,XX +XXX,XX @@ typedef struct QEMUResetEntry {
     QTAILQ_ENTRY(QEMUResetEntry) entry;
     QEMUResetHandler *func;
     void *opaque;
+    bool skip_on_snapshot_load;
 } QEMUResetEntry;
 
 static QTAILQ_HEAD(, QEMUResetEntry) reset_handlers =
@@ -XXX,XX +XXX,XX @@ void qemu_register_reset(QEMUResetHandler *func, void *opaque)
     QTAILQ_INSERT_TAIL(&reset_handlers, re, entry);
 }
 
+void qemu_register_reset_nosnapshotload(QEMUResetHandler *func, void *opaque)
+{
+    QEMUResetEntry *re = g_new0(QEMUResetEntry, 1);
+
+    re->func = func;
+    re->opaque = opaque;
+    re->skip_on_snapshot_load = true;
+    QTAILQ_INSERT_TAIL(&reset_handlers, re, entry);
+}
+
 void qemu_unregister_reset(QEMUResetHandler *func, void *opaque)
 {
     QEMUResetEntry *re;
@@ -XXX,XX +XXX,XX @@ void qemu_unregister_reset(QEMUResetHandler *func, void *opaque)
     }
 }
 
-void qemu_devices_reset(void)
+void qemu_devices_reset(ShutdownCause reason)
 {
     QEMUResetEntry *re, *nre;
 
     /* reset all devices */
     QTAILQ_FOREACH_SAFE(re, &reset_handlers, entry, nre) {
+        if (reason == SHUTDOWN_CAUSE_SNAPSHOT_LOAD &&
+            re->skip_on_snapshot_load) {
+            continue;
+        }
         re->func(re->opaque);
     }
 }
diff --git a/hw/hppa/machine.c b/hw/hppa/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/hppa/machine.c
+++ b/hw/hppa/machine.c
@@ -XXX,XX +XXX,XX @@ static void machine_hppa_init(MachineState *machine)
     cpu[0]->env.gr[19] = FW_CFG_IO_BASE;
 }
 
-static void hppa_machine_reset(MachineState *ms)
+static void hppa_machine_reset(MachineState *ms, ShutdownCause reason)
 {
     unsigned int smp_cpus = ms->smp.cpus;
     int i;
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     /* Start all CPUs at the firmware entry point.
      *  Monarch CPU will initialize firmware, secondary CPUs
diff --git a/hw/i386/microvm.c b/hw/i386/microvm.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/microvm.c
+++ b/hw/i386/microvm.c
@@ -XXX,XX +XXX,XX @@ static void microvm_machine_state_init(MachineState *machine)
     microvm_devices_init(mms);
 }
 
-static void microvm_machine_reset(MachineState *machine)
+static void microvm_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     MicrovmMachineState *mms = MICROVM_MACHINE(machine);
     CPUState *cs;
@@ -XXX,XX +XXX,XX @@ static void microvm_machine_reset(MachineState *machine)
         mms->kernel_cmdline_fixed = true;
     }
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     CPU_FOREACH(cs) {
         cpu = X86_CPU(cs);
diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -XXX,XX +XXX,XX @@ static void pc_machine_initfn(Object *obj)
     cxl_machine_init(obj, &pcms->cxl_devices_state);
 }
 
-static void pc_machine_reset(MachineState *machine)
+static void pc_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     CPUState *cs;
     X86CPU *cpu;
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     /* Reset APIC after devices have been reset to cancel
      * any changes that qemu_devices_reset() might have done.
@@ -XXX,XX +XXX,XX @@ static void pc_machine_reset(MachineState *machine)
 static void pc_machine_wakeup(MachineState *machine)
 {
     cpu_synchronize_all_states();
-    pc_machine_reset(machine);
+    pc_machine_reset(machine, SHUTDOWN_CAUSE_NONE);
     cpu_synchronize_all_post_reset();
 }
 
diff --git a/hw/ppc/pegasos2.c b/hw/ppc/pegasos2.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/pegasos2.c
+++ b/hw/ppc/pegasos2.c
@@ -XXX,XX +XXX,XX @@ static void pegasos2_pci_config_write(Pegasos2MachineState *pm, int bus,
     pegasos2_mv_reg_write(pm, pcicfg + 4, len, val);
 }
 
-static void pegasos2_machine_reset(MachineState *machine)
+static void pegasos2_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     Pegasos2MachineState *pm = PEGASOS2_MACHINE(machine);
     void *fdt;
     uint64_t d[2];
     int sz;
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
     if (!pm->vof) {
         return; /* Firmware should set up machine so nothing to do */
     }
diff --git a/hw/ppc/pnv.c b/hw/ppc/pnv.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/pnv.c
+++ b/hw/ppc/pnv.c
@@ -XXX,XX +XXX,XX @@ static void pnv_powerdown_notify(Notifier *n, void *opaque)
     }
 }
 
-static void pnv_reset(MachineState *machine)
+static void pnv_reset(MachineState *machine, ShutdownCause reason)
 {
     PnvMachineState *pnv = PNV_MACHINE(machine);
     IPMIBmc *bmc;
     void *fdt;
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     /*
      * The machine should provide by default an internal BMC simulator.
diff --git a/hw/ppc/spapr.c b/hw/ppc/spapr.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ppc/spapr.c
+++ b/hw/ppc/spapr.c
@@ -XXX,XX +XXX,XX @@ void spapr_check_mmu_mode(bool guest_radix)
     }
 }
 
-static void spapr_machine_reset(MachineState *machine)
+static void spapr_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     SpaprMachineState *spapr = SPAPR_MACHINE(machine);
     PowerPCCPU *first_ppc_cpu;
@@ -XXX,XX +XXX,XX @@ static void spapr_machine_reset(MachineState *machine)
         spapr_setup_hpt(spapr);
     }
 
-    qemu_devices_reset();
+    qemu_devices_reset(reason);
 
     spapr_ovec_cleanup(spapr->ov5_cas);
     spapr->ov5_cas = spapr_ovec_new();
diff --git a/hw/s390x/s390-virtio-ccw.c b/hw/s390x/s390-virtio-ccw.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/s390x/s390-virtio-ccw.c
+++ b/hw/s390x/s390-virtio-ccw.c
@@ -XXX,XX +XXX,XX @@ static void s390_pv_prepare_reset(S390CcwMachineState *ms)
     s390_pv_prep_reset();
 }
 
-static void s390_machine_reset(MachineState *machine)
+static void s390_machine_reset(MachineState *machine, ShutdownCause reason)
 {
     S390CcwMachineState *ms = S390_CCW_MACHINE(machine);
     enum s390_reset reset_type;
@@ -XXX,XX +XXX,XX @@ static void s390_machine_reset(MachineState *machine)
             s390_machine_unprotect(ms);
         }
 
-        qemu_devices_reset();
+        qemu_devices_reset(reason);
         s390_crypto_reset();
 
         /* configure and start the ipl CPU only */
diff --git a/migration/savevm.c b/migration/savevm.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -XXX,XX +XXX,XX @@ bool load_snapshot(const char *name, const char *vmstate,
         goto err_drain;
     }
 
-    qemu_system_reset(SHUTDOWN_CAUSE_NONE);
+    qemu_system_reset(SHUTDOWN_CAUSE_SNAPSHOT_LOAD);
     mis->from_src_file = f;
 
     if (!yank_register_instance(MIGRATION_YANK_INSTANCE, errp)) {
diff --git a/softmmu/runstate.c b/softmmu/runstate.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/runstate.c
+++ b/softmmu/runstate.c
@@ -XXX,XX +XXX,XX @@ void qemu_system_reset(ShutdownCause reason)
     cpu_synchronize_all_states();
 
     if (mc && mc->reset) {
-        mc->reset(current_machine);
+        mc->reset(current_machine, reason);
     } else {
-        qemu_devices_reset();
+        qemu_devices_reset(reason);
     }
-    if (reason && reason != SHUTDOWN_CAUSE_SUBSYSTEM_RESET) {
+    switch (reason) {
+    case SHUTDOWN_CAUSE_NONE:
+    case SHUTDOWN_CAUSE_SUBSYSTEM_RESET:
+    case SHUTDOWN_CAUSE_SNAPSHOT_LOAD:
+        break;
+    default:
         qapi_event_send_reset(shutdown_caused_by_guest(reason), reason);
     }
     cpu_synchronize_all_post_reset();
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

When the system reboots, the rng-seed that the FDT has should be
re-randomized, so that the new boot gets a new seed. Several
architectures require this functionality, so export a function for
injecting a new seed into the given FDT.

Cc: Alistair Francis <alistair.francis@wdc.com>
Cc: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20221025004327.568476-3-Jason@zx2c4.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/sysemu/device_tree.h |  9 +++++++++
 softmmu/device_tree.c        | 21 +++++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/include/sysemu/device_tree.h b/include/sysemu/device_tree.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/device_tree.h
+++ b/include/sysemu/device_tree.h
@@ -XXX,XX +XXX,XX @@ int qemu_fdt_setprop_sized_cells_from_array(void *fdt,
                                                 qdt_tmp);                 \
     })
 
+
+/**
+ * qemu_fdt_randomize_seeds:
+ * @fdt: device tree blob
+ *
+ * Re-randomize all "rng-seed" properties with new seeds.
+ */
+void qemu_fdt_randomize_seeds(void *fdt);
+
 #define FDT_PCI_RANGE_RELOCATABLE          0x80000000
 #define FDT_PCI_RANGE_PREFETCHABLE         0x40000000
 #define FDT_PCI_RANGE_ALIASED              0x20000000
diff --git a/softmmu/device_tree.c b/softmmu/device_tree.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/device_tree.c
+++ b/softmmu/device_tree.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qemu/bswap.h"
 #include "qemu/cutils.h"
+#include "qemu/guest-random.h"
 #include "sysemu/device_tree.h"
 #include "hw/loader.h"
 #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ void hmp_dumpdtb(Monitor *mon, const QDict *qdict)
 
     info_report("dtb dumped to %s", filename);
 }
+
+void qemu_fdt_randomize_seeds(void *fdt)
+{
+    int noffset, poffset, len;
+    const char *name;
+    uint8_t *data;
+
+    for (noffset = fdt_next_node(fdt, 0, NULL);
+         noffset >= 0;
+         noffset = fdt_next_node(fdt, noffset, NULL)) {
+        for (poffset = fdt_first_property_offset(fdt, noffset);
+             poffset >= 0;
+             poffset = fdt_next_property_offset(fdt, poffset)) {
+            data = (uint8_t *)fdt_getprop_by_offset(fdt, poffset, &name, &len);
+            if (!data || strcmp(name, "rng-seed"))
+                continue;
+            qemu_guest_getrandom_nofail(data, len);
+        }
+    }
+}
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Snapshot loading is supposed to be deterministic, so we shouldn't
re-randomize the various seeds used.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-4-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/i386/x86.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/i386/x86.c b/hw/i386/x86.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/i386/x86.c
+++ b/hw/i386/x86.c
@@ -XXX,XX +XXX,XX @@ void x86_load_linux(X86MachineState *x86ms,
         setup_data->type = cpu_to_le32(SETUP_RNG_SEED);
         setup_data->len = cpu_to_le32(RNG_SEED_LENGTH);
         qemu_guest_getrandom_nofail(setup_data->data, RNG_SEED_LENGTH);
-        qemu_register_reset(reset_rng_seed, setup_data);
+        qemu_register_reset_nosnapshotload(reset_rng_seed, setup_data);
         fw_cfg_add_bytes_callback(fw_cfg, FW_CFG_KERNEL_DATA, reset_rng_seed, NULL,
                                   setup_data, kernel, kernel_size, true);
     } else {
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

When the system reboots, the rng-seed that the FDT has should be
re-randomized, so that the new boot gets a new seed. Since the FDT is in
the ROM region at this point, we add a hook right after the ROM has been
added, so that we have a pointer to that copy of the FDT.

Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: qemu-arm@nongnu.org
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-5-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
      * the DTB is copied again upon reset, even if addr points into RAM.
      */
     rom_add_blob_fixed_as("dtb", fdt, size, addr, as);
+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+                                       rom_ptr_for_as(as, addr, size));
 
     g_free(fdt);
 
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Cc: Palmer Dabbelt <palmer@dabbelt.com>
Cc: Alistair Francis <alistair.francis@wdc.com>
Cc: Bin Meng <bin.meng@windriver.com>
Cc: qemu-riscv@nongnu.org
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 20221025004327.568476-6-Jason@zx2c4.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/riscv/boot.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/riscv/boot.c b/hw/riscv/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/riscv/boot.c
+++ b/hw/riscv/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/device_tree.h"
 #include "sysemu/qtest.h"
 #include "sysemu/kvm.h"
+#include "sysemu/reset.h"
 
 #include <libfdt.h>
 
@@ -XXX,XX +XXX,XX @@ uint64_t riscv_load_fdt(hwaddr dram_base, uint64_t mem_size, void *fdt)
 
     rom_add_blob_fixed_as("fdt", fdt, fdtsize, fdt_addr,
                           &address_space_memory);
+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+                        rom_ptr_for_as(&address_space_memory, fdt_addr, fdtsize));
 
     return fdt_addr;
 }
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Snapshot loading is supposed to be deterministic, so we shouldn't
re-randomize the various seeds used.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-7-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/m68k/virt.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/hw/m68k/virt.c b/hw/m68k/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/m68k/virt.c
+++ b/hw/m68k/virt.c
@@ -XXX,XX +XXX,XX @@ typedef struct {
     M68kCPU *cpu;
     hwaddr initial_pc;
     hwaddr initial_stack;
-    struct bi_record *rng_seed;
 } ResetInfo;
 
 static void main_cpu_reset(void *opaque)
@@ -XXX,XX +XXX,XX @@ static void main_cpu_reset(void *opaque)
     M68kCPU *cpu = reset_info->cpu;
     CPUState *cs = CPU(cpu);
 
-    if (reset_info->rng_seed) {
-        qemu_guest_getrandom_nofail((void *)reset_info->rng_seed->data + 2,
-            be16_to_cpu(*(uint16_t *)reset_info->rng_seed->data));
-    }
-
     cpu_reset(cs);
     cpu->env.aregs[7] = reset_info->initial_stack;
     cpu->env.pc = reset_info->initial_pc;
 }
 
+static void rerandomize_rng_seed(void *opaque)
+{
+    struct bi_record *rng_seed = opaque;
+    qemu_guest_getrandom_nofail((void *)rng_seed->data + 2,
+                                be16_to_cpu(*(uint16_t *)rng_seed->data));
+}
+
 static void virt_init(MachineState *machine)
 {
     M68kCPU *cpu = NULL;
@@ -XXX,XX +XXX,XX @@ static void virt_init(MachineState *machine)
         BOOTINFO0(param_ptr, BI_LAST);
         rom_add_blob_fixed_as("bootinfo", param_blob, param_ptr - param_blob,
                               parameters_base, cs->as);
-        reset_info->rng_seed = rom_ptr_for_as(cs->as, parameters_base,
-                                              param_ptr - param_blob) +
-                               (param_rng_seed - param_blob);
+        qemu_register_reset_nosnapshotload(rerandomize_rng_seed,
+                            rom_ptr_for_as(cs->as, parameters_base,
+                                           param_ptr - param_blob) +
+                            (param_rng_seed - param_blob));
         g_free(param_blob);
     }
 }
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Snapshot loading is supposed to be deterministic, so we shouldn't
re-randomize the various seeds used.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-8-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/m68k/q800.c | 33 +++++++++++++--------------------
 1 file changed, 13 insertions(+), 20 deletions(-)

diff --git a/hw/m68k/q800.c b/hw/m68k/q800.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/m68k/q800.c
+++ b/hw/m68k/q800.c
@@ -XXX,XX +XXX,XX @@ static const TypeInfo glue_info = {
     },
 };
 
-typedef struct {
-    M68kCPU *cpu;
-    struct bi_record *rng_seed;
-} ResetInfo;
-
 static void main_cpu_reset(void *opaque)
 {
-    ResetInfo *reset_info = opaque;
-    M68kCPU *cpu = reset_info->cpu;
+    M68kCPU *cpu = opaque;
     CPUState *cs = CPU(cpu);
 
-    if (reset_info->rng_seed) {
-        qemu_guest_getrandom_nofail((void *)reset_info->rng_seed->data + 2,
-            be16_to_cpu(*(uint16_t *)reset_info->rng_seed->data));
-    }
-
     cpu_reset(cs);
     cpu->env.aregs[7] = ldl_phys(cs->as, 0);
     cpu->env.pc = ldl_phys(cs->as, 4);
 }
 
+static void rerandomize_rng_seed(void *opaque)
+{
+    struct bi_record *rng_seed = opaque;
+    qemu_guest_getrandom_nofail((void *)rng_seed->data + 2,
+                                be16_to_cpu(*(uint16_t *)rng_seed->data));
+}
+
 static uint8_t fake_mac_rom[] = {
     0, 0, 0, 0, 0, 0, 0, 0, 0, 0,
 
@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
     NubusBus *nubus;
     DeviceState *glue;
     DriveInfo *dinfo;
-    ResetInfo *reset_info;
     uint8_t rng_seed[32];
 
     linux_boot = (kernel_filename != NULL);
@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
         exit(1);
     }
 
-    reset_info = g_new0(ResetInfo, 1);
-
     /* init CPUs */
     cpu = M68K_CPU(cpu_create(machine->cpu_type));
-    reset_info->cpu = cpu;
-    qemu_register_reset(main_cpu_reset, reset_info);
+    qemu_register_reset(main_cpu_reset, cpu);
 
     /* RAM */
     memory_region_add_subregion(get_system_memory(), 0, machine->ram);
@@ -XXX,XX +XXX,XX @@ static void q800_init(MachineState *machine)
         BOOTINFO0(param_ptr, BI_LAST);
         rom_add_blob_fixed_as("bootinfo", param_blob, param_ptr - param_blob,
                               parameters_base, cs->as);
-        reset_info->rng_seed = rom_ptr_for_as(cs->as, parameters_base,
-                                              param_ptr - param_blob) +
-                               (param_rng_seed - param_blob);
+        qemu_register_reset_nosnapshotload(rerandomize_rng_seed,
+                            rom_ptr_for_as(cs->as, parameters_base,
+                                           param_ptr - param_blob) +
+                            (param_rng_seed - param_blob));
         g_free(param_blob);
     } else {
         uint8_t *ptr;
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Cc: Aleksandar Rikalo <aleksandar.rikalo@syrmia.com>
Cc: Paul Burton <paulburton@kernel.org>
Cc: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-9-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/mips/boston.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/mips/boston.c b/hw/mips/boston.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/mips/boston.c
+++ b/hw/mips/boston.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/sysemu.h"
 #include "sysemu/qtest.h"
 #include "sysemu/runstate.h"
+#include "sysemu/reset.h"
 
 #include <libfdt.h>
 #include "qom/object.h"
@@ -XXX,XX +XXX,XX @@ static void boston_mach_init(MachineState *machine)
             /* Calculate real fdt size after filter */
             dt_size = fdt_totalsize(dtb_load_data);
             rom_add_blob_fixed("dtb", dtb_load_data, dt_size, dtb_paddr);
+            qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+                                rom_ptr(dtb_paddr, dt_size));
         } else {
             /* Try to load file as FIT */
             fit_err = load_fit(&boston_fit_loader, machine->kernel_filename, s);
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Cc: Stafford Horne <shorne@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-11-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/openrisc/boot.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/openrisc/boot.c b/hw/openrisc/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/openrisc/boot.c
+++ b/hw/openrisc/boot.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/openrisc/boot.h"
 #include "sysemu/device_tree.h"
 #include "sysemu/qtest.h"
+#include "sysemu/reset.h"
 
 #include <libfdt.h>
 
@@ -XXX,XX +XXX,XX @@ uint32_t openrisc_load_fdt(void *fdt, hwaddr load_start,
 
     rom_add_blob_fixed_as("fdt", fdt, fdtsize, fdt_addr,
                           &address_space_memory);
+    qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+                        rom_ptr_for_as(&address_space_memory, fdt_addr, fdtsize));
 
     return fdt_addr;
 }
-- 
2.25.1

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

Cc: Yoshinori Sato <ysato@users.sourceforge.jp>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
Message-id: 20221025004327.568476-12-Jason@zx2c4.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/rx/rx-gdbsim.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/rx/rx-gdbsim.c b/hw/rx/rx-gdbsim.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/rx/rx-gdbsim.c
+++ b/hw/rx/rx-gdbsim.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/rx/rx62n.h"
 #include "sysemu/qtest.h"
 #include "sysemu/device_tree.h"
+#include "sysemu/reset.h"
 #include "hw/boards.h"
 #include "qom/object.h"
 
@@ -XXX,XX +XXX,XX @@ static void rx_gdbsim_init(MachineState *machine)
             dtb_offset = ROUND_DOWN(machine->ram_size - dtb_size, 16);
             rom_add_blob_fixed("dtb", dtb, dtb_size,
                                SDRAM_BASE + dtb_offset);
+            qemu_register_reset_nosnapshotload(qemu_fdt_randomize_seeds,
+                                rom_ptr(SDRAM_BASE + dtb_offset, dtb_size));
             /* Set dtb address to R1 */
             RX_CPU(first_cpu)->env.regs[1] = SDRAM_BASE + dtb_offset;
         }
-- 
2.25.1

Hi; here's the latest batch of arm changes. The big thing
in here is the SMMUv3 changes to add stage-2 translation support.

thanks
-- PMM

The following changes since commit aa9bbd865502ed517624ab6fe7d4b5d89ca95e43:

Merge tag 'pull-ppc-20230528' of https://gitlab.com/danielhb/qemu into staging (2023-05-29 14:31:52 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230530

for you to fetch changes up to b03d0d4f531a8b867e0aac1fab0b876903015680:

docs: sbsa: correct graphics card name (2023-05-30 13:32:46 +0100)

----------------------------------------------------------------
target-arm queue:
 * fsl-imx6: Add SNVS support for i.MX6 boards
 * smmuv3: Add support for stage 2 translations
 * hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop
 * hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
 * cleanups for recent Kconfig changes
 * target/arm: Explicitly select short-format FSR for M-profile
 * tests/qtest: Run arm-specific tests only if the required machine is available
 * hw/arm/sbsa-ref: add GIC node into DT
 * docs: sbsa: correct graphics card name
 * Update copyright dates to 2023

----------------------------------------------------------------
Clément Chigot (1):
      hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number

Enze Li (1):
      Update copyright dates to 2023

Fabiano Rosas (3):
      target/arm: Explain why we need to select ARM_V7M
      arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
      arm/Kconfig: Make TCG dependence explicit

Marcin Juszkiewicz (2):
      hw/arm/sbsa-ref: add GIC node into DT
      docs: sbsa: correct graphics card name

Mostafa Saleh (10):
      hw/arm/smmuv3: Add missing fields for IDR0
      hw/arm/smmuv3: Update translation config to hold stage-2
      hw/arm/smmuv3: Refactor stage-1 PTW
      hw/arm/smmuv3: Add page table walk for stage-2
      hw/arm/smmuv3: Parse STE config for stage-2
      hw/arm/smmuv3: Make TLB lookup work for stage-2
      hw/arm/smmuv3: Add VMID to TLB tagging
      hw/arm/smmuv3: Add CMDs related to stage-2
      hw/arm/smmuv3: Add stage-2 support in iova notifier
      hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2

Peter Maydell (1):
      target/arm: Explicitly select short-format FSR for M-profile

Thomas Huth (1):
      tests/qtest: Run arm-specific tests only if the required machine is available

Tommy Wu (1):
      hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.

