[RFC PATCH 0/4] No-op support for Arm FEAT_XS, feedback needed

[RFC PATCH 0/4] No-op support for Arm FEAT_XS, feedback needed

[Manos Pitsidianakis]

This series is an initial incomplete attempt at adding support for the
FEAT_XS feature in aarch64 TCG. This feature was introduced in ARMv8.7:
it adds a new memory attribute XS which indicates that a memory access
could take longer than usual to complete and also adds instruction
variants for TLBI maintenance and DSB.

These variants are implemented as no-ops, since QEMU TCG doesn't
implement caching.

This is my first foray into TCG and certain things weren't clear to me:

1. How to make sure the feature is implemented properly. Since we model
   cache maintenance as no-ops my understanding is the only
   functionality we need to provide is to expose the FEAT_XS feature bit
   and also make sure the nXS variants trap properly if configured with
   fine-grained traps.
2. Is there a point in adding a TCG test? If I read the manual
   correctly, the nXS variants should trap to the undefined instruction
   vector if unimplemented.

These patches lack support for FGT for now.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
---
Manos Pitsidianakis (4):
      arm: Add FEAT_XS's TLBI NXS variants
      arm/tcg: add decodetree entry for DSB nXS variant
      arm/tcg/cpu64: add FEAT_XS feat in max cpu
      tests/tcg/aarch64: add system test for FEAT_XS

 target/arm/cpu-features.h          |   5 +
 target/arm/helper.c                | 366 +++++++++++++++++++++----------------
 target/arm/tcg/a64.decode          |   3 +
 target/arm/tcg/cpu64.c             |   1 +
 target/arm/tcg/translate-a64.c     |   6 +
 tests/tcg/aarch64/system/feat-xs.c |  27 +++
 6 files changed, 255 insertions(+), 153 deletions(-)
---
base-commit: 7e3b6d8063f245d27eecce5aabe624b5785f2a77
change-id: 20240919-arm-feat-xs-73eedb23d937

--
γαῖα πυρί μιχθήτω

[RFC PATCH 1/4] arm: Add FEAT_XS's TLBI NXS variants

[Manos Pitsidianakis]

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
---
 target/arm/cpu-features.h |   5 +
 target/arm/helper.c       | 366 +++++++++++++++++++++++++++-------------------
 2 files changed, 218 insertions(+), 153 deletions(-)

diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
index 04ce2818263e2c3b99c59940001b65302e1d26d2..b4dcd429c3540e18c44d3c30f82f030be45719f2 100644
--- a/target/arm/cpu-features.h
+++ b/target/arm/cpu-features.h
@@ -970,6 +970,11 @@ static inline bool isar_feature_aa64_sme_fa64(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64smfr0, ID_AA64SMFR0, FA64);
 }
 
