Series comparison

-[PULL 00/30] target-arm queue
+[PULL 00/21] target-arm queue
-The following changes since commit 003ba52a8b327180e284630b289c6ece5a3e08b9:
+Hi; here's the latest batch of arm changes. The big thing
 in here is the SMMUv3 changes to add stage-2 translation support.
-  Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2023-02-16 11:16:39 +0000)
+thanks
 -- PMM
 The following changes since commit aa9bbd865502ed517624ab6fe7d4b5d89ca95e43:
   Merge tag 'pull-ppc-20230528' of https://gitlab.com/danielhb/qemu into staging (2023-05-29 14:31:52 -0700)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230216
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230530
-for you to fetch changes up to caf01d6a435d9f4a95aeae2f9fc6cb8b889b1fb8:
+for you to fetch changes up to b03d0d4f531a8b867e0aac1fab0b876903015680:
-  tests/qtest: Restrict tpm-tis-devices-{swtpm}-test to CONFIG_TCG (2023-02-16 16:28:53 +0000)
+  docs: sbsa: correct graphics card name (2023-05-30 13:32:46 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * Some mostly M-profile-related code cleanups
+ * fsl-imx6: Add SNVS support for i.MX6 boards
- * avocado: Retire the boot_linux.py AArch64 TCG tests
+ * smmuv3: Add support for stage 2 translations
- * hw/arm/smmuv3: Add GBPA register
+ * hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop
- * arm/virt: don't try to spell out the accelerator
+ * hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
- * hw/arm: Attach PSPI module to NPCM7XX SoC
+ * cleanups for recent Kconfig changes
- * Some cleanup/refactoring patches aiming towards
+ * target/arm: Explicitly select short-format FSR for M-profile
-   allowing building Arm targets without CONFIG_TCG
+ * tests/qtest: Run arm-specific tests only if the required machine is available
  * hw/arm/sbsa-ref: add GIC node into DT
  * docs: sbsa: correct graphics card name
  * Update copyright dates to 2023
 ----------------------------------------------------------------
-Alex Bennée (1):
+Clément Chigot (1):
-      tests/avocado: retire the Aarch64 TCG tests from boot_linux.py
+      hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
-Claudio Fontana (3):
+Enze Li (1):
-      target/arm: rename handle_semihosting to tcg_handle_semihosting
+      Update copyright dates to 2023
       target/arm: wrap psci call with tcg_enabled
       target/arm: wrap call to aarch64_sve_change_el in tcg_enabled()
-Cornelia Huck (1):
+Fabiano Rosas (3):
-      arm/virt: don't try to spell out the accelerator
+      target/arm: Explain why we need to select ARM_V7M
       arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
       arm/Kconfig: Make TCG dependence explicit
-Fabiano Rosas (7):
+Marcin Juszkiewicz (2):
-      target/arm: Move PC alignment check
+      hw/arm/sbsa-ref: add GIC node into DT
-      target/arm: Move cpregs code out of cpu.h
+      docs: sbsa: correct graphics card name
       tests/avocado: Skip tests that require a missing accelerator
       tests/avocado: Tag TCG tests with accel:tcg
       target/arm: Use "max" as default cpu for the virt machine with KVM
       tests/qtest: arm-cpu-features: Match tests to required accelerators
       tests/qtest: Restrict tpm-tis-devices-{swtpm}-test to CONFIG_TCG
-Hao Wu (3):
+Mostafa Saleh (10):
-      MAINTAINERS: Add myself to maintainers and remove Havard
+      hw/arm/smmuv3: Add missing fields for IDR0
-      hw/ssi: Add Nuvoton PSPI Module
+      hw/arm/smmuv3: Update translation config to hold stage-2
-      hw/arm: Attach PSPI module to NPCM7XX SoC
+      hw/arm/smmuv3: Refactor stage-1 PTW
       hw/arm/smmuv3: Add page table walk for stage-2
       hw/arm/smmuv3: Parse STE config for stage-2
       hw/arm/smmuv3: Make TLB lookup work for stage-2
       hw/arm/smmuv3: Add VMID to TLB tagging
       hw/arm/smmuv3: Add CMDs related to stage-2
       hw/arm/smmuv3: Add stage-2 support in iova notifier
       hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2
-Jean-Philippe Brucker (2):
+Peter Maydell (1):
-      hw/arm/smmu-common: Support 64-bit addresses
+      target/arm: Explicitly select short-format FSR for M-profile
       hw/arm/smmu-common: Fix TTB1 handling
-Mostafa Saleh (1):
+Thomas Huth (1):
-      hw/arm/smmuv3: Add GBPA register
+      tests/qtest: Run arm-specific tests only if the required machine is available
-Philippe Mathieu-Daudé (12):
+Tommy Wu (1):
-      hw/intc/armv7m_nvic: Use OBJECT_DECLARE_SIMPLE_TYPE() macro
+      hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.
       target/arm: Simplify arm_v7m_mmu_idx_for_secstate() for user emulation
       target/arm: Reduce arm_v7m_mmu_idx_[all/for_secstate_and_priv]() scope
       target/arm: Constify ID_PFR1 on user emulation
       target/arm: Convert CPUARMState::eabi to boolean
       target/arm: Avoid resetting CPUARMState::eabi field
       target/arm: Restrict CPUARMState::gicv3state to sysemu
       target/arm: Restrict CPUARMState::arm_boot_info to sysemu
       target/arm: Restrict CPUARMState::nvic to sysemu
       target/arm: Store CPUARMState::nvic as NVICState*
       target/arm: Declare CPU <-> NVIC helpers in 'hw/intc/armv7m_nvic.h'
       hw/arm: Add missing XLNX_ZYNQMP_ARM -> USB_DWC3 Kconfig dependency
- MAINTAINERS                            |   8 +-
+Vitaly Cheptsov (1):
- docs/system/arm/nuvoton.rst            |   2 +-
+      fsl-imx6: Add SNVS support for i.MX6 boards
  hw/arm/smmuv3-internal.h               |   7 +
  include/hw/arm/npcm7xx.h               |   2 +
  include/hw/arm/smmu-common.h           |   2 -
  include/hw/arm/smmuv3.h                |   1 +
  include/hw/intc/armv7m_nvic.h          | 128 +++++++++++++++++-
  include/hw/ssi/npcm_pspi.h             |  53 ++++++++
  linux-user/user-internals.h            |   2 +-
  target/arm/cpregs.h                    |  98 ++++++++++++++
  target/arm/cpu.h                       | 228 ++-------------------------------
  target/arm/internals.h                 |  14 --
  hw/arm/npcm7xx.c                       |  25 +++-
  hw/arm/smmu-common.c                   |   4 +-
  hw/arm/smmuv3.c                        |  43 ++++++-
  hw/arm/virt.c                          |  10 +-
  hw/intc/armv7m_nvic.c                  |  38 ++----
  hw/ssi/npcm_pspi.c                     | 221 ++++++++++++++++++++++++++++++++
  linux-user/arm/cpu_loop.c              |   4 +-
  target/arm/cpu.c                       |   5 +-
  target/arm/cpu_tcg.c                   |   3 +
  target/arm/helper.c                    |  31 +++--
  target/arm/m_helper.c                  |  86 +++++++------
  target/arm/machine.c                   |  18 +--
  tests/qtest/arm-cpu-features.c         |  28 ++--
  hw/arm/Kconfig                         |   1 +
  hw/ssi/meson.build                     |   2 +-
  hw/ssi/trace-events                    |   5 +
  tests/avocado/avocado_qemu/__init__.py |   4 +
  tests/avocado/boot_linux.py            |  48 ++-----
  tests/avocado/boot_linux_console.py    |   1 +
  tests/avocado/machine_aarch64_virt.py  |  63 ++++++++-
  tests/avocado/reverse_debugging.py     |   8 ++
  tests/qtest/meson.build                |   4 +-
 files changed, 798 insertions(+), 399 deletions(-)
  create mode 100644 include/hw/ssi/npcm_pspi.h
  create mode 100644 hw/ssi/npcm_pspi.c
+ docs/conf.py                                |   2 +-
+ docs/system/arm/sbsa.rst                    |   2 +-
+ configs/devices/aarch64-softmmu/default.mak |   6 +
+ configs/devices/arm-softmmu/default.mak     |  40 ++++
+ hw/arm/smmu-internal.h                      |  37 +++
+ hw/arm/smmuv3-internal.h                    |  12 +-
+ include/hw/arm/fsl-imx6.h                   |   2 +
+ include/hw/arm/smmu-common.h                |  45 +++-
+ include/hw/arm/smmuv3.h                     |   4 +
+ include/qemu/help-texts.h                   |   2 +-
+ hw/arm/fsl-imx6.c                           |   8 +
+ hw/arm/sbsa-ref.c                           |  19 +-
+ hw/arm/smmu-common.c                        | 209 ++++++++++++++--
+ hw/arm/smmuv3.c                             | 357 ++++++++++++++++++++++++----
+ hw/arm/xlnx-zynqmp.c                        |   2 +-
+ hw/dma/xilinx_axidma.c                      |  11 +-
+ target/arm/tcg/tlb_helper.c                 |  13 +-
+ hw/arm/Kconfig                              | 123 ++++++----
+ hw/arm/trace-events                         |  14 +-
+ target/arm/Kconfig                          |   3 +
+ tests/qtest/meson.build                     |   7 +-
+files changed, 773 insertions(+), 145 deletions(-)

-[PULL 01/30] hw/intc/armv7m_nvic: Use OBJECT_DECLARE_SIMPLE_TYPE() macro
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Manually convert to OBJECT_DECLARE_SIMPLE_TYPE() macro,
-similarly to automatic conversion from commit 8063396bf3
-("Use OBJECT_DECLARE_SIMPLE_TYPE when possible").
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230206223502.25122-2-philmd@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/intc/armv7m_nvic.h | 5 +----
-file changed, 1 insertion(+), 4 deletions(-)
-diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/armv7m_nvic.h
-+++ b/include/hw/intc/armv7m_nvic.h
-@@ -XXX,XX +XXX,XX @@
- #include "qom/object.h"
- #define TYPE_NVIC "armv7m_nvic"
--
--typedef struct NVICState NVICState;
--DECLARE_INSTANCE_CHECKER(NVICState, NVIC,
--                         TYPE_NVIC)
-+OBJECT_DECLARE_SIMPLE_TYPE(NVICState, NVIC)
- /* Highest permitted number of exceptions (architectural limit) */
- #define NVIC_MAX_VECTORS 512
---
-.34.1

-[PULL 24/30] target/arm: Move PC alignment check
+[PULL 01/21] fsl-imx6: Add SNVS support for i.MX6 boards
-From: Fabiano Rosas <farosas@suse.de>
+From: Vitaly Cheptsov <cheptsov@ispras.ru>
-Move this earlier to make the next patch diff cleaner. While here
+SNVS is supported on both i.MX6 and i.MX6UL and is needed
-update the comment slightly to not give the impression that the
+to support shutdown on the board.
 misalignment affects only TCG.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Cc: Peter Maydell <peter.maydell@linaro.org> (odd fixer:SABRELITE / i.MX6)
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Cc: Jean-Christophe Dubois <jcd@tribudubois.net> (reviewer:SABRELITE / i.MX6)
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Cc: qemu-arm@nongnu.org (open list:SABRELITE / i.MX6)
-Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Cc: qemu-devel@nongnu.org (open list:All patches CC here)
 Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>
 Message-id: 20230515095015.66860-1-cheptsov@ispras.ru
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/machine.c | 18 +++++++++---------
+ include/hw/arm/fsl-imx6.h | 2 ++
-file changed, 9 insertions(+), 9 deletions(-)
+ hw/arm/fsl-imx6.c         | 8 ++++++++
 files changed, 10 insertions(+)
-diff --git a/target/arm/machine.c b/target/arm/machine.c
+diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/machine.c
+--- a/include/hw/arm/fsl-imx6.h
-+++ b/target/arm/machine.c
++++ b/include/hw/arm/fsl-imx6.h
-@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
+@@ -XXX,XX +XXX,XX @@
-         }
+ #include "hw/cpu/a9mpcore.h"
-     }
+ #include "hw/misc/imx6_ccm.h"
  #include "hw/misc/imx6_src.h"
 +#include "hw/misc/imx7_snvs.h"
  #include "hw/watchdog/wdt_imx2.h"
  #include "hw/char/imx_serial.h"
  #include "hw/timer/imx_gpt.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
      A9MPPrivState  a9mpcore;
      IMX6CCMState   ccm;
      IMX6SRCState   src;
 +    IMX7SNVSState  snvs;
      IMXSerialState uart[FSL_IMX6_NUM_UARTS];
      IMXGPTState    gpt;
      IMXEPITState   epit[FSL_IMX6_NUM_EPITS];
 diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/fsl-imx6.c
 +++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
      object_initialize_child(obj, "src", &s->src, TYPE_IMX6_SRC);
 +    object_initialize_child(obj, "snvs", &s->snvs, TYPE_IMX7_SNVS);
 +
      for (i = 0; i < FSL_IMX6_NUM_UARTS; i++) {
          snprintf(name, NAME_SIZE, "uart%d", i + 1);
          object_initialize_child(obj, name, &s->uart[i], TYPE_IMX_SERIAL);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                         qdev_get_gpio_in(DEVICE(&s->a9mpcore),
                                          FSL_IMX6_ENET_MAC_1588_IRQ));
 +    /*
-+     * Misaligned thumb pc is architecturally impossible. Fail the
++     * SNVS
 +     * incoming migration. For TCG it would trigger the assert in
 +     * thumb_tr_translate_insn().
 +     */
-+    if (!is_a64(env) && env->thumb && (env->regs[15] & 1)) {
++    sysbus_realize(SYS_BUS_DEVICE(&s->snvs), &error_abort);
-+        return -1;
++    sysbus_mmio_map(SYS_BUS_DEVICE(&s->snvs), 0, FSL_IMX6_SNVSHP_ADDR);
 +    }
 +
-     hw_breakpoint_update_all(cpu);
+     /*
-     hw_watchpoint_update_all(cpu);
+      * Watchdog
+      */
@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
          }
      }
 -    /*
 -     * Misaligned thumb pc is architecturally impossible.
 -     * We have an assert in thumb_tr_translate_insn to verify this.
 -     * Fail an incoming migrate to avoid this assert.
 -     */
 -    if (!is_a64(env) && env->thumb && (env->regs[15] & 1)) {
 -        return -1;
 -    }
 -
      if (!kvm_enabled()) {
          pmu_op_finish(&cpu->env);
      }
 --
 .34.1

-[PULL 11/30] target/arm: Declare CPU <-> NVIC helpers in 'hw/intc/armv7m_nvic.h'
+[PULL 02/21] hw/arm/smmuv3: Add missing fields for IDR0
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-While dozens of files include "cpu.h", only 3 files require
+In preparation for adding stage-2 support.
-these NVIC helper declarations.
+Add IDR0 fields related to stage-2.
 VMID16: 16-bit VMID supported.
 S2P: Stage-2 translation supported.
 They are described in 6.3.1 SMMU_IDR0.
 No functional change intended.
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20230206223502.25122-12-philmd@linaro.org
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-2-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/intc/armv7m_nvic.h | 123 ++++++++++++++++++++++++++++++++++
+ hw/arm/smmuv3-internal.h | 2 ++
- target/arm/cpu.h              | 123 ----------------------------------
+file changed, 2 insertions(+)
  target/arm/cpu.c              |   4 +-
  target/arm/cpu_tcg.c          |   3 +
  target/arm/m_helper.c         |   3 +
 files changed, 132 insertions(+), 124 deletions(-)
-diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h
+diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/armv7m_nvic.h
+--- a/hw/arm/smmuv3-internal.h
-+++ b/include/hw/intc/armv7m_nvic.h
++++ b/hw/arm/smmuv3-internal.h
-@@ -XXX,XX +XXX,XX @@ struct NVICState {
+@@ -XXX,XX +XXX,XX @@ typedef enum SMMUTranslationStatus {
-     qemu_irq sysresetreq;
+ /* MMIO Registers */
- };
+ REG32(IDR0,                0x0)
-+/* Interface between CPU and Interrupt controller.  */
++    FIELD(IDR0, S2P,         0 , 1)
-+/**
+     FIELD(IDR0, S1P,         1 , 1)
-+ * armv7m_nvic_set_pending: mark the specified exception as pending
+     FIELD(IDR0, TTF,         2 , 2)
-+ * @s: the NVIC
+     FIELD(IDR0, COHACC,      4 , 1)
-+ * @irq: the exception number to mark pending
+     FIELD(IDR0, ASID16,      12, 1)
-+ * @secure: false for non-banked exceptions or for the nonsecure
++    FIELD(IDR0, VMID16,      18, 1)
-+ * version of a banked exception, true for the secure version of a banked
+     FIELD(IDR0, TTENDIAN,    21, 2)
-+ * exception.
+     FIELD(IDR0, STALL_MODEL, 24, 2)
-+ *
+     FIELD(IDR0, TERM_MODEL,  26, 1)
 + * Marks the specified exception as pending. Note that we will assert()
 + * if @secure is true and @irq does not specify one of the fixed set
 + * of architecturally banked exceptions.
 + */
 +void armv7m_nvic_set_pending(NVICState *s, int irq, bool secure);
 +/**
 + * armv7m_nvic_set_pending_derived: mark this derived exception as pending
 + * @s: the NVIC
 + * @irq: the exception number to mark pending
 + * @secure: false for non-banked exceptions or for the nonsecure
 + * version of a banked exception, true for the secure version of a banked
 + * exception.
 + *
 + * Similar to armv7m_nvic_set_pending(), but specifically for derived
 + * exceptions (exceptions generated in the course of trying to take
 + * a different exception).
 + */
 +void armv7m_nvic_set_pending_derived(NVICState *s, int irq, bool secure);
 +/**
 + * armv7m_nvic_set_pending_lazyfp: mark this lazy FP exception as pending
 + * @s: the NVIC
 + * @irq: the exception number to mark pending
 + * @secure: false for non-banked exceptions or for the nonsecure
 + * version of a banked exception, true for the secure version of a banked
 + * exception.
 + *
 + * Similar to armv7m_nvic_set_pending(), but specifically for exceptions
 + * generated in the course of lazy stacking of FP registers.
 + */
 +void armv7m_nvic_set_pending_lazyfp(NVICState *s, int irq, bool secure);
 +/**
 + * armv7m_nvic_get_pending_irq_info: return highest priority pending
 + *    exception, and whether it targets Secure state
 + * @s: the NVIC
 + * @pirq: set to pending exception number
 + * @ptargets_secure: set to whether pending exception targets Secure
 + *
 + * This function writes the number of the highest priority pending
 + * exception (the one which would be made active by
 + * armv7m_nvic_acknowledge_irq()) to @pirq, and sets @ptargets_secure
 + * to true if the current highest priority pending exception should
 + * be taken to Secure state, false for NS.
 + */
 +void armv7m_nvic_get_pending_irq_info(NVICState *s, int *pirq,
 +                                      bool *ptargets_secure);
 +/**
 + * armv7m_nvic_acknowledge_irq: make highest priority pending exception active
 + * @s: the NVIC
 + *
 + * Move the current highest priority pending exception from the pending
 + * state to the active state, and update v7m.exception to indicate that
 + * it is the exception currently being handled.
 + */
 +void armv7m_nvic_acknowledge_irq(NVICState *s);
 +/**
 + * armv7m_nvic_complete_irq: complete specified interrupt or exception
 + * @s: the NVIC
 + * @irq: the exception number to complete
 + * @secure: true if this exception was secure
 + *
 + * Returns: -1 if the irq was not active
 + *           1 if completing this irq brought us back to base (no active irqs)
 + *           0 if there is still an irq active after this one was completed
 + * (Ignoring -1, this is the same as the RETTOBASE value before completion.)
 + */
 +int armv7m_nvic_complete_irq(NVICState *s, int irq, bool secure);
 +/**
 + * armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
 + * @s: the NVIC
 + * @irq: the exception number to mark pending
 + * @secure: false for non-banked exceptions or for the nonsecure
 + * version of a banked exception, true for the secure version of a banked
 + * exception.
 + *
 + * Return whether an exception is "ready", i.e. whether the exception is
 + * enabled and is configured at a priority which would allow it to
 + * interrupt the current execution priority. This controls whether the
 + * RDY bit for it in the FPCCR is set.
 + */
 +bool armv7m_nvic_get_ready_status(NVICState *s, int irq, bool secure);
 +/**
 + * armv7m_nvic_raw_execution_priority: return the raw execution priority
 + * @s: the NVIC
 + *
 + * Returns: the raw execution priority as defined by the v8M architecture.
 + * This is the execution priority minus the effects of AIRCR.PRIS,
 + * and minus any PRIMASK/FAULTMASK/BASEPRI priority boosting.
 + * (v8M ARM ARM I_PKLD.)
 + */
 +int armv7m_nvic_raw_execution_priority(NVICState *s);
 +/**
 + * armv7m_nvic_neg_prio_requested: return true if the requested execution
 + * priority is negative for the specified security state.
 + * @s: the NVIC
 + * @secure: the security state to test
 + * This corresponds to the pseudocode IsReqExecPriNeg().
 + */
 +#ifndef CONFIG_USER_ONLY
 +bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure);
 +#else
 +static inline bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure)
 +{
 +    return false;
 +}
 +#endif
 +#ifndef CONFIG_USER_ONLY
 +bool armv7m_nvic_can_take_pending_exception(NVICState *s);
 +#else
 +static inline bool armv7m_nvic_can_take_pending_exception(NVICState *s)
 +{
 +    return true;
 +}
 +#endif
 +
  #endif
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_list(void);
  uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
                                   uint32_t cur_el, bool secure);
 -/* Interface between CPU and Interrupt controller.  */
 -#ifndef CONFIG_USER_ONLY
 -bool armv7m_nvic_can_take_pending_exception(NVICState *s);
 -#else
 -static inline bool armv7m_nvic_can_take_pending_exception(NVICState *s)
 -{
 -    return true;
 -}
 -#endif
 -/**
 - * armv7m_nvic_set_pending: mark the specified exception as pending
 - * @s: the NVIC
 - * @irq: the exception number to mark pending
 - * @secure: false for non-banked exceptions or for the nonsecure
 - * version of a banked exception, true for the secure version of a banked
 - * exception.
 - *
 - * Marks the specified exception as pending. Note that we will assert()
 - * if @secure is true and @irq does not specify one of the fixed set
 - * of architecturally banked exceptions.
 - */
 -void armv7m_nvic_set_pending(NVICState *s, int irq, bool secure);
 -/**
 - * armv7m_nvic_set_pending_derived: mark this derived exception as pending
 - * @s: the NVIC
 - * @irq: the exception number to mark pending
 - * @secure: false for non-banked exceptions or for the nonsecure
 - * version of a banked exception, true for the secure version of a banked
 - * exception.
 - *
 - * Similar to armv7m_nvic_set_pending(), but specifically for derived
 - * exceptions (exceptions generated in the course of trying to take
 - * a different exception).
 - */
 -void armv7m_nvic_set_pending_derived(NVICState *s, int irq, bool secure);
 -/**
 - * armv7m_nvic_set_pending_lazyfp: mark this lazy FP exception as pending
 - * @s: the NVIC
 - * @irq: the exception number to mark pending
 - * @secure: false for non-banked exceptions or for the nonsecure
 - * version of a banked exception, true for the secure version of a banked
 - * exception.
 - *
 - * Similar to armv7m_nvic_set_pending(), but specifically for exceptions
 - * generated in the course of lazy stacking of FP registers.
 - */
 -void armv7m_nvic_set_pending_lazyfp(NVICState *s, int irq, bool secure);
 -/**
 - * armv7m_nvic_get_pending_irq_info: return highest priority pending
 - *    exception, and whether it targets Secure state
 - * @s: the NVIC
 - * @pirq: set to pending exception number
 - * @ptargets_secure: set to whether pending exception targets Secure
 - *
 - * This function writes the number of the highest priority pending
 - * exception (the one which would be made active by
 - * armv7m_nvic_acknowledge_irq()) to @pirq, and sets @ptargets_secure
 - * to true if the current highest priority pending exception should
 - * be taken to Secure state, false for NS.
 - */
 -void armv7m_nvic_get_pending_irq_info(NVICState *s, int *pirq,
 -                                      bool *ptargets_secure);
 -/**
 - * armv7m_nvic_acknowledge_irq: make highest priority pending exception active
 - * @s: the NVIC
 - *
 - * Move the current highest priority pending exception from the pending
 - * state to the active state, and update v7m.exception to indicate that
 - * it is the exception currently being handled.
 - */
 -void armv7m_nvic_acknowledge_irq(NVICState *s);
 -/**
 - * armv7m_nvic_complete_irq: complete specified interrupt or exception
 - * @s: the NVIC
 - * @irq: the exception number to complete
 - * @secure: true if this exception was secure
 - *
 - * Returns: -1 if the irq was not active
 - *           1 if completing this irq brought us back to base (no active irqs)
 - *           0 if there is still an irq active after this one was completed
 - * (Ignoring -1, this is the same as the RETTOBASE value before completion.)
 - */
 -int armv7m_nvic_complete_irq(NVICState *s, int irq, bool secure);
 -/**
 - * armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
 - * @s: the NVIC
 - * @irq: the exception number to mark pending
 - * @secure: false for non-banked exceptions or for the nonsecure
 - * version of a banked exception, true for the secure version of a banked
 - * exception.
 - *
 - * Return whether an exception is "ready", i.e. whether the exception is
 - * enabled and is configured at a priority which would allow it to
 - * interrupt the current execution priority. This controls whether the
 - * RDY bit for it in the FPCCR is set.
 - */
 -bool armv7m_nvic_get_ready_status(NVICState *s, int irq, bool secure);
 -/**
 - * armv7m_nvic_raw_execution_priority: return the raw execution priority
 - * @s: the NVIC
 - *
 - * Returns: the raw execution priority as defined by the v8M architecture.
 - * This is the execution priority minus the effects of AIRCR.PRIS,
 - * and minus any PRIMASK/FAULTMASK/BASEPRI priority boosting.
 - * (v8M ARM ARM I_PKLD.)
 - */
 -int armv7m_nvic_raw_execution_priority(NVICState *s);
 -/**
 - * armv7m_nvic_neg_prio_requested: return true if the requested execution
 - * priority is negative for the specified security state.
 - * @s: the NVIC
 - * @secure: the security state to test
 - * This corresponds to the pseudocode IsReqExecPriNeg().
 - */
 -#ifndef CONFIG_USER_ONLY
 -bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure);
 -#else
 -static inline bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure)
 -{
 -    return false;
 -}
 -#endif
 -
  /* Interface for defining coprocessor registers.
   * Registers are defined in tables of arm_cp_reginfo structs
   * which are passed to define_arm_cp_regs().
 diff --git a/target/arm/cpu.c b/target/arm/cpu.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.c
 +++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
  #if !defined(CONFIG_USER_ONLY)
  #include "hw/loader.h"
  #include "hw/boards.h"
 +#ifdef CONFIG_TCG
  #include "hw/intc/armv7m_nvic.h"
 -#endif
 +#endif /* CONFIG_TCG */
 +#endif /* !CONFIG_USER_ONLY */
  #include "sysemu/tcg.h"
  #include "sysemu/qtest.h"
  #include "sysemu/hw_accel.h"
 diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu_tcg.c
 +++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/boards.h"
  #endif
  #include "cpregs.h"
 +#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
 +#include "hw/intc/armv7m_nvic.h"
 +#endif
  /* Share AArch32 -cpu max features with AArch64. */
 diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/m_helper.c
 +++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@
  #include "exec/cpu_ldst.h"
  #include "semihosting/common-semi.h"
  #endif
 +#if !defined(CONFIG_USER_ONLY)
 +#include "hw/intc/armv7m_nvic.h"
 +#endif
  static void v7m_msr_xpsr(CPUARMState *env, uint32_t mask,
                           uint32_t reg, uint32_t val)
 --
 .34.1

-[PULL 27/30] tests/avocado: Tag TCG tests with accel:tcg
+[PULL 03/21] hw/arm/smmuv3: Update translation config to hold stage-2
-From: Fabiano Rosas <farosas@suse.de>
+From: Mostafa Saleh <smostafa@google.com>
-This allows the test to be skipped when TCG is not present in the QEMU
+In preparation for adding stage-2 support, add a S2 config
-binary.
+struct(SMMUS2Cfg), composed of the following fields and embedded in
 the main SMMUTransCfg:
  -tsz: Size of IPA input region (S2T0SZ)
  -sl0: Start level of translation (S2SL0)
  -affd: AF Fault Disable (S2AFFD)
  -record_faults: Record fault events (S2R)
  -granule_sz: Granule page shift (based on S2TG)
  -vmid: Virtual Machine ID (S2VMID)
  -vttb: Address of translation table base (S2TTB)
  -eff_ps: Effective PA output range (based on S2PS)
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
+They will be used in the next patches in stage-2 address translation.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+The fields in SMMUS2Cfg, are reordered to make the shared and stage-1
 fields next to each other, this reordering didn't change the struct
 size (104 bytes before and after).
 Stage-1 only fields: aa64, asid, tt, ttb, tbi, record_faults, oas.
 oas is stage-1 output address size. However, it is used to check
 input address in case stage-1 is unimplemented or bypassed according
 to SMMUv3 manual IHI0070.E "3.4. Address sizes"
 Shared fields: stage, disabled, bypassed, aborted, iotlb_*.
 No functional change intended.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-3-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/avocado/boot_linux_console.py | 1 +
+ include/hw/arm/smmu-common.h | 22 +++++++++++++++++++---
- tests/avocado/reverse_debugging.py  | 8 ++++++++
+file changed, 19 insertions(+), 3 deletions(-)
 files changed, 9 insertions(+)
-diff --git a/tests/avocado/boot_linux_console.py b/tests/avocado/boot_linux_console.py
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/tests/avocado/boot_linux_console.py
+--- a/include/hw/arm/smmu-common.h
-+++ b/tests/avocado/boot_linux_console.py
++++ b/include/hw/arm/smmu-common.h
-@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_uboot_netbsd9(self):
+@@ -XXX,XX +XXX,XX @@ typedef struct SMMUTLBEntry {
+     uint8_t granule;
-     def test_aarch64_raspi3_atf(self):
+ } SMMUTLBEntry;
-         """
-+        :avocado: tags=accel:tcg
++/* Stage-2 configuration. */
-         :avocado: tags=arch:aarch64
++typedef struct SMMUS2Cfg {
-         :avocado: tags=machine:raspi3b
++    uint8_t tsz;            /* Size of IPA input region (S2T0SZ) */
-         :avocado: tags=cpu:cortex-a53
++    uint8_t sl0;            /* Start level of translation (S2SL0) */
-diff --git a/tests/avocado/reverse_debugging.py b/tests/avocado/reverse_debugging.py
++    bool affd;              /* AF Fault Disable (S2AFFD) */
-index XXXXXXX..XXXXXXX 100644
++    bool record_faults;     /* Record fault events (S2R) */
---- a/tests/avocado/reverse_debugging.py
++    uint8_t granule_sz;     /* Granule page shift (based on S2TG) */
-+++ b/tests/avocado/reverse_debugging.py
++    uint8_t eff_ps;         /* Effective PA output range (based on S2PS) */
-@@ -XXX,XX +XXX,XX @@ def reverse_debugging(self, shift=7, args=None):
++    uint16_t vmid;          /* Virtual Machine ID (S2VMID) */
-         vm.shutdown()
++    uint64_t vttb;          /* Address of translation table base (S2TTB) */
++} SMMUS2Cfg;
  class ReverseDebugging_X86_64(ReverseDebugging):
 +    """
 +    :avocado: tags=accel:tcg
 +    """
 +
-     REG_PC = 0x10
+ /*
-     REG_CS = 0x12
+  * Generic structure populated by derived SMMU devices
-     def get_pc(self, g):
+  * after decoding the configuration information and used as
-@@ -XXX,XX +XXX,XX @@ def test_x86_64_pc(self):
+  * input to the page table walk
-         self.reverse_debugging()
+  */
+ typedef struct SMMUTransCfg {
- class ReverseDebugging_AArch64(ReverseDebugging):
++    /* Shared fields between stage-1 and stage-2. */
-+    """
+     int stage;                 /* translation stage */
-+    :avocado: tags=accel:tcg
+-    bool aa64;                 /* arch64 or aarch32 translation table */
-+    """
+     bool disabled;             /* smmu is disabled */
-+
+     bool bypassed;             /* translation is bypassed */
-     REG_PC = 32
+     bool aborted;              /* translation is aborted */
++    uint32_t iotlb_hits;       /* counts IOTLB hits */
-     # unidentified gitlab timeout problem
++    uint32_t iotlb_misses;     /* counts IOTLB misses*/
 +    /* Used by stage-1 only. */
 +    bool aa64;                 /* arch64 or aarch32 translation table */
      bool record_faults;        /* record fault events */
      uint64_t ttb;              /* TT base address */
      uint8_t oas;               /* output address width */
      uint8_t tbi;               /* Top Byte Ignore */
      uint16_t asid;
      SMMUTransTableInfo tt[2];
 -    uint32_t iotlb_hits;       /* counts IOTLB hits for this asid */
 -    uint32_t iotlb_misses;     /* counts IOTLB misses for this asid */
 +    /* Used by stage-2 only. */
 +    struct SMMUS2Cfg s2cfg;
  } SMMUTransCfg;
  typedef struct SMMUDevice {
 --
 .34.1

-[PULL 19/30] hw/arm/smmu-common: Support 64-bit addresses
+[PULL 04/21] hw/arm/smmuv3: Refactor stage-1 PTW
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-Addresses targeting the second translation table (TTB1) in the SMMU have
+In preparation for adding stage-2 support, rename smmu_ptw_64 to
-all upper bits set. Ensure the IOMMU region covers all 64 bits.
+smmu_ptw_64_s1 and refactor some of the code so it can be reused in
 stage-2 page table walk.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Remove AA64 check from PTW as decode_cd already ensures that AA64 is
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+used, otherwise it faults with C_BAD_CD.
 A stage member is added to SMMUPTWEventInfo to differentiate
 between stage-1 and stage-2 ptw faults.
 Add stage argument to trace_smmu_ptw_level be consistent with other
 trace events.
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20230214171921.1917916-2-jean-philippe@linaro.org
+Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-4-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/smmu-common.h | 2 --
+ include/hw/arm/smmu-common.h | 16 +++++++++++++---
- hw/arm/smmu-common.c         | 2 +-
+ hw/arm/smmu-common.c         | 27 ++++++++++-----------------
-files changed, 1 insertion(+), 3 deletions(-)
+ hw/arm/smmuv3.c              |  2 ++
  hw/arm/trace-events          |  2 +-
 files changed, 26 insertions(+), 21 deletions(-)
 diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/smmu-common.h
 +++ b/include/hw/arm/smmu-common.h
 @@ -XXX,XX +XXX,XX @@
- #define SMMU_PCI_DEVFN_MAX    256
+ #include "hw/pci/pci.h"
- #define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
+ #include "qom/object.h"
--#define SMMU_MAX_VA_BITS      48
+-#define SMMU_PCI_BUS_MAX      256
--
+-#define SMMU_PCI_DEVFN_MAX    256
 -#define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
 +#define SMMU_PCI_BUS_MAX                    256
 +#define SMMU_PCI_DEVFN_MAX                  256
 +#define SMMU_PCI_DEVFN(sid)                 (sid & 0xFF)
 +
 +/* VMSAv8-64 Translation constants and functions */
 +#define VMSA_LEVELS                         4
 +
 +#define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
 +#define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
 +                                             (VMSA_LEVELS - (lvl)))
 +#define VMSA_IDXMSK(isz, strd, lvl)         ((1ULL << \
 +                                             VMSA_BIT_LVL(isz, strd, lvl)) - 1)
  /*
   * Page table walk error types
-  */
+@@ -XXX,XX +XXX,XX @@ typedef enum {
  } SMMUPTWEventType;
  typedef struct SMMUPTWEventInfo {
 +    int stage;
      SMMUPTWEventType type;
      dma_addr_t addr; /* fetched address that induced an abort, if any */
  } SMMUPTWEventInfo;
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
-@@ -XXX,XX +XXX,XX @@ static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
+@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
+ }
-         memory_region_init_iommu(&sdev->iommu, sizeof(sdev->iommu),
-                                  s->mrtypename,
+ /**
--                                 OBJECT(s), name, 1ULL << SMMU_MAX_VA_BITS);
+- * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
-+                                 OBJECT(s), name, UINT64_MAX);
++ * smmu_ptw_64_s1 - VMSAv8-64 Walk of the page tables for a given IOVA
-         address_space_init(&sdev->as,
+  * @cfg: translation config
-                            MEMORY_REGION(&sdev->iommu), name);
+  * @iova: iova to translate
-         trace_smmu_add_mr(name);
+  * @perm: access type
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
   * Upon success, @tlbe is filled with translated_addr and entry
   * permission rights.
   */
 -static int smmu_ptw_64(SMMUTransCfg *cfg,
 -                       dma_addr_t iova, IOMMUAccessFlags perm,
 -                       SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 +static int smmu_ptw_64_s1(SMMUTransCfg *cfg,
 +                          dma_addr_t iova, IOMMUAccessFlags perm,
 +                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
  {
      dma_addr_t baseaddr, indexmask;
      int stage = cfg->stage;
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
      }
      granule_sz = tt->granule_sz;
 -    stride = granule_sz - 3;
 +    stride = VMSA_STRIDE(granule_sz);
      inputsize = 64 - tt->tsz;
      level = 4 - (inputsize - 4) / stride;
 -    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
 +    indexmask = VMSA_IDXMSK(inputsize, stride, level);
      baseaddr = extract64(tt->ttb, 0, 48);
      baseaddr &= ~indexmask;
 -    while (level <= 3) {
 +    while (level < VMSA_LEVELS) {
          uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
          uint64_t mask = subpage_size - 1;
          uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
          if (get_pte(baseaddr, offset, &pte, info)) {
                  goto error;
          }
 -        trace_smmu_ptw_level(level, iova, subpage_size,
 +        trace_smmu_ptw_level(stage, level, iova, subpage_size,
                               baseaddr, offset, pte);
          if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
      info->type = SMMU_PTW_ERR_TRANSLATION;
  error:
 +    info->stage = 1;
      tlbe->entry.perm = IOMMU_NONE;
      return -EINVAL;
  }
@@ -XXX,XX +XXX,XX @@ error:
  int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
               SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
  {
 -    if (!cfg->aa64) {
 -        /*
 -         * This code path is not entered as we check this while decoding
 -         * the configuration data in the derived SMMU model.
 -         */
 -        g_assert_not_reached();
 -    }
 -
 -    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
 +    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
  }
  /**
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
      cached_entry = g_new0(SMMUTLBEntry, 1);
      if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) {
 +        /* All faults from PTW has S2 field. */
 +        event.u.f_walk_eabt.s2 = (ptw_info.stage == 2);
          g_free(cached_entry);
          switch (ptw_info.type) {
          case SMMU_PTW_ERR_WALK_EABT:
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
  # smmu-common.c
  smmu_add_mr(const char *name) "%s"
 -smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
 +smmu_ptw_level(int stage, int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
  smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
  smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
  smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
 --
 .34.1