Vitaly Cheptsov (1):
      fsl-imx6: Add SNVS support for i.MX6 boards

From: Vitaly Cheptsov <cheptsov@ispras.ru>

SNVS is supported on both i.MX6 and i.MX6UL and is needed
to support shutdown on the board.

Cc: Peter Maydell <peter.maydell@linaro.org> (odd fixer:SABRELITE / i.MX6)
Cc: Jean-Christophe Dubois <jcd@tribudubois.net> (reviewer:SABRELITE / i.MX6)
Cc: qemu-arm@nongnu.org (open list:SABRELITE / i.MX6)
Cc: qemu-devel@nongnu.org (open list:All patches CC here)
Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>
Message-id: 20230515095015.66860-1-cheptsov@ispras.ru
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h | 2 ++
 hw/arm/fsl-imx6.c         | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/cpu/a9mpcore.h"
 #include "hw/misc/imx6_ccm.h"
 #include "hw/misc/imx6_src.h"
+#include "hw/misc/imx7_snvs.h"
 #include "hw/watchdog/wdt_imx2.h"
 #include "hw/char/imx_serial.h"
 #include "hw/timer/imx_gpt.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
     A9MPPrivState  a9mpcore;
     IMX6CCMState   ccm;
     IMX6SRCState   src;
+    IMX7SNVSState  snvs;
     IMXSerialState uart[FSL_IMX6_NUM_UARTS];
     IMXGPTState    gpt;
     IMXEPITState   epit[FSL_IMX6_NUM_EPITS];
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
 
     object_initialize_child(obj, "src", &s->src, TYPE_IMX6_SRC);
 
+    object_initialize_child(obj, "snvs", &s->snvs, TYPE_IMX7_SNVS);
+
     for (i = 0; i < FSL_IMX6_NUM_UARTS; i++) {
         snprintf(name, NAME_SIZE, "uart%d", i + 1);
         object_initialize_child(obj, name, &s->uart[i], TYPE_IMX_SERIAL);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                        qdev_get_gpio_in(DEVICE(&s->a9mpcore),
                                         FSL_IMX6_ENET_MAC_1588_IRQ));
 
+    /*
+     * SNVS
+     */
+    sysbus_realize(SYS_BUS_DEVICE(&s->snvs), &error_abort);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->snvs), 0, FSL_IMX6_SNVSHP_ADDR);
+
     /*
      * Watchdog
      */
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support.
Add IDR0 fields related to stage-2.

VMID16: 16-bit VMID supported.
S2P: Stage-2 translation supported.

They are described in 6.3.1 SMMU_IDR0.

No functional change intended.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-2-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef enum SMMUTranslationStatus {
 /* MMIO Registers */
 
 REG32(IDR0,                0x0)
+    FIELD(IDR0, S2P,         0 , 1)
     FIELD(IDR0, S1P,         1 , 1)
     FIELD(IDR0, TTF,         2 , 2)
     FIELD(IDR0, COHACC,      4 , 1)
     FIELD(IDR0, ASID16,      12, 1)
+    FIELD(IDR0, VMID16,      18, 1)
     FIELD(IDR0, TTENDIAN,    21, 2)
     FIELD(IDR0, STALL_MODEL, 24, 2)
     FIELD(IDR0, TERM_MODEL,  26, 1)
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, add a S2 config
struct(SMMUS2Cfg), composed of the following fields and embedded in
the main SMMUTransCfg:
 -tsz: Size of IPA input region (S2T0SZ)
 -sl0: Start level of translation (S2SL0)
 -affd: AF Fault Disable (S2AFFD)
 -record_faults: Record fault events (S2R)
 -granule_sz: Granule page shift (based on S2TG)
 -vmid: Virtual Machine ID (S2VMID)
 -vttb: Address of translation table base (S2TTB)
 -eff_ps: Effective PA output range (based on S2PS)

They will be used in the next patches in stage-2 address translation.

The fields in SMMUS2Cfg, are reordered to make the shared and stage-1
fields next to each other, this reordering didn't change the struct
size (104 bytes before and after).

Stage-1 only fields: aa64, asid, tt, ttb, tbi, record_faults, oas.
oas is stage-1 output address size. However, it is used to check
input address in case stage-1 is unimplemented or bypassed according
to SMMUv3 manual IHI0070.E "3.4. Address sizes"

Shared fields: stage, disabled, bypassed, aborted, iotlb_*.

No functional change intended.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-3-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUTLBEntry {
     uint8_t granule;
 } SMMUTLBEntry;
 
+/* Stage-2 configuration. */
+typedef struct SMMUS2Cfg {
+    uint8_t tsz;            /* Size of IPA input region (S2T0SZ) */
+    uint8_t sl0;            /* Start level of translation (S2SL0) */
+    bool affd;              /* AF Fault Disable (S2AFFD) */
+    bool record_faults;     /* Record fault events (S2R) */
+    uint8_t granule_sz;     /* Granule page shift (based on S2TG) */
+    uint8_t eff_ps;         /* Effective PA output range (based on S2PS) */
+    uint16_t vmid;          /* Virtual Machine ID (S2VMID) */
+    uint64_t vttb;          /* Address of translation table base (S2TTB) */
+} SMMUS2Cfg;
+
 /*
  * Generic structure populated by derived SMMU devices
  * after decoding the configuration information and used as
  * input to the page table walk
  */
 typedef struct SMMUTransCfg {
+    /* Shared fields between stage-1 and stage-2. */
     int stage;                 /* translation stage */
-    bool aa64;                 /* arch64 or aarch32 translation table */
     bool disabled;             /* smmu is disabled */
     bool bypassed;             /* translation is bypassed */
     bool aborted;              /* translation is aborted */
+    uint32_t iotlb_hits;       /* counts IOTLB hits */
+    uint32_t iotlb_misses;     /* counts IOTLB misses*/
+    /* Used by stage-1 only. */
+    bool aa64;                 /* arch64 or aarch32 translation table */
     bool record_faults;        /* record fault events */
     uint64_t ttb;              /* TT base address */
     uint8_t oas;               /* output address width */
     uint8_t tbi;               /* Top Byte Ignore */
     uint16_t asid;
     SMMUTransTableInfo tt[2];
-    uint32_t iotlb_hits;       /* counts IOTLB hits for this asid */
-    uint32_t iotlb_misses;     /* counts IOTLB misses for this asid */
+    /* Used by stage-2 only. */
+    struct SMMUS2Cfg s2cfg;
 } SMMUTransCfg;
 
 typedef struct SMMUDevice {
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, rename smmu_ptw_64 to
smmu_ptw_64_s1 and refactor some of the code so it can be reused in
stage-2 page table walk.

Remove AA64 check from PTW as decode_cd already ensures that AA64 is
used, otherwise it faults with C_BAD_CD.

A stage member is added to SMMUPTWEventInfo to differentiate
between stage-1 and stage-2 ptw faults.

Add stage argument to trace_smmu_ptw_level be consistent with other
trace events.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-4-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h | 16 +++++++++++++---
 hw/arm/smmu-common.c         | 27 ++++++++++-----------------
 hw/arm/smmuv3.c              |  2 ++
 hw/arm/trace-events          |  2 +-
 4 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/pci/pci.h"
 #include "qom/object.h"
 
-#define SMMU_PCI_BUS_MAX      256
-#define SMMU_PCI_DEVFN_MAX    256
-#define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
+#define SMMU_PCI_BUS_MAX                    256
+#define SMMU_PCI_DEVFN_MAX                  256
+#define SMMU_PCI_DEVFN(sid)                 (sid & 0xFF)
+
+/* VMSAv8-64 Translation constants and functions */
+#define VMSA_LEVELS                         4
+
+#define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
+#define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
+                                             (VMSA_LEVELS - (lvl)))
+#define VMSA_IDXMSK(isz, strd, lvl)         ((1ULL << \
+                                             VMSA_BIT_LVL(isz, strd, lvl)) - 1)
 
 /*
  * Page table walk error types
@@ -XXX,XX +XXX,XX @@ typedef enum {
 } SMMUPTWEventType;
 
 typedef struct SMMUPTWEventInfo {
+    int stage;
     SMMUPTWEventType type;
     dma_addr_t addr; /* fetched address that induced an abort, if any */
 } SMMUPTWEventInfo;
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
 }
 
 /**
- * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
+ * smmu_ptw_64_s1 - VMSAv8-64 Walk of the page tables for a given IOVA
  * @cfg: translation config
  * @iova: iova to translate
  * @perm: access type
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
  * Upon success, @tlbe is filled with translated_addr and entry
  * permission rights.
  */
-static int smmu_ptw_64(SMMUTransCfg *cfg,
-                       dma_addr_t iova, IOMMUAccessFlags perm,
-                       SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+static int smmu_ptw_64_s1(SMMUTransCfg *cfg,
+                          dma_addr_t iova, IOMMUAccessFlags perm,
+                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
     dma_addr_t baseaddr, indexmask;
     int stage = cfg->stage;
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
     }
 
     granule_sz = tt->granule_sz;
-    stride = granule_sz - 3;
+    stride = VMSA_STRIDE(granule_sz);
     inputsize = 64 - tt->tsz;
     level = 4 - (inputsize - 4) / stride;
-    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
+    indexmask = VMSA_IDXMSK(inputsize, stride, level);
     baseaddr = extract64(tt->ttb, 0, 48);
     baseaddr &= ~indexmask;
 
-    while (level <= 3) {
+    while (level < VMSA_LEVELS) {
         uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
         uint64_t mask = subpage_size - 1;
         uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
         if (get_pte(baseaddr, offset, &pte, info)) {
                 goto error;
         }
-        trace_smmu_ptw_level(level, iova, subpage_size,
+        trace_smmu_ptw_level(stage, level, iova, subpage_size,
                              baseaddr, offset, pte);
 
         if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
     info->type = SMMU_PTW_ERR_TRANSLATION;
 
 error:
+    info->stage = 1;
     tlbe->entry.perm = IOMMU_NONE;
     return -EINVAL;
 }
@@ -XXX,XX +XXX,XX @@ error:
 int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
              SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
-    if (!cfg->aa64) {
-        /*
-         * This code path is not entered as we check this while decoding
-         * the configuration data in the derived SMMU model.
-         */
-        g_assert_not_reached();
-    }
-
-    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
+    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
 }
 
 /**
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
     cached_entry = g_new0(SMMUTLBEntry, 1);
 
     if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) {
+        /* All faults from PTW has S2 field. */
+        event.u.f_walk_eabt.s2 = (ptw_info.stage == 2);
         g_free(cached_entry);
         switch (ptw_info.type) {
         case SMMU_PTW_ERR_WALK_EABT:
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
 
 # smmu-common.c
 smmu_add_mr(const char *name) "%s"
-smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
+smmu_ptw_level(int stage, int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
 smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
 smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
 smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, add Stage-2 PTW code.
Only Aarch64 format is supported as stage-1.