+static inline bool isar_feature_aa64_xs(const ARMISARegisters *id)
+{
+    return FIELD_SEX64(id->id_aa64isar1, ID_AA64ISAR1, XS) >= 0;
+}
+
 /*
  * Feature tests for "does this exist in either 32-bit or 64-bit?"
  */
diff --git a/target/arm/helper.c b/target/arm/helper.c
index 3f77b40734f2db831254a0e4eb205751aec0d1e5..3104a2d1dab6e58bf454c75afd478ec6d5fe521f 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -5671,98 +5671,111 @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .fgt = FGT_DCCISW,
       .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP },
     /* TLBI operations */
-    { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
+#define TLBI(name, opc0, opc1, crn, crm, opc2, access, accessfn, type, fgt, \
+             writefn)                                                       \
+{ name, .state = ARM_CP_STATE_AA64, opc0, opc1, crn, crm, opc2, access,     \
+  accessfn, type, fgt, writefn },                                           \
+{ name"NXS", .state = ARM_CP_STATE_AA64, opc0, opc1, crn + 1, crm, opc2,    \
+   access, accessfn, type, fgt, writefn }
+ TLBI(.name = "TLBI_VMALLE1IS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 0,
       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVMALLE1IS,
-      .writefn = tlbi_aa64_vmalle1is_write },
-    { .name = "TLBI_VAE1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vmalle1is_write),
+ TLBI(.name = "TLBI_VAE1IS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 1,
       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVAE1IS,
-      .writefn = tlbi_aa64_vae1is_write },
-    { .name = "TLBI_ASIDE1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1is_write),
+ TLBI(.name = "TLBI_ASIDE1IS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 2,
       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIASIDE1IS,
-      .writefn = tlbi_aa64_vmalle1is_write },
-    { .name = "TLBI_VAAE1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vmalle1is_write),
+ TLBI(.name = "TLBI_VAAE1IS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 3,
       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVAAE1IS,
-      .writefn = tlbi_aa64_vae1is_write },
-    { .name = "TLBI_VALE1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1is_write),
+ TLBI(.name = "TLBI_VALE1IS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVALE1IS,
-      .writefn = tlbi_aa64_vae1is_write },
-    { .name = "TLBI_VAALE1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1is_write),
+ TLBI(.name = "TLBI_VAALE1IS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVAALE1IS,
-      .writefn = tlbi_aa64_vae1is_write },
-    { .name = "TLBI_VMALLE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1is_write),
+ TLBI(.name = "TLBI_VMALLE1",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 0,
       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVMALLE1,
-      .writefn = tlbi_aa64_vmalle1_write },
-    { .name = "TLBI_VAE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vmalle1_write),
+ TLBI(.name = "TLBI_VAE1",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 1,
       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVAE1,
-      .writefn = tlbi_aa64_vae1_write },
-    { .name = "TLBI_ASIDE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1_write),
+ TLBI(.name = "TLBI_ASIDE1",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 2,
       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIASIDE1,
-      .writefn = tlbi_aa64_vmalle1_write },
-    { .name = "TLBI_VAAE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vmalle1_write),
+ TLBI(.name = "TLBI_VAAE1",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 3,
       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVAAE1,
-      .writefn = tlbi_aa64_vae1_write },
-    { .name = "TLBI_VALE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1_write),
+ TLBI(.name = "TLBI_VALE1",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVALE1,
-      .writefn = tlbi_aa64_vae1_write },
-    { .name = "TLBI_VAALE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1_write),
+ TLBI(.name = "TLBI_VAALE1",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVAALE1,
-      .writefn = tlbi_aa64_vae1_write },
-    { .name = "TLBI_IPAS2E1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1_write),
+#undef TLBI
+#define TLBI(name, opc0, opc1, crn, crm, opc2, access, type, writefn)   \
+{ name, .state = ARM_CP_STATE_AA64, opc0, opc1, crn, crm, opc2, access, \
+  type, writefn },                                           \
+{ name"NXS", .state = ARM_CP_STATE_AA64, opc0, opc1, crn + 1, crm, opc2,\
+   access, type, writefn }
+ TLBI(.name = "TLBI_IPAS2E1IS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ipas2e1is_write },
-    { .name = "TLBI_IPAS2LE1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_ipas2e1is_write),
+ TLBI(.name = "TLBI_IPAS2LE1IS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ipas2e1is_write },
-    { .name = "TLBI_ALLE1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_ipas2e1is_write),