-[PULL 25/30] target/arm: Move cpregs code out of cpu.h
+[PULL 05/21] hw/arm/smmuv3: Add page table walk for stage-2
-From: Fabiano Rosas <farosas@suse.de>
+From: Mostafa Saleh <smostafa@google.com>
-Since commit cf7c6d1004 ("target/arm: Split out cpregs.h") we now have
+In preparation for adding stage-2 support, add Stage-2 PTW code.
-a cpregs.h header which is more suitable for this code.
+Only Aarch64 format is supported as stage-1.
-Code moved verbatim.
+Nesting stage-1 and stage-2 is not supported right now.
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
+HTTU is not supported, SW is expected to maintain the Access flag.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+This is described in the SMMUv3 manual(IHI 0070.E.a)
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+"5.2. Stream Table Entry" in "[181] S2AFFD".
-Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+This flag determines the behavior on access of a stage-2 page whose
 descriptor has AF == 0:
 - 0b0: An Access flag fault occurs (stall not supported).
 - 0b1: An Access flag fault never occurs.
 An Access fault takes priority over a Permission fault.
 There are 3 address size checks for stage-2 according to
 (IHI 0070.E.a) in "3.4. Address sizes".
 - As nesting is not supported, input address is passed directly to
 stage-2, and is checked against IAS.
 We use cfg->oas to hold the OAS when stage-1 is not used, this is set
 in the next patch.
 This check is done outside of smmu_ptw_64_s2 as it is not part of
 stage-2(it throws stage-1 fault), and the stage-2 function shouldn't
 change it's behavior when nesting is supported.
 When nesting is supported and we figure out how to combine TLB for
 stage-1 and stage-2 we can move this check into the stage-1 function
 as described in ARM DDI0487I.a in pseudocode
 aarch64/translation/vmsa_translation/AArch64.S1Translate
 aarch64/translation/vmsa_translation/AArch64.S1DisabledOutput
 - Input to stage-2 is checked against s2t0sz, and throws stage-2
 transaltion fault if exceeds it.
 - Output of stage-2 is checked against effective PA output range.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-5-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpregs.h | 98 +++++++++++++++++++++++++++++++++++++++++++++
+ hw/arm/smmu-internal.h |  35 ++++++++++
- target/arm/cpu.h    | 91 -----------------------------------------
+ hw/arm/smmu-common.c   | 142 ++++++++++++++++++++++++++++++++++++++++-
-files changed, 98 insertions(+), 91 deletions(-)
+files changed, 176 insertions(+), 1 deletion(-)
-diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
+diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpregs.h
+--- a/hw/arm/smmu-internal.h
-+++ b/target/arm/cpregs.h
++++ b/hw/arm/smmu-internal.h
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@
-     ARM_CP_SME                   = 1 << 19,
+ #define PTE_APTABLE(pte) \
- };
+     (extract64(pte, 61, 2))
 +#define PTE_AF(pte) \
 +    (extract64(pte, 10, 1))
  /*
   * TODO: At the moment all transactions are considered as privileged (EL1)
   * as IOMMU translation callback does not pass user/priv attributes.
@@ -XXX,XX +XXX,XX @@
  #define is_permission_fault(ap, perm) \
      (((perm) & IOMMU_WO) && ((ap) & 0x2))
 +#define is_permission_fault_s2(s2ap, perm) \
 +    (!(((s2ap) & (perm)) == (perm)))
 +
  #define PTE_AP_TO_PERM(ap) \
      (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
@@ -XXX,XX +XXX,XX @@ uint64_t iova_level_offset(uint64_t iova, int inputsize,
              MAKE_64BIT_MASK(0, gsz - 3);
  }
 +/* FEAT_LPA2 and FEAT_TTST are not implemented. */
 +static inline int get_start_level(int sl0 , int granule_sz)
 +{
 +    /* ARM DDI0487I.a: Table D8-12. */
 +    if (granule_sz == 12) {
 +        return 2 - sl0;
 +    }
 +    /* ARM DDI0487I.a: Table D8-22 and Table D8-31. */
 +    return 3 - sl0;
 +}
 +
 +/*
-+ * Interface for defining coprocessor registers.
++ * Index in a concatenated first level stage-2 page table.
-+ * Registers are defined in tables of arm_cp_reginfo structs
++ * ARM DDI0487I.a: D8.2.2 Concatenated translation tables.
 + * which are passed to define_arm_cp_regs().
 + */
-+
++static inline int pgd_concat_idx(int start_level, int granule_sz,
-+/*
++                                 dma_addr_t ipa)
-+ * When looking up a coprocessor register we look for it
++{
-+ * via an integer which encodes all of:
++    uint64_t ret;
-+ *  coprocessor number
++    /*
-+ *  Crn, Crm, opc1, opc2 fields
++     * Get the number of bits handled by next levels, then any extra bits in
-+ *  32 or 64 bit register (ie is it accessed via MRC/MCR
++     * the address should index the concatenated tables. This relation can be
-+ *    or via MRRC/MCRR?)
++     * deduced from tables in ARM DDI0487I.a: D8.2.7-9
-+ *  non-secure/secure bank (AArch32 only)
++     */
-+ * We allow 4 bits for opc1 because MRRC/MCRR have a 4 bit field.
++    int shift =  level_shift(start_level - 1, granule_sz);
-+ * (In this case crn and opc2 should be zero.)
++
-+ * For AArch64, there is no 32/64 bit size distinction;
++    ret = ipa >> shift;
-+ * instead all registers have a 2 bit op0, 3 bit op1 and op2,
++    return ret;
-+ * and 4 bit CRn and CRm. The encoding patterns are chosen
++}
-+ * to be easy to convert to and from the KVM encodings, and also
++
-+ * so that the hashtable can contain both AArch32 and AArch64
+ #define SMMU_IOTLB_ASID(key) ((key).asid)
-+ * registers (to allow for interprocessing where we might run
-+ * 32 bit code on a 64 bit core).
+ typedef struct SMMUIOTLBPageInvInfo {
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ error:
      return -EINVAL;
  }
 +/**
 + * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa
 + * for stage-2.
 + * @cfg: translation config
 + * @ipa: ipa to translate
 + * @perm: access type
 + * @tlbe: SMMUTLBEntry (out)
 + * @info: handle to an error info
 + *
 + * Return 0 on success, < 0 on error. In case of error, @info is filled
 + * and tlbe->perm is set to IOMMU_NONE.
 + * Upon success, @tlbe is filled with translated_addr and entry
 + * permission rights.
 + */
-+/*
++static int smmu_ptw_64_s2(SMMUTransCfg *cfg,
-+ * This bit is private to our hashtable cpreg; in KVM register
++                          dma_addr_t ipa, IOMMUAccessFlags perm,
-+ * IDs the AArch64/32 distinction is the KVM_REG_ARM/ARM64
++                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 + * in the upper bits of the 64 bit ID.
 + */
 +#define CP_REG_AA64_SHIFT 28
 +#define CP_REG_AA64_MASK (1 << CP_REG_AA64_SHIFT)
 +
 +/*
 + * To enable banking of coprocessor registers depending on ns-bit we
 + * add a bit to distinguish between secure and non-secure cpregs in the
 + * hashtable.
 + */
 +#define CP_REG_NS_SHIFT 29
 +#define CP_REG_NS_MASK (1 << CP_REG_NS_SHIFT)
 +
 +#define ENCODE_CP_REG(cp, is64, ns, crn, crm, opc1, opc2)   \
 +    ((ns) << CP_REG_NS_SHIFT | ((cp) << 16) | ((is64) << 15) |   \
 +     ((crn) << 11) | ((crm) << 7) | ((opc1) << 3) | (opc2))
 +
 +#define ENCODE_AA64_CP_REG(cp, crn, crm, op0, op1, op2) \
 +    (CP_REG_AA64_MASK |                                 \
 +     ((cp) << CP_REG_ARM_COPROC_SHIFT) |                \
 +     ((op0) << CP_REG_ARM64_SYSREG_OP0_SHIFT) |         \
 +     ((op1) << CP_REG_ARM64_SYSREG_OP1_SHIFT) |         \
 +     ((crn) << CP_REG_ARM64_SYSREG_CRN_SHIFT) |         \
 +     ((crm) << CP_REG_ARM64_SYSREG_CRM_SHIFT) |         \
 +     ((op2) << CP_REG_ARM64_SYSREG_OP2_SHIFT))
 +
 +/*
 + * Convert a full 64 bit KVM register ID to the truncated 32 bit
 + * version used as a key for the coprocessor register hashtable
 + */
 +static inline uint32_t kvm_to_cpreg_id(uint64_t kvmid)
 +{
-+    uint32_t cpregid = kvmid;
++    const int stage = 2;
-+    if ((kvmid & CP_REG_ARCH_MASK) == CP_REG_ARM64) {
++    int granule_sz = cfg->s2cfg.granule_sz;
-+        cpregid |= CP_REG_AA64_MASK;
++    /* ARM DDI0487I.a: Table D8-7. */
-+    } else {
++    int inputsize = 64 - cfg->s2cfg.tsz;
-+        if ((kvmid & CP_REG_SIZE_MASK) == CP_REG_SIZE_U64) {
++    int level = get_start_level(cfg->s2cfg.sl0, granule_sz);
-+            cpregid |= (1 << 15);
++    int stride = VMSA_STRIDE(granule_sz);
 +    int idx = pgd_concat_idx(level, granule_sz, ipa);
 +    /*
 +     * Get the ttb from concatenated structure.
 +     * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte))
 +     */
 +    uint64_t baseaddr = extract64(cfg->s2cfg.vttb, 0, 48) + (1 << stride) *
 +                                  idx * sizeof(uint64_t);
 +    dma_addr_t indexmask = VMSA_IDXMSK(inputsize, stride, level);
 +
 +    baseaddr &= ~indexmask;
 +
 +    /*
 +     * On input, a stage 2 Translation fault occurs if the IPA is outside the
 +     * range configured by the relevant S2T0SZ field of the STE.
 +     */
 +    if (ipa >= (1ULL << inputsize)) {
 +        info->type = SMMU_PTW_ERR_TRANSLATION;
 +        goto error;
 +    }
 +
 +    while (level < VMSA_LEVELS) {
 +        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
 +        uint64_t mask = subpage_size - 1;
 +        uint32_t offset = iova_level_offset(ipa, inputsize, level, granule_sz);
 +        uint64_t pte, gpa;
 +        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
 +        uint8_t s2ap;
 +
 +        if (get_pte(baseaddr, offset, &pte, info)) {
 +                goto error;
 +        }
 +        trace_smmu_ptw_level(stage, level, ipa, subpage_size,
 +                             baseaddr, offset, pte);
 +        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
 +            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
 +                                       pte_addr, offset, pte);
 +            break;
 +        }
 +
 +        if (is_table_pte(pte, level)) {
 +            baseaddr = get_table_pte_address(pte, granule_sz);
 +            level++;
 +            continue;
 +        } else if (is_page_pte(pte, level)) {
 +            gpa = get_page_pte_address(pte, granule_sz);
 +            trace_smmu_ptw_page_pte(stage, level, ipa,
 +                                    baseaddr, pte_addr, pte, gpa);
 +        } else {
 +            uint64_t block_size;
 +
 +            gpa = get_block_pte_address(pte, level, granule_sz,
 +                                        &block_size);
 +            trace_smmu_ptw_block_pte(stage, level, baseaddr,
 +                                     pte_addr, pte, ipa, gpa,
 +                                     block_size >> 20);
 +        }
 +
 +        /*
-+         * KVM is always non-secure so add the NS flag on AArch32 register
++         * If S2AFFD and PTE.AF are 0 => fault. (5.2. Stream Table Entry)
-+         * entries.
++         * An Access fault takes priority over a Permission fault.
 +         */
-+         cpregid |= 1 << CP_REG_NS_SHIFT;
++        if (!PTE_AF(pte) && !cfg->s2cfg.affd) {
-+    }
++            info->type = SMMU_PTW_ERR_ACCESS;
-+    return cpregid;
++            goto error;
 +        }
 +
 +        s2ap = PTE_AP(pte);
 +        if (is_permission_fault_s2(s2ap, perm)) {
 +            info->type = SMMU_PTW_ERR_PERMISSION;
 +            goto error;
 +        }
 +
 +        /*
 +         * The address output from the translation causes a stage 2 Address
 +         * Size fault if it exceeds the effective PA output range.
 +         */
 +        if (gpa >= (1ULL << cfg->s2cfg.eff_ps)) {
 +            info->type = SMMU_PTW_ERR_ADDR_SIZE;
 +            goto error;
 +        }
 +
 +        tlbe->entry.translated_addr = gpa;
 +        tlbe->entry.iova = ipa & ~mask;
 +        tlbe->entry.addr_mask = mask;
 +        tlbe->entry.perm = s2ap;
 +        tlbe->level = level;
 +        tlbe->granule = granule_sz;
 +        return 0;
 +    }
 +    info->type = SMMU_PTW_ERR_TRANSLATION;
 +
 +error:
 +    info->stage = 2;
 +    tlbe->entry.perm = IOMMU_NONE;
 +    return -EINVAL;
 +}
 +
-+/*
+ /**
-+ * Convert a truncated 32 bit hashtable key into the full
+  * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
-+ * 64 bit KVM register ID.
+  *
-+ */
+@@ -XXX,XX +XXX,XX @@ error:
-+static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
+ int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
-+{
+              SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 +    uint64_t kvmid;
 +
 +    if (cpregid & CP_REG_AA64_MASK) {
 +        kvmid = cpregid & ~CP_REG_AA64_MASK;
 +        kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM64;
 +    } else {
 +        kvmid = cpregid & ~(1 << 15);
 +        if (cpregid & (1 << 15)) {
 +            kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM;
 +        } else {
 +            kvmid |= CP_REG_SIZE_U32 | CP_REG_ARM;
 +        }
 +    }
 +    return kvmid;
 +}
 +
  /*
   * Valid values for ARMCPRegInfo state field, indicating which of
   * the AArch32 and AArch64 execution states this register is visible in.
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_list(void);
  uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
                                   uint32_t cur_el, bool secure);
 -/* Interface for defining coprocessor registers.
 - * Registers are defined in tables of arm_cp_reginfo structs
 - * which are passed to define_arm_cp_regs().
 - */
 -
 -/* When looking up a coprocessor register we look for it
 - * via an integer which encodes all of:
 - *  coprocessor number
 - *  Crn, Crm, opc1, opc2 fields
 - *  32 or 64 bit register (ie is it accessed via MRC/MCR
 - *    or via MRRC/MCRR?)
 - *  non-secure/secure bank (AArch32 only)
 - * We allow 4 bits for opc1 because MRRC/MCRR have a 4 bit field.
 - * (In this case crn and opc2 should be zero.)
 - * For AArch64, there is no 32/64 bit size distinction;
 - * instead all registers have a 2 bit op0, 3 bit op1 and op2,
 - * and 4 bit CRn and CRm. The encoding patterns are chosen
 - * to be easy to convert to and from the KVM encodings, and also
 - * so that the hashtable can contain both AArch32 and AArch64
 - * registers (to allow for interprocessing where we might run
 - * 32 bit code on a 64 bit core).
 - */
 -/* This bit is private to our hashtable cpreg; in KVM register
 - * IDs the AArch64/32 distinction is the KVM_REG_ARM/ARM64
 - * in the upper bits of the 64 bit ID.
 - */
 -#define CP_REG_AA64_SHIFT 28
 -#define CP_REG_AA64_MASK (1 << CP_REG_AA64_SHIFT)
 -
 -/* To enable banking of coprocessor registers depending on ns-bit we
 - * add a bit to distinguish between secure and non-secure cpregs in the
 - * hashtable.
 - */
 -#define CP_REG_NS_SHIFT 29
 -#define CP_REG_NS_MASK (1 << CP_REG_NS_SHIFT)
 -
 -#define ENCODE_CP_REG(cp, is64, ns, crn, crm, opc1, opc2)   \
 -    ((ns) << CP_REG_NS_SHIFT | ((cp) << 16) | ((is64) << 15) |   \
 -     ((crn) << 11) | ((crm) << 7) | ((opc1) << 3) | (opc2))
 -
 -#define ENCODE_AA64_CP_REG(cp, crn, crm, op0, op1, op2) \
 -    (CP_REG_AA64_MASK |                                 \
 -     ((cp) << CP_REG_ARM_COPROC_SHIFT) |                \
 -     ((op0) << CP_REG_ARM64_SYSREG_OP0_SHIFT) |         \
 -     ((op1) << CP_REG_ARM64_SYSREG_OP1_SHIFT) |         \
 -     ((crn) << CP_REG_ARM64_SYSREG_CRN_SHIFT) |         \
 -     ((crm) << CP_REG_ARM64_SYSREG_CRM_SHIFT) |         \
 -     ((op2) << CP_REG_ARM64_SYSREG_OP2_SHIFT))
 -
 -/* Convert a full 64 bit KVM register ID to the truncated 32 bit
 - * version used as a key for the coprocessor register hashtable
 - */
 -static inline uint32_t kvm_to_cpreg_id(uint64_t kvmid)
 -{
 -    uint32_t cpregid = kvmid;
 -    if ((kvmid & CP_REG_ARCH_MASK) == CP_REG_ARM64) {
 -        cpregid |= CP_REG_AA64_MASK;
 -    } else {
 -        if ((kvmid & CP_REG_SIZE_MASK) == CP_REG_SIZE_U64) {
 -            cpregid |= (1 << 15);
 -        }
 -
 -        /* KVM is always non-secure so add the NS flag on AArch32 register
 -         * entries.
 -         */
 -         cpregid |= 1 << CP_REG_NS_SHIFT;
 -    }
 -    return cpregid;
 -}
 -
 -/* Convert a truncated 32 bit hashtable key into the full
 - * 64 bit KVM register ID.
 - */
 -static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
 -{
 -    uint64_t kvmid;
 -
 -    if (cpregid & CP_REG_AA64_MASK) {
 -        kvmid = cpregid & ~CP_REG_AA64_MASK;
 -        kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM64;
 -    } else {
 -        kvmid = cpregid & ~(1 << 15);
 -        if (cpregid & (1 << 15)) {
 -            kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM;
 -        } else {
 -            kvmid |= CP_REG_SIZE_U32 | CP_REG_ARM;
 -        }
 -    }
 -    return kvmid;
 -}
 -
  /* Return the highest implemented Exception Level */
  static inline int arm_highest_el(CPUARMState *env)
  {
+-    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
++    if (cfg->stage == 1) {
++        return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
++    } else if (cfg->stage == 2) {
++        /*
++         * If bypassing stage 1(or unimplemented), the input address is passed
++         * directly to stage 2 as IPA. If the input address of a transaction
++         * exceeds the size of the IAS, a stage 1 Address Size fault occurs.
++         * For AA64, IAS = OAS according to (IHI 0070.E.a) "3.4 Address sizes"
++         */
++        if (iova >= (1ULL << cfg->oas)) {
++            info->type = SMMU_PTW_ERR_ADDR_SIZE;
++            info->stage = 1;
++            tlbe->entry.perm = IOMMU_NONE;
++            return -EINVAL;
++        }
++
++        return smmu_ptw_64_s2(cfg, iova, perm, tlbe, info);
++    }
++
++    g_assert_not_reached();
+ }
+ /**
 --
 .34.1

-[PULL 13/30] hw/arm/smmuv3: Add GBPA register
+[PULL 06/21] hw/arm/smmuv3: Parse STE config for stage-2
 From: Mostafa Saleh <smostafa@google.com>
-GBPA register can be used to globally abort all
+Parse stage-2 configuration from STE and populate it in SMMUS2Cfg.
-transactions.
+Validity of field values are checked when possible.
-It is described in the SMMU manual in "6.3.14 SMMU_GBPA".
+Only AA64 tables are supported and Small Translation Tables (STT) are
-ABORT reset value is IMPLEMENTATION DEFINED, it is chosen to
+not supported.
-be zero(Do not abort incoming transactions).
+According to SMMUv3 UM(IHI0070E) "5.2 Stream Table Entry": All fields
-Other fields have default values of Use Incoming.
+with an S2 prefix (with the exception of S2VMID) are IGNORED when
+stage-2 bypasses translation (Config[1] == 0).
-If UPDATE is not set, the write is ignored. This is the only permitted
-behavior in SMMUv3.2 and later.(6.3.14.1 Update procedure)
+Which means that VMID can be used(for TLB tagging) even if stage-2 is
+bypassed, so we parse it unconditionally when S2P exists. Otherwise
-As this patch adds a new state to the SMMU (GBPA), it is added
+it is set to -1.(only S1P)
-in a new subsection for forward migration compatibility.
-GBPA is only migrated if its value is different from the reset value.
+As stall is not supported, if S2S is set the translation would abort.
-It does this to be backward migration compatible if SW didn't write
+For S2R, we reuse the same code used for stage-1 with flag
-the register.
+record_faults. However when nested translation is supported we would
 need to separate stage-1 and stage-2 faults.
 Fix wrong shift in STE_S2HD, STE_S2HA, STE_S2S.
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20230214094009.2445653-1-smostafa@google.com
+Message-id: 20230516203327.2051088-6-smostafa@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmuv3-internal.h |  7 +++++++
+ hw/arm/smmuv3-internal.h     |  10 +-
- include/hw/arm/smmuv3.h  |  1 +
+ include/hw/arm/smmu-common.h |   1 +
- hw/arm/smmuv3.c          | 43 +++++++++++++++++++++++++++++++++++++++-
+ include/hw/arm/smmuv3.h      |   3 +
-files changed, 50 insertions(+), 1 deletion(-)
+ hw/arm/smmuv3.c              | 181 +++++++++++++++++++++++++++++++++--
 files changed, 185 insertions(+), 10 deletions(-)
 diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3-internal.h
 +++ b/hw/arm/smmuv3-internal.h
-@@ -XXX,XX +XXX,XX @@ REG32(CR0ACK,              0x24)
+@@ -XXX,XX +XXX,XX @@ typedef struct CD {
- REG32(CR1,                 0x28)
+ #define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
- REG32(CR2,                 0x2c)
+ #define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
- REG32(STATUSR,             0x40)
+ #define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
-+REG32(GBPA,                0x44)
+-#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
-+    FIELD(GBPA, ABORT,        20, 1)
+-#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
-+    FIELD(GBPA, UPDATE,       31, 1)
+-#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
-+
++#define STE_S2ENDI(x)      extract32((x)->word[5], 20, 1)
-+/* Use incoming. */
++#define STE_S2AFFD(x)      extract32((x)->word[5], 21, 1)
-+#define SMMU_GBPA_RESET_VAL 0x1000
++#define STE_S2HD(x)        extract32((x)->word[5], 23, 1)
-+
++#define STE_S2HA(x)        extract32((x)->word[5], 24, 1)
- REG32(IRQ_CTRL,            0x50)
++#define STE_S2S(x)         extract32((x)->word[5], 25, 1)
-     FIELD(IRQ_CTRL, GERROR_IRQEN,        0, 1)
++#define STE_S2R(x)         extract32((x)->word[5], 26, 1)
-     FIELD(IRQ_CTRL, PRI_IRQEN,           1, 1)
++
  #define STE_CTXPTR(x)                                           \
      ({                                                          \
          unsigned long addr;                                     \
 diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/smmu-common.h
 +++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@
  /* VMSAv8-64 Translation constants and functions */
  #define VMSA_LEVELS                         4
 +#define VMSA_MAX_S2_CONCAT                  16
  #define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
  #define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
 diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/smmuv3.h
 +++ b/include/hw/arm/smmuv3.h
-@@ -XXX,XX +XXX,XX @@ struct SMMUv3State {
+@@ -XXX,XX +XXX,XX @@ struct SMMUv3Class {
-     uint32_t cr[3];
+ #define TYPE_ARM_SMMUV3   "arm-smmuv3"
-     uint32_t cr0ack;
+ OBJECT_DECLARE_TYPE(SMMUv3State, SMMUv3Class, ARM_SMMUV3)
-     uint32_t statusr;
-+    uint32_t gbpa;
++#define STAGE1_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S1P)
-     uint32_t irq_ctrl;
++#define STAGE2_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S2P)
-     uint32_t gerror;
++
-     uint32_t gerrorn;
+ #endif
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
+@@ -XXX,XX +XXX,XX @@
-     s->gerror = 0;
+ #include "smmuv3-internal.h"
-     s->gerrorn = 0;
+ #include "smmu-internal.h"
-     s->statusr = 0;
-+    s->gbpa = SMMU_GBPA_RESET_VAL;
++#define PTW_RECORD_FAULT(cfg)   (((cfg)->stage == 1) ? (cfg)->record_faults : \
 +                                 (cfg)->s2cfg.record_faults)
 +
  /**
   * smmuv3_trigger_irq - pulse @irq if enabled and update
   * GERROR register in case of GERROR interrupt
@@ -XXX,XX +XXX,XX @@ static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
      return 0;
  }
- static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
++/*
 + * Max valid value is 39 when SMMU_IDR3.STT == 0.
 + * In architectures after SMMUv3.0:
 + * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this
 + *   field is MAX(16, 64-IAS)
 + * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field
 + *   is (64-IAS).
 + * As we only support AA64, IAS = OAS.
 + */
 +static bool s2t0sz_valid(SMMUTransCfg *cfg)
 +{
 +    if (cfg->s2cfg.tsz > 39) {
 +        return false;
 +    }
 +
 +    if (cfg->s2cfg.granule_sz == 16) {
 +        return (cfg->s2cfg.tsz >= 64 - oas2bits(SMMU_IDR5_OAS));
 +    }
 +
 +    return (cfg->s2cfg.tsz >= MAX(64 - oas2bits(SMMU_IDR5_OAS), 16));
 +}
 +
 +/*
 + * Return true if s2 page table config is valid.
 + * This checks with the configured start level, ias_bits and granularity we can
 + * have a valid page table as described in ARM ARM D8.2 Translation process.
 + * The idea here is to see for the highest possible number of IPA bits, how
 + * many concatenated tables we would need, if it is more than 16, then this is
 + * not possible.
 + */
 +static bool s2_pgtable_config_valid(uint8_t sl0, uint8_t t0sz, uint8_t gran)
 +{
 +    int level = get_start_level(sl0, gran);
 +    uint64_t ipa_bits = 64 - t0sz;
 +    uint64_t max_ipa = (1ULL << ipa_bits) - 1;
 +    int nr_concat = pgd_concat_idx(level, gran, max_ipa) + 1;
 +
 +    return nr_concat <= VMSA_MAX_S2_CONCAT;
 +}
 +
 +static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
 +{
 +    cfg->stage = 2;
 +
 +    if (STE_S2AA64(ste) == 0x0) {
 +        qemu_log_mask(LOG_UNIMP,
 +                      "SMMUv3 AArch32 tables not supported\n");
 +        g_assert_not_reached();
 +    }
 +
 +    switch (STE_S2TG(ste)) {
 +    case 0x0: /* 4KB */
 +        cfg->s2cfg.granule_sz = 12;
 +        break;
 +    case 0x1: /* 64KB */
 +        cfg->s2cfg.granule_sz = 16;
 +        break;
 +    case 0x2: /* 16KB */
 +        cfg->s2cfg.granule_sz = 14;
 +        break;
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste));
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.vttb = STE_S2TTB(ste);
 +
 +    cfg->s2cfg.sl0 = STE_S2SL0(ste);
 +    /* FEAT_TTST not supported. */
 +    if (cfg->s2cfg.sl0 == 0x3) {
 +        qemu_log_mask(LOG_UNIMP, "SMMUv3 S2SL0 = 0x3 has no meaning!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* For AA64, The effective S2PS size is capped to the OAS. */
 +    cfg->s2cfg.eff_ps = oas2bits(MIN(STE_S2PS(ste), SMMU_IDR5_OAS));
 +    /*
 +     * It is ILLEGAL for the address in S2TTB to be outside the range
 +     * described by the effective S2PS value.
 +     */
 +    if (cfg->s2cfg.vttb & ~(MAKE_64BIT_MASK(0, cfg->s2cfg.eff_ps))) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 S2TTB too large 0x%lx, effective PS %d bits\n",
 +                      cfg->s2cfg.vttb,  cfg->s2cfg.eff_ps);
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.tsz = STE_S2T0SZ(ste);
 +
 +    if (!s2t0sz_valid(cfg)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 bad STE S2T0SZ = %d\n",
 +                      cfg->s2cfg.tsz);
 +        goto bad_ste;
 +    }
 +
 +    if (!s2_pgtable_config_valid(cfg->s2cfg.sl0, cfg->s2cfg.tsz,
 +                                    cfg->s2cfg.granule_sz)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 STE stage 2 config not valid!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* Only LE supported(IDR0.TTENDIAN). */
 +    if (STE_S2ENDI(ste)) {
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "SMMUv3 STE_S2ENDI only supports LE!\n");
 +        goto bad_ste;
 +    }
 +
 +    cfg->s2cfg.affd = STE_S2AFFD(ste);
 +
 +    cfg->s2cfg.record_faults = STE_S2R(ste);
 +    /* As stall is not supported. */
 +    if (STE_S2S(ste)) {
 +        qemu_log_mask(LOG_UNIMP, "SMMUv3 Stall not implemented!\n");
 +        goto bad_ste;
 +    }
 +
 +    /* This is still here as stage 2 has not been fully enabled yet. */
 +    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
 +    goto bad_ste;
 +
 +    return 0;
 +
 +bad_ste:
 +    return -EINVAL;
 +}
 +
  /* Returns < 0 in case of invalid STE, 0 otherwise */
  static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
                        STE *ste, SMMUEventInfo *event)
  {
      uint32_t config;
 +    int ret;
      if (!STE_VALID(ste)) {
          if (!event->inval_ste_allowed) {
@@ -XXX,XX +XXX,XX @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
          return 0;
      }
 -    if (STE_CFG_S2_ENABLED(config)) {
 -        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
 +    /*
 +     * If a stage is enabled in SW while not advertised, throw bad ste
 +     * according to user manual(IHI0070E) "5.2 Stream Table Entry".
 +     */
 +    if (!STAGE1_SUPPORTED(s) && STE_CFG_S1_ENABLED(config)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S1 used but not supported.\n");
          goto bad_ste;
      }
 +    if (!STAGE2_SUPPORTED(s) && STE_CFG_S2_ENABLED(config)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S2 used but not supported.\n");
 +        goto bad_ste;
 +    }
 +
 +    if (STAGE2_SUPPORTED(s)) {
 +        /* VMID is considered even if s2 is disabled. */
 +        cfg->s2cfg.vmid = STE_S2VMID(ste);
 +    } else {
 +        /* Default to -1 */
 +        cfg->s2cfg.vmid = -1;
 +    }
 +
 +    if (STE_CFG_S2_ENABLED(config)) {
 +        /*
 +         * Stage-1 OAS defaults to OAS even if not enabled as it would be used
 +         * in input address check for stage-2.
 +         */
 +        cfg->oas = oas2bits(SMMU_IDR5_OAS);
 +        ret = decode_ste_s2_cfg(cfg, ste);
 +        if (ret) {
 +            goto bad_ste;
 +        }
 +    }
      if (STE_S1CDMAX(ste) != 0) {
          qemu_log_mask(LOG_UNIMP,
 @@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
-     qemu_mutex_lock(&s->mutex);
+     if (cached_entry) {
+         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
-     if (!smmu_enabled(s)) {
+             status = SMMU_TRANS_ERROR;
--        status = SMMU_TRANS_DISABLE;
+-            if (cfg->record_faults) {
-+        if (FIELD_EX32(s->gbpa, GBPA, ABORT)) {
++            /*
-+            status = SMMU_TRANS_ABORT;
++             * We know that the TLB only contains either stage-1 or stage-2 as
-+        } else {
++             * nesting is not supported. So it is sufficient to check the
-+            status = SMMU_TRANS_DISABLE;
++             * translation stage to know the TLB stage for now.
-+        }
++             */
-         goto epilogue;
++            event.u.f_walk_eabt.s2 = (cfg->stage == 2);
-     }
++            if (PTW_RECORD_FAULT(cfg)) {
+                 event.type = SMMU_EVT_F_PERMISSION;
-@@ -XXX,XX +XXX,XX @@ static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
+                 event.u.f_permission.addr = addr;
-     case A_GERROR_IRQ_CFG2:
+                 event.u.f_permission.rnw = flag & 0x1;
-         s->gerror_irq_cfg2 = data;
+@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
-         return MEMTX_OK;
+             event.u.f_walk_eabt.addr2 = ptw_info.addr;
-+    case A_GBPA:
+             break;
-+        /*
+         case SMMU_PTW_ERR_TRANSLATION:
-+         * If UPDATE is not set, the write is ignored. This is the only
+-            if (cfg->record_faults) {
-+         * permitted behavior in SMMUv3.2 and later.
++            if (PTW_RECORD_FAULT(cfg)) {
-+         */
+                 event.type = SMMU_EVT_F_TRANSLATION;
-+        if (data & R_GBPA_UPDATE_MASK) {
+                 event.u.f_translation.addr = addr;
-+            /* Ignore update bit as write is synchronous. */
+                 event.u.f_translation.rnw = flag & 0x1;
-+            s->gbpa = data & ~R_GBPA_UPDATE_MASK;
+             }
-+        }
+             break;
-+        return MEMTX_OK;
+         case SMMU_PTW_ERR_ADDR_SIZE:
-     case A_STRTAB_BASE: /* 64b */
+-            if (cfg->record_faults) {
-         s->strtab_base = deposit64(s->strtab_base, 0, 32, data);
++            if (PTW_RECORD_FAULT(cfg)) {
-         return MEMTX_OK;
+                 event.type = SMMU_EVT_F_ADDR_SIZE;
-@@ -XXX,XX +XXX,XX @@ static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset,
+                 event.u.f_addr_size.addr = addr;
-     case A_STATUSR:
+                 event.u.f_addr_size.rnw = flag & 0x1;
-         *data = s->statusr;
+             }
-         return MEMTX_OK;
+             break;
-+    case A_GBPA:
+         case SMMU_PTW_ERR_ACCESS:
-+        *data = s->gbpa;
+-            if (cfg->record_faults) {
-+        return MEMTX_OK;
++            if (PTW_RECORD_FAULT(cfg)) {
-     case A_IRQ_CTRL:
+                 event.type = SMMU_EVT_F_ACCESS;
-     case A_IRQ_CTRL_ACK:
+                 event.u.f_access.addr = addr;
-         *data = s->irq_ctrl;
+                 event.u.f_access.rnw = flag & 0x1;
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3_queue = {
+             }
-     },
+             break;
- };
+         case SMMU_PTW_ERR_PERMISSION:
+-            if (cfg->record_faults) {
-+static bool smmuv3_gbpa_needed(void *opaque)
++            if (PTW_RECORD_FAULT(cfg)) {
-+{
+                 event.type = SMMU_EVT_F_PERMISSION;
-+    SMMUv3State *s = opaque;
+                 event.u.f_permission.addr = addr;
-+
+                 event.u.f_permission.rnw = flag & 0x1;
 +    /* Only migrate GBPA if it has different reset value. */
 +    return s->gbpa != SMMU_GBPA_RESET_VAL;
 +}
 +
 +static const VMStateDescription vmstate_gbpa = {
 +    .name = "smmuv3/gbpa",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = smmuv3_gbpa_needed,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT32(gbpa, SMMUv3State),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
  static const VMStateDescription vmstate_smmuv3 = {
      .name = "smmuv3",
      .version_id = 1,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3 = {
          VMSTATE_END_OF_LIST(),
      },
 +    .subsections = (const VMStateDescription * []) {
 +        &vmstate_gbpa,
 +        NULL
 +    }
  };
  static void smmuv3_instance_init(Object *obj)
 --
 .34.1

-[PULL 22/30] target/arm: wrap psci call with tcg_enabled
+[PULL 07/21] hw/arm/smmuv3: Make TLB lookup work for stage-2
-From: Claudio Fontana <cfontana@suse.de>
+From: Mostafa Saleh <smostafa@google.com>
-for "all" builds (tcg + kvm), we want to avoid doing
+Right now, either stage-1 or stage-2 are supported, this simplifies
-the psci check if tcg is built-in, but not enabled.
+how we can deal with TLBs.
 This patch makes TLB lookup work if stage-2 is enabled instead of
 stage-1.
 TLB lookup is done before a PTW, if a valid entry is found we won't
 do the PTW.
 To be able to do TLB lookup, we need the correct tagging info, as
 granularity and input size, so we get this based on the supported
 translation stage. The TLB entries are added correctly from each
 stage PTW.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+When nested translation is supported, this would need to change, for
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+example if we go with a combined TLB implementation, we would need to
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
+use the min of the granularities in TLB.
-Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 As stage-2 shouldn't be tagged by ASID, it will be set to -1 if S1P
 is not enabled.
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-7-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 3 ++-
+ hw/arm/smmuv3.c | 44 +++++++++++++++++++++++++++++++++-----------
-file changed, 2 insertions(+), 1 deletion(-)
+file changed, 33 insertions(+), 11 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/arm/smmuv3.c
-+++ b/target/arm/helper.c
++++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
- #include "hw/irq.h"
+     STE ste;
- #include "sysemu/cpu-timers.h"
+     CD cd;
- #include "sysemu/kvm.h"
-+#include "sysemu/tcg.h"
++    /* ASID defaults to -1 (if s1 is not supported). */
- #include "qapi/qapi-commands-machine-target.h"
++    cfg->asid = -1;
- #include "qapi/error.h"
++
- #include "qemu/guest-random.h"
+     ret = smmu_find_ste(s, sid, &ste, event);
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
+     if (ret) {
-                       env->exception.syndrome);
+         return ret;
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
          .addr_mask = ~(hwaddr)0,
          .perm = IOMMU_NONE,
      };
 +    /*
 +     * Combined attributes used for TLB lookup, as only one stage is supported,
 +     * it will hold attributes based on the enabled stage.
 +     */
 +    SMMUTransTableInfo tt_combined;
      qemu_mutex_lock(&s->mutex);
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
          goto epilogue;
      }
--    if (arm_is_psci_call(cpu, cs->exception_index)) {
+-    tt = select_tt(cfg, addr);
-+    if (tcg_enabled() && arm_is_psci_call(cpu, cs->exception_index)) {
+-    if (!tt) {
-         arm_handle_psci_call(cpu);
+-        if (cfg->record_faults) {
-         qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
+-            event.type = SMMU_EVT_F_TRANSLATION;
-         return;
+-            event.u.f_translation.addr = addr;
 -            event.u.f_translation.rnw = flag & 0x1;
 +    if (cfg->stage == 1) {
 +        /* Select stage1 translation table. */
 +        tt = select_tt(cfg, addr);
 +        if (!tt) {
 +            if (cfg->record_faults) {
 +                event.type = SMMU_EVT_F_TRANSLATION;
 +                event.u.f_translation.addr = addr;
 +                event.u.f_translation.rnw = flag & 0x1;
 +            }
 +            status = SMMU_TRANS_ERROR;
 +            goto epilogue;
          }
 -        status = SMMU_TRANS_ERROR;
 -        goto epilogue;
 -    }
 +        tt_combined.granule_sz = tt->granule_sz;
 +        tt_combined.tsz = tt->tsz;
 -    page_mask = (1ULL << (tt->granule_sz)) - 1;
 +    } else {
 +        /* Stage2. */
 +        tt_combined.granule_sz = cfg->s2cfg.granule_sz;
 +        tt_combined.tsz = cfg->s2cfg.tsz;
 +    }
 +    /*
 +     * TLB lookup looks for granule and input size for a translation stage,
 +     * as only one stage is supported right now, choose the right values
 +     * from the configuration.
 +     */
 +    page_mask = (1ULL << tt_combined.granule_sz) - 1;
      aligned_addr = addr & ~page_mask;
 -    cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr);
 +    cached_entry = smmu_iotlb_lookup(bs, cfg, &tt_combined, aligned_addr);
      if (cached_entry) {
          if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
              status = SMMU_TRANS_ERROR;
 --
 .34.1

-[PULL 20/30] hw/arm/smmu-common: Fix TTB1 handling
+[PULL 08/21] hw/arm/smmuv3: Add VMID to TLB tagging
-From: Jean-Philippe Brucker <jean-philippe@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-Addresses targeting the second translation table (TTB1) in the SMMU have
+Allow TLB to be tagged with VMID.
-all upper bits set (except for the top byte when TBI is enabled). Fix
-the TTB1 check.
+If stage-1 is only supported, VMID is set to -1 and ignored from STE
+and CMD_TLBI_NH* cmds.
-Reported-by: Ola Hugosson <ola.hugosson@arm.com>
 Update smmu_iotlb_insert trace event to have vmid.
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Eric Auger <eric.auger@redhat.com>
-Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Message-id: 20230214171921.1917916-3-jean-philippe@linaro.org
+Message-id: 20230516203327.2051088-8-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/smmu-common.c | 2 +-
+ hw/arm/smmu-internal.h       |  2 ++
-file changed, 1 insertion(+), 1 deletion(-)
+ include/hw/arm/smmu-common.h |  5 +++--
+ hw/arm/smmu-common.c         | 36 ++++++++++++++++++++++--------------
  hw/arm/smmuv3.c              | 12 +++++++++---
  hw/arm/trace-events          |  6 +++---
 files changed, 39 insertions(+), 22 deletions(-)
 diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-internal.h
 +++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@ static inline int pgd_concat_idx(int start_level, int granule_sz,
  }
  #define SMMU_IOTLB_ASID(key) ((key).asid)
 +#define SMMU_IOTLB_VMID(key) ((key).vmid)
  typedef struct SMMUIOTLBPageInvInfo {
      int asid;
 +    int vmid;
      uint64_t iova;
      uint64_t mask;
  } SMMUIOTLBPageInvInfo;
 diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/smmu-common.h
 +++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUPciBus {
  typedef struct SMMUIOTLBKey {
      uint64_t iova;
      uint16_t asid;
 +    uint16_t vmid;
      uint8_t tg;
      uint8_t level;
  } SMMUIOTLBKey;
@@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid);
  SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
                                  SMMUTransTableInfo *tt, hwaddr iova);
  void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *entry);
 -SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
 +SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                  uint8_t tg, uint8_t level);
  void smmu_iotlb_inv_all(SMMUState *s);
  void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
 -void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
 +void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                           uint8_t tg, uint64_t num_pages, uint8_t ttl);
  /* Unmap the range of all the notifiers registered to any IOMMU mr */
 diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmu-common.c
 +++ b/hw/arm/smmu-common.c
-@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
+@@ -XXX,XX +XXX,XX @@ static guint smmu_iotlb_key_hash(gconstpointer v)
-         /* there is a ttbr0 region and we are in it (high bits all zero) */
-         return &cfg->tt[0];
+     /* Jenkins hash */
-     } else if (cfg->tt[1].tsz &&
+     a = b = c = JHASH_INITVAL + sizeof(*key);
--           !extract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte)) {
+-    a += key->asid + key->level + key->tg;
-+        sextract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte) == -1) {
++    a += key->asid + key->vmid + key->level + key->tg;
-         /* there is a ttbr1 region and we are in it (high bits all one) */
+     b += extract64(key->iova, 0, 32);
-         return &cfg->tt[1];
+     c += extract64(key->iova, 32, 32);
-     } else if (!cfg->tt[0].tsz) {
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
      SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2;
      return (k1->asid == k2->asid) && (k1->iova == k2->iova) &&
 -           (k1->level == k2->level) && (k1->tg == k2->tg);
 +           (k1->level == k2->level) && (k1->tg == k2->tg) &&
 +           (k1->vmid == k2->vmid);
  }
 -SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
 +SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                  uint8_t tg, uint8_t level)
  {
 -    SMMUIOTLBKey key = {.asid = asid, .iova = iova, .tg = tg, .level = level};
 +    SMMUIOTLBKey key = {.asid = asid, .vmid = vmid, .iova = iova,
 +                        .tg = tg, .level = level};
      return key;
  }
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
          uint64_t mask = subpage_size - 1;
          SMMUIOTLBKey key;
 -        key = smmu_get_iotlb_key(cfg->asid, iova & ~mask, tg, level);
 +        key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid,
 +                                 iova & ~mask, tg, level);
          entry = g_hash_table_lookup(bs->iotlb, &key);
          if (entry) {
              break;
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
      if (entry) {
          cfg->iotlb_hits++;
 -        trace_smmu_iotlb_lookup_hit(cfg->asid, iova,
 +        trace_smmu_iotlb_lookup_hit(cfg->asid, cfg->s2cfg.vmid, iova,
                                      cfg->iotlb_hits, cfg->iotlb_misses,
 * cfg->iotlb_hits /
                                      (cfg->iotlb_hits + cfg->iotlb_misses));
      } else {
          cfg->iotlb_misses++;
 -        trace_smmu_iotlb_lookup_miss(cfg->asid, iova,
 +        trace_smmu_iotlb_lookup_miss(cfg->asid, cfg->s2cfg.vmid, iova,
                                       cfg->iotlb_hits, cfg->iotlb_misses,
 * cfg->iotlb_hits /
                                       (cfg->iotlb_hits + cfg->iotlb_misses));
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new)
          smmu_iotlb_inv_all(bs);
      }
 -    *key = smmu_get_iotlb_key(cfg->asid, new->entry.iova, tg, new->level);
 -    trace_smmu_iotlb_insert(cfg->asid, new->entry.iova, tg, new->level);
 +    *key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
 +                              tg, new->level);
 +    trace_smmu_iotlb_insert(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
 +                            tg, new->level);
      g_hash_table_insert(bs->iotlb, key, new);
  }
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
      return SMMU_IOTLB_ASID(*iotlb_key) == asid;
  }
 -
 -static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
 +static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                                gpointer user_data)
  {
      SMMUTLBEntry *iter = (SMMUTLBEntry *)value;
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
      if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) {
          return false;
      }
 +    if (info->vmid >= 0 && info->vmid != SMMU_IOTLB_VMID(iotlb_key)) {
 +        return false;
 +    }
      return ((info->iova & ~entry->addr_mask) == entry->iova) ||
             ((entry->iova & ~info->mask) == info->iova);
  }
 -void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
 +void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                           uint8_t tg, uint64_t num_pages, uint8_t ttl)
  {
      /* if tg is not set we use 4KB range invalidation */
      uint8_t granule = tg ? tg * 2 + 10 : 12;
      if (ttl && (num_pages == 1) && (asid >= 0)) {
 -        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
 +        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, iova, tg, ttl);
          if (g_hash_table_remove(s->iotlb, &key)) {
              return;
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
      SMMUIOTLBPageInvInfo info = {
          .asid = asid, .iova = iova,
 +        .vmid = vmid,
          .mask = (num_pages * 1 << granule) - 1};
      g_hash_table_foreach_remove(s->iotlb,
 -                                smmu_hash_remove_by_asid_iova,
 +                                smmu_hash_remove_by_asid_vmid_iova,
                                  &info);
  }
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
  {
      dma_addr_t end, addr = CMD_ADDR(cmd);
      uint8_t type = CMD_TYPE(cmd);
 -    uint16_t vmid = CMD_VMID(cmd);
 +    int vmid = -1;
      uint8_t scale = CMD_SCALE(cmd);
      uint8_t num = CMD_NUM(cmd);
      uint8_t ttl = CMD_TTL(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
      uint64_t num_pages;
      uint8_t granule;
      int asid = -1;
 +    SMMUv3State *smmuv3 = ARM_SMMUV3(s);
 +
 +    /* Only consider VMID if stage-2 is supported. */
 +    if (STAGE2_SUPPORTED(smmuv3)) {
 +        vmid = CMD_VMID(cmd);
 +    }
      if (type == SMMU_CMD_TLBI_NH_VA) {
          asid = CMD_ASID(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
      if (!tg) {
          trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
          smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
 -        smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl);
 +        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
          num_pages = (mask + 1) >> granule;
          trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
          smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
 -        smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
 +        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
          addr += mask + 1;
      }
  }
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_iotlb_inv_all(void) "IOTLB invalidate all"
  smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
  smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
  smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
 -smmu_iotlb_lookup_hit(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 -smmu_iotlb_lookup_miss(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 -smmu_iotlb_insert(uint16_t asid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d addr=0x%"PRIx64" tg=%d level=%d"
 +smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 +smmu_iotlb_lookup_miss(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
 +smmu_iotlb_insert(uint16_t asid, uint16_t vmid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d vmid=%d addr=0x%"PRIx64" tg=%d level=%d"
  # smmuv3.c
  smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
 --
 .34.1

