[PATCH 0/4] arm64: sysreg: Bring field definitions in line with the spec

[PATCH 0/4] arm64: sysreg: Bring field definitions in line with the spec

[Fuad Tabba]

Hi folks,

Fixes to definitions in the sysreg file that don't match the current
spec: three wrong enum values, two misspelt field names, and fields the
architecture has dropped, including leftovers from FEAT_TME. The last
patch also removes the BRBE driver's check on two more such
fields (BRBINFx_EL1.T and LASTFAILED), the only functional change in
the series.

These came out of the pKVM feature-bit audit, which led me to check the
whole file against ARM's register descriptions.

I plan to look at turning that check into a linter under
arch/arm64/tools, along the lines Will suggested [1], so the next
batch doesn't depend on someone reading the spec.

Based on Linux 7.3-rc6 (a90ee4305c4a5).

Cheers,
/fuad

[1] https://lore.kernel.org/all/20241211224015.GB17836@willie-the-truck/

Fuad Tabba (4):
  arm64: sysreg: Fix three incorrect enum values
  arm64: sysreg: Fix the names of two misspelt fields
  arm64: sysreg: Mark fields the architecture dropped as RES0
  perf: arm_brbe: Remove the check for TME transaction states

 arch/arm64/kvm/config.c         |  4 ++--
 arch/arm64/kvm/emulate-nested.c |  2 +-
 arch/arm64/tools/sysreg         | 28 ++++++++++------------------
 drivers/perf/arm_brbe.c         | 18 ------------------
 4 files changed, 13 insertions(+), 39 deletions(-)


base-commit: a90ee4305c4a5df72c11b31dacfdc76e00fcf78a
-- 
2.39.5

[PATCH 1/4] arm64: sysreg: Fix three incorrect enum values

[Fuad Tabba]

Three enum values in the sysreg file don't match DDI0601 2026-09.
Outer Shareable in VTCR_EL2.SH0 is 0b10, not 0b01, as TCR_EL1.SH0 in
the same file already has it. Thumb-2 in ID_PFR0_EL1.State1 is 0b0011,
not 0b0010, and the M-profile model in ID_PFR1_EL1.MProgMod is 0b0010,
not 0b0001. The spec lists all three old values as reserved.

There are currently no users of these values. The VTCR_EL2 one came in
with commit a035001dea37 ("arm64: Convert VTCR_EL2 to sysreg
infratructure"), the ID_PFR0_EL1 one with commit fb0b8d1a24d8
("arm64/sysreg: Convert ID_PFR0_EL1 to automatic generation") and the
ID_PFR1_EL1 one with commit 1224308075f1 ("arm64/sysreg: Convert
ID_PFR1_EL1 to automatic generation").

Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
 arch/arm64/tools/sysreg | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg
index e2d37ee221b84..f2812545f336e 100644
--- a/arch/arm64/tools/sysreg
+++ b/arch/arm64/tools/sysreg
@@ -434,7 +434,7 @@ EndEnum
 UnsignedEnum	7:4	State1
 	0b0000	NI
 	0b0001	THUMB
-	0b0010	THUMB2
+	0b0011	THUMB2
 EndEnum
 UnsignedEnum	3:0	State0
 	0b0000	NI
@@ -469,7 +469,7 @@ UnsignedEnum	15:12	Virtualization
 EndEnum
 UnsignedEnum	11:8	MProgMod
 	0b0000	NI
-	0b0001	IMP
+	0b0010	IMP
 EndEnum
 Enum	7:4	Security
 	0b0000	NI
@@ -4652,7 +4652,7 @@ Enum	15:14	TG0
 EndEnum
 Enum	13:12	SH0
 	0b00	NONE
-	0b01	OUTER
+	0b10	OUTER
 	0b11	INNER
 EndEnum
 Enum	11:10	ORGN0
-- 
2.39.5

[PATCH 2/4] arm64: sysreg: Fix the names of two misspelt fields

[Fuad Tabba]

Two fields in the sysreg file have the wrong name. In DDI0601 2026-09,
bit 10 of HFGRTR2_EL2 and HFGWTR2_EL2, which traps SCTLR2ALIAS_EL1, is
nSCTLR2ALIAS_EL1, not nSCTLRALIAS2_EL1, and bits [39:36] of SMPRIMAP_EL2
are P9, between P8 and P10, not F9.