Nesting stage-1 and stage-2 is not supported right now.

HTTU is not supported, SW is expected to maintain the Access flag.
This is described in the SMMUv3 manual(IHI 0070.E.a)
"5.2. Stream Table Entry" in "[181] S2AFFD".
This flag determines the behavior on access of a stage-2 page whose
descriptor has AF == 0:
- 0b0: An Access flag fault occurs (stall not supported).
- 0b1: An Access flag fault never occurs.
An Access fault takes priority over a Permission fault.

There are 3 address size checks for stage-2 according to
(IHI 0070.E.a) in "3.4. Address sizes".
- As nesting is not supported, input address is passed directly to
stage-2, and is checked against IAS.
We use cfg->oas to hold the OAS when stage-1 is not used, this is set
in the next patch.
This check is done outside of smmu_ptw_64_s2 as it is not part of
stage-2(it throws stage-1 fault), and the stage-2 function shouldn't
change it's behavior when nesting is supported.
When nesting is supported and we figure out how to combine TLB for
stage-1 and stage-2 we can move this check into the stage-1 function
as described in ARM DDI0487I.a in pseudocode
aarch64/translation/vmsa_translation/AArch64.S1Translate
aarch64/translation/vmsa_translation/AArch64.S1DisabledOutput

- Input to stage-2 is checked against s2t0sz, and throws stage-2
transaltion fault if exceeds it.

- Output of stage-2 is checked against effective PA output range.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-5-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-internal.h |  35 ++++++++++
 hw/arm/smmu-common.c   | 142 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 176 insertions(+), 1 deletion(-)

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-internal.h
+++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@
 #define PTE_APTABLE(pte) \
     (extract64(pte, 61, 2))
 
+#define PTE_AF(pte) \
+    (extract64(pte, 10, 1))
 /*
  * TODO: At the moment all transactions are considered as privileged (EL1)
  * as IOMMU translation callback does not pass user/priv attributes.
@@ -XXX,XX +XXX,XX @@
 #define is_permission_fault(ap, perm) \
     (((perm) & IOMMU_WO) && ((ap) & 0x2))
 
+#define is_permission_fault_s2(s2ap, perm) \
+    (!(((s2ap) & (perm)) == (perm)))
+
 #define PTE_AP_TO_PERM(ap) \
     (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
 
@@ -XXX,XX +XXX,XX @@ uint64_t iova_level_offset(uint64_t iova, int inputsize,
             MAKE_64BIT_MASK(0, gsz - 3);
 }
 
+/* FEAT_LPA2 and FEAT_TTST are not implemented. */
+static inline int get_start_level(int sl0 , int granule_sz)
+{
+    /* ARM DDI0487I.a: Table D8-12. */
+    if (granule_sz == 12) {
+        return 2 - sl0;
+    }
+    /* ARM DDI0487I.a: Table D8-22 and Table D8-31. */
+    return 3 - sl0;
+}
+
+/*
+ * Index in a concatenated first level stage-2 page table.
+ * ARM DDI0487I.a: D8.2.2 Concatenated translation tables.
+ */
+static inline int pgd_concat_idx(int start_level, int granule_sz,
+                                 dma_addr_t ipa)
+{
+    uint64_t ret;
+    /*
+     * Get the number of bits handled by next levels, then any extra bits in
+     * the address should index the concatenated tables. This relation can be
+     * deduced from tables in ARM DDI0487I.a: D8.2.7-9
+     */
+    int shift =  level_shift(start_level - 1, granule_sz);
+
+    ret = ipa >> shift;
+    return ret;
+}
+
 #define SMMU_IOTLB_ASID(key) ((key).asid)
 
 typedef struct SMMUIOTLBPageInvInfo {
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ error:
     return -EINVAL;
 }
 
+/**
+ * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa
+ * for stage-2.
+ * @cfg: translation config
+ * @ipa: ipa to translate
+ * @perm: access type
+ * @tlbe: SMMUTLBEntry (out)
+ * @info: handle to an error info
+ *
+ * Return 0 on success, < 0 on error. In case of error, @info is filled
+ * and tlbe->perm is set to IOMMU_NONE.
+ * Upon success, @tlbe is filled with translated_addr and entry
+ * permission rights.
+ */
+static int smmu_ptw_64_s2(SMMUTransCfg *cfg,
+                          dma_addr_t ipa, IOMMUAccessFlags perm,
+                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+{
+    const int stage = 2;
+    int granule_sz = cfg->s2cfg.granule_sz;
+    /* ARM DDI0487I.a: Table D8-7. */
+    int inputsize = 64 - cfg->s2cfg.tsz;
+    int level = get_start_level(cfg->s2cfg.sl0, granule_sz);
+    int stride = VMSA_STRIDE(granule_sz);
+    int idx = pgd_concat_idx(level, granule_sz, ipa);
+    /*
+     * Get the ttb from concatenated structure.
+     * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte))
+     */
+    uint64_t baseaddr = extract64(cfg->s2cfg.vttb, 0, 48) + (1 << stride) *
+                                  idx * sizeof(uint64_t);
+    dma_addr_t indexmask = VMSA_IDXMSK(inputsize, stride, level);
+
+    baseaddr &= ~indexmask;
+
+    /*
+     * On input, a stage 2 Translation fault occurs if the IPA is outside the
+     * range configured by the relevant S2T0SZ field of the STE.
+     */
+    if (ipa >= (1ULL << inputsize)) {
+        info->type = SMMU_PTW_ERR_TRANSLATION;
+        goto error;
+    }
+
+    while (level < VMSA_LEVELS) {
+        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
+        uint64_t mask = subpage_size - 1;
+        uint32_t offset = iova_level_offset(ipa, inputsize, level, granule_sz);
+        uint64_t pte, gpa;
+        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
+        uint8_t s2ap;
+
+        if (get_pte(baseaddr, offset, &pte, info)) {
+                goto error;
+        }
+        trace_smmu_ptw_level(stage, level, ipa, subpage_size,
+                             baseaddr, offset, pte);
+        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
+            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
+                                       pte_addr, offset, pte);
+            break;
+        }
+
+        if (is_table_pte(pte, level)) {
+            baseaddr = get_table_pte_address(pte, granule_sz);
+            level++;
+            continue;
+        } else if (is_page_pte(pte, level)) {
+            gpa = get_page_pte_address(pte, granule_sz);
+            trace_smmu_ptw_page_pte(stage, level, ipa,
+                                    baseaddr, pte_addr, pte, gpa);
+        } else {
+            uint64_t block_size;
+
+            gpa = get_block_pte_address(pte, level, granule_sz,
+                                        &block_size);
+            trace_smmu_ptw_block_pte(stage, level, baseaddr,
+                                     pte_addr, pte, ipa, gpa,
+                                     block_size >> 20);
+        }
+
+        /*
+         * If S2AFFD and PTE.AF are 0 => fault. (5.2. Stream Table Entry)
+         * An Access fault takes priority over a Permission fault.
+         */
+        if (!PTE_AF(pte) && !cfg->s2cfg.affd) {
+            info->type = SMMU_PTW_ERR_ACCESS;
+            goto error;
+        }
+
+        s2ap = PTE_AP(pte);
+        if (is_permission_fault_s2(s2ap, perm)) {
+            info->type = SMMU_PTW_ERR_PERMISSION;
+            goto error;
+        }
+
+        /*
+         * The address output from the translation causes a stage 2 Address
+         * Size fault if it exceeds the effective PA output range.
+         */
+        if (gpa >= (1ULL << cfg->s2cfg.eff_ps)) {
+            info->type = SMMU_PTW_ERR_ADDR_SIZE;
+            goto error;
+        }
+
+        tlbe->entry.translated_addr = gpa;
+        tlbe->entry.iova = ipa & ~mask;
+        tlbe->entry.addr_mask = mask;
+        tlbe->entry.perm = s2ap;
+        tlbe->level = level;
+        tlbe->granule = granule_sz;
+        return 0;
+    }
+    info->type = SMMU_PTW_ERR_TRANSLATION;
+
+error:
+    info->stage = 2;
+    tlbe->entry.perm = IOMMU_NONE;
+    return -EINVAL;
+}
+
 /**
  * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
  *
@@ -XXX,XX +XXX,XX @@ error:
 int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
              SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
-    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
+    if (cfg->stage == 1) {
+        return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
+    } else if (cfg->stage == 2) {
+        /*
+         * If bypassing stage 1(or unimplemented), the input address is passed
+         * directly to stage 2 as IPA. If the input address of a transaction
+         * exceeds the size of the IAS, a stage 1 Address Size fault occurs.
+         * For AA64, IAS = OAS according to (IHI 0070.E.a) "3.4 Address sizes"
+         */
+        if (iova >= (1ULL << cfg->oas)) {
+            info->type = SMMU_PTW_ERR_ADDR_SIZE;
+            info->stage = 1;
+            tlbe->entry.perm = IOMMU_NONE;
+            return -EINVAL;
+        }
+
+        return smmu_ptw_64_s2(cfg, iova, perm, tlbe, info);
+    }
+
+    g_assert_not_reached();
 }
 
 /**
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Parse stage-2 configuration from STE and populate it in SMMUS2Cfg.
Validity of field values are checked when possible.

Only AA64 tables are supported and Small Translation Tables (STT) are
not supported.

According to SMMUv3 UM(IHI0070E) "5.2 Stream Table Entry": All fields
with an S2 prefix (with the exception of S2VMID) are IGNORED when
stage-2 bypasses translation (Config[1] == 0).

Which means that VMID can be used(for TLB tagging) even if stage-2 is
bypassed, so we parse it unconditionally when S2P exists. Otherwise
it is set to -1.(only S1P)

As stall is not supported, if S2S is set the translation would abort.
For S2R, we reuse the same code used for stage-1 with flag
record_faults. However when nested translation is supported we would
need to separate stage-1 and stage-2 faults.

