Series comparison

-[Qemu-devel] [PULL 0/9] target-arm queue
+[PULL 00/17] target-arm queue
-ARM bugfixes for rc1...
+Hi; here's a target-arm pullreq for rc0; these are all bugfixes
 and similar minor stuff.
+thanks
+-- PMM
-The following changes since commit f291910db61b5812e68f1e76afb3ade41d567bea:
+The following changes since commit 0462a32b4f63b2448b4a196381138afd50719dc4:
-  Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-11-09' into staging (2017-11-13 13:13:12 +0000)
+  Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging (2025-03-14 09:31:13 +0800)
-are available in the git repository at:
+are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171113
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250314-1
-for you to fetch changes up to d25f2a72272b9ffe0d06710d6217d1169bc2cc7d:
+for you to fetch changes up to a019e15edfd62beae1e2f6adc0fa7415ba20b14c:
-  accel/tcg/translate-all: expand cpu_restore_state addr check (2017-11-13 13:55:27 +0000)
+  meson.build: Set RUST_BACKTRACE for all tests (2025-03-14 12:54:33 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * translate-a64.c: silence gcc5 warning
+ * Correctly handle corner cases of guest attempting an exception
- * highbank: validate register offset before access
+   return to AArch32 when target EL is AArch64 only
- * MAINTAINERS: Add entries for Smartfusion2
+ * MAINTAINERS: Fix status for Arm boards I "maintain"
- * accel/tcg/translate-all: expand cpu_restore_state addr check
+ * tests/functional: Bump up arm_replay timeout
-   (so usermode insn aborts don't crash with an assertion failure)
+ * Revert "hw/char/pl011: Warn when using disabled receiver"
- * fix TCG initialization of some Arm boards by allowing them
+ * util/cacheflush: Make first DSB unconditional on aarch64
-   to specify min/default number of CPUs to create
+ * target/arm: Fix SVE/SME access check logic
  * meson.build: Set RUST_BACKTRACE for all tests
 ----------------------------------------------------------------
-Alex Bennée (1):
+Joe Komlodi (1):
-      accel/tcg/translate-all: expand cpu_restore_state addr check
+      util/cacheflush: Make first DSB unconditional on aarch64
-Alistair Francis (2):
+Paolo Bonzini (1):
-      xlnx-zynqmp: Properly support the smp command line option
+      Revert "hw/char/pl011: Warn when using disabled receiver"
       xlnx-zcu102: Add an info message deprecating the EP108
-Emilio G. Cota (4):
+Peter Maydell (13):
-      arm/translate-a64: mark path as unreachable to eliminate warning
+      target/arm: Move A32_BANKED_REG_{GET,SET} macros to cpregs.h
-      qom: move CPUClass.tcg_initialize to a global
+      target/arm: Un-inline access_secure_reg()
-      xlnx-zcu102: Specify the max number of CPUs for the EP108
+      linux-user/aarch64: Remove unused get/put_user macros
-      hw: add .min_cpus and .default_cpus fields to machine_class
+      linux-user/arm: Remove unused get_put_user macros
       target/arm: Move arm_cpu_data_is_big_endian() etc to internals.h
       target/arm: Move arm_current_el() and arm_el_is_aa64() to internals.h
       target/arm: SCR_EL3.RW should be treated as 1 if EL2 doesn't support AArch32
       target/arm: HCR_EL2.RW should be RAO/WI if EL1 doesn't support AArch32
       target/arm: Add cpu local variable to exception_return helper
       target/arm: Forbid return to AArch32 when CPU is AArch64-only
       MAINTAINERS: Fix status for Arm boards I "maintain"
       tests/functional: Bump up arm_replay timeout
       meson.build: Set RUST_BACKTRACE for all tests
-Prasad J Pandit (1):
+Richard Henderson (2):
-      highbank: validate register offset before access
+      target/arm: Make DisasContext.{fp, sve}_access_checked tristate
       target/arm: Simplify pstate_sm check in sve_access_check
-Subbaraya Sundeep (1):
+ MAINTAINERS                         |  14 ++--
-      MAINTAINERS: Add entries for Smartfusion2
+ meson.build                         |   9 ++-
+ target/arm/cpregs.h                 |  28 +++++++
- include/exec/exec-all.h    | 11 ++++++++++
+ target/arm/cpu.h                    | 153 +-----------------------------------
- include/hw/boards.h        |  5 +++++
+ target/arm/internals.h              | 135 +++++++++++++++++++++++++++++++
- include/qom/cpu.h          |  1 -
+ target/arm/tcg/translate-a64.h      |   2 +-
- accel/tcg/translate-all.c  | 52 ++++++++++++++++++++++++++--------------------
+ target/arm/tcg/translate.h          |  10 ++-
- exec.c                     |  5 +++--
+ hw/char/pl011.c                     |  19 ++---
- hw/arm/exynos4_boards.c    | 12 ++++-------
+ hw/intc/arm_gicv3_cpuif.c           |   1 +
- hw/arm/highbank.c          | 17 +++++++++++++--
+ linux-user/aarch64/cpu_loop.c       |  48 -----------
- hw/arm/raspi.c             |  2 ++
+ linux-user/arm/cpu_loop.c           |  43 +---------
- hw/arm/xlnx-zcu102.c       |  9 +++++++-
+ target/arm/arch_dump.c              |   1 +
- hw/arm/xlnx-zynqmp.c       | 26 ++++++++++++++---------
+ target/arm/helper.c                 |  16 +++-
- target/arm/translate-a64.c |  2 ++
+ target/arm/tcg/helper-a64.c         |  12 ++-
- vl.c                       | 21 ++++++++++++++++---
+ target/arm/tcg/hflags.c             |   9 +++
- MAINTAINERS                | 17 +++++++++++++++
+ target/arm/tcg/translate-a64.c      |  37 ++++-----
- qemu-doc.texi              |  7 +++++++
+ util/cacheflush.c                   |   4 +-
-files changed, 137 insertions(+), 50 deletions(-)
+ .gitlab-ci.d/buildtest-template.yml |   1 -
+files changed, 257 insertions(+), 285 deletions(-)

-[Qemu-devel] [PULL 6/9] xlnx-zcu102: Add an info message deprecating the EP108
+[PULL 01/17] target/arm: Move A32_BANKED_REG_{GET, SET} macros to cpregs.h
-From: Alistair Francis <alistair.francis@xilinx.com>
+The A32_BANKED_REG_{GET,SET} macros are only used inside target/arm;
 move their definitions to cpregs.h. There's no need to have them
 defined in all the code that includes cpu.h.
-The EP108 was an early access development board that is no longer used.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Add an info message to convert any users to the ZCU102 instead. On QEMU
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-they are both identical.
+---
  target/arm/cpregs.h | 28 ++++++++++++++++++++++++++++
  target/arm/cpu.h    | 27 ---------------------------
 files changed, 28 insertions(+), 27 deletions(-)
-This patch also updated the qemu-doc.texi file to indicate that the
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
 EP108 has been deprecated.
 Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
 Reviewed-by: Emilio G. Cota <cota@braap.org>
 Message-id: 1510343626-25861-4-git-send-email-cota@braap.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  hw/arm/xlnx-zcu102.c | 3 +++
  qemu-doc.texi        | 7 +++++++
 files changed, 10 insertions(+)
 diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/target/arm/cpregs.h
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/target/arm/cpregs.h
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_cpreg_traps_in_nv(const ARMCPRegInfo *ri)
- {
+     return ri->opc1 == 4 || ri->opc1 == 5;
-     XlnxZCU102 *s = EP108_MACHINE(machine);
+ }
-+    info_report("The Xilinx EP108 machine is deprecated, please use the "
++/* Macros for accessing a specified CP register bank */
-+                "ZCU102 machine instead. It has the same features supported.");
++#define A32_BANKED_REG_GET(_env, _regname, _secure)                     \
 +    ((_secure) ? (_env)->cp15._regname##_s : (_env)->cp15._regname##_ns)
 +
-     xlnx_zynqmp_init(s, machine);
++#define A32_BANKED_REG_SET(_env, _regname, _secure, _val)       \
 +    do {                                                        \
 +        if (_secure) {                                          \
 +            (_env)->cp15._regname##_s = (_val);                 \
 +        } else {                                                \
 +            (_env)->cp15._regname##_ns = (_val);                \
 +        }                                                       \
 +    } while (0)
 +
 +/*
 + * Macros for automatically accessing a specific CP register bank depending on
 + * the current secure state of the system.  These macros are not intended for
 + * supporting instruction translation reads/writes as these are dependent
 + * solely on the SCR.NS bit and not the mode.
 + */
 +#define A32_BANKED_CURRENT_REG_GET(_env, _regname)                          \
 +    A32_BANKED_REG_GET((_env), _regname,                                    \
 +                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)))
 +
 +#define A32_BANKED_CURRENT_REG_SET(_env, _regname, _val)                    \
 +    A32_BANKED_REG_SET((_env), _regname,                                    \
 +                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)), \
 +                       (_val))
 +
  #endif /* TARGET_ARM_CPREGS_H */
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool access_secure_reg(CPUARMState *env)
      return ret;
  }
-diff --git a/qemu-doc.texi b/qemu-doc.texi
+-/* Macros for accessing a specified CP register bank */
-index XXXXXXX..XXXXXXX 100644
+-#define A32_BANKED_REG_GET(_env, _regname, _secure)    \
---- a/qemu-doc.texi
+-    ((_secure) ? (_env)->cp15._regname##_s : (_env)->cp15._regname##_ns)
-+++ b/qemu-doc.texi
+-
-@@ -XXX,XX +XXX,XX @@ or ``ivshmem-doorbell`` device types.
+-#define A32_BANKED_REG_SET(_env, _regname, _secure, _val)   \
- The ``spapr-pci-vfio-host-bridge'' device type is replaced by
+-    do {                                                \
- the ``spapr-pci-host-bridge'' device type.
+-        if (_secure) {                                   \
+-            (_env)->cp15._regname##_s = (_val);            \
-+@section System emulator machines
+-        } else {                                        \
-+
+-            (_env)->cp15._regname##_ns = (_val);           \
-+@subsection Xilinx EP108 (since 2.11.0)
+-        }                                               \
-+
+-    } while (0)
-+The ``xlnx-ep108'' machine has been replaced by the ``xlnx-zcu102'' machine.
+-
-+The ``xlnx-zcu102'' machine has the same features and capabilites in QEMU.
+-/* Macros for automatically accessing a specific CP register bank depending on
-+
+- * the current secure state of the system.  These macros are not intended for
- @node License
+- * supporting instruction translation reads/writes as these are dependent
- @appendix License
+- * solely on the SCR.NS bit and not the mode.
 - */
 -#define A32_BANKED_CURRENT_REG_GET(_env, _regname)        \
 -    A32_BANKED_REG_GET((_env), _regname,                \
 -                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)))
 -
 -#define A32_BANKED_CURRENT_REG_SET(_env, _regname, _val)                       \
 -    A32_BANKED_REG_SET((_env), _regname,                                    \
 -                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)), \
 -                       (_val))
 -
  uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
                                   uint32_t cur_el, bool secure);
 --
-.7.4
+.43.0

-New patch
+[PULL 02/17] target/arm: Un-inline access_secure_reg()
+We would like to move arm_el_is_aa64() to internals.h; however, it is
+used by access_secure_reg().  Make that function not be inline, so
+that it can stay in cpu.h.
+access_secure_reg() is used only in two places:
+ * in hflags.c
+ * in the user-mode arm emulators, to decide whether to store
+   the TLS value in the secure or non-secure banked field
+The second of these is not on a super-hot path that would care about
+the inlining (and incidentally will always use the NS banked field
+because our user-mode CPUs never set ARM_FEATURE_EL3); put the
+definition of access_secure_reg() in hflags.c, near its only use
+inside target/arm.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/cpu.h        | 12 +++---------
+ target/arm/tcg/hflags.c |  9 +++++++++
+files changed, 12 insertions(+), 9 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
+     return aa64;
+ }
+-/* Function for determining whether guest cp register reads and writes should
++/*
++ * Function for determining whether guest cp register reads and writes should
+  * access the secure or non-secure bank of a cp register.  When EL3 is
+  * operating in AArch32 state, the NS-bit determines whether the secure
+  * instance of a cp register should be used. When EL3 is AArch64 (or if
+  * it doesn't exist at all) then there is no register banking, and all
+  * accesses are to the non-secure version.
+  */
+-static inline bool access_secure_reg(CPUARMState *env)
+-{
+-    bool ret = (arm_feature(env, ARM_FEATURE_EL3) &&
+-                !arm_el_is_aa64(env, 3) &&
+-                !(env->cp15.scr_el3 & SCR_NS));
+-
+-    return ret;
+-}
++bool access_secure_reg(CPUARMState *env);
+ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
+                                  uint32_t cur_el, bool secure);
+diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/tcg/hflags.c
++++ b/target/arm/tcg/hflags.c
+@@ -XXX,XX +XXX,XX @@ static bool aprofile_require_alignment(CPUARMState *env, int el, uint64_t sctlr)
+ #endif
+ }
++bool access_secure_reg(CPUARMState *env)
++{
++    bool ret = (arm_feature(env, ARM_FEATURE_EL3) &&
++                !arm_el_is_aa64(env, 3) &&
++                !(env->cp15.scr_el3 & SCR_NS));
++
++    return ret;
++}
++
+ static CPUARMTBFlags rebuild_hflags_common(CPUARMState *env, int fp_el,
+                                            ARMMMUIdx mmu_idx,
+                                            CPUARMTBFlags flags)
+--
+.43.0