-[PULL 03/30] target/arm: Reduce arm_v7m_mmu_idx_[all/for_secstate_and_priv]() scope
+[PULL 09/21] hw/arm/smmuv3: Add CMDs related to stage-2
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
+From: Mostafa Saleh <smostafa@google.com>
-arm_v7m_mmu_idx_all() and arm_v7m_mmu_idx_for_secstate_and_priv()
+CMD_TLBI_S2_IPA: As S1+S2 is not enabled, for now this can be the
-are only used for system emulation in m_helper.c.
+same as CMD_TLBI_NH_VAA.
-Move the definitions to avoid prototype forward declarations.
+CMD_TLBI_S12_VMALL: Added new function to invalidate TLB by VMID.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+For stage-1 only commands, add a check to throw CERROR_ILL if used
-Message-id: 20230206223502.25122-4-philmd@linaro.org
+when stage-1 is not supported.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
 Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-9-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h | 14 --------
+ include/hw/arm/smmu-common.h |  1 +
- target/arm/m_helper.c  | 74 +++++++++++++++++++++---------------------
+ hw/arm/smmu-common.c         | 16 +++++++++++
-files changed, 37 insertions(+), 51 deletions(-)
+ hw/arm/smmuv3.c              | 55 ++++++++++++++++++++++++++++++------
+ hw/arm/trace-events          |  4 ++-
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+files changed, 67 insertions(+), 9 deletions(-)
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
-+++ b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
-@@ -XXX,XX +XXX,XX @@ static inline ARMMMUIdx core_to_aa64_mmu_idx(int mmu_idx)
+--- a/include/hw/arm/smmu-common.h
++++ b/include/hw/arm/smmu-common.h
- int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx);
+@@ -XXX,XX +XXX,XX @@ SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
+                                 uint8_t tg, uint8_t level);
--/*
+ void smmu_iotlb_inv_all(SMMUState *s);
-- * Return the MMU index for a v7M CPU with all relevant information
+ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
-- * manually specified.
++void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid);
-- */
+ void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
--ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
+                          uint8_t tg, uint64_t num_pages, uint8_t ttl);
--                              bool secstate, bool priv, bool negpri);
--
+diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
--/*
+index XXXXXXX..XXXXXXX 100644
-- * Return the MMU index for a v7M CPU in the specified security and
+--- a/hw/arm/smmu-common.c
-- * privilege state.
++++ b/hw/arm/smmu-common.c
-- */
+@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
--ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
--                                                bool secstate, bool priv);
+     return SMMU_IOTLB_ASID(*iotlb_key) == asid;
--
+ }
- /* Return the MMU index for a v7M CPU in the specified security state */
++
- ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate);
++static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value,
++                                         gpointer user_data)
 diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/m_helper.c
 +++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
  #else /* !CONFIG_USER_ONLY */
 +static ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
 +                                     bool secstate, bool priv, bool negpri)
 +{
-+    ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
++    uint16_t vmid = *(uint16_t *)user_data;
-+
++    SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;
-+    if (priv) {
++
-+        mmu_idx |= ARM_MMU_IDX_M_PRIV;
++    return SMMU_IOTLB_VMID(*iotlb_key) == vmid;
 +    }
 +
 +    if (negpri) {
 +        mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
 +    }
 +
 +    if (secstate) {
 +        mmu_idx |= ARM_MMU_IDX_M_S;
 +    }
 +
 +    return mmu_idx;
 +}
 +
-+static ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
+ static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
-+                                                       bool secstate, bool priv)
+                                               gpointer user_data)
  {
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
      g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
  }
 +inline void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid)
 +{
-+    bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate);
++    trace_smmu_iotlb_inv_vmid(vmid);
-+
++    g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid);
 +    return arm_v7m_mmu_idx_all(env, secstate, priv, negpri);
 +}
 +
-+/* Return the MMU index for a v7M CPU in the specified security state */
+ /* VMSAv8-64 Translation */
-+ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
-+{
+ /**
-+    bool priv = arm_v7m_is_handler_mode(env) ||
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
-+        !(env->v7m.control[secstate] & 1);
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/hw/arm/smmuv3.c
-+    return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
++++ b/hw/arm/smmuv3.c
-+}
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
-+
+     }
  /*
   * What kind of stack write are we doing? This affects how exceptions
   * generated during the stacking are treated.
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
      return tt_resp;
  }
--ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
+-static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
--                              bool secstate, bool priv, bool negpri)
++static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
--{
+ {
--    ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
+     dma_addr_t end, addr = CMD_ADDR(cmd);
--
+     uint8_t type = CMD_TYPE(cmd);
--    if (priv) {
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
--        mmu_idx |= ARM_MMU_IDX_M_PRIV;
+     }
--    }
--
+     if (!tg) {
--    if (negpri) {
+-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
--        mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
++        trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
--    }
+         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
--
+         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
--    if (secstate) {
+         return;
--        mmu_idx |= ARM_MMU_IDX_M_S;
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
--    }
+         uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
--
--    return mmu_idx;
+         num_pages = (mask + 1) >> granule;
--}
+-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
--
++        trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
--ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
+         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
--                                                bool secstate, bool priv)
+         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
--{
+         addr += mask + 1;
--    bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate);
+@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
--
+         {
--    return arm_v7m_mmu_idx_all(env, secstate, priv, negpri);
+             uint16_t asid = CMD_ASID(&cmd);
--}
--
++            if (!STAGE1_SUPPORTED(s)) {
--/* Return the MMU index for a v7M CPU in the specified security state */
++                cmd_error = SMMU_CERROR_ILL;
--ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
++                break;
--{
++            }
--    bool priv = arm_v7m_is_handler_mode(env) ||
++
--        !(env->v7m.control[secstate] & 1);
+             trace_smmuv3_cmdq_tlbi_nh_asid(asid);
--
+             smmu_inv_notifiers_all(&s->smmu_state);
--    return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
+             smmu_iotlb_inv_asid(bs, asid);
--}
+             break;
--
+         }
- #endif /* !CONFIG_USER_ONLY */
+         case SMMU_CMD_TLBI_NH_ALL:
 +            if (!STAGE1_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            QEMU_FALLTHROUGH;
          case SMMU_CMD_TLBI_NSNH_ALL:
              trace_smmuv3_cmdq_tlbi_nh();
              smmu_inv_notifiers_all(&s->smmu_state);
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
              break;
          case SMMU_CMD_TLBI_NH_VAA:
          case SMMU_CMD_TLBI_NH_VA:
 -            smmuv3_s1_range_inval(bs, &cmd);
 +            if (!STAGE1_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            smmuv3_range_inval(bs, &cmd);
 +            break;
 +        case SMMU_CMD_TLBI_S12_VMALL:
 +        {
 +            uint16_t vmid = CMD_VMID(&cmd);
 +
 +            if (!STAGE2_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +
 +            trace_smmuv3_cmdq_tlbi_s12_vmid(vmid);
 +            smmu_inv_notifiers_all(&s->smmu_state);
 +            smmu_iotlb_inv_vmid(bs, vmid);
 +            break;
 +        }
 +        case SMMU_CMD_TLBI_S2_IPA:
 +            if (!STAGE2_SUPPORTED(s)) {
 +                cmd_error = SMMU_CERROR_ILL;
 +                break;
 +            }
 +            /*
 +             * As currently only either s1 or s2 are supported
 +             * we can reuse same function for s2.
 +             */
 +            smmuv3_range_inval(bs, &cmd);
              break;
          case SMMU_CMD_TLBI_EL3_ALL:
          case SMMU_CMD_TLBI_EL3_VA:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
          case SMMU_CMD_TLBI_EL2_ASID:
          case SMMU_CMD_TLBI_EL2_VA:
          case SMMU_CMD_TLBI_EL2_VAA:
 -        case SMMU_CMD_TLBI_S12_VMALL:
 -        case SMMU_CMD_TLBI_S2_IPA:
          case SMMU_CMD_ATC_INV:
          case SMMU_CMD_PRI_RESP:
          case SMMU_CMD_RESUME:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
              break;
          default:
              cmd_error = SMMU_CERROR_ILL;
 -            qemu_log_mask(LOG_GUEST_ERROR,
 -                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
              break;
          }
          qemu_mutex_unlock(&s->mutex);
          if (cmd_error) {
 +            if (cmd_error == SMMU_CERROR_ILL) {
 +                qemu_log_mask(LOG_GUEST_ERROR,
 +                              "Illegal command type: %d\n", CMD_TYPE(&cmd));
 +            }
              break;
          }
          /*
 diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/trace-events
 +++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, ui
  smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
  smmu_iotlb_inv_all(void) "IOTLB invalidate all"
  smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
 +smmu_iotlb_inv_vmid(uint16_t vmid) "IOTLB invalidate vmid=%d"
  smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
  smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
  smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_cfgi_ste_range(int start, int end) "start=0x%x - end=0x%x"
  smmuv3_cmdq_cfgi_cd(uint32_t sid) "sid=0x%x"
  smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
  smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
 -smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
 +smmuv3_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
  smmuv3_cmdq_tlbi_nh(void) ""
  smmuv3_cmdq_tlbi_nh_asid(uint16_t asid) "asid=%d"
 +smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
  smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
  smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
  smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
 --
 .34.1

-[PULL 17/30] hw/ssi: Add Nuvoton PSPI Module
+[PULL 10/21] hw/arm/smmuv3: Add stage-2 support in iova notifier
-From: Hao Wu <wuhaotsh@google.com>
+From: Mostafa Saleh <smostafa@google.com>
-Nuvoton's PSPI is a general purpose SPI module which enables
+In smmuv3_notify_iova, read the granule based on translation stage
-connections to SPI-based peripheral devices.
+and use VMID if valid value is sent.
-Signed-off-by: Hao Wu <wuhaotsh@google.com>
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
-Reviewed-by: Chris Rauer <crauer@google.com>
+Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Philippe Mathieu-Daude <philmd@linaro.org>
+Tested-by: Eric Auger <eric.auger@redhat.com>
-Message-id: 20230208235433.3989937-3-wuhaotsh@google.com
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-10-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS                |   6 +-
+ hw/arm/smmuv3.c     | 39 ++++++++++++++++++++++++++-------------
- include/hw/ssi/npcm_pspi.h |  53 +++++++++
+ hw/arm/trace-events |  2 +-
- hw/ssi/npcm_pspi.c         | 221 +++++++++++++++++++++++++++++++++++++
+files changed, 27 insertions(+), 14 deletions(-)
  hw/ssi/meson.build         |   2 +-
  hw/ssi/trace-events        |   5 +
 files changed, 283 insertions(+), 4 deletions(-)
  create mode 100644 include/hw/ssi/npcm_pspi.h
  create mode 100644 hw/ssi/npcm_pspi.c
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/arm/smmuv3.c
-+++ b/MAINTAINERS
++++ b/hw/arm/smmuv3.c
-@@ -XXX,XX +XXX,XX @@ M: Tyrone Ting <kfting@nuvoton.com>
+@@ -XXX,XX +XXX,XX @@ epilogue:
- M: Hao Wu <wuhaotsh@google.com>
+  * @mr: IOMMU mr region handle
- L: qemu-arm@nongnu.org
+  * @n: notifier to be called
- S: Supported
+  * @asid: address space ID or negative value if we don't care
--F: hw/*/npcm7xx*
++ * @vmid: virtual machine ID or negative value if we don't care
--F: include/hw/*/npcm7xx*
+  * @iova: iova
--F: tests/qtest/npcm7xx*
+  * @tg: translation granule (if communicated through range invalidation)
-+F: hw/*/npcm*
+  * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
-+F: include/hw/*/npcm*
+  */
-+F: tests/qtest/npcm*
+ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
- F: pc-bios/npcm7xx_bootrom.bin
+                                IOMMUNotifier *n,
- F: roms/vbootrom
+-                               int asid, dma_addr_t iova,
- F: docs/system/arm/nuvoton.rst
+-                               uint8_t tg, uint64_t num_pages)
-diff --git a/include/hw/ssi/npcm_pspi.h b/include/hw/ssi/npcm_pspi.h
++                               int asid, int vmid,
-new file mode 100644
++                               dma_addr_t iova, uint8_t tg,
-index XXXXXXX..XXXXXXX
++                               uint64_t num_pages)
---- /dev/null
+ {
-+++ b/include/hw/ssi/npcm_pspi.h
+     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
-@@ -XXX,XX +XXX,XX @@
+     IOMMUTLBEvent event;
-+/*
+     uint8_t granule;
-+ * Nuvoton Peripheral SPI Module
++    SMMUv3State *s = sdev->smmu;
-+ *
-+ * Copyright 2023 Google LLC
+     if (!tg) {
-+ *
+         SMMUEventInfo event = {.inval_ste_allowed = true};
-+ * This program is free software; you can redistribute it and/or modify it
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
-+ * under the terms of the GNU General Public License as published by the
+             return;
-+ * Free Software Foundation; either version 2 of the License, or
+         }
-+ * (at your option) any later version.
-+ *
+-        tt = select_tt(cfg, iova);
-+ * This program is distributed in the hope that it will be useful, but WITHOUT
+-        if (!tt) {
-+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
++        if (vmid >= 0 && cfg->s2cfg.vmid != vmid) {
-+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+             return;
-+ * for more details.
+         }
-+ */
+-        granule = tt->granule_sz;
 +#ifndef NPCM_PSPI_H
 +#define NPCM_PSPI_H
 +
-+#include "hw/ssi/ssi.h"
++        if (STAGE1_SUPPORTED(s)) {
-+#include "hw/sysbus.h"
++            tt = select_tt(cfg, iova);
-+
++            if (!tt) {
-+/*
++                return;
-+ * Number of registers in our device state structure. Don't change this without
++            }
-+ * incrementing the version_id in the vmstate.
++            granule = tt->granule_sz;
-+ */
++        } else {
-+#define NPCM_PSPI_NR_REGS 3
++            granule = cfg->s2cfg.granule_sz;
 +
 +/**
 + * NPCMPSPIState - Device state for one Flash Interface Unit.
 + * @parent: System bus device.
 + * @mmio: Memory region for register access.
 + * @spi: The SPI bus mastered by this controller.
 + * @regs: Register contents.
 + * @irq: The interrupt request queue for this module.
 + *
 + * Each PSPI has a shared bank of registers, and controls up to four chip
 + * selects. Each chip select has a dedicated memory region which may be used to
 + * read and write the flash connected to that chip select as if it were memory.
 + */
 +typedef struct NPCMPSPIState {
 +    SysBusDevice parent;
 +
 +    MemoryRegion mmio;
 +
 +    SSIBus *spi;
 +    uint16_t regs[NPCM_PSPI_NR_REGS];
 +    qemu_irq irq;
 +} NPCMPSPIState;
 +
 +#define TYPE_NPCM_PSPI "npcm-pspi"
 +OBJECT_DECLARE_SIMPLE_TYPE(NPCMPSPIState, NPCM_PSPI)
 +
 +#endif /* NPCM_PSPI_H */
 diff --git a/hw/ssi/npcm_pspi.c b/hw/ssi/npcm_pspi.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/hw/ssi/npcm_pspi.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Nuvoton NPCM Peripheral SPI Module (PSPI)
 + *
 + * Copyright 2023 Google LLC
 + *
 + * This program is free software; you can redistribute it and/or modify it
 + * under the terms of the GNU General Public License as published by the
 + * Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful, but WITHOUT
 + * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
 + * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
 + * for more details.
 + */
 +
 +#include "qemu/osdep.h"
 +
 +#include "hw/irq.h"
 +#include "hw/registerfields.h"
 +#include "hw/ssi/npcm_pspi.h"
 +#include "migration/vmstate.h"
 +#include "qapi/error.h"
 +#include "qemu/error-report.h"
 +#include "qemu/log.h"
 +#include "qemu/module.h"
 +#include "qemu/units.h"
 +
 +#include "trace.h"
 +
 +REG16(PSPI_DATA, 0x0)
 +REG16(PSPI_CTL1, 0x2)
 +    FIELD(PSPI_CTL1, SPIEN, 0,  1)
 +    FIELD(PSPI_CTL1, MOD,   2,  1)
 +    FIELD(PSPI_CTL1, EIR,   5,  1)
 +    FIELD(PSPI_CTL1, EIW,   6,  1)
 +    FIELD(PSPI_CTL1, SCM,   7,  1)
 +    FIELD(PSPI_CTL1, SCIDL, 8,  1)
 +    FIELD(PSPI_CTL1, SCDV,  9,  7)
 +REG16(PSPI_STAT, 0x4)
 +    FIELD(PSPI_STAT, BSY,  0,  1)
 +    FIELD(PSPI_STAT, RBF,  1,  1)
 +
 +static void npcm_pspi_update_irq(NPCMPSPIState *s)
 +{
 +    int level = 0;
 +
 +    /* Only fire IRQ when the module is enabled. */
 +    if (FIELD_EX16(s->regs[R_PSPI_CTL1], PSPI_CTL1, SPIEN)) {
 +        /* Update interrupt as BSY is cleared. */
 +        if ((!FIELD_EX16(s->regs[R_PSPI_STAT], PSPI_STAT, BSY)) &&
 +            FIELD_EX16(s->regs[R_PSPI_CTL1], PSPI_CTL1, EIW)) {
 +            level = 1;
 +        }
 +
-+        /* Update interrupt as RBF is set. */
+     } else {
-+        if (FIELD_EX16(s->regs[R_PSPI_STAT], PSPI_STAT, RBF) &&
+         granule = tg * 2 + 10;
-+            FIELD_EX16(s->regs[R_PSPI_CTL1], PSPI_CTL1, EIR)) {
+     }
-+            level = 1;
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
-+        }
+     memory_region_notify_iommu_one(n, &event);
-+    }
+ }
-+    qemu_set_irq(s->irq, level);
-+}
+-/* invalidate an asid/iova range tuple in all mr's */
-+
+-static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
-+static uint16_t npcm_pspi_read_data(NPCMPSPIState *s)
+-                                      uint8_t tg, uint64_t num_pages)
-+{
++/* invalidate an asid/vmid/iova range tuple in all mr's */
-+    uint16_t value = s->regs[R_PSPI_DATA];
++static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid,
-+
++                                      dma_addr_t iova, uint8_t tg,
-+    /* Clear stat bits as the value are read out. */
++                                      uint64_t num_pages)
-+    s->regs[R_PSPI_STAT] = 0;
+ {
-+
+     SMMUDevice *sdev;
-+    return value;
-+}
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
-+
+         IOMMUMemoryRegion *mr = &sdev->iommu;
-+static void npcm_pspi_write_data(NPCMPSPIState *s, uint16_t data)
+         IOMMUNotifier *n;
-+{
-+    uint16_t value = 0;
+-        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova,
-+
+-                                        tg, num_pages);
-+    if (FIELD_EX16(s->regs[R_PSPI_CTL1], PSPI_CTL1, MOD)) {
++        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid,
-+        value = ssi_transfer(s->spi, extract16(data, 8, 8)) << 8;
++                                        iova, tg, num_pages);
-+    }
-+    value |= ssi_transfer(s->spi, extract16(data, 0, 8));
+         IOMMU_NOTIFIER_FOREACH(n, mr) {
-+    s->regs[R_PSPI_DATA] = value;
+-            smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages);
-+
++            smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages);
-+    /* Mark data as available */
+         }
-+    s->regs[R_PSPI_STAT] = R_PSPI_STAT_BSY_MASK | R_PSPI_STAT_RBF_MASK;
+     }
-+}
+ }
-+
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
-+/* Control register read handler. */
-+static uint64_t npcm_pspi_ctrl_read(void *opaque, hwaddr addr,
+     if (!tg) {
-+                                    unsigned int size)
+         trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
-+{
+-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
-+    NPCMPSPIState *s = opaque;
++        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1);
-+    uint16_t value;
+         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
-+
+         return;
-+    switch (addr) {
+     }
-+    case A_PSPI_DATA:
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
-+        value = npcm_pspi_read_data(s);
-+        break;
+         num_pages = (mask + 1) >> granule;
-+
+         trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-+    case A_PSPI_CTL1:
+-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
-+        value = s->regs[R_PSPI_CTL1];
++        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages);
-+        break;
+         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
-+
+         addr += mask + 1;
-+    case A_PSPI_STAT:
+     }
-+        value = s->regs[R_PSPI_STAT];
+diff --git a/hw/arm/trace-events b/hw/arm/trace-events
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: write to invalid offset 0x%" PRIx64 "\n",
 +                      DEVICE(s)->canonical_path, addr);
 +        return 0;
 +    }
 +    trace_npcm_pspi_ctrl_read(DEVICE(s)->canonical_path, addr, value);
 +    npcm_pspi_update_irq(s);
 +
 +    return value;
 +}
 +
 +/* Control register write handler. */
 +static void npcm_pspi_ctrl_write(void *opaque, hwaddr addr, uint64_t v,
 +                                 unsigned int size)
 +{
 +    NPCMPSPIState *s = opaque;
 +    uint16_t value = v;
 +
 +    trace_npcm_pspi_ctrl_write(DEVICE(s)->canonical_path, addr, value);
 +
 +    switch (addr) {
 +    case A_PSPI_DATA:
 +        npcm_pspi_write_data(s, value);
 +        break;
 +
 +    case A_PSPI_CTL1:
 +        s->regs[R_PSPI_CTL1] = value;
 +        break;
 +
 +    case A_PSPI_STAT:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: write to read-only register PSPI_STAT: 0x%08"
 +                      PRIx64 "\n", DEVICE(s)->canonical_path, v);
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "%s: write to invalid offset 0x%" PRIx64 "\n",
 +                      DEVICE(s)->canonical_path, addr);
 +        return;
 +    }
 +    npcm_pspi_update_irq(s);
 +}
 +
 +static const MemoryRegionOps npcm_pspi_ctrl_ops = {
 +    .read = npcm_pspi_ctrl_read,
 +    .write = npcm_pspi_ctrl_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .valid = {
 +        .min_access_size = 1,
 +        .max_access_size = 2,
 +        .unaligned = false,
 +    },
 +    .impl = {
 +        .min_access_size = 2,
 +        .max_access_size = 2,
 +        .unaligned = false,
 +    },
 +};
 +
 +static void npcm_pspi_enter_reset(Object *obj, ResetType type)
 +{
 +    NPCMPSPIState *s = NPCM_PSPI(obj);
 +
 +    trace_npcm_pspi_enter_reset(DEVICE(obj)->canonical_path, type);
 +    memset(s->regs, 0, sizeof(s->regs));
 +}
 +
 +static void npcm_pspi_realize(DeviceState *dev, Error **errp)
 +{
 +    NPCMPSPIState *s = NPCM_PSPI(dev);
 +    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 +    Object *obj = OBJECT(dev);
 +
 +    s->spi = ssi_create_bus(dev, "pspi");
 +    memory_region_init_io(&s->mmio, obj, &npcm_pspi_ctrl_ops, s,
 +                          "mmio", 4 * KiB);
 +    sysbus_init_mmio(sbd, &s->mmio);
 +    sysbus_init_irq(sbd, &s->irq);
 +}
 +
 +static const VMStateDescription vmstate_npcm_pspi = {
 +    .name = "npcm-pspi",
 +    .version_id = 0,
 +    .minimum_version_id = 0,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_UINT16_ARRAY(regs, NPCMPSPIState, NPCM_PSPI_NR_REGS),
 +        VMSTATE_END_OF_LIST(),
 +    },
 +};
 +
 +
 +static void npcm_pspi_class_init(ObjectClass *klass, void *data)
 +{
 +    ResettableClass *rc = RESETTABLE_CLASS(klass);
 +    DeviceClass *dc = DEVICE_CLASS(klass);
 +
 +    dc->desc = "NPCM Peripheral SPI Module";
 +    dc->realize = npcm_pspi_realize;
 +    dc->vmsd = &vmstate_npcm_pspi;
 +    rc->phases.enter = npcm_pspi_enter_reset;
 +}
 +
 +static const TypeInfo npcm_pspi_types[] = {
 +    {
 +        .name = TYPE_NPCM_PSPI,
 +        .parent = TYPE_SYS_BUS_DEVICE,
 +        .instance_size = sizeof(NPCMPSPIState),
 +        .class_init = npcm_pspi_class_init,
 +    },
 +};
 +DEFINE_TYPES(npcm_pspi_types);
 diff --git a/hw/ssi/meson.build b/hw/ssi/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/meson.build
+--- a/hw/arm/trace-events
-+++ b/hw/ssi/meson.build
++++ b/hw/arm/trace-events
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
- softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_smc.c'))
+ smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
- softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('mss-spi.c'))
+ smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
--softmmu_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx_fiu.c'))
+ smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
-+softmmu_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx_fiu.c', 'npcm_pspi.c'))
+-smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
- softmmu_ss.add(when: 'CONFIG_PL022', if_true: files('pl022.c'))
++smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint16_t vmid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d vmid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
- softmmu_ss.add(when: 'CONFIG_SIFIVE_SPI', if_true: files('sifive_spi.c'))
  softmmu_ss.add(when: 'CONFIG_SSI', if_true: files('ssi.c'))
 diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/trace-events
 +++ b/hw/ssi/trace-events
@@ -XXX,XX +XXX,XX @@ npcm7xx_fiu_ctrl_write(const char *id, uint64_t addr, uint32_t data) "%s offset:
  npcm7xx_fiu_flash_read(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
  npcm7xx_fiu_flash_write(const char *id, unsigned cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
 +# npcm_pspi.c
 +npcm_pspi_enter_reset(const char *id, int reset_type) "%s reset type: %d"
 +npcm_pspi_ctrl_read(const char *id, uint64_t addr, uint16_t data) "%s offset: 0x%03" PRIx64 " value: 0x%04" PRIx16
 +npcm_pspi_ctrl_write(const char *id, uint64_t addr, uint16_t data) "%s offset: 0x%03" PRIx64 " value: 0x%04" PRIx16
 +
  # ibex_spi_host.c
  ibex_spi_host_reset(const char *msg) "%s"
 --
 .34.1

-[PULL 15/30] arm/virt: don't try to spell out the accelerator
+[PULL 11/21] hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2
-From: Cornelia Huck <cohuck@redhat.com>
+From: Mostafa Saleh <smostafa@google.com>
-Just use current_accel_name() directly.
+As everything is in place, we can use a new system property to
 advertise which stage is supported and remove bad_ste from STE
 stage2 config.
-Signed-off-by: Cornelia Huck <cohuck@redhat.com>
+The property added arm-smmuv3.stage can have 3 values:
 - "1": Stage-1 only is advertised.
 - "2": Stage-2 only is advertised.
 If not passed or an unsupported value is passed, it will default to
 stage-1.
 Advertise VMID16.
 Don't try to decode CD, if stage-2 is configured.
 Reviewed-by: Eric Auger <eric.auger@redhat.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Mostafa Saleh <smostafa@google.com>
 Tested-by: Eric Auger <eric.auger@redhat.com>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Message-id: 20230516203327.2051088-11-smostafa@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 6 +++---
+ include/hw/arm/smmuv3.h |  1 +
-file changed, 3 insertions(+), 3 deletions(-)
+ hw/arm/smmuv3.c         | 32 ++++++++++++++++++++++----------
 files changed, 23 insertions(+), 10 deletions(-)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/include/hw/arm/smmuv3.h
-+++ b/hw/arm/virt.c
++++ b/include/hw/arm/smmuv3.h
-@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ struct SMMUv3State {
-     if (vms->secure && (kvm_enabled() || hvf_enabled())) {
-         error_report("mach-virt: %s does not support providing "
+     qemu_irq     irq[4];
-                      "Security extensions (TrustZone) to the guest CPU",
+     QemuMutex mutex;
--                     kvm_enabled() ? "KVM" : "HVF");
++    char *stage;
-+                     current_accel_name());
+ };
-         exit(1);
  typedef enum {
 diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/smmuv3.c
 +++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
  #include "hw/irq.h"
  #include "hw/sysbus.h"
  #include "migration/vmstate.h"
 +#include "hw/qdev-properties.h"
  #include "hw/qdev-core.h"
  #include "hw/pci/pci.h"
  #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
  static void smmuv3_init_regs(SMMUv3State *s)
  {
 -    /**
 -     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
 -     *       multi-level stream table
 -     */
 -    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
 +    /* Based on sys property, the stages supported in smmu will be advertised.*/
 +    if (s->stage && !strcmp("2", s->stage)) {
 +        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
 +    } else {
 +        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
 +    }
 +
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
 +    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, VMID16, 1); /* 16-bit VMID */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
      s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
      /* terminated transaction will always be aborted/error returned */
@@ -XXX,XX +XXX,XX @@ static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
          goto bad_ste;
      }
-     if (vms->virt && (kvm_enabled() || hvf_enabled())) {
+-    /* This is still here as stage 2 has not been fully enabled yet. */
-         error_report("mach-virt: %s does not support providing "
+-    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
-                      "Virtualization extensions to the guest CPU",
+-    goto bad_ste;
--                     kvm_enabled() ? "KVM" : "HVF");
+-
-+                     current_accel_name());
+     return 0;
-         exit(1);
  bad_ste:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
          return ret;
      }
-     if (vms->mte && (kvm_enabled() || hvf_enabled())) {
+-    if (cfg->aborted || cfg->bypassed) {
-         error_report("mach-virt: %s does not support providing "
++    if (cfg->aborted || cfg->bypassed || (cfg->stage == 2)) {
-                      "MTE to the guest CPU",
+         return 0;
 -                     kvm_enabled() ? "KVM" : "HVF");
 +                     current_accel_name());
          exit(1);
      }
+@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3 = {
+     }
+ };
++static Property smmuv3_properties[] = {
++    /*
++     * Stages of translation advertised.
++     * "1": Stage 1
++     * "2": Stage 2
++     * Defaults to stage 1
++     */
++    DEFINE_PROP_STRING("stage", SMMUv3State, stage),
++    DEFINE_PROP_END_OF_LIST()
++};
++
+ static void smmuv3_instance_init(Object *obj)
+ {
+     /* Nothing much to do here as of now */
+@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
+                                        &c->parent_phases);
+     c->parent_realize = dc->realize;
+     dc->realize = smmu_realize;
++    device_class_set_props(dc, smmuv3_properties);
+ }
+ static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
 --
 .34.1

-[PULL 02/30] target/arm: Simplify arm_v7m_mmu_idx_for_secstate() for user emulation
+[PULL 12/21] hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
+From: Tommy Wu <tommy.wu@sifive.com>
-Suggested-by: Richard Henderson <richard.henderson@linaro.org>
+When we receive a packet from the xilinx_axienet and then try to s2mem
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+through the xilinx_axidma, if the descriptor ring buffer is full in the
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+xilinx axidma driver, we’ll assert the DMASR.HALTED in the
-Message-id: 20230206223502.25122-3-philmd@linaro.org
+function : stream_process_s2mem and return 0. In the end, we’ll be stuck in
 an infinite loop in axienet_eth_rx_notify.
 This patch checks the DMASR.HALTED state when we try to push data
 from xilinx axi-enet to xilinx axi-dma. When the DMASR.HALTED is asserted,
 we will not keep pushing the data and then prevent the infinte loop.
 Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
 Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
 Reviewed-by: Frank Chang <frank.chang@sifive.com>
 Message-id: 20230519062137.1251741-1-tommy.wu@sifive.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/m_helper.c | 11 ++++++++---
+ hw/dma/xilinx_axidma.c | 11 ++++++++---
 file changed, 8 insertions(+), 3 deletions(-)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/hw/dma/xilinx_axidma.c
-+++ b/target/arm/m_helper.c
++++ b/hw/dma/xilinx_axidma.c
-@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
+@@ -XXX,XX +XXX,XX @@ static inline int stream_idle(struct Stream *s)
-     return 0;
+     return !!(s->regs[R_DMASR] & DMASR_IDLE);
  }
--#else
++static inline int stream_halted(struct Stream *s)
 +ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
 +{
-+    return ARMMMUIdx_MUser;
++    return !!(s->regs[R_DMASR] & DMASR_HALTED);
 +}
 +
-+#else /* !CONFIG_USER_ONLY */
+ static void stream_reset(struct Stream *s)
  /*
   * What kind of stack write are we doing? This affects how exceptions
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
      return tt_resp;
  }
 -#endif /* !CONFIG_USER_ONLY */
 -
  ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
                                bool secstate, bool priv, bool negpri)
  {
-@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
+     s->regs[R_DMASR] = DMASR_HALTED;  /* starts up halted.  */
+@@ -XXX,XX +XXX,XX @@ static void stream_process_mem2s(struct Stream *s, StreamSink *tx_data_dev,
-     return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
+     uint64_t addr;
- }
+     bool eop;
-+
-+#endif /* !CONFIG_USER_ONLY */
+-    if (!stream_running(s) || stream_idle(s)) {
 +    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
          return;
      }
@@ -XXX,XX +XXX,XX @@ static size_t stream_process_s2mem(struct Stream *s, unsigned char *buf,
      unsigned int rxlen;
      size_t pos = 0;
 -    if (!stream_running(s) || stream_idle(s)) {
 +    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
          return 0;
      }
@@ -XXX,XX +XXX,XX @@ xilinx_axidma_data_stream_can_push(StreamSink *obj,
      XilinxAXIDMAStreamSink *ds = XILINX_AXI_DMA_DATA_STREAM(obj);
      struct Stream *s = &ds->dma->streams[1];
 -    if (!stream_running(s) || stream_idle(s)) {
 +    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
          ds->dma->notify = notify;
          ds->dma->notify_opaque = notify_opaque;
          return false;
 --
 .34.1

-[PULL 04/30] target/arm: Constify ID_PFR1 on user emulation
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20230206223502.25122-5-philmd@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 12 ++++++++++--
-file changed, 10 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
-     }
- }
-+#ifndef CONFIG_USER_ONLY
- /*
-  * We don't know until after realize whether there's a GICv3
-  * attached, and that is what registers the gicv3 sysregs.
-@@ -XXX,XX +XXX,XX @@ static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
-     return pfr1;
- }
--#ifndef CONFIG_USER_ONLY
- static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri)
- {
-     ARMCPU *cpu = env_archcpu(env);
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
-               .access = PL1_R, .type = ARM_CP_NO_RAW,
-               .accessfn = access_aa32_tid3,
-+#ifdef CONFIG_USER_ONLY
-+              .type = ARM_CP_CONST,
-+              .resetvalue = cpu->isar.id_pfr1,
-+#else
-+              .type = ARM_CP_NO_RAW,
-+              .accessfn = access_aa32_tid3,
-               .readfn = id_pfr1_read,
--              .writefn = arm_cp_write_ignore },
-+              .writefn = arm_cp_write_ignore
-+#endif
-+            },
-             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
-               .access = PL1_R, .type = ARM_CP_CONST,
---
-.34.1

-[PULL 05/30] target/arm: Convert CPUARMState::eabi to boolean
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Suggested-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230206223502.25122-6-philmd@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- linux-user/user-internals.h | 2 +-
- target/arm/cpu.h            | 2 +-
- linux-user/arm/cpu_loop.c   | 4 ++--
-files changed, 4 insertions(+), 4 deletions(-)
-diff --git a/linux-user/user-internals.h b/linux-user/user-internals.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/user-internals.h
-+++ b/linux-user/user-internals.h
-@@ -XXX,XX +XXX,XX @@ void print_termios(void *arg);
- #ifdef TARGET_ARM
- static inline int regpairs_aligned(CPUArchState *cpu_env, int num)
- {
--    return cpu_env->eabi == 1;
-+    return cpu_env->eabi;
- }
- #elif defined(TARGET_MIPS) && defined(TARGET_ABI_MIPSO32)
- static inline int regpairs_aligned(CPUArchState *cpu_env, int num) { return 1; }
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
- #if defined(CONFIG_USER_ONLY)
-     /* For usermode syscall translation.  */
--    int eabi;
-+    bool eabi;
- #endif
-     struct CPUBreakpoint *cpu_breakpoint[16];
-diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/arm/cpu_loop.c
-+++ b/linux-user/arm/cpu_loop.c
-@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
-             break;
-         case EXCP_SWI:
-             {
--                env->eabi = 1;
-+                env->eabi = true;
-                 /* system call */
-                 if (env->thumb) {
-                     /* Thumb is always EABI style with syscall number in r7 */
-@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
-                          * > 0xfffff and are handled below as out-of-range.
-                          */
-                         n ^= ARM_SYSCALL_BASE;
--                        env->eabi = 0;
-+                        env->eabi = false;
-                     }
-                 }
---
-.34.1

-[PULL 06/30] target/arm: Avoid resetting CPUARMState::eabi field
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Although the 'eabi' field is only used in user emulation where
-CPU reset doesn't occur, it doesn't belong to the area to reset.
-Move it after the 'end_reset_fields' for consistency.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20230206223502.25122-7-philmd@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h | 9 ++++-----
-file changed, 4 insertions(+), 5 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-     ARMVectorReg zarray[ARM_MAX_VQ * 16];
- #endif
--#if defined(CONFIG_USER_ONLY)
--    /* For usermode syscall translation.  */
--    bool eabi;
--#endif
--
-     struct CPUBreakpoint *cpu_breakpoint[16];
-     struct CPUWatchpoint *cpu_watchpoint[16];
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-     const struct arm_boot_info *boot_info;
-     /* Store GICv3CPUState to access from this struct */
-     void *gicv3state;
-+#if defined(CONFIG_USER_ONLY)
-+    /* For usermode syscall translation.  */
-+    bool eabi;
-+#endif /* CONFIG_USER_ONLY */
- #ifdef TARGET_TAGGED_ADDRESSES
-     /* Linux syscall tagged address support */
---
-.34.1

-[PULL 07/30] target/arm: Restrict CPUARMState::gicv3state to sysemu
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Message-id: 20230206223502.25122-8-philmd@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-     void *nvic;
-     const struct arm_boot_info *boot_info;
-+#if !defined(CONFIG_USER_ONLY)
-     /* Store GICv3CPUState to access from this struct */
-     void *gicv3state;
--#if defined(CONFIG_USER_ONLY)
-+#else /* CONFIG_USER_ONLY */
-     /* For usermode syscall translation.  */
-     bool eabi;
- #endif /* CONFIG_USER_ONLY */
---
-.34.1

-[PULL 08/30] target/arm: Restrict CPUARMState::arm_boot_info to sysemu
+[PULL 13/21] hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
+From: Clément Chigot <chigot@adacore.com>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+When passing --smp with a number lower than XLNX_ZYNQMP_NUM_APU_CPUS,
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+the expression (ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS) will result
-Message-id: 20230206223502.25122-9-philmd@linaro.org
+in a positive number as ms->smp.cpus is a unsigned int.
 This will raise the following error afterwards, as Qemu will try to
 instantiate some additional RPUs.
   | $ qemu-system-aarch64 --smp 1 -M xlnx-zcu102
   | **
   | ERROR:../src/tcg/tcg.c:777:tcg_register_thread:
   |   assertion failed: (n < tcg_max_ctxs)
 Signed-off-by: Clément Chigot <chigot@adacore.com>
 Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Message-id: 20230524143714.565792-1-chigot@adacore.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/cpu.h | 2 +-
+ hw/arm/xlnx-zynqmp.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
+--- a/hw/arm/xlnx-zynqmp.c
-+++ b/target/arm/cpu.h
++++ b/hw/arm/xlnx-zynqmp.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(MachineState *ms, XlnxZynqMPState *s,
-     } sau;
+                                    const char *boot_cpu, Error **errp)
+ {
-     void *nvic;
+     int i;
--    const struct arm_boot_info *boot_info;
+-    int num_rpus = MIN(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS,
- #if !defined(CONFIG_USER_ONLY)
++    int num_rpus = MIN((int)(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS),
-+    const struct arm_boot_info *boot_info;
+                        XLNX_ZYNQMP_NUM_RPU_CPUS);
-     /* Store GICv3CPUState to access from this struct */
-     void *gicv3state;
+     if (num_rpus <= 0) {
  #else /* CONFIG_USER_ONLY */
 --
 .34.1

-[PULL 09/30] target/arm: Restrict CPUARMState::nvic to sysemu
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230206223502.25122-10-philmd@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-         uint32_t ctrl;
-     } sau;
--    void *nvic;
- #if !defined(CONFIG_USER_ONLY)
-+    void *nvic;
-     const struct arm_boot_info *boot_info;
-     /* Store GICv3CPUState to access from this struct */
-     void *gicv3state;
---
-.34.1

-[PULL 10/30] target/arm: Store CPUARMState::nvic as NVICState*
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
-There is no point in using a void pointer to access the NVIC.
-Use the real type to avoid casting it while debugging.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230206223502.25122-11-philmd@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/cpu.h      | 46 ++++++++++++++++++++++---------------------
- hw/intc/armv7m_nvic.c | 38 ++++++++++++-----------------------
- target/arm/cpu.c      |  1 +
- target/arm/m_helper.c |  2 +-
-files changed, 39 insertions(+), 48 deletions(-)
-diff --git a/target/arm/cpu.h b/target/arm/cpu.h
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.h
-+++ b/target/arm/cpu.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMTBFlags {
- typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
-+typedef struct NVICState NVICState;
-+
- typedef struct CPUArchState {
-     /* Regs for current mode.  */
-     uint32_t regs[16];
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
-     } sau;
- #if !defined(CONFIG_USER_ONLY)
--    void *nvic;
-+    NVICState *nvic;
-     const struct arm_boot_info *boot_info;
-     /* Store GICv3CPUState to access from this struct */
-     void *gicv3state;
-@@ -XXX,XX +XXX,XX @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
- /* Interface between CPU and Interrupt controller.  */
- #ifndef CONFIG_USER_ONLY
--bool armv7m_nvic_can_take_pending_exception(void *opaque);
-+bool armv7m_nvic_can_take_pending_exception(NVICState *s);
- #else
--static inline bool armv7m_nvic_can_take_pending_exception(void *opaque)
-+static inline bool armv7m_nvic_can_take_pending_exception(NVICState *s)
- {
-     return true;
- }
- #endif
- /**
-  * armv7m_nvic_set_pending: mark the specified exception as pending
-- * @opaque: the NVIC
-+ * @s: the NVIC
-  * @irq: the exception number to mark pending
-  * @secure: false for non-banked exceptions or for the nonsecure
-  * version of a banked exception, true for the secure version of a banked
-@@ -XXX,XX +XXX,XX @@ static inline bool armv7m_nvic_can_take_pending_exception(void *opaque)
-  * if @secure is true and @irq does not specify one of the fixed set
-  * of architecturally banked exceptions.
-  */
--void armv7m_nvic_set_pending(void *opaque, int irq, bool secure);
-+void armv7m_nvic_set_pending(NVICState *s, int irq, bool secure);
- /**
-  * armv7m_nvic_set_pending_derived: mark this derived exception as pending
-- * @opaque: the NVIC
-+ * @s: the NVIC
-  * @irq: the exception number to mark pending
-  * @secure: false for non-banked exceptions or for the nonsecure
-  * version of a banked exception, true for the secure version of a banked
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq, bool secure);
-  * exceptions (exceptions generated in the course of trying to take
-  * a different exception).
-  */
--void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure);
-+void armv7m_nvic_set_pending_derived(NVICState *s, int irq, bool secure);
- /**
-  * armv7m_nvic_set_pending_lazyfp: mark this lazy FP exception as pending
-- * @opaque: the NVIC
-+ * @s: the NVIC
-  * @irq: the exception number to mark pending
-  * @secure: false for non-banked exceptions or for the nonsecure
-  * version of a banked exception, true for the secure version of a banked
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure);
-  * Similar to armv7m_nvic_set_pending(), but specifically for exceptions
-  * generated in the course of lazy stacking of FP registers.
-  */
--void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure);
-+void armv7m_nvic_set_pending_lazyfp(NVICState *s, int irq, bool secure);
- /**
-  * armv7m_nvic_get_pending_irq_info: return highest priority pending
-  *    exception, and whether it targets Secure state
-- * @opaque: the NVIC
-+ * @s: the NVIC
-  * @pirq: set to pending exception number
-  * @ptargets_secure: set to whether pending exception targets Secure
-  *
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure);
-  * to true if the current highest priority pending exception should
-  * be taken to Secure state, false for NS.
-  */
--void armv7m_nvic_get_pending_irq_info(void *opaque, int *pirq,
-+void armv7m_nvic_get_pending_irq_info(NVICState *s, int *pirq,
-                                       bool *ptargets_secure);
- /**
-  * armv7m_nvic_acknowledge_irq: make highest priority pending exception active
-- * @opaque: the NVIC
-+ * @s: the NVIC
-  *
-  * Move the current highest priority pending exception from the pending
-  * state to the active state, and update v7m.exception to indicate that
-  * it is the exception currently being handled.
-  */
--void armv7m_nvic_acknowledge_irq(void *opaque);
-+void armv7m_nvic_acknowledge_irq(NVICState *s);
- /**
-  * armv7m_nvic_complete_irq: complete specified interrupt or exception
-- * @opaque: the NVIC
-+ * @s: the NVIC
-  * @irq: the exception number to complete
-  * @secure: true if this exception was secure
-  *
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque);
-  *           0 if there is still an irq active after this one was completed
-  * (Ignoring -1, this is the same as the RETTOBASE value before completion.)
-  */
--int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure);
-+int armv7m_nvic_complete_irq(NVICState *s, int irq, bool secure);
- /**
-  * armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
-- * @opaque: the NVIC
-+ * @s: the NVIC
-  * @irq: the exception number to mark pending
-  * @secure: false for non-banked exceptions or for the nonsecure
-  * version of a banked exception, true for the secure version of a banked
-@@ -XXX,XX +XXX,XX @@ int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure);
-  * interrupt the current execution priority. This controls whether the
-  * RDY bit for it in the FPCCR is set.
-  */
--bool armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure);
-+bool armv7m_nvic_get_ready_status(NVICState *s, int irq, bool secure);
- /**
-  * armv7m_nvic_raw_execution_priority: return the raw execution priority
-- * @opaque: the NVIC
-+ * @s: the NVIC
-  *
-  * Returns: the raw execution priority as defined by the v8M architecture.
-  * This is the execution priority minus the effects of AIRCR.PRIS,
-  * and minus any PRIMASK/FAULTMASK/BASEPRI priority boosting.
-  * (v8M ARM ARM I_PKLD.)
-  */
--int armv7m_nvic_raw_execution_priority(void *opaque);
-+int armv7m_nvic_raw_execution_priority(NVICState *s);
- /**
-  * armv7m_nvic_neg_prio_requested: return true if the requested execution
-  * priority is negative for the specified security state.
-- * @opaque: the NVIC
-+ * @s: the NVIC
-  * @secure: the security state to test
-  * This corresponds to the pseudocode IsReqExecPriNeg().
-  */
- #ifndef CONFIG_USER_ONLY
--bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure);
-+bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure);
- #else
--static inline bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
-+static inline bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure)
- {
-     return false;
- }
-diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/intc/armv7m_nvic.c
-+++ b/hw/intc/armv7m_nvic.c
-@@ -XXX,XX +XXX,XX @@ static inline int nvic_exec_prio(NVICState *s)
-     return MIN(running, s->exception_prio);
- }
--bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
-+bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure)
- {
-     /* Return true if the requested execution priority is negative
-      * for the specified security state, ie that security state
-@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
-      * mean we don't allow FAULTMASK_NS to actually make the execution
-      * priority negative). Compare pseudocode IsReqExcPriNeg().
-      */
--    NVICState *s = opaque;
--
-     if (s->cpu->env.v7m.faultmask[secure]) {
-         return true;
-     }
-@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
-     return false;
- }
--bool armv7m_nvic_can_take_pending_exception(void *opaque)
-+bool armv7m_nvic_can_take_pending_exception(NVICState *s)
- {
--    NVICState *s = opaque;
--
-     return nvic_exec_prio(s) > nvic_pending_prio(s);
- }
--int armv7m_nvic_raw_execution_priority(void *opaque)
-+int armv7m_nvic_raw_execution_priority(NVICState *s)
- {
--    NVICState *s = opaque;
--
-     return s->exception_prio;
- }
-@@ -XXX,XX +XXX,XX @@ static void nvic_irq_update(NVICState *s)
-  * if @secure is true and @irq does not specify one of the fixed set
-  * of architecturally banked exceptions.
-  */
--static void armv7m_nvic_clear_pending(void *opaque, int irq, bool secure)
-+static void armv7m_nvic_clear_pending(NVICState *s, int irq, bool secure)
- {
--    NVICState *s = (NVICState *)opaque;
-     VecInfo *vec;
-     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
-@@ -XXX,XX +XXX,XX @@ static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,
-     }
- }
--void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)
-+void armv7m_nvic_set_pending(NVICState *s, int irq, bool secure)
- {
--    do_armv7m_nvic_set_pending(opaque, irq, secure, false);
-+    do_armv7m_nvic_set_pending(s, irq, secure, false);
- }
--void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure)
-+void armv7m_nvic_set_pending_derived(NVICState *s, int irq, bool secure)
- {
--    do_armv7m_nvic_set_pending(opaque, irq, secure, true);
-+    do_armv7m_nvic_set_pending(s, irq, secure, true);
- }
--void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure)
-+void armv7m_nvic_set_pending_lazyfp(NVICState *s, int irq, bool secure)
- {
-     /*
-      * Pend an exception during lazy FP stacking. This differs
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure)
-      * whether we should escalate depends on the saved context
-      * in the FPCCR register, not on the current state of the CPU/NVIC.
-      */
--    NVICState *s = (NVICState *)opaque;
-     bool banked = exc_is_banked(irq);
-     VecInfo *vec;
-     bool targets_secure;
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure)
- }
- /* Make pending IRQ active.  */
--void armv7m_nvic_acknowledge_irq(void *opaque)
-+void armv7m_nvic_acknowledge_irq(NVICState *s)
- {
--    NVICState *s = (NVICState *)opaque;
-     CPUARMState *env = &s->cpu->env;
-     const int pending = s->vectpending;
-     const int running = nvic_exec_prio(s);
-@@ -XXX,XX +XXX,XX @@ static bool vectpending_targets_secure(NVICState *s)
-         exc_targets_secure(s, s->vectpending);
- }
--void armv7m_nvic_get_pending_irq_info(void *opaque,
-+void armv7m_nvic_get_pending_irq_info(NVICState *s,
-                                       int *pirq, bool *ptargets_secure)
- {
--    NVICState *s = (NVICState *)opaque;
-     const int pending = s->vectpending;
-     bool targets_secure;
-@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
-     *pirq = pending;
- }
--int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
-+int armv7m_nvic_complete_irq(NVICState *s, int irq, bool secure)
- {
--    NVICState *s = (NVICState *)opaque;
-     VecInfo *vec = NULL;
-     int ret = 0;
-@@ -XXX,XX +XXX,XX @@ int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
-     return ret;
- }
--bool armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
-+bool armv7m_nvic_get_ready_status(NVICState *s, int irq, bool secure)
- {
-     /*
-      * Return whether an exception is "ready", i.e. it is enabled and is
-@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
-      * for non-banked exceptions secure is always false; for banked exceptions
-      * it indicates which of the exceptions is required.
-      */
--    NVICState *s = (NVICState *)opaque;
-     bool banked = exc_is_banked(irq);
-     VecInfo *vec;
-     int running = nvic_exec_prio(s);
-diff --git a/target/arm/cpu.c b/target/arm/cpu.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/cpu.c
-+++ b/target/arm/cpu.c
-@@ -XXX,XX +XXX,XX @@
- #if !defined(CONFIG_USER_ONLY)
- #include "hw/loader.h"
- #include "hw/boards.h"
-+#include "hw/intc/armv7m_nvic.h"
- #endif
- #include "sysemu/tcg.h"
- #include "sysemu/qtest.h"
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
-+++ b/target/arm/m_helper.c
-@@ -XXX,XX +XXX,XX @@ static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr,
-      * that we will need later in order to do lazy FP reg stacking.
-      */
-     bool is_secure = env->v7m.secure;
--    void *nvic = env->nvic;
-+    NVICState *nvic = env->nvic;
-     /*
-      * Some bits are unbanked and live always in fpccr[M_REG_S]; some bits
-      * are banked and we want to update the bit in the bank for the
---
-.34.1