Rename both, along with the three KVM users of the first. The second
has no users.

No functional change intended.

Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
 arch/arm64/kvm/config.c         | 4 ++--
 arch/arm64/kvm/emulate-nested.c | 2 +-
 arch/arm64/tools/sysreg         | 6 +++---
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/arch/arm64/kvm/config.c b/arch/arm64/kvm/config.c
index 1053676551aff..e93919cadf860 100644
--- a/arch/arm64/kvm/config.c
+++ b/arch/arm64/kvm/config.c
@@ -804,7 +804,7 @@ static const struct reg_bits_to_feat_map hfgrtr2_feat_map[] = {
 		   HFGRTR2_EL2_nCPACRALIAS_EL1	|
 		   HFGRTR2_EL2_nCPACRMASK_EL1	|
 		   HFGRTR2_EL2_nSCTLR2MASK_EL1	|
-		   HFGRTR2_EL2_nSCTLRALIAS2_EL1	|
+		   HFGRTR2_EL2_nSCTLR2ALIAS_EL1	|
 		   HFGRTR2_EL2_nSCTLRALIAS_EL1	|
 		   HFGRTR2_EL2_nSCTLRMASK_EL1	|
 		   HFGRTR2_EL2_nTCR2ALIAS_EL1	|
@@ -825,7 +825,7 @@ static const struct reg_bits_to_feat_map hfgwtr2_feat_map[] = {
 		   HFGWTR2_EL2_nCPACRALIAS_EL1	|
 		   HFGWTR2_EL2_nCPACRMASK_EL1	|
 		   HFGWTR2_EL2_nSCTLR2MASK_EL1	|
-		   HFGWTR2_EL2_nSCTLRALIAS2_EL1	|
+		   HFGWTR2_EL2_nSCTLR2ALIAS_EL1	|
 		   HFGWTR2_EL2_nSCTLRALIAS_EL1	|
 		   HFGWTR2_EL2_nSCTLRMASK_EL1	|
 		   HFGWTR2_EL2_nTCR2ALIAS_EL1	|
diff --git a/arch/arm64/kvm/emulate-nested.c b/arch/arm64/kvm/emulate-nested.c
index f59d89d04ecaf..fc23c793ef176 100644
--- a/arch/arm64/kvm/emulate-nested.c
+++ b/arch/arm64/kvm/emulate-nested.c
@@ -1431,7 +1431,7 @@ static const struct encoding_to_trap_config encoding_to_fgt[] __initconst = {
 	SR_FGT(SYS_CPACRMASK_EL1,	HFGRTR2, nCPACRMASK_EL1, 0),
 	SR_FGT(SYS_PFAR_EL1,		HFGRTR2, nPFAR_EL1, 0),
 	SR_FGT(SYS_RCWSMASK_EL1,	HFGRTR2, nRCWSMASK_EL1, 0),
-	SR_FGT(SYS_SCTLR2ALIAS_EL1,	HFGRTR2, nSCTLRALIAS2_EL1, 0),
+	SR_FGT(SYS_SCTLR2ALIAS_EL1,	HFGRTR2, nSCTLR2ALIAS_EL1, 0),
 	SR_FGT(SYS_SCTLR2MASK_EL1,	HFGRTR2, nSCTLR2MASK_EL1, 0),
 	SR_FGT(SYS_SCTLRALIAS_EL1,	HFGRTR2, nSCTLRALIAS_EL1, 0),
 	SR_FGT(SYS_SCTLRMASK_EL1,	HFGRTR2, nSCTLRMASK_EL1, 0),
diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg
index f2812545f336e..341db8e9b6c37 100644
--- a/arch/arm64/tools/sysreg
+++ b/arch/arm64/tools/sysreg
@@ -4336,7 +4336,7 @@ Field	14	nACTLRALIAS_EL1
 Field	13	nACTLRMASK_EL1
 Field	12	nTCR2ALIAS_EL1
 Field	11	nTCRALIAS_EL1
-Field	10	nSCTLRALIAS2_EL1
+Field	10	nSCTLR2ALIAS_EL1
 Field	9	nSCTLRALIAS_EL1
 Field	8	nCPACRALIAS_EL1
 Field	7	nTCR2MASK_EL1
@@ -4355,7 +4355,7 @@ Field	14	nACTLRALIAS_EL1
 Field	13	nACTLRMASK_EL1
 Field	12	nTCR2ALIAS_EL1
 Field	11	nTCRALIAS_EL1
-Field	10	nSCTLRALIAS2_EL1
+Field	10	nSCTLR2ALIAS_EL1
 Field	9	nSCTLRALIAS_EL1
 Field	8	nCPACRALIAS_EL1
 Field	7	nTCR2MASK_EL1
@@ -4592,7 +4592,7 @@ Field	55:52	P13
 Field	51:48	P12
 Field	47:44	P11
 Field	43:40	P10
-Field	39:36	F9
+Field	39:36	P9
 Field	35:32	P8
 Field	31:28	P7
 Field	27:24	P6
-- 
2.39.5