-New patch
+[PULL 03/17] linux-user/aarch64: Remove unused get/put_user macros
+At the top of linux-user/aarch64/cpu_loop.c we define a set of
+macros for reading and writing data and code words, but we never
+use these macros. Delete them.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ linux-user/aarch64/cpu_loop.c | 48 -----------------------------------
+file changed, 48 deletions(-)
+diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/aarch64/cpu_loop.c
++++ b/linux-user/aarch64/cpu_loop.c
+@@ -XXX,XX +XXX,XX @@
+ #include "target/arm/syndrome.h"
+ #include "target/arm/cpu-features.h"
+-#define get_user_code_u32(x, gaddr, env)                \
+-    ({ abi_long __r = get_user_u32((x), (gaddr));       \
+-        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
+-            (x) = bswap32(x);                           \
+-        }                                               \
+-        __r;                                            \
+-    })
+-
+-#define get_user_code_u16(x, gaddr, env)                \
+-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
+-        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
+-            (x) = bswap16(x);                           \
+-        }                                               \
+-        __r;                                            \
+-    })
+-
+-#define get_user_data_u32(x, gaddr, env)                \
+-    ({ abi_long __r = get_user_u32((x), (gaddr));       \
+-        if (!__r && arm_cpu_bswap_data(env)) {          \
+-            (x) = bswap32(x);                           \
+-        }                                               \
+-        __r;                                            \
+-    })
+-
+-#define get_user_data_u16(x, gaddr, env)                \
+-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
+-        if (!__r && arm_cpu_bswap_data(env)) {          \
+-            (x) = bswap16(x);                           \
+-        }                                               \
+-        __r;                                            \
+-    })
+-
+-#define put_user_data_u32(x, gaddr, env)                \
+-    ({ typeof(x) __x = (x);                             \
+-        if (arm_cpu_bswap_data(env)) {                  \
+-            __x = bswap32(__x);                         \
+-        }                                               \
+-        put_user_u32(__x, (gaddr));                     \
+-    })
+-
+-#define put_user_data_u16(x, gaddr, env)                \
+-    ({ typeof(x) __x = (x);                             \
+-        if (arm_cpu_bswap_data(env)) {                  \
+-            __x = bswap16(__x);                         \
+-        }                                               \
+-        put_user_u16(__x, (gaddr));                     \
+-    })
+-
+ /* AArch64 main loop */
+ void cpu_loop(CPUARMState *env)
+ {
+--
+.43.0

-New patch
+[PULL 04/17] linux-user/arm: Remove unused get_put_user macros
+In linux-user/arm/cpu_loop.c we define a full set of get/put
+macros for both code and data (since the endianness handling
+is different between the two). However the only one we actually
+use is get_user_code_u32(). Remove the rest.
+We leave a comment noting how data-side accesses should be handled
+for big-endian, because that's a subtle point and we just removed the
+macros that were effectively documenting it.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ linux-user/arm/cpu_loop.c | 43 ++++-----------------------------------
+file changed, 4 insertions(+), 39 deletions(-)
+diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
+index XXXXXXX..XXXXXXX 100644
+--- a/linux-user/arm/cpu_loop.c
++++ b/linux-user/arm/cpu_loop.c
+@@ -XXX,XX +XXX,XX @@
+         __r;                                            \
+     })
+-#define get_user_code_u16(x, gaddr, env)                \
+-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
+-        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
+-            (x) = bswap16(x);                           \
+-        }                                               \
+-        __r;                                            \
+-    })
+-
+-#define get_user_data_u32(x, gaddr, env)                \
+-    ({ abi_long __r = get_user_u32((x), (gaddr));       \
+-        if (!__r && arm_cpu_bswap_data(env)) {          \
+-            (x) = bswap32(x);                           \
+-        }                                               \
+-        __r;                                            \
+-    })
+-
+-#define get_user_data_u16(x, gaddr, env)                \
+-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
+-        if (!__r && arm_cpu_bswap_data(env)) {          \
+-            (x) = bswap16(x);                           \
+-        }                                               \
+-        __r;                                            \
+-    })
+-
+-#define put_user_data_u32(x, gaddr, env)                \
+-    ({ typeof(x) __x = (x);                             \
+-        if (arm_cpu_bswap_data(env)) {                  \
+-            __x = bswap32(__x);                         \
+-        }                                               \
+-        put_user_u32(__x, (gaddr));                     \
+-    })
+-
+-#define put_user_data_u16(x, gaddr, env)                \
+-    ({ typeof(x) __x = (x);                             \
+-        if (arm_cpu_bswap_data(env)) {                  \
+-            __x = bswap16(__x);                         \
+-        }                                               \
+-        put_user_u16(__x, (gaddr));                     \
+-    })
++/*
++ * Note that if we need to do data accesses here, they should do a
++ * bswap if arm_cpu_bswap_data() returns true.
++ */
+ /*
+  * Similar to code in accel/tcg/user-exec.c, but outside the execution loop.
+--
+.43.0

-New patch
+[PULL 05/17] target/arm: Move arm_cpu_data_is_big_endian() etc to internals.h
+The arm_cpu_data_is_big_endian() and related functions are now used
+only in target/arm; they can be moved to internals.h.
+The motivation here is that we would like to move arm_current_el()
+to internals.h.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/cpu.h       | 48 ------------------------------------------
+ target/arm/internals.h | 48 ++++++++++++++++++++++++++++++++++++++++++
+files changed, 48 insertions(+), 48 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_sctlr_b(CPUARMState *env)
+ uint64_t arm_sctlr(CPUARMState *env, int el);
+-static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
+-                                                  bool sctlr_b)
+-{
+-#ifdef CONFIG_USER_ONLY
+-    /*
+-     * In system mode, BE32 is modelled in line with the
+-     * architecture (as word-invariant big-endianness), where loads
+-     * and stores are done little endian but from addresses which
+-     * are adjusted by XORing with the appropriate constant. So the
+-     * endianness to use for the raw data access is not affected by
+-     * SCTLR.B.
+-     * In user mode, however, we model BE32 as byte-invariant
+-     * big-endianness (because user-only code cannot tell the
+-     * difference), and so we need to use a data access endianness
+-     * that depends on SCTLR.B.
+-     */
+-    if (sctlr_b) {
+-        return true;
+-    }
+-#endif
+-    /* In 32bit endianness is determined by looking at CPSR's E bit */
+-    return env->uncached_cpsr & CPSR_E;
+-}
+-
+-static inline bool arm_cpu_data_is_big_endian_a64(int el, uint64_t sctlr)
+-{
+-    return sctlr & (el ? SCTLR_EE : SCTLR_E0E);
+-}
+-
+-/* Return true if the processor is in big-endian mode. */
+-static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
+-{
+-    if (!is_a64(env)) {
+-        return arm_cpu_data_is_big_endian_a32(env, arm_sctlr_b(env));
+-    } else {
+-        int cur_el = arm_current_el(env);
+-        uint64_t sctlr = arm_sctlr(env, cur_el);
+-        return arm_cpu_data_is_big_endian_a64(cur_el, sctlr);
+-    }
+-}
+-
+ #include "exec/cpu-all.h"
+ /*
+@@ -XXX,XX +XXX,XX @@ static inline bool bswap_code(bool sctlr_b)
+ #endif
+ }
+-#ifdef CONFIG_USER_ONLY
+-static inline bool arm_cpu_bswap_data(CPUARMState *env)
+-{
+-    return TARGET_BIG_ENDIAN ^ arm_cpu_data_is_big_endian(env);
+-}
+-#endif
+-
+ void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
+                           uint64_t *cs_base, uint32_t *flags);
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
+     return arm_rmode_to_sf_map[rmode];
+ }
++static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
++                                                  bool sctlr_b)
++{
++#ifdef CONFIG_USER_ONLY
++    /*
++     * In system mode, BE32 is modelled in line with the
++     * architecture (as word-invariant big-endianness), where loads
++     * and stores are done little endian but from addresses which
++     * are adjusted by XORing with the appropriate constant. So the
++     * endianness to use for the raw data access is not affected by
++     * SCTLR.B.
++     * In user mode, however, we model BE32 as byte-invariant
++     * big-endianness (because user-only code cannot tell the
++     * difference), and so we need to use a data access endianness
++     * that depends on SCTLR.B.
++     */
++    if (sctlr_b) {
++        return true;
++    }
++#endif
++    /* In 32bit endianness is determined by looking at CPSR's E bit */
++    return env->uncached_cpsr & CPSR_E;
++}
++
++static inline bool arm_cpu_data_is_big_endian_a64(int el, uint64_t sctlr)
++{
++    return sctlr & (el ? SCTLR_EE : SCTLR_E0E);
++}
++
++/* Return true if the processor is in big-endian mode. */
++static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
++{
++    if (!is_a64(env)) {
++        return arm_cpu_data_is_big_endian_a32(env, arm_sctlr_b(env));
++    } else {
++        int cur_el = arm_current_el(env);
++        uint64_t sctlr = arm_sctlr(env, cur_el);
++        return arm_cpu_data_is_big_endian_a64(cur_el, sctlr);
++    }
++}
++
++#ifdef CONFIG_USER_ONLY
++static inline bool arm_cpu_bswap_data(CPUARMState *env)
++{
++    return TARGET_BIG_ENDIAN ^ arm_cpu_data_is_big_endian(env);
++}
++#endif
++
+ static inline void aarch64_save_sp(CPUARMState *env, int el)
+ {
+     if (env->pstate & PSTATE_SP) {
+--
+.43.0