+ TLBI(.name = "TLBI_ALLE1IS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 4,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_alle1is_write },
-    { .name = "TLBI_VMALLS12E1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_alle1is_write),
+ TLBI(.name = "TLBI_VMALLS12E1IS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 6,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_alle1is_write },
-    { .name = "TLBI_IPAS2E1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_alle1is_write),
+ TLBI(.name = "TLBI_IPAS2E1",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ipas2e1_write },
-    { .name = "TLBI_IPAS2LE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_ipas2e1_write),
+ TLBI(.name = "TLBI_IPAS2LE1",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ipas2e1_write },
-    { .name = "TLBI_ALLE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_ipas2e1_write),
+ TLBI(.name = "TLBI_ALLE1",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 4,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_alle1_write },
-    { .name = "TLBI_VMALLS12E1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_alle1_write),
+ TLBI(.name = "TLBI_VMALLS12E1",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 6,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_alle1is_write },
+      .writefn = tlbi_aa64_alle1is_write),
+#undef TLBI
 #ifndef CONFIG_USER_ONLY
     /* 64 bit address translation operations */
     { .name = "AT_S1E1R", .state = ARM_CP_STATE_AA64,
@@ -5819,41 +5832,49 @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
       .writefn = par_write },
 #endif
     /* TLB invalidate last level of translation table walk */
-    { .name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
+#define TLBI(name, cp, opc1, crn, crm, opc2, type, access, accessfn, writefn)\
+{ name, cp, opc1, crn, crm, opc2, type, access, accessfn, writefn },         \
+{ name"NXS", cp, opc1, crn + 1, crm, opc2, type, access, accessfn, writefn }
+ TLBI(.name = "TLBIMVALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 5,
       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis,
-      .writefn = tlbimva_is_write },
-    { .name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
+      .writefn = tlbimva_is_write),
+ TLBI(.name = "TLBIMVAALIS", .cp = 15, .opc1 = 0, .crn = 8, .crm = 3, .opc2 = 7,
       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlbis,
-      .writefn = tlbimvaa_is_write },
-    { .name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
+      .writefn = tlbimvaa_is_write),
+ TLBI(.name = "TLBIMVAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 5,
       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
-      .writefn = tlbimva_write },
-    { .name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
+      .writefn = tlbimva_write),
+ TLBI(.name = "TLBIMVAAL", .cp = 15, .opc1 = 0, .crn = 8, .crm = 7, .opc2 = 7,
       .type = ARM_CP_NO_RAW, .access = PL1_W, .accessfn = access_ttlb,
-      .writefn = tlbimvaa_write },
-    { .name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
+      .writefn = tlbimvaa_write),
+#undef TLBI
+#define TLBI(name, cp, opc1, crn, crm, opc2, type, access, writefn)\
+{ name, cp, opc1, crn, crm, opc2, type, access, writefn },         \
+{ name"NXS", cp, opc1, crn + 1, crm, opc2, type, access, writefn }
+ TLBI(.name = "TLBIMVALH", .cp = 15, .opc1 = 4, .crn = 8, .crm = 7, .opc2 = 5,
       .type = ARM_CP_NO_RAW, .access = PL2_W,
-      .writefn = tlbimva_hyp_write },
-    { .name = "TLBIMVALHIS",
+      .writefn = tlbimva_hyp_write),
+ TLBI(.name = "TLBIMVALHIS",
       .cp = 15, .opc1 = 4, .crn = 8, .crm = 3, .opc2 = 5,
       .type = ARM_CP_NO_RAW, .access = PL2_W,
-      .writefn = tlbimva_hyp_is_write },
-    { .name = "TLBIIPAS2",
+      .writefn = tlbimva_hyp_is_write),
+ TLBI(.name = "TLBIIPAS2",
       .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 1,
       .type = ARM_CP_NO_RAW, .access = PL2_W,
-      .writefn = tlbiipas2_hyp_write },
-    { .name = "TLBIIPAS2IS",
+      .writefn = tlbiipas2_hyp_write),
+ TLBI(.name = "TLBIIPAS2IS",
       .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 1,
       .type = ARM_CP_NO_RAW, .access = PL2_W,
-      .writefn = tlbiipas2is_hyp_write },
-    { .name = "TLBIIPAS2L",
+      .writefn = tlbiipas2is_hyp_write),
+ TLBI(.name = "TLBIIPAS2L",
       .cp = 15, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 5,
       .type = ARM_CP_NO_RAW, .access = PL2_W,
-      .writefn = tlbiipas2_hyp_write },
-    { .name = "TLBIIPAS2LIS",
+      .writefn = tlbiipas2_hyp_write),
+ TLBI(.name = "TLBIIPAS2LIS",
       .cp = 15, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 5,
       .type = ARM_CP_NO_RAW, .access = PL2_W,
-      .writefn = tlbiipas2is_hyp_write },
+      .writefn = tlbiipas2is_hyp_write),
+#undef TLBI
     /* 32 bit cache operations */
     { .name = "ICIALLUIS", .cp = 15, .opc1 = 0, .crn = 7, .crm = 1, .opc2 = 0,
       .type = ARM_CP_NOP, .access = PL1_W, .accessfn = access_ticab },
@@ -7829,207 +7850,245 @@ static const ARMCPRegInfo pauth_reginfo[] = {
 };
 