[PATCH 3/4] arm64: sysreg: Mark fields the architecture dropped as RES0

[Fuad Tabba]

Commit d65bf6e317e7 ("KVM: arm64: Remove all traces of FEAT_TME")
turned the TME fields of SCTLR_EL1 into RES0, but left their copies in
SCTLRMASK_EL1. PMICFILTR_EL0.T and BRBFCR_EL1.LASTFAILED have gone from
the architecture as well. All six fields are RES0 in DDI0601 2026-09.

Mark them RES0 to match the spec. Nothing in the tree refers to them.

Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
 arch/arm64/tools/sysreg | 11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)

diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg
index 341db8e9b6c37..99af1c39478be 100644
--- a/arch/arm64/tools/sysreg
+++ b/arch/arm64/tools/sysreg
@@ -1420,8 +1420,7 @@ Field	17	DIRECT
 Field	16	EnI
 Res0	15:8
 Field	7	PAUSED
-Field	6	LASTFAILED
-Res0	5:0
+Res0	6:0
 EndSysreg
 
 Sysreg	BRBTS_EL1	2	1	9	0	2
@@ -2663,11 +2662,7 @@ Field	57	EPAN
 Field	56	EnALS
 Field	55	EnAS0
 Field	54	EnASR
-Field	53	TME
-Field	52	TME0
-Field	51	TMT
-Field	50	TMT0
-Res0	49:47
+Res0	53:47
 Field	46	TWEDEL
 Field	45	TWEDEn
 Field	44	DSSBS
@@ -2985,7 +2980,7 @@ Field	27	NSH
 Field	26	M
 Res0	25
 Field	24	SH
-Field	23	T
+Res0	23
 Field	22	RLK
 Field	21	RLU
 Field	20	RLH
-- 
2.39.5

[PATCH 4/4] perf: arm_brbe: Remove the check for TME transaction states

[Fuad Tabba]

When an event samples branch flags, the BRBE driver warns once if a
branch record has BRBINFx_EL1.T or LASTFAILED set, which its comment
calls TME-related information. FEAT_TME has been withdrawn from the
architecture, and both fields are RES0 in DDI0601 2026-09, so the check
tests fields that no longer exist.

Remove the check and its two accessors, which were the only users of
the fields' defines, and mark both fields RES0 in the sysreg file.

Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>
---
 arch/arm64/tools/sysreg |  5 +----
 drivers/perf/arm_brbe.c | 18 ------------------
 2 files changed, 1 insertion(+), 22 deletions(-)

diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg
index 99af1c39478be..b15a59b9e95dd 100644
--- a/arch/arm64/tools/sysreg
+++ b/arch/arm64/tools/sysreg
@@ -1338,10 +1338,7 @@ Res0	63:47
 Field	46	CCU
 Field	45:40	CC_EXP
 Field	39:32	CC_MANT
-Res0	31:18
-Field	17	LASTFAILED
-Field	16	T
-Res0	15:14
+Res0	31:14
 Enum	13:8		TYPE
 	0b000000	DIRECT_UNCOND
 	0b000001	INDIRECT
diff --git a/drivers/perf/arm_brbe.c b/drivers/perf/arm_brbe.c
index 254be4da8ae29..073d145847417 100644
--- a/drivers/perf/arm_brbe.c
+++ b/drivers/perf/arm_brbe.c
@@ -166,21 +166,11 @@ static bool brbe_record_is_target_only(u64 brbinf)
 	return brbe_record_valid(brbinf) == BRBINFx_EL1_VALID_TARGET;
 }
 