-New patch
+[PULL 06/17] target/arm: Move arm_current_el() and arm_el_is_aa64() to internals.h
+The functions arm_current_el() and arm_el_is_aa64() are used only in
 target/arm and in hw/intc/arm_gicv3_cpuif.c.  They're functions that
 query internal state of the CPU.  Move them out of cpu.h and into
 internals.h.
 This means we need to include internals.h in arm_gicv3_cpuif.c, but
 this is justifiable because that file is implementing the GICv3 CPU
 interface, which really is part of the CPU proper; we just ended up
 implementing it in code in hw/intc/ for historical reasons.
 The motivation for this move is that we'd like to change
 arm_el_is_aa64() to add a condition that uses cpu_isar_feature();
 but we don't want to include cpu-features.h in cpu.h.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  target/arm/cpu.h          | 66 --------------------------------------
  target/arm/internals.h    | 67 +++++++++++++++++++++++++++++++++++++++
  hw/intc/arm_gicv3_cpuif.c |  1 +
  target/arm/arch_dump.c    |  1 +
 files changed, 69 insertions(+), 66 deletions(-)
 diff --git a/target/arm/cpu.h b/target/arm/cpu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/cpu.h
 +++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space);
  uint64_t arm_hcr_el2_eff(CPUARMState *env);
  uint64_t arm_hcrx_el2_eff(CPUARMState *env);
 -/* Return true if the specified exception level is running in AArch64 state. */
 -static inline bool arm_el_is_aa64(CPUARMState *env, int el)
 -{
 -    /* This isn't valid for EL0 (if we're in EL0, is_a64() is what you want,
 -     * and if we're not in EL0 then the state of EL0 isn't well defined.)
 -     */
 -    assert(el >= 1 && el <= 3);
 -    bool aa64 = arm_feature(env, ARM_FEATURE_AARCH64);
 -
 -    /* The highest exception level is always at the maximum supported
 -     * register width, and then lower levels have a register width controlled
 -     * by bits in the SCR or HCR registers.
 -     */
 -    if (el == 3) {
 -        return aa64;
 -    }
 -
 -    if (arm_feature(env, ARM_FEATURE_EL3) &&
 -        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
 -        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
 -    }
 -
 -    if (el == 2) {
 -        return aa64;
 -    }
 -
 -    if (arm_is_el2_enabled(env)) {
 -        aa64 = aa64 && (env->cp15.hcr_el2 & HCR_RW);
 -    }
 -
 -    return aa64;
 -}
 -
  /*
   * Function for determining whether guest cp register reads and writes should
   * access the secure or non-secure bank of a cp register.  When EL3 is
@@ -XXX,XX +XXX,XX @@ static inline bool arm_v7m_is_handler_mode(CPUARMState *env)
      return env->v7m.exception != 0;
  }
 -/* Return the current Exception Level (as per ARMv8; note that this differs
 - * from the ARMv7 Privilege Level).
 - */
 -static inline int arm_current_el(CPUARMState *env)
 -{
 -    if (arm_feature(env, ARM_FEATURE_M)) {
 -        return arm_v7m_is_handler_mode(env) ||
 -            !(env->v7m.control[env->v7m.secure] & 1);
 -    }
 -
 -    if (is_a64(env)) {
 -        return extract32(env->pstate, 2, 2);
 -    }
 -
 -    switch (env->uncached_cpsr & 0x1f) {
 -    case ARM_CPU_MODE_USR:
 -        return 0;
 -    case ARM_CPU_MODE_HYP:
 -        return 2;
 -    case ARM_CPU_MODE_MON:
 -        return 3;
 -    default:
 -        if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
 -            /* If EL3 is 32-bit then all secure privileged modes run in
 -             * EL3
 -             */
 -            return 3;
 -        }
 -
 -        return 1;
 -    }
 -}
 -
  /**
   * write_list_to_cpustate
   * @cpu: ARMCPU
 diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
      return arm_rmode_to_sf_map[rmode];
  }
 +/* Return true if the specified exception level is running in AArch64 state. */
 +static inline bool arm_el_is_aa64(CPUARMState *env, int el)
 +{
 +    /*
 +     * This isn't valid for EL0 (if we're in EL0, is_a64() is what you want,
 +     * and if we're not in EL0 then the state of EL0 isn't well defined.)
 +     */
 +    assert(el >= 1 && el <= 3);
 +    bool aa64 = arm_feature(env, ARM_FEATURE_AARCH64);
 +
 +    /*
 +     * The highest exception level is always at the maximum supported
 +     * register width, and then lower levels have a register width controlled
 +     * by bits in the SCR or HCR registers.
 +     */
 +    if (el == 3) {
 +        return aa64;
 +    }
 +
 +    if (arm_feature(env, ARM_FEATURE_EL3) &&
 +        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
 +        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
 +    }
 +
 +    if (el == 2) {
 +        return aa64;
 +    }
 +
 +    if (arm_is_el2_enabled(env)) {
 +        aa64 = aa64 && (env->cp15.hcr_el2 & HCR_RW);
 +    }
 +
 +    return aa64;
 +}
 +
 +/*
 + * Return the current Exception Level (as per ARMv8; note that this differs
 + * from the ARMv7 Privilege Level).
 + */
 +static inline int arm_current_el(CPUARMState *env)
 +{
 +    if (arm_feature(env, ARM_FEATURE_M)) {
 +        return arm_v7m_is_handler_mode(env) ||
 +            !(env->v7m.control[env->v7m.secure] & 1);
 +    }
 +
 +    if (is_a64(env)) {
 +        return extract32(env->pstate, 2, 2);
 +    }
 +
 +    switch (env->uncached_cpsr & 0x1f) {
 +    case ARM_CPU_MODE_USR:
 +        return 0;
 +    case ARM_CPU_MODE_HYP:
 +        return 2;
 +    case ARM_CPU_MODE_MON:
 +        return 3;
 +    default:
 +        if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
 +            /* If EL3 is 32-bit then all secure privileged modes run in EL3 */
 +            return 3;
 +        }
 +
 +        return 1;
 +    }
 +}
 +
  static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
                                                    bool sctlr_b)
  {
 diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/arm_gicv3_cpuif.c
 +++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@
  #include "cpu.h"
  #include "target/arm/cpregs.h"
  #include "target/arm/cpu-features.h"
 +#include "target/arm/internals.h"
  #include "system/tcg.h"
  #include "system/qtest.h"
 diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/arch_dump.c
 +++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@
  #include "elf.h"
  #include "system/dump.h"
  #include "cpu-features.h"
 +#include "internals.h"
  /* struct user_pt_regs from arch/arm64/include/uapi/asm/ptrace.h */
  struct aarch64_user_regs {
 --
 .43.0

-New patch
+[PULL 07/17] target/arm: SCR_EL3.RW should be treated as 1 if EL2 doesn't support AArch32
+The definition of SCR_EL3.RW says that its effective value is 1 if:
+ - EL2 is implemented and does not support AArch32, and SCR_EL3.NS is 1
+ - the effective value of SCR_EL3.{EEL2,NS} is {1,0} (i.e. we are
+   Secure and Secure EL2 is disabled)
+We implement the second of these in arm_el_is_aa64(), but forgot the
+first.
+Provide a new function arm_scr_rw_eff() to return the effective
+value of SCR_EL3.RW, and use it in arm_el_is_aa64() and the other
+places that currently look directly at the bit value.
+(scr_write() enforces that the RW bit is RAO/WI if neither EL1 nor
+EL2 have AArch32 support, but if EL1 does but EL2 does not then the
+bit must still be writeable.)
+This will mean that if code at EL3 attempts to perform an exception
+return to AArch32 EL2 when EL2 is AArch64-only we will correctly
+handle this as an illegal exception return: it will be caught by the
+"return to an EL which is configured for a different register width"
+check in HELPER(exception_return).
+We do already have some CPU types which don't implement AArch32
+above EL0, so this is technically a bug; it doesn't seem worth
+backporting to stable because no sensible guest code will be
+deliberately attempting to set the RW bit to a value corresponding
+to an unimplemented execution state and then checking that we
+did the right thing.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/internals.h | 26 +++++++++++++++++++++++---
+ target/arm/helper.c    |  4 ++--
+files changed, 25 insertions(+), 5 deletions(-)
+diff --git a/target/arm/internals.h b/target/arm/internals.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/internals.h
++++ b/target/arm/internals.h
+@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
+     return arm_rmode_to_sf_map[rmode];
+ }
++/* Return the effective value of SCR_EL3.RW */
++static inline bool arm_scr_rw_eff(CPUARMState *env)
++{
++    /*
++     * SCR_EL3.RW has an effective value of 1 if:
++     *  - we are NS and EL2 is implemented but doesn't support AArch32
++     *  - we are S and EL2 is enabled (in which case it must be AArch64)
++     */
++    ARMCPU *cpu = env_archcpu(env);
++
++    if (env->cp15.scr_el3 & SCR_RW) {
++        return true;
++    }
++    if (env->cp15.scr_el3 & SCR_NS) {
++        return arm_feature(env, ARM_FEATURE_EL2) &&
++            !cpu_isar_feature(aa64_aa32_el2, cpu);
++    } else {
++        return env->cp15.scr_el3 & SCR_EEL2;
++    }
++}
++
+ /* Return true if the specified exception level is running in AArch64 state. */
+ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
+ {
+@@ -XXX,XX +XXX,XX @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
+         return aa64;
+     }
+-    if (arm_feature(env, ARM_FEATURE_EL3) &&
+-        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
+-        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
++    if (arm_feature(env, ARM_FEATURE_EL3)) {
++        aa64 = aa64 && arm_scr_rw_eff(env);
+     }
+     if (el == 2) {
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
+     uint64_t hcr_el2;
+     if (arm_feature(env, ARM_FEATURE_EL3)) {
+-        rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
++        rw = arm_scr_rw_eff(env);
+     } else {
+         /*
+          * Either EL2 is the highest EL (and so the EL2 register width
+@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
+         switch (new_el) {
+         case 3:
+-            is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0;
++            is_aa64 = arm_scr_rw_eff(env);
+             break;
+         case 2:
+             hcr = arm_hcr_el2_eff(env);
+--
+.43.0

-New patch
+[PULL 08/17] target/arm: HCR_EL2.RW should be RAO/WI if EL1 doesn't support AArch32
+When EL1 doesn't support AArch32, the HCR_EL2.RW bit is supposed to
+be RAO/WI. Enforce the RAO/WI behaviour.
+Note that we handle "reset value should honour RES1 bits" in the same
+way that SCR_EL3 does, via a reset function.
+We do already have some CPU types which don't implement AArch32
+above EL0, so this is technically a bug; it doesn't seem worth
+backporting to stable because no sensible guest code will be
+deliberately attempting to set the RW bit to a value corresponding
+to an unimplemented execution state and then checking that we
+did the right thing.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+---
+ target/arm/helper.c | 12 ++++++++++++
+file changed, 12 insertions(+)
+diff --git a/target/arm/helper.c b/target/arm/helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/helper.c
++++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
+     /* Clear RES0 bits.  */
+     value &= valid_mask;
++    /* RW is RAO/WI if EL1 is AArch64 only */
++    if (!cpu_isar_feature(aa64_aa32_el1, cpu)) {
++        value |= HCR_RW;
++    }
++
+     /*
+      * These bits change the MMU setup:
+      * HCR_VM enables stage 2 translation
+@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
+     do_hcr_write(env, value, MAKE_64BIT_MASK(32, 32));
+ }
++static void hcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
++{
++    /* hcr_write will set the RES1 bits on an AArch64-only CPU */
++    hcr_write(env, ri, 0);
++}
++
+ /*
+  * Return the effective value of HCR_EL2, at the given security state.
+  * Bits that are not included here:
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
+       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
+       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
+       .nv2_redirect_offset = 0x78,
++      .resetfn = hcr_reset,
+       .writefn = hcr_write, .raw_writefn = raw_write },
+     { .name = "HCR", .state = ARM_CP_STATE_AA32,
+       .type = ARM_CP_ALIAS | ARM_CP_IO,
+--
+.43.0

-[Qemu-devel] [PULL 1/9] arm/translate-a64: mark path as unreachable to eliminate warning
+[PULL 09/17] target/arm: Add cpu local variable to exception_return helper
-From: "Emilio G. Cota" <cota@braap.org>
+We already call env_archcpu() multiple times within the
 exception_return helper function, and we're about to want to
 add another use of the ARMCPU pointer. Add a local variable
 cpu so we can call env_archcpu() just once.
-Fixes the following warning when compiling with gcc 5.4.0 with -O1
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-optimizations and --enable-debug:
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
  target/arm/tcg/helper-a64.c | 7 ++++---
 file changed, 4 insertions(+), 3 deletions(-)
-target/arm/translate-a64.c: In function ‘aarch64_tr_translate_insn’:
+diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
 target/arm/translate-a64.c:2361:8: error: ‘post_index’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
      if (!post_index) {
         ^
 target/arm/translate-a64.c:2307:10: note: ‘post_index’ was declared here
      bool post_index;
           ^
 target/arm/translate-a64.c:2386:8: error: ‘writeback’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
      if (writeback) {
         ^
 target/arm/translate-a64.c:2308:10: note: ‘writeback’ was declared here
      bool writeback;
           ^
 Note that idx comes from selecting 2 bits, and therefore its value
 can be at most 3.
 Signed-off-by: Emilio G. Cota <cota@braap.org>
 Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 1510087611-1851-1-git-send-email-cota@braap.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/translate-a64.c | 2 ++
 file changed, 2 insertions(+)
 diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/tcg/helper-a64.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/tcg/helper-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
+@@ -XXX,XX +XXX,XX @@ static void cpsr_write_from_spsr_elx(CPUARMState *env,
-         post_index = false;
-         writeback = true;
+ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
-         break;
+ {
-+    default:
++    ARMCPU *cpu = env_archcpu(env);
-+        g_assert_not_reached();
+     int cur_el = arm_current_el(env);
      unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
      uint32_t spsr = env->banked_spsr[spsr_idx];
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
      }
-     if (rn == 31) {
+     bql_lock();
 -    arm_call_pre_el_change_hook(env_archcpu(env));
 +    arm_call_pre_el_change_hook(cpu);
      bql_unlock();
      if (!return_to_aa64) {
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
          int tbii;
          env->aarch64 = true;
 -        spsr &= aarch64_pstate_valid_mask(&env_archcpu(env)->isar);
 +        spsr &= aarch64_pstate_valid_mask(&cpu->isar);
          pstate_write(env, spsr);
          if (!arm_singlestep_active(env)) {
              env->pstate &= ~PSTATE_SS;
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
      aarch64_sve_change_el(env, cur_el, new_el, return_to_aa64);
      bql_lock();
 -    arm_call_el_change_hook(env_archcpu(env));
 +    arm_call_el_change_hook(cpu);
      bql_unlock();
      return;
 --
-.7.4
+.43.0