 static const ARMCPRegInfo tlbirange_reginfo[] = {
-    { .name = "TLBI_RVAE1IS", .state = ARM_CP_STATE_AA64,
+#define TLBI(name, opc0, opc1, crn, crm, opc2, access, accessfn, type, fgt, \
+             writefn)                                                       \
+{ name, .state = ARM_CP_STATE_AA64, opc0, opc1, crn, crm, opc2, access,     \
+  accessfn, type, fgt, writefn },                                           \
+{ name"NXS", .state = ARM_CP_STATE_AA64, opc0, opc1, crn + 1, crm, opc2,    \
+   access, accessfn, type, fgt, writefn }
+ TLBI(.name = "TLBI_RVAE1IS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 1,
       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVAE1IS,
-      .writefn = tlbi_aa64_rvae1is_write },
-    { .name = "TLBI_RVAAE1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1is_write),
+ TLBI(.name = "TLBI_RVAAE1IS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 3,
       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVAAE1IS,
-      .writefn = tlbi_aa64_rvae1is_write },
-   { .name = "TLBI_RVALE1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1is_write),
+   TLBI(.name = "TLBI_RVALE1IS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 5,
       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVALE1IS,
-      .writefn = tlbi_aa64_rvae1is_write },
-    { .name = "TLBI_RVAALE1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1is_write),
+ TLBI(.name = "TLBI_RVAALE1IS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 2, .opc2 = 7,
       .access = PL1_W, .accessfn = access_ttlbis, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVAALE1IS,
-      .writefn = tlbi_aa64_rvae1is_write },
-    { .name = "TLBI_RVAE1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1is_write),
+ TLBI(.name = "TLBI_RVAE1OS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 1,
       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVAE1OS,
-      .writefn = tlbi_aa64_rvae1is_write },
-    { .name = "TLBI_RVAAE1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1is_write),
+ TLBI(.name = "TLBI_RVAAE1OS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 3,
       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVAAE1OS,
-      .writefn = tlbi_aa64_rvae1is_write },
-   { .name = "TLBI_RVALE1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1is_write),
+ TLBI(.name = "TLBI_RVALE1OS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 5,
       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVALE1OS,
-      .writefn = tlbi_aa64_rvae1is_write },
-    { .name = "TLBI_RVAALE1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1is_write),
+ TLBI(.name = "TLBI_RVAALE1OS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 5, .opc2 = 7,
       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVAALE1OS,
-      .writefn = tlbi_aa64_rvae1is_write },
-    { .name = "TLBI_RVAE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1is_write),
+ TLBI(.name = "TLBI_RVAE1",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 1,
       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVAE1,
-      .writefn = tlbi_aa64_rvae1_write },
-    { .name = "TLBI_RVAAE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1_write),
+ TLBI(.name = "TLBI_RVAAE1",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 3,
       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVAAE1,
-      .writefn = tlbi_aa64_rvae1_write },
-   { .name = "TLBI_RVALE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1_write),
+   TLBI(.name = "TLBI_RVALE1",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 5,
       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVALE1,
-      .writefn = tlbi_aa64_rvae1_write },
-    { .name = "TLBI_RVAALE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1_write),
+ TLBI(.name = "TLBI_RVAALE1",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 6, .opc2 = 7,
       .access = PL1_W, .accessfn = access_ttlb, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIRVAALE1,
-      .writefn = tlbi_aa64_rvae1_write },
-    { .name = "TLBI_RIPAS2E1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae1_write),
+#undef TLBI
+#define TLBI(name, opc0, opc1, crn, crm, opc2, access, type, writefn)    \
+{ name, .state = ARM_CP_STATE_AA64, opc0, opc1, crn, crm, opc2, access,  \
+  type, writefn },                                                       \
+{ name"NXS", .state = ARM_CP_STATE_AA64, opc0, opc1, crn + 1, crm, opc2, \
+  access, type, writefn }
+ TLBI(.name = "TLBI_RIPAS2E1IS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 2,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ripas2e1is_write },
-    { .name = "TLBI_RIPAS2LE1IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_ripas2e1is_write),
+ TLBI(.name = "TLBI_RIPAS2LE1IS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 0, .opc2 = 6,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ripas2e1is_write },
-    { .name = "TLBI_RVAE2IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_ripas2e1is_write),
+ TLBI(.name = "TLBI_RVAE2IS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 1,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
-      .writefn = tlbi_aa64_rvae2is_write },
-   { .name = "TLBI_RVALE2IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae2is_write),
+   TLBI(.name = "TLBI_RVALE2IS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 2, .opc2 = 5,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
-      .writefn = tlbi_aa64_rvae2is_write },
-    { .name = "TLBI_RIPAS2E1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae2is_write),
+ TLBI(.name = "TLBI_RIPAS2E1",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 2,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ripas2e1_write },
-    { .name = "TLBI_RIPAS2LE1", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_ripas2e1_write),
+ TLBI(.name = "TLBI_RIPAS2LE1",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 6,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_ripas2e1_write },
-   { .name = "TLBI_RVAE2OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_ripas2e1_write),
+   TLBI(.name = "TLBI_RVAE2OS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 1,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
-      .writefn = tlbi_aa64_rvae2is_write },
-   { .name = "TLBI_RVALE2OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae2is_write),
+   TLBI(.name = "TLBI_RVALE2OS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 5, .opc2 = 5,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
-      .writefn = tlbi_aa64_rvae2is_write },
-    { .name = "TLBI_RVAE2", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae2is_write),
+ TLBI(.name = "TLBI_RVAE2",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 1,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
-      .writefn = tlbi_aa64_rvae2_write },
-   { .name = "TLBI_RVALE2", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae2_write),
+   TLBI(.name = "TLBI_RVALE2",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 6, .opc2 = 5,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
-      .writefn = tlbi_aa64_rvae2_write },
-   { .name = "TLBI_RVAE3IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae2_write),
+   TLBI(.name = "TLBI_RVAE3IS",
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 2, .opc2 = 1,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_rvae3is_write },
-   { .name = "TLBI_RVALE3IS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae3is_write),
+   TLBI(.name = "TLBI_RVALE3IS",
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 2, .opc2 = 5,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_rvae3is_write },
-   { .name = "TLBI_RVAE3OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae3is_write),
+   TLBI(.name = "TLBI_RVAE3OS",
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 5, .opc2 = 1,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_rvae3is_write },
-   { .name = "TLBI_RVALE3OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae3is_write),
+   TLBI(.name = "TLBI_RVALE3OS",
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 5, .opc2 = 5,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_rvae3is_write },
-   { .name = "TLBI_RVAE3", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae3is_write),
+   TLBI(.name = "TLBI_RVAE3",
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 6, .opc2 = 1,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_rvae3_write },
-   { .name = "TLBI_RVALE3", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_rvae3_write),
+   TLBI(.name = "TLBI_RVALE3",
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 6, .opc2 = 5,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_rvae3_write },
+      .writefn = tlbi_aa64_rvae3_write),
+#undef TLBI
 };
 