-[PULL 12/30] tests/avocado: retire the Aarch64 TCG tests from boot_linux.py
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-The two TCG tests for GICv2 and GICv3 are very heavy weight distros
-that take a long time to boot up, especially for an --enable-debug
-build. The total code coverage they give is:
-  Overall coverage rate:
-    lines......: 11.2% (59584 of 530123 lines)
-    functions..: 15.0% (7436 of 49443 functions)
-    branches...: 6.3% (19273 of 303933 branches)
-We already get pretty close to that with the machine_aarch64_virt
-tests which only does one full boot (~120s vs ~600s) of alpine. We
-expand the kernel+initrd boot (~8s) to test both GICs and also add an
-RNG device and a block device to generate a few IRQs and exercise the
-storage layer. With that we get to a coverage of:
-  Overall coverage rate:
-    lines......: 11.0% (58121 of 530123 lines)
-    functions..: 14.9% (7343 of 49443 functions)
-    branches...: 6.0% (18269 of 303933 branches)
-which I feel is close enough given the massive time saving. If we want
-to target any more sub-systems we can use lighter weight more directed
-tests.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Acked-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230203181632.2919715-1-alex.bennee@linaro.org
-Cc: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/avocado/boot_linux.py           | 48 ++++----------------
- tests/avocado/machine_aarch64_virt.py | 63 ++++++++++++++++++++++++---
-files changed, 65 insertions(+), 46 deletions(-)
-diff --git a/tests/avocado/boot_linux.py b/tests/avocado/boot_linux.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/avocado/boot_linux.py
-+++ b/tests/avocado/boot_linux.py
-@@ -XXX,XX +XXX,XX @@ def test_pc_q35_kvm(self):
-         self.launch_and_wait(set_up_ssh_connection=False)
--# For Aarch64 we only boot KVM tests in CI as the TCG tests are very
--# heavyweight. There are lighter weight distros which we use in the
--# machine_aarch64_virt.py tests.
-+# For Aarch64 we only boot KVM tests in CI as booting the current
-+# Fedora OS in TCG tests is very heavyweight. There are lighter weight
-+# distros which we use in the machine_aarch64_virt.py tests.
- class BootLinuxAarch64(LinuxTest):
-     """
-     :avocado: tags=arch:aarch64
-     :avocado: tags=machine:virt
--    :avocado: tags=machine:gic-version=2
-     """
-     timeout = 720
--    def add_common_args(self):
--        self.vm.add_args('-bios',
--                         os.path.join(BUILD_DIR, 'pc-bios',
--                                      'edk2-aarch64-code.fd'))
--        self.vm.add_args('-device', 'virtio-rng-pci,rng=rng0')
--        self.vm.add_args('-object', 'rng-random,id=rng0,filename=/dev/urandom')
--
--    @skipIf(os.getenv('GITLAB_CI'), 'Running on GitLab')
--    def test_fedora_cloud_tcg_gicv2(self):
--        """
--        :avocado: tags=accel:tcg
--        :avocado: tags=cpu:max
--        :avocado: tags=device:gicv2
--        """
--        self.require_accelerator("tcg")
--        self.vm.add_args("-accel", "tcg")
--        self.vm.add_args("-cpu", "max,lpa2=off")
--        self.vm.add_args("-machine", "virt,gic-version=2")
--        self.add_common_args()
--        self.launch_and_wait(set_up_ssh_connection=False)
--
--    @skipIf(os.getenv('GITLAB_CI'), 'Running on GitLab')
--    def test_fedora_cloud_tcg_gicv3(self):
--        """
--        :avocado: tags=accel:tcg
--        :avocado: tags=cpu:max
--        :avocado: tags=device:gicv3
--        """
--        self.require_accelerator("tcg")
--        self.vm.add_args("-accel", "tcg")
--        self.vm.add_args("-cpu", "max,lpa2=off")
--        self.vm.add_args("-machine", "virt,gic-version=3")
--        self.add_common_args()
--        self.launch_and_wait(set_up_ssh_connection=False)
--
-     def test_virt_kvm(self):
-         """
-         :avocado: tags=accel:kvm
-@@ -XXX,XX +XXX,XX @@ def test_virt_kvm(self):
-         self.require_accelerator("kvm")
-         self.vm.add_args("-accel", "kvm")
-         self.vm.add_args("-machine", "virt,gic-version=host")
--        self.add_common_args()
-+        self.vm.add_args('-bios',
-+                         os.path.join(BUILD_DIR, 'pc-bios',
-+                                      'edk2-aarch64-code.fd'))
-+        self.vm.add_args('-device', 'virtio-rng-pci,rng=rng0')
-+        self.vm.add_args('-object', 'rng-random,id=rng0,filename=/dev/urandom')
-         self.launch_and_wait(set_up_ssh_connection=False)
-diff --git a/tests/avocado/machine_aarch64_virt.py b/tests/avocado/machine_aarch64_virt.py
-index XXXXXXX..XXXXXXX 100644
---- a/tests/avocado/machine_aarch64_virt.py
-+++ b/tests/avocado/machine_aarch64_virt.py
-@@ -XXX,XX +XXX,XX @@
- import time
- import os
-+import logging
- from avocado_qemu import QemuSystemTest
- from avocado_qemu import wait_for_console_pattern
- from avocado_qemu import exec_command
- from avocado_qemu import BUILD_DIR
-+from avocado.utils import process
-+from avocado.utils.path import find_command
- class Aarch64VirtMachine(QemuSystemTest):
-     KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
-@@ -XXX,XX +XXX,XX @@ def test_alpine_virt_tcg_gic_max(self):
-         self.wait_for_console_pattern('Welcome to Alpine Linux 3.16')
--    def test_aarch64_virt(self):
-+    def common_aarch64_virt(self, machine):
-         """
--        :avocado: tags=arch:aarch64
--        :avocado: tags=machine:virt
--        :avocado: tags=accel:tcg
--        :avocado: tags=cpu:max
-+        Common code to launch basic virt machine with kernel+initrd
-+        and a scratch disk.
-         """
-+        logger = logging.getLogger('aarch64_virt')
-+
-         kernel_url = ('https://fileserver.linaro.org/s/'
-                       'z6B2ARM7DQT3HWN/download')
--
-         kernel_hash = 'ed11daab50c151dde0e1e9c9cb8b2d9bd3215347'
-         kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
-@@ -XXX,XX +XXX,XX @@ def test_aarch64_virt(self):
-                                'console=ttyAMA0')
-         self.require_accelerator("tcg")
-         self.vm.add_args('-cpu', 'max,pauth-impdef=on',
-+                         '-machine', machine,
-                          '-accel', 'tcg',
-                          '-kernel', kernel_path,
-                          '-append', kernel_command_line)
-+
-+        # A RNG offers an easy way to generate a few IRQs
-+        self.vm.add_args('-device', 'virtio-rng-pci,rng=rng0')
-+        self.vm.add_args('-object',
-+                         'rng-random,id=rng0,filename=/dev/urandom')
-+
-+        # Also add a scratch block device
-+        logger.info('creating scratch qcow2 image')
-+        image_path = os.path.join(self.workdir, 'scratch.qcow2')
-+        qemu_img = os.path.join(BUILD_DIR, 'qemu-img')
-+        if not os.path.exists(qemu_img):
-+            qemu_img = find_command('qemu-img', False)
-+        if qemu_img is False:
-+            self.cancel('Could not find "qemu-img", which is required to '
-+                        'create the temporary qcow2 image')
-+        cmd = '%s create -f qcow2 %s 8M' % (qemu_img, image_path)
-+        process.run(cmd)
-+
-+        # Add the device
-+        self.vm.add_args('-blockdev',
-+                         f"driver=qcow2,file.driver=file,file.filename={image_path},node-name=scratch")
-+        self.vm.add_args('-device',
-+                         'virtio-blk-device,drive=scratch')
-+
-         self.vm.launch()
-         self.wait_for_console_pattern('Welcome to Buildroot')
-         time.sleep(0.1)
-         exec_command(self, 'root')
-         time.sleep(0.1)
-+        exec_command(self, 'dd if=/dev/hwrng of=/dev/vda bs=512 count=4')
-+        time.sleep(0.1)
-+        exec_command(self, 'md5sum /dev/vda')
-+        time.sleep(0.1)
-+        exec_command(self, 'cat /proc/interrupts')
-+        time.sleep(0.1)
-         exec_command(self, 'cat /proc/self/maps')
-         time.sleep(0.1)
-+
-+    def test_aarch64_virt_gicv3(self):
-+        """
-+        :avocado: tags=arch:aarch64
-+        :avocado: tags=machine:virt
-+        :avocado: tags=accel:tcg
-+        :avocado: tags=cpu:max
-+        """
-+        self.common_aarch64_virt("virt,gic_version=3")
-+
-+    def test_aarch64_virt_gicv2(self):
-+        """
-+        :avocado: tags=arch:aarch64
-+        :avocado: tags=machine:virt
-+        :avocado: tags=accel:tcg
-+        :avocado: tags=cpu:max
-+        """
-+        self.common_aarch64_virt("virt,gic-version=2")
---
-.34.1

-[PULL 30/30] tests/qtest: Restrict tpm-tis-devices-{swtpm}-test to CONFIG_TCG
+[PULL 14/21] tests/qtest: Run arm-specific tests only if the required machine is available
-From: Fabiano Rosas <farosas@suse.de>
+From: Thomas Huth <thuth@redhat.com>
-These tests set -accel tcg, so restrict them to when TCG is present.
+pflash-cfi02-test.c always uses the "musicpal" machine for testing,
 test-arm-mptimer.c always uses the "vexpress-a9" machine, and
 microbit-test.c requires the "microbit" machine, so we should only
 run these tests if the machines have been enabled in the configuration.
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Signed-off-by: Thomas Huth <thuth@redhat.com>
-Acked-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20230524080600.1618137-1-thuth@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/meson.build | 4 ++--
+ tests/qtest/meson.build | 7 ++++---
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 4 insertions(+), 3 deletions(-)
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
 @@ -XXX,XX +XXX,XX @@ qtests_arm = \
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
+-  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
++  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') and
++   config_all_devices.has_key('CONFIG_MUSICPAL') ? ['pflash-cfi02-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed : []) + \
+   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
+   (config_all_devices.has_key('CONFIG_GENERIC_LOADER') ? ['hexloader-test'] : []) + \
+   (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \
++  (config_all_devices.has_key('CONFIG_VEXPRESS') ? ['test-arm-mptimer'] : []) + \
++  (config_all_devices.has_key('CONFIG_MICROBIT') ? ['microbit-test'] : []) + \
+   ['arm-cpu-features',
+-   'microbit-test',
+-   'test-arm-mptimer',
+    'boot-serial-test']
  # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional
- qtests_aarch64 = \
-   (cpu != 'arm' and unpack_edk2_blobs ? ['bios-tables-test'] : []) +                            \
--  (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-test'] : []) +        \
--  (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-swtpm-test'] : []) +  \
-+  (config_all.has_key('CONFIG_TCG') and config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ?            \
-+    ['tpm-tis-device-test', 'tpm-tis-device-swtpm-test'] : []) +                                         \
-   (config_all_devices.has_key('CONFIG_XLNX_ZYNQMP_ARM') ? ['xlnx-can-test', 'fuzz-xlnx-dp-test'] : []) + \
-   (config_all_devices.has_key('CONFIG_RASPI') ? ['bcm2835-dma-test'] : []) +  \
-   ['arm-cpu-features',
 --
 .34.1

-[PULL 29/30] tests/qtest: arm-cpu-features: Match tests to required accelerators
+[PULL 15/21] target/arm: Explicitly select short-format FSR for M-profile
-From: Fabiano Rosas <farosas@suse.de>
+For M-profile, there is no guest-facing A-profile format FSR, but we
 still use the env->exception.fsr field to pass fault information from
 the point where a fault is raised to the code in
 arm_v7m_cpu_do_interrupt() which interprets it and sets the M-profile
 specific fault status registers.  So it doesn't matter whether we
 fill in env->exception.fsr in the short format or the LPAE format, as
 long as both sides agree.  As it happens arm_v7m_cpu_do_interrupt()
 assumes short-form.
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
+In compute_fsr_fsc() we weren't explicitly choosing short-form for
 M-profile, but instead relied on it falling out in the wash because
 arm_s1_regime_using_lpae_format() would be false.  This was broken in
 commit 452c67a4 when we added v8R support, because we said "PMSAv8 is
 always LPAE format" (as it is for v8R), forgetting that we were
 implicitly using this code path on M-profile. At that point we would
 hit a g_assert_not_reached():
  ERROR:../../target/arm/internals.h:549:arm_fi_to_lfsc: code should not be reached
 #7  0x0000555555e055f7 in arm_fi_to_lfsc (fi=0x7fffecff9a90) at ../../target/arm/internals.h:549
 #8  0x0000555555e05a27 in compute_fsr_fsc (env=0x555557356670, fi=0x7fffecff9a90, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff9a1c)
     at ../../target/arm/tlb_helper.c:95
 #9  0x0000555555e05b62 in arm_deliver_fault (cpu=0x555557354800, addr=268961344, access_type=MMU_INST_FETCH, mmu_idx=1, fi=0x7fffecff9a90)
     at ../../target/arm/tlb_helper.c:132
 #10 0x0000555555e06095 in arm_cpu_tlb_fill (cs=0x555557354800, address=268961344, size=1, access_type=MMU_INST_FETCH, mmu_idx=1, probe=false, retaddr=0)
     at ../../target/arm/tlb_helper.c:260
 The specific assertion changed when commit fcc7404eff24b4c added
 "assert not M-profile" to arm_is_secure_below_el3(), because the
 conditions being checked in compute_fsr_fsc() include
 arm_el_is_aa64(), which will end up calling arm_is_secure_below_el3()
 and asserting before we try to call arm_fi_to_lfsc():
 #7  0x0000555555efaf43 in arm_is_secure_below_el3 (env=0x5555574665a0) at ../../target/arm/cpu.h:2396
 #8  0x0000555555efb103 in arm_is_el2_enabled (env=0x5555574665a0) at ../../target/arm/cpu.h:2448
 #9  0x0000555555efb204 in arm_el_is_aa64 (env=0x5555574665a0, el=1) at ../../target/arm/cpu.h:2509
 #10 0x0000555555efbdfd in compute_fsr_fsc (env=0x5555574665a0, fi=0x7fffecff99e0, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff996c)
 Avoid the assertion and the incorrect FSR format selection by
 explicitly making M-profile use the short-format in this function.
 Fixes: 452c67a42704 ("target/arm: Enable TTBCR_EAE for ARMv8-R AArch32")a
 Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1658
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Acked-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20230523131726.866635-1-peter.maydell@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/qtest/arm-cpu-features.c | 28 ++++++++++++++++++----------
+ target/arm/tcg/tlb_helper.c | 13 +++++++++++--
-file changed, 18 insertions(+), 10 deletions(-)
+file changed, 11 insertions(+), 2 deletions(-)
-diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
+diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/arm-cpu-features.c
+--- a/target/arm/tcg/tlb_helper.c
-+++ b/tests/qtest/arm-cpu-features.c
++++ b/target/arm/tcg/tlb_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
- #define SVE_MAX_VQ 16
+     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
+     uint32_t fsr, fsc;
- #define MACHINE     "-machine virt,gic-version=max -accel tcg "
--#define MACHINE_KVM "-machine virt,gic-version=max -accel kvm -accel tcg "
+-    if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
-+#define MACHINE_KVM "-machine virt,gic-version=max -accel kvm "
+-        arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
- #define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
++    /*
-                     "  'arguments': { 'type': 'full', "
++     * For M-profile there is no guest-facing FSR. We compute a
- #define QUERY_TAIL  "}}"
++     * short-form value for env->exception.fsr which we will then
-@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
++     * examine in arm_v7m_cpu_do_interrupt(). In theory we could
- {
++     * use the LPAE format instead as long as both bits of code agree
-     g_test_init(&argc, &argv, NULL);
++     * (and arm_fi_to_lfsc() handled the M-profile specific
++     * ARMFault_QEMU_NSCExec and ARMFault_QEMU_SFault cases).
--    qtest_add_data_func("/arm/query-cpu-model-expansion",
++     */
--                        NULL, test_query_cpu_model_expansion);
++    if (!arm_feature(env, ARM_FEATURE_M) &&
-+    if (qtest_has_accel("tcg")) {
++        (target_el == 2 || arm_el_is_aa64(env, target_el) ||
-+        qtest_add_data_func("/arm/query-cpu-model-expansion",
++         arm_s1_regime_using_lpae_format(env, arm_mmu_idx))) {
 +                            NULL, test_query_cpu_model_expansion);
 +    }
 +
 +    if (!g_str_equal(qtest_get_arch(), "aarch64")) {
 +        goto out;
 +    }
      /*
       * For now we only run KVM specific tests with AArch64 QEMU in
       * order avoid attempting to run an AArch32 QEMU with KVM on
       * AArch64 hosts. That won't work and isn't easy to detect.
       */
 -    if (g_str_equal(qtest_get_arch(), "aarch64") && qtest_has_accel("kvm")) {
 +    if (qtest_has_accel("kvm")) {
          /*
-          * This tests target the 'host' CPU type, so register it only if
+          * LPAE format fault status register : bottom 6 bits are
-          * KVM is available.
+          * status code in the same form as needed for syndrome
           */
          qtest_add_data_func("/arm/kvm/query-cpu-model-expansion",
                              NULL, test_query_cpu_model_expansion_kvm);
 -    }
 -    if (g_str_equal(qtest_get_arch(), "aarch64")) {
 -        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-max-vq-8",
 -                            NULL, sve_tests_sve_max_vq_8);
 -        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
 -                            NULL, sve_tests_sve_off);
          qtest_add_data_func("/arm/kvm/query-cpu-model-expansion/sve-off",
                              NULL, sve_tests_sve_off_kvm);
      }
 +    if (qtest_has_accel("tcg")) {
 +        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-max-vq-8",
 +                            NULL, sve_tests_sve_max_vq_8);
 +        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
 +                            NULL, sve_tests_sve_off);
 +    }
 +
 +out:
      return g_test_run();
  }
 --
 .34.1

-[PULL 26/30] tests/avocado: Skip tests that require a missing accelerator
+[PULL 16/21] target/arm: Explain why we need to select ARM_V7M
 From: Fabiano Rosas <farosas@suse.de>
-If a test was tagged with the "accel" tag and the specified
+We currently need to select ARM_V7M unconditionally when TCG is
-accelerator it not present in the qemu binary, cancel the test.
+present in the build because some translate.c helpers and the whole of
 m_helpers.c are not yet under CONFIG_ARM_V7M.
-We can now write tests without explicit calls to require_accelerator,
+Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 just the tag is enough.
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-id: 20230523180525.29994-2-farosas@suse.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- tests/avocado/avocado_qemu/__init__.py | 4 ++++
+ target/arm/Kconfig | 3 +++
-file changed, 4 insertions(+)
+file changed, 3 insertions(+)
-diff --git a/tests/avocado/avocado_qemu/__init__.py b/tests/avocado/avocado_qemu/__init__.py
+diff --git a/target/arm/Kconfig b/target/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
---- a/tests/avocado/avocado_qemu/__init__.py
+--- a/target/arm/Kconfig
-+++ b/tests/avocado/avocado_qemu/__init__.py
++++ b/target/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ def setUp(self):
+@@ -XXX,XX +XXX,XX @@
+ config ARM
-         super().setUp('qemu-system-')
+     bool
+     select ARM_COMPATIBLE_SEMIHOSTING if TCG
 +        accel_required = self._get_unique_tag_val('accel')
 +        if accel_required:
 +            self.require_accelerator(accel_required)
 +
-         self.machine = self.params.get('machine',
++    # We need to select this until we move m_helper.c and the
-                                        default=self._get_unique_tag_val('machine'))
++    # translate.c v7m helpers under ARM_V7M.
+     select ARM_V7M if TCG
  config AARCH64
 --
 .34.1

-[PULL 28/30] target/arm: Use "max" as default cpu for the virt machine with KVM
+[PULL 17/21] arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
 From: Fabiano Rosas <farosas@suse.de>
-Now that the cortex-a15 is under CONFIG_TCG, use as default CPU for a
+When we moved the arm default CONFIGs into Kconfig and removed them
-KVM-only build the 'max' cpu.
+from default.mak, we made it harder to identify which CONFIGs are
 selected by default in case users want to disable them.
-Note that we cannot use 'host' here because the qtests can run without
+Bring back the default entries into default.mak, but keep them
-any other accelerator (than qtest) and 'host' depends on KVM being
+commented out. This way users can keep their workflows of editing
-enabled.
+default.mak to remove build options without needing to search through
 Kconfig.
+Reported-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Acked-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20230523180525.29994-3-farosas@suse.de
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt.c | 4 ++++
+ configs/devices/aarch64-softmmu/default.mak |  6 ++++
-file changed, 4 insertions(+)
+ configs/devices/arm-softmmu/default.mak     | 40 +++++++++++++++++++++
 files changed, 46 insertions(+)
-diff --git a/hw/arm/virt.c b/hw/arm/virt.c
+diff --git a/configs/devices/aarch64-softmmu/default.mak b/configs/devices/aarch64-softmmu/default.mak
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt.c
+--- a/configs/devices/aarch64-softmmu/default.mak
-+++ b/hw/arm/virt.c
++++ b/configs/devices/aarch64-softmmu/default.mak
-@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@
-     mc->minimum_page_bits = 12;
-     mc->possible_cpu_arch_ids = virt_possible_cpu_arch_ids;
+ # We support all the 32 bit boards so need all their config
-     mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
+ include ../arm-softmmu/default.mak
-+#ifdef CONFIG_TCG
++
-     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
++# These are selected by default when TCG is enabled, uncomment them to
-+#else
++# keep out of the build.
-+    mc->default_cpu_type = ARM_CPU_TYPE_NAME("max");
++# CONFIG_XLNX_ZYNQMP_ARM=n
-+#endif
++# CONFIG_XLNX_VERSAL=n
-     mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
++# CONFIG_SBSA_REF=n
-     mc->kvm_type = virt_kvm_type;
+diff --git a/configs/devices/arm-softmmu/default.mak b/configs/devices/arm-softmmu/default.mak
-     assert(!mc->get_hotplug_handler);
+index XXXXXXX..XXXXXXX 100644
 --- a/configs/devices/arm-softmmu/default.mak
 +++ b/configs/devices/arm-softmmu/default.mak
@@ -XXX,XX +XXX,XX @@
  # CONFIG_TEST_DEVICES=n
  CONFIG_ARM_VIRT=y
 +
 +# These are selected by default when TCG is enabled, uncomment them to
 +# keep out of the build.
 +# CONFIG_CUBIEBOARD=n
 +# CONFIG_EXYNOS4=n
 +# CONFIG_HIGHBANK=n
 +# CONFIG_INTEGRATOR=n
 +# CONFIG_FSL_IMX31=n
 +# CONFIG_MUSICPAL=n
 +# CONFIG_MUSCA=n
 +# CONFIG_CHEETAH=n
 +# CONFIG_SX1=n
 +# CONFIG_NSERIES=n
 +# CONFIG_STELLARIS=n
 +# CONFIG_STM32VLDISCOVERY=n
 +# CONFIG_REALVIEW=n
 +# CONFIG_VERSATILE=n
 +# CONFIG_VEXPRESS=n
 +# CONFIG_ZYNQ=n
 +# CONFIG_MAINSTONE=n
 +# CONFIG_GUMSTIX=n
 +# CONFIG_SPITZ=n
 +# CONFIG_TOSA=n
 +# CONFIG_Z2=n
 +# CONFIG_NPCM7XX=n
 +# CONFIG_COLLIE=n
 +# CONFIG_ASPEED_SOC=n
 +# CONFIG_NETDUINO2=n
 +# CONFIG_NETDUINOPLUS2=n
 +# CONFIG_OLIMEX_STM32_H405=n
 +# CONFIG_MPS2=n
 +# CONFIG_RASPI=n
 +# CONFIG_DIGIC=n
 +# CONFIG_SABRELITE=n
 +# CONFIG_EMCRAFT_SF2=n
 +# CONFIG_MICROBIT=n
 +# CONFIG_FSL_IMX25=n
 +# CONFIG_FSL_IMX7=n
 +# CONFIG_FSL_IMX6UL=n
 +# CONFIG_ALLWINNER_H3=n
 --
 .34.1

-[PULL 14/30] hw/arm: Add missing XLNX_ZYNQMP_ARM -> USB_DWC3 Kconfig dependency
+[PULL 18/21] arm/Kconfig: Make TCG dependence explicit
-From: Philippe Mathieu-Daudé <philmd@linaro.org>
+From: Fabiano Rosas <farosas@suse.de>
-Since commit acc0b8b05a when running the ZynqMP ZCU102 board with
+Replace the 'default y if TCG' pattern with 'default y; depends on
-a QEMU configured using --without-default-devices, we get:
+TCG'.
-  $ qemu-system-aarch64 -M xlnx-zcu102
+That makes explict that there is a dependence on TCG and enabling
-  qemu-system-aarch64: missing object type 'usb_dwc3'
+these CONFIGs via .mak files without TCG present will fail earlier.
-  Abort trap: 6
+Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
-Fix by adding the missing Kconfig dependency.
+Signed-off-by: Fabiano Rosas <farosas@suse.de>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
-Fixes: acc0b8b05a ("hw/arm/xlnx-zynqmp: Connect ZynqMP's USB controllers")
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-id: 20230523180525.29994-4-farosas@suse.de
 Message-id: 20230216092327.2203-1-philmd@linaro.org
 Reviewed-by: Francisco Iglesias <francisco.iglesias@amd.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Kconfig | 1 +
+ hw/arm/Kconfig | 123 ++++++++++++++++++++++++++++++++-----------------
-file changed, 1 insertion(+)
+file changed, 82 insertions(+), 41 deletions(-)
 diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/Kconfig
 +++ b/hw/arm/Kconfig
+@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
+ config CHEETAH
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select OMAP
+     select TSC210X
+ config CUBIEBOARD
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ALLWINNER_A10
+ config DIGIC
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select PTIMER
+     select PFLASH_CFI02
+ config EXYNOS4
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     imply I2C_DEVICES
+     select A9MPCORE
+     select I2C
+@@ -XXX,XX +XXX,XX @@ config EXYNOS4
+ config HIGHBANK
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select A9MPCORE
+     select A15MPCORE
+     select AHCI
+@@ -XXX,XX +XXX,XX @@ config HIGHBANK
+ config INTEGRATOR
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ARM_TIMER
+     select INTEGRATOR_DEBUG
+     select PL011 # UART
+@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
+ config MAINSTONE
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select PXA2XX
+     select PFLASH_CFI01
+     select SMC91C111
+ config MUSCA
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ARMSSE
+     select PL011
+     select PL031
+@@ -XXX,XX +XXX,XX @@ config MARVELL_88W8618
+ config MUSICPAL
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select OR_IRQ
+     select BITBANG_I2C
+     select MARVELL_88W8618
+@@ -XXX,XX +XXX,XX @@ config MUSICPAL
+ config NETDUINO2
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select STM32F205_SOC
+ config NETDUINOPLUS2
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select STM32F405_SOC
+ config OLIMEX_STM32_H405
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select STM32F405_SOC
+ config NSERIES
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select OMAP
+     select TMP105   # temperature sensor
+     select BLIZZARD # LCD/TV controller
+@@ -XXX,XX +XXX,XX @@ config PXA2XX
+ config GUMSTIX
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select PFLASH_CFI01
+     select SMC91C111
+     select PXA2XX
+ config TOSA
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ZAURUS  # scoop
+     select MICRODRIVE
+     select PXA2XX
+@@ -XXX,XX +XXX,XX @@ config TOSA
+ config SPITZ
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ADS7846 # touch-screen controller
+     select MAX111X # A/D converter
+     select WM8750  # audio codec
+@@ -XXX,XX +XXX,XX @@ config SPITZ
+ config Z2
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select PFLASH_CFI01
+     select WM8750
+     select PL011 # UART
+@@ -XXX,XX +XXX,XX @@ config Z2
+ config REALVIEW
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     imply PCI_DEVICES
+     imply PCI_TESTDEV
+     imply I2C_DEVICES
+@@ -XXX,XX +XXX,XX @@ config REALVIEW
+ config SBSA_REF
+     bool
+-    default y if TCG && AARCH64
++    default y
++    depends on TCG && AARCH64
+     imply PCI_DEVICES
+     select AHCI
+     select ARM_SMMUV3
+@@ -XXX,XX +XXX,XX @@ config SBSA_REF
+ config SABRELITE
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select FSL_IMX6
+     select SSI_M25P80
+ config STELLARIS
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     imply I2C_DEVICES
+     select ARM_V7M
+     select CMSDK_APB_WATCHDOG
+@@ -XXX,XX +XXX,XX @@ config STELLARIS
+ config STM32VLDISCOVERY
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select STM32F100_SOC
+ config STRONGARM
+@@ -XXX,XX +XXX,XX @@ config STRONGARM
+ config COLLIE
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select PFLASH_CFI01
+     select ZAURUS  # scoop
+     select STRONGARM
+ config SX1
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select OMAP
+ config VERSATILE
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ARM_TIMER # sp804
+     select PFLASH_CFI01
+     select LSI_SCSI_PCI
+@@ -XXX,XX +XXX,XX @@ config VERSATILE
+ config VEXPRESS
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select A9MPCORE
+     select A15MPCORE
+     select ARM_MPTIMER
+@@ -XXX,XX +XXX,XX @@ config VEXPRESS
+ config ZYNQ
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select A9MPCORE
+     select CADENCE # UART
+     select PFLASH_CFI02
+@@ -XXX,XX +XXX,XX @@ config ZYNQ
+ config ARM_V7M
+     bool
+     # currently v7M must be included in a TCG build due to translate.c
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select PTIMER
+ config ALLWINNER_A10
+@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
+ config ALLWINNER_H3
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select ALLWINNER_A10_PIT
+     select ALLWINNER_SUN8I_EMAC
+     select ALLWINNER_I2C
+@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
+ config RASPI
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select FRAMEBUFFER
+     select PL011 # UART
+     select SDHCI
+@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
+ config XLNX_ZYNQMP_ARM
+     bool
+-    default y if TCG && AARCH64
++    default y
++    depends on TCG && AARCH64
+     select AHCI
+     select ARM_GIC
+     select CADENCE
 @@ -XXX,XX +XXX,XX @@ config XLNX_ZYNQMP_ARM
-     select XLNX_CSU_DMA
-     select XLNX_ZYNQMP
-     select XLNX_ZDMA
-+    select USB_DWC3
  config XLNX_VERSAL
      bool
+-    default y if TCG && AARCH64
++    default y
++    depends on TCG && AARCH64
+     select ARM_GIC
+     select PL011
+     select CADENCE
+@@ -XXX,XX +XXX,XX @@ config XLNX_VERSAL
+ config NPCM7XX
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select A9MPCORE
+     select ADM1272
+     select ARM_GIC
+@@ -XXX,XX +XXX,XX @@ config NPCM7XX
+ config FSL_IMX25
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     imply I2C_DEVICES
+     select IMX
+     select IMX_FEC
+@@ -XXX,XX +XXX,XX @@ config FSL_IMX25
+ config FSL_IMX31
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     imply I2C_DEVICES
+     select SERIAL
+     select IMX
+@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
+ config ASPEED_SOC
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select DS1338
+     select FTGMAC100
+     select I2C
+@@ -XXX,XX +XXX,XX @@ config ASPEED_SOC
+ config MPS2
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     imply I2C_DEVICES
+     select ARMSSE
+     select LAN9118
+@@ -XXX,XX +XXX,XX @@ config MPS2
+ config FSL_IMX7
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     imply PCI_DEVICES
+     imply TEST_DEVICES
+     imply I2C_DEVICES
+@@ -XXX,XX +XXX,XX @@ config ARM_SMMUV3
+ config FSL_IMX6UL
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     imply I2C_DEVICES
+     select A15MPCORE
+     select IMX
+@@ -XXX,XX +XXX,XX @@ config FSL_IMX6UL
+ config MICROBIT
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select NRF51_SOC
+ config NRF51_SOC
+@@ -XXX,XX +XXX,XX @@ config NRF51_SOC
+ config EMCRAFT_SF2
+     bool
+-    default y if TCG && ARM
++    default y
++    depends on TCG && ARM
+     select MSF2
+     select SSI_M25P80
 --
 .34.1

-[PULL 23/30] target/arm: wrap call to aarch64_sve_change_el in tcg_enabled()
+[PULL 19/21] Update copyright dates to 2023
-From: Claudio Fontana <cfontana@suse.de>
+From: Enze Li <lienze@kylinos.cn>
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
+I noticed that in the latest version, the copyright string is still
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+, even though 2023 is halfway through.  This patch fixes that and
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
+fixes the documentation along with it.
-Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Enze Li <lienze@kylinos.cn>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20230525064345.1152801-1-lienze@kylinos.cn
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 12 +++++++-----
+ docs/conf.py              | 2 +-
-file changed, 7 insertions(+), 5 deletions(-)
+ include/qemu/help-texts.h | 2 +-
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/docs/conf.py b/docs/conf.py
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/docs/conf.py
-+++ b/target/arm/helper.c
++++ b/docs/conf.py
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@
-     unsigned int cur_el = arm_current_el(env);
-     int rt;
+ # General information about the project.
+ project = u'QEMU'
--    /*
+-copyright = u'2022, The QEMU Project Developers'
--     * Note that new_el can never be 0.  If cur_el is 0, then
++copyright = u'2023, The QEMU Project Developers'
--     * el0_a64 is is_a64(), else el0_a64 is ignored.
+ author = u'The QEMU Project Developers'
--     */
--    aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
+ # The version info for the project you're documenting, acts as replacement for
-+    if (tcg_enabled()) {
+diff --git a/include/qemu/help-texts.h b/include/qemu/help-texts.h
-+        /*
+index XXXXXXX..XXXXXXX 100644
-+         * Note that new_el can never be 0.  If cur_el is 0, then
+--- a/include/qemu/help-texts.h
-+         * el0_a64 is is_a64(), else el0_a64 is ignored.
++++ b/include/qemu/help-texts.h
-+         */
+@@ -XXX,XX +XXX,XX @@
-+        aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
+ #define QEMU_HELP_TEXTS_H
-+    }
+ /* Copyright string for -version arguments, About dialogs, etc */
-     if (cur_el < new_el) {
+-#define QEMU_COPYRIGHT "Copyright (c) 2003-2022 " \
-         /*
++#define QEMU_COPYRIGHT "Copyright (c) 2003-2023 " \
      "Fabrice Bellard and the QEMU Project developers"
  /* Bug reporting information for --help arguments, About dialogs, etc */
 --
 .34.1

-[PULL 18/30] hw/arm: Attach PSPI module to NPCM7XX SoC
+[PULL 20/21] hw/arm/sbsa-ref: add GIC node into DT
-From: Hao Wu <wuhaotsh@google.com>
+From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-Signed-off-by: Hao Wu <wuhaotsh@google.com>
+Let add GIC information into DeviceTree as part of SBSA-REF versioning.
-Reviewed-by: Titus Rwantare <titusr@google.com>
-Reviewed-by: Philippe Mathieu-Daude <philmd@linaro.org>
+Trusted Firmware will read it and provide to next firmware level.
-Message-id: 20230208235433.3989937-4-wuhaotsh@google.com
 Bumps platform version to 0.1 one so we can check is node is present.
 Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- docs/system/arm/nuvoton.rst |  2 +-
+ hw/arm/sbsa-ref.c | 19 ++++++++++++++++++-
- include/hw/arm/npcm7xx.h    |  2 ++
+file changed, 18 insertions(+), 1 deletion(-)
  hw/arm/npcm7xx.c            | 25 +++++++++++++++++++++++--
 files changed, 26 insertions(+), 3 deletions(-)
-diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
+diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/system/arm/nuvoton.rst
+--- a/hw/arm/sbsa-ref.c
-+++ b/docs/system/arm/nuvoton.rst
++++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ Supported devices
   * SMBus controller (SMBF)
   * Ethernet controller (EMC)
   * Tachometer
 + * Peripheral SPI controller (PSPI)
  Missing devices
  ---------------
@@ -XXX,XX +XXX,XX @@ Missing devices
   * Ethernet controller (GMAC)
   * USB device (USBD)
 - * Peripheral SPI controller (PSPI)
   * SD/MMC host
   * PECI interface
   * PCI and PCIe root complex and bridges
 diff --git a/include/hw/arm/npcm7xx.h b/include/hw/arm/npcm7xx.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/npcm7xx.h
 +++ b/include/hw/arm/npcm7xx.h
 @@ -XXX,XX +XXX,XX @@
- #include "hw/nvram/npcm7xx_otp.h"
+ #include "exec/hwaddr.h"
- #include "hw/timer/npcm7xx_timer.h"
+ #include "kvm_arm.h"
- #include "hw/ssi/npcm7xx_fiu.h"
+ #include "hw/arm/boot.h"
-+#include "hw/ssi/npcm_pspi.h"
++#include "hw/arm/fdt.h"
- #include "hw/usb/hcd-ehci.h"
+ #include "hw/arm/smmuv3.h"
- #include "hw/usb/hcd-ohci.h"
+ #include "hw/block/flash.h"
- #include "target/arm/cpu.h"
+ #include "hw/boards.h"
-@@ -XXX,XX +XXX,XX @@ struct NPCM7xxState {
+@@ -XXX,XX +XXX,XX @@ static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
-     NPCM7xxFIUState     fiu[2];
+     return arm_cpu_mp_affinity(idx, clustersz);
-     NPCM7xxEMCState     emc[2];
+ }
-     NPCM7xxSDHCIState   mmc;
-+    NPCMPSPIState       pspi[2];
++static void sbsa_fdt_add_gic_node(SBSAMachineState *sms)
- };
++{
++    char *nodename;
  #define TYPE_NPCM7XX    "npcm7xx"
 diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/npcm7xx.c
 +++ b/hw/arm/npcm7xx.c
@@ -XXX,XX +XXX,XX @@ enum NPCM7xxInterrupt {
      NPCM7XX_EMC1RX_IRQ          = 15,
      NPCM7XX_EMC1TX_IRQ,
      NPCM7XX_MMC_IRQ             = 26,
 +    NPCM7XX_PSPI2_IRQ           = 28,
 +    NPCM7XX_PSPI1_IRQ           = 31,
      NPCM7XX_TIMER0_IRQ          = 32,   /* Timer Module 0 */
      NPCM7XX_TIMER1_IRQ,
      NPCM7XX_TIMER2_IRQ,
@@ -XXX,XX +XXX,XX @@ static const hwaddr npcm7xx_emc_addr[] = {
 xf0826000,
  };
 +/* Register base address for each PSPI Module */
 +static const hwaddr npcm7xx_pspi_addr[] = {
 +    0xf0200000,
 +    0xf0201000,
 +};
 +
- static const struct {
++    nodename = g_strdup_printf("/intc");
-     hwaddr regs_addr;
++    qemu_fdt_add_subnode(sms->fdt, nodename);
-     uint32_t unconnected_pins;
++    qemu_fdt_setprop_sized_cells(sms->fdt, nodename, "reg",
-@@ -XXX,XX +XXX,XX @@ static void npcm7xx_init(Object *obj)
++                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].base,
-         object_initialize_child(obj, "emc[*]", &s->emc[i], TYPE_NPCM7XX_EMC);
++                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].size,
 +                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].base,
 +                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].size);
 +
 +    g_free(nodename);
 +}
  /*
   * Firmware on this machine only uses ACPI table to load OS, these limited
   * device tree nodes are just to let firmware know the info which varies from
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
       *                        fw compatibility.
       */
      qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
 -    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 0);
 +    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 1);
      if (ms->numa_state->have_numa_distance) {
          int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
          g_free(nodename);
      }
-+    for (i = 0; i < ARRAY_SIZE(s->pspi); i++) {
-+        object_initialize_child(obj, "pspi[*]", &s->pspi[i], TYPE_NPCM_PSPI);
-+    }
 +
-     object_initialize_child(obj, "mmc", &s->mmc, TYPE_NPCM7XX_SDHCI);
++    sbsa_fdt_add_gic_node(sms);
  }
-@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
+ #define SBSA_FLASH_SECTOR_SIZE (256 * KiB)
      sysbus_connect_irq(SYS_BUS_DEVICE(&s->mmc), 0,
              npcm7xx_irq(s, NPCM7XX_MMC_IRQ));
 +    /* PSPI */
 +    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_pspi_addr) != ARRAY_SIZE(s->pspi));
 +    for (i = 0; i < ARRAY_SIZE(s->pspi); i++) {
 +        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->pspi[i]);
 +        int irq = (i == 0) ? NPCM7XX_PSPI1_IRQ : NPCM7XX_PSPI2_IRQ;
 +
 +        sysbus_realize(sbd, &error_abort);
 +        sysbus_mmio_map(sbd, 0, npcm7xx_pspi_addr[i]);
 +        sysbus_connect_irq(sbd, 0, npcm7xx_irq(s, irq));
 +    }
 +
      create_unimplemented_device("npcm7xx.shm",          0xc0001000,   4 * KiB);
      create_unimplemented_device("npcm7xx.vdmx",         0xe0800000,   4 * KiB);
      create_unimplemented_device("npcm7xx.pcierc",       0xe1000000,  64 * KiB);
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
      create_unimplemented_device("npcm7xx.peci",         0xf0100000,   4 * KiB);
      create_unimplemented_device("npcm7xx.siox[1]",      0xf0101000,   4 * KiB);
      create_unimplemented_device("npcm7xx.siox[2]",      0xf0102000,   4 * KiB);
 -    create_unimplemented_device("npcm7xx.pspi1",        0xf0200000,   4 * KiB);
 -    create_unimplemented_device("npcm7xx.pspi2",        0xf0201000,   4 * KiB);
      create_unimplemented_device("npcm7xx.ahbpci",       0xf0400000,   1 * MiB);
      create_unimplemented_device("npcm7xx.mcphy",        0xf05f0000,  64 * KiB);
      create_unimplemented_device("npcm7xx.gmac1",        0xf0802000,   8 * KiB);
 --
 .34.1