-[Qemu-devel] [PULL 5/9] xlnx-zynqmp: Properly support the smp command line option
+[PULL 10/17] target/arm: Forbid return to AArch32 when CPU is AArch64-only
-From: Alistair Francis <alistair.francis@xilinx.com>
+In the Arm ARM, rule R_TYTWB states that returning to AArch32
 is an illegal exception return if:
  * AArch32 is not supported at any exception level
  * the target EL is configured for AArch64 via SCR_EL3.RW
    or HCR_EL2.RW or via CPU state at reset
-Allow the -smp command line option to control the number of CPUs we
+We check the second of these, but not the first (which can only be
-create.
+relevant for the case of a return to EL0, because if AArch32 is not
 supported at one of the higher ELs then the RW bits will have an
 effective value of 1 and the the "configured for AArch64" condition
 will hold also).
-Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
+Add the missing condition. Although this is technically a bug
-Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
+(because we have one AArch64-only CPU: a64fx) it isn't worth
-Reviewed-by: Emilio G. Cota <cota@braap.org>
+backporting to stable because no sensible guest code will
-Tested-by: Emilio G. Cota <cota@braap.org>
+deliberately try to return to a nonexistent execution state
-Message-id: 1510343626-25861-3-git-send-email-cota@braap.org
+to check that it gets an illegal exception return.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 ---
- hw/arm/xlnx-zcu102.c |  3 ++-
+ target/arm/tcg/helper-a64.c | 5 +++++
- hw/arm/xlnx-zynqmp.c | 26 ++++++++++++++++----------
+file changed, 5 insertions(+)
 files changed, 18 insertions(+), 11 deletions(-)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/target/arm/tcg/helper-a64.c
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/target/arm/tcg/helper-a64.c
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
- {
+         goto illegal_return;
      MachineClass *mc = MACHINE_CLASS(oc);
 -    mc->desc = "Xilinx ZynqMP ZCU102 board";
 +    mc->desc = "Xilinx ZynqMP ZCU102 board with 4xA53s and 2xR5s based on " \
 +               "the value of smp";
      mc->init = xlnx_zcu102_init;
      mc->block_default_type = IF_IDE;
      mc->units_per_default_bus = 1;
 diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zynqmp.c
 +++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(XlnxZynqMPState *s, const char *boot_cpu,
  {
      Error *err = NULL;
      int i;
 +    int num_rpus = MIN(smp_cpus - XLNX_ZYNQMP_NUM_APU_CPUS, XLNX_ZYNQMP_NUM_RPU_CPUS);
 -    for (i = 0; i < XLNX_ZYNQMP_NUM_RPU_CPUS; i++) {
 +    for (i = 0; i < num_rpus; i++) {
          char *name;
          object_initialize(&s->rpu_cpu[i], sizeof(s->rpu_cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(Object *obj)
  {
      XlnxZynqMPState *s = XLNX_ZYNQMP(obj);
      int i;
 +    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
 -    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
 +    for (i = 0; i < num_apus; i++) {
          object_initialize(&s->apu_cpu[i], sizeof(s->apu_cpu[i]),
                            "cortex-a53-" TYPE_ARM_CPU);
          object_property_add_child(obj, "apu-cpu[*]", OBJECT(&s->apu_cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
      MemoryRegion *system_memory = get_system_memory();
      uint8_t i;
      uint64_t ram_size;
 +    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
      const char *boot_cpu = s->boot_cpu ? s->boot_cpu : "apu-cpu[0]";
      ram_addr_t ddr_low_size, ddr_high_size;
      qemu_irq gic_spi[GIC_NUM_SPI_INTR];
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
      qdev_prop_set_uint32(DEVICE(&s->gic), "num-irq", GIC_NUM_SPI_INTR + 32);
      qdev_prop_set_uint32(DEVICE(&s->gic), "revision", 2);
 -    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", XLNX_ZYNQMP_NUM_APU_CPUS);
 +    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", num_apus);
      /* Realize APUs before realizing the GIC. KVM requires this.  */
 -    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
 +    for (i = 0; i < num_apus; i++) {
          char *name;
          object_property_set_int(OBJECT(&s->apu_cpu[i]), QEMU_PSCI_CONDUIT_SMC,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
          }
      }
--    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
++    if (!return_to_aa64 && !cpu_isar_feature(aa64_aa32, cpu)) {
-+    for (i = 0; i < num_apus; i++) {
++        /* Return to AArch32 when CPU is AArch64-only */
-         qemu_irq irq;
++        goto illegal_return;
          sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
      }
      if (s->has_rpu) {
 -        xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
 -        if (err) {
 -            error_propagate(errp, err);
 -            return;
 -        }
 +        info_report("The 'has_rpu' property is no longer required, to use the "
 +                    "RPUs just use -smp 6.");
 +    }
 +
-+    xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
+     if (new_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
-+    if (err) {
+         goto illegal_return;
 +        error_propagate(errp, err);
 +        return;
      }
-     if (!s->boot_cpu_ptr) {
 --
-.7.4
+.43.0

-[Qemu-devel] [PULL 3/9] MAINTAINERS: Add entries for Smartfusion2
+[PULL 11/17] MAINTAINERS: Fix status for Arm boards I "maintain"
-From: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+I'm down as the only listed maintainer for quite a lot of Arm SoC and
 board types.  In some cases this is only as the "maintainer of last
 resort" and I'm not in practice doing anything beyond patch review
 and the odd bit of tidyup.
-Voluntarily add myself as maintainer for Smartfusion2
+Move these entries in MAINTAINERS from "Maintained" to "Odd Fixes",
 to better represent reality.  Entries for other boards and SoCs where
 I do more actively care (or where there is a listed co-maintainer)
 remain as they are.
-Signed-off-by: Subbaraya Sundeep <sundeep.lkml@gmail.com>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1510552520-3566-1-git-send-email-sundeep.lkml@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-id: 20250307152838.3226398-1-peter.maydell@linaro.org
 ---
- MAINTAINERS | 17 +++++++++++++++++
+ MAINTAINERS | 14 +++++++-------
-file changed, 17 insertions(+)
+file changed, 7 insertions(+), 7 deletions(-)
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ M: Alistair Francis <alistair@alistair23.me>
+@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/kzm.rst
- S: Maintained
+ Integrator CP
- F: hw/arm/netduino2.c
+ M: Peter Maydell <peter.maydell@linaro.org>
+ L: qemu-arm@nongnu.org
-+SmartFusion2
+-S: Maintained
-+M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
++S: Odd Fixes
-+S: Maintained
+ F: hw/arm/integratorcp.c
-+F: hw/arm/msf2-soc.c
+ F: hw/misc/arm_integrator_debug.c
-+F: hw/misc/msf2-sysreg.c
+ F: include/hw/misc/arm_integrator_debug.h
-+F: hw/timer/mss-timer.c
+@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/mps2.rst
-+F: hw/ssi/mss-spi.c
+ Musca
-+F: include/hw/arm/msf2-soc.h
+ M: Peter Maydell <peter.maydell@linaro.org>
-+F: include/hw/misc/msf2-sysreg.h
+ L: qemu-arm@nongnu.org
-+F: include/hw/timer/mss-timer.h
+-S: Maintained
-+F: include/hw/ssi/mss-spi.h
++S: Odd Fixes
-+
+ F: hw/arm/musca.c
-+Emcraft M2S-FG484
+ F: docs/system/arm/musca.rst
-+M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
-+S: Maintained
+@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_aarch64_raspi4.py
-+F: hw/arm/msf2-som.c
+ Real View
-+
+ M: Peter Maydell <peter.maydell@linaro.org>
- CRIS Machines
+ L: qemu-arm@nongnu.org
- -------------
+-S: Maintained
- Axis Dev88
++S: Odd Fixes
  F: hw/arm/realview*
  F: hw/cpu/realview_mpcore.c
  F: hw/intc/realview_gic.c
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_arm_collie.py
  Stellaris
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/*/stellaris*
  F: hw/display/ssd03*
  F: include/hw/input/gamepad.h
@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/stm32.rst
  Versatile Express
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/arm/vexpress.c
  F: hw/display/sii9022.c
  F: docs/system/arm/vexpress.rst
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_arm_vexpress.py
  Versatile PB
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/*/versatile*
  F: hw/i2c/arm_sbcon_i2c.c
  F: include/hw/i2c/arm_sbcon_i2c.h
@@ -XXX,XX +XXX,XX @@ F: include/hw/hyperv/vmbus*.h
  OMAP
  M: Peter Maydell <peter.maydell@linaro.org>
  L: qemu-arm@nongnu.org
 -S: Maintained
 +S: Odd Fixes
  F: hw/*/omap*
  F: include/hw/arm/omap.h
  F: docs/system/arm/sx1.rst
 --
-.7.4
+.43.0

-[Qemu-devel] [PULL 2/9] highbank: validate register offset before access
+[PULL 13/17] Revert "hw/char/pl011: Warn when using disabled receiver"
-From: Prasad J Pandit <pjp@fedoraproject.org>
+From: Paolo Bonzini <pbonzini@redhat.com>
-An 'offset' parameter sent to highbank register r/w functions
+The guest does not control whether characters are sent on the UART.
-could be greater than number(NUM_REGS=0x200) of hb registers,
+Sending them before the guest happens to boot will now result in a
-leading to an OOB access issue. Add check to avoid it.
+"guest error" log entry that is only because of timing, even if the
 guest _would_ later setup the receiver correctly.
-Reported-by: Moguofang (Dennis mo) <moguofang@huawei.com>
+This reverts the bulk of commit abf2b6a028670bd2890bb3aee7e103fe53e4b0df,
-Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+and instead adds a comment about why we don't check the enable bits.
-Message-id: 20171113062658.9697-1-ppandit@redhat.com
 Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Message-id: 20250311153717.206129-1-pbonzini@redhat.com
 [PMM: expanded comment]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/highbank.c | 17 +++++++++++++++--
+ hw/char/pl011.c | 19 ++++++++++---------
-file changed, 15 insertions(+), 2 deletions(-)
+file changed, 10 insertions(+), 9 deletions(-)
-diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
+diff --git a/hw/char/pl011.c b/hw/char/pl011.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/highbank.c
+--- a/hw/char/pl011.c
-+++ b/hw/arm/highbank.c
++++ b/hw/char/pl011.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static int pl011_can_receive(void *opaque)
- #include "hw/ide/ahci.h"
+     unsigned fifo_depth = pl011_get_fifo_depth(s);
- #include "hw/cpu/a9mpcore.h"
+     unsigned fifo_available = fifo_depth - s->read_count;
- #include "hw/cpu/a15mpcore.h"
-+#include "qemu/log.h"
+-    if (!(s->cr & CR_UARTEN)) {
+-        qemu_log_mask(LOG_GUEST_ERROR,
- #define SMP_BOOT_ADDR           0x100
+-                      "PL011 receiving data on disabled UART\n");
- #define SMP_BOOT_REG            0x40
+-    }
-@@ -XXX,XX +XXX,XX @@ static void hb_regs_write(void *opaque, hwaddr offset,
+-    if (!(s->cr & CR_RXE)) {
-         }
+-        qemu_log_mask(LOG_GUEST_ERROR,
-     }
+-                      "PL011 receiving data on disabled RX UART\n");
+-    }
--    regs[offset/4] = value;
+-    trace_pl011_can_receive(s->lcr, s->read_count, fifo_depth, fifo_available);
-+    if (offset / 4 >= NUM_REGS) {
++    /*
-+        qemu_log_mask(LOG_GUEST_ERROR,
++     * In theory we should check the UART and RX enable bits here and
-+                  "highbank: bad write offset 0x%" HWADDR_PRIx "\n", offset);
++     * return 0 if they are not set (so the guest can't receive data
-+        return;
++     * until you have enabled the UART). In practice we suspect there
-+    }
++     * is at least some guest code out there which has been tested only
-+    regs[offset / 4] = value;
++     * on QEMU and which never bothers to enable the UART because we
 +     * historically never enforced that. So we effectively keep the
 +     * UART continuously enabled regardless of the enable bits.
 +     */
 +    trace_pl011_can_receive(s->lcr, s->read_count, fifo_depth, fifo_available);
      return fifo_available;
  }
- static uint64_t hb_regs_read(void *opaque, hwaddr offset,
-                              unsigned size)
- {
-+    uint32_t value;
-     uint32_t *regs = opaque;
--    uint32_t value = regs[offset/4];
-+
-+    if (offset / 4 >= NUM_REGS) {
-+        qemu_log_mask(LOG_GUEST_ERROR,
-+                  "highbank: bad read offset 0x%" HWADDR_PRIx "\n", offset);
-+        return 0;
-+    }
-+    value = regs[offset / 4];
-     if ((offset == 0x100) || (offset == 0x108) || (offset == 0x10C)) {
-         value |= 0x30000000;
 --
-.7.4
+.43.0