 static const ARMCPRegInfo tlbios_reginfo[] = {
-    { .name = "TLBI_VMALLE1OS", .state = ARM_CP_STATE_AA64,
+#define TLBI(name, opc0, opc1, crn, crm, opc2, access, accessfn, type, fgt, \
+             writefn)                                                       \
+{ name, .state = ARM_CP_STATE_AA64, opc0, opc1, crn, crm, opc2, access,     \
+  accessfn, type, fgt, writefn },                                           \
+{ name"NXS", .state = ARM_CP_STATE_AA64, opc0, opc1, crn + 1, crm, opc2,    \
+   access, accessfn, type, fgt, writefn }
+ TLBI(.name = "TLBI_VMALLE1OS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 0,
       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVMALLE1OS,
-      .writefn = tlbi_aa64_vmalle1is_write },
-    { .name = "TLBI_VAE1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vmalle1is_write),
+ TLBI(.name = "TLBI_VAE1OS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 1,
       .fgt = FGT_TLBIVAE1OS,
       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_vae1is_write },
-    { .name = "TLBI_ASIDE1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1is_write),
+ TLBI(.name = "TLBI_ASIDE1OS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 2,
       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIASIDE1OS,
-      .writefn = tlbi_aa64_vmalle1is_write },
-    { .name = "TLBI_VAAE1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vmalle1is_write),
+ TLBI(.name = "TLBI_VAAE1OS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 3,
       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVAAE1OS,
-      .writefn = tlbi_aa64_vae1is_write },
-    { .name = "TLBI_VALE1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1is_write),
+ TLBI(.name = "TLBI_VALE1OS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 5,
       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVALE1OS,
-      .writefn = tlbi_aa64_vae1is_write },
-    { .name = "TLBI_VAALE1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1is_write),
+ TLBI(.name = "TLBI_VAALE1OS",
       .opc0 = 1, .opc1 = 0, .crn = 8, .crm = 1, .opc2 = 7,
       .access = PL1_W, .accessfn = access_ttlbos, .type = ARM_CP_NO_RAW,
       .fgt = FGT_TLBIVAALE1OS,
-      .writefn = tlbi_aa64_vae1is_write },
-    { .name = "TLBI_ALLE2OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae1is_write),
+#undef TLBI
+#define TLBI(name, opc0, opc1, crn, crm, opc2, access, type, writefn)       \
+{ name, .state = ARM_CP_STATE_AA64, opc0, opc1, crn, crm, opc2, access,     \
+  type, writefn },                                                          \
+{ name"NXS", .state = ARM_CP_STATE_AA64, opc0, opc1, crn + 1, crm, opc2,    \
+   access, type, writefn }
+ TLBI(.name = "TLBI_ALLE2OS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 0,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
-      .writefn = tlbi_aa64_alle2is_write },
-    { .name = "TLBI_VAE2OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_alle2is_write),
+ TLBI(.name = "TLBI_VAE2OS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 1,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
-      .writefn = tlbi_aa64_vae2is_write },
-   { .name = "TLBI_ALLE1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae2is_write),
+   TLBI(.name = "TLBI_ALLE1OS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 4,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_alle1is_write },
-    { .name = "TLBI_VALE2OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_alle1is_write),
+ TLBI(.name = "TLBI_VALE2OS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 5,
       .access = PL2_W, .type = ARM_CP_NO_RAW | ARM_CP_EL3_NO_EL2_UNDEF,
-      .writefn = tlbi_aa64_vae2is_write },
-    { .name = "TLBI_VMALLS12E1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae2is_write),
+ TLBI(.name = "TLBI_VMALLS12E1OS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 1, .opc2 = 6,
       .access = PL2_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_alle1is_write },
-    { .name = "TLBI_IPAS2E1OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_alle1is_write),
+#undef TLBI
+#define TLBI(name, opc0, opc1, crn, crm, opc2, access, type)            \
+{ name, .state = ARM_CP_STATE_AA64, opc0, opc1, crn, crm, opc2, access, \
+  type },                                                               \
+{ name"NXS", .state = ARM_CP_STATE_AA64, opc0, opc1, crn + 1, crm, opc2,\
+   access, type }
+ TLBI(.name = "TLBI_IPAS2E1OS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 0,
-      .access = PL2_W, .type = ARM_CP_NOP },
-    { .name = "TLBI_RIPAS2E1OS", .state = ARM_CP_STATE_AA64,
+      .access = PL2_W, .type = ARM_CP_NOP),
+ TLBI(.name = "TLBI_RIPAS2E1OS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 3,
-      .access = PL2_W, .type = ARM_CP_NOP },
-    { .name = "TLBI_IPAS2LE1OS", .state = ARM_CP_STATE_AA64,
+      .access = PL2_W, .type = ARM_CP_NOP),
+ TLBI(.name = "TLBI_IPAS2LE1OS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 4,
-      .access = PL2_W, .type = ARM_CP_NOP },
-    { .name = "TLBI_RIPAS2LE1OS", .state = ARM_CP_STATE_AA64,
+      .access = PL2_W, .type = ARM_CP_NOP),
+ TLBI(.name = "TLBI_RIPAS2LE1OS",
       .opc0 = 1, .opc1 = 4, .crn = 8, .crm = 4, .opc2 = 7,
-      .access = PL2_W, .type = ARM_CP_NOP },
-    { .name = "TLBI_ALLE3OS", .state = ARM_CP_STATE_AA64,
+      .access = PL2_W, .type = ARM_CP_NOP),
+#undef TLBI
+#define TLBI(name, opc0, opc1, crn, crm, opc2, access, type, writefn)       \
+{ name, .state = ARM_CP_STATE_AA64, opc0, opc1, crn, crm, opc2, access,     \
+  type, writefn },                                                          \
+{ name"NXS", .state = ARM_CP_STATE_AA64, opc0, opc1, crn + 1, crm, opc2,    \
+   access, type, writefn }
+ TLBI(.name = "TLBI_ALLE3OS",
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 0,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_alle3is_write },
-    { .name = "TLBI_VAE3OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_alle3is_write),
+ TLBI(.name = "TLBI_VAE3OS",
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 1,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_vae3is_write },
-    { .name = "TLBI_VALE3OS", .state = ARM_CP_STATE_AA64,
+      .writefn = tlbi_aa64_vae3is_write),
+ TLBI(.name = "TLBI_VALE3OS",
       .opc0 = 1, .opc1 = 6, .crn = 8, .crm = 1, .opc2 = 5,
       .access = PL3_W, .type = ARM_CP_NO_RAW,
-      .writefn = tlbi_aa64_vae3is_write },
+      .writefn = tlbi_aa64_vae3is_write),
+#undef TLBI
 };
 