-[PULL 16/30] MAINTAINERS: Add myself to maintainers and remove Havard
+[PULL 21/21] docs: sbsa: correct graphics card name
-From: Hao Wu <wuhaotsh@google.com>
+From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-Havard is no longer working on the Nuvoton systems for a while
+We moved from VGA to Bochs to have PCIe card.
 and won't be able to do any work on it in the future. So I'll
 take over maintaining the Nuvoton system from him.
-Signed-off-by: Hao Wu <wuhaotsh@google.com>
+Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-Acked-by: Havard Skinnemoen <hskinnemoen@google.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daude <philmd@linaro.org>
 Message-id: 20230208235433.3989937-2-wuhaotsh@google.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- MAINTAINERS | 2 +-
+ docs/system/arm/sbsa.rst | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/docs/system/arm/sbsa.rst
-+++ b/MAINTAINERS
++++ b/docs/system/arm/sbsa.rst
-@@ -XXX,XX +XXX,XX @@ F: include/hw/net/mv88w8618_eth.h
+@@ -XXX,XX +XXX,XX @@ The sbsa-ref board supports:
- F: docs/system/arm/musicpal.rst
+   - System bus EHCI controller
+   - CDROM and hard disc on AHCI bus
- Nuvoton NPCM7xx
+   - E1000E ethernet card on PCIe bus
--M: Havard Skinnemoen <hskinnemoen@google.com>
+-  - VGA display adaptor on PCIe bus
- M: Tyrone Ting <kfting@nuvoton.com>
++  - Bochs display adapter on PCIe bus
-+M: Hao Wu <wuhaotsh@google.com>
+   - A generic SBSA watchdog device
- L: qemu-arm@nongnu.org
  S: Supported
  F: hw/*/npcm7xx*
 --
 .34.1

-[PULL 21/30] target/arm: rename handle_semihosting to tcg_handle_semihosting
+Deleted patch
-From: Claudio Fontana <cfontana@suse.de>
-make it clearer from the name that this is a tcg-only function.
-Signed-off-by: Claudio Fontana <cfontana@suse.de>
-Signed-off-by: Fabiano Rosas <farosas@suse.de>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
-  * trapped to the hypervisor in KVM.
-  */
- #ifdef CONFIG_TCG
--static void handle_semihosting(CPUState *cs)
-+static void tcg_handle_semihosting(CPUState *cs)
- {
-     ARMCPU *cpu = ARM_CPU(cs);
-     CPUARMState *env = &cpu->env;
-@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
-      */
- #ifdef CONFIG_TCG
-     if (cs->exception_index == EXCP_SEMIHOST) {
--        handle_semihosting(cs);
-+        tcg_handle_semihosting(cs);
-         return;
-     }
- #endif
---
-.34.1

The following changes since commit 003ba52a8b327180e284630b289c6ece5a3e08b9:

Merge tag 'for-upstream' of https://gitlab.com/bonzini/qemu into staging (2023-02-16 11:16:39 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230216

for you to fetch changes up to caf01d6a435d9f4a95aeae2f9fc6cb8b889b1fb8:

tests/qtest: Restrict tpm-tis-devices-{swtpm}-test to CONFIG_TCG (2023-02-16 16:28:53 +0000)

----------------------------------------------------------------
target-arm queue:
 * Some mostly M-profile-related code cleanups
 * avocado: Retire the boot_linux.py AArch64 TCG tests
 * hw/arm/smmuv3: Add GBPA register
 * arm/virt: don't try to spell out the accelerator
 * hw/arm: Attach PSPI module to NPCM7XX SoC
 * Some cleanup/refactoring patches aiming towards
   allowing building Arm targets without CONFIG_TCG

----------------------------------------------------------------
Alex Bennée (1):
      tests/avocado: retire the Aarch64 TCG tests from boot_linux.py

Claudio Fontana (3):
      target/arm: rename handle_semihosting to tcg_handle_semihosting
      target/arm: wrap psci call with tcg_enabled
      target/arm: wrap call to aarch64_sve_change_el in tcg_enabled()

Cornelia Huck (1):
      arm/virt: don't try to spell out the accelerator

Fabiano Rosas (7):
      target/arm: Move PC alignment check
      target/arm: Move cpregs code out of cpu.h
      tests/avocado: Skip tests that require a missing accelerator
      tests/avocado: Tag TCG tests with accel:tcg
      target/arm: Use "max" as default cpu for the virt machine with KVM
      tests/qtest: arm-cpu-features: Match tests to required accelerators
      tests/qtest: Restrict tpm-tis-devices-{swtpm}-test to CONFIG_TCG

Hao Wu (3):
      MAINTAINERS: Add myself to maintainers and remove Havard
      hw/ssi: Add Nuvoton PSPI Module
      hw/arm: Attach PSPI module to NPCM7XX SoC

Jean-Philippe Brucker (2):
      hw/arm/smmu-common: Support 64-bit addresses
      hw/arm/smmu-common: Fix TTB1 handling

Mostafa Saleh (1):
      hw/arm/smmuv3: Add GBPA register

Philippe Mathieu-Daudé (12):
      hw/intc/armv7m_nvic: Use OBJECT_DECLARE_SIMPLE_TYPE() macro
      target/arm: Simplify arm_v7m_mmu_idx_for_secstate() for user emulation
      target/arm: Reduce arm_v7m_mmu_idx_[all/for_secstate_and_priv]() scope
      target/arm: Constify ID_PFR1 on user emulation
      target/arm: Convert CPUARMState::eabi to boolean
      target/arm: Avoid resetting CPUARMState::eabi field
      target/arm: Restrict CPUARMState::gicv3state to sysemu
      target/arm: Restrict CPUARMState::arm_boot_info to sysemu
      target/arm: Restrict CPUARMState::nvic to sysemu
      target/arm: Store CPUARMState::nvic as NVICState*
      target/arm: Declare CPU <-> NVIC helpers in 'hw/intc/armv7m_nvic.h'
      hw/arm: Add missing XLNX_ZYNQMP_ARM -> USB_DWC3 Kconfig dependency

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Manually convert to OBJECT_DECLARE_SIMPLE_TYPE() macro,
similarly to automatic conversion from commit 8063396bf3
("Use OBJECT_DECLARE_SIMPLE_TYPE when possible").

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230206223502.25122-2-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/intc/armv7m_nvic.h | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/armv7m_nvic.h
+++ b/include/hw/intc/armv7m_nvic.h
@@ -XXX,XX +XXX,XX @@
 #include "qom/object.h"
 
 #define TYPE_NVIC "armv7m_nvic"
-
-typedef struct NVICState NVICState;
-DECLARE_INSTANCE_CHECKER(NVICState, NVIC,
-                         TYPE_NVIC)
+OBJECT_DECLARE_SIMPLE_TYPE(NVICState, NVIC)
 
 /* Highest permitted number of exceptions (architectural limit) */
 #define NVIC_MAX_VECTORS 512
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230206223502.25122-3-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/m_helper.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
     return 0;
 }
 
-#else
+ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
+{
+    return ARMMMUIdx_MUser;
+}
+
+#else /* !CONFIG_USER_ONLY */
 
 /*
  * What kind of stack write are we doing? This affects how exceptions
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
     return tt_resp;
 }
 
-#endif /* !CONFIG_USER_ONLY */
-
 ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
                               bool secstate, bool priv, bool negpri)
 {
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
 
     return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
 }
+
+#endif /* !CONFIG_USER_ONLY */
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

arm_v7m_mmu_idx_all() and arm_v7m_mmu_idx_for_secstate_and_priv()
are only used for system emulation in m_helper.c.
Move the definitions to avoid prototype forward declarations.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230206223502.25122-4-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 14 --------
 target/arm/m_helper.c  | 74 +++++++++++++++++++++---------------------
 2 files changed, 37 insertions(+), 51 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline ARMMMUIdx core_to_aa64_mmu_idx(int mmu_idx)
 
 int arm_mmu_idx_to_el(ARMMMUIdx mmu_idx);
 
-/*
- * Return the MMU index for a v7M CPU with all relevant information
- * manually specified.
- */
-ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
-                              bool secstate, bool priv, bool negpri);
-
-/*
- * Return the MMU index for a v7M CPU in the specified security and
- * privilege state.
- */
-ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
-                                                bool secstate, bool priv);
-
 /* Return the MMU index for a v7M CPU in the specified security state */
 ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate);
 
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
 
 #else /* !CONFIG_USER_ONLY */
 
+static ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
+                                     bool secstate, bool priv, bool negpri)
+{
+    ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
+
+    if (priv) {
+        mmu_idx |= ARM_MMU_IDX_M_PRIV;
+    }
+
+    if (negpri) {
+        mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
+    }
+
+    if (secstate) {
+        mmu_idx |= ARM_MMU_IDX_M_S;
+    }
+
+    return mmu_idx;
+}
+
+static ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
+                                                       bool secstate, bool priv)
+{
+    bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate);
+
+    return arm_v7m_mmu_idx_all(env, secstate, priv, negpri);
+}
+
+/* Return the MMU index for a v7M CPU in the specified security state */
+ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
+{
+    bool priv = arm_v7m_is_handler_mode(env) ||
+        !(env->v7m.control[secstate] & 1);
+
+    return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
+}
+
 /*
  * What kind of stack write are we doing? This affects how exceptions
  * generated during the stacking are treated.
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(v7m_tt)(CPUARMState *env, uint32_t addr, uint32_t op)
     return tt_resp;
 }
 
-ARMMMUIdx arm_v7m_mmu_idx_all(CPUARMState *env,
-                              bool secstate, bool priv, bool negpri)
-{
-    ARMMMUIdx mmu_idx = ARM_MMU_IDX_M;
-
-    if (priv) {
-        mmu_idx |= ARM_MMU_IDX_M_PRIV;
-    }
-
-    if (negpri) {
-        mmu_idx |= ARM_MMU_IDX_M_NEGPRI;
-    }
-
-    if (secstate) {
-        mmu_idx |= ARM_MMU_IDX_M_S;
-    }
-
-    return mmu_idx;
-}
-
-ARMMMUIdx arm_v7m_mmu_idx_for_secstate_and_priv(CPUARMState *env,
-                                                bool secstate, bool priv)
-{
-    bool negpri = armv7m_nvic_neg_prio_requested(env->nvic, secstate);
-
-    return arm_v7m_mmu_idx_all(env, secstate, priv, negpri);
-}
-
-/* Return the MMU index for a v7M CPU in the specified security state */
-ARMMMUIdx arm_v7m_mmu_idx_for_secstate(CPUARMState *env, bool secstate)
-{
-    bool priv = arm_v7m_is_handler_mode(env) ||
-        !(env->v7m.control[secstate] & 1);
-
-    return arm_v7m_mmu_idx_for_secstate_and_priv(env, secstate, priv);
-}
-
 #endif /* !CONFIG_USER_ONLY */
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230206223502.25122-5-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void define_pmu_regs(ARMCPU *cpu)
     }
 }
 
+#ifndef CONFIG_USER_ONLY
 /*
  * We don't know until after realize whether there's a GICv3
  * attached, and that is what registers the gicv3 sysregs.
@@ -XXX,XX +XXX,XX @@ static uint64_t id_pfr1_read(CPUARMState *env, const ARMCPRegInfo *ri)
     return pfr1;
 }
 
-#ifndef CONFIG_USER_ONLY
 static uint64_t id_aa64pfr0_read(CPUARMState *env, const ARMCPRegInfo *ri)
 {
     ARMCPU *cpu = env_archcpu(env);
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
               .accessfn = access_aa32_tid3,
+#ifdef CONFIG_USER_ONLY
+              .type = ARM_CP_CONST,
+              .resetvalue = cpu->isar.id_pfr1,
+#else
+              .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa32_tid3,
               .readfn = id_pfr1_read,
-              .writefn = arm_cp_write_ignore },
+              .writefn = arm_cp_write_ignore
+#endif
+            },
             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Suggested-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230206223502.25122-6-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/user-internals.h | 2 +-
 target/arm/cpu.h            | 2 +-
 linux-user/arm/cpu_loop.c   | 4 ++--
 3 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/linux-user/user-internals.h b/linux-user/user-internals.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/user-internals.h
+++ b/linux-user/user-internals.h
@@ -XXX,XX +XXX,XX @@ void print_termios(void *arg);
 #ifdef TARGET_ARM
 static inline int regpairs_aligned(CPUArchState *cpu_env, int num)
 {
-    return cpu_env->eabi == 1;
+    return cpu_env->eabi;
 }
 #elif defined(TARGET_MIPS) && defined(TARGET_ABI_MIPSO32)
 static inline int regpairs_aligned(CPUArchState *cpu_env, int num) { return 1; }
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
 
 #if defined(CONFIG_USER_ONLY)
     /* For usermode syscall translation.  */
-    int eabi;
+    bool eabi;
 #endif
 
     struct CPUBreakpoint *cpu_breakpoint[16];
diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
             break;
         case EXCP_SWI:
             {
-                env->eabi = 1;
+                env->eabi = true;
                 /* system call */
                 if (env->thumb) {
                     /* Thumb is always EABI style with syscall number in r7 */
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
                          * > 0xfffff and are handled below as out-of-range.
                          */
                         n ^= ARM_SYSCALL_BASE;
-                        env->eabi = 0;
+                        env->eabi = false;
                     }
                 }
 
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

Although the 'eabi' field is only used in user emulation where
CPU reset doesn't occur, it doesn't belong to the area to reset.
Move it after the 'end_reset_fields' for consistency.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230206223502.25122-7-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
     ARMVectorReg zarray[ARM_MAX_VQ * 16];
 #endif
 
-#if defined(CONFIG_USER_ONLY)
-    /* For usermode syscall translation.  */
-    bool eabi;
-#endif
-
     struct CPUBreakpoint *cpu_breakpoint[16];
     struct CPUWatchpoint *cpu_watchpoint[16];
 
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
     const struct arm_boot_info *boot_info;
     /* Store GICv3CPUState to access from this struct */
     void *gicv3state;
+#if defined(CONFIG_USER_ONLY)
+    /* For usermode syscall translation.  */
+    bool eabi;
+#endif /* CONFIG_USER_ONLY */
 
 #ifdef TARGET_TAGGED_ADDRESSES
     /* Linux syscall tagged address support */
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

There is no point in using a void pointer to access the NVIC.
Use the real type to avoid casting it while debugging.

Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230206223502.25122-11-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h      | 46 ++++++++++++++++++++++---------------------
 hw/intc/armv7m_nvic.c | 38 ++++++++++++-----------------------
 target/arm/cpu.c      |  1 +
 target/arm/m_helper.c |  2 +-
 4 files changed, 39 insertions(+), 48 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUARMTBFlags {
 
 typedef struct ARMMMUFaultInfo ARMMMUFaultInfo;
 
+typedef struct NVICState NVICState;
+
 typedef struct CPUArchState {
     /* Regs for current mode.  */
     uint32_t regs[16];
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
     } sau;
 
 #if !defined(CONFIG_USER_ONLY)
-    void *nvic;
+    NVICState *nvic;
     const struct arm_boot_info *boot_info;
     /* Store GICv3CPUState to access from this struct */
     void *gicv3state;
@@ -XXX,XX +XXX,XX @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
 
 /* Interface between CPU and Interrupt controller.  */
 #ifndef CONFIG_USER_ONLY
-bool armv7m_nvic_can_take_pending_exception(void *opaque);
+bool armv7m_nvic_can_take_pending_exception(NVICState *s);
 #else
-static inline bool armv7m_nvic_can_take_pending_exception(void *opaque)
+static inline bool armv7m_nvic_can_take_pending_exception(NVICState *s)
 {
     return true;
 }
 #endif
 /**
  * armv7m_nvic_set_pending: mark the specified exception as pending
- * @opaque: the NVIC
+ * @s: the NVIC
  * @irq: the exception number to mark pending
  * @secure: false for non-banked exceptions or for the nonsecure
  * version of a banked exception, true for the secure version of a banked
@@ -XXX,XX +XXX,XX @@ static inline bool armv7m_nvic_can_take_pending_exception(void *opaque)
  * if @secure is true and @irq does not specify one of the fixed set
  * of architecturally banked exceptions.
  */
-void armv7m_nvic_set_pending(void *opaque, int irq, bool secure);
+void armv7m_nvic_set_pending(NVICState *s, int irq, bool secure);
 /**
  * armv7m_nvic_set_pending_derived: mark this derived exception as pending
- * @opaque: the NVIC
+ * @s: the NVIC
  * @irq: the exception number to mark pending
  * @secure: false for non-banked exceptions or for the nonsecure
  * version of a banked exception, true for the secure version of a banked
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending(void *opaque, int irq, bool secure);
  * exceptions (exceptions generated in the course of trying to take
  * a different exception).
  */
-void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure);
+void armv7m_nvic_set_pending_derived(NVICState *s, int irq, bool secure);
 /**
  * armv7m_nvic_set_pending_lazyfp: mark this lazy FP exception as pending
- * @opaque: the NVIC
+ * @s: the NVIC
  * @irq: the exception number to mark pending
  * @secure: false for non-banked exceptions or for the nonsecure
  * version of a banked exception, true for the secure version of a banked
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure);
  * Similar to armv7m_nvic_set_pending(), but specifically for exceptions
  * generated in the course of lazy stacking of FP registers.
  */
-void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure);
+void armv7m_nvic_set_pending_lazyfp(NVICState *s, int irq, bool secure);
 /**
  * armv7m_nvic_get_pending_irq_info: return highest priority pending
  *    exception, and whether it targets Secure state
- * @opaque: the NVIC
+ * @s: the NVIC
  * @pirq: set to pending exception number
  * @ptargets_secure: set to whether pending exception targets Secure
  *
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure);
  * to true if the current highest priority pending exception should
  * be taken to Secure state, false for NS.
  */
-void armv7m_nvic_get_pending_irq_info(void *opaque, int *pirq,
+void armv7m_nvic_get_pending_irq_info(NVICState *s, int *pirq,
                                       bool *ptargets_secure);
 /**
  * armv7m_nvic_acknowledge_irq: make highest priority pending exception active
- * @opaque: the NVIC
+ * @s: the NVIC
  *
  * Move the current highest priority pending exception from the pending
  * state to the active state, and update v7m.exception to indicate that
  * it is the exception currently being handled.
  */
-void armv7m_nvic_acknowledge_irq(void *opaque);
+void armv7m_nvic_acknowledge_irq(NVICState *s);
 /**
  * armv7m_nvic_complete_irq: complete specified interrupt or exception
- * @opaque: the NVIC
+ * @s: the NVIC
  * @irq: the exception number to complete
  * @secure: true if this exception was secure
  *
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_acknowledge_irq(void *opaque);
  *           0 if there is still an irq active after this one was completed
  * (Ignoring -1, this is the same as the RETTOBASE value before completion.)
  */
-int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure);
+int armv7m_nvic_complete_irq(NVICState *s, int irq, bool secure);
 /**
  * armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
- * @opaque: the NVIC
+ * @s: the NVIC
  * @irq: the exception number to mark pending
  * @secure: false for non-banked exceptions or for the nonsecure
  * version of a banked exception, true for the secure version of a banked
@@ -XXX,XX +XXX,XX @@ int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure);
  * interrupt the current execution priority. This controls whether the
  * RDY bit for it in the FPCCR is set.
  */
-bool armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure);
+bool armv7m_nvic_get_ready_status(NVICState *s, int irq, bool secure);
 /**
  * armv7m_nvic_raw_execution_priority: return the raw execution priority
- * @opaque: the NVIC
+ * @s: the NVIC
  *
  * Returns: the raw execution priority as defined by the v8M architecture.
  * This is the execution priority minus the effects of AIRCR.PRIS,
  * and minus any PRIMASK/FAULTMASK/BASEPRI priority boosting.
  * (v8M ARM ARM I_PKLD.)
  */
-int armv7m_nvic_raw_execution_priority(void *opaque);
+int armv7m_nvic_raw_execution_priority(NVICState *s);
 /**
  * armv7m_nvic_neg_prio_requested: return true if the requested execution
  * priority is negative for the specified security state.
- * @opaque: the NVIC
+ * @s: the NVIC
  * @secure: the security state to test
  * This corresponds to the pseudocode IsReqExecPriNeg().
  */
 #ifndef CONFIG_USER_ONLY
-bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure);
+bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure);
 #else
-static inline bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
+static inline bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure)
 {
     return false;
 }
diff --git a/hw/intc/armv7m_nvic.c b/hw/intc/armv7m_nvic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/armv7m_nvic.c
+++ b/hw/intc/armv7m_nvic.c
@@ -XXX,XX +XXX,XX @@ static inline int nvic_exec_prio(NVICState *s)
     return MIN(running, s->exception_prio);
 }
 
-bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
+bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure)
 {
     /* Return true if the requested execution priority is negative
      * for the specified security state, ie that security state
@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
      * mean we don't allow FAULTMASK_NS to actually make the execution
      * priority negative). Compare pseudocode IsReqExcPriNeg().
      */
-    NVICState *s = opaque;
-
     if (s->cpu->env.v7m.faultmask[secure]) {
         return true;
     }
@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_neg_prio_requested(void *opaque, bool secure)
     return false;
 }
 
-bool armv7m_nvic_can_take_pending_exception(void *opaque)
+bool armv7m_nvic_can_take_pending_exception(NVICState *s)
 {
-    NVICState *s = opaque;
-
     return nvic_exec_prio(s) > nvic_pending_prio(s);
 }
 
-int armv7m_nvic_raw_execution_priority(void *opaque)
+int armv7m_nvic_raw_execution_priority(NVICState *s)
 {
-    NVICState *s = opaque;
-
     return s->exception_prio;
 }
 
@@ -XXX,XX +XXX,XX @@ static void nvic_irq_update(NVICState *s)
  * if @secure is true and @irq does not specify one of the fixed set
  * of architecturally banked exceptions.
  */
-static void armv7m_nvic_clear_pending(void *opaque, int irq, bool secure)
+static void armv7m_nvic_clear_pending(NVICState *s, int irq, bool secure)
 {
-    NVICState *s = (NVICState *)opaque;
     VecInfo *vec;
 
     assert(irq > ARMV7M_EXCP_RESET && irq < s->num_irq);
@@ -XXX,XX +XXX,XX @@ static void do_armv7m_nvic_set_pending(void *opaque, int irq, bool secure,
     }
 }
 
-void armv7m_nvic_set_pending(void *opaque, int irq, bool secure)
+void armv7m_nvic_set_pending(NVICState *s, int irq, bool secure)
 {
-    do_armv7m_nvic_set_pending(opaque, irq, secure, false);
+    do_armv7m_nvic_set_pending(s, irq, secure, false);
 }
 
-void armv7m_nvic_set_pending_derived(void *opaque, int irq, bool secure)
+void armv7m_nvic_set_pending_derived(NVICState *s, int irq, bool secure)
 {
-    do_armv7m_nvic_set_pending(opaque, irq, secure, true);
+    do_armv7m_nvic_set_pending(s, irq, secure, true);
 }
 
-void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure)
+void armv7m_nvic_set_pending_lazyfp(NVICState *s, int irq, bool secure)
 {
     /*
      * Pend an exception during lazy FP stacking. This differs
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure)
      * whether we should escalate depends on the saved context
      * in the FPCCR register, not on the current state of the CPU/NVIC.
      */
-    NVICState *s = (NVICState *)opaque;
     bool banked = exc_is_banked(irq);
     VecInfo *vec;
     bool targets_secure;
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_set_pending_lazyfp(void *opaque, int irq, bool secure)
 }
 
 /* Make pending IRQ active.  */
-void armv7m_nvic_acknowledge_irq(void *opaque)
+void armv7m_nvic_acknowledge_irq(NVICState *s)
 {
-    NVICState *s = (NVICState *)opaque;
     CPUARMState *env = &s->cpu->env;
     const int pending = s->vectpending;
     const int running = nvic_exec_prio(s);
@@ -XXX,XX +XXX,XX @@ static bool vectpending_targets_secure(NVICState *s)
         exc_targets_secure(s, s->vectpending);
 }
 
-void armv7m_nvic_get_pending_irq_info(void *opaque,
+void armv7m_nvic_get_pending_irq_info(NVICState *s,
                                       int *pirq, bool *ptargets_secure)
 {
-    NVICState *s = (NVICState *)opaque;
     const int pending = s->vectpending;
     bool targets_secure;
 
@@ -XXX,XX +XXX,XX @@ void armv7m_nvic_get_pending_irq_info(void *opaque,
     *pirq = pending;
 }
 
-int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
+int armv7m_nvic_complete_irq(NVICState *s, int irq, bool secure)
 {
-    NVICState *s = (NVICState *)opaque;
     VecInfo *vec = NULL;
     int ret = 0;
 
@@ -XXX,XX +XXX,XX @@ int armv7m_nvic_complete_irq(void *opaque, int irq, bool secure)
     return ret;
 }
 
-bool armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
+bool armv7m_nvic_get_ready_status(NVICState *s, int irq, bool secure)
 {
     /*
      * Return whether an exception is "ready", i.e. it is enabled and is
@@ -XXX,XX +XXX,XX @@ bool armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
      * for non-banked exceptions secure is always false; for banked exceptions
      * it indicates which of the exceptions is required.
      */
-    NVICState *s = (NVICState *)opaque;
     bool banked = exc_is_banked(irq);
     VecInfo *vec;
     int running = nvic_exec_prio(s);
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #include "hw/boards.h"
+#include "hw/intc/armv7m_nvic.h"
 #endif
 #include "sysemu/tcg.h"
 #include "sysemu/qtest.h"
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ static void v7m_update_fpccr(CPUARMState *env, uint32_t frameptr,
      * that we will need later in order to do lazy FP reg stacking.
      */
     bool is_secure = env->v7m.secure;
-    void *nvic = env->nvic;
+    NVICState *nvic = env->nvic;
     /*
      * Some bits are unbanked and live always in fpccr[M_REG_S]; some bits
      * are banked and we want to update the bit in the bank for the
-- 
2.34.1

From: Philippe Mathieu-Daudé <philmd@linaro.org>

While dozens of files include "cpu.h", only 3 files require
these NVIC helper declarations.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230206223502.25122-12-philmd@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/intc/armv7m_nvic.h | 123 ++++++++++++++++++++++++++++++++++
 target/arm/cpu.h              | 123 ----------------------------------
 target/arm/cpu.c              |   4 +-
 target/arm/cpu_tcg.c          |   3 +
 target/arm/m_helper.c         |   3 +
 5 files changed, 132 insertions(+), 124 deletions(-)

diff --git a/include/hw/intc/armv7m_nvic.h b/include/hw/intc/armv7m_nvic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/armv7m_nvic.h
+++ b/include/hw/intc/armv7m_nvic.h
@@ -XXX,XX +XXX,XX @@ struct NVICState {
     qemu_irq sysresetreq;
 };
 
+/* Interface between CPU and Interrupt controller.  */
+/**
+ * armv7m_nvic_set_pending: mark the specified exception as pending
+ * @s: the NVIC
+ * @irq: the exception number to mark pending
+ * @secure: false for non-banked exceptions or for the nonsecure
+ * version of a banked exception, true for the secure version of a banked
+ * exception.
+ *
+ * Marks the specified exception as pending. Note that we will assert()
+ * if @secure is true and @irq does not specify one of the fixed set
+ * of architecturally banked exceptions.
+ */
+void armv7m_nvic_set_pending(NVICState *s, int irq, bool secure);
+/**
+ * armv7m_nvic_set_pending_derived: mark this derived exception as pending
+ * @s: the NVIC
+ * @irq: the exception number to mark pending
+ * @secure: false for non-banked exceptions or for the nonsecure
+ * version of a banked exception, true for the secure version of a banked
+ * exception.
+ *
+ * Similar to armv7m_nvic_set_pending(), but specifically for derived
+ * exceptions (exceptions generated in the course of trying to take
+ * a different exception).
+ */
+void armv7m_nvic_set_pending_derived(NVICState *s, int irq, bool secure);
+/**
+ * armv7m_nvic_set_pending_lazyfp: mark this lazy FP exception as pending
+ * @s: the NVIC
+ * @irq: the exception number to mark pending
+ * @secure: false for non-banked exceptions or for the nonsecure
+ * version of a banked exception, true for the secure version of a banked
+ * exception.
+ *
+ * Similar to armv7m_nvic_set_pending(), but specifically for exceptions
+ * generated in the course of lazy stacking of FP registers.
+ */
+void armv7m_nvic_set_pending_lazyfp(NVICState *s, int irq, bool secure);
+/**
+ * armv7m_nvic_get_pending_irq_info: return highest priority pending
+ *    exception, and whether it targets Secure state
+ * @s: the NVIC
+ * @pirq: set to pending exception number
+ * @ptargets_secure: set to whether pending exception targets Secure
+ *
+ * This function writes the number of the highest priority pending
+ * exception (the one which would be made active by
+ * armv7m_nvic_acknowledge_irq()) to @pirq, and sets @ptargets_secure
+ * to true if the current highest priority pending exception should
+ * be taken to Secure state, false for NS.
+ */
+void armv7m_nvic_get_pending_irq_info(NVICState *s, int *pirq,
+                                      bool *ptargets_secure);
+/**
+ * armv7m_nvic_acknowledge_irq: make highest priority pending exception active
+ * @s: the NVIC
+ *
+ * Move the current highest priority pending exception from the pending
+ * state to the active state, and update v7m.exception to indicate that
+ * it is the exception currently being handled.
+ */
+void armv7m_nvic_acknowledge_irq(NVICState *s);
+/**
+ * armv7m_nvic_complete_irq: complete specified interrupt or exception
+ * @s: the NVIC
+ * @irq: the exception number to complete
+ * @secure: true if this exception was secure
+ *
+ * Returns: -1 if the irq was not active
+ *           1 if completing this irq brought us back to base (no active irqs)
+ *           0 if there is still an irq active after this one was completed
+ * (Ignoring -1, this is the same as the RETTOBASE value before completion.)
+ */
+int armv7m_nvic_complete_irq(NVICState *s, int irq, bool secure);
+/**
+ * armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
+ * @s: the NVIC
+ * @irq: the exception number to mark pending
+ * @secure: false for non-banked exceptions or for the nonsecure
+ * version of a banked exception, true for the secure version of a banked
+ * exception.
+ *
+ * Return whether an exception is "ready", i.e. whether the exception is
+ * enabled and is configured at a priority which would allow it to
+ * interrupt the current execution priority. This controls whether the
+ * RDY bit for it in the FPCCR is set.
+ */
+bool armv7m_nvic_get_ready_status(NVICState *s, int irq, bool secure);
+/**
+ * armv7m_nvic_raw_execution_priority: return the raw execution priority
+ * @s: the NVIC
+ *
+ * Returns: the raw execution priority as defined by the v8M architecture.
+ * This is the execution priority minus the effects of AIRCR.PRIS,
+ * and minus any PRIMASK/FAULTMASK/BASEPRI priority boosting.
+ * (v8M ARM ARM I_PKLD.)
+ */
+int armv7m_nvic_raw_execution_priority(NVICState *s);
+/**
+ * armv7m_nvic_neg_prio_requested: return true if the requested execution
+ * priority is negative for the specified security state.
+ * @s: the NVIC
+ * @secure: the security state to test
+ * This corresponds to the pseudocode IsReqExecPriNeg().
+ */
+#ifndef CONFIG_USER_ONLY
+bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure);
+#else
+static inline bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure)
+{
+    return false;
+}
+#endif
+#ifndef CONFIG_USER_ONLY
+bool armv7m_nvic_can_take_pending_exception(NVICState *s);
+#else
+static inline bool armv7m_nvic_can_take_pending_exception(NVICState *s)
+{
+    return true;
+}
+#endif
+
 #endif
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_list(void);
 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
                                  uint32_t cur_el, bool secure);
 
-/* Interface between CPU and Interrupt controller.  */
-#ifndef CONFIG_USER_ONLY
-bool armv7m_nvic_can_take_pending_exception(NVICState *s);
-#else
-static inline bool armv7m_nvic_can_take_pending_exception(NVICState *s)
-{
-    return true;
-}
-#endif
-/**
- * armv7m_nvic_set_pending: mark the specified exception as pending
- * @s: the NVIC
- * @irq: the exception number to mark pending
- * @secure: false for non-banked exceptions or for the nonsecure
- * version of a banked exception, true for the secure version of a banked
- * exception.
- *
- * Marks the specified exception as pending. Note that we will assert()
- * if @secure is true and @irq does not specify one of the fixed set
- * of architecturally banked exceptions.
- */
-void armv7m_nvic_set_pending(NVICState *s, int irq, bool secure);
-/**
- * armv7m_nvic_set_pending_derived: mark this derived exception as pending
- * @s: the NVIC
- * @irq: the exception number to mark pending
- * @secure: false for non-banked exceptions or for the nonsecure
- * version of a banked exception, true for the secure version of a banked
- * exception.
- *
- * Similar to armv7m_nvic_set_pending(), but specifically for derived
- * exceptions (exceptions generated in the course of trying to take
- * a different exception).
- */
-void armv7m_nvic_set_pending_derived(NVICState *s, int irq, bool secure);
-/**
- * armv7m_nvic_set_pending_lazyfp: mark this lazy FP exception as pending
- * @s: the NVIC
- * @irq: the exception number to mark pending
- * @secure: false for non-banked exceptions or for the nonsecure
- * version of a banked exception, true for the secure version of a banked
- * exception.
- *
- * Similar to armv7m_nvic_set_pending(), but specifically for exceptions
- * generated in the course of lazy stacking of FP registers.
- */
-void armv7m_nvic_set_pending_lazyfp(NVICState *s, int irq, bool secure);
-/**
- * armv7m_nvic_get_pending_irq_info: return highest priority pending
- *    exception, and whether it targets Secure state
- * @s: the NVIC
- * @pirq: set to pending exception number
- * @ptargets_secure: set to whether pending exception targets Secure
- *
- * This function writes the number of the highest priority pending
- * exception (the one which would be made active by
- * armv7m_nvic_acknowledge_irq()) to @pirq, and sets @ptargets_secure
- * to true if the current highest priority pending exception should
- * be taken to Secure state, false for NS.
- */
-void armv7m_nvic_get_pending_irq_info(NVICState *s, int *pirq,
-                                      bool *ptargets_secure);
-/**
- * armv7m_nvic_acknowledge_irq: make highest priority pending exception active
- * @s: the NVIC
- *
- * Move the current highest priority pending exception from the pending
- * state to the active state, and update v7m.exception to indicate that
- * it is the exception currently being handled.
- */
-void armv7m_nvic_acknowledge_irq(NVICState *s);
-/**
- * armv7m_nvic_complete_irq: complete specified interrupt or exception
- * @s: the NVIC
- * @irq: the exception number to complete
- * @secure: true if this exception was secure
- *
- * Returns: -1 if the irq was not active
- *           1 if completing this irq brought us back to base (no active irqs)
- *           0 if there is still an irq active after this one was completed
- * (Ignoring -1, this is the same as the RETTOBASE value before completion.)
- */
-int armv7m_nvic_complete_irq(NVICState *s, int irq, bool secure);
-/**
- * armv7m_nvic_get_ready_status(void *opaque, int irq, bool secure)
- * @s: the NVIC
- * @irq: the exception number to mark pending
- * @secure: false for non-banked exceptions or for the nonsecure
- * version of a banked exception, true for the secure version of a banked
- * exception.
- *
- * Return whether an exception is "ready", i.e. whether the exception is
- * enabled and is configured at a priority which would allow it to
- * interrupt the current execution priority. This controls whether the
- * RDY bit for it in the FPCCR is set.
- */
-bool armv7m_nvic_get_ready_status(NVICState *s, int irq, bool secure);
-/**
- * armv7m_nvic_raw_execution_priority: return the raw execution priority
- * @s: the NVIC
- *
- * Returns: the raw execution priority as defined by the v8M architecture.
- * This is the execution priority minus the effects of AIRCR.PRIS,
- * and minus any PRIMASK/FAULTMASK/BASEPRI priority boosting.
- * (v8M ARM ARM I_PKLD.)
- */
-int armv7m_nvic_raw_execution_priority(NVICState *s);
-/**
- * armv7m_nvic_neg_prio_requested: return true if the requested execution
- * priority is negative for the specified security state.
- * @s: the NVIC
- * @secure: the security state to test
- * This corresponds to the pseudocode IsReqExecPriNeg().
- */
-#ifndef CONFIG_USER_ONLY
-bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure);
-#else
-static inline bool armv7m_nvic_neg_prio_requested(NVICState *s, bool secure)
-{
-    return false;
-}
-#endif
-
 /* Interface for defining coprocessor registers.
  * Registers are defined in tables of arm_cp_reginfo structs
  * which are passed to define_arm_cp_regs().
diff --git a/target/arm/cpu.c b/target/arm/cpu.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.c
+++ b/target/arm/cpu.c
@@ -XXX,XX +XXX,XX @@
 #if !defined(CONFIG_USER_ONLY)
 #include "hw/loader.h"
 #include "hw/boards.h"
+#ifdef CONFIG_TCG
 #include "hw/intc/armv7m_nvic.h"
-#endif
+#endif /* CONFIG_TCG */
+#endif /* !CONFIG_USER_ONLY */
 #include "sysemu/tcg.h"
 #include "sysemu/qtest.h"
 #include "sysemu/hw_accel.h"
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/boards.h"
 #endif
 #include "cpregs.h"
+#if !defined(CONFIG_USER_ONLY) && defined(CONFIG_TCG)
+#include "hw/intc/armv7m_nvic.h"
+#endif
 
 
 /* Share AArch32 -cpu max features with AArch64. */
diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/cpu_ldst.h"
 #include "semihosting/common-semi.h"
 #endif
+#if !defined(CONFIG_USER_ONLY)
+#include "hw/intc/armv7m_nvic.h"
+#endif
 
 static void v7m_msr_xpsr(CPUARMState *env, uint32_t mask,
                          uint32_t reg, uint32_t val)
-- 
2.34.1

From: Alex Bennée <alex.bennee@linaro.org>

The two TCG tests for GICv2 and GICv3 are very heavy weight distros
that take a long time to boot up, especially for an --enable-debug
build. The total code coverage they give is:

Overall coverage rate:
    lines......: 11.2% (59584 of 530123 lines)
    functions..: 15.0% (7436 of 49443 functions)
    branches...: 6.3% (19273 of 303933 branches)

We already get pretty close to that with the machine_aarch64_virt
tests which only does one full boot (~120s vs ~600s) of alpine. We
expand the kernel+initrd boot (~8s) to test both GICs and also add an
RNG device and a block device to generate a few IRQs and exercise the
storage layer. With that we get to a coverage of:

Overall coverage rate:
    lines......: 11.0% (58121 of 530123 lines)
    functions..: 14.9% (7343 of 49443 functions)
    branches...: 6.0% (18269 of 303933 branches)

which I feel is close enough given the massive time saving. If we want
to target any more sub-systems we can use lighter weight more directed
tests.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230203181632.2919715-1-alex.bennee@linaro.org
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/avocado/boot_linux.py           | 48 ++++----------------
 tests/avocado/machine_aarch64_virt.py | 63 ++++++++++++++++++++++++---
 2 files changed, 65 insertions(+), 46 deletions(-)

diff --git a/tests/avocado/boot_linux.py b/tests/avocado/boot_linux.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/avocado/boot_linux.py
+++ b/tests/avocado/boot_linux.py
@@ -XXX,XX +XXX,XX @@ def test_pc_q35_kvm(self):
         self.launch_and_wait(set_up_ssh_connection=False)
 
 
-# For Aarch64 we only boot KVM tests in CI as the TCG tests are very
-# heavyweight. There are lighter weight distros which we use in the
-# machine_aarch64_virt.py tests.
+# For Aarch64 we only boot KVM tests in CI as booting the current
+# Fedora OS in TCG tests is very heavyweight. There are lighter weight
+# distros which we use in the machine_aarch64_virt.py tests.
 class BootLinuxAarch64(LinuxTest):
     """
     :avocado: tags=arch:aarch64
     :avocado: tags=machine:virt
-    :avocado: tags=machine:gic-version=2
     """
     timeout = 720
 
-    def add_common_args(self):
-        self.vm.add_args('-bios',
-                         os.path.join(BUILD_DIR, 'pc-bios',
-                                      'edk2-aarch64-code.fd'))
-        self.vm.add_args('-device', 'virtio-rng-pci,rng=rng0')
-        self.vm.add_args('-object', 'rng-random,id=rng0,filename=/dev/urandom')
-
-    @skipIf(os.getenv('GITLAB_CI'), 'Running on GitLab')
-    def test_fedora_cloud_tcg_gicv2(self):
-        """
-        :avocado: tags=accel:tcg
-        :avocado: tags=cpu:max
-        :avocado: tags=device:gicv2
-        """
-        self.require_accelerator("tcg")
-        self.vm.add_args("-accel", "tcg")
-        self.vm.add_args("-cpu", "max,lpa2=off")
-        self.vm.add_args("-machine", "virt,gic-version=2")
-        self.add_common_args()
-        self.launch_and_wait(set_up_ssh_connection=False)
-
-    @skipIf(os.getenv('GITLAB_CI'), 'Running on GitLab')
-    def test_fedora_cloud_tcg_gicv3(self):
-        """
-        :avocado: tags=accel:tcg
-        :avocado: tags=cpu:max
-        :avocado: tags=device:gicv3
-        """
-        self.require_accelerator("tcg")
-        self.vm.add_args("-accel", "tcg")
-        self.vm.add_args("-cpu", "max,lpa2=off")
-        self.vm.add_args("-machine", "virt,gic-version=3")
-        self.add_common_args()
-        self.launch_and_wait(set_up_ssh_connection=False)
-
     def test_virt_kvm(self):
         """
         :avocado: tags=accel:kvm
@@ -XXX,XX +XXX,XX @@ def test_virt_kvm(self):
         self.require_accelerator("kvm")
         self.vm.add_args("-accel", "kvm")
         self.vm.add_args("-machine", "virt,gic-version=host")
-        self.add_common_args()
+        self.vm.add_args('-bios',
+                         os.path.join(BUILD_DIR, 'pc-bios',
+                                      'edk2-aarch64-code.fd'))
+        self.vm.add_args('-device', 'virtio-rng-pci,rng=rng0')
+        self.vm.add_args('-object', 'rng-random,id=rng0,filename=/dev/urandom')
         self.launch_and_wait(set_up_ssh_connection=False)
 
 
diff --git a/tests/avocado/machine_aarch64_virt.py b/tests/avocado/machine_aarch64_virt.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/avocado/machine_aarch64_virt.py
+++ b/tests/avocado/machine_aarch64_virt.py
@@ -XXX,XX +XXX,XX @@
 
 import time
 import os
+import logging
 
 from avocado_qemu import QemuSystemTest
 from avocado_qemu import wait_for_console_pattern
 from avocado_qemu import exec_command
 from avocado_qemu import BUILD_DIR
+from avocado.utils import process
+from avocado.utils.path import find_command
 
 class Aarch64VirtMachine(QemuSystemTest):
     KERNEL_COMMON_COMMAND_LINE = 'printk.time=0 '
@@ -XXX,XX +XXX,XX @@ def test_alpine_virt_tcg_gic_max(self):
         self.wait_for_console_pattern('Welcome to Alpine Linux 3.16')
 
 
-    def test_aarch64_virt(self):
+    def common_aarch64_virt(self, machine):
         """
-        :avocado: tags=arch:aarch64
-        :avocado: tags=machine:virt
-        :avocado: tags=accel:tcg
-        :avocado: tags=cpu:max
+        Common code to launch basic virt machine with kernel+initrd
+        and a scratch disk.
         """
+        logger = logging.getLogger('aarch64_virt')
+
         kernel_url = ('https://fileserver.linaro.org/s/'
                       'z6B2ARM7DQT3HWN/download')
-
         kernel_hash = 'ed11daab50c151dde0e1e9c9cb8b2d9bd3215347'
         kernel_path = self.fetch_asset(kernel_url, asset_hash=kernel_hash)
 
@@ -XXX,XX +XXX,XX @@ def test_aarch64_virt(self):
                                'console=ttyAMA0')
         self.require_accelerator("tcg")
         self.vm.add_args('-cpu', 'max,pauth-impdef=on',
+                         '-machine', machine,
                          '-accel', 'tcg',
                          '-kernel', kernel_path,
                          '-append', kernel_command_line)
+
+        # A RNG offers an easy way to generate a few IRQs
+        self.vm.add_args('-device', 'virtio-rng-pci,rng=rng0')
+        self.vm.add_args('-object',
+                         'rng-random,id=rng0,filename=/dev/urandom')
+
+        # Also add a scratch block device
+        logger.info('creating scratch qcow2 image')
+        image_path = os.path.join(self.workdir, 'scratch.qcow2')
+        qemu_img = os.path.join(BUILD_DIR, 'qemu-img')
+        if not os.path.exists(qemu_img):
+            qemu_img = find_command('qemu-img', False)
+        if qemu_img is False:
+            self.cancel('Could not find "qemu-img", which is required to '
+                        'create the temporary qcow2 image')
+        cmd = '%s create -f qcow2 %s 8M' % (qemu_img, image_path)
+        process.run(cmd)
+
+        # Add the device
+        self.vm.add_args('-blockdev',
+                         f"driver=qcow2,file.driver=file,file.filename={image_path},node-name=scratch")
+        self.vm.add_args('-device',
+                         'virtio-blk-device,drive=scratch')
+
         self.vm.launch()
         self.wait_for_console_pattern('Welcome to Buildroot')
         time.sleep(0.1)
         exec_command(self, 'root')
         time.sleep(0.1)
+        exec_command(self, 'dd if=/dev/hwrng of=/dev/vda bs=512 count=4')
+        time.sleep(0.1)
+        exec_command(self, 'md5sum /dev/vda')
+        time.sleep(0.1)
+        exec_command(self, 'cat /proc/interrupts')
+        time.sleep(0.1)
         exec_command(self, 'cat /proc/self/maps')
         time.sleep(0.1)
+
+    def test_aarch64_virt_gicv3(self):
+        """
+        :avocado: tags=arch:aarch64
+        :avocado: tags=machine:virt
+        :avocado: tags=accel:tcg
+        :avocado: tags=cpu:max
+        """
+        self.common_aarch64_virt("virt,gic_version=3")
+
+    def test_aarch64_virt_gicv2(self):
+        """
+        :avocado: tags=arch:aarch64
+        :avocado: tags=machine:virt
+        :avocado: tags=accel:tcg
+        :avocado: tags=cpu:max
+        """
+        self.common_aarch64_virt("virt,gic-version=2")
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

GBPA register can be used to globally abort all
transactions.