-[Qemu-devel] [PULL 4/9] qom: move CPUClass.tcg_initialize to a global
+[PULL 14/17] util/cacheflush: Make first DSB unconditional on aarch64
-From: "Emilio G. Cota" <cota@braap.org>
+From: Joe Komlodi <komlodi@google.com>
-c3cee ("qom: Introduce CPUClass.tcg_initialize", 2017-10-24)
+On ARM hosts with CTR_EL0.DIC and CTR_EL0.IDC set, this would only cause
-introduces a per-CPUClass bool that we check so that the target CPU
+an ISB to be executed during cache maintenance, which could lead to QEMU
-is initialized for TCG only once. This works well except when
+executing TBs containing garbage instructions.
 we end up creating more than one CPUClass, in which case we end
 up incorrectly initializing TCG more than once, i.e. once for
 each CPUClass.
-This can be replicated with:
+This seems to be because the ISB finishes executing instructions and
-  $ aarch64-softmmu/qemu-system-aarch64 -machine xlnx-zcu102 -smp 6 \
+flushes the pipeline, but the ISB doesn't guarantee that writes from the
-      -global driver=xlnx,,zynqmp,property=has_rpu,value=on
+executed instructions are committed. If a small enough TB is created, it's
-In this case the class name of the "RPUs" is prefixed by "cortex-r5-",
+possible that the writes setting up the TB aren't committed by the time the
-whereas the "regular" CPUs are prefixed by "cortex-a53-". This
+TB is executed.
 results in two CPUClass instances being created.
-Fix it by introducing a static variable, so that only the first
+This function is intended to be a port of the gcc implementation
-target CPU being initialized will initialize the target-dependent
+(https://github.com/gcc-mirror/gcc/blob/85b46d0795ac76bc192cb8f88b646a647acf98c1/libgcc/config/aarch64/sync-cache.c#L67)
-part of TCG, regardless of CPUClass instances.
+which makes the first DSB unconditional, so we can fix the synchronization
 issue by doing that as well.
-Fixes: 55c3ceef61fcf06fc98ddc752b7cce788ce7680b
+Cc: qemu-stable@nongnu.org
-Signed-off-by: Emilio G. Cota <cota@braap.org>
+Fixes: 664a79735e4deb1 ("util: Specialize flush_idcache_range for aarch64")
-Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
+Signed-off-by: Joe Komlodi <komlodi@google.com>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
+Message-id: 20250310203622.1827940-2-komlodi@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1510343626-25861-2-git-send-email-cota@braap.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/qom/cpu.h | 1 -
+ util/cacheflush.c | 4 +++-
- exec.c            | 5 +++--
+file changed, 3 insertions(+), 1 deletion(-)
 files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/include/qom/cpu.h b/include/qom/cpu.h
+diff --git a/util/cacheflush.c b/util/cacheflush.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/qom/cpu.h
+--- a/util/cacheflush.c
-+++ b/include/qom/cpu.h
++++ b/util/cacheflush.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CPUClass {
+@@ -XXX,XX +XXX,XX @@ void flush_idcache_range(uintptr_t rx, uintptr_t rw, size_t len)
-     /* Keep non-pointer data at the end to minimize holes.  */
+         for (p = rw & -dcache_lsize; p < rw + len; p += dcache_lsize) {
-     int gdb_num_core_regs;
+             asm volatile("dc\tcvau, %0" : : "r" (p) : "memory");
-     bool gdb_stop_before_watchpoint;
+         }
--    bool tcg_initialized;
+-        asm volatile("dsb\tish" : : : "memory");
  } CPUClass;
  #ifdef HOST_WORDS_BIGENDIAN
 diff --git a/exec.c b/exec.c
 index XXXXXXX..XXXXXXX 100644
 --- a/exec.c
 +++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
  void cpu_exec_realizefn(CPUState *cpu, Error **errp)
  {
      CPUClass *cc = CPU_GET_CLASS(cpu);
 +    static bool tcg_target_initialized;
      cpu_list_add(cpu);
 -    if (tcg_enabled() && !cc->tcg_initialized) {
 -        cc->tcg_initialized = true;
 +    if (tcg_enabled() && !tcg_target_initialized) {
 +        tcg_target_initialized = true;
          cc->tcg_initialize();
      }
++    /* DSB unconditionally to ensure any outstanding writes are committed. */
++    asm volatile("dsb\tish" : : : "memory");
++
+     /*
+      * If CTR_EL0.DIC is enabled, Instruction cache cleaning to the Point
+      * of Unification is not required for instruction to data coherence.
 --
-.7.4
+.43.0

-[Qemu-devel] [PULL 8/9] hw: add .min_cpus and .default_cpus fields to machine_class
+[PULL 15/17] target/arm: Make DisasContext.{fp, sve}_access_checked tristate
-From: "Emilio G. Cota" <cota@braap.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-max_cpus needs to be an upper bound on the number of vCPUs
+The check for fp_excp_el in assert_fp_access_checked is
-initialized; otherwise TCG region initialization breaks.
+incorrect.  For SME, with StreamingMode enabled, the access
 is really against the streaming mode vectors, and access
 to the normal fp registers is allowed to be disabled.
 C.f. sme_enabled_check.
-Some boards initialize a hard-coded number of vCPUs, which is not
+Convert sve_access_checked to match, even though we don't
-captured by the global max_cpus and therefore breaks TCG initialization.
+currently check the exception state.
 Fix it by adding the .min_cpus field to machine_class.
-This commit also changes some user-facing behaviour: we now die if
+Cc: qemu-stable@nongnu.org
--smp is below this hard-coded vCPU minimum instead of silently
+Fixes: 3d74825f4d6 ("target/arm: Add SME enablement checks")
-ignoring the passed -smp value (sometimes announcing this by printing
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-a warning). However, the introduction of .default_cpus lessens the
+Message-id: 20250307190415.982049-2-richard.henderson@linaro.org
-likelihood that users will notice this: if -smp isn't set, we now
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 assign the value in .default_cpus to both smp_cpus and max_cpus. IOW,
 if a user does not set -smp, they always get a correct number of vCPUs.
 This change fixes 3468b59 ("tcg: enable multiple TCG contexts in
 softmmu", 2017-10-24), which broke TCG initialization for some
 ARM boards.
 Fixes: 3468b59e18b179bc63c7ce934de912dfa9596122
 Reported-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
 Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
 Signed-off-by: Emilio G. Cota <cota@braap.org>
 Message-id: 1510343626-25861-6-git-send-email-cota@braap.org
 Suggested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Emilio G. Cota <cota@braap.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/boards.h     |  5 +++++
+ target/arm/tcg/translate-a64.h |  2 +-
- hw/arm/exynos4_boards.c | 12 ++++--------
+ target/arm/tcg/translate.h     | 10 +++++++---
- hw/arm/raspi.c          |  2 ++
+ target/arm/tcg/translate-a64.c | 17 +++++++++--------
- hw/arm/xlnx-zcu102.c    |  2 ++
+files changed, 17 insertions(+), 12 deletions(-)
  vl.c                    | 21 ++++++++++++++++++---
 files changed, 31 insertions(+), 11 deletions(-)
-diff --git a/include/hw/boards.h b/include/hw/boards.h
+diff --git a/target/arm/tcg/translate-a64.h b/target/arm/tcg/translate-a64.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
+--- a/target/arm/tcg/translate-a64.h
-+++ b/include/hw/boards.h
++++ b/target/arm/tcg/translate-a64.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+@@ -XXX,XX +XXX,XX @@ TCGv_i64 gen_mte_checkN(DisasContext *s, TCGv_i64 addr, bool is_write,
+ static inline void assert_fp_access_checked(DisasContext *s)
- /**
+ {
-  * MachineClass:
+ #ifdef CONFIG_DEBUG_TCG
-+ * @max_cpus: maximum number of CPUs supported. Default: 1
+-    if (unlikely(!s->fp_access_checked || s->fp_excp_el)) {
-+ * @min_cpus: minimum number of CPUs supported. Default: 1
++    if (unlikely(s->fp_access_checked <= 0)) {
-+ * @default_cpus: number of CPUs instantiated if none are specified. Default: 1
+         fprintf(stderr, "target-arm: FP access check missing for "
-  * @get_hotplug_handler: this function is called during bus-less
+                 "instruction 0x%08x\n", s->insn);
-  *    device hotplug. If defined it returns pointer to an instance
+         abort();
-  *    of HotplugHandler object, which handles hotplug operation
+diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ struct MachineClass {
      BlockInterfaceType block_default_type;
      int units_per_default_bus;
      int max_cpus;
 +    int min_cpus;
 +    int default_cpus;
      unsigned int no_serial:1,
          no_parallel:1,
          use_virtcon:1,
 diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/exynos4_boards.c
+--- a/target/arm/tcg/translate.h
-+++ b/hw/arm/exynos4_boards.c
++++ b/target/arm/tcg/translate.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
- #include "qemu-common.h"
+     bool aarch64;
- #include "cpu.h"
+     bool thumb;
- #include "sysemu/sysemu.h"
+     bool lse2;
--#include "sysemu/qtest.h"
+-    /* Because unallocated encodings generate different exception syndrome
- #include "hw/sysbus.h"
++    /*
- #include "net/net.h"
++     * Because unallocated encodings generate different exception syndrome
- #include "hw/arm/arm.h"
+      * information from traps due to FP being disabled, we can't do a single
-@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
+      * "is fp access disabled" check at a high level in the decode tree.
-                            Exynos4BoardType board_type)
+      * To help in catching bugs where the access check was forgotten in some
       * code path, we set this flag when the access check is done, and assert
       * that it is set at the point where we actually touch the FP regs.
 +     *   0: not checked,
 +     *   1: checked, access ok
 +     *  -1: checked, access denied
       */
 -    bool fp_access_checked;
 -    bool sve_access_checked;
 +    int8_t fp_access_checked;
 +    int8_t sve_access_checked;
      /* ARMv8 single-step state (this is distinct from the QEMU gdbstub
       * single-step support).
       */
 diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/tcg/translate-a64.c
 +++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool fp_access_check_only(DisasContext *s)
  {
-     Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
+     if (s->fp_excp_el) {
--    MachineClass *mc = MACHINE_GET_CLASS(machine);
+         assert(!s->fp_access_checked);
--
+-        s->fp_access_checked = true;
--    if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
++        s->fp_access_checked = -1;
--        error_report("%s board supports only %d CPU cores, ignoring smp_cpus"
--                     " value",
+         gen_exception_insn_el(s, 0, EXCP_UDEF,
--                     mc->name, EXYNOS4210_NCPUS);
+                               syn_fp_access_trap(1, 0xe, false, 0),
--    }
+                               s->fp_excp_el);
+         return false;
-     exynos4_board_binfo.ram_size = exynos4_board_ram_size[board_type];
+     }
-     exynos4_board_binfo.board_id = exynos4_board_id[board_type];
+-    s->fp_access_checked = true;
-@@ -XXX,XX +XXX,XX @@ static void nuri_class_init(ObjectClass *oc, void *data)
++    s->fp_access_checked = 1;
-     mc->desc = "Samsung NURI board (Exynos4210)";
+     return true;
      mc->init = nuri_init;
      mc->max_cpus = EXYNOS4210_NCPUS;
 +    mc->min_cpus = EXYNOS4210_NCPUS;
 +    mc->default_cpus = EXYNOS4210_NCPUS;
      mc->ignore_memory_transaction_failures = true;
  }
-@@ -XXX,XX +XXX,XX @@ static void smdkc210_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
-     mc->desc = "Samsung SMDKC210 board (Exynos4210)";
+                               syn_sve_access_trap(), s->sve_excp_el);
-     mc->init = smdkc210_init;
+         goto fail_exit;
-     mc->max_cpus = EXYNOS4210_NCPUS;
+     }
-+    mc->min_cpus = EXYNOS4210_NCPUS;
+-    s->sve_access_checked = true;
-+    mc->default_cpus = EXYNOS4210_NCPUS;
++    s->sve_access_checked = 1;
-     mc->ignore_memory_transaction_failures = true;
+     return fp_access_check(s);
   fail_exit:
      /* Assert that we only raise one exception per instruction. */
      assert(!s->sve_access_checked);
 -    s->sve_access_checked = true;
 +    s->sve_access_checked = -1;
      return false;
  }
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+@@ -XXX,XX +XXX,XX @@ bool sme_enabled_check(DisasContext *s)
-index XXXXXXX..XXXXXXX 100644
+      * sme_excp_el by itself for cpregs access checks.
---- a/hw/arm/raspi.c
+      */
-+++ b/hw/arm/raspi.c
+     if (!s->fp_excp_el || s->sme_excp_el < s->fp_excp_el) {
-@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
+-        s->fp_access_checked = true;
-     mc->no_floppy = 1;
+-        return sme_access_check(s);
-     mc->no_cdrom = 1;
++        bool ret = sme_access_check(s);
-     mc->max_cpus = BCM2836_NCPUS;
++        s->fp_access_checked = (ret ? 1 : -1);
-+    mc->min_cpus = BCM2836_NCPUS;
++        return ret;
-+    mc->default_cpus = BCM2836_NCPUS;
+     }
-     mc->default_ram_size = 1024 * 1024 * 1024;
+     return fp_access_check_only(s);
      mc->ignore_memory_transaction_failures = true;
  };
 diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-zcu102.c
 +++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
      mc->units_per_default_bus = 1;
      mc->ignore_memory_transaction_failures = true;
      mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
 +    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
  }
+@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
- static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
+     s->insn = insn;
-@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
+     s->base.pc_next = pc + 4;
-     mc->units_per_default_bus = 1;
-     mc->ignore_memory_transaction_failures = true;
+-    s->fp_access_checked = false;
-     mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
+-    s->sve_access_checked = false;
-+    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
++    s->fp_access_checked = 0;
- }
++    s->sve_access_checked = 0;
- static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
+     if (s->pstate_il) {
-diff --git a/vl.c b/vl.c
+         /*
 index XXXXXXX..XXXXXXX 100644
 --- a/vl.c
 +++ b/vl.c
@@ -XXX,XX +XXX,XX @@ Chardev *virtcon_hds[MAX_VIRTIO_CONSOLES];
  Chardev *sclp_hds[MAX_SCLP_CONSOLES];
  int win2k_install_hack = 0;
  int singlestep = 0;
 -int smp_cpus = 1;
 -unsigned int max_cpus = 1;
 +int smp_cpus;
 +unsigned int max_cpus;
  int smp_cores = 1;
  int smp_threads = 1;
  int acpi_enabled = 1;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
          exit(0);
      }
 +    /* machine_class: default to UP */
 +    machine_class->max_cpus = machine_class->max_cpus ?: 1;
 +    machine_class->min_cpus = machine_class->min_cpus ?: 1;
 +    machine_class->default_cpus = machine_class->default_cpus ?: 1;
 +
 +    /* default to machine_class->default_cpus */
 +    smp_cpus = machine_class->default_cpus;
 +    max_cpus = machine_class->default_cpus;
 +
      smp_parse(qemu_opts_find(qemu_find_opts("smp-opts"), NULL));
 -    machine_class->max_cpus = machine_class->max_cpus ?: 1; /* Default to UP */
 +    /* sanity-check smp_cpus and max_cpus against machine_class */
 +    if (smp_cpus < machine_class->min_cpus) {
 +        error_report("Invalid SMP CPUs %d. The min CPUs "
 +                     "supported by machine '%s' is %d", smp_cpus,
 +                     machine_class->name, machine_class->min_cpus);
 +        exit(1);
 +    }
      if (max_cpus > machine_class->max_cpus) {
          error_report("Invalid SMP CPUs %d. The max CPUs "
                       "supported by machine '%s' is %d", max_cpus,
 --
-.7.4
+.43.0

