On Fri, 16 Oct 2026 17:46:57 +0800 Jinjie Ruan <[email protected]> wrote:
> From: Jinjie Ruan <[email protected]> > > FEAT_MPAM_SMS's MPAMSM_EL1 (S3_0_C10_C5_3) was missing, so a v7.x > guest with SME enabled took an UNDEFINED instruction in > cpu_enable_mpam(), which writes the register unconditionally when > ARM64_SME is present. Register it backed by CPU state like the other > MPAM registers, letting linux v7.x boot with -cpu max unmodified. > > Signed-off-by: Jinjie Ruan <[email protected]> > --- > target/arm/cpu.h | 1 + > target/arm/helper.c | 6 ++++++ > 2 files changed, 7 insertions(+) > > diff --git a/target/arm/cpu.h b/target/arm/cpu.h > index 218923a..c60ec62 100644 > --- a/target/arm/cpu.h > +++ b/target/arm/cpu.h > @@ -761,6 +761,7 @@ typedef struct CPUArchState { > uint64_t mpam1_el1; > uint64_t mpam2_el2; > uint64_t mpamhcr_el2; > + uint64_t mpamsm_el1; > /* Optional fault info across tlb lookup. */ > ARMMMUFaultInfo *tlb_fi; > > diff --git a/target/arm/helper.c b/target/arm/helper.c > index d5d96d5..a9b1521 100644 > --- a/target/arm/helper.c > +++ b/target/arm/helper.c > @@ -6912,6 +6912,12 @@ void register_cp_regs_for_features(ARMCPU *cpu) > .access = PL1_R, .type = ARM_CP_CONST, > .accessfn = access_tid3, > .resetvalue = cpu->isar.mpamidr_el1 }, > + { .name = "MPAMSM_EL1", .state = ARM_CP_STATE_AA64, > + .opc0 = 3, .opc1 = 0, .crn = 0xa, .crm = 5, .opc2 = 3, > + .access = PL1_RW, .type = ARM_CP_ALIAS, > + .accessfn = access_tid3, Same as previous. Wrong trap. Also depends on SME being present, otherwise this register needs hiding. FWIW claude at least is really good at giving at poking holes in these entries. Other LLMs might be too. Bunch of RES0 in this one as well. > + .fieldoffset = offsetof(CPUARMState, mpamsm_el1), > + }, > { .name = "MPAM0_EL1", .state = ARM_CP_STATE_AA64, > .opc0 = 3, .opc1 = 0, .crn = 0xa, .crm = 5, .opc2 = 1, > .access = PL1_RW, .type = ARM_CP_ALIAS,