It is described in the SMMU manual in "6.3.14 SMMU_GBPA".
ABORT reset value is IMPLEMENTATION DEFINED, it is chosen to
be zero(Do not abort incoming transactions).

Other fields have default values of Use Incoming.

If UPDATE is not set, the write is ignored. This is the only permitted
behavior in SMMUv3.2 and later.(6.3.14.1 Update procedure)

As this patch adds a new state to the SMMU (GBPA), it is added
in a new subsection for forward migration compatibility.
GBPA is only migrated if its value is different from the reset value.
It does this to be backward migration compatible if SW didn't write
the register.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20230214094009.2445653-1-smostafa@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h |  7 +++++++
 include/hw/arm/smmuv3.h  |  1 +
 hw/arm/smmuv3.c          | 43 +++++++++++++++++++++++++++++++++++++++-
 3 files changed, 50 insertions(+), 1 deletion(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ REG32(CR0ACK,              0x24)
 REG32(CR1,                 0x28)
 REG32(CR2,                 0x2c)
 REG32(STATUSR,             0x40)
+REG32(GBPA,                0x44)
+    FIELD(GBPA, ABORT,        20, 1)
+    FIELD(GBPA, UPDATE,       31, 1)
+
+/* Use incoming. */
+#define SMMU_GBPA_RESET_VAL 0x1000
+
 REG32(IRQ_CTRL,            0x50)
     FIELD(IRQ_CTRL, GERROR_IRQEN,        0, 1)
     FIELD(IRQ_CTRL, PRI_IRQEN,           1, 1)
diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmuv3.h
+++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@ struct SMMUv3State {
     uint32_t cr[3];
     uint32_t cr0ack;
     uint32_t statusr;
+    uint32_t gbpa;
     uint32_t irq_ctrl;
     uint32_t gerror;
     uint32_t gerrorn;
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_init_regs(SMMUv3State *s)
     s->gerror = 0;
     s->gerrorn = 0;
     s->statusr = 0;
+    s->gbpa = SMMU_GBPA_RESET_VAL;
 }
 
 static int smmu_get_ste(SMMUv3State *s, dma_addr_t addr, STE *buf,
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
     qemu_mutex_lock(&s->mutex);
 
     if (!smmu_enabled(s)) {
-        status = SMMU_TRANS_DISABLE;
+        if (FIELD_EX32(s->gbpa, GBPA, ABORT)) {
+            status = SMMU_TRANS_ABORT;
+        } else {
+            status = SMMU_TRANS_DISABLE;
+        }
         goto epilogue;
     }
 
@@ -XXX,XX +XXX,XX @@ static MemTxResult smmu_writel(SMMUv3State *s, hwaddr offset,
     case A_GERROR_IRQ_CFG2:
         s->gerror_irq_cfg2 = data;
         return MEMTX_OK;
+    case A_GBPA:
+        /*
+         * If UPDATE is not set, the write is ignored. This is the only
+         * permitted behavior in SMMUv3.2 and later.
+         */
+        if (data & R_GBPA_UPDATE_MASK) {
+            /* Ignore update bit as write is synchronous. */
+            s->gbpa = data & ~R_GBPA_UPDATE_MASK;
+        }
+        return MEMTX_OK;
     case A_STRTAB_BASE: /* 64b */
         s->strtab_base = deposit64(s->strtab_base, 0, 32, data);
         return MEMTX_OK;
@@ -XXX,XX +XXX,XX @@ static MemTxResult smmu_readl(SMMUv3State *s, hwaddr offset,
     case A_STATUSR:
         *data = s->statusr;
         return MEMTX_OK;
+    case A_GBPA:
+        *data = s->gbpa;
+        return MEMTX_OK;
     case A_IRQ_CTRL:
     case A_IRQ_CTRL_ACK:
         *data = s->irq_ctrl;
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3_queue = {
     },
 };
 
+static bool smmuv3_gbpa_needed(void *opaque)
+{
+    SMMUv3State *s = opaque;
+
+    /* Only migrate GBPA if it has different reset value. */
+    return s->gbpa != SMMU_GBPA_RESET_VAL;
+}
+
+static const VMStateDescription vmstate_gbpa = {
+    .name = "smmuv3/gbpa",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = smmuv3_gbpa_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(gbpa, SMMUv3State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 static const VMStateDescription vmstate_smmuv3 = {
     .name = "smmuv3",
     .version_id = 1,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3 = {
 
         VMSTATE_END_OF_LIST(),
     },
+    .subsections = (const VMStateDescription * []) {
+        &vmstate_gbpa,
+        NULL
+    }
 };
 
 static void smmuv3_instance_init(Object *obj)
-- 
2.34.1

From: Cornelia Huck <cohuck@redhat.com>

Just use current_accel_name() directly.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void machvirt_init(MachineState *machine)
     if (vms->secure && (kvm_enabled() || hvf_enabled())) {
         error_report("mach-virt: %s does not support providing "
                      "Security extensions (TrustZone) to the guest CPU",
-                     kvm_enabled() ? "KVM" : "HVF");
+                     current_accel_name());
         exit(1);
     }
 
     if (vms->virt && (kvm_enabled() || hvf_enabled())) {
         error_report("mach-virt: %s does not support providing "
                      "Virtualization extensions to the guest CPU",
-                     kvm_enabled() ? "KVM" : "HVF");
+                     current_accel_name());
         exit(1);
     }
 
     if (vms->mte && (kvm_enabled() || hvf_enabled())) {
         error_report("mach-virt: %s does not support providing "
                      "MTE to the guest CPU",
-                     kvm_enabled() ? "KVM" : "HVF");
+                     current_accel_name());
         exit(1);
     }
 
-- 
2.34.1

From: Hao Wu <wuhaotsh@google.com>

Nuvoton's PSPI is a general purpose SPI module which enables
connections to SPI-based peripheral devices.

Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Chris Rauer <crauer@google.com>
Reviewed-by: Philippe Mathieu-Daude <philmd@linaro.org>
Message-id: 20230208235433.3989937-3-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS                |   6 +-
 include/hw/ssi/npcm_pspi.h |  53 +++++++++
 hw/ssi/npcm_pspi.c         | 221 +++++++++++++++++++++++++++++++++++++
 hw/ssi/meson.build         |   2 +-
 hw/ssi/trace-events        |   5 +
 5 files changed, 283 insertions(+), 4 deletions(-)
 create mode 100644 include/hw/ssi/npcm_pspi.h
 create mode 100644 hw/ssi/npcm_pspi.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Tyrone Ting <kfting@nuvoton.com>
 M: Hao Wu <wuhaotsh@google.com>
 L: qemu-arm@nongnu.org
 S: Supported
-F: hw/*/npcm7xx*
-F: include/hw/*/npcm7xx*
-F: tests/qtest/npcm7xx*
+F: hw/*/npcm*
+F: include/hw/*/npcm*
+F: tests/qtest/npcm*
 F: pc-bios/npcm7xx_bootrom.bin
 F: roms/vbootrom
 F: docs/system/arm/nuvoton.rst
diff --git a/include/hw/ssi/npcm_pspi.h b/include/hw/ssi/npcm_pspi.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/ssi/npcm_pspi.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Nuvoton Peripheral SPI Module
+ *
+ * Copyright 2023 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+#ifndef NPCM_PSPI_H
+#define NPCM_PSPI_H
+
+#include "hw/ssi/ssi.h"
+#include "hw/sysbus.h"
+
+/*
+ * Number of registers in our device state structure. Don't change this without
+ * incrementing the version_id in the vmstate.
+ */
+#define NPCM_PSPI_NR_REGS 3
+
+/**
+ * NPCMPSPIState - Device state for one Flash Interface Unit.
+ * @parent: System bus device.
+ * @mmio: Memory region for register access.
+ * @spi: The SPI bus mastered by this controller.
+ * @regs: Register contents.
+ * @irq: The interrupt request queue for this module.
+ *
+ * Each PSPI has a shared bank of registers, and controls up to four chip
+ * selects. Each chip select has a dedicated memory region which may be used to
+ * read and write the flash connected to that chip select as if it were memory.
+ */
+typedef struct NPCMPSPIState {
+    SysBusDevice parent;
+
+    MemoryRegion mmio;
+
+    SSIBus *spi;
+    uint16_t regs[NPCM_PSPI_NR_REGS];
+    qemu_irq irq;
+} NPCMPSPIState;
+
+#define TYPE_NPCM_PSPI "npcm-pspi"
+OBJECT_DECLARE_SIMPLE_TYPE(NPCMPSPIState, NPCM_PSPI)
+
+#endif /* NPCM_PSPI_H */
diff --git a/hw/ssi/npcm_pspi.c b/hw/ssi/npcm_pspi.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/ssi/npcm_pspi.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Nuvoton NPCM Peripheral SPI Module (PSPI)
+ *
+ * Copyright 2023 Google LLC
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
+ * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
+ * for more details.
+ */
+
+#include "qemu/osdep.h"
+
+#include "hw/irq.h"
+#include "hw/registerfields.h"
+#include "hw/ssi/npcm_pspi.h"
+#include "migration/vmstate.h"
+#include "qapi/error.h"
+#include "qemu/error-report.h"
+#include "qemu/log.h"
+#include "qemu/module.h"
+#include "qemu/units.h"
+
+#include "trace.h"
+
+REG16(PSPI_DATA, 0x0)
+REG16(PSPI_CTL1, 0x2)
+    FIELD(PSPI_CTL1, SPIEN, 0,  1)
+    FIELD(PSPI_CTL1, MOD,   2,  1)
+    FIELD(PSPI_CTL1, EIR,   5,  1)
+    FIELD(PSPI_CTL1, EIW,   6,  1)
+    FIELD(PSPI_CTL1, SCM,   7,  1)
+    FIELD(PSPI_CTL1, SCIDL, 8,  1)
+    FIELD(PSPI_CTL1, SCDV,  9,  7)
+REG16(PSPI_STAT, 0x4)
+    FIELD(PSPI_STAT, BSY,  0,  1)
+    FIELD(PSPI_STAT, RBF,  1,  1)
+
+static void npcm_pspi_update_irq(NPCMPSPIState *s)
+{
+    int level = 0;
+
+    /* Only fire IRQ when the module is enabled. */
+    if (FIELD_EX16(s->regs[R_PSPI_CTL1], PSPI_CTL1, SPIEN)) {
+        /* Update interrupt as BSY is cleared. */
+        if ((!FIELD_EX16(s->regs[R_PSPI_STAT], PSPI_STAT, BSY)) &&
+            FIELD_EX16(s->regs[R_PSPI_CTL1], PSPI_CTL1, EIW)) {
+            level = 1;
+        }
+
+        /* Update interrupt as RBF is set. */
+        if (FIELD_EX16(s->regs[R_PSPI_STAT], PSPI_STAT, RBF) &&
+            FIELD_EX16(s->regs[R_PSPI_CTL1], PSPI_CTL1, EIR)) {
+            level = 1;
+        }
+    }
+    qemu_set_irq(s->irq, level);
+}
+
+static uint16_t npcm_pspi_read_data(NPCMPSPIState *s)
+{
+    uint16_t value = s->regs[R_PSPI_DATA];
+
+    /* Clear stat bits as the value are read out. */
+    s->regs[R_PSPI_STAT] = 0;
+
+    return value;
+}
+
+static void npcm_pspi_write_data(NPCMPSPIState *s, uint16_t data)
+{
+    uint16_t value = 0;
+
+    if (FIELD_EX16(s->regs[R_PSPI_CTL1], PSPI_CTL1, MOD)) {
+        value = ssi_transfer(s->spi, extract16(data, 8, 8)) << 8;
+    }
+    value |= ssi_transfer(s->spi, extract16(data, 0, 8));
+    s->regs[R_PSPI_DATA] = value;
+
+    /* Mark data as available */
+    s->regs[R_PSPI_STAT] = R_PSPI_STAT_BSY_MASK | R_PSPI_STAT_RBF_MASK;
+}
+
+/* Control register read handler. */
+static uint64_t npcm_pspi_ctrl_read(void *opaque, hwaddr addr,
+                                    unsigned int size)
+{
+    NPCMPSPIState *s = opaque;
+    uint16_t value;
+
+    switch (addr) {
+    case A_PSPI_DATA:
+        value = npcm_pspi_read_data(s);
+        break;
+
+    case A_PSPI_CTL1:
+        value = s->regs[R_PSPI_CTL1];
+        break;
+
+    case A_PSPI_STAT:
+        value = s->regs[R_PSPI_STAT];
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: write to invalid offset 0x%" PRIx64 "\n",
+                      DEVICE(s)->canonical_path, addr);
+        return 0;
+    }
+    trace_npcm_pspi_ctrl_read(DEVICE(s)->canonical_path, addr, value);
+    npcm_pspi_update_irq(s);
+
+    return value;
+}
+
+/* Control register write handler. */
+static void npcm_pspi_ctrl_write(void *opaque, hwaddr addr, uint64_t v,
+                                 unsigned int size)
+{
+    NPCMPSPIState *s = opaque;
+    uint16_t value = v;
+
+    trace_npcm_pspi_ctrl_write(DEVICE(s)->canonical_path, addr, value);
+
+    switch (addr) {
+    case A_PSPI_DATA:
+        npcm_pspi_write_data(s, value);
+        break;
+
+    case A_PSPI_CTL1:
+        s->regs[R_PSPI_CTL1] = value;
+        break;
+
+    case A_PSPI_STAT:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: write to read-only register PSPI_STAT: 0x%08"
+                      PRIx64 "\n", DEVICE(s)->canonical_path, v);
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: write to invalid offset 0x%" PRIx64 "\n",
+                      DEVICE(s)->canonical_path, addr);
+        return;
+    }
+    npcm_pspi_update_irq(s);
+}
+
+static const MemoryRegionOps npcm_pspi_ctrl_ops = {
+    .read = npcm_pspi_ctrl_read,
+    .write = npcm_pspi_ctrl_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 1,
+        .max_access_size = 2,
+        .unaligned = false,
+    },
+    .impl = {
+        .min_access_size = 2,
+        .max_access_size = 2,
+        .unaligned = false,
+    },
+};
+
+static void npcm_pspi_enter_reset(Object *obj, ResetType type)
+{
+    NPCMPSPIState *s = NPCM_PSPI(obj);
+
+    trace_npcm_pspi_enter_reset(DEVICE(obj)->canonical_path, type);
+    memset(s->regs, 0, sizeof(s->regs));
+}
+
+static void npcm_pspi_realize(DeviceState *dev, Error **errp)
+{
+    NPCMPSPIState *s = NPCM_PSPI(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+    Object *obj = OBJECT(dev);
+
+    s->spi = ssi_create_bus(dev, "pspi");
+    memory_region_init_io(&s->mmio, obj, &npcm_pspi_ctrl_ops, s,
+                          "mmio", 4 * KiB);
+    sysbus_init_mmio(sbd, &s->mmio);
+    sysbus_init_irq(sbd, &s->irq);
+}
+
+static const VMStateDescription vmstate_npcm_pspi = {
+    .name = "npcm-pspi",
+    .version_id = 0,
+    .minimum_version_id = 0,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT16_ARRAY(regs, NPCMPSPIState, NPCM_PSPI_NR_REGS),
+        VMSTATE_END_OF_LIST(),
+    },
+};
+
+
+static void npcm_pspi_class_init(ObjectClass *klass, void *data)
+{
+    ResettableClass *rc = RESETTABLE_CLASS(klass);
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->desc = "NPCM Peripheral SPI Module";
+    dc->realize = npcm_pspi_realize;
+    dc->vmsd = &vmstate_npcm_pspi;
+    rc->phases.enter = npcm_pspi_enter_reset;
+}
+
+static const TypeInfo npcm_pspi_types[] = {
+    {
+        .name = TYPE_NPCM_PSPI,
+        .parent = TYPE_SYS_BUS_DEVICE,
+        .instance_size = sizeof(NPCMPSPIState),
+        .class_init = npcm_pspi_class_init,
+    },
+};
+DEFINE_TYPES(npcm_pspi_types);
diff --git a/hw/ssi/meson.build b/hw/ssi/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/meson.build
+++ b/hw/ssi/meson.build
@@ -XXX,XX +XXX,XX @@
 softmmu_ss.add(when: 'CONFIG_ASPEED_SOC', if_true: files('aspeed_smc.c'))
 softmmu_ss.add(when: 'CONFIG_MSF2', if_true: files('mss-spi.c'))
-softmmu_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx_fiu.c'))
+softmmu_ss.add(when: 'CONFIG_NPCM7XX', if_true: files('npcm7xx_fiu.c', 'npcm_pspi.c'))
 softmmu_ss.add(when: 'CONFIG_PL022', if_true: files('pl022.c'))
 softmmu_ss.add(when: 'CONFIG_SIFIVE_SPI', if_true: files('sifive_spi.c'))
 softmmu_ss.add(when: 'CONFIG_SSI', if_true: files('ssi.c'))
diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/trace-events
+++ b/hw/ssi/trace-events
@@ -XXX,XX +XXX,XX @@ npcm7xx_fiu_ctrl_write(const char *id, uint64_t addr, uint32_t data) "%s offset:
 npcm7xx_fiu_flash_read(const char *id, int cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
 npcm7xx_fiu_flash_write(const char *id, unsigned cs, uint64_t addr, unsigned int size, uint64_t value) "%s[%d] offset: 0x%08" PRIx64 " size: %u value: 0x%" PRIx64
 
+# npcm_pspi.c
+npcm_pspi_enter_reset(const char *id, int reset_type) "%s reset type: %d"
+npcm_pspi_ctrl_read(const char *id, uint64_t addr, uint16_t data) "%s offset: 0x%03" PRIx64 " value: 0x%04" PRIx16
+npcm_pspi_ctrl_write(const char *id, uint64_t addr, uint16_t data) "%s offset: 0x%03" PRIx64 " value: 0x%04" PRIx16
+
 # ibex_spi_host.c
 
 ibex_spi_host_reset(const char *msg) "%s"
-- 
2.34.1

From: Hao Wu <wuhaotsh@google.com>

Signed-off-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Titus Rwantare <titusr@google.com>
Reviewed-by: Philippe Mathieu-Daude <philmd@linaro.org>
Message-id: 20230208235433.3989937-4-wuhaotsh@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/nuvoton.rst |  2 +-
 include/hw/arm/npcm7xx.h    |  2 ++
 hw/arm/npcm7xx.c            | 25 +++++++++++++++++++++++--
 3 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/docs/system/arm/nuvoton.rst b/docs/system/arm/nuvoton.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/nuvoton.rst
+++ b/docs/system/arm/nuvoton.rst
@@ -XXX,XX +XXX,XX @@ Supported devices
  * SMBus controller (SMBF)
  * Ethernet controller (EMC)
  * Tachometer
+ * Peripheral SPI controller (PSPI)
 
 Missing devices
 ---------------
@@ -XXX,XX +XXX,XX @@ Missing devices
 
  * Ethernet controller (GMAC)
  * USB device (USBD)
- * Peripheral SPI controller (PSPI)
  * SD/MMC host
  * PECI interface
  * PCI and PCIe root complex and bridges
diff --git a/include/hw/arm/npcm7xx.h b/include/hw/arm/npcm7xx.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/npcm7xx.h
+++ b/include/hw/arm/npcm7xx.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/nvram/npcm7xx_otp.h"
 #include "hw/timer/npcm7xx_timer.h"
 #include "hw/ssi/npcm7xx_fiu.h"
+#include "hw/ssi/npcm_pspi.h"
 #include "hw/usb/hcd-ehci.h"
 #include "hw/usb/hcd-ohci.h"
 #include "target/arm/cpu.h"
@@ -XXX,XX +XXX,XX @@ struct NPCM7xxState {
     NPCM7xxFIUState     fiu[2];
     NPCM7xxEMCState     emc[2];
     NPCM7xxSDHCIState   mmc;
+    NPCMPSPIState       pspi[2];
 };
 
 #define TYPE_NPCM7XX    "npcm7xx"
diff --git a/hw/arm/npcm7xx.c b/hw/arm/npcm7xx.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/npcm7xx.c
+++ b/hw/arm/npcm7xx.c
@@ -XXX,XX +XXX,XX @@ enum NPCM7xxInterrupt {
     NPCM7XX_EMC1RX_IRQ          = 15,
     NPCM7XX_EMC1TX_IRQ,
     NPCM7XX_MMC_IRQ             = 26,
+    NPCM7XX_PSPI2_IRQ           = 28,
+    NPCM7XX_PSPI1_IRQ           = 31,
     NPCM7XX_TIMER0_IRQ          = 32,   /* Timer Module 0 */
     NPCM7XX_TIMER1_IRQ,
     NPCM7XX_TIMER2_IRQ,
@@ -XXX,XX +XXX,XX @@ static const hwaddr npcm7xx_emc_addr[] = {
     0xf0826000,
 };
 
+/* Register base address for each PSPI Module */
+static const hwaddr npcm7xx_pspi_addr[] = {
+    0xf0200000,
+    0xf0201000,
+};
+
 static const struct {
     hwaddr regs_addr;
     uint32_t unconnected_pins;
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_init(Object *obj)
         object_initialize_child(obj, "emc[*]", &s->emc[i], TYPE_NPCM7XX_EMC);
     }
 
+    for (i = 0; i < ARRAY_SIZE(s->pspi); i++) {
+        object_initialize_child(obj, "pspi[*]", &s->pspi[i], TYPE_NPCM_PSPI);
+    }
+
     object_initialize_child(obj, "mmc", &s->mmc, TYPE_NPCM7XX_SDHCI);
 }
 
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->mmc), 0,
             npcm7xx_irq(s, NPCM7XX_MMC_IRQ));
 
+    /* PSPI */
+    QEMU_BUILD_BUG_ON(ARRAY_SIZE(npcm7xx_pspi_addr) != ARRAY_SIZE(s->pspi));
+    for (i = 0; i < ARRAY_SIZE(s->pspi); i++) {
+        SysBusDevice *sbd = SYS_BUS_DEVICE(&s->pspi[i]);
+        int irq = (i == 0) ? NPCM7XX_PSPI1_IRQ : NPCM7XX_PSPI2_IRQ;
+
+        sysbus_realize(sbd, &error_abort);
+        sysbus_mmio_map(sbd, 0, npcm7xx_pspi_addr[i]);
+        sysbus_connect_irq(sbd, 0, npcm7xx_irq(s, irq));
+    }
+
     create_unimplemented_device("npcm7xx.shm",          0xc0001000,   4 * KiB);
     create_unimplemented_device("npcm7xx.vdmx",         0xe0800000,   4 * KiB);
     create_unimplemented_device("npcm7xx.pcierc",       0xe1000000,  64 * KiB);
@@ -XXX,XX +XXX,XX @@ static void npcm7xx_realize(DeviceState *dev, Error **errp)
     create_unimplemented_device("npcm7xx.peci",         0xf0100000,   4 * KiB);
     create_unimplemented_device("npcm7xx.siox[1]",      0xf0101000,   4 * KiB);
     create_unimplemented_device("npcm7xx.siox[2]",      0xf0102000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.pspi1",        0xf0200000,   4 * KiB);
-    create_unimplemented_device("npcm7xx.pspi2",        0xf0201000,   4 * KiB);
     create_unimplemented_device("npcm7xx.ahbpci",       0xf0400000,   1 * MiB);
     create_unimplemented_device("npcm7xx.mcphy",        0xf05f0000,  64 * KiB);
     create_unimplemented_device("npcm7xx.gmac1",        0xf0802000,   8 * KiB);
-- 
2.34.1

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

Addresses targeting the second translation table (TTB1) in the SMMU have
all upper bits set. Ensure the IOMMU region covers all 64 bits.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20230214171921.1917916-2-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h | 2 --
 hw/arm/smmu-common.c         | 2 +-
 2 files changed, 1 insertion(+), 3 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@
 #define SMMU_PCI_DEVFN_MAX    256
 #define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
 
-#define SMMU_MAX_VA_BITS      48
-
 /*
  * Page table walk error types
  */
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static AddressSpace *smmu_find_add_as(PCIBus *bus, void *opaque, int devfn)
 
         memory_region_init_iommu(&sdev->iommu, sizeof(sdev->iommu),
                                  s->mrtypename,
-                                 OBJECT(s), name, 1ULL << SMMU_MAX_VA_BITS);
+                                 OBJECT(s), name, UINT64_MAX);
         address_space_init(&sdev->as,
                            MEMORY_REGION(&sdev->iommu), name);
         trace_smmu_add_mr(name);
-- 
2.34.1

From: Jean-Philippe Brucker <jean-philippe@linaro.org>

Addresses targeting the second translation table (TTB1) in the SMMU have
all upper bits set (except for the top byte when TBI is enabled). Fix
the TTB1 check.

Reported-by: Ola Hugosson <ola.hugosson@arm.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230214171921.1917916-3-jean-philippe@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-common.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
         /* there is a ttbr0 region and we are in it (high bits all zero) */
         return &cfg->tt[0];
     } else if (cfg->tt[1].tsz &&
-           !extract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte)) {
+        sextract64(iova, 64 - cfg->tt[1].tsz, cfg->tt[1].tsz - tbi_byte) == -1) {
         /* there is a ttbr1 region and we are in it (high bits all one) */
         return &cfg->tt[1];
     } else if (!cfg->tt[0].tsz) {
-- 
2.34.1

From: Claudio Fontana <cfontana@suse.de>

make it clearer from the name that this is a tcg-only function.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
  * trapped to the hypervisor in KVM.
  */
 #ifdef CONFIG_TCG
-static void handle_semihosting(CPUState *cs)
+static void tcg_handle_semihosting(CPUState *cs)
 {
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
      */
 #ifdef CONFIG_TCG
     if (cs->exception_index == EXCP_SEMIHOST) {
-        handle_semihosting(cs);
+        tcg_handle_semihosting(cs);
         return;
     }
 #endif
-- 
2.34.1

From: Claudio Fontana <cfontana@suse.de>

for "all" builds (tcg + kvm), we want to avoid doing
the psci check if tcg is built-in, but not enabled.

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "sysemu/cpu-timers.h"
 #include "sysemu/kvm.h"
+#include "sysemu/tcg.h"
 #include "qapi/qapi-commands-machine-target.h"
 #include "qapi/error.h"
 #include "qemu/guest-random.h"
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
                       env->exception.syndrome);
     }
 
-    if (arm_is_psci_call(cpu, cs->exception_index)) {
+    if (tcg_enabled() && arm_is_psci_call(cpu, cs->exception_index)) {
         arm_handle_psci_call(cpu);
         qemu_log_mask(CPU_LOG_INT, "...handled as PSCI call\n");
         return;
-- 
2.34.1

From: Claudio Fontana <cfontana@suse.de>

Signed-off-by: Claudio Fontana <cfontana@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
     unsigned int cur_el = arm_current_el(env);
     int rt;
 
-    /*
-     * Note that new_el can never be 0.  If cur_el is 0, then
-     * el0_a64 is is_a64(), else el0_a64 is ignored.
-     */
-    aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
+    if (tcg_enabled()) {
+        /*
+         * Note that new_el can never be 0.  If cur_el is 0, then
+         * el0_a64 is is_a64(), else el0_a64 is ignored.
+         */
+        aarch64_sve_change_el(env, cur_el, new_el, is_a64(env));
+    }
 
     if (cur_el < new_el) {
         /*
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

Move this earlier to make the next patch diff cleaner. While here
update the comment slightly to not give the impression that the
misalignment affects only TCG.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/machine.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/machine.c b/target/arm/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/machine.c
+++ b/target/arm/machine.c
@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
         }
     }
 
+    /*
+     * Misaligned thumb pc is architecturally impossible. Fail the
+     * incoming migration. For TCG it would trigger the assert in
+     * thumb_tr_translate_insn().
+     */
+    if (!is_a64(env) && env->thumb && (env->regs[15] & 1)) {
+        return -1;
+    }
+
     hw_breakpoint_update_all(cpu);
     hw_watchpoint_update_all(cpu);
 
@@ -XXX,XX +XXX,XX @@ static int cpu_post_load(void *opaque, int version_id)
         }
     }
 
-    /*
-     * Misaligned thumb pc is architecturally impossible.
-     * We have an assert in thumb_tr_translate_insn to verify this.
-     * Fail an incoming migrate to avoid this assert.
-     */
-    if (!is_a64(env) && env->thumb && (env->regs[15] & 1)) {
-        return -1;
-    }
-
     if (!kvm_enabled()) {
         pmu_op_finish(&cpu->env);
     }
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

Since commit cf7c6d1004 ("target/arm: Split out cpregs.h") we now have
a cpregs.h header which is more suitable for this code.

Code moved verbatim.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpregs.h | 98 +++++++++++++++++++++++++++++++++++++++++++++
 target/arm/cpu.h    | 91 -----------------------------------------
 2 files changed, 98 insertions(+), 91 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@ enum {
     ARM_CP_SME                   = 1 << 19,
 };
 
+/*
+ * Interface for defining coprocessor registers.
+ * Registers are defined in tables of arm_cp_reginfo structs
+ * which are passed to define_arm_cp_regs().
+ */
+
+/*
+ * When looking up a coprocessor register we look for it
+ * via an integer which encodes all of:
+ *  coprocessor number
+ *  Crn, Crm, opc1, opc2 fields
+ *  32 or 64 bit register (ie is it accessed via MRC/MCR
+ *    or via MRRC/MCRR?)
+ *  non-secure/secure bank (AArch32 only)
+ * We allow 4 bits for opc1 because MRRC/MCRR have a 4 bit field.
+ * (In this case crn and opc2 should be zero.)
+ * For AArch64, there is no 32/64 bit size distinction;
+ * instead all registers have a 2 bit op0, 3 bit op1 and op2,
+ * and 4 bit CRn and CRm. The encoding patterns are chosen
+ * to be easy to convert to and from the KVM encodings, and also
+ * so that the hashtable can contain both AArch32 and AArch64
+ * registers (to allow for interprocessing where we might run
+ * 32 bit code on a 64 bit core).
+ */
+/*
+ * This bit is private to our hashtable cpreg; in KVM register
+ * IDs the AArch64/32 distinction is the KVM_REG_ARM/ARM64
+ * in the upper bits of the 64 bit ID.
+ */
+#define CP_REG_AA64_SHIFT 28
+#define CP_REG_AA64_MASK (1 << CP_REG_AA64_SHIFT)
+
+/*
+ * To enable banking of coprocessor registers depending on ns-bit we
+ * add a bit to distinguish between secure and non-secure cpregs in the
+ * hashtable.
+ */
+#define CP_REG_NS_SHIFT 29
+#define CP_REG_NS_MASK (1 << CP_REG_NS_SHIFT)
+
+#define ENCODE_CP_REG(cp, is64, ns, crn, crm, opc1, opc2)   \
+    ((ns) << CP_REG_NS_SHIFT | ((cp) << 16) | ((is64) << 15) |   \
+     ((crn) << 11) | ((crm) << 7) | ((opc1) << 3) | (opc2))
+
+#define ENCODE_AA64_CP_REG(cp, crn, crm, op0, op1, op2) \
+    (CP_REG_AA64_MASK |                                 \
+     ((cp) << CP_REG_ARM_COPROC_SHIFT) |                \
+     ((op0) << CP_REG_ARM64_SYSREG_OP0_SHIFT) |         \
+     ((op1) << CP_REG_ARM64_SYSREG_OP1_SHIFT) |         \
+     ((crn) << CP_REG_ARM64_SYSREG_CRN_SHIFT) |         \
+     ((crm) << CP_REG_ARM64_SYSREG_CRM_SHIFT) |         \
+     ((op2) << CP_REG_ARM64_SYSREG_OP2_SHIFT))
+
+/*
+ * Convert a full 64 bit KVM register ID to the truncated 32 bit
+ * version used as a key for the coprocessor register hashtable
+ */
+static inline uint32_t kvm_to_cpreg_id(uint64_t kvmid)
+{
+    uint32_t cpregid = kvmid;
+    if ((kvmid & CP_REG_ARCH_MASK) == CP_REG_ARM64) {
+        cpregid |= CP_REG_AA64_MASK;
+    } else {
+        if ((kvmid & CP_REG_SIZE_MASK) == CP_REG_SIZE_U64) {
+            cpregid |= (1 << 15);
+        }
+
+        /*
+         * KVM is always non-secure so add the NS flag on AArch32 register
+         * entries.
+         */
+         cpregid |= 1 << CP_REG_NS_SHIFT;
+    }
+    return cpregid;
+}
+
+/*
+ * Convert a truncated 32 bit hashtable key into the full
+ * 64 bit KVM register ID.
+ */
+static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
+{
+    uint64_t kvmid;
+
+    if (cpregid & CP_REG_AA64_MASK) {
+        kvmid = cpregid & ~CP_REG_AA64_MASK;
+        kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM64;
+    } else {
+        kvmid = cpregid & ~(1 << 15);
+        if (cpregid & (1 << 15)) {
+            kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM;
+        } else {
+            kvmid |= CP_REG_SIZE_U32 | CP_REG_ARM;
+        }
+    }
+    return kvmid;
+}
+
 /*
  * Valid values for ARMCPRegInfo state field, indicating which of
  * the AArch32 and AArch64 execution states this register is visible in.
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ void arm_cpu_list(void);
 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
                                  uint32_t cur_el, bool secure);
 
-/* Interface for defining coprocessor registers.
- * Registers are defined in tables of arm_cp_reginfo structs
- * which are passed to define_arm_cp_regs().
- */
-
-/* When looking up a coprocessor register we look for it
- * via an integer which encodes all of:
- *  coprocessor number
- *  Crn, Crm, opc1, opc2 fields
- *  32 or 64 bit register (ie is it accessed via MRC/MCR
- *    or via MRRC/MCRR?)
- *  non-secure/secure bank (AArch32 only)
- * We allow 4 bits for opc1 because MRRC/MCRR have a 4 bit field.
- * (In this case crn and opc2 should be zero.)
- * For AArch64, there is no 32/64 bit size distinction;
- * instead all registers have a 2 bit op0, 3 bit op1 and op2,
- * and 4 bit CRn and CRm. The encoding patterns are chosen
- * to be easy to convert to and from the KVM encodings, and also
- * so that the hashtable can contain both AArch32 and AArch64
- * registers (to allow for interprocessing where we might run
- * 32 bit code on a 64 bit core).
- */
-/* This bit is private to our hashtable cpreg; in KVM register
- * IDs the AArch64/32 distinction is the KVM_REG_ARM/ARM64
- * in the upper bits of the 64 bit ID.
- */
-#define CP_REG_AA64_SHIFT 28
-#define CP_REG_AA64_MASK (1 << CP_REG_AA64_SHIFT)
-
-/* To enable banking of coprocessor registers depending on ns-bit we
- * add a bit to distinguish between secure and non-secure cpregs in the
- * hashtable.
- */
-#define CP_REG_NS_SHIFT 29
-#define CP_REG_NS_MASK (1 << CP_REG_NS_SHIFT)
-
-#define ENCODE_CP_REG(cp, is64, ns, crn, crm, opc1, opc2)   \
-    ((ns) << CP_REG_NS_SHIFT | ((cp) << 16) | ((is64) << 15) |   \
-     ((crn) << 11) | ((crm) << 7) | ((opc1) << 3) | (opc2))
-
-#define ENCODE_AA64_CP_REG(cp, crn, crm, op0, op1, op2) \
-    (CP_REG_AA64_MASK |                                 \
-     ((cp) << CP_REG_ARM_COPROC_SHIFT) |                \
-     ((op0) << CP_REG_ARM64_SYSREG_OP0_SHIFT) |         \
-     ((op1) << CP_REG_ARM64_SYSREG_OP1_SHIFT) |         \
-     ((crn) << CP_REG_ARM64_SYSREG_CRN_SHIFT) |         \
-     ((crm) << CP_REG_ARM64_SYSREG_CRM_SHIFT) |         \
-     ((op2) << CP_REG_ARM64_SYSREG_OP2_SHIFT))
-
-/* Convert a full 64 bit KVM register ID to the truncated 32 bit
- * version used as a key for the coprocessor register hashtable
- */
-static inline uint32_t kvm_to_cpreg_id(uint64_t kvmid)
-{
-    uint32_t cpregid = kvmid;
-    if ((kvmid & CP_REG_ARCH_MASK) == CP_REG_ARM64) {
-        cpregid |= CP_REG_AA64_MASK;
-    } else {
-        if ((kvmid & CP_REG_SIZE_MASK) == CP_REG_SIZE_U64) {
-            cpregid |= (1 << 15);
-        }
-
-        /* KVM is always non-secure so add the NS flag on AArch32 register
-         * entries.
-         */
-         cpregid |= 1 << CP_REG_NS_SHIFT;
-    }
-    return cpregid;
-}
-
-/* Convert a truncated 32 bit hashtable key into the full
- * 64 bit KVM register ID.
- */
-static inline uint64_t cpreg_to_kvm_id(uint32_t cpregid)
-{
-    uint64_t kvmid;
-
-    if (cpregid & CP_REG_AA64_MASK) {
-        kvmid = cpregid & ~CP_REG_AA64_MASK;
-        kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM64;
-    } else {
-        kvmid = cpregid & ~(1 << 15);
-        if (cpregid & (1 << 15)) {
-            kvmid |= CP_REG_SIZE_U64 | CP_REG_ARM;
-        } else {
-            kvmid |= CP_REG_SIZE_U32 | CP_REG_ARM;
-        }
-    }
-    return kvmid;
-}
-
 /* Return the highest implemented Exception Level */
 static inline int arm_highest_el(CPUARMState *env)
 {
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

If a test was tagged with the "accel" tag and the specified
accelerator it not present in the qemu binary, cancel the test.

We can now write tests without explicit calls to require_accelerator,
just the tag is enough.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/avocado/avocado_qemu/__init__.py | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tests/avocado/avocado_qemu/__init__.py b/tests/avocado/avocado_qemu/__init__.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/avocado/avocado_qemu/__init__.py
+++ b/tests/avocado/avocado_qemu/__init__.py
@@ -XXX,XX +XXX,XX @@ def setUp(self):
 
         super().setUp('qemu-system-')
 
+        accel_required = self._get_unique_tag_val('accel')
+        if accel_required:
+            self.require_accelerator(accel_required)
+
         self.machine = self.params.get('machine',
                                        default=self._get_unique_tag_val('machine'))
 
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

This allows the test to be skipped when TCG is not present in the QEMU
binary.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/avocado/boot_linux_console.py | 1 +
 tests/avocado/reverse_debugging.py  | 8 ++++++++
 2 files changed, 9 insertions(+)

diff --git a/tests/avocado/boot_linux_console.py b/tests/avocado/boot_linux_console.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/avocado/boot_linux_console.py
+++ b/tests/avocado/boot_linux_console.py
@@ -XXX,XX +XXX,XX @@ def test_arm_orangepi_uboot_netbsd9(self):
 
     def test_aarch64_raspi3_atf(self):
         """
+        :avocado: tags=accel:tcg
         :avocado: tags=arch:aarch64
         :avocado: tags=machine:raspi3b
         :avocado: tags=cpu:cortex-a53
diff --git a/tests/avocado/reverse_debugging.py b/tests/avocado/reverse_debugging.py
index XXXXXXX..XXXXXXX 100644
--- a/tests/avocado/reverse_debugging.py
+++ b/tests/avocado/reverse_debugging.py
@@ -XXX,XX +XXX,XX @@ def reverse_debugging(self, shift=7, args=None):
         vm.shutdown()
 
 class ReverseDebugging_X86_64(ReverseDebugging):
+    """
+    :avocado: tags=accel:tcg
+    """
+
     REG_PC = 0x10
     REG_CS = 0x12
     def get_pc(self, g):
@@ -XXX,XX +XXX,XX @@ def test_x86_64_pc(self):
         self.reverse_debugging()
 
 class ReverseDebugging_AArch64(ReverseDebugging):
+    """
+    :avocado: tags=accel:tcg
+    """
+
     REG_PC = 32
 
     # unidentified gitlab timeout problem
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

Now that the cortex-a15 is under CONFIG_TCG, use as default CPU for a
KVM-only build the 'max' cpu.

Note that we cannot use 'host' here because the qtests can run without
any other accelerator (than qtest) and 'host' depends on KVM being
enabled.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
     mc->minimum_page_bits = 12;
     mc->possible_cpu_arch_ids = virt_possible_cpu_arch_ids;
     mc->cpu_index_to_instance_props = virt_cpu_index_to_props;
+#ifdef CONFIG_TCG
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
+#else
+    mc->default_cpu_type = ARM_CPU_TYPE_NAME("max");
+#endif
     mc->get_default_cpu_node_id = virt_get_default_cpu_node_id;
     mc->kvm_type = virt_kvm_type;
     assert(!mc->get_hotplug_handler);
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Acked-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/arm-cpu-features.c | 28 ++++++++++++++++++----------
 1 file changed, 18 insertions(+), 10 deletions(-)

diff --git a/tests/qtest/arm-cpu-features.c b/tests/qtest/arm-cpu-features.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/arm-cpu-features.c
+++ b/tests/qtest/arm-cpu-features.c
@@ -XXX,XX +XXX,XX @@
 #define SVE_MAX_VQ 16
 
 #define MACHINE     "-machine virt,gic-version=max -accel tcg "
-#define MACHINE_KVM "-machine virt,gic-version=max -accel kvm -accel tcg "
+#define MACHINE_KVM "-machine virt,gic-version=max -accel kvm "
 #define QUERY_HEAD  "{ 'execute': 'query-cpu-model-expansion', " \
                     "  'arguments': { 'type': 'full', "
 #define QUERY_TAIL  "}}"
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
 {
     g_test_init(&argc, &argv, NULL);
 
-    qtest_add_data_func("/arm/query-cpu-model-expansion",
-                        NULL, test_query_cpu_model_expansion);
+    if (qtest_has_accel("tcg")) {
+        qtest_add_data_func("/arm/query-cpu-model-expansion",
+                            NULL, test_query_cpu_model_expansion);
+    }
+
+    if (!g_str_equal(qtest_get_arch(), "aarch64")) {
+        goto out;
+    }
 
     /*
      * For now we only run KVM specific tests with AArch64 QEMU in
      * order avoid attempting to run an AArch32 QEMU with KVM on
      * AArch64 hosts. That won't work and isn't easy to detect.
      */
-    if (g_str_equal(qtest_get_arch(), "aarch64") && qtest_has_accel("kvm")) {
+    if (qtest_has_accel("kvm")) {
         /*
          * This tests target the 'host' CPU type, so register it only if
          * KVM is available.
          */
         qtest_add_data_func("/arm/kvm/query-cpu-model-expansion",
                             NULL, test_query_cpu_model_expansion_kvm);
-    }
 
-    if (g_str_equal(qtest_get_arch(), "aarch64")) {
-        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-max-vq-8",
-                            NULL, sve_tests_sve_max_vq_8);
-        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
-                            NULL, sve_tests_sve_off);
         qtest_add_data_func("/arm/kvm/query-cpu-model-expansion/sve-off",
                             NULL, sve_tests_sve_off_kvm);
     }
 
+    if (qtest_has_accel("tcg")) {
+        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-max-vq-8",
+                            NULL, sve_tests_sve_max_vq_8);
+        qtest_add_data_func("/arm/max/query-cpu-model-expansion/sve-off",
+                            NULL, sve_tests_sve_off);
+    }
+
+out:
     return g_test_run();
 }
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

These tests set -accel tcg, so restrict them to when TCG is present.

