Merge tag 'pull-target-arm-20240402' of https://git.linaro.org/people/pmaydell/qemu-arm into staging

target-arm queue:
 * take HSTR traps of cp15 accesses to EL2, not EL1
 * docs: sbsa: update specs, add dt note
 * hw/intc/arm_gicv3: ICC_HPPIR* return SPURIOUS if int group is disabled
 * tests/qtest: Fix STM32L4x5 GPIO test on 32-bit
 * raspi4b: Reduce RAM to 1Gb on 32-bit hosts

# -----BEGIN PGP SIGNATURE-----
#
# iQJNBAABCAA3FiEE4aXFk81BneKOgxXPPCUl7RQ2DN4FAmYL3J8ZHHBldGVyLm1h
# eWRlbGxAbGluYXJvLm9yZwAKCRA8JSXtFDYM3lL9D/9ayKF76MKs+oK8+uHTOLPb
# Mk71K1apgFnkzC7v9xuI76M6SzZpcKslUbieucDhkDLdVuZvlV3eUcwQGbNWu9fx
# PCkx7RmD54o+nlGxacZx4wGDfgu9j3maCVik048WxNoHb03NPahfHIb/GFRyHgt/
# TTjeqfAX7GDbHzMiGuaEJi5dLuAP0/imLt7pooJv4JRDX3CMY+tzlclU4ySMBr+S
# 0fs5oi6kZMayM8iolpSrPDQy/N3jZJpd5pNPPIcsnL5DEJHKodHbD11+Zetb1tQ7
# Tyw+x+hUb8Yx2WADVBaihYnbvakUVLt7ZzdgDENV534O/1Vmabzt14CBGTwq4faQ
# 8Hbc4e/ulhsOUlaxCDKTCuCKDW7sub7UelSz7mX6dAwcjvEi/L99dkP1wSpl0W04
# 3uTQyjDrfCOVNJ/FMYLRp5VkjwUVacbs3u3Tpe2bgRMI+hxnKZjtIMIY09q3l7em
# JrPOsiiJlVzngcQko1K0cor3p5W43HIhLUlh0RqJL/CsVhXFfHShAJowK31vGnNp
# ITklT5CWKMmogHTJycQieemhwwKaALgCUBC9TrcD1dTJe/GksYXVg6Fit7IJttBI
# zsPMM21Namtr1tKsV71xgtpDrkiWZkeFRpo/GrEf50bX1Mx7Dc8D/ons2RS0G2vo
# S13Dyt6GBtzS9M8rKX2fsQ==
# =rYVb
# -----END PGP SIGNATURE-----
# gpg: Signature made Tue 02 Apr 2024 11:23:27 BST
# gpg:                using RSA key E1A5C593CD419DE28E8315CF3C2525ED14360CDE
# gpg:                issuer "peter.maydell@linaro.org"
# gpg: Good signature from "Peter Maydell <peter.maydell@linaro.org>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@gmail.com>" [ultimate]
# gpg:                 aka "Peter Maydell <pmaydell@chiark.greenend.org.uk>" [ultimate]
# gpg:                 aka "Peter Maydell <peter@archaic.org.uk>" [ultimate]
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* tag 'pull-target-arm-20240402' of https://git.linaro.org/people/pmaydell/qemu-arm:
  raspi4b: Reduce RAM to 1Gb on 32-bit hosts
  tests/qtest: Fix STM32L4x5 GPIO test on 32-bit
  hw/intc/arm_gicv3: ICC_HPPIR* return SPURIOUS if int group is disabled
  docs: sbsa: update specs, add dt note
  target/arm: take HSTR traps of cp15 accesses to EL2, not EL1

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

5 files changed, 68 insertions, 36 deletions

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
index bca61608ff..2bf22a1d0b 100644
--- a/docs/system/arm/sbsa.rst
+++ b/docs/system/arm/sbsa.rst
@@ -1,12 +1,16 @@
 Arm Server Base System Architecture Reference board (``sbsa-ref``)
 ==================================================================
 
-While the ``virt`` board is a generic board platform that doesn't match
-any real hardware the ``sbsa-ref`` board intends to look like real
-hardware. The `Server Base System Architecture
-<https://developer.arm.com/documentation/den0029/latest>`_ defines a
-minimum base line of hardware support and importantly how the firmware
-reports that to any operating system.
+The ``sbsa-ref`` board intends to look like real hardware (while the ``virt``
+board is a generic board platform that doesn't match any real hardware).
+
+The hardware part is defined by two specifications:
+
+  - `Base System Architecture <https://developer.arm.com/documentation/den0094/>`__ (BSA)
+  - `Server Base System Architecture <https://developer.arm.com/documentation/den0029/>`__ (SBSA)
+
+The `Arm Base Boot Requirements <https://developer.arm.com/documentation/den0044/>`__ (BBR)
+specification defines how the firmware reports that to any operating system.
 
 It is intended to be a machine for developing firmware and testing
 standards compliance with operating systems.
@@ -35,16 +39,29 @@ includes both internal hardware and parts affected by the qemu command line
 (i.e. CPUs and memory). As a result it must have a firmware specifically built
 to expect a certain hardware layout (as you would in a real machine).
 