 static uint64_t rndr_readfn(CPUARMState *env, const ARMCPRegInfo *ri)
@@ -9201,7 +9260,8 @@ void register_cp_regs_for_features(ARMCPU *cpu)
                                R_ID_AA64ISAR1_SB_MASK |
                                R_ID_AA64ISAR1_BF16_MASK |
                                R_ID_AA64ISAR1_DGH_MASK |
-                               R_ID_AA64ISAR1_I8MM_MASK },
+                               R_ID_AA64ISAR1_I8MM_MASK |
+                               R_ID_AA64ISAR1_XS_MASK },
             { .name = "ID_AA64ISAR2_EL1",
               .exported_bits = R_ID_AA64ISAR2_WFXT_MASK |
                                R_ID_AA64ISAR2_RPRES_MASK |

-- 
2.45.2

[RFC PATCH 2/4] arm/tcg: add decodetree entry for DSB nXS variant

[Manos Pitsidianakis]

The DSB nXS variant is always both a reads and writes request type.
Ignore the domain field like we do in plain DSB and perform a full
system barrier operation.

The DSB nXS variant is part of FEAT_XS made mandatory from Armv8.7.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
---
 target/arm/tcg/a64.decode      | 3 +++
 target/arm/tcg/translate-a64.c | 6 ++++++
 2 files changed, 9 insertions(+)

diff --git a/target/arm/tcg/a64.decode b/target/arm/tcg/a64.decode
index 331a8e180c0b14e2abe3ec641a867235574316f7..c4f516abc18224932082cdf3e7530edc7a304bc1 100644
--- a/target/arm/tcg/a64.decode
+++ b/target/arm/tcg/a64.decode
@@ -245,6 +245,9 @@ WFIT            1101 0101 0000 0011 0001 0000 001 rd:5
 
 CLREX           1101 0101 0000 0011 0011 ---- 010 11111
 DSB_DMB         1101 0101 0000 0011 0011 domain:2 types:2 10- 11111
+# For the DSB nXS variant, types always equals MBReqTypes_All and we ignore the
+# domain bits.
+DSB_nXS         1101 0101 0000 0011 0011 -- 10 001 11111
 ISB             1101 0101 0000 0011 0011 ---- 110 11111
 SB              1101 0101 0000 0011 0011 0000 111 11111
 
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index 071b6349fc38802a62f4b4056e369c4d8b1ecf94..85e71599203eee62b4d22a0b10ed676cc815dab6 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -1959,6 +1959,12 @@ static bool trans_DSB_DMB(DisasContext *s, arg_DSB_DMB *a)
     return true;
 }
 
+static bool trans_DSB_nXS(DisasContext *ctx, arg_DSB_nXS *a)
+{
+    tcg_gen_mb(TCG_BAR_SC | TCG_MO_ALL);
+    return true;
+}
+
 static bool trans_ISB(DisasContext *s, arg_ISB *a)
 {
     /*

-- 
2.45.2

[RFC PATCH 3/4] arm/tcg/cpu64: add FEAT_XS feat in max cpu

[Manos Pitsidianakis]

Add FEAT_XS feature report value in max cpu's ID_AA64ISAR1 sys register.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
---
 target/arm/tcg/cpu64.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
index 0168920828651492b1114d66ab0fc72c20dda2a8..8c8f88d84151952872f1b1987e98d789b501fb23 100644
--- a/target/arm/tcg/cpu64.c
+++ b/target/arm/tcg/cpu64.c
@@ -1163,6 +1163,7 @@ void aarch64_max_tcg_initfn(Object *obj)
     t = FIELD_DP64(t, ID_AA64ISAR1, BF16, 2);     /* FEAT_BF16, FEAT_EBF16 */
     t = FIELD_DP64(t, ID_AA64ISAR1, DGH, 1);      /* FEAT_DGH */
     t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 1);     /* FEAT_I8MM */
+    t = FIELD_DP64(t, ID_AA64ISAR1, XS, 1);       /* FEAT_XS */
     cpu->isar.id_aa64isar1 = t;
 
     t = cpu->isar.id_aa64isar2;

-- 
2.45.2

[RFC PATCH 4/4] tests/tcg/aarch64: add system test for FEAT_XS

[Manos Pitsidianakis]

Add system test to make sure FEAT_XS is enabled for max cpu emulation
and that QEMU doesn't crash when encountering an NXS instruction
variant.

Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
---
 tests/tcg/aarch64/system/feat-xs.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

diff --git a/tests/tcg/aarch64/system/feat-xs.c b/tests/tcg/aarch64/system/feat-xs.c
new file mode 100644
index 0000000000000000000000000000000000000000..52a481c577f9420fa2f6d6a794c1f26772cb4bff
--- /dev/null
+++ b/tests/tcg/aarch64/system/feat-xs.c
@@ -0,0 +1,27 @@
+/*
+ * FEAT_XS Test
+ *
+ * Copyright (c) 2024 Linaro Ltd
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include <minilib.h>
+#include <stdint.h>
+
+int main(void)
+{
+    uint64_t isar1;
+
+    asm volatile ("mrs %0, id_aa64isar1_el1" : "=r"(isar1));
+    if (((isar1 >> 56) & (0xff)) != 1) {
+        ml_printf("FEAT_XS not supported by CPU");
+        return 1;
+    }
+    /* VMALLE1NXS */
+    asm volatile (".inst 0xd508971f");
+    /* VMALLE1OSNXS */
+    asm volatile (".inst 0xd508911f");
+
+    return 0;
+}

-- 
2.45.2

Re: [RFC PATCH 1/4] arm: Add FEAT_XS's TLBI NXS variants

[Richard Henderson]

On 10/14/24 03:48, Manos Pitsidianakis wrote:
> Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
> ---
>   target/arm/cpu-features.h |   5 +
>   target/arm/helper.c       | 366 +++++++++++++++++++++++++++-------------------
>   2 files changed, 218 insertions(+), 153 deletions(-)
> 
> diff --git a/target/arm/cpu-features.h b/target/arm/cpu-features.h
> index 04ce2818263e2c3b99c59940001b65302e1d26d2..b4dcd429c3540e18c44d3c30f82f030be45719f2 100644
> --- a/target/arm/cpu-features.h
> +++ b/target/arm/cpu-features.h
> @@ -970,6 +970,11 @@ static inline bool isar_feature_aa64_sme_fa64(const ARMISARegisters *id)
>       return FIELD_EX64(id->id_aa64smfr0, ID_AA64SMFR0, FA64);
>   }
>   
> +static inline bool isar_feature_aa64_xs(const ARMISARegisters *id)
> +{
> +    return FIELD_SEX64(id->id_aa64isar1, ID_AA64ISAR1, XS) >= 0;
> +}
> +
>   /*
>    * Feature tests for "does this exist in either 32-bit or 64-bit?"
>    */
> diff --git a/target/arm/helper.c b/target/arm/helper.c
> index 3f77b40734f2db831254a0e4eb205751aec0d1e5..3104a2d1dab6e58bf454c75afd478ec6d5fe521f 100644
> --- a/target/arm/helper.c
> +++ b/target/arm/helper.c
> @@ -5671,98 +5671,111 @@ static const ARMCPRegInfo v8_cp_reginfo[] = {
>         .fgt = FGT_DCCISW,
>         .access = PL1_W, .accessfn = access_tsw, .type = ARM_CP_NOP },
>       /* TLBI operations */
> -    { .name = "TLBI_VMALLE1IS", .state = ARM_CP_STATE_AA64,
> +#define TLBI(name, opc0, opc1, crn, crm, opc2, access, accessfn, type, fgt, \
> +             writefn)                                                       \
> +{ name, .state = ARM_CP_STATE_AA64, opc0, opc1, crn, crm, opc2, access,     \
> +  accessfn, type, fgt, writefn },                                           \
> +{ name"NXS", .state = ARM_CP_STATE_AA64, opc0, opc1, crn + 1, crm, opc2,    \
> +   access, accessfn, type, fgt, writefn }

You cannot insert the NXS operations into the existing arrays.
They must be separate, so that they are registered only if FEAT_XS is present.