Fix wrong shift in STE_S2HD, STE_S2HA, STE_S2S.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20230516203327.2051088-6-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h     |  10 +-
 include/hw/arm/smmu-common.h |   1 +
 include/hw/arm/smmuv3.h      |   3 +
 hw/arm/smmuv3.c              | 181 +++++++++++++++++++++++++++++++++--
 4 files changed, 185 insertions(+), 10 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef struct CD {
 #define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
 #define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
 #define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
-#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
-#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
-#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
+#define STE_S2ENDI(x)      extract32((x)->word[5], 20, 1)
+#define STE_S2AFFD(x)      extract32((x)->word[5], 21, 1)
+#define STE_S2HD(x)        extract32((x)->word[5], 23, 1)
+#define STE_S2HA(x)        extract32((x)->word[5], 24, 1)
+#define STE_S2S(x)         extract32((x)->word[5], 25, 1)
+#define STE_S2R(x)         extract32((x)->word[5], 26, 1)
+
 #define STE_CTXPTR(x)                                           \
     ({                                                          \
         unsigned long addr;                                     \
diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@
 
 /* VMSAv8-64 Translation constants and functions */
 #define VMSA_LEVELS                         4
+#define VMSA_MAX_S2_CONCAT                  16
 
 #define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
 #define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmuv3.h
+++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@ struct SMMUv3Class {
 #define TYPE_ARM_SMMUV3   "arm-smmuv3"
 OBJECT_DECLARE_TYPE(SMMUv3State, SMMUv3Class, ARM_SMMUV3)
 
+#define STAGE1_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S1P)
+#define STAGE2_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S2P)
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 #include "smmuv3-internal.h"
 #include "smmu-internal.h"
 
+#define PTW_RECORD_FAULT(cfg)   (((cfg)->stage == 1) ? (cfg)->record_faults : \
+                                 (cfg)->s2cfg.record_faults)
+
 /**
  * smmuv3_trigger_irq - pulse @irq if enabled and update
  * GERROR register in case of GERROR interrupt
@@ -XXX,XX +XXX,XX @@ static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
     return 0;
 }
 
+/*
+ * Max valid value is 39 when SMMU_IDR3.STT == 0.
+ * In architectures after SMMUv3.0:
+ * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this
+ *   field is MAX(16, 64-IAS)
+ * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field
+ *   is (64-IAS).
+ * As we only support AA64, IAS = OAS.
+ */
+static bool s2t0sz_valid(SMMUTransCfg *cfg)
+{
+    if (cfg->s2cfg.tsz > 39) {
+        return false;
+    }
+
+    if (cfg->s2cfg.granule_sz == 16) {
+        return (cfg->s2cfg.tsz >= 64 - oas2bits(SMMU_IDR5_OAS));
+    }
+
+    return (cfg->s2cfg.tsz >= MAX(64 - oas2bits(SMMU_IDR5_OAS), 16));
+}
+
+/*
+ * Return true if s2 page table config is valid.
+ * This checks with the configured start level, ias_bits and granularity we can
+ * have a valid page table as described in ARM ARM D8.2 Translation process.
+ * The idea here is to see for the highest possible number of IPA bits, how
+ * many concatenated tables we would need, if it is more than 16, then this is
+ * not possible.
+ */
+static bool s2_pgtable_config_valid(uint8_t sl0, uint8_t t0sz, uint8_t gran)
+{
+    int level = get_start_level(sl0, gran);
+    uint64_t ipa_bits = 64 - t0sz;
+    uint64_t max_ipa = (1ULL << ipa_bits) - 1;
+    int nr_concat = pgd_concat_idx(level, gran, max_ipa) + 1;
+
+    return nr_concat <= VMSA_MAX_S2_CONCAT;
+}
+
+static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
+{
+    cfg->stage = 2;
+
+    if (STE_S2AA64(ste) == 0x0) {
+        qemu_log_mask(LOG_UNIMP,
+                      "SMMUv3 AArch32 tables not supported\n");
+        g_assert_not_reached();
+    }
+
+    switch (STE_S2TG(ste)) {
+    case 0x0: /* 4KB */
+        cfg->s2cfg.granule_sz = 12;
+        break;
+    case 0x1: /* 64KB */
+        cfg->s2cfg.granule_sz = 16;
+        break;
+    case 0x2: /* 16KB */
+        cfg->s2cfg.granule_sz = 14;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste));
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.vttb = STE_S2TTB(ste);
+
+    cfg->s2cfg.sl0 = STE_S2SL0(ste);
+    /* FEAT_TTST not supported. */
+    if (cfg->s2cfg.sl0 == 0x3) {
+        qemu_log_mask(LOG_UNIMP, "SMMUv3 S2SL0 = 0x3 has no meaning!\n");
+        goto bad_ste;
+    }
+
+    /* For AA64, The effective S2PS size is capped to the OAS. */
+    cfg->s2cfg.eff_ps = oas2bits(MIN(STE_S2PS(ste), SMMU_IDR5_OAS));
+    /*
+     * It is ILLEGAL for the address in S2TTB to be outside the range
+     * described by the effective S2PS value.
+     */
+    if (cfg->s2cfg.vttb & ~(MAKE_64BIT_MASK(0, cfg->s2cfg.eff_ps))) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 S2TTB too large 0x%lx, effective PS %d bits\n",
+                      cfg->s2cfg.vttb,  cfg->s2cfg.eff_ps);
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.tsz = STE_S2T0SZ(ste);
+
+    if (!s2t0sz_valid(cfg)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 bad STE S2T0SZ = %d\n",
+                      cfg->s2cfg.tsz);
+        goto bad_ste;
+    }
+
+    if (!s2_pgtable_config_valid(cfg->s2cfg.sl0, cfg->s2cfg.tsz,
+                                    cfg->s2cfg.granule_sz)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 STE stage 2 config not valid!\n");
+        goto bad_ste;
+    }
+
+    /* Only LE supported(IDR0.TTENDIAN). */
+    if (STE_S2ENDI(ste)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 STE_S2ENDI only supports LE!\n");
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.affd = STE_S2AFFD(ste);
+
+    cfg->s2cfg.record_faults = STE_S2R(ste);
+    /* As stall is not supported. */
+    if (STE_S2S(ste)) {
+        qemu_log_mask(LOG_UNIMP, "SMMUv3 Stall not implemented!\n");
+        goto bad_ste;
+    }
+
+    /* This is still here as stage 2 has not been fully enabled yet. */
+    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
+    goto bad_ste;
+
+    return 0;
+
+bad_ste:
+    return -EINVAL;
+}
+
 /* Returns < 0 in case of invalid STE, 0 otherwise */
 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
                       STE *ste, SMMUEventInfo *event)
 {
     uint32_t config;
+    int ret;
 
     if (!STE_VALID(ste)) {
         if (!event->inval_ste_allowed) {
@@ -XXX,XX +XXX,XX @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
         return 0;
     }
 
-    if (STE_CFG_S2_ENABLED(config)) {
-        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
+    /*
+     * If a stage is enabled in SW while not advertised, throw bad ste
+     * according to user manual(IHI0070E) "5.2 Stream Table Entry".
+     */
+    if (!STAGE1_SUPPORTED(s) && STE_CFG_S1_ENABLED(config)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S1 used but not supported.\n");
         goto bad_ste;
     }
+    if (!STAGE2_SUPPORTED(s) && STE_CFG_S2_ENABLED(config)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S2 used but not supported.\n");
+        goto bad_ste;
+    }
+
+    if (STAGE2_SUPPORTED(s)) {
+        /* VMID is considered even if s2 is disabled. */
+        cfg->s2cfg.vmid = STE_S2VMID(ste);
+    } else {
+        /* Default to -1 */
+        cfg->s2cfg.vmid = -1;
+    }
+
+    if (STE_CFG_S2_ENABLED(config)) {
+        /*
+         * Stage-1 OAS defaults to OAS even if not enabled as it would be used
+         * in input address check for stage-2.
+         */
+        cfg->oas = oas2bits(SMMU_IDR5_OAS);
+        ret = decode_ste_s2_cfg(cfg, ste);
+        if (ret) {
+            goto bad_ste;
+        }
+    }
 
     if (STE_S1CDMAX(ste) != 0) {
         qemu_log_mask(LOG_UNIMP,
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
     if (cached_entry) {
         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
             status = SMMU_TRANS_ERROR;
-            if (cfg->record_faults) {
+            /*
+             * We know that the TLB only contains either stage-1 or stage-2 as
+             * nesting is not supported. So it is sufficient to check the
+             * translation stage to know the TLB stage for now.
+             */
+            event.u.f_walk_eabt.s2 = (cfg->stage == 2);
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_PERMISSION;
                 event.u.f_permission.addr = addr;
                 event.u.f_permission.rnw = flag & 0x1;
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
             event.u.f_walk_eabt.addr2 = ptw_info.addr;
             break;
         case SMMU_PTW_ERR_TRANSLATION:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_TRANSLATION;
                 event.u.f_translation.addr = addr;
                 event.u.f_translation.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_ADDR_SIZE:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_ADDR_SIZE;
                 event.u.f_addr_size.addr = addr;
                 event.u.f_addr_size.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_ACCESS:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_ACCESS;
                 event.u.f_access.addr = addr;
                 event.u.f_access.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_PERMISSION:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_PERMISSION;
                 event.u.f_permission.addr = addr;
                 event.u.f_permission.rnw = flag & 0x1;
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Right now, either stage-1 or stage-2 are supported, this simplifies
how we can deal with TLBs.
This patch makes TLB lookup work if stage-2 is enabled instead of
stage-1.
TLB lookup is done before a PTW, if a valid entry is found we won't
do the PTW.
To be able to do TLB lookup, we need the correct tagging info, as
granularity and input size, so we get this based on the supported
translation stage. The TLB entries are added correctly from each
stage PTW.

When nested translation is supported, this would need to change, for
example if we go with a combined TLB implementation, we would need to
use the min of the granularities in TLB.

As stage-2 shouldn't be tagged by ASID, it will be set to -1 if S1P
is not enabled.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-7-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c | 44 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 33 insertions(+), 11 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
     STE ste;
     CD cd;
 
+    /* ASID defaults to -1 (if s1 is not supported). */
+    cfg->asid = -1;
+
     ret = smmu_find_ste(s, sid, &ste, event);
     if (ret) {
         return ret;
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
         .addr_mask = ~(hwaddr)0,
         .perm = IOMMU_NONE,
     };
+    /*
+     * Combined attributes used for TLB lookup, as only one stage is supported,
+     * it will hold attributes based on the enabled stage.
+     */
+    SMMUTransTableInfo tt_combined;
 
     qemu_mutex_lock(&s->mutex);
 
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
         goto epilogue;
     }
 
-    tt = select_tt(cfg, addr);
-    if (!tt) {
-        if (cfg->record_faults) {
-            event.type = SMMU_EVT_F_TRANSLATION;
-            event.u.f_translation.addr = addr;
-            event.u.f_translation.rnw = flag & 0x1;
+    if (cfg->stage == 1) {
+        /* Select stage1 translation table. */
+        tt = select_tt(cfg, addr);
+        if (!tt) {
+            if (cfg->record_faults) {
+                event.type = SMMU_EVT_F_TRANSLATION;
+                event.u.f_translation.addr = addr;
+                event.u.f_translation.rnw = flag & 0x1;
+            }
+            status = SMMU_TRANS_ERROR;
+            goto epilogue;
         }
-        status = SMMU_TRANS_ERROR;
-        goto epilogue;
-    }
+        tt_combined.granule_sz = tt->granule_sz;
+        tt_combined.tsz = tt->tsz;
 
-    page_mask = (1ULL << (tt->granule_sz)) - 1;
+    } else {
+        /* Stage2. */
+        tt_combined.granule_sz = cfg->s2cfg.granule_sz;
+        tt_combined.tsz = cfg->s2cfg.tsz;
+    }
+    /*
+     * TLB lookup looks for granule and input size for a translation stage,
+     * as only one stage is supported right now, choose the right values
+     * from the configuration.
+     */
+    page_mask = (1ULL << tt_combined.granule_sz) - 1;
     aligned_addr = addr & ~page_mask;
 
-    cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr);
+    cached_entry = smmu_iotlb_lookup(bs, cfg, &tt_combined, aligned_addr);
     if (cached_entry) {
         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
             status = SMMU_TRANS_ERROR;
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Allow TLB to be tagged with VMID.

If stage-1 is only supported, VMID is set to -1 and ignored from STE
and CMD_TLBI_NH* cmds.