+Note
+''''
+
+QEMU provides the guest EL3 firmware with minimal information about hardware
+platform using minimalistic devicetree. This is not a Linux devicetree. It is
+not even a firmware devicetree.
+
+It is information passed from QEMU to describe the information a hardware
+platform would have other mechanisms to discover at runtime, that are affected
+by the QEMU command line.
+
+Ultimately this devicetree may be replaced by IPC calls to an emulated SCP.
+
 DeviceTree information
 ''''''''''''''''''''''
 
-The devicetree provided by the board model to the firmware is not intended
-to be a complete compliant DT. It currently reports:
+The devicetree reports:
 
    - CPUs
    - memory
    - platform version
    - GIC addresses
+   - NUMA node id for CPUs and memory
 
 Platform version
 ''''''''''''''''
@@ -70,4 +87,4 @@ Platform version changes:
   GIC ITS information is present in devicetree.
 
 0.3
-  The USB controller is an XHCI device, not EHCI
+  The USB controller is an XHCI device, not EHCI.
diff --git a/hw/arm/raspi4b.c b/hw/arm/raspi4b.c
index cb1b1f2f14..85877880fc 100644
--- a/hw/arm/raspi4b.c
+++ b/hw/arm/raspi4b.c
@@ -112,7 +112,11 @@ static void raspi4b_machine_class_init(ObjectClass *oc, void *data)
     MachineClass *mc = MACHINE_CLASS(oc);
     RaspiBaseMachineClass *rmc = RASPI_BASE_MACHINE_CLASS(oc);
 
+#if HOST_LONG_BITS == 32
+    rmc->board_rev = 0xa03111; /* Revision 1.1, 1 Gb RAM */
+#else
     rmc->board_rev = 0xb03115; /* Revision 1.5, 2 Gb RAM */
+#endif
     raspi_machine_class_common_init(mc, rmc->board_rev);
     mc->init = raspi4b_machine_init;
 }
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index e1a60d8c15..67d8fd07b7 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -1067,7 +1067,7 @@ static uint64_t icc_hppir0_value(GICv3CPUState *cs, CPUARMState *env)
      */
     bool irq_is_secure;
 
-    if (cs->hppi.prio == 0xff) {
+    if (icc_no_enabled_hppi(cs)) {
         return INTID_SPURIOUS;
     }
 
@@ -1104,7 +1104,7 @@ static uint64_t icc_hppir1_value(GICv3CPUState *cs, CPUARMState *env)
      */
     bool irq_is_secure;
 
-    if (cs->hppi.prio == 0xff) {
+    if (icc_no_enabled_hppi(cs)) {
         return INTID_SPURIOUS;
     }
 
diff --git a/target/arm/tcg/translate.c b/target/arm/tcg/translate.c
index c8a2470675..69585e6003 100644
--- a/target/arm/tcg/translate.c
+++ b/target/arm/tcg/translate.c
@@ -4585,7 +4585,7 @@ static void do_coproc_insn(DisasContext *s, int cpnum, int is64,
             tcg_gen_andi_i32(t, t, 1u << maskbit);
             tcg_gen_brcondi_i32(TCG_COND_EQ, t, 0, over.label);
 
-            gen_exception_insn(s, 0, EXCP_UDEF, syndrome);
+            gen_exception_insn_el(s, 0, EXCP_UDEF, syndrome, 2);
             /*
              * gen_exception_insn() will set is_jmp to DISAS_NORETURN,
              * but since we're conditionally branching over it, we want
diff --git a/tests/qtest/stm32l4x5_gpio-test.c b/tests/qtest/stm32l4x5_gpio-test.c
index cc56be2031..0f6bda54d3 100644
--- a/tests/qtest/stm32l4x5_gpio-test.c
+++ b/tests/qtest/stm32l4x5_gpio-test.c
@@ -76,6 +76,17 @@ const uint32_t idr_reset[NUM_GPIOS] = {
     0x00000000
 };
 
+#define PIN_MASK        0xF
+#define GPIO_ADDR_MASK  (~(GPIO_SIZE - 1))
+
+static inline void *test_data(uint32_t gpio_addr, uint8_t pin)
+{
+    return (void *)(uintptr_t)((gpio_addr & GPIO_ADDR_MASK) | (pin & PIN_MASK));
+}
+
+#define test_gpio_addr(data)      ((uintptr_t)(data) & GPIO_ADDR_MASK)
+#define test_pin(data)            ((uintptr_t)(data) & PIN_MASK)
+
 static uint32_t gpio_readl(unsigned int gpio, unsigned int offset)
 {
     return readl(gpio + offset);
@@ -269,8 +280,8 @@ static void test_gpio_output_mode(const void *data)
      * Additionally, it checks that values written to ODR
      * when not in output mode are stored and not discarded.
      */
-    unsigned int pin = ((uint64_t)data) & 0xF;
-    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int pin = test_pin(data);
+    uint32_t gpio = test_gpio_addr(data);
     unsigned int gpio_id = get_gpio_id(gpio);
 
     qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
@@ -304,8 +315,8 @@ static void test_gpio_input_mode(const void *data)
      * corresponding GPIO line high/low : it should set the
      * right bit in IDR and send an irq to syscfg.
      */
-    unsigned int pin = ((uint64_t)data) & 0xF;
-    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int pin = test_pin(data);
+    uint32_t gpio = test_gpio_addr(data);
     unsigned int gpio_id = get_gpio_id(gpio);
 
     qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
@@ -333,8 +344,8 @@ static void test_pull_up_pull_down(const void *data)
      * Test that a floating pin with pull-up sets the pin
      * high and vice-versa.
      */
-    unsigned int pin = ((uint64_t)data) & 0xF;
-    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int pin = test_pin(data);
+    uint32_t gpio = test_gpio_addr(data);
     unsigned int gpio_id = get_gpio_id(gpio);
 
     qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
@@ -363,8 +374,8 @@ static void test_push_pull(const void *data)
      * disconnects the pin, that the pin can't be set or reset
      * externally afterwards.
      */
-    unsigned int pin = ((uint64_t)data) & 0xF;
-    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int pin = test_pin(data);
+    uint32_t gpio = test_gpio_addr(data);
     uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 
     qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
@@ -410,8 +421,8 @@ static void test_open_drain(const void *data)
      * However a pin set low externally shouldn't be disconnected,
      * and it can be set low externally when in open-drain mode.
      */
-    unsigned int pin = ((uint64_t)data) & 0xF;
-    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int pin = test_pin(data);
+    uint32_t gpio = test_gpio_addr(data);
     uint32_t gpio2 = GPIO_BASE_ADDR + (GPIO_H - gpio);
 
     qtest_irq_intercept_in(global_qtest, "/machine/soc/syscfg");
@@ -466,8 +477,8 @@ static void test_bsrr_brr(const void *data)
      * has the desired effect on ODR.
      * In BSRR, BSx has priority over BRx.
      */
-    unsigned int pin = ((uint64_t)data) & 0xF;
-    uint32_t gpio = ((uint64_t)data) >> 32;
+    unsigned int pin = test_pin(data);
+    uint32_t gpio = test_gpio_addr(data);
 
     gpio_writel(gpio, BSRR, (1 << pin));
     g_assert_cmphex(gpio_readl(gpio, ODR), ==, reset(gpio, ODR) | (1 << pin));
@@ -507,40 +518,40 @@ int main(int argc, char **argv)
      * is problematic since the pin was already high.
      */
     qtest_add_data_func("stm32l4x5/gpio/test_gpioc5_output_mode",
-                        (void *)((uint64_t)GPIO_C << 32 | 5),
+                        test_data(GPIO_C, 5),
                         test_gpio_output_mode);
     qtest_add_data_func("stm32l4x5/gpio/test_gpioh3_output_mode",
-                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_data(GPIO_H, 3),
                         test_gpio_output_mode);
     qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode1",
-                        (void *)((uint64_t)GPIO_D << 32 | 6),
+                        test_data(GPIO_D, 6),
                         test_gpio_input_mode);
     qtest_add_data_func("stm32l4x5/gpio/test_gpio_input_mode2",
-                        (void *)((uint64_t)GPIO_C << 32 | 10),
+                        test_data(GPIO_C, 10),
                         test_gpio_input_mode);
     qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down1",
-                        (void *)((uint64_t)GPIO_B << 32 | 5),
+                        test_data(GPIO_B, 5),
                         test_pull_up_pull_down);
     qtest_add_data_func("stm32l4x5/gpio/test_gpio_pull_up_pull_down2",
-                        (void *)((uint64_t)GPIO_F << 32 | 1),
+                        test_data(GPIO_F, 1),
                         test_pull_up_pull_down);
     qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull1",
-                        (void *)((uint64_t)GPIO_G << 32 | 6),
+                        test_data(GPIO_G, 6),
                         test_push_pull);
     qtest_add_data_func("stm32l4x5/gpio/test_gpio_push_pull2",
-                        (void *)((uint64_t)GPIO_H << 32 | 3),
+                        test_data(GPIO_H, 3),
                         test_push_pull);
     qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain1",
-                        (void *)((uint64_t)GPIO_C << 32 | 4),
+                        test_data(GPIO_C, 4),
                         test_open_drain);
     qtest_add_data_func("stm32l4x5/gpio/test_gpio_open_drain2",
-                        (void *)((uint64_t)GPIO_E << 32 | 11),
+                        test_data(GPIO_E, 11),
                         test_open_drain);
     qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr1",
-                        (void *)((uint64_t)GPIO_A << 32 | 12),
+                        test_data(GPIO_A, 12),
                         test_bsrr_brr);
     qtest_add_data_func("stm32l4x5/gpio/test_bsrr_brr2",
-                        (void *)((uint64_t)GPIO_D << 32 | 0),
+                        test_data(GPIO_D, 0),
                         test_bsrr_brr);
 
     qtest_start("-machine b-l475e-iot01a");