Signed-off-by: Fabiano Rosas <farosas@suse.de>
Acked-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/meson.build | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_arm = \
 # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional
 qtests_aarch64 = \
   (cpu != 'arm' and unpack_edk2_blobs ? ['bios-tables-test'] : []) +                            \
-  (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-test'] : []) +        \
-  (config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ? ['tpm-tis-device-swtpm-test'] : []) +  \
+  (config_all.has_key('CONFIG_TCG') and config_all_devices.has_key('CONFIG_TPM_TIS_SYSBUS') ?            \
+    ['tpm-tis-device-test', 'tpm-tis-device-swtpm-test'] : []) +                                         \
   (config_all_devices.has_key('CONFIG_XLNX_ZYNQMP_ARM') ? ['xlnx-can-test', 'fuzz-xlnx-dp-test'] : []) + \
   (config_all_devices.has_key('CONFIG_RASPI') ? ['bcm2835-dma-test'] : []) +  \
   ['arm-cpu-features',
-- 
2.34.1

Hi; here's the latest batch of arm changes. The big thing
in here is the SMMUv3 changes to add stage-2 translation support.

thanks
-- PMM

The following changes since commit aa9bbd865502ed517624ab6fe7d4b5d89ca95e43:

Merge tag 'pull-ppc-20230528' of https://gitlab.com/danielhb/qemu into staging (2023-05-29 14:31:52 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230530

for you to fetch changes up to b03d0d4f531a8b867e0aac1fab0b876903015680:

docs: sbsa: correct graphics card name (2023-05-30 13:32:46 +0100)

----------------------------------------------------------------
target-arm queue:
 * fsl-imx6: Add SNVS support for i.MX6 boards
 * smmuv3: Add support for stage 2 translations
 * hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop
 * hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number
 * cleanups for recent Kconfig changes
 * target/arm: Explicitly select short-format FSR for M-profile
 * tests/qtest: Run arm-specific tests only if the required machine is available
 * hw/arm/sbsa-ref: add GIC node into DT
 * docs: sbsa: correct graphics card name
 * Update copyright dates to 2023

----------------------------------------------------------------
Clément Chigot (1):
      hw/arm/xlnx-zynqmp: fix unsigned error when checking the RPUs number

Enze Li (1):
      Update copyright dates to 2023

Fabiano Rosas (3):
      target/arm: Explain why we need to select ARM_V7M
      arm/Kconfig: Keep Kconfig default entries in default.mak as documentation
      arm/Kconfig: Make TCG dependence explicit

Marcin Juszkiewicz (2):
      hw/arm/sbsa-ref: add GIC node into DT
      docs: sbsa: correct graphics card name

Mostafa Saleh (10):
      hw/arm/smmuv3: Add missing fields for IDR0
      hw/arm/smmuv3: Update translation config to hold stage-2
      hw/arm/smmuv3: Refactor stage-1 PTW
      hw/arm/smmuv3: Add page table walk for stage-2
      hw/arm/smmuv3: Parse STE config for stage-2
      hw/arm/smmuv3: Make TLB lookup work for stage-2
      hw/arm/smmuv3: Add VMID to TLB tagging
      hw/arm/smmuv3: Add CMDs related to stage-2
      hw/arm/smmuv3: Add stage-2 support in iova notifier
      hw/arm/smmuv3: Add knob to choose translation stage and enable stage-2

Peter Maydell (1):
      target/arm: Explicitly select short-format FSR for M-profile

Thomas Huth (1):
      tests/qtest: Run arm-specific tests only if the required machine is available

Tommy Wu (1):
      hw/dma/xilinx_axidma: Check DMASR.HALTED to prevent infinite loop.

Vitaly Cheptsov (1):
      fsl-imx6: Add SNVS support for i.MX6 boards

From: Vitaly Cheptsov <cheptsov@ispras.ru>

SNVS is supported on both i.MX6 and i.MX6UL and is needed
to support shutdown on the board.

Cc: Peter Maydell <peter.maydell@linaro.org> (odd fixer:SABRELITE / i.MX6)
Cc: Jean-Christophe Dubois <jcd@tribudubois.net> (reviewer:SABRELITE / i.MX6)
Cc: qemu-arm@nongnu.org (open list:SABRELITE / i.MX6)
Cc: qemu-devel@nongnu.org (open list:All patches CC here)
Signed-off-by: Vitaly Cheptsov <cheptsov@ispras.ru>
Message-id: 20230515095015.66860-1-cheptsov@ispras.ru
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h | 2 ++
 hw/arm/fsl-imx6.c         | 8 ++++++++
 2 files changed, 10 insertions(+)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/cpu/a9mpcore.h"
 #include "hw/misc/imx6_ccm.h"
 #include "hw/misc/imx6_src.h"
+#include "hw/misc/imx7_snvs.h"
 #include "hw/watchdog/wdt_imx2.h"
 #include "hw/char/imx_serial.h"
 #include "hw/timer/imx_gpt.h"
@@ -XXX,XX +XXX,XX @@ struct FslIMX6State {
     A9MPPrivState  a9mpcore;
     IMX6CCMState   ccm;
     IMX6SRCState   src;
+    IMX7SNVSState  snvs;
     IMXSerialState uart[FSL_IMX6_NUM_UARTS];
     IMXGPTState    gpt;
     IMXEPITState   epit[FSL_IMX6_NUM_EPITS];
diff --git a/hw/arm/fsl-imx6.c b/hw/arm/fsl-imx6.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/fsl-imx6.c
+++ b/hw/arm/fsl-imx6.c
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_init(Object *obj)
 
     object_initialize_child(obj, "src", &s->src, TYPE_IMX6_SRC);
 
+    object_initialize_child(obj, "snvs", &s->snvs, TYPE_IMX7_SNVS);
+
     for (i = 0; i < FSL_IMX6_NUM_UARTS; i++) {
         snprintf(name, NAME_SIZE, "uart%d", i + 1);
         object_initialize_child(obj, name, &s->uart[i], TYPE_IMX_SERIAL);
@@ -XXX,XX +XXX,XX @@ static void fsl_imx6_realize(DeviceState *dev, Error **errp)
                        qdev_get_gpio_in(DEVICE(&s->a9mpcore),
                                         FSL_IMX6_ENET_MAC_1588_IRQ));
 
+    /*
+     * SNVS
+     */
+    sysbus_realize(SYS_BUS_DEVICE(&s->snvs), &error_abort);
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->snvs), 0, FSL_IMX6_SNVSHP_ADDR);
+
     /*
      * Watchdog
      */
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support.
Add IDR0 fields related to stage-2.

VMID16: 16-bit VMID supported.
S2P: Stage-2 translation supported.

They are described in 6.3.1 SMMU_IDR0.

No functional change intended.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-2-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef enum SMMUTranslationStatus {
 /* MMIO Registers */
 
 REG32(IDR0,                0x0)
+    FIELD(IDR0, S2P,         0 , 1)
     FIELD(IDR0, S1P,         1 , 1)
     FIELD(IDR0, TTF,         2 , 2)
     FIELD(IDR0, COHACC,      4 , 1)
     FIELD(IDR0, ASID16,      12, 1)
+    FIELD(IDR0, VMID16,      18, 1)
     FIELD(IDR0, TTENDIAN,    21, 2)
     FIELD(IDR0, STALL_MODEL, 24, 2)
     FIELD(IDR0, TERM_MODEL,  26, 1)
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, add a S2 config
struct(SMMUS2Cfg), composed of the following fields and embedded in
the main SMMUTransCfg:
 -tsz: Size of IPA input region (S2T0SZ)
 -sl0: Start level of translation (S2SL0)
 -affd: AF Fault Disable (S2AFFD)
 -record_faults: Record fault events (S2R)
 -granule_sz: Granule page shift (based on S2TG)
 -vmid: Virtual Machine ID (S2VMID)
 -vttb: Address of translation table base (S2TTB)
 -eff_ps: Effective PA output range (based on S2PS)

They will be used in the next patches in stage-2 address translation.

The fields in SMMUS2Cfg, are reordered to make the shared and stage-1
fields next to each other, this reordering didn't change the struct
size (104 bytes before and after).

Stage-1 only fields: aa64, asid, tt, ttb, tbi, record_faults, oas.
oas is stage-1 output address size. However, it is used to check
input address in case stage-1 is unimplemented or bypassed according
to SMMUv3 manual IHI0070.E "3.4. Address sizes"

Shared fields: stage, disabled, bypassed, aborted, iotlb_*.

No functional change intended.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-3-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUTLBEntry {
     uint8_t granule;
 } SMMUTLBEntry;
 
+/* Stage-2 configuration. */
+typedef struct SMMUS2Cfg {
+    uint8_t tsz;            /* Size of IPA input region (S2T0SZ) */
+    uint8_t sl0;            /* Start level of translation (S2SL0) */
+    bool affd;              /* AF Fault Disable (S2AFFD) */
+    bool record_faults;     /* Record fault events (S2R) */
+    uint8_t granule_sz;     /* Granule page shift (based on S2TG) */
+    uint8_t eff_ps;         /* Effective PA output range (based on S2PS) */
+    uint16_t vmid;          /* Virtual Machine ID (S2VMID) */
+    uint64_t vttb;          /* Address of translation table base (S2TTB) */
+} SMMUS2Cfg;
+
 /*
  * Generic structure populated by derived SMMU devices
  * after decoding the configuration information and used as
  * input to the page table walk
  */
 typedef struct SMMUTransCfg {
+    /* Shared fields between stage-1 and stage-2. */
     int stage;                 /* translation stage */
-    bool aa64;                 /* arch64 or aarch32 translation table */
     bool disabled;             /* smmu is disabled */
     bool bypassed;             /* translation is bypassed */
     bool aborted;              /* translation is aborted */
+    uint32_t iotlb_hits;       /* counts IOTLB hits */
+    uint32_t iotlb_misses;     /* counts IOTLB misses*/
+    /* Used by stage-1 only. */
+    bool aa64;                 /* arch64 or aarch32 translation table */
     bool record_faults;        /* record fault events */
     uint64_t ttb;              /* TT base address */
     uint8_t oas;               /* output address width */
     uint8_t tbi;               /* Top Byte Ignore */
     uint16_t asid;
     SMMUTransTableInfo tt[2];
-    uint32_t iotlb_hits;       /* counts IOTLB hits for this asid */
-    uint32_t iotlb_misses;     /* counts IOTLB misses for this asid */
+    /* Used by stage-2 only. */
+    struct SMMUS2Cfg s2cfg;
 } SMMUTransCfg;
 
 typedef struct SMMUDevice {
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, rename smmu_ptw_64 to
smmu_ptw_64_s1 and refactor some of the code so it can be reused in
stage-2 page table walk.

Remove AA64 check from PTW as decode_cd already ensures that AA64 is
used, otherwise it faults with C_BAD_CD.

A stage member is added to SMMUPTWEventInfo to differentiate
between stage-1 and stage-2 ptw faults.

Add stage argument to trace_smmu_ptw_level be consistent with other
trace events.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-4-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h | 16 +++++++++++++---
 hw/arm/smmu-common.c         | 27 ++++++++++-----------------
 hw/arm/smmuv3.c              |  2 ++
 hw/arm/trace-events          |  2 +-
 4 files changed, 26 insertions(+), 21 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/pci/pci.h"
 #include "qom/object.h"
 
-#define SMMU_PCI_BUS_MAX      256
-#define SMMU_PCI_DEVFN_MAX    256
-#define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
+#define SMMU_PCI_BUS_MAX                    256
+#define SMMU_PCI_DEVFN_MAX                  256
+#define SMMU_PCI_DEVFN(sid)                 (sid & 0xFF)
+
+/* VMSAv8-64 Translation constants and functions */
+#define VMSA_LEVELS                         4
+
+#define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
+#define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
+                                             (VMSA_LEVELS - (lvl)))
+#define VMSA_IDXMSK(isz, strd, lvl)         ((1ULL << \
+                                             VMSA_BIT_LVL(isz, strd, lvl)) - 1)
 
 /*
  * Page table walk error types
@@ -XXX,XX +XXX,XX @@ typedef enum {
 } SMMUPTWEventType;
 
 typedef struct SMMUPTWEventInfo {
+    int stage;
     SMMUPTWEventType type;
     dma_addr_t addr; /* fetched address that induced an abort, if any */
 } SMMUPTWEventInfo;
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
 }
 
 /**
- * smmu_ptw_64 - VMSAv8-64 Walk of the page tables for a given IOVA
+ * smmu_ptw_64_s1 - VMSAv8-64 Walk of the page tables for a given IOVA
  * @cfg: translation config
  * @iova: iova to translate
  * @perm: access type
@@ -XXX,XX +XXX,XX @@ SMMUTransTableInfo *select_tt(SMMUTransCfg *cfg, dma_addr_t iova)
  * Upon success, @tlbe is filled with translated_addr and entry
  * permission rights.
  */
-static int smmu_ptw_64(SMMUTransCfg *cfg,
-                       dma_addr_t iova, IOMMUAccessFlags perm,
-                       SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+static int smmu_ptw_64_s1(SMMUTransCfg *cfg,
+                          dma_addr_t iova, IOMMUAccessFlags perm,
+                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
     dma_addr_t baseaddr, indexmask;
     int stage = cfg->stage;
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
     }
 
     granule_sz = tt->granule_sz;
-    stride = granule_sz - 3;
+    stride = VMSA_STRIDE(granule_sz);
     inputsize = 64 - tt->tsz;
     level = 4 - (inputsize - 4) / stride;
-    indexmask = (1ULL << (inputsize - (stride * (4 - level)))) - 1;
+    indexmask = VMSA_IDXMSK(inputsize, stride, level);
     baseaddr = extract64(tt->ttb, 0, 48);
     baseaddr &= ~indexmask;
 
-    while (level <= 3) {
+    while (level < VMSA_LEVELS) {
         uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
         uint64_t mask = subpage_size - 1;
         uint32_t offset = iova_level_offset(iova, inputsize, level, granule_sz);
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
         if (get_pte(baseaddr, offset, &pte, info)) {
                 goto error;
         }
-        trace_smmu_ptw_level(level, iova, subpage_size,
+        trace_smmu_ptw_level(stage, level, iova, subpage_size,
                              baseaddr, offset, pte);
 
         if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
@@ -XXX,XX +XXX,XX @@ static int smmu_ptw_64(SMMUTransCfg *cfg,
     info->type = SMMU_PTW_ERR_TRANSLATION;
 
 error:
+    info->stage = 1;
     tlbe->entry.perm = IOMMU_NONE;
     return -EINVAL;
 }
@@ -XXX,XX +XXX,XX @@ error:
 int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
              SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
-    if (!cfg->aa64) {
-        /*
-         * This code path is not entered as we check this while decoding
-         * the configuration data in the derived SMMU model.
-         */
-        g_assert_not_reached();
-    }
-
-    return smmu_ptw_64(cfg, iova, perm, tlbe, info);
+    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
 }
 
 /**
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
     cached_entry = g_new0(SMMUTLBEntry, 1);
 
     if (smmu_ptw(cfg, aligned_addr, flag, cached_entry, &ptw_info)) {
+        /* All faults from PTW has S2 field. */
+        event.u.f_walk_eabt.s2 = (ptw_info.stage == 2);
         g_free(cached_entry);
         switch (ptw_info.type) {
         case SMMU_PTW_ERR_WALK_EABT:
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ virt_acpi_setup(void) "No fw cfg or ACPI disabled. Bailing out."
 
 # smmu-common.c
 smmu_add_mr(const char *name) "%s"
-smmu_ptw_level(int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
+smmu_ptw_level(int stage, int level, uint64_t iova, size_t subpage_size, uint64_t baseaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d iova=0x%"PRIx64" subpage_sz=0x%zx baseaddr=0x%"PRIx64" offset=%d => pte=0x%"PRIx64
 smmu_ptw_invalid_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint32_t offset, uint64_t pte) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" offset=%d pte=0x%"PRIx64
 smmu_ptw_page_pte(int stage, int level,  uint64_t iova, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t address) "stage=%d level=%d iova=0x%"PRIx64" base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" page address = 0x%"PRIx64
 smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, uint64_t pte, uint64_t iova, uint64_t gpa, int bsize_mb) "stage=%d level=%d base@=0x%"PRIx64" pte@=0x%"PRIx64" pte=0x%"PRIx64" iova=0x%"PRIx64" block address = 0x%"PRIx64" block size = %d MiB"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In preparation for adding stage-2 support, add Stage-2 PTW code.
Only Aarch64 format is supported as stage-1.

Nesting stage-1 and stage-2 is not supported right now.

HTTU is not supported, SW is expected to maintain the Access flag.
This is described in the SMMUv3 manual(IHI 0070.E.a)
"5.2. Stream Table Entry" in "[181] S2AFFD".
This flag determines the behavior on access of a stage-2 page whose
descriptor has AF == 0:
- 0b0: An Access flag fault occurs (stall not supported).
- 0b1: An Access flag fault never occurs.
An Access fault takes priority over a Permission fault.

There are 3 address size checks for stage-2 according to
(IHI 0070.E.a) in "3.4. Address sizes".
- As nesting is not supported, input address is passed directly to
stage-2, and is checked against IAS.
We use cfg->oas to hold the OAS when stage-1 is not used, this is set
in the next patch.
This check is done outside of smmu_ptw_64_s2 as it is not part of
stage-2(it throws stage-1 fault), and the stage-2 function shouldn't
change it's behavior when nesting is supported.
When nesting is supported and we figure out how to combine TLB for
stage-1 and stage-2 we can move this check into the stage-1 function
as described in ARM DDI0487I.a in pseudocode
aarch64/translation/vmsa_translation/AArch64.S1Translate
aarch64/translation/vmsa_translation/AArch64.S1DisabledOutput

- Input to stage-2 is checked against s2t0sz, and throws stage-2
transaltion fault if exceeds it.

- Output of stage-2 is checked against effective PA output range.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-5-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-internal.h |  35 ++++++++++
 hw/arm/smmu-common.c   | 142 ++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 176 insertions(+), 1 deletion(-)

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-internal.h
+++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@
 #define PTE_APTABLE(pte) \
     (extract64(pte, 61, 2))
 
+#define PTE_AF(pte) \
+    (extract64(pte, 10, 1))
 /*
  * TODO: At the moment all transactions are considered as privileged (EL1)
  * as IOMMU translation callback does not pass user/priv attributes.
@@ -XXX,XX +XXX,XX @@
 #define is_permission_fault(ap, perm) \
     (((perm) & IOMMU_WO) && ((ap) & 0x2))
 
+#define is_permission_fault_s2(s2ap, perm) \
+    (!(((s2ap) & (perm)) == (perm)))
+
 #define PTE_AP_TO_PERM(ap) \
     (IOMMU_ACCESS_FLAG(true, !((ap) & 0x2)))
 
@@ -XXX,XX +XXX,XX @@ uint64_t iova_level_offset(uint64_t iova, int inputsize,
             MAKE_64BIT_MASK(0, gsz - 3);
 }
 
+/* FEAT_LPA2 and FEAT_TTST are not implemented. */
+static inline int get_start_level(int sl0 , int granule_sz)
+{
+    /* ARM DDI0487I.a: Table D8-12. */
+    if (granule_sz == 12) {
+        return 2 - sl0;
+    }
+    /* ARM DDI0487I.a: Table D8-22 and Table D8-31. */
+    return 3 - sl0;
+}
+
+/*
+ * Index in a concatenated first level stage-2 page table.
+ * ARM DDI0487I.a: D8.2.2 Concatenated translation tables.
+ */
+static inline int pgd_concat_idx(int start_level, int granule_sz,
+                                 dma_addr_t ipa)
+{
+    uint64_t ret;
+    /*
+     * Get the number of bits handled by next levels, then any extra bits in
+     * the address should index the concatenated tables. This relation can be
+     * deduced from tables in ARM DDI0487I.a: D8.2.7-9
+     */
+    int shift =  level_shift(start_level - 1, granule_sz);
+
+    ret = ipa >> shift;
+    return ret;
+}
+
 #define SMMU_IOTLB_ASID(key) ((key).asid)
 
 typedef struct SMMUIOTLBPageInvInfo {
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ error:
     return -EINVAL;
 }
 
+/**
+ * smmu_ptw_64_s2 - VMSAv8-64 Walk of the page tables for a given ipa
+ * for stage-2.
+ * @cfg: translation config
+ * @ipa: ipa to translate
+ * @perm: access type
+ * @tlbe: SMMUTLBEntry (out)
+ * @info: handle to an error info
+ *
+ * Return 0 on success, < 0 on error. In case of error, @info is filled
+ * and tlbe->perm is set to IOMMU_NONE.
+ * Upon success, @tlbe is filled with translated_addr and entry
+ * permission rights.
+ */
+static int smmu_ptw_64_s2(SMMUTransCfg *cfg,
+                          dma_addr_t ipa, IOMMUAccessFlags perm,
+                          SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
+{
+    const int stage = 2;
+    int granule_sz = cfg->s2cfg.granule_sz;
+    /* ARM DDI0487I.a: Table D8-7. */
+    int inputsize = 64 - cfg->s2cfg.tsz;
+    int level = get_start_level(cfg->s2cfg.sl0, granule_sz);
+    int stride = VMSA_STRIDE(granule_sz);
+    int idx = pgd_concat_idx(level, granule_sz, ipa);
+    /*
+     * Get the ttb from concatenated structure.
+     * The offset is the idx * size of each ttb(number of ptes * (sizeof(pte))
+     */
+    uint64_t baseaddr = extract64(cfg->s2cfg.vttb, 0, 48) + (1 << stride) *
+                                  idx * sizeof(uint64_t);
+    dma_addr_t indexmask = VMSA_IDXMSK(inputsize, stride, level);
+
+    baseaddr &= ~indexmask;
+
+    /*
+     * On input, a stage 2 Translation fault occurs if the IPA is outside the
+     * range configured by the relevant S2T0SZ field of the STE.
+     */
+    if (ipa >= (1ULL << inputsize)) {
+        info->type = SMMU_PTW_ERR_TRANSLATION;
+        goto error;
+    }
+
+    while (level < VMSA_LEVELS) {
+        uint64_t subpage_size = 1ULL << level_shift(level, granule_sz);
+        uint64_t mask = subpage_size - 1;
+        uint32_t offset = iova_level_offset(ipa, inputsize, level, granule_sz);
+        uint64_t pte, gpa;
+        dma_addr_t pte_addr = baseaddr + offset * sizeof(pte);
+        uint8_t s2ap;
+
+        if (get_pte(baseaddr, offset, &pte, info)) {
+                goto error;
+        }
+        trace_smmu_ptw_level(stage, level, ipa, subpage_size,
+                             baseaddr, offset, pte);
+        if (is_invalid_pte(pte) || is_reserved_pte(pte, level)) {
+            trace_smmu_ptw_invalid_pte(stage, level, baseaddr,
+                                       pte_addr, offset, pte);
+            break;
+        }
+
+        if (is_table_pte(pte, level)) {
+            baseaddr = get_table_pte_address(pte, granule_sz);
+            level++;
+            continue;
+        } else if (is_page_pte(pte, level)) {
+            gpa = get_page_pte_address(pte, granule_sz);
+            trace_smmu_ptw_page_pte(stage, level, ipa,
+                                    baseaddr, pte_addr, pte, gpa);
+        } else {
+            uint64_t block_size;
+
+            gpa = get_block_pte_address(pte, level, granule_sz,
+                                        &block_size);
+            trace_smmu_ptw_block_pte(stage, level, baseaddr,
+                                     pte_addr, pte, ipa, gpa,
+                                     block_size >> 20);
+        }
+
+        /*
+         * If S2AFFD and PTE.AF are 0 => fault. (5.2. Stream Table Entry)
+         * An Access fault takes priority over a Permission fault.
+         */
+        if (!PTE_AF(pte) && !cfg->s2cfg.affd) {
+            info->type = SMMU_PTW_ERR_ACCESS;
+            goto error;
+        }
+
+        s2ap = PTE_AP(pte);
+        if (is_permission_fault_s2(s2ap, perm)) {
+            info->type = SMMU_PTW_ERR_PERMISSION;
+            goto error;
+        }
+
+        /*
+         * The address output from the translation causes a stage 2 Address
+         * Size fault if it exceeds the effective PA output range.
+         */
+        if (gpa >= (1ULL << cfg->s2cfg.eff_ps)) {
+            info->type = SMMU_PTW_ERR_ADDR_SIZE;
+            goto error;
+        }
+
+        tlbe->entry.translated_addr = gpa;
+        tlbe->entry.iova = ipa & ~mask;
+        tlbe->entry.addr_mask = mask;
+        tlbe->entry.perm = s2ap;
+        tlbe->level = level;
+        tlbe->granule = granule_sz;
+        return 0;
+    }
+    info->type = SMMU_PTW_ERR_TRANSLATION;
+
+error:
+    info->stage = 2;
+    tlbe->entry.perm = IOMMU_NONE;
+    return -EINVAL;
+}
+
 /**
  * smmu_ptw - Walk the page tables for an IOVA, according to @cfg
  *
@@ -XXX,XX +XXX,XX @@ error:
 int smmu_ptw(SMMUTransCfg *cfg, dma_addr_t iova, IOMMUAccessFlags perm,
              SMMUTLBEntry *tlbe, SMMUPTWEventInfo *info)
 {
-    return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
+    if (cfg->stage == 1) {
+        return smmu_ptw_64_s1(cfg, iova, perm, tlbe, info);
+    } else if (cfg->stage == 2) {
+        /*
+         * If bypassing stage 1(or unimplemented), the input address is passed
+         * directly to stage 2 as IPA. If the input address of a transaction
+         * exceeds the size of the IAS, a stage 1 Address Size fault occurs.
+         * For AA64, IAS = OAS according to (IHI 0070.E.a) "3.4 Address sizes"
+         */
+        if (iova >= (1ULL << cfg->oas)) {
+            info->type = SMMU_PTW_ERR_ADDR_SIZE;
+            info->stage = 1;
+            tlbe->entry.perm = IOMMU_NONE;
+            return -EINVAL;
+        }
+
+        return smmu_ptw_64_s2(cfg, iova, perm, tlbe, info);
+    }
+
+    g_assert_not_reached();
 }
 
 /**
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Parse stage-2 configuration from STE and populate it in SMMUS2Cfg.
Validity of field values are checked when possible.

Only AA64 tables are supported and Small Translation Tables (STT) are
not supported.

According to SMMUv3 UM(IHI0070E) "5.2 Stream Table Entry": All fields
with an S2 prefix (with the exception of S2VMID) are IGNORED when
stage-2 bypasses translation (Config[1] == 0).

Which means that VMID can be used(for TLB tagging) even if stage-2 is
bypassed, so we parse it unconditionally when S2P exists. Otherwise
it is set to -1.(only S1P)

As stall is not supported, if S2S is set the translation would abort.
For S2R, we reuse the same code used for stage-1 with flag
record_faults. However when nested translation is supported we would
need to separate stage-1 and stage-2 faults.

Fix wrong shift in STE_S2HD, STE_S2HA, STE_S2S.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20230516203327.2051088-6-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3-internal.h     |  10 +-
 include/hw/arm/smmu-common.h |   1 +
 include/hw/arm/smmuv3.h      |   3 +
 hw/arm/smmuv3.c              | 181 +++++++++++++++++++++++++++++++++--
 4 files changed, 185 insertions(+), 10 deletions(-)

diff --git a/hw/arm/smmuv3-internal.h b/hw/arm/smmuv3-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3-internal.h
+++ b/hw/arm/smmuv3-internal.h
@@ -XXX,XX +XXX,XX @@ typedef struct CD {
 #define STE_S2TG(x)        extract32((x)->word[5], 14, 2)
 #define STE_S2PS(x)        extract32((x)->word[5], 16, 3)
 #define STE_S2AA64(x)      extract32((x)->word[5], 19, 1)
-#define STE_S2HD(x)        extract32((x)->word[5], 24, 1)
-#define STE_S2HA(x)        extract32((x)->word[5], 25, 1)
-#define STE_S2S(x)         extract32((x)->word[5], 26, 1)
+#define STE_S2ENDI(x)      extract32((x)->word[5], 20, 1)
+#define STE_S2AFFD(x)      extract32((x)->word[5], 21, 1)
+#define STE_S2HD(x)        extract32((x)->word[5], 23, 1)
+#define STE_S2HA(x)        extract32((x)->word[5], 24, 1)
+#define STE_S2S(x)         extract32((x)->word[5], 25, 1)
+#define STE_S2R(x)         extract32((x)->word[5], 26, 1)
+
 #define STE_CTXPTR(x)                                           \
     ({                                                          \
         unsigned long addr;                                     \
diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@
 
 /* VMSAv8-64 Translation constants and functions */
 #define VMSA_LEVELS                         4
+#define VMSA_MAX_S2_CONCAT                  16
 
 #define VMSA_STRIDE(gran)                   ((gran) - VMSA_LEVELS + 1)
 #define VMSA_BIT_LVL(isz, strd, lvl)        ((isz) - (strd) * \
diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmuv3.h
+++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@ struct SMMUv3Class {
 #define TYPE_ARM_SMMUV3   "arm-smmuv3"
 OBJECT_DECLARE_TYPE(SMMUv3State, SMMUv3Class, ARM_SMMUV3)
 
+#define STAGE1_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S1P)
+#define STAGE2_SUPPORTED(s)      FIELD_EX32(s->idr[0], IDR0, S2P)
+
 #endif
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 #include "smmuv3-internal.h"
 #include "smmu-internal.h"
 
+#define PTW_RECORD_FAULT(cfg)   (((cfg)->stage == 1) ? (cfg)->record_faults : \
+                                 (cfg)->s2cfg.record_faults)
+
 /**
  * smmuv3_trigger_irq - pulse @irq if enabled and update
  * GERROR register in case of GERROR interrupt
@@ -XXX,XX +XXX,XX @@ static int smmu_get_cd(SMMUv3State *s, STE *ste, uint32_t ssid,
     return 0;
 }
 
+/*
+ * Max valid value is 39 when SMMU_IDR3.STT == 0.
+ * In architectures after SMMUv3.0:
+ * - If STE.S2TG selects a 4KB or 16KB granule, the minimum valid value for this
+ *   field is MAX(16, 64-IAS)
+ * - If STE.S2TG selects a 64KB granule, the minimum valid value for this field
+ *   is (64-IAS).
+ * As we only support AA64, IAS = OAS.
+ */
+static bool s2t0sz_valid(SMMUTransCfg *cfg)
+{
+    if (cfg->s2cfg.tsz > 39) {
+        return false;
+    }
+
+    if (cfg->s2cfg.granule_sz == 16) {
+        return (cfg->s2cfg.tsz >= 64 - oas2bits(SMMU_IDR5_OAS));
+    }
+
+    return (cfg->s2cfg.tsz >= MAX(64 - oas2bits(SMMU_IDR5_OAS), 16));
+}
+
+/*
+ * Return true if s2 page table config is valid.
+ * This checks with the configured start level, ias_bits and granularity we can
+ * have a valid page table as described in ARM ARM D8.2 Translation process.
+ * The idea here is to see for the highest possible number of IPA bits, how
+ * many concatenated tables we would need, if it is more than 16, then this is
+ * not possible.
+ */
+static bool s2_pgtable_config_valid(uint8_t sl0, uint8_t t0sz, uint8_t gran)
+{
+    int level = get_start_level(sl0, gran);
+    uint64_t ipa_bits = 64 - t0sz;
+    uint64_t max_ipa = (1ULL << ipa_bits) - 1;
+    int nr_concat = pgd_concat_idx(level, gran, max_ipa) + 1;
+
+    return nr_concat <= VMSA_MAX_S2_CONCAT;
+}
+
+static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
+{
+    cfg->stage = 2;
+
+    if (STE_S2AA64(ste) == 0x0) {
+        qemu_log_mask(LOG_UNIMP,
+                      "SMMUv3 AArch32 tables not supported\n");
+        g_assert_not_reached();
+    }
+
+    switch (STE_S2TG(ste)) {
+    case 0x0: /* 4KB */
+        cfg->s2cfg.granule_sz = 12;
+        break;
+    case 0x1: /* 64KB */
+        cfg->s2cfg.granule_sz = 16;
+        break;
+    case 0x2: /* 16KB */
+        cfg->s2cfg.granule_sz = 14;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 bad STE S2TG: %x\n", STE_S2TG(ste));
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.vttb = STE_S2TTB(ste);
+
+    cfg->s2cfg.sl0 = STE_S2SL0(ste);
+    /* FEAT_TTST not supported. */
+    if (cfg->s2cfg.sl0 == 0x3) {
+        qemu_log_mask(LOG_UNIMP, "SMMUv3 S2SL0 = 0x3 has no meaning!\n");
+        goto bad_ste;
+    }
+
+    /* For AA64, The effective S2PS size is capped to the OAS. */
+    cfg->s2cfg.eff_ps = oas2bits(MIN(STE_S2PS(ste), SMMU_IDR5_OAS));
+    /*
+     * It is ILLEGAL for the address in S2TTB to be outside the range
+     * described by the effective S2PS value.
+     */
+    if (cfg->s2cfg.vttb & ~(MAKE_64BIT_MASK(0, cfg->s2cfg.eff_ps))) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 S2TTB too large 0x%lx, effective PS %d bits\n",
+                      cfg->s2cfg.vttb,  cfg->s2cfg.eff_ps);
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.tsz = STE_S2T0SZ(ste);
+
+    if (!s2t0sz_valid(cfg)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 bad STE S2T0SZ = %d\n",
+                      cfg->s2cfg.tsz);
+        goto bad_ste;
+    }
+
+    if (!s2_pgtable_config_valid(cfg->s2cfg.sl0, cfg->s2cfg.tsz,
+                                    cfg->s2cfg.granule_sz)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 STE stage 2 config not valid!\n");
+        goto bad_ste;
+    }
+
+    /* Only LE supported(IDR0.TTENDIAN). */
+    if (STE_S2ENDI(ste)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "SMMUv3 STE_S2ENDI only supports LE!\n");
+        goto bad_ste;
+    }
+
+    cfg->s2cfg.affd = STE_S2AFFD(ste);
+
+    cfg->s2cfg.record_faults = STE_S2R(ste);
+    /* As stall is not supported. */
+    if (STE_S2S(ste)) {
+        qemu_log_mask(LOG_UNIMP, "SMMUv3 Stall not implemented!\n");
+        goto bad_ste;
+    }
+
+    /* This is still here as stage 2 has not been fully enabled yet. */
+    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
+    goto bad_ste;
+
+    return 0;
+
+bad_ste:
+    return -EINVAL;
+}
+
 /* Returns < 0 in case of invalid STE, 0 otherwise */
 static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
                       STE *ste, SMMUEventInfo *event)
 {
     uint32_t config;
+    int ret;
 
     if (!STE_VALID(ste)) {
         if (!event->inval_ste_allowed) {
@@ -XXX,XX +XXX,XX @@ static int decode_ste(SMMUv3State *s, SMMUTransCfg *cfg,
         return 0;
     }
 
-    if (STE_CFG_S2_ENABLED(config)) {
-        qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
+    /*
+     * If a stage is enabled in SW while not advertised, throw bad ste
+     * according to user manual(IHI0070E) "5.2 Stream Table Entry".
+     */
+    if (!STAGE1_SUPPORTED(s) && STE_CFG_S1_ENABLED(config)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S1 used but not supported.\n");
         goto bad_ste;
     }
+    if (!STAGE2_SUPPORTED(s) && STE_CFG_S2_ENABLED(config)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "SMMUv3 S2 used but not supported.\n");
+        goto bad_ste;
+    }
+
+    if (STAGE2_SUPPORTED(s)) {
+        /* VMID is considered even if s2 is disabled. */
+        cfg->s2cfg.vmid = STE_S2VMID(ste);
+    } else {
+        /* Default to -1 */
+        cfg->s2cfg.vmid = -1;
+    }
+
+    if (STE_CFG_S2_ENABLED(config)) {
+        /*
+         * Stage-1 OAS defaults to OAS even if not enabled as it would be used
+         * in input address check for stage-2.
+         */
+        cfg->oas = oas2bits(SMMU_IDR5_OAS);
+        ret = decode_ste_s2_cfg(cfg, ste);
+        if (ret) {
+            goto bad_ste;
+        }
+    }
 
     if (STE_S1CDMAX(ste) != 0) {
         qemu_log_mask(LOG_UNIMP,
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
     if (cached_entry) {
         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
             status = SMMU_TRANS_ERROR;
-            if (cfg->record_faults) {
+            /*
+             * We know that the TLB only contains either stage-1 or stage-2 as
+             * nesting is not supported. So it is sufficient to check the
+             * translation stage to know the TLB stage for now.
+             */
+            event.u.f_walk_eabt.s2 = (cfg->stage == 2);
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_PERMISSION;
                 event.u.f_permission.addr = addr;
                 event.u.f_permission.rnw = flag & 0x1;
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
             event.u.f_walk_eabt.addr2 = ptw_info.addr;
             break;
         case SMMU_PTW_ERR_TRANSLATION:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_TRANSLATION;
                 event.u.f_translation.addr = addr;
                 event.u.f_translation.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_ADDR_SIZE:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_ADDR_SIZE;
                 event.u.f_addr_size.addr = addr;
                 event.u.f_addr_size.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_ACCESS:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_ACCESS;
                 event.u.f_access.addr = addr;
                 event.u.f_access.rnw = flag & 0x1;
             }
             break;
         case SMMU_PTW_ERR_PERMISSION:
-            if (cfg->record_faults) {
+            if (PTW_RECORD_FAULT(cfg)) {
                 event.type = SMMU_EVT_F_PERMISSION;
                 event.u.f_permission.addr = addr;
                 event.u.f_permission.rnw = flag & 0x1;
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Right now, either stage-1 or stage-2 are supported, this simplifies
how we can deal with TLBs.
This patch makes TLB lookup work if stage-2 is enabled instead of
stage-1.
TLB lookup is done before a PTW, if a valid entry is found we won't
do the PTW.
To be able to do TLB lookup, we need the correct tagging info, as
granularity and input size, so we get this based on the supported
translation stage. The TLB entries are added correctly from each
stage PTW.

When nested translation is supported, this would need to change, for
example if we go with a combined TLB implementation, we would need to
use the min of the granularities in TLB.

As stage-2 shouldn't be tagged by ASID, it will be set to -1 if S1P
is not enabled.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-7-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c | 44 +++++++++++++++++++++++++++++++++-----------
 1 file changed, 33 insertions(+), 11 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
     STE ste;
     CD cd;
 
+    /* ASID defaults to -1 (if s1 is not supported). */
+    cfg->asid = -1;
+
     ret = smmu_find_ste(s, sid, &ste, event);
     if (ret) {
         return ret;
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
         .addr_mask = ~(hwaddr)0,
         .perm = IOMMU_NONE,
     };
+    /*
+     * Combined attributes used for TLB lookup, as only one stage is supported,
+     * it will hold attributes based on the enabled stage.
+     */
+    SMMUTransTableInfo tt_combined;
 
     qemu_mutex_lock(&s->mutex);
 
@@ -XXX,XX +XXX,XX @@ static IOMMUTLBEntry smmuv3_translate(IOMMUMemoryRegion *mr, hwaddr addr,
         goto epilogue;
     }
 
-    tt = select_tt(cfg, addr);
-    if (!tt) {
-        if (cfg->record_faults) {
-            event.type = SMMU_EVT_F_TRANSLATION;
-            event.u.f_translation.addr = addr;
-            event.u.f_translation.rnw = flag & 0x1;
+    if (cfg->stage == 1) {
+        /* Select stage1 translation table. */
+        tt = select_tt(cfg, addr);
+        if (!tt) {
+            if (cfg->record_faults) {
+                event.type = SMMU_EVT_F_TRANSLATION;
+                event.u.f_translation.addr = addr;
+                event.u.f_translation.rnw = flag & 0x1;
+            }
+            status = SMMU_TRANS_ERROR;
+            goto epilogue;
         }
-        status = SMMU_TRANS_ERROR;
-        goto epilogue;
-    }
+        tt_combined.granule_sz = tt->granule_sz;
+        tt_combined.tsz = tt->tsz;
 
-    page_mask = (1ULL << (tt->granule_sz)) - 1;
+    } else {
+        /* Stage2. */
+        tt_combined.granule_sz = cfg->s2cfg.granule_sz;
+        tt_combined.tsz = cfg->s2cfg.tsz;
+    }
+    /*
+     * TLB lookup looks for granule and input size for a translation stage,
+     * as only one stage is supported right now, choose the right values
+     * from the configuration.
+     */
+    page_mask = (1ULL << tt_combined.granule_sz) - 1;
     aligned_addr = addr & ~page_mask;
 
-    cached_entry = smmu_iotlb_lookup(bs, cfg, tt, aligned_addr);
+    cached_entry = smmu_iotlb_lookup(bs, cfg, &tt_combined, aligned_addr);
     if (cached_entry) {
         if ((flag & IOMMU_WO) && !(cached_entry->entry.perm & IOMMU_WO)) {
             status = SMMU_TRANS_ERROR;
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

Allow TLB to be tagged with VMID.

If stage-1 is only supported, VMID is set to -1 and ignored from STE
and CMD_TLBI_NH* cmds.