You can see this with the split between v8_cp_reginfo[] and tlbirange_reginfo[].

> @@ -9201,7 +9260,8 @@ void register_cp_regs_for_features(ARMCPU *cpu)
>                                  R_ID_AA64ISAR1_SB_MASK |
>                                  R_ID_AA64ISAR1_BF16_MASK |
>                                  R_ID_AA64ISAR1_DGH_MASK |
> -                               R_ID_AA64ISAR1_I8MM_MASK },
> +                               R_ID_AA64ISAR1_I8MM_MASK |
> +                               R_ID_AA64ISAR1_XS_MASK },

This is incorrect.  Here we are emulating

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/arch/arm64/cpu-feature-registers.rst#n208

and XS is not present.  Nor should it be, since cache flushing is not something that 
userland may do.


r~

Re: [RFC PATCH 2/4] arm/tcg: add decodetree entry for DSB nXS variant

[Richard Henderson]

On 10/14/24 03:48, Manos Pitsidianakis wrote:
> +static bool trans_DSB_nXS(DisasContext *ctx, arg_DSB_nXS *a)
> +{
> +    tcg_gen_mb(TCG_BAR_SC | TCG_MO_ALL);
> +    return true;
> +}
This is missing the feature test:

     if (!dc_isar_feature(aa64_xs, ctx)) {
         return false;
     }


r~

Re: [RFC PATCH 3/4] arm/tcg/cpu64: add FEAT_XS feat in max cpu

[Richard Henderson]

On 10/14/24 03:48, Manos Pitsidianakis wrote:
> Add FEAT_XS feature report value in max cpu's ID_AA64ISAR1 sys register.
> 
> Signed-off-by: Manos Pitsidianakis<manos.pitsidianakis@linaro.org>
> ---
>   target/arm/tcg/cpu64.c | 1 +
>   1 file changed, 1 insertion(+)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

r~

Re: [RFC PATCH 3/4] arm/tcg/cpu64: add FEAT_XS feat in max cpu

[Richard Henderson]

On 10/14/24 03:48, Manos Pitsidianakis wrote:
> Add FEAT_XS feature report value in max cpu's ID_AA64ISAR1 sys register.
> 
> Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
> ---
>   target/arm/tcg/cpu64.c | 1 +
>   1 file changed, 1 insertion(+)
> 
> diff --git a/target/arm/tcg/cpu64.c b/target/arm/tcg/cpu64.c
> index 0168920828651492b1114d66ab0fc72c20dda2a8..8c8f88d84151952872f1b1987e98d789b501fb23 100644
> --- a/target/arm/tcg/cpu64.c
> +++ b/target/arm/tcg/cpu64.c
> @@ -1163,6 +1163,7 @@ void aarch64_max_tcg_initfn(Object *obj)
>       t = FIELD_DP64(t, ID_AA64ISAR1, BF16, 2);     /* FEAT_BF16, FEAT_EBF16 */
>       t = FIELD_DP64(t, ID_AA64ISAR1, DGH, 1);      /* FEAT_DGH */
>       t = FIELD_DP64(t, ID_AA64ISAR1, I8MM, 1);     /* FEAT_I8MM */
> +    t = FIELD_DP64(t, ID_AA64ISAR1, XS, 1);       /* FEAT_XS */
>       cpu->isar.id_aa64isar1 = t;
>   
>       t = cpu->isar.id_aa64isar2;
> 

Actually, this or a follow-up is missing the change to
docs/system/arm/emulation.rst.


r~

Re: [RFC PATCH 4/4] tests/tcg/aarch64: add system test for FEAT_XS

[Richard Henderson]

On 10/14/24 03:48, Manos Pitsidianakis wrote:
> Add system test to make sure FEAT_XS is enabled for max cpu emulation
> and that QEMU doesn't crash when encountering an NXS instruction
> variant.
> 
> Signed-off-by: Manos Pitsidianakis<manos.pitsidianakis@linaro.org>
> ---
>   tests/tcg/aarch64/system/feat-xs.c | 27 +++++++++++++++++++++++++++
>   1 file changed, 27 insertions(+)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>


r~

Re: [RFC PATCH 0/4] No-op support for Arm FEAT_XS, feedback needed

[Peter Maydell]

On Mon, 14 Oct 2024 at 11:50, Manos Pitsidianakis
<manos.pitsidianakis@linaro.org> wrote:
>
> This series is an initial incomplete attempt at adding support for the
> FEAT_XS feature in aarch64 TCG. This feature was introduced in ARMv8.7:
> it adds a new memory attribute XS which indicates that a memory access
> could take longer than usual to complete and also adds instruction
> variants for TLBI maintenance and DSB.
>
> These variants are implemented as no-ops, since QEMU TCG doesn't
> implement caching.
>
> This is my first foray into TCG and certain things weren't clear to me:
>
> 1. How to make sure the feature is implemented properly. Since we model
>    cache maintenance as no-ops my understanding is the only
>    functionality we need to provide is to expose the FEAT_XS feature bit
>    and also make sure the nXS variants trap properly if configured with
>    fine-grained traps.