-[Qemu-devel] [PULL 9/9] accel/tcg/translate-all: expand cpu_restore_state addr check
+[PULL 16/17] target/arm: Simplify pstate_sm check in sve_access_check
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-We are still seeing signals during translation time when we walk over
+In StreamingMode, fp_access_checked is handled already.
-a page protection boundary. This expands the check to ensure the host
+We cannot fall through to fp_access_check lest we fall
-PC is inside the code generation buffer. The original suggestion was
+foul of the double-check assertion.
 to check versus tcg_ctx.code_gen_ptr but as we now segment the
 translation buffer we have to settle for just a general check for
 being inside.
-I've also fixed up the declaration to make it clear it can deal with
+Cc: qemu-stable@nongnu.org
-invalid addresses. A later patch will fix up the call sites.
+Fixes: 285b1d5fcef ("target/arm: Handle SME in sve_access_check")
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Message-id: 20250307190415.982049-3-richard.henderson@linaro.org
-Reported-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Laurent Vivier <laurent@vivier.eu>
+[PMM: move declaration of 'ret' to top of block]
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20171108153245.20740-2-alex.bennee@linaro.org
 Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
 Cc: Richard Henderson <rth@twiddle.net>
 Tested-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/exec/exec-all.h   | 11 ++++++++++
+ target/arm/tcg/translate-a64.c | 22 +++++++++++-----------
- accel/tcg/translate-all.c | 52 ++++++++++++++++++++++++++---------------------
+file changed, 11 insertions(+), 11 deletions(-)
 files changed, 40 insertions(+), 23 deletions(-)
-diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
+diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/exec-all.h
+--- a/target/arm/tcg/translate-a64.c
-+++ b/include/exec/exec-all.h
++++ b/target/arm/tcg/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
+@@ -XXX,XX +XXX,XX @@ static int fp_access_check_vector_hsd(DisasContext *s, bool is_q, MemOp esz)
-                           target_ulong *data);
+ bool sve_access_check(DisasContext *s)
+ {
- void cpu_gen_init(void);
+     if (s->pstate_sm || !dc_isar_feature(aa64_sve, s)) {
 +        bool ret;
 +
-+/**
+         assert(dc_isar_feature(aa64_sme, s));
-+ * cpu_restore_state:
+-        if (!sme_sm_enabled_check(s)) {
-+ * @cpu: the vCPU state is to be restore to
+-            goto fail_exit;
-+ * @searched_pc: the host PC the fault occurred at
+-        }
-+ * @return: true if state was restored, false otherwise
+-    } else if (s->sve_excp_el) {
-+ *
++        ret = sme_sm_enabled_check(s);
-+ * Attempt to restore the state for a fault occurring in translated
++        s->sve_access_checked = (ret ? 1 : -1);
-+ * code. If the searched_pc is not in translated code no state is
++        return ret;
-+ * restored and the function returns false.
++    }
-+ */
++    if (s->sve_excp_el) {
- bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc);
++        /* Assert that we only raise one exception per instruction. */
++        assert(!s->sve_access_checked);
- void QEMU_NORETURN cpu_loop_exit_noexc(CPUState *cpu);
+         gen_exception_insn_el(s, 0, EXCP_UDEF,
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
+                               syn_sve_access_trap(), s->sve_excp_el);
-index XXXXXXX..XXXXXXX 100644
+-        goto fail_exit;
---- a/accel/tcg/translate-all.c
++        s->sve_access_checked = -1;
-+++ b/accel/tcg/translate-all.c
++        return false;
-@@ -XXX,XX +XXX,XX @@ static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
+     }
-     return 0;
+     s->sve_access_checked = 1;
      return fp_access_check(s);
 -
 - fail_exit:
 -    /* Assert that we only raise one exception per instruction. */
 -    assert(!s->sve_access_checked);
 -    s->sve_access_checked = -1;
 -    return false;
  }
--bool cpu_restore_state(CPUState *cpu, uintptr_t retaddr)
+ /*
 +bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
  {
      TranslationBlock *tb;
      bool r = false;
 +    uintptr_t check_offset;
 -    /* A retaddr of zero is invalid so we really shouldn't have ended
 -     * up here. The target code has likely forgotten to check retaddr
 -     * != 0 before attempting to restore state. We return early to
 -     * avoid blowing up on a recursive tb_lock(). The target must have
 -     * previously survived a failed cpu_restore_state because
 -     * tb_find_pc(0) would have failed anyway. It still should be
 -     * fixed though.
 +    /* The host_pc has to be in the region of current code buffer. If
 +     * it is not we will not be able to resolve it here. The two cases
 +     * where host_pc will not be correct are:
 +     *
 +     *  - fault during translation (instruction fetch)
 +     *  - fault from helper (not using GETPC() macro)
 +     *
 +     * Either way we need return early to avoid blowing up on a
 +     * recursive tb_lock() as we can't resolve it here.
 +     *
 +     * We are using unsigned arithmetic so if host_pc <
 +     * tcg_init_ctx.code_gen_buffer check_offset will wrap to way
 +     * above the code_gen_buffer_size
       */
 -
 -    if (!retaddr) {
 -        return r;
 -    }
 -
 -    tb_lock();
 -    tb = tb_find_pc(retaddr);
 -    if (tb) {
 -        cpu_restore_state_from_tb(cpu, tb, retaddr);
 -        if (tb->cflags & CF_NOCACHE) {
 -            /* one-shot translation, invalidate it immediately */
 -            tb_phys_invalidate(tb, -1);
 -            tb_remove(tb);
 +    check_offset = host_pc - (uintptr_t) tcg_init_ctx.code_gen_buffer;
 +
 +    if (check_offset < tcg_init_ctx.code_gen_buffer_size) {
 +        tb_lock();
 +        tb = tb_find_pc(host_pc);
 +        if (tb) {
 +            cpu_restore_state_from_tb(cpu, tb, host_pc);
 +            if (tb->cflags & CF_NOCACHE) {
 +                /* one-shot translation, invalidate it immediately */
 +                tb_phys_invalidate(tb, -1);
 +                tb_remove(tb);
 +            }
 +            r = true;
          }
 -        r = true;
 +        tb_unlock();
      }
 -    tb_unlock();
      return r;
  }
 --
-.7.4
+.43.0

-[Qemu-devel] [PULL 7/9] xlnx-zcu102: Specify the max number of CPUs for the EP108
+[PULL 17/17] meson.build: Set RUST_BACKTRACE for all tests
-From: "Emilio G. Cota" <cota@braap.org>
+We want to capture potential Rust backtraces on panics in our test
 logs, which isn't Rust's default behaviour.  Set RUST_BACKTRACE=1 in
 the add_test_setup environments, so that all our tests get run with
 this environment variable set.
-Just like the zcu102, the ep108 can instantiate several CPUs.
+This makes the setting of that variable in the gitlab CI template
 redundant, so we can remove it.
-Signed-off-by: Emilio G. Cota <cota@braap.org>
-Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
-Message-id: 1510343626-25861-5-git-send-email-cota@braap.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Message-id: 20250310102950.3752908-1-peter.maydell@linaro.org
 ---
- hw/arm/xlnx-zcu102.c | 1 +
+ meson.build                         | 9 ++++++---
-file changed, 1 insertion(+)
+ .gitlab-ci.d/buildtest-template.yml | 1 -
 files changed, 6 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
+diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-zcu102.c
+--- a/meson.build
-+++ b/hw/arm/xlnx-zcu102.c
++++ b/meson.build
-@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
+@@ -XXX,XX +XXX,XX @@ project('qemu', ['c'], meson_version: '>=1.5.0',
-     mc->block_default_type = IF_IDE;
-     mc->units_per_default_bus = 1;
+ meson.add_devenv({ 'MESON_BUILD_ROOT' : meson.project_build_root() })
-     mc->ignore_memory_transaction_failures = true;
-+    mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
+-add_test_setup('quick', exclude_suites: ['slow', 'thorough'], is_default: true)
- }
+-add_test_setup('slow', exclude_suites: ['thorough'], env: ['G_TEST_SLOW=1', 'SPEED=slow'])
+-add_test_setup('thorough', env: ['G_TEST_SLOW=1', 'SPEED=thorough'])
- static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
++add_test_setup('quick', exclude_suites: ['slow', 'thorough'], is_default: true,
 +               env: ['RUST_BACKTRACE=1'])
 +add_test_setup('slow', exclude_suites: ['thorough'],
 +               env: ['G_TEST_SLOW=1', 'SPEED=slow', 'RUST_BACKTRACE=1'])
 +add_test_setup('thorough',
 +               env: ['G_TEST_SLOW=1', 'SPEED=thorough', 'RUST_BACKTRACE=1'])
  meson.add_postconf_script(find_program('scripts/symlink-install-tree.py'))
 diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
 index XXXXXXX..XXXXXXX 100644
 --- a/.gitlab-ci.d/buildtest-template.yml
 +++ b/.gitlab-ci.d/buildtest-template.yml
@@ -XXX,XX +XXX,XX @@
    stage: test
    image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
    script:
 -    - export RUST_BACKTRACE=1
      - source scripts/ci/gitlab-ci-section
      - section_start buildenv "Setting up to run tests"
      - scripts/git-submodule.sh update roms/SLOF
 --
-.7.4
+.43.0

ARM bugfixes for rc1...

The following changes since commit f291910db61b5812e68f1e76afb3ade41d567bea:

Merge remote-tracking branch 'remotes/ericb/tags/pull-nbd-2017-11-09' into staging (2017-11-13 13:13:12 +0000)

are available in the git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20171113

for you to fetch changes up to d25f2a72272b9ffe0d06710d6217d1169bc2cc7d:

accel/tcg/translate-all: expand cpu_restore_state addr check (2017-11-13 13:55:27 +0000)

----------------------------------------------------------------
target-arm queue:
 * translate-a64.c: silence gcc5 warning
 * highbank: validate register offset before access
 * MAINTAINERS: Add entries for Smartfusion2
 * accel/tcg/translate-all: expand cpu_restore_state addr check
   (so usermode insn aborts don't crash with an assertion failure)
 * fix TCG initialization of some Arm boards by allowing them
   to specify min/default number of CPUs to create

----------------------------------------------------------------
Alex Bennée (1):
      accel/tcg/translate-all: expand cpu_restore_state addr check

Alistair Francis (2):
      xlnx-zynqmp: Properly support the smp command line option
      xlnx-zcu102: Add an info message deprecating the EP108

Emilio G. Cota (4):
      arm/translate-a64: mark path as unreachable to eliminate warning
      qom: move CPUClass.tcg_initialize to a global
      xlnx-zcu102: Specify the max number of CPUs for the EP108
      hw: add .min_cpus and .default_cpus fields to machine_class

Prasad J Pandit (1):
      highbank: validate register offset before access

Subbaraya Sundeep (1):
      MAINTAINERS: Add entries for Smartfusion2

From: "Emilio G. Cota" <cota@braap.org>

Fixes the following warning when compiling with gcc 5.4.0 with -O1
optimizations and --enable-debug:

target/arm/translate-a64.c: In function ‘aarch64_tr_translate_insn’:
target/arm/translate-a64.c:2361:8: error: ‘post_index’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
     if (!post_index) {
        ^
target/arm/translate-a64.c:2307:10: note: ‘post_index’ was declared here
     bool post_index;
          ^
target/arm/translate-a64.c:2386:8: error: ‘writeback’ may be used uninitialized in this function [-Werror=maybe-uninitialized]
     if (writeback) {
        ^
target/arm/translate-a64.c:2308:10: note: ‘writeback’ was declared here
     bool writeback;
          ^

Note that idx comes from selecting 2 bits, and therefore its value
can be at most 3.