Update smmu_iotlb_insert trace event to have vmid.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-8-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmu-internal.h       |  2 ++
 include/hw/arm/smmu-common.h |  5 +++--
 hw/arm/smmu-common.c         | 36 ++++++++++++++++++++++--------------
 hw/arm/smmuv3.c              | 12 +++++++++---
 hw/arm/trace-events          |  6 +++---
 5 files changed, 39 insertions(+), 22 deletions(-)

diff --git a/hw/arm/smmu-internal.h b/hw/arm/smmu-internal.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-internal.h
+++ b/hw/arm/smmu-internal.h
@@ -XXX,XX +XXX,XX @@ static inline int pgd_concat_idx(int start_level, int granule_sz,
 }
 
 #define SMMU_IOTLB_ASID(key) ((key).asid)
+#define SMMU_IOTLB_VMID(key) ((key).vmid)
 
 typedef struct SMMUIOTLBPageInvInfo {
     int asid;
+    int vmid;
     uint64_t iova;
     uint64_t mask;
 } SMMUIOTLBPageInvInfo;
diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ typedef struct SMMUPciBus {
 typedef struct SMMUIOTLBKey {
     uint64_t iova;
     uint16_t asid;
+    uint16_t vmid;
     uint8_t tg;
     uint8_t level;
 } SMMUIOTLBKey;
@@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid);
 SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
                                 SMMUTransTableInfo *tt, hwaddr iova);
 void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *entry);
-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
+SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level);
 void smmu_iotlb_inv_all(SMMUState *s);
 void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
-void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
+void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl);
 
 /* Unmap the range of all the notifiers registered to any IOMMU mr */
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static guint smmu_iotlb_key_hash(gconstpointer v)
 
     /* Jenkins hash */
     a = b = c = JHASH_INITVAL + sizeof(*key);
-    a += key->asid + key->level + key->tg;
+    a += key->asid + key->vmid + key->level + key->tg;
     b += extract64(key->iova, 0, 32);
     c += extract64(key->iova, 32, 32);
 
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_iotlb_key_equal(gconstpointer v1, gconstpointer v2)
     SMMUIOTLBKey *k1 = (SMMUIOTLBKey *)v1, *k2 = (SMMUIOTLBKey *)v2;
 
     return (k1->asid == k2->asid) && (k1->iova == k2->iova) &&
-           (k1->level == k2->level) && (k1->tg == k2->tg);
+           (k1->level == k2->level) && (k1->tg == k2->tg) &&
+           (k1->vmid == k2->vmid);
 }
 
-SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint64_t iova,
+SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level)
 {
-    SMMUIOTLBKey key = {.asid = asid, .iova = iova, .tg = tg, .level = level};
+    SMMUIOTLBKey key = {.asid = asid, .vmid = vmid, .iova = iova,
+                        .tg = tg, .level = level};
 
     return key;
 }
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
         uint64_t mask = subpage_size - 1;
         SMMUIOTLBKey key;
 
-        key = smmu_get_iotlb_key(cfg->asid, iova & ~mask, tg, level);
+        key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid,
+                                 iova & ~mask, tg, level);
         entry = g_hash_table_lookup(bs->iotlb, &key);
         if (entry) {
             break;
@@ -XXX,XX +XXX,XX @@ SMMUTLBEntry *smmu_iotlb_lookup(SMMUState *bs, SMMUTransCfg *cfg,
 
     if (entry) {
         cfg->iotlb_hits++;
-        trace_smmu_iotlb_lookup_hit(cfg->asid, iova,
+        trace_smmu_iotlb_lookup_hit(cfg->asid, cfg->s2cfg.vmid, iova,
                                     cfg->iotlb_hits, cfg->iotlb_misses,
                                     100 * cfg->iotlb_hits /
                                     (cfg->iotlb_hits + cfg->iotlb_misses));
     } else {
         cfg->iotlb_misses++;
-        trace_smmu_iotlb_lookup_miss(cfg->asid, iova,
+        trace_smmu_iotlb_lookup_miss(cfg->asid, cfg->s2cfg.vmid, iova,
                                      cfg->iotlb_hits, cfg->iotlb_misses,
                                      100 * cfg->iotlb_hits /
                                      (cfg->iotlb_hits + cfg->iotlb_misses));
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_insert(SMMUState *bs, SMMUTransCfg *cfg, SMMUTLBEntry *new)
         smmu_iotlb_inv_all(bs);
     }
 
-    *key = smmu_get_iotlb_key(cfg->asid, new->entry.iova, tg, new->level);
-    trace_smmu_iotlb_insert(cfg->asid, new->entry.iova, tg, new->level);
+    *key = smmu_get_iotlb_key(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
+                              tg, new->level);
+    trace_smmu_iotlb_insert(cfg->asid, cfg->s2cfg.vmid, new->entry.iova,
+                            tg, new->level);
     g_hash_table_insert(bs->iotlb, key, new);
 }
 
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
 
     return SMMU_IOTLB_ASID(*iotlb_key) == asid;
 }
-
-static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
+static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                               gpointer user_data)
 {
     SMMUTLBEntry *iter = (SMMUTLBEntry *)value;
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid_iova(gpointer key, gpointer value,
     if (info->asid >= 0 && info->asid != SMMU_IOTLB_ASID(iotlb_key)) {
         return false;
     }
+    if (info->vmid >= 0 && info->vmid != SMMU_IOTLB_VMID(iotlb_key)) {
+        return false;
+    }
     return ((info->iova & ~entry->addr_mask) == entry->iova) ||
            ((entry->iova & ~info->mask) == info->iova);
 }
 
-void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
+void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl)
 {
     /* if tg is not set we use 4KB range invalidation */
     uint8_t granule = tg ? tg * 2 + 10 : 12;
 
     if (ttl && (num_pages == 1) && (asid >= 0)) {
-        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, iova, tg, ttl);
+        SMMUIOTLBKey key = smmu_get_iotlb_key(asid, vmid, iova, tg, ttl);
 
         if (g_hash_table_remove(s->iotlb, &key)) {
             return;
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_iova(SMMUState *s, int asid, dma_addr_t iova,
 
     SMMUIOTLBPageInvInfo info = {
         .asid = asid, .iova = iova,
+        .vmid = vmid,
         .mask = (num_pages * 1 << granule) - 1};
 
     g_hash_table_foreach_remove(s->iotlb,
-                                smmu_hash_remove_by_asid_iova,
+                                smmu_hash_remove_by_asid_vmid_iova,
                                 &info);
 }
 
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
 {
     dma_addr_t end, addr = CMD_ADDR(cmd);
     uint8_t type = CMD_TYPE(cmd);
-    uint16_t vmid = CMD_VMID(cmd);
+    int vmid = -1;
     uint8_t scale = CMD_SCALE(cmd);
     uint8_t num = CMD_NUM(cmd);
     uint8_t ttl = CMD_TTL(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     uint64_t num_pages;
     uint8_t granule;
     int asid = -1;
+    SMMUv3State *smmuv3 = ARM_SMMUV3(s);
+
+    /* Only consider VMID if stage-2 is supported. */
+    if (STAGE2_SUPPORTED(smmuv3)) {
+        vmid = CMD_VMID(cmd);
+    }
 
     if (type == SMMU_CMD_TLBI_NH_VA) {
         asid = CMD_ASID(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     if (!tg) {
         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
-        smmu_iotlb_inv_iova(s, asid, addr, tg, 1, ttl);
+        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
         num_pages = (mask + 1) >> granule;
         trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
-        smmu_iotlb_inv_iova(s, asid, addr, tg, num_pages, ttl);
+        smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
     }
 }
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_iotlb_inv_all(void) "IOTLB invalidate all"
 smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
 smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
 smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
-smmu_iotlb_lookup_hit(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-smmu_iotlb_lookup_miss(uint16_t asid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
-smmu_iotlb_insert(uint16_t asid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d addr=0x%"PRIx64" tg=%d level=%d"
+smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
+smmu_iotlb_lookup_miss(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache MISS asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
+smmu_iotlb_insert(uint16_t asid, uint16_t vmid, uint64_t addr, uint8_t tg, uint8_t level) "IOTLB ++ asid=%d vmid=%d addr=0x%"PRIx64" tg=%d level=%d"
 
 # smmuv3.c
 smmuv3_read_mmio(uint64_t addr, uint64_t val, unsigned size, uint32_t r) "addr: 0x%"PRIx64" val:0x%"PRIx64" size: 0x%x(%d)"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

CMD_TLBI_S2_IPA: As S1+S2 is not enabled, for now this can be the
same as CMD_TLBI_NH_VAA.

CMD_TLBI_S12_VMALL: Added new function to invalidate TLB by VMID.

For stage-1 only commands, add a check to throw CERROR_ILL if used
when stage-1 is not supported.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-9-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h |  1 +
 hw/arm/smmu-common.c         | 16 +++++++++++
 hw/arm/smmuv3.c              | 55 ++++++++++++++++++++++++++++++------
 hw/arm/trace-events          |  4 ++-
 4 files changed, 67 insertions(+), 9 deletions(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@ SMMUIOTLBKey smmu_get_iotlb_key(uint16_t asid, uint16_t vmid, uint64_t iova,
                                 uint8_t tg, uint8_t level);
 void smmu_iotlb_inv_all(SMMUState *s);
 void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid);
+void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid);
 void smmu_iotlb_inv_iova(SMMUState *s, int asid, int vmid, dma_addr_t iova,
                          uint8_t tg, uint64_t num_pages, uint8_t ttl);
 
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ static gboolean smmu_hash_remove_by_asid(gpointer key, gpointer value,
 
     return SMMU_IOTLB_ASID(*iotlb_key) == asid;
 }
+
+static gboolean smmu_hash_remove_by_vmid(gpointer key, gpointer value,
+                                         gpointer user_data)
+{
+    uint16_t vmid = *(uint16_t *)user_data;
+    SMMUIOTLBKey *iotlb_key = (SMMUIOTLBKey *)key;
+
+    return SMMU_IOTLB_VMID(*iotlb_key) == vmid;
+}
+
 static gboolean smmu_hash_remove_by_asid_vmid_iova(gpointer key, gpointer value,
                                               gpointer user_data)
 {
@@ -XXX,XX +XXX,XX @@ void smmu_iotlb_inv_asid(SMMUState *s, uint16_t asid)
     g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_asid, &asid);
 }
 
+inline void smmu_iotlb_inv_vmid(SMMUState *s, uint16_t vmid)
+{
+    trace_smmu_iotlb_inv_vmid(vmid);
+    g_hash_table_foreach_remove(s->iotlb, smmu_hash_remove_by_vmid, &vmid);
+}
+
 /* VMSAv8-64 Translation */
 
 /**
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
     }
 }
 
-static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
+static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 {
     dma_addr_t end, addr = CMD_ADDR(cmd);
     uint8_t type = CMD_TYPE(cmd);
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
     }
 
     if (!tg) {
-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
+        trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
@@ -XXX,XX +XXX,XX @@ static void smmuv3_s1_range_inval(SMMUState *s, Cmd *cmd)
         uint64_t mask = dma_aligned_pow2_mask(addr, end, 64);
 
         num_pages = (mask + 1) >> granule;
-        trace_smmuv3_s1_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
+        trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
         smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
         {
             uint16_t asid = CMD_ASID(&cmd);
 
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+
             trace_smmuv3_cmdq_tlbi_nh_asid(asid);
             smmu_inv_notifiers_all(&s->smmu_state);
             smmu_iotlb_inv_asid(bs, asid);
             break;
         }
         case SMMU_CMD_TLBI_NH_ALL:
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            QEMU_FALLTHROUGH;
         case SMMU_CMD_TLBI_NSNH_ALL:
             trace_smmuv3_cmdq_tlbi_nh();
             smmu_inv_notifiers_all(&s->smmu_state);
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
             break;
         case SMMU_CMD_TLBI_NH_VAA:
         case SMMU_CMD_TLBI_NH_VA:
-            smmuv3_s1_range_inval(bs, &cmd);
+            if (!STAGE1_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            smmuv3_range_inval(bs, &cmd);
+            break;
+        case SMMU_CMD_TLBI_S12_VMALL:
+        {
+            uint16_t vmid = CMD_VMID(&cmd);
+
+            if (!STAGE2_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+
+            trace_smmuv3_cmdq_tlbi_s12_vmid(vmid);
+            smmu_inv_notifiers_all(&s->smmu_state);
+            smmu_iotlb_inv_vmid(bs, vmid);
+            break;
+        }
+        case SMMU_CMD_TLBI_S2_IPA:
+            if (!STAGE2_SUPPORTED(s)) {
+                cmd_error = SMMU_CERROR_ILL;
+                break;
+            }
+            /*
+             * As currently only either s1 or s2 are supported
+             * we can reuse same function for s2.
+             */
+            smmuv3_range_inval(bs, &cmd);
             break;
         case SMMU_CMD_TLBI_EL3_ALL:
         case SMMU_CMD_TLBI_EL3_VA:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
         case SMMU_CMD_TLBI_EL2_ASID:
         case SMMU_CMD_TLBI_EL2_VA:
         case SMMU_CMD_TLBI_EL2_VAA:
-        case SMMU_CMD_TLBI_S12_VMALL:
-        case SMMU_CMD_TLBI_S2_IPA:
         case SMMU_CMD_ATC_INV:
         case SMMU_CMD_PRI_RESP:
         case SMMU_CMD_RESUME:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_cmdq_consume(SMMUv3State *s)
             break;
         default:
             cmd_error = SMMU_CERROR_ILL;
-            qemu_log_mask(LOG_GUEST_ERROR,
-                          "Illegal command type: %d\n", CMD_TYPE(&cmd));
             break;
         }
         qemu_mutex_unlock(&s->mutex);
         if (cmd_error) {
+            if (cmd_error == SMMU_CERROR_ILL) {
+                qemu_log_mask(LOG_GUEST_ERROR,
+                              "Illegal command type: %d\n", CMD_TYPE(&cmd));
+            }
             break;
         }
         /*
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmu_ptw_block_pte(int stage, int level, uint64_t baseaddr, uint64_t pteaddr, ui
 smmu_get_pte(uint64_t baseaddr, int index, uint64_t pteaddr, uint64_t pte) "baseaddr=0x%"PRIx64" index=0x%x, pteaddr=0x%"PRIx64", pte=0x%"PRIx64
 smmu_iotlb_inv_all(void) "IOTLB invalidate all"
 smmu_iotlb_inv_asid(uint16_t asid) "IOTLB invalidate asid=%d"
+smmu_iotlb_inv_vmid(uint16_t vmid) "IOTLB invalidate vmid=%d"
 smmu_iotlb_inv_iova(uint16_t asid, uint64_t addr) "IOTLB invalidate asid=%d addr=0x%"PRIx64
 smmu_inv_notifiers_mr(const char *name) "iommu mr=%s"
 smmu_iotlb_lookup_hit(uint16_t asid, uint16_t vmid, uint64_t addr, uint32_t hit, uint32_t miss, uint32_t p) "IOTLB cache HIT asid=%d vmid=%d addr=0x%"PRIx64" hit=%d miss=%d hit rate=%d"
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_cfgi_ste_range(int start, int end) "start=0x%x - end=0x%x"
 smmuv3_cmdq_cfgi_cd(uint32_t sid) "sid=0x%x"
 smmuv3_config_cache_hit(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache HIT for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
 smmuv3_config_cache_miss(uint32_t sid, uint32_t hits, uint32_t misses, uint32_t perc) "Config cache MISS for sid=0x%x (hits=%d, misses=%d, hit rate=%d)"
-smmuv3_s1_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
+smmuv3_range_inval(int vmid, int asid, uint64_t addr, uint8_t tg, uint64_t num_pages, uint8_t ttl, bool leaf) "vmid=%d asid=%d addr=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64" ttl=%d leaf=%d"
 smmuv3_cmdq_tlbi_nh(void) ""
 smmuv3_cmdq_tlbi_nh_asid(uint16_t asid) "asid=%d"
+smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
 smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
 smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
 smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

In smmuv3_notify_iova, read the granule based on translation stage
and use VMID if valid value is sent.

Signed-off-by: Mostafa Saleh <smostafa@google.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-10-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/smmuv3.c     | 39 ++++++++++++++++++++++++++-------------
 hw/arm/trace-events |  2 +-
 2 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@ epilogue:
  * @mr: IOMMU mr region handle
  * @n: notifier to be called
  * @asid: address space ID or negative value if we don't care
+ * @vmid: virtual machine ID or negative value if we don't care
  * @iova: iova
  * @tg: translation granule (if communicated through range invalidation)
  * @num_pages: number of @granule sized pages (if tg != 0), otherwise 1
  */
 static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
                                IOMMUNotifier *n,
-                               int asid, dma_addr_t iova,
-                               uint8_t tg, uint64_t num_pages)
+                               int asid, int vmid,
+                               dma_addr_t iova, uint8_t tg,
+                               uint64_t num_pages)
 {
     SMMUDevice *sdev = container_of(mr, SMMUDevice, iommu);
     IOMMUTLBEvent event;
     uint8_t granule;
+    SMMUv3State *s = sdev->smmu;
 
     if (!tg) {
         SMMUEventInfo event = {.inval_ste_allowed = true};
@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
             return;
         }
 
-        tt = select_tt(cfg, iova);
-        if (!tt) {
+        if (vmid >= 0 && cfg->s2cfg.vmid != vmid) {
             return;
         }
-        granule = tt->granule_sz;
+
+        if (STAGE1_SUPPORTED(s)) {
+            tt = select_tt(cfg, iova);
+            if (!tt) {
+                return;
+            }
+            granule = tt->granule_sz;
+        } else {
+            granule = cfg->s2cfg.granule_sz;
+        }
+
     } else {
         granule = tg * 2 + 10;
     }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_notify_iova(IOMMUMemoryRegion *mr,
     memory_region_notify_iommu_one(n, &event);
 }
 
-/* invalidate an asid/iova range tuple in all mr's */
-static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
-                                      uint8_t tg, uint64_t num_pages)
+/* invalidate an asid/vmid/iova range tuple in all mr's */
+static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, int vmid,
+                                      dma_addr_t iova, uint8_t tg,
+                                      uint64_t num_pages)
 {
     SMMUDevice *sdev;
 
@@ -XXX,XX +XXX,XX @@ static void smmuv3_inv_notifiers_iova(SMMUState *s, int asid, dma_addr_t iova,
         IOMMUMemoryRegion *mr = &sdev->iommu;
         IOMMUNotifier *n;
 
-        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, iova,
-                                        tg, num_pages);
+        trace_smmuv3_inv_notifiers_iova(mr->parent_obj.name, asid, vmid,
+                                        iova, tg, num_pages);
 
         IOMMU_NOTIFIER_FOREACH(n, mr) {
-            smmuv3_notify_iova(mr, n, asid, iova, tg, num_pages);
+            smmuv3_notify_iova(mr, n, asid, vmid, iova, tg, num_pages);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 
     if (!tg) {
         trace_smmuv3_range_inval(vmid, asid, addr, tg, 1, ttl, leaf);
-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, 1);
+        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, 1);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, 1, ttl);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void smmuv3_range_inval(SMMUState *s, Cmd *cmd)
 
         num_pages = (mask + 1) >> granule;
         trace_smmuv3_range_inval(vmid, asid, addr, tg, num_pages, ttl, leaf);
-        smmuv3_inv_notifiers_iova(s, asid, addr, tg, num_pages);
+        smmuv3_inv_notifiers_iova(s, asid, vmid, addr, tg, num_pages);
         smmu_iotlb_inv_iova(s, asid, vmid, addr, tg, num_pages, ttl);
         addr += mask + 1;
     }
diff --git a/hw/arm/trace-events b/hw/arm/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/trace-events
+++ b/hw/arm/trace-events
@@ -XXX,XX +XXX,XX @@ smmuv3_cmdq_tlbi_s12_vmid(uint16_t vmid) "vmid=%d"
 smmuv3_config_cache_inv(uint32_t sid) "Config cache INV for sid=0x%x"
 smmuv3_notify_flag_add(const char *iommu) "ADD SMMUNotifier node for iommu mr=%s"
 smmuv3_notify_flag_del(const char *iommu) "DEL SMMUNotifier node for iommu mr=%s"
-smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
+smmuv3_inv_notifiers_iova(const char *name, uint16_t asid, uint16_t vmid, uint64_t iova, uint8_t tg, uint64_t num_pages) "iommu mr=%s asid=%d vmid=%d iova=0x%"PRIx64" tg=%d num_pages=0x%"PRIx64
 
-- 
2.34.1

From: Mostafa Saleh <smostafa@google.com>

As everything is in place, we can use a new system property to
advertise which stage is supported and remove bad_ste from STE
stage2 config.

The property added arm-smmuv3.stage can have 3 values:
- "1": Stage-1 only is advertised.
- "2": Stage-2 only is advertised.

If not passed or an unsupported value is passed, it will default to
stage-1.

Advertise VMID16.

Don't try to decode CD, if stage-2 is configured.

Reviewed-by: Eric Auger <eric.auger@redhat.com>
Signed-off-by: Mostafa Saleh <smostafa@google.com>
Tested-by: Eric Auger <eric.auger@redhat.com>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Message-id: 20230516203327.2051088-11-smostafa@google.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmuv3.h |  1 +
 hw/arm/smmuv3.c         | 32 ++++++++++++++++++++++----------
 2 files changed, 23 insertions(+), 10 deletions(-)

diff --git a/include/hw/arm/smmuv3.h b/include/hw/arm/smmuv3.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmuv3.h
+++ b/include/hw/arm/smmuv3.h
@@ -XXX,XX +XXX,XX @@ struct SMMUv3State {
 
     qemu_irq     irq[4];
     QemuMutex mutex;
+    char *stage;
 };
 
 typedef enum {
diff --git a/hw/arm/smmuv3.c b/hw/arm/smmuv3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmuv3.c
+++ b/hw/arm/smmuv3.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/irq.h"
 #include "hw/sysbus.h"
 #include "migration/vmstate.h"
+#include "hw/qdev-properties.h"
 #include "hw/qdev-core.h"
 #include "hw/pci/pci.h"
 #include "cpu.h"
@@ -XXX,XX +XXX,XX @@ void smmuv3_record_event(SMMUv3State *s, SMMUEventInfo *info)
 
 static void smmuv3_init_regs(SMMUv3State *s)
 {
-    /**
-     * IDR0: stage1 only, AArch64 only, coherent access, 16b ASID,
-     *       multi-level stream table
-     */
-    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1); /* stage 1 supported */
+    /* Based on sys property, the stages supported in smmu will be advertised.*/
+    if (s->stage && !strcmp("2", s->stage)) {
+        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S2P, 1);
+    } else {
+        s->idr[0] = FIELD_DP32(s->idr[0], IDR0, S1P, 1);
+    }
+
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTF, 2); /* AArch64 PTW only */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, COHACC, 1); /* IO coherent */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, ASID16, 1); /* 16-bit ASID */
+    s->idr[0] = FIELD_DP32(s->idr[0], IDR0, VMID16, 1); /* 16-bit VMID */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, TTENDIAN, 2); /* little endian */
     s->idr[0] = FIELD_DP32(s->idr[0], IDR0, STALL_MODEL, 1); /* No stall */
     /* terminated transaction will always be aborted/error returned */
@@ -XXX,XX +XXX,XX @@ static int decode_ste_s2_cfg(SMMUTransCfg *cfg, STE *ste)
         goto bad_ste;
     }
 
-    /* This is still here as stage 2 has not been fully enabled yet. */
-    qemu_log_mask(LOG_UNIMP, "SMMUv3 does not support stage 2 yet\n");
-    goto bad_ste;
-
     return 0;
 
 bad_ste:
@@ -XXX,XX +XXX,XX @@ static int smmuv3_decode_config(IOMMUMemoryRegion *mr, SMMUTransCfg *cfg,
         return ret;
     }
 
-    if (cfg->aborted || cfg->bypassed) {
+    if (cfg->aborted || cfg->bypassed || (cfg->stage == 2)) {
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_smmuv3 = {
     }
 };
 
+static Property smmuv3_properties[] = {
+    /*
+     * Stages of translation advertised.
+     * "1": Stage 1
+     * "2": Stage 2
+     * Defaults to stage 1
+     */
+    DEFINE_PROP_STRING("stage", SMMUv3State, stage),
+    DEFINE_PROP_END_OF_LIST()
+};
+
 static void smmuv3_instance_init(Object *obj)
 {
     /* Nothing much to do here as of now */
@@ -XXX,XX +XXX,XX @@ static void smmuv3_class_init(ObjectClass *klass, void *data)
                                        &c->parent_phases);
     c->parent_realize = dc->realize;
     dc->realize = smmu_realize;
+    device_class_set_props(dc, smmuv3_properties);
 }
 
 static int smmuv3_notify_flag_changed(IOMMUMemoryRegion *iommu,
-- 
2.34.1

From: Tommy Wu <tommy.wu@sifive.com>

When we receive a packet from the xilinx_axienet and then try to s2mem
through the xilinx_axidma, if the descriptor ring buffer is full in the
xilinx axidma driver, we’ll assert the DMASR.HALTED in the
function : stream_process_s2mem and return 0. In the end, we’ll be stuck in
an infinite loop in axienet_eth_rx_notify.

This patch checks the DMASR.HALTED state when we try to push data
from xilinx axi-enet to xilinx axi-dma. When the DMASR.HALTED is asserted,
we will not keep pushing the data and then prevent the infinte loop.

Signed-off-by: Tommy Wu <tommy.wu@sifive.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Frank Chang <frank.chang@sifive.com>
Message-id: 20230519062137.1251741-1-tommy.wu@sifive.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/dma/xilinx_axidma.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/hw/dma/xilinx_axidma.c b/hw/dma/xilinx_axidma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xilinx_axidma.c
+++ b/hw/dma/xilinx_axidma.c
@@ -XXX,XX +XXX,XX @@ static inline int stream_idle(struct Stream *s)
     return !!(s->regs[R_DMASR] & DMASR_IDLE);
 }
 
+static inline int stream_halted(struct Stream *s)
+{
+    return !!(s->regs[R_DMASR] & DMASR_HALTED);
+}
+
 static void stream_reset(struct Stream *s)
 {
     s->regs[R_DMASR] = DMASR_HALTED;  /* starts up halted.  */
@@ -XXX,XX +XXX,XX @@ static void stream_process_mem2s(struct Stream *s, StreamSink *tx_data_dev,
     uint64_t addr;
     bool eop;
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static size_t stream_process_s2mem(struct Stream *s, unsigned char *buf,
     unsigned int rxlen;
     size_t pos = 0;
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ xilinx_axidma_data_stream_can_push(StreamSink *obj,
     XilinxAXIDMAStreamSink *ds = XILINX_AXI_DMA_DATA_STREAM(obj);
     struct Stream *s = &ds->dma->streams[1];
 
-    if (!stream_running(s) || stream_idle(s)) {
+    if (!stream_running(s) || stream_idle(s) || stream_halted(s)) {
         ds->dma->notify = notify;
         ds->dma->notify_opaque = notify_opaque;
         return false;
-- 
2.34.1

From: Clément Chigot <chigot@adacore.com>

When passing --smp with a number lower than XLNX_ZYNQMP_NUM_APU_CPUS,
the expression (ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS) will result
in a positive number as ms->smp.cpus is a unsigned int.
This will raise the following error afterwards, as Qemu will try to
instantiate some additional RPUs.
  | $ qemu-system-aarch64 --smp 1 -M xlnx-zcu102
  | **
  | ERROR:../src/tcg/tcg.c:777:tcg_register_thread:
  |   assertion failed: (n < tcg_max_ctxs)

Signed-off-by: Clément Chigot <chigot@adacore.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Tested-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20230524143714.565792-1-chigot@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zynqmp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(MachineState *ms, XlnxZynqMPState *s,
                                    const char *boot_cpu, Error **errp)
 {
     int i;
-    int num_rpus = MIN(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS,
+    int num_rpus = MIN((int)(ms->smp.cpus - XLNX_ZYNQMP_NUM_APU_CPUS),
                        XLNX_ZYNQMP_NUM_RPU_CPUS);
 
     if (num_rpus <= 0) {
-- 
2.34.1

From: Thomas Huth <thuth@redhat.com>

pflash-cfi02-test.c always uses the "musicpal" machine for testing,
test-arm-mptimer.c always uses the "vexpress-a9" machine, and
microbit-test.c requires the "microbit" machine, so we should only
run these tests if the machines have been enabled in the configuration.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Fabiano Rosas <farosas@suse.de>
Message-id: 20230524080600.1618137-1-thuth@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/meson.build | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_arm = \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_DUALTIMER') ? ['cmsdk-apb-dualtimer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_TIMER') ? ['cmsdk-apb-timer-test'] : []) + \
   (config_all_devices.has_key('CONFIG_CMSDK_APB_WATCHDOG') ? ['cmsdk-apb-watchdog-test'] : []) + \
-  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') ? ['pflash-cfi02-test'] : []) +         \
+  (config_all_devices.has_key('CONFIG_PFLASH_CFI02') and
+   config_all_devices.has_key('CONFIG_MUSICPAL') ? ['pflash-cfi02-test'] : []) + \
   (config_all_devices.has_key('CONFIG_ASPEED_SOC') ? qtests_aspeed : []) + \
   (config_all_devices.has_key('CONFIG_NPCM7XX') ? qtests_npcm7xx : []) + \
   (config_all_devices.has_key('CONFIG_GENERIC_LOADER') ? ['hexloader-test'] : []) + \
   (config_all_devices.has_key('CONFIG_TPM_TIS_I2C') ? ['tpm-tis-i2c-test'] : []) + \
+  (config_all_devices.has_key('CONFIG_VEXPRESS') ? ['test-arm-mptimer'] : []) + \
+  (config_all_devices.has_key('CONFIG_MICROBIT') ? ['microbit-test'] : []) + \
   ['arm-cpu-features',
-   'microbit-test',
-   'test-arm-mptimer',
    'boot-serial-test']
 
 # TODO: once aarch64 TCG is fixed on ARM 32 bit host, make bios-tables-test unconditional
-- 
2.34.1

For M-profile, there is no guest-facing A-profile format FSR, but we
still use the env->exception.fsr field to pass fault information from
the point where a fault is raised to the code in
arm_v7m_cpu_do_interrupt() which interprets it and sets the M-profile
specific fault status registers.  So it doesn't matter whether we
fill in env->exception.fsr in the short format or the LPAE format, as
long as both sides agree.  As it happens arm_v7m_cpu_do_interrupt()
assumes short-form.

In compute_fsr_fsc() we weren't explicitly choosing short-form for
M-profile, but instead relied on it falling out in the wash because
arm_s1_regime_using_lpae_format() would be false.  This was broken in
commit 452c67a4 when we added v8R support, because we said "PMSAv8 is
always LPAE format" (as it is for v8R), forgetting that we were
implicitly using this code path on M-profile. At that point we would
hit a g_assert_not_reached():
 ERROR:../../target/arm/internals.h:549:arm_fi_to_lfsc: code should not be reached

#7  0x0000555555e055f7 in arm_fi_to_lfsc (fi=0x7fffecff9a90) at ../../target/arm/internals.h:549
#8  0x0000555555e05a27 in compute_fsr_fsc (env=0x555557356670, fi=0x7fffecff9a90, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff9a1c)
    at ../../target/arm/tlb_helper.c:95
#9  0x0000555555e05b62 in arm_deliver_fault (cpu=0x555557354800, addr=268961344, access_type=MMU_INST_FETCH, mmu_idx=1, fi=0x7fffecff9a90)
    at ../../target/arm/tlb_helper.c:132
#10 0x0000555555e06095 in arm_cpu_tlb_fill (cs=0x555557354800, address=268961344, size=1, access_type=MMU_INST_FETCH, mmu_idx=1, probe=false, retaddr=0)
    at ../../target/arm/tlb_helper.c:260

The specific assertion changed when commit fcc7404eff24b4c added
"assert not M-profile" to arm_is_secure_below_el3(), because the
conditions being checked in compute_fsr_fsc() include
arm_el_is_aa64(), which will end up calling arm_is_secure_below_el3()
and asserting before we try to call arm_fi_to_lfsc():

#7  0x0000555555efaf43 in arm_is_secure_below_el3 (env=0x5555574665a0) at ../../target/arm/cpu.h:2396
#8  0x0000555555efb103 in arm_is_el2_enabled (env=0x5555574665a0) at ../../target/arm/cpu.h:2448
#9  0x0000555555efb204 in arm_el_is_aa64 (env=0x5555574665a0, el=1) at ../../target/arm/cpu.h:2509
#10 0x0000555555efbdfd in compute_fsr_fsc (env=0x5555574665a0, fi=0x7fffecff99e0, target_el=1, mmu_idx=1, ret_fsc=0x7fffecff996c)

Avoid the assertion and the incorrect FSR format selection by
explicitly making M-profile use the short-format in this function.

Fixes: 452c67a42704 ("target/arm: Enable TTBCR_EAE for ARMv8-R AArch32")a
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1658
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230523131726.866635-1-peter.maydell@linaro.org
---
 target/arm/tcg/tlb_helper.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/target/arm/tcg/tlb_helper.c b/target/arm/tcg/tlb_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/tlb_helper.c
+++ b/target/arm/tcg/tlb_helper.c
@@ -XXX,XX +XXX,XX @@ static uint32_t compute_fsr_fsc(CPUARMState *env, ARMMMUFaultInfo *fi,
     ARMMMUIdx arm_mmu_idx = core_to_arm_mmu_idx(env, mmu_idx);
     uint32_t fsr, fsc;
 
-    if (target_el == 2 || arm_el_is_aa64(env, target_el) ||
-        arm_s1_regime_using_lpae_format(env, arm_mmu_idx)) {
+    /*
+     * For M-profile there is no guest-facing FSR. We compute a
+     * short-form value for env->exception.fsr which we will then
+     * examine in arm_v7m_cpu_do_interrupt(). In theory we could
+     * use the LPAE format instead as long as both bits of code agree
+     * (and arm_fi_to_lfsc() handled the M-profile specific
+     * ARMFault_QEMU_NSCExec and ARMFault_QEMU_SFault cases).
+     */
+    if (!arm_feature(env, ARM_FEATURE_M) &&
+        (target_el == 2 || arm_el_is_aa64(env, target_el) ||
+         arm_s1_regime_using_lpae_format(env, arm_mmu_idx))) {
         /*
          * LPAE format fault status register : bottom 6 bits are
          * status code in the same form as needed for syndrome
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

When we moved the arm default CONFIGs into Kconfig and removed them
from default.mak, we made it harder to identify which CONFIGs are
selected by default in case users want to disable them.

Bring back the default entries into default.mak, but keep them
commented out. This way users can keep their workflows of editing
default.mak to remove build options without needing to search through
Kconfig.

Reported-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20230523180525.29994-3-farosas@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 configs/devices/aarch64-softmmu/default.mak |  6 ++++
 configs/devices/arm-softmmu/default.mak     | 40 +++++++++++++++++++++
 2 files changed, 46 insertions(+)

diff --git a/configs/devices/aarch64-softmmu/default.mak b/configs/devices/aarch64-softmmu/default.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/devices/aarch64-softmmu/default.mak
+++ b/configs/devices/aarch64-softmmu/default.mak
@@ -XXX,XX +XXX,XX @@
 
 # We support all the 32 bit boards so need all their config
 include ../arm-softmmu/default.mak
+
+# These are selected by default when TCG is enabled, uncomment them to
+# keep out of the build.
+# CONFIG_XLNX_ZYNQMP_ARM=n
+# CONFIG_XLNX_VERSAL=n
+# CONFIG_SBSA_REF=n
diff --git a/configs/devices/arm-softmmu/default.mak b/configs/devices/arm-softmmu/default.mak
index XXXXXXX..XXXXXXX 100644
--- a/configs/devices/arm-softmmu/default.mak
+++ b/configs/devices/arm-softmmu/default.mak
@@ -XXX,XX +XXX,XX @@
 # CONFIG_TEST_DEVICES=n
 
 CONFIG_ARM_VIRT=y
+
+# These are selected by default when TCG is enabled, uncomment them to
+# keep out of the build.
+# CONFIG_CUBIEBOARD=n
+# CONFIG_EXYNOS4=n
+# CONFIG_HIGHBANK=n
+# CONFIG_INTEGRATOR=n
+# CONFIG_FSL_IMX31=n
+# CONFIG_MUSICPAL=n
+# CONFIG_MUSCA=n
+# CONFIG_CHEETAH=n
+# CONFIG_SX1=n
+# CONFIG_NSERIES=n
+# CONFIG_STELLARIS=n
+# CONFIG_STM32VLDISCOVERY=n
+# CONFIG_REALVIEW=n
+# CONFIG_VERSATILE=n
+# CONFIG_VEXPRESS=n
+# CONFIG_ZYNQ=n
+# CONFIG_MAINSTONE=n
+# CONFIG_GUMSTIX=n
+# CONFIG_SPITZ=n
+# CONFIG_TOSA=n
+# CONFIG_Z2=n
+# CONFIG_NPCM7XX=n
+# CONFIG_COLLIE=n
+# CONFIG_ASPEED_SOC=n
+# CONFIG_NETDUINO2=n
+# CONFIG_NETDUINOPLUS2=n
+# CONFIG_OLIMEX_STM32_H405=n
+# CONFIG_MPS2=n
+# CONFIG_RASPI=n
+# CONFIG_DIGIC=n
+# CONFIG_SABRELITE=n
+# CONFIG_EMCRAFT_SF2=n
+# CONFIG_MICROBIT=n
+# CONFIG_FSL_IMX25=n
+# CONFIG_FSL_IMX7=n
+# CONFIG_FSL_IMX6UL=n
+# CONFIG_ALLWINNER_H3=n
-- 
2.34.1

From: Fabiano Rosas <farosas@suse.de>

Replace the 'default y if TCG' pattern with 'default y; depends on
TCG'.

That makes explict that there is a dependence on TCG and enabling
these CONFIGs via .mak files without TCG present will fail earlier.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Fabiano Rosas <farosas@suse.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20230523180525.29994-4-farosas@suse.de
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/Kconfig | 123 ++++++++++++++++++++++++++++++++-----------------
 1 file changed, 82 insertions(+), 41 deletions(-)

diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
 
 config CHEETAH
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
     select TSC210X
 
 config CUBIEBOARD
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ALLWINNER_A10
 
 config DIGIC
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PTIMER
     select PFLASH_CFI02
 
 config EXYNOS4
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select A9MPCORE
     select I2C
@@ -XXX,XX +XXX,XX @@ config EXYNOS4
 
 config HIGHBANK
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select A15MPCORE
     select AHCI
@@ -XXX,XX +XXX,XX @@ config HIGHBANK
 
 config INTEGRATOR
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARM_TIMER
     select INTEGRATOR_DEBUG
     select PL011 # UART
@@ -XXX,XX +XXX,XX @@ config INTEGRATOR
 
 config MAINSTONE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PXA2XX
     select PFLASH_CFI01
     select SMC91C111
 
 config MUSCA
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARMSSE
     select PL011
     select PL031
@@ -XXX,XX +XXX,XX @@ config MARVELL_88W8618
 
 config MUSICPAL
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
@@ -XXX,XX +XXX,XX @@ config MUSICPAL
 
 config NETDUINO2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F205_SOC
 
 config NETDUINOPLUS2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F405_SOC
 
 config OLIMEX_STM32_H405
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F405_SOC
 
 config NSERIES
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
     select TMP105   # temperature sensor
     select BLIZZARD # LCD/TV controller
@@ -XXX,XX +XXX,XX @@ config PXA2XX
 
 config GUMSTIX
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select SMC91C111
     select PXA2XX
 
 config TOSA
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ZAURUS  # scoop
     select MICRODRIVE
     select PXA2XX
@@ -XXX,XX +XXX,XX @@ config TOSA
 
 config SPITZ
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ADS7846 # touch-screen controller
     select MAX111X # A/D converter
     select WM8750  # audio codec
@@ -XXX,XX +XXX,XX @@ config SPITZ
 
 config Z2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select WM8750
     select PL011 # UART
@@ -XXX,XX +XXX,XX @@ config Z2
 
 config REALVIEW
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply PCI_DEVICES
     imply PCI_TESTDEV
     imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config REALVIEW
 
 config SBSA_REF
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     imply PCI_DEVICES
     select AHCI
     select ARM_SMMUV3
@@ -XXX,XX +XXX,XX @@ config SBSA_REF
 
 config SABRELITE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select FSL_IMX6
     select SSI_M25P80
 
 config STELLARIS
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select ARM_V7M
     select CMSDK_APB_WATCHDOG
@@ -XXX,XX +XXX,XX @@ config STELLARIS
 
 config STM32VLDISCOVERY
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select STM32F100_SOC
 
 config STRONGARM
@@ -XXX,XX +XXX,XX @@ config STRONGARM
 
 config COLLIE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PFLASH_CFI01
     select ZAURUS  # scoop
     select STRONGARM
 
 config SX1
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select OMAP
 
 config VERSATILE
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ARM_TIMER # sp804
     select PFLASH_CFI01
     select LSI_SCSI_PCI
@@ -XXX,XX +XXX,XX @@ config VERSATILE
 
 config VEXPRESS
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select A15MPCORE
     select ARM_MPTIMER
@@ -XXX,XX +XXX,XX @@ config VEXPRESS
 
 config ZYNQ
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select CADENCE # UART
     select PFLASH_CFI02
@@ -XXX,XX +XXX,XX @@ config ZYNQ
 config ARM_V7M
     bool
     # currently v7M must be included in a TCG build due to translate.c
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select PTIMER
 
 config ALLWINNER_A10
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_A10
 
 config ALLWINNER_H3
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select ALLWINNER_A10_PIT
     select ALLWINNER_SUN8I_EMAC
     select ALLWINNER_I2C
@@ -XXX,XX +XXX,XX @@ config ALLWINNER_H3
 
 config RASPI
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select FRAMEBUFFER
     select PL011 # UART
     select SDHCI
@@ -XXX,XX +XXX,XX @@ config STM32F405_SOC
 
 config XLNX_ZYNQMP_ARM
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     select AHCI
     select ARM_GIC
     select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_ZYNQMP_ARM
 
 config XLNX_VERSAL
     bool
-    default y if TCG && AARCH64
+    default y
+    depends on TCG && AARCH64
     select ARM_GIC
     select PL011
     select CADENCE
@@ -XXX,XX +XXX,XX @@ config XLNX_VERSAL
 
 config NPCM7XX
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select A9MPCORE
     select ADM1272
     select ARM_GIC
@@ -XXX,XX +XXX,XX @@ config NPCM7XX
 
 config FSL_IMX25
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select IMX
     select IMX_FEC
@@ -XXX,XX +XXX,XX @@ config FSL_IMX25
 
 config FSL_IMX31
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select SERIAL
     select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6
 
 config ASPEED_SOC
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select DS1338
     select FTGMAC100
     select I2C
@@ -XXX,XX +XXX,XX @@ config ASPEED_SOC
 
 config MPS2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select ARMSSE
     select LAN9118
@@ -XXX,XX +XXX,XX @@ config MPS2
 
 config FSL_IMX7
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply PCI_DEVICES
     imply TEST_DEVICES
     imply I2C_DEVICES
@@ -XXX,XX +XXX,XX @@ config ARM_SMMUV3
 
 config FSL_IMX6UL
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     imply I2C_DEVICES
     select A15MPCORE
     select IMX
@@ -XXX,XX +XXX,XX @@ config FSL_IMX6UL
 
 config MICROBIT
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select NRF51_SOC
 
 config NRF51_SOC
@@ -XXX,XX +XXX,XX @@ config NRF51_SOC
 
 config EMCRAFT_SF2
     bool
-    default y if TCG && ARM
+    default y
+    depends on TCG && ARM
     select MSF2
     select SSI_M25P80
 
-- 
2.34.1

From: Enze Li <lienze@kylinos.cn>

I noticed that in the latest version, the copyright string is still
2022, even though 2023 is halfway through.  This patch fixes that and
fixes the documentation along with it.

Signed-off-by: Enze Li <lienze@kylinos.cn>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230525064345.1152801-1-lienze@kylinos.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/conf.py              | 2 +-
 include/qemu/help-texts.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docs/conf.py b/docs/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/conf.py
+++ b/docs/conf.py
@@ -XXX,XX +XXX,XX @@
 
 # General information about the project.
 project = u'QEMU'
-copyright = u'2022, The QEMU Project Developers'
+copyright = u'2023, The QEMU Project Developers'
 author = u'The QEMU Project Developers'
 
 # The version info for the project you're documenting, acts as replacement for
diff --git a/include/qemu/help-texts.h b/include/qemu/help-texts.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/help-texts.h
+++ b/include/qemu/help-texts.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_HELP_TEXTS_H
 
 /* Copyright string for -version arguments, About dialogs, etc */
-#define QEMU_COPYRIGHT "Copyright (c) 2003-2022 " \
+#define QEMU_COPYRIGHT "Copyright (c) 2003-2023 " \
     "Fabrice Bellard and the QEMU Project developers"
 
 /* Bug reporting information for --help arguments, About dialogs, etc */
-- 
2.34.1

From: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>

Let add GIC information into DeviceTree as part of SBSA-REF versioning.

Trusted Firmware will read it and provide to next firmware level.

Bumps platform version to 0.1 one so we can check is node is present.

Signed-off-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 19 ++++++++++++++++++-
 1 file changed, 18 insertions(+), 1 deletion(-)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/hwaddr.h"
 #include "kvm_arm.h"
 #include "hw/arm/boot.h"
+#include "hw/arm/fdt.h"
 #include "hw/arm/smmuv3.h"
 #include "hw/block/flash.h"
 #include "hw/boards.h"
@@ -XXX,XX +XXX,XX @@ static uint64_t sbsa_ref_cpu_mp_affinity(SBSAMachineState *sms, int idx)
     return arm_cpu_mp_affinity(idx, clustersz);
 }
 
+static void sbsa_fdt_add_gic_node(SBSAMachineState *sms)
+{
+    char *nodename;
+
+    nodename = g_strdup_printf("/intc");
+    qemu_fdt_add_subnode(sms->fdt, nodename);
+    qemu_fdt_setprop_sized_cells(sms->fdt, nodename, "reg",
+                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].base,
+                                 2, sbsa_ref_memmap[SBSA_GIC_DIST].size,
+                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].base,
+                                 2, sbsa_ref_memmap[SBSA_GIC_REDIST].size);
+
+    g_free(nodename);
+}
 /*
  * Firmware on this machine only uses ACPI table to load OS, these limited
  * device tree nodes are just to let firmware know the info which varies from
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
      *                        fw compatibility.
      */
     qemu_fdt_setprop_cell(fdt, "/", "machine-version-major", 0);
-    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 0);
+    qemu_fdt_setprop_cell(fdt, "/", "machine-version-minor", 1);
 
     if (ms->numa_state->have_numa_distance) {
         int size = nb_numa_nodes * nb_numa_nodes * 3 * sizeof(uint32_t);
@@ -XXX,XX +XXX,XX @@ static void create_fdt(SBSAMachineState *sms)
 
         g_free(nodename);
     }
+
+    sbsa_fdt_add_gic_node(sms);
 }
 
 #define SBSA_FLASH_SECTOR_SIZE (256 * KiB)
-- 
2.34.1