We also need to make HCRX_EL2 writes allow read and write of the
new FGTnXS and FnXS bits. (hcrx_write() constructs a valid_mask
and only allows those bits to be written, so the mask needs updating.)

> 2. Is there a point in adding a TCG test? If I read the manual
>    correctly, the nXS variants should trap to the undefined instruction
>    vector if unimplemented.
>
> These patches lack support for FGT for now.

We will need the FGT support, but I think it should be
straightforward to add:
 * add a new entry NXS to the FIELD() definitions of FGT in cpregs.h
   with the meaning "honour HCR_EL2.FGTnXS to suppress FGT",
   and in access_check_cp_reg skip the trap-check if NXS is
   set and arm_hcrx_el2_eff() has the FGTnXS bit set
 * when we add the new ARMCPRegInfo stanzas for the new NXS,
   make the .fgt fields be
     .fgt = FGT_TLBIwhatever | FGT_NXS
   so we apply the NXS logic to those ones
   (or if you like use macro magic in cpreg.h to define
   FGT_TLBIVAE1OSNXS as being FGT_TLBIVAE1OS | FGT_NXS,
   like what we do for including FGT_REV in the FGT_ constants)

-- PMM

Re: [RFC PATCH 0/4] No-op support for Arm FEAT_XS, feedback needed

[Gustavo Romero]

Hi Manos,

On 10/14/24 07:48, Manos Pitsidianakis wrote:
> This series is an initial incomplete attempt at adding support for the
> FEAT_XS feature in aarch64 TCG. This feature was introduced in ARMv8.7:
> it adds a new memory attribute XS which indicates that a memory access
> could take longer than usual to complete and also adds instruction
> variants for TLBI maintenance and DSB.
> 
> These variants are implemented as no-ops, since QEMU TCG doesn't
> implement caching.
> 
> This is my first foray into TCG and certain things weren't clear to me:
> 
> 1. How to make sure the feature is implemented properly. Since we model
>     cache maintenance as no-ops my understanding is the only
>     functionality we need to provide is to expose the FEAT_XS feature bit
>     and also make sure the nXS variants trap properly if configured with
>     fine-grained traps.
> 2. Is there a point in adding a TCG test? If I read the manual
>     correctly, the nXS variants should trap to the undefined instruction
>     vector if unimplemented.

Yes, I think a test as the one you provided is worth to at least, as you
mentioned, check if QEMU doesn't crash when encountering NXS instruction
variants.


Cheers,
Gustavo


> These patches lack support for FGT for now.
> 
> Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
> ---
> Manos Pitsidianakis (4):
>        arm: Add FEAT_XS's TLBI NXS variants
>        arm/tcg: add decodetree entry for DSB nXS variant
>        arm/tcg/cpu64: add FEAT_XS feat in max cpu
>        tests/tcg/aarch64: add system test for FEAT_XS
> 
>   target/arm/cpu-features.h          |   5 +
>   target/arm/helper.c                | 366 +++++++++++++++++++++----------------
>   target/arm/tcg/a64.decode          |   3 +
>   target/arm/tcg/cpu64.c             |   1 +
>   target/arm/tcg/translate-a64.c     |   6 +
>   tests/tcg/aarch64/system/feat-xs.c |  27 +++
>   6 files changed, 255 insertions(+), 153 deletions(-)
> ---
> base-commit: 7e3b6d8063f245d27eecce5aabe624b5785f2a77
> change-id: 20240919-arm-feat-xs-73eedb23d937
> 
> --
> γαῖα πυρί μιχθήτω
> 
> 

Re: [RFC PATCH 4/4] tests/tcg/aarch64: add system test for FEAT_XS

[Gustavo Romero]

Hi Manos,

On 10/14/24 07:48, Manos Pitsidianakis wrote:
> Add system test to make sure FEAT_XS is enabled for max cpu emulation
> and that QEMU doesn't crash when encountering an NXS instruction
> variant.
> 
> Signed-off-by: Manos Pitsidianakis <manos.pitsidianakis@linaro.org>
> ---
>   tests/tcg/aarch64/system/feat-xs.c | 27 +++++++++++++++++++++++++++
>   1 file changed, 27 insertions(+)
> 
> diff --git a/tests/tcg/aarch64/system/feat-xs.c b/tests/tcg/aarch64/system/feat-xs.c
> new file mode 100644
> index 0000000000000000000000000000000000000000..52a481c577f9420fa2f6d6a794c1f26772cb4bff
> --- /dev/null
> +++ b/tests/tcg/aarch64/system/feat-xs.c
> @@ -0,0 +1,27 @@
> +/*
> + * FEAT_XS Test
> + *
> + * Copyright (c) 2024 Linaro Ltd
> + *
> + * SPDX-License-Identifier: GPL-2.0-or-later
> + */
> +
> +#include <minilib.h>
> +#include <stdint.h>
> +
> +int main(void)
> +{
> +    uint64_t isar1;
> +
> +    asm volatile ("mrs %0, id_aa64isar1_el1" : "=r"(isar1));
> +    if (((isar1 >> 56) & (0xff)) != 1) {

XS field is 4 bits, so & against 0xF instead of 0xFF?


Cheers,
Gustavo

> +        ml_printf("FEAT_XS not supported by CPU");
> +        return 1;
> +    }
> +    /* VMALLE1NXS */
> +    asm volatile (".inst 0xd508971f");
> +    /* VMALLE1OSNXS */
> +    asm volatile (".inst 0xd508911f");
> +
> +    return 0;
> +}
>