Signed-off-by: Emilio G. Cota <cota@braap.org>
Acked-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1510087611-1851-1-git-send-email-cota@braap.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_ldst_reg_imm9(DisasContext *s, uint32_t insn,
         post_index = false;
         writeback = true;
         break;
+    default:
+        g_assert_not_reached();
     }
 
     if (rn == 31) {
-- 
2.7.4

From: Prasad J Pandit <pjp@fedoraproject.org>

An 'offset' parameter sent to highbank register r/w functions
could be greater than number(NUM_REGS=0x200) of hb registers,
leading to an OOB access issue. Add check to avoid it.

Reported-by: Moguofang (Dennis mo) <moguofang@huawei.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Message-id: 20171113062658.9697-1-ppandit@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/highbank.c | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

diff --git a/hw/arm/highbank.c b/hw/arm/highbank.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/highbank.c
+++ b/hw/arm/highbank.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/ide/ahci.h"
 #include "hw/cpu/a9mpcore.h"
 #include "hw/cpu/a15mpcore.h"
+#include "qemu/log.h"
 
 #define SMP_BOOT_ADDR           0x100
 #define SMP_BOOT_REG            0x40
@@ -XXX,XX +XXX,XX @@ static void hb_regs_write(void *opaque, hwaddr offset,
         }
     }
 
-    regs[offset/4] = value;
+    if (offset / 4 >= NUM_REGS) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                  "highbank: bad write offset 0x%" HWADDR_PRIx "\n", offset);
+        return;
+    }
+    regs[offset / 4] = value;
 }
 
 static uint64_t hb_regs_read(void *opaque, hwaddr offset,
                              unsigned size)
 {
+    uint32_t value;
     uint32_t *regs = opaque;
-    uint32_t value = regs[offset/4];
+
+    if (offset / 4 >= NUM_REGS) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                  "highbank: bad read offset 0x%" HWADDR_PRIx "\n", offset);
+        return 0;
+    }
+    value = regs[offset / 4];
 
     if ((offset == 0x100) || (offset == 0x108) || (offset == 0x10C)) {
         value |= 0x30000000;
-- 
2.7.4

From: Subbaraya Sundeep <sundeep.lkml@gmail.com>

Voluntarily add myself as maintainer for Smartfusion2

Signed-off-by: Subbaraya Sundeep <sundeep.lkml@gmail.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1510552520-3566-1-git-send-email-sundeep.lkml@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 MAINTAINERS | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Alistair Francis <alistair@alistair23.me>
 S: Maintained
 F: hw/arm/netduino2.c
 
+SmartFusion2
+M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+S: Maintained
+F: hw/arm/msf2-soc.c
+F: hw/misc/msf2-sysreg.c
+F: hw/timer/mss-timer.c
+F: hw/ssi/mss-spi.c
+F: include/hw/arm/msf2-soc.h
+F: include/hw/misc/msf2-sysreg.h
+F: include/hw/timer/mss-timer.h
+F: include/hw/ssi/mss-spi.h
+
+Emcraft M2S-FG484
+M: Subbaraya Sundeep <sundeep.lkml@gmail.com>
+S: Maintained
+F: hw/arm/msf2-som.c
+
 CRIS Machines
 -------------
 Axis Dev88
-- 
2.7.4

From: "Emilio G. Cota" <cota@braap.org>

55c3cee ("qom: Introduce CPUClass.tcg_initialize", 2017-10-24)
introduces a per-CPUClass bool that we check so that the target CPU
is initialized for TCG only once. This works well except when
we end up creating more than one CPUClass, in which case we end
up incorrectly initializing TCG more than once, i.e. once for
each CPUClass.

This can be replicated with:
  $ aarch64-softmmu/qemu-system-aarch64 -machine xlnx-zcu102 -smp 6 \
      -global driver=xlnx,,zynqmp,property=has_rpu,value=on
In this case the class name of the "RPUs" is prefixed by "cortex-r5-",
whereas the "regular" CPUs are prefixed by "cortex-a53-". This
results in two CPUClass instances being created.

Fix it by introducing a static variable, so that only the first
target CPU being initialized will initialize the target-dependent
part of TCG, regardless of CPUClass instances.

Fixes: 55c3ceef61fcf06fc98ddc752b7cce788ce7680b
Signed-off-by: Emilio G. Cota <cota@braap.org>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Alistair Francis <alistair.francis@xilinx.com>
Message-id: 1510343626-25861-2-git-send-email-cota@braap.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/qom/cpu.h | 1 -
 exec.c            | 5 +++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/qom/cpu.h b/include/qom/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qom/cpu.h
+++ b/include/qom/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUClass {
     /* Keep non-pointer data at the end to minimize holes.  */
     int gdb_num_core_regs;
     bool gdb_stop_before_watchpoint;
-    bool tcg_initialized;
 } CPUClass;
 
 #ifdef HOST_WORDS_BIGENDIAN
diff --git a/exec.c b/exec.c
index XXXXXXX..XXXXXXX 100644
--- a/exec.c
+++ b/exec.c
@@ -XXX,XX +XXX,XX @@ void cpu_exec_initfn(CPUState *cpu)
 void cpu_exec_realizefn(CPUState *cpu, Error **errp)
 {
     CPUClass *cc = CPU_GET_CLASS(cpu);
+    static bool tcg_target_initialized;
 
     cpu_list_add(cpu);
 
-    if (tcg_enabled() && !cc->tcg_initialized) {
-        cc->tcg_initialized = true;
+    if (tcg_enabled() && !tcg_target_initialized) {
+        tcg_target_initialized = true;
         cc->tcg_initialize();
     }
 
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

Allow the -smp command line option to control the number of CPUs we
create.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Emilio G. Cota <cota@braap.org>
Tested-by: Emilio G. Cota <cota@braap.org>
Message-id: 1510343626-25861-3-git-send-email-cota@braap.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c |  3 ++-
 hw/arm/xlnx-zynqmp.c | 26 ++++++++++++++++----------
 2 files changed, 18 insertions(+), 11 deletions(-)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
 {
     MachineClass *mc = MACHINE_CLASS(oc);
 
-    mc->desc = "Xilinx ZynqMP ZCU102 board";
+    mc->desc = "Xilinx ZynqMP ZCU102 board with 4xA53s and 2xR5s based on " \
+               "the value of smp";
     mc->init = xlnx_zcu102_init;
     mc->block_default_type = IF_IDE;
     mc->units_per_default_bus = 1;
diff --git a/hw/arm/xlnx-zynqmp.c b/hw/arm/xlnx-zynqmp.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zynqmp.c
+++ b/hw/arm/xlnx-zynqmp.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_create_rpu(XlnxZynqMPState *s, const char *boot_cpu,
 {
     Error *err = NULL;
     int i;
+    int num_rpus = MIN(smp_cpus - XLNX_ZYNQMP_NUM_APU_CPUS, XLNX_ZYNQMP_NUM_RPU_CPUS);
 
-    for (i = 0; i < XLNX_ZYNQMP_NUM_RPU_CPUS; i++) {
+    for (i = 0; i < num_rpus; i++) {
         char *name;
 
         object_initialize(&s->rpu_cpu[i], sizeof(s->rpu_cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_init(Object *obj)
 {
     XlnxZynqMPState *s = XLNX_ZYNQMP(obj);
     int i;
+    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
 
-    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
+    for (i = 0; i < num_apus; i++) {
         object_initialize(&s->apu_cpu[i], sizeof(s->apu_cpu[i]),
                           "cortex-a53-" TYPE_ARM_CPU);
         object_property_add_child(obj, "apu-cpu[*]", OBJECT(&s->apu_cpu[i]),
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     MemoryRegion *system_memory = get_system_memory();
     uint8_t i;
     uint64_t ram_size;
+    int num_apus = MIN(smp_cpus, XLNX_ZYNQMP_NUM_APU_CPUS);
     const char *boot_cpu = s->boot_cpu ? s->boot_cpu : "apu-cpu[0]";
     ram_addr_t ddr_low_size, ddr_high_size;
     qemu_irq gic_spi[GIC_NUM_SPI_INTR];
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
 
     qdev_prop_set_uint32(DEVICE(&s->gic), "num-irq", GIC_NUM_SPI_INTR + 32);
     qdev_prop_set_uint32(DEVICE(&s->gic), "revision", 2);
-    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", XLNX_ZYNQMP_NUM_APU_CPUS);
+    qdev_prop_set_uint32(DEVICE(&s->gic), "num-cpu", num_apus);
 
     /* Realize APUs before realizing the GIC. KVM requires this.  */
-    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
+    for (i = 0; i < num_apus; i++) {
         char *name;
 
         object_property_set_int(OBJECT(&s->apu_cpu[i]), QEMU_PSCI_CONDUIT_SMC,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
         }
     }
 
-    for (i = 0; i < XLNX_ZYNQMP_NUM_APU_CPUS; i++) {
+    for (i = 0; i < num_apus; i++) {
         qemu_irq irq;
 
         sysbus_connect_irq(SYS_BUS_DEVICE(&s->gic), i,
@@ -XXX,XX +XXX,XX @@ static void xlnx_zynqmp_realize(DeviceState *dev, Error **errp)
     }
 
     if (s->has_rpu) {
-        xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
-        if (err) {
-            error_propagate(errp, err);
-            return;
-        }
+        info_report("The 'has_rpu' property is no longer required, to use the "
+                    "RPUs just use -smp 6.");
+    }
+
+    xlnx_zynqmp_create_rpu(s, boot_cpu, &err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
     }
 
     if (!s->boot_cpu_ptr) {
-- 
2.7.4

From: Alistair Francis <alistair.francis@xilinx.com>

The EP108 was an early access development board that is no longer used.
Add an info message to convert any users to the ZCU102 instead. On QEMU
they are both identical.

This patch also updated the qemu-doc.texi file to indicate that the
EP108 has been deprecated.

Signed-off-by: Alistair Francis <alistair.francis@xilinx.com>
Reviewed-by: Emilio G. Cota <cota@braap.org>
Message-id: 1510343626-25861-4-git-send-email-cota@braap.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/xlnx-zcu102.c | 3 +++
 qemu-doc.texi        | 7 +++++++
 2 files changed, 10 insertions(+)

diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_init(MachineState *machine)
 {
     XlnxZCU102 *s = EP108_MACHINE(machine);
 
+    info_report("The Xilinx EP108 machine is deprecated, please use the "
+                "ZCU102 machine instead. It has the same features supported.");
+
     xlnx_zynqmp_init(s, machine);
 }
 
diff --git a/qemu-doc.texi b/qemu-doc.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-doc.texi
+++ b/qemu-doc.texi
@@ -XXX,XX +XXX,XX @@ or ``ivshmem-doorbell`` device types.
 The ``spapr-pci-vfio-host-bridge'' device type is replaced by
 the ``spapr-pci-host-bridge'' device type.
 
+@section System emulator machines
+
+@subsection Xilinx EP108 (since 2.11.0)
+
+The ``xlnx-ep108'' machine has been replaced by the ``xlnx-zcu102'' machine.
+The ``xlnx-zcu102'' machine has the same features and capabilites in QEMU.
+
 @node License
 @appendix License
 
-- 
2.7.4

From: "Emilio G. Cota" <cota@braap.org>

max_cpus needs to be an upper bound on the number of vCPUs
initialized; otherwise TCG region initialization breaks.

Some boards initialize a hard-coded number of vCPUs, which is not
captured by the global max_cpus and therefore breaks TCG initialization.
Fix it by adding the .min_cpus field to machine_class.

This commit also changes some user-facing behaviour: we now die if
-smp is below this hard-coded vCPU minimum instead of silently
ignoring the passed -smp value (sometimes announcing this by printing
a warning). However, the introduction of .default_cpus lessens the
likelihood that users will notice this: if -smp isn't set, we now
assign the value in .default_cpus to both smp_cpus and max_cpus. IOW,
if a user does not set -smp, they always get a correct number of vCPUs.

This change fixes 3468b59 ("tcg: enable multiple TCG contexts in
softmmu", 2017-10-24), which broke TCG initialization for some
ARM boards.