Update smmu_iotlb_insert trace event to have vmid.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-8-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-internal.h       |  2 ++
 include/hw/arm/smmu-common.h |  5 +++--
 hw/arm/smmu-common.c         | 36 ++++++++++++++++++++++--------------
 hw/arm/smmuv3.c              | 12 +++++++++---
 hw/arm/trace-events          |  6 +++---
 5 files changed, 39 insertions(+), 22 deletions(-)

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-internal.h
+++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@ static inline int pgd_concat_idx(int start_level, int granule_sz,
 }
 
 #define SMMU_IOTLB_ASID(key) ((key).asid)
+#define SMMU_IOTLB_VMID(key) ((key).vmid)
 
 typedef struct SMMUIOTLBPageInvInfo {
     int asid;
+    int vmid;
     uint64_t iova;
     uint64_t mask;
 } SMMUIOTLBPageInvInfo;
diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUPciBus {
 typedef struct SMMUIOTLBKey {
     uint64_t iova;
     uint16_t asid;
+    uint16_t vmid;
     uint8_t tg;
     uint8_t level;
 } SMMUIOTLBKey;
@@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid);
 SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
                                 SMMUTransTableInfo *tt, hwaddr iova);
 void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *entry);
-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
+SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level);
 void smmu_iotlb_inv_all(SMMUState *s);
 void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
-void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
+void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl);
 
 /* Unmap the range of all the notifiers registered to any IOMMU mr */
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static guint smmu_iotlb_key_hash(gconstpointer v)
 
     /* Jenkins hash */
     a = b = c = JHASH_INITVAL + sizeof(*key);
-    a += key->asid + key->level + key->tg;
+    a += key->asid + key->vmid + key->level + key->tg;
     b += extract64(key->iova, 0, 32);
     c += extract64(key->iova, 32, 32);
 
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
     SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2;
 
     return (k1->asid == k2->asid) && (k1->iova == k2->iova) &&
-           (k1->level == k2->level) && (k1->tg == k2->tg);
+           (k1->level == k2->level) && (k1->tg == k2->tg) &&
+           (k1->vmid == k2->vmid);
 }
 
-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
+SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level)
 {
-    SMMUIOTLBKey key = {.asid = asid, .iova = iova, .tg = tg, .level = level};
+    SMMUIOTLBKey key = {.asid = asid, .vmid = vmid, .iova = iova,
+                        .tg = tg, .level = level};
 
     return key;
 }
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
         uint64_t mask = subpage_size - 1;
         SMMUIOTLBKey key;
 
-        key = smmu_get_iotlb_key(cfg->asid, iova & ~mask, tg, level);
+        key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid,
+                                 iova & ~mask, tg, level);
         entry = g_hash_table_lookup(bs->iotlb, &key);
         if (entry) {
             break;
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
 
     if (entry) {
         cfg->iotlb_hits++;
-        trace_smmu_iotlb_lookup_hit(cfg->asid, iova,
+        trace_smmu_iotlb_lookup_hit(cfg->asid, cfg->s2cfg.vmid, iova,
                                     cfg->iotlb_hits, cfg->iotlb_misses,
                                     100 * cfg->iotlb_hits /
                                     (cfg->iotlb_hits + cfg->iotlb_misses));
     } else {
         cfg->iotlb_misses++;
-        trace_smmu_iotlb_lookup_miss(cfg->asid, iova,
+        trace_smmu_iotlb_lookup_miss(cfg->asid, cfg->s2cfg.vmid, iova,
                                      cfg->iotlb_hits, cfg->iotlb_misses,
                                      100 * cfg->iotlb_hits /
                                      (cfg->iotlb_hits + cfg->iotlb_misses));
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new)
         smmu_iotlb_inv_all(bs);
     }
 
-    *key = smmu_get_iotlb_key(cfg->asid, new->entry.iova, tg, new->level);
-    trace_smmu_iotlb_insert(cfg->asid, new->entry.iova, tg, new->level);
+    *key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
+                              tg, new->level);
+    trace_smmu_iotlb_insert(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
+                            tg, new->level);
     g_hash_table_insert(bs->iotlb, key, new);
 }
 
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
 
     return SMMU_IOTLB_ASID(*iotlb_key) == asid;
 }
-
-static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
+static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                               gpointer user_data)
 {
     SMMUTLBEntry *iter = (SMMUTLBEntry *)value;
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
     if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) {
         return false;
     }
+    if (info->vmid >= 0 && info->vmid != SMMU_IOTLB_VMID(iotlb_key)) {
+        return false;
+    }
     return ((info->iova & ~entry->addr_mask) == entry->iova) ||
            ((entry->iova & ~info->mask) == info->iova);
 }
 
-void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
+void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl)
 {
     /* if tg is not set we use 4KB range invalidation */
     uint8_t granule = tg ? tg * 2 + 10 : 12;
 
     if (ttl && (num_pages == 1) && (asid >= 0)) {
-        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
+        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, iova, tg, ttl);
 
         if (g_hash_table_remove(s->iotlb, &key)) {
             return;
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
 
     SMMUIOTLBPageInvInfo info = {
         .asid = asid, .iova = iova,
+        .vmid = vmid,
         .mask = (num_pages * 1 << granule) - 1};
 
     g_hash_table_foreach_remove(s->iotlb,
-                                smmu_hash_remove_by_asid_iova,
+                                smmu_hash_remove_by_asid_vmid_iova,
                                 &info);
 }
 
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
 {
     dma_addr_t end, addr = CMD_ADDR(cmd);
     uint8_t type = CMD_TYPE(cmd);
-    uint16_t vmid = CMD_VMID(cmd);
+    int vmid = -1;
     uint8_t scale = CMD_SCALE(cmd);
     uint8_t num = CMD_NUM(cmd);
     uint8_t ttl = CMD_TTL(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     uint64_t num_pages;
     uint8_t granule;
     int asid = -1;
+    SMMUv3State *smmuv3 = ARM_SMMUV3(s);
+
+    /* Only consider VMID if stage-2 is supported. */
+    if (STAGE2_SUPPORTED(smmuv3)) {
+        vmid = CMD_VMID(cmd);
+    }
 
     if (type == SMMU_CMD_TLBI_NH_VA) {
         asid = CMD_ASID(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     if (!tg) {
         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
-        smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl);
+        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
         num_pages = (mask + 1) >> granule;
         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
-        smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
+        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
     }
 }
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_iotlb_inv_all(void) "IOTLB invalidate all"
 smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
 smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
 smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
-smmu_iotlb_lookup_hit(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-smmu_iotlb_lookup_miss(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-smmu_iotlb_insert(uint16_t asid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d addr=0x%"PRIx64" tg=%d level=%d"
+smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
+smmu_iotlb_lookup_miss(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
+smmu_iotlb_insert(uint16_t asid, uint16_t vmid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d vmid=%d addr=0x%"PRIx64" tg=%d level=%d"
 
 # smmuv3.c
 smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

CMD_TLBI_S2_IPA: As S1+S2 is not enabled, for now this can be the
same as CMD_TLBI_NH_VAA.

CMD_TLBI_S12_VMALL: Added new function to invalidate TLB by VMID.

For stage-1 only commands, add a check to throw CERROR_ILL if used
when stage-1 is not supported.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-9-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h |  1 +
 hw/arm/smmu-common.c         | 16 +++++++++++
 hw/arm/smmuv3.c              | 55 ++++++++++++++++++++++++++++++------
 hw/arm/trace-events          |  4 ++-
 4 files changed, 67 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level);
 void smmu_iotlb_inv_all(SMMUState *s);
 void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
+void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid);
 void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl);
 
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
 
     return SMMU_IOTLB_ASID(*iotlb_key) == asid;
 }
+
+static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value,
+                                         gpointer user_data)
+{
+    uint16_t vmid = *(uint16_t *)user_data;
+    SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;
+
+    return SMMU_IOTLB_VMID(*iotlb_key) == vmid;
+}
+
 static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                               gpointer user_data)
 {
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
     g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
 }
 
+inline void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid)
+{
+    trace_smmu_iotlb_inv_vmid(vmid);
+    g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid);
+}
+
 /* VMSAv8-64 Translation */
 
 /**
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
     }
 }
 
-static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
+static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 {
     dma_addr_t end, addr = CMD_ADDR(cmd);
     uint8_t type = CMD_TYPE(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     }
 
     if (!tg) {
-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
+        trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
         uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
 
         num_pages = (mask + 1) >> granule;
-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
+        trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
         {
             uint16_t asid = CMD_ASID(&cmd);
 
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+
             trace_smmuv3_cmdq_tlbi_nh_asid(asid);
             smmu_inv_notifiers_all(&s->smmu_state);
             smmu_iotlb_inv_asid(bs, asid);
             break;
         }
         case SMMU_CMD_TLBI_NH_ALL:
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            QEMU_FALLTHROUGH;
         case SMMU_CMD_TLBI_NSNH_ALL:
             trace_smmuv3_cmdq_tlbi_nh();
             smmu_inv_notifiers_all(&s->smmu_state);
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
             break;
         case SMMU_CMD_TLBI_NH_VAA:
         case SMMU_CMD_TLBI_NH_VA:
-            smmuv3_s1_range_inval(bs, &cmd);
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            smmuv3_range_inval(bs, &cmd);
+            break;
+        case SMMU_CMD_TLBI_S12_VMALL:
+        {
+            uint16_t vmid = CMD_VMID(&cmd);
+
+            if (!STAGE2_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+
+            trace_smmuv3_cmdq_tlbi_s12_vmid(vmid);
+            smmu_inv_notifiers_all(&s->smmu_state);
+            smmu_iotlb_inv_vmid(bs, vmid);
+            break;
+        }
+        case SMMU_CMD_TLBI_S2_IPA:
+            if (!STAGE2_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            /*
+             * As currently only either s1 or s2 are supported
+             * we can reuse same function for s2.
+             */
+            smmuv3_range_inval(bs, &cmd);
             break;
         case SMMU_CMD_TLBI_EL3_ALL:
         case SMMU_CMD_TLBI_EL3_VA:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
         case SMMU_CMD_TLBI_EL2_ASID:
         case SMMU_CMD_TLBI_EL2_VA:
         case SMMU_CMD_TLBI_EL2_VAA:
-        case SMMU_CMD_TLBI_S12_VMALL:
-        case SMMU_CMD_TLBI_S2_IPA:
         case SMMU_CMD_ATC_INV:
         case SMMU_CMD_PRI_RESP:
         case SMMU_CMD_RESUME:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
             break;
         default:
             cmd_error = SMMU_CERROR_ILL;
-            qemu_log_mask(LOG_GUEST_ERROR,
-                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
             break;
         }
         qemu_mutex_unlock(&s->mutex);
         if (cmd_error) {
+            if (cmd_error == SMMU_CERROR_ILL) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Illegal command type: %d\n", CMD_TYPE(&cmd));
+            }
             break;
         }
         /*
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, ui
 smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
 smmu_iotlb_inv_all(void) "IOTLB invalidate all"
 smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
+smmu_iotlb_inv_vmid(uint16_t vmid) "IOTLB invalidate vmid=%d"
 smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
 smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
 smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_cfgi_ste_range(int start, int end) "start=0x%x - end=0x%x"
 smmuv3_cmdq_cfgi_cd(uint32_t sid) "sid=0x%x"
 smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
 smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
-smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
+smmuv3_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
 smmuv3_cmdq_tlbi_nh(void) ""
 smmuv3_cmdq_tlbi_nh_asid(uint16_t asid) "asid=%d"
+smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
 smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
 smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
 smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In smmuv3_notify_iova, read the granule based on translation stage
and use VMID if valid value is sent.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-10-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c     | 39 ++++++++++++++++++++++++++-------------
 hw/arm/trace-events |  2 +-
 2 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ epilogue:
  * @mr: IOMMU mr region handle
  * @n: notifier to be called
  * @asid: address space ID or negative value if we don't care
+ * @vmid: virtual machine ID or negative value if we don't care
  * @iova: iova
  * @tg: translation granule (if communicated through range invalidation)
  * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
  */
 static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
                                IOMMUNotifier *n,
-                               int asid, dma_addr_t iova,
-                               uint8_t tg, uint64_t num_pages)
+                               int asid, int vmid,
+                               dma_addr_t iova, uint8_t tg,
+                               uint64_t num_pages)
 {
     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
     IOMMUTLBEvent event;
     uint8_t granule;
+    SMMUv3State *s = sdev->smmu;
 
     if (!tg) {
         SMMUEventInfo event = {.inval_ste_allowed = true};
@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
             return;
         }
 