-static int brbinf_get_in_tx(u64 brbinf)
-{
-	return FIELD_GET(BRBINFx_EL1_T_MASK, brbinf);
-}
-
 static int brbinf_get_mispredict(u64 brbinf)
 {
 	return FIELD_GET(BRBINFx_EL1_MPRED_MASK, brbinf);
 }
 
-static int brbinf_get_lastfailed(u64 brbinf)
-{
-	return FIELD_GET(BRBINFx_EL1_LASTFAILED_MASK, brbinf);
-}
-
 static u16 brbinf_get_cycles(u64 brbinf)
 {
 	u32 exp, mant, cycles;
@@ -627,14 +617,6 @@ static bool perf_entry_from_brbe_regset(int index, struct perf_branch_entry *ent
 			entry->mispred = brbinf_get_mispredict(brbinf);
 			entry->predicted = !entry->mispred;
 		}
-
-		/*
-		 * Currently TME feature is neither implemented in any hardware
-		 * nor it is being supported in the kernel. Just warn here once
-		 * if TME related information shows up rather unexpectedly.
-		 */
-		if (brbinf_get_lastfailed(brbinf) || brbinf_get_in_tx(brbinf))
-			pr_warn_once("Unknown transaction states\n");
 	}
 
 	/*
-- 
2.39.5

Re: [PATCH 2/4] arm64: sysreg: Fix the names of two misspelt fields

[sashiko-bot]

> Two fields in the sysreg file have the wrong name. In DDI0601 2026-09,
> bit 10 of HFGRTR2_EL2 and HFGWTR2_EL2, which traps SCTLR2ALIAS_EL1, is
> nSCTLR2ALIAS_EL1, not nSCTLRALIAS2_EL1, and bits [39:36] of SMPRIMAP_EL2
> are P9, between P8 and P10, not F9.
> 
> Rename both, along with the three KVM users of the first. The second
> has no users.
> 
> No functional change intended.
> 
> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013130247.4135515-1-fuad.tabba@linux.dev?part=2

Re: [PATCH 1/4] arm64: sysreg: Fix three incorrect enum values

[sashiko-bot]

> Three enum values in the sysreg file don't match DDI0601 2026-09.
> Outer Shareable in VTCR_EL2.SH0 is 0b10, not 0b01, as TCR_EL1.SH0 in
> the same file already has it. Thumb-2 in ID_PFR0_EL1.State1 is 0b0011,
> not 0b0010, and the M-profile model in ID_PFR1_EL1.MProgMod is 0b0010,
> not 0b0001. The spec lists all three old values as reserved.
> 
> There are currently no users of these values. The VTCR_EL2 one came in
> with commit a035001dea37 ("arm64: Convert VTCR_EL2 to sysreg
> infratructure"), the ID_PFR0_EL1 one with commit fb0b8d1a24d8
> ("arm64/sysreg: Convert ID_PFR0_EL1 to automatic generation") and the
> ID_PFR1_EL1 one with commit 1224308075f1 ("arm64/sysreg: Convert
> ID_PFR1_EL1 to automatic generation").
> 
> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013130247.4135515-1-fuad.tabba@linux.dev?part=1

Re: [PATCH 4/4] perf: arm_brbe: Remove the check for TME transaction states

[sashiko-bot]

> When an event samples branch flags, the BRBE driver warns once if a
> branch record has BRBINFx_EL1.T or LASTFAILED set, which its comment
> calls TME-related information. FEAT_TME has been withdrawn from the
> architecture, and both fields are RES0 in DDI0601 2026-09, so the check
> tests fields that no longer exist.
> 
> Remove the check and its two accessors, which were the only users of
> the fields' defines, and mark both fields RES0 in the sysreg file.
> 
> Signed-off-by: Fuad Tabba <fuad.tabba@linux.dev>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013130247.4135515-1-fuad.tabba@linux.dev?part=4

Re: [PATCH 3/4] arm64: sysreg: Mark fields the architecture dropped as RES0

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] arm64/sysreg: Semantic drift in auto-generated SCTLR_EL1_RES0 mask consumed by KVM
--

commit 60f264776efd2948b9996828935b2e973ae9b2bd
Author: Fuad Tabba <fuad.tabba@linux.dev>

arm64: sysreg: Mark fields the architecture dropped as RES0

Commit d65bf6e317e7 turned the TME fields of SCTLR_EL1 into RES0, but left
their copies in SCTLRMASK_EL1. PMICFILTR_EL0.T and BRBFCR_EL1.LASTFAILED
have gone from the architecture as well, so mark them all as RES0 to match
the spec.