-        tt = select_tt(cfg, iova);
-        if (!tt) {
+        if (vmid >= 0 && cfg->s2cfg.vmid != vmid) {
             return;
         }
-        granule = tt->granule_sz;
+
+        if (STAGE1_SUPPORTED(s)) {
+            tt = select_tt(cfg, iova);
+            if (!tt) {
+                return;
+            }
+            granule = tt->granule_sz;
+        } else {
+            granule = cfg->s2cfg.granule_sz;
+        }
+
     } else {
         granule = tg * 2 + 10;
     }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
     memory_region_notify_iommu_one(n, &event);
 }
 
-/* invalidate an asid/iova range tuple in all mr's */
-static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
-                                      uint8_t tg, uint64_t num_pages)
+/* invalidate an asid/vmid/iova range tuple in all mr's */
+static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid,
+                                      dma_addr_t iova, uint8_t tg,
+                                      uint64_t num_pages)
 {
     SMMUDevice *sdev;
 
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
         IOMMUMemoryRegion *mr = &sdev->iommu;
         IOMMUNotifier *n;
 
-        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova,
-                                        tg, num_pages);
+        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid,
+                                        iova, tg, num_pages);
 
         IOMMU_NOTIFIER_FOREACH(n, mr) {
-            smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages);
+            smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 
     if (!tg) {
         trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
+        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 
         num_pages = (mask + 1) >> granule;
         trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
+        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
     }
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
 smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
 smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
 smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
-smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
+smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint16_t vmid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d vmid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
 
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

As everything is in place, we can use a new system property to
advertise which stage is supported and remove bad_ste from STE
stage2 config.

The property added arm-smmuv3.stage can have 3 values:
- "1": Stage-1 only is advertised.
- "2": Stage-2 only is advertised.

If not passed or an unsupported value is passed, it will default to
stage-1.

Advertise VMID16.

Don't try to decode CD, if stage-2 is configured.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-11-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmuv3.h |  1 +
 hw/arm/smmuv3.c         | 32 ++++++++++++++++++++++----------
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmuv3.h
+++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@ struct SMMUv3State {
 
     qemu_irq     irq[4];
     QemuMutex mutex;
+    char *stage;
 };
 
 typedef enum {
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
 #include "hw/qdev-core.h"
 #include "hw/pci/pci.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
 
 static void smmuv3_init_regs(SMMUv3State *s)
 {
-    /**
-     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
-     *       multi-level stream table
-     */
-    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
+    /* Based on sys property, the stages supported in smmu will be advertised.*/
+    if (s->stage && !strcmp("2", s->stage)) {
+        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
+    } else {
+        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
+    }
+
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, VMID16, 1); /* 16-bit VMID */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
     /* terminated transaction will always be aborted/error returned */
@@ -XXX,XX +XXX,XX @@ static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
         goto bad_ste;
     }
 
-    /* This is still here as stage 2 has not been fully enabled yet. */
-    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
-    goto bad_ste;
-
     return 0;
 
 bad_ste:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
         return ret;
     }
 
-    if (cfg->aborted || cfg->bypassed) {
+    if (cfg->aborted || cfg->bypassed || (cfg->stage == 2)) {
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3 = {
     }
 };
 
+static Property smmuv3_properties[] = {
+    /*
+     * Stages of translation advertised.
+     * "1": Stage 1
+     * "2": Stage 2
+     * Defaults to stage 1
+     */
+    DEFINE_PROP_STRING("stage", SMMUv3State, stage),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void smmuv3_instance_init(Object *obj)
 {
     /* Nothing much to do here as of now */
@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
                                        &c->parent_phases);
     c->parent_realize = dc->realize;
     dc->realize = smmu_realize;
+    device_class_set_props(dc, smmuv3_properties);
 }
 
 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
-- 
2.34.1

From: Tommy Wu <tommy.wu@sifive.com>

When we receive a packet from the xilinx_axienet and then try to s2mem
through the xilinx_axidma, if the descriptor ring buffer is full in the
xilinx axidma driver, we’ll assert the DMASR.HALTED in the
function : stream_process_s2mem and return 0. In the end, we’ll be stuck in
an infinite loop in axienet_eth_rx_notify.

This patch checks the DMASR.HALTED state when we try to push data
from xilinx axi-enet to xilinx axi-dma. When the DMASR.HALTED is asserted,
we will not keep pushing the data and then prevent the infinte loop.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-id: 20230519062137.1251741-1-tommy.wu@sifive.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/dma/xilinx_axidma.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -XXX,XX +XXX,XX @@ static inline int stream_idle(struct Stream *s)
     return !!(s->regs[R_DMASR] & DMASR_IDLE);
 }
 
+static inline int stream_halted(struct Stream *s)
+{
+    return !!(s->regs[R_DMASR] & DMASR_HALTED);
+}
+
 static void stream_reset(struct Stream *s)
 {
     s->regs[R_DMASR] = DMASR_HALTED;  /* starts up halted.  */
@@ -XXX,XX +XXX,XX @@ static void stream_process_mem2s(struct Stream *s, StreamSink *tx_data_dev,
     uint64_t addr;
     bool eop;
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static size_t stream_process_s2mem(struct Stream *s, unsigned char *buf,
     unsigned int rxlen;
     size_t pos = 0;
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ xilinx_axidma_data_stream_can_push(StreamSink *obj,
     XilinxAXIDMAStreamSink *ds = XILINX_AXI_DMA_DATA_STREAM(obj);
     struct Stream *s = &ds->dma->streams[1];
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         ds->dma->notify = notify;
         ds->dma->notify_opaque = notify_opaque;
         return false;
-- 
2.34.1

From: Clément Chigot <chigot@adacore.com>

When passing --smp with a number lower than XLNX_ZYNQMP_NUM_APU_CPUS,
the expression (ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS) will result
in a positive number as ms->smp.cpus is a unsigned int.
This will raise the following error afterwards, as Qemu will try to
instantiate some additional RPUs.
  | $ qemu-system-aarch64 --smp 1 -M xlnx-zcu102
  | **
  | ERROR:../src/tcg/tcg.c:777:tcg_register_thread:
  |   assertion failed: (n < tcg_max_ctxs)

Signed-off-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20230524143714.565792-1-chigot@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zynqmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(MachineState *ms, XlnxZynqMPState *s,
                                    const char *boot_cpu, Error **errp)
 {
     int i;
-    int num_rpus = MIN(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS,
+    int num_rpus = MIN((int)(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS),
                        XLNX_ZYNQMP_NUM_RPU_CPUS);
 
     if (num_rpus <= 0) {
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

pflash-cfi02-test.c always uses the "musicpal" machine for testing,
test-arm-mptimer.c always uses the "vexpress-a9" machine, and
microbit-test.c requires the "microbit" machine, so we should only
run these tests if the machines have been enabled in the configuration.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-id: 20230524080600.1618137-1-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/meson.build | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_arm = \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
-  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
+  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') and
+   config_all_devices.has_key('CONFIG_MUSICPAL') ? ['pflash-cfi02-test'] : []) + \
   (config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed : []) + \
   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
   (config_all_devices.has_key('CONFIG_GENERIC_LOADER') ? ['hexloader-test'] : []) + \
   (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \
+  (config_all_devices.has_key('CONFIG_VEXPRESS') ? ['test-arm-mptimer'] : []) + \
+  (config_all_devices.has_key('CONFIG_MICROBIT') ? ['microbit-test'] : []) + \
   ['arm-cpu-features',
-   'microbit-test',
-   'test-arm-mptimer',
    'boot-serial-test']
 
 # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional
-- 
2.34.1

For M-profile, there is no guest-facing A-profile format FSR, but we
still use the env->exception.fsr field to pass fault information from
the point where a fault is raised to the code in
arm_v7m_cpu_do_interrupt() which interprets it and sets the M-profile
specific fault status registers.  So it doesn't matter whether we
fill in env->exception.fsr in the short format or the LPAE format, as
long as both sides agree.  As it happens arm_v7m_cpu_do_interrupt()
assumes short-form.

In compute_fsr_fsc() we weren't explicitly choosing short-form for
M-profile, but instead relied on it falling out in the wash because
arm_s1_regime_using_lpae_format() would be false.  This was broken in
commit 452c67a4 when we added v8R support, because we said "PMSAv8 is
always LPAE format" (as it is for v8R), forgetting that we were
implicitly using this code path on M-profile. At that point we would
hit a g_assert_not_reached():
 ERROR:../../target/arm/internals.h:549:arm_fi_to_lfsc: code should not be reached

#7  0x0000555555e055f7 in arm_fi_to_lfsc (fi=0x7fffecff9a90) at ../../target/arm/internals.h:549
#8  0x0000555555e05a27 in compute_fsr_fsc (env=0x555557356670, fi=0x7fffecff9a90, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff9a1c)
    at ../../target/arm/tlb_helper.c:95
#9  0x0000555555e05b62 in arm_deliver_fault (cpu=0x555557354800, addr=268961344, access_type=MMU_INST_FETCH, mmu_idx=1, fi=0x7fffecff9a90)
    at ../../target/arm/tlb_helper.c:132
#10 0x0000555555e06095 in arm_cpu_tlb_fill (cs=0x555557354800, address=268961344, size=1, access_type=MMU_INST_FETCH, mmu_idx=1, probe=false, retaddr=0)
    at ../../target/arm/tlb_helper.c:260

The specific assertion changed when commit fcc7404eff24b4c added
"assert not M-profile" to arm_is_secure_below_el3(), because the
conditions being checked in compute_fsr_fsc() include
arm_el_is_aa64(), which will end up calling arm_is_secure_below_el3()
and asserting before we try to call arm_fi_to_lfsc():

#7  0x0000555555efaf43 in arm_is_secure_below_el3 (env=0x5555574665a0) at ../../target/arm/cpu.h:2396
#8  0x0000555555efb103 in arm_is_el2_enabled (env=0x5555574665a0) at ../../target/arm/cpu.h:2448
#9  0x0000555555efb204 in arm_el_is_aa64 (env=0x5555574665a0, el=1) at ../../target/arm/cpu.h:2509
#10 0x0000555555efbdfd in compute_fsr_fsc (env=0x5555574665a0, fi=0x7fffecff99e0, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff996c)

Avoid the assertion and the incorrect FSR format selection by
explicitly making M-profile use the short-format in this function.

Fixes: 452c67a42704 ("target/arm: Enable TTBCR_EAE for ARMv8-R AArch32")a
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1658
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230523131726.866635-1-peter.maydell@linaro.org
---
 target/arm/tcg/tlb_helper.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
     uint32_t fsr, fsc;
 
-    if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
-        arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
+    /*
+     * For M-profile there is no guest-facing FSR. We compute a
+     * short-form value for env->exception.fsr which we will then
+     * examine in arm_v7m_cpu_do_interrupt(). In theory we could
+     * use the LPAE format instead as long as both bits of code agree
+     * (and arm_fi_to_lfsc() handled the M-profile specific
+     * ARMFault_QEMU_NSCExec and ARMFault_QEMU_SFault cases).
+     */
+    if (!arm_feature(env, ARM_FEATURE_M) &&
+        (target_el == 2 || arm_el_is_aa64(env, target_el) ||
+         arm_s1_regime_using_lpae_format(env, arm_mmu_idx))) {
         /*
          * LPAE format fault status register : bottom 6 bits are
          * status code in the same form as needed for syndrome
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

When we moved the arm default CONFIGs into Kconfig and removed them
from default.mak, we made it harder to identify which CONFIGs are
selected by default in case users want to disable them.

Bring back the default entries into default.mak, but keep them
commented out. This way users can keep their workflows of editing
default.mak to remove build options without needing to search through
Kconfig.

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20230523180525.29994-3-farosas@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configs/devices/aarch64-softmmu/default.mak |  6 ++++
 configs/devices/arm-softmmu/default.mak     | 40 +++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/configs/devices/aarch64-softmmu/default.mak b/configs/devices/aarch64-softmmu/default.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/devices/aarch64-softmmu/default.mak
+++ b/configs/devices/aarch64-softmmu/default.mak
@@ -XXX,XX +XXX,XX @@
 
 # We support all the 32 bit boards so need all their config
 include ../arm-softmmu/default.mak
+
+# These are selected by default when TCG is enabled, uncomment them to
+# keep out of the build.
+# CONFIG_XLNX_ZYNQMP_ARM=n
+# CONFIG_XLNX_VERSAL=n
+# CONFIG_SBSA_REF=n
diff --git a/configs/devices/arm-softmmu/default.mak b/configs/devices/arm-softmmu/default.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/devices/arm-softmmu/default.mak
+++ b/configs/devices/arm-softmmu/default.mak
@@ -XXX,XX +XXX,XX @@
 # CONFIG_TEST_DEVICES=n
 
 CONFIG_ARM_VIRT=y
+
+# These are selected by default when TCG is enabled, uncomment them to
+# keep out of the build.
+# CONFIG_CUBIEBOARD=n
+# CONFIG_EXYNOS4=n
+# CONFIG_HIGHBANK=n
+# CONFIG_INTEGRATOR=n
+# CONFIG_FSL_IMX31=n
+# CONFIG_MUSICPAL=n
+# CONFIG_MUSCA=n
+# CONFIG_CHEETAH=n
+# CONFIG_SX1=n
+# CONFIG_NSERIES=n
+# CONFIG_STELLARIS=n
+# CONFIG_STM32VLDISCOVERY=n
+# CONFIG_REALVIEW=n
+# CONFIG_VERSATILE=n
+# CONFIG_VEXPRESS=n
+# CONFIG_ZYNQ=n
+# CONFIG_MAINSTONE=n
+# CONFIG_GUMSTIX=n
+# CONFIG_SPITZ=n
+# CONFIG_TOSA=n
+# CONFIG_Z2=n
+# CONFIG_NPCM7XX=n
+# CONFIG_COLLIE=n
+# CONFIG_ASPEED_SOC=n
+# CONFIG_NETDUINO2=n
+# CONFIG_NETDUINOPLUS2=n
+# CONFIG_OLIMEX_STM32_H405=n
+# CONFIG_MPS2=n
+# CONFIG_RASPI=n
+# CONFIG_DIGIC=n
+# CONFIG_SABRELITE=n
+# CONFIG_EMCRAFT_SF2=n
+# CONFIG_MICROBIT=n
+# CONFIG_FSL_IMX25=n
+# CONFIG_FSL_IMX7=n
+# CONFIG_FSL_IMX6UL=n
+# CONFIG_ALLWINNER_H3=n
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

Replace the 'default y if TCG' pattern with 'default y; depends on
TCG'.

That makes explict that there is a dependence on TCG and enabling
these CONFIGs via .mak files without TCG present will fail earlier.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230523180525.29994-4-farosas@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Kconfig | 123 ++++++++++++++++++++++++++++++++-----------------
 1 file changed, 82 insertions(+), 41 deletions(-)

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
 
 config CHEETAH
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
     select TSC210X
 
 config CUBIEBOARD
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ALLWINNER_A10
 
 config DIGIC
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PTIMER
     select PFLASH_CFI02
 
 config EXYNOS4
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select A9MPCORE
     select I2C
@@ -XXX,XX +XXX,XX @@ config EXYNOS4
 
 config HIGHBANK
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select A15MPCORE
     select AHCI
@@ -XXX,XX +XXX,XX @@ config HIGHBANK
 
 config INTEGRATOR
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARM_TIMER
     select INTEGRATOR_DEBUG
     select PL011 # UART
@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
 
 config MAINSTONE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PXA2XX
     select PFLASH_CFI01
     select SMC91C111
 
 config MUSCA
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARMSSE
     select PL011
     select PL031
@@ -XXX,XX +XXX,XX @@ config MARVELL_88W8618
 
 config MUSICPAL
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
@@ -XXX,XX +XXX,XX @@ config MUSICPAL
 
 config NETDUINO2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F205_SOC
 
 config NETDUINOPLUS2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F405_SOC
 
 config OLIMEX_STM32_H405
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F405_SOC
 
 config NSERIES
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
     select TMP105   # temperature sensor
     select BLIZZARD # LCD/TV controller
@@ -XXX,XX +XXX,XX @@ config PXA2XX
 
 config GUMSTIX
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select SMC91C111
     select PXA2XX
 
 config TOSA
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ZAURUS  # scoop
     select MICRODRIVE
     select PXA2XX
@@ -XXX,XX +XXX,XX @@ config TOSA
 
 config SPITZ
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ADS7846 # touch-screen controller
     select MAX111X # A/D converter
     select WM8750  # audio codec
@@ -XXX,XX +XXX,XX @@ config SPITZ
 
 config Z2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select WM8750
     select PL011 # UART
@@ -XXX,XX +XXX,XX @@ config Z2
 
 config REALVIEW
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply PCI_DEVICES
     imply PCI_TESTDEV
     imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config REALVIEW
 
 config SBSA_REF
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     imply PCI_DEVICES
     select AHCI
     select ARM_SMMUV3
@@ -XXX,XX +XXX,XX @@ config SBSA_REF
 
 config SABRELITE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select FSL_IMX6
     select SSI_M25P80
 
 config STELLARIS
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select ARM_V7M
     select CMSDK_APB_WATCHDOG
@@ -XXX,XX +XXX,XX @@ config STELLARIS
 
 config STM32VLDISCOVERY
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F100_SOC
 
 config STRONGARM
@@ -XXX,XX +XXX,XX @@ config STRONGARM
 
 config COLLIE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select ZAURUS  # scoop
     select STRONGARM
 
 config SX1
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
 
 config VERSATILE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARM_TIMER # sp804
     select PFLASH_CFI01
     select LSI_SCSI_PCI
@@ -XXX,XX +XXX,XX @@ config VERSATILE
 
 config VEXPRESS
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select A15MPCORE
     select ARM_MPTIMER
@@ -XXX,XX +XXX,XX @@ config VEXPRESS
 
 config ZYNQ
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select CADENCE # UART
     select PFLASH_CFI02
@@ -XXX,XX +XXX,XX @@ config ZYNQ
 config ARM_V7M
     bool
     # currently v7M must be included in a TCG build due to translate.c
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PTIMER
 
 config ALLWINNER_A10
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
 
 config ALLWINNER_H3
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ALLWINNER_A10_PIT
     select ALLWINNER_SUN8I_EMAC
     select ALLWINNER_I2C
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
 
 config RASPI
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select FRAMEBUFFER
     select PL011 # UART
     select SDHCI
@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
 
 config XLNX_ZYNQMP_ARM
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     select AHCI
     select ARM_GIC
     select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_ZYNQMP_ARM
 
 config XLNX_VERSAL
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     select ARM_GIC
     select PL011
     select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_VERSAL
 
 config NPCM7XX
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select ADM1272
     select ARM_GIC
@@ -XXX,XX +XXX,XX @@ config NPCM7XX
 
 config FSL_IMX25
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select IMX
     select IMX_FEC
@@ -XXX,XX +XXX,XX @@ config FSL_IMX25
 
 config FSL_IMX31
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select SERIAL
     select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
 
 config ASPEED_SOC
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select DS1338
     select FTGMAC100
     select I2C
@@ -XXX,XX +XXX,XX @@ config ASPEED_SOC
 
 config MPS2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select ARMSSE
     select LAN9118
@@ -XXX,XX +XXX,XX @@ config MPS2
 
 config FSL_IMX7
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply PCI_DEVICES
     imply TEST_DEVICES
     imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config ARM_SMMUV3
 
 config FSL_IMX6UL
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select A15MPCORE
     select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6UL
 
 config MICROBIT
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select NRF51_SOC
 
 config NRF51_SOC
@@ -XXX,XX +XXX,XX @@ config NRF51_SOC
 
 config EMCRAFT_SF2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select MSF2
     select SSI_M25P80
 
-- 
2.34.1

From: Enze Li <lienze@kylinos.cn>

I noticed that in the latest version, the copyright string is still
2022, even though 2023 is halfway through.  This patch fixes that and
fixes the documentation along with it.

Signed-off-by: Enze Li <lienze@kylinos.cn>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230525064345.1152801-1-lienze@kylinos.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/conf.py              | 2 +-
 include/qemu/help-texts.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@
 
 # General information about the project.
 project = u'QEMU'
-copyright = u'2022, The QEMU Project Developers'
+copyright = u'2023, The QEMU Project Developers'
 author = u'The QEMU Project Developers'
 
 # The version info for the project you're documenting, acts as replacement for
diff --git a/include/qemu/help-texts.h b/include/qemu/help-texts.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/help-texts.h
+++ b/include/qemu/help-texts.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_HELP_TEXTS_H
 
 /* Copyright string for -version arguments, About dialogs, etc */
-#define QEMU_COPYRIGHT "Copyright (c) 2003-2022 " \
+#define QEMU_COPYRIGHT "Copyright (c) 2003-2023 " \
     "Fabrice Bellard and the QEMU Project developers"
 
 /* Bug reporting information for --help arguments, About dialogs, etc */
-- 
2.34.1

From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>

Let add GIC information into DeviceTree as part of SBSA-REF versioning.

Trusted Firmware will read it and provide to next firmware level.

Bumps platform version to 0.1 one so we can check is node is present.

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "kvm_arm.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/fdt.h"
 #include "hw/arm/smmuv3.h"
 #include "hw/block/flash.h"
 #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
     return arm_cpu_mp_affinity(idx, clustersz);
 }
 
+static void sbsa_fdt_add_gic_node(SBSAMachineState *sms)
+{
+    char *nodename;
+
+    nodename = g_strdup_printf("/intc");
+    qemu_fdt_add_subnode(sms->fdt, nodename);
+    qemu_fdt_setprop_sized_cells(sms->fdt, nodename, "reg",
+                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].base,
+                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].size,
+                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].base,
+                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].size);
+
+    g_free(nodename);
+}
 /*
  * Firmware on this machine only uses ACPI table to load OS, these limited
  * device tree nodes are just to let firmware know the info which varies from
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
      *                        fw compatibility.
      */
     qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
-    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 0);
+    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 1);
 
     if (ms->numa_state->have_numa_distance) {
         int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
 
         g_free(nodename);
     }
+
+    sbsa_fdt_add_gic_node(sms);
 }
 
 #define SBSA_FLASH_SECTOR_SIZE (256 * KiB)
-- 
2.34.1