> diff --git a/arch/arm64/tools/sysreg b/arch/arm64/tools/sysreg
> index 341db8e9b6c37..99af1c39478be 100644
> --- a/arch/arm64/tools/sysreg
> +++ b/arch/arm64/tools/sysreg

[ ... ]

> @@ -2663,11 +2662,7 @@ Field	57	EPAN
>  Field	56	EnALS
>  Field	55	EnAS0
>  Field	54	EnASR
> -Field	53	TME
> -Field	52	TME0
> -Field	51	TMT
> -Field	50	TMT0
> -Res0	49:47
> +Res0	53:47

[Severity: Medium]
This change reclassifies bits 53:50 of SCTLR_EL1 (TME, TME0, TMT, TMT0) from
Field to Res0. This silently regenerates the aggregate mask SCTLR_EL1_RES0 to
include these bits.

This macro is actively consumed by KVM during C initialization via
FORCE_RES0(SCTLR_EL1_RES0) in sctlr_el1_feat_map() in arch/arm64/kvm/config.c:

arch/arm64/kvm/config.c:sctlr_el1_feat_map() {
    ...
    FORCE_RES0(SCTLR_EL1_RES0),
    ...
}

Could this cause a regression in KVM guest feature configuration for SCTLR_EL1
by forcing the removed TME bits to 0? Is KVM's initialization logic robust to
SCTLR_EL1_RES0 expanding to cover bits 53:50, and is forcing these bits to 0
for guests intended?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013130247.4135515-1-fuad.tabba@linux.dev?part=3

Re: [PATCH 3/4] arm64: sysreg: Mark fields the architecture dropped as RES0

[Fuad Tabba]

On Tue, 13 Oct 2026 14:15:11 +0100, sashiko-bot@kernel.org wrote:
[...]
>> @@ -2663,11 +2662,7 @@ Field        57        EPAN
>>  Field        56        EnALS
>>  Field        55        EnAS0
>>  Field        54        EnASR
>> -Field        53        TME
>> -Field        52        TME0
>> -Field        51        TMT
>> -Field        50        TMT0
>> -Res0        49:47
>> +Res0        53:47
>
>[Severity: Medium]
>This change reclassifies bits 53:50 of SCTLR_EL1 (TME, TME0, TMT, TMT0) from
>Field to Res0. This silently regenerates the aggregate mask SCTLR_EL1_RES0 to
>include these bits.

This hunk is in SCTLRMASK_EL1, not SCTLR_EL1. SCTLR_EL1 has had Res0
53:50 since commit d65bf6e317e7 ("KVM: arm64: Remove all traces of
FEAT_TME"), so SCTLR_EL1_RES0 doesn't change. Nothing uses
SCTLRMASK_EL1_RES0.

Cheers,
/fuad

Re: [PATCH 1/4] arm64: sysreg: Fix three incorrect enum values

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 454 bytes --]

On Tue, Oct 13, 2026 at 02:02:44PM +0100, Fuad Tabba wrote:
> Three enum values in the sysreg file don't match DDI0601 2026-09.
> Outer Shareable in VTCR_EL2.SH0 is 0b10, not 0b01, as TCR_EL1.SH0 in
> the same file already has it. Thumb-2 in ID_PFR0_EL1.State1 is 0b0011,
> not 0b0010, and the M-profile model in ID_PFR1_EL1.MProgMod is 0b0010,
> not 0b0001. The spec lists all three old values as reserved.

Reviewed-by: Mark Brown <broonie@kernel.org>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

Re: [PATCH 2/4] arm64: sysreg: Fix the names of two misspelt fields

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 365 bytes --]

On Tue, Oct 13, 2026 at 02:02:45PM +0100, Fuad Tabba wrote:
> Two fields in the sysreg file have the wrong name. In DDI0601 2026-09,
> bit 10 of HFGRTR2_EL2 and HFGWTR2_EL2, which traps SCTLR2ALIAS_EL1, is
> nSCTLR2ALIAS_EL1, not nSCTLRALIAS2_EL1, and bits [39:36] of SMPRIMAP_EL2
> are P9, between P8 and P10, not F9.

Reviewed-by: Mark Brown <broonie@kernel.org>

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]