Fixes: 3468b59e18b179bc63c7ce934de912dfa9596122
Reported-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@xilinx.com>
Signed-off-by: Emilio G. Cota <cota@braap.org>
Message-id: 1510343626-25861-6-git-send-email-cota@braap.org
Suggested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Emilio G. Cota <cota@braap.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/boards.h     |  5 +++++
 hw/arm/exynos4_boards.c | 12 ++++--------
 hw/arm/raspi.c          |  2 ++
 hw/arm/xlnx-zcu102.c    |  2 ++
 vl.c                    | 21 ++++++++++++++++++---
 5 files changed, 31 insertions(+), 11 deletions(-)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
 /**
  * MachineClass:
+ * @max_cpus: maximum number of CPUs supported. Default: 1
+ * @min_cpus: minimum number of CPUs supported. Default: 1
+ * @default_cpus: number of CPUs instantiated if none are specified. Default: 1
  * @get_hotplug_handler: this function is called during bus-less
  *    device hotplug. If defined it returns pointer to an instance
  *    of HotplugHandler object, which handles hotplug operation
@@ -XXX,XX +XXX,XX @@ struct MachineClass {
     BlockInterfaceType block_default_type;
     int units_per_default_bus;
     int max_cpus;
+    int min_cpus;
+    int default_cpus;
     unsigned int no_serial:1,
         no_parallel:1,
         use_virtcon:1,
diff --git a/hw/arm/exynos4_boards.c b/hw/arm/exynos4_boards.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/exynos4_boards.c
+++ b/hw/arm/exynos4_boards.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "cpu.h"
 #include "sysemu/sysemu.h"
-#include "sysemu/qtest.h"
 #include "hw/sysbus.h"
 #include "net/net.h"
 #include "hw/arm/arm.h"
@@ -XXX,XX +XXX,XX @@ exynos4_boards_init_common(MachineState *machine,
                            Exynos4BoardType board_type)
 {
     Exynos4BoardState *s = g_new(Exynos4BoardState, 1);
-    MachineClass *mc = MACHINE_GET_CLASS(machine);
-
-    if (smp_cpus != EXYNOS4210_NCPUS && !qtest_enabled()) {
-        error_report("%s board supports only %d CPU cores, ignoring smp_cpus"
-                     " value",
-                     mc->name, EXYNOS4210_NCPUS);
-    }
 
     exynos4_board_binfo.ram_size = exynos4_board_ram_size[board_type];
     exynos4_board_binfo.board_id = exynos4_board_id[board_type];
@@ -XXX,XX +XXX,XX @@ static void nuri_class_init(ObjectClass *oc, void *data)
     mc->desc = "Samsung NURI board (Exynos4210)";
     mc->init = nuri_init;
     mc->max_cpus = EXYNOS4210_NCPUS;
+    mc->min_cpus = EXYNOS4210_NCPUS;
+    mc->default_cpus = EXYNOS4210_NCPUS;
     mc->ignore_memory_transaction_failures = true;
 }
 
@@ -XXX,XX +XXX,XX @@ static void smdkc210_class_init(ObjectClass *oc, void *data)
     mc->desc = "Samsung SMDKC210 board (Exynos4210)";
     mc->init = smdkc210_init;
     mc->max_cpus = EXYNOS4210_NCPUS;
+    mc->min_cpus = EXYNOS4210_NCPUS;
+    mc->default_cpus = EXYNOS4210_NCPUS;
     mc->ignore_memory_transaction_failures = true;
 }
 
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->max_cpus = BCM2836_NCPUS;
+    mc->min_cpus = BCM2836_NCPUS;
+    mc->default_cpus = BCM2836_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
     mc->ignore_memory_transaction_failures = true;
 };
diff --git a/hw/arm/xlnx-zcu102.c b/hw/arm/xlnx-zcu102.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-zcu102.c
+++ b/hw/arm/xlnx-zcu102.c
@@ -XXX,XX +XXX,XX @@ static void xlnx_ep108_machine_class_init(ObjectClass *oc, void *data)
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
     mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
+    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
 }
 
 static const TypeInfo xlnx_ep108_machine_init_typeinfo = {
@@ -XXX,XX +XXX,XX @@ static void xlnx_zcu102_machine_class_init(ObjectClass *oc, void *data)
     mc->units_per_default_bus = 1;
     mc->ignore_memory_transaction_failures = true;
     mc->max_cpus = XLNX_ZYNQMP_NUM_APU_CPUS + XLNX_ZYNQMP_NUM_RPU_CPUS;
+    mc->default_cpus = XLNX_ZYNQMP_NUM_APU_CPUS;
 }
 
 static const TypeInfo xlnx_zcu102_machine_init_typeinfo = {
diff --git a/vl.c b/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/vl.c
+++ b/vl.c
@@ -XXX,XX +XXX,XX @@ Chardev *virtcon_hds[MAX_VIRTIO_CONSOLES];
 Chardev *sclp_hds[MAX_SCLP_CONSOLES];
 int win2k_install_hack = 0;
 int singlestep = 0;
-int smp_cpus = 1;
-unsigned int max_cpus = 1;
+int smp_cpus;
+unsigned int max_cpus;
 int smp_cores = 1;
 int smp_threads = 1;
 int acpi_enabled = 1;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv, char **envp)
         exit(0);
     }
 
+    /* machine_class: default to UP */
+    machine_class->max_cpus = machine_class->max_cpus ?: 1;
+    machine_class->min_cpus = machine_class->min_cpus ?: 1;
+    machine_class->default_cpus = machine_class->default_cpus ?: 1;
+
+    /* default to machine_class->default_cpus */
+    smp_cpus = machine_class->default_cpus;
+    max_cpus = machine_class->default_cpus;
+
     smp_parse(qemu_opts_find(qemu_find_opts("smp-opts"), NULL));
 
-    machine_class->max_cpus = machine_class->max_cpus ?: 1; /* Default to UP */
+    /* sanity-check smp_cpus and max_cpus against machine_class */
+    if (smp_cpus < machine_class->min_cpus) {
+        error_report("Invalid SMP CPUs %d. The min CPUs "
+                     "supported by machine '%s' is %d", smp_cpus,
+                     machine_class->name, machine_class->min_cpus);
+        exit(1);
+    }
     if (max_cpus > machine_class->max_cpus) {
         error_report("Invalid SMP CPUs %d. The max CPUs "
                      "supported by machine '%s' is %d", max_cpus,
-- 
2.7.4

From: Alex Bennée <alex.bennee@linaro.org>

We are still seeing signals during translation time when we walk over
a page protection boundary. This expands the check to ensure the host
PC is inside the code generation buffer. The original suggestion was
to check versus tcg_ctx.code_gen_ptr but as we now segment the
translation buffer we have to settle for just a general check for
being inside.

I've also fixed up the declaration to make it clear it can deal with
invalid addresses. A later patch will fix up the call sites.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reported-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Laurent Vivier <laurent@vivier.eu>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20171108153245.20740-2-alex.bennee@linaro.org
Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Cc: Richard Henderson <rth@twiddle.net>
Tested-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/exec/exec-all.h   | 11 ++++++++++
 accel/tcg/translate-all.c | 52 ++++++++++++++++++++++++++---------------------
 2 files changed, 40 insertions(+), 23 deletions(-)

diff --git a/include/exec/exec-all.h b/include/exec/exec-all.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/exec-all.h
+++ b/include/exec/exec-all.h
@@ -XXX,XX +XXX,XX @@ void restore_state_to_opc(CPUArchState *env, struct TranslationBlock *tb,
                           target_ulong *data);
 
 void cpu_gen_init(void);
+
+/**
+ * cpu_restore_state:
+ * @cpu: the vCPU state is to be restore to
+ * @searched_pc: the host PC the fault occurred at
+ * @return: true if state was restored, false otherwise
+ *
+ * Attempt to restore the state for a fault occurring in translated
+ * code. If the searched_pc is not in translated code no state is
+ * restored and the function returns false.
+ */
 bool cpu_restore_state(CPUState *cpu, uintptr_t searched_pc);
 
 void QEMU_NORETURN cpu_loop_exit_noexc(CPUState *cpu);
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ static int cpu_restore_state_from_tb(CPUState *cpu, TranslationBlock *tb,
     return 0;
 }
 
-bool cpu_restore_state(CPUState *cpu, uintptr_t retaddr)
+bool cpu_restore_state(CPUState *cpu, uintptr_t host_pc)
 {
     TranslationBlock *tb;
     bool r = false;
+    uintptr_t check_offset;
 
-    /* A retaddr of zero is invalid so we really shouldn't have ended
-     * up here. The target code has likely forgotten to check retaddr
-     * != 0 before attempting to restore state. We return early to
-     * avoid blowing up on a recursive tb_lock(). The target must have
-     * previously survived a failed cpu_restore_state because
-     * tb_find_pc(0) would have failed anyway. It still should be
-     * fixed though.
+    /* The host_pc has to be in the region of current code buffer. If
+     * it is not we will not be able to resolve it here. The two cases
+     * where host_pc will not be correct are:
+     *
+     *  - fault during translation (instruction fetch)
+     *  - fault from helper (not using GETPC() macro)
+     *
+     * Either way we need return early to avoid blowing up on a
+     * recursive tb_lock() as we can't resolve it here.
+     *
+     * We are using unsigned arithmetic so if host_pc <
+     * tcg_init_ctx.code_gen_buffer check_offset will wrap to way
+     * above the code_gen_buffer_size
      */
-
-    if (!retaddr) {
-        return r;
-    }
-
-    tb_lock();
-    tb = tb_find_pc(retaddr);
-    if (tb) {
-        cpu_restore_state_from_tb(cpu, tb, retaddr);
-        if (tb->cflags & CF_NOCACHE) {
-            /* one-shot translation, invalidate it immediately */
-            tb_phys_invalidate(tb, -1);
-            tb_remove(tb);
+    check_offset = host_pc - (uintptr_t) tcg_init_ctx.code_gen_buffer;
+
+    if (check_offset < tcg_init_ctx.code_gen_buffer_size) {
+        tb_lock();
+        tb = tb_find_pc(host_pc);
+        if (tb) {
+            cpu_restore_state_from_tb(cpu, tb, host_pc);
+            if (tb->cflags & CF_NOCACHE) {
+                /* one-shot translation, invalidate it immediately */
+                tb_phys_invalidate(tb, -1);
+                tb_remove(tb);
+            }
+            r = true;
         }
-        r = true;
+        tb_unlock();
     }
-    tb_unlock();
 
     return r;
 }
-- 
2.7.4

Hi; here's a target-arm pullreq for rc0; these are all bugfixes
and similar minor stuff.

thanks
-- PMM

The following changes since commit 0462a32b4f63b2448b4a196381138afd50719dc4:

Merge tag 'for-upstream' of https://repo.or.cz/qemu/kevin into staging (2025-03-14 09:31:13 +0800)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20250314-1

for you to fetch changes up to a019e15edfd62beae1e2f6adc0fa7415ba20b14c:

meson.build: Set RUST_BACKTRACE for all tests (2025-03-14 12:54:33 +0000)

----------------------------------------------------------------
target-arm queue:
 * Correctly handle corner cases of guest attempting an exception
   return to AArch32 when target EL is AArch64 only
 * MAINTAINERS: Fix status for Arm boards I "maintain"
 * tests/functional: Bump up arm_replay timeout
 * Revert "hw/char/pl011: Warn when using disabled receiver"
 * util/cacheflush: Make first DSB unconditional on aarch64
 * target/arm: Fix SVE/SME access check logic
 * meson.build: Set RUST_BACKTRACE for all tests

----------------------------------------------------------------
Joe Komlodi (1):
      util/cacheflush: Make first DSB unconditional on aarch64

Paolo Bonzini (1):
      Revert "hw/char/pl011: Warn when using disabled receiver"

Peter Maydell (13):
      target/arm: Move A32_BANKED_REG_{GET,SET} macros to cpregs.h
      target/arm: Un-inline access_secure_reg()
      linux-user/aarch64: Remove unused get/put_user macros
      linux-user/arm: Remove unused get_put_user macros
      target/arm: Move arm_cpu_data_is_big_endian() etc to internals.h
      target/arm: Move arm_current_el() and arm_el_is_aa64() to internals.h
      target/arm: SCR_EL3.RW should be treated as 1 if EL2 doesn't support AArch32
      target/arm: HCR_EL2.RW should be RAO/WI if EL1 doesn't support AArch32
      target/arm: Add cpu local variable to exception_return helper
      target/arm: Forbid return to AArch32 when CPU is AArch64-only
      MAINTAINERS: Fix status for Arm boards I "maintain"
      tests/functional: Bump up arm_replay timeout
      meson.build: Set RUST_BACKTRACE for all tests

Richard Henderson (2):
      target/arm: Make DisasContext.{fp, sve}_access_checked tristate
      target/arm: Simplify pstate_sm check in sve_access_check

The A32_BANKED_REG_{GET,SET} macros are only used inside target/arm;
move their definitions to cpregs.h. There's no need to have them
defined in all the code that includes cpu.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpregs.h | 28 ++++++++++++++++++++++++++++
 target/arm/cpu.h    | 27 ---------------------------
 2 files changed, 28 insertions(+), 27 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_cpreg_traps_in_nv(const ARMCPRegInfo *ri)
     return ri->opc1 == 4 || ri->opc1 == 5;
 }
 
+/* Macros for accessing a specified CP register bank */
+#define A32_BANKED_REG_GET(_env, _regname, _secure)                     \
+    ((_secure) ? (_env)->cp15._regname##_s : (_env)->cp15._regname##_ns)
+
+#define A32_BANKED_REG_SET(_env, _regname, _secure, _val)       \
+    do {                                                        \
+        if (_secure) {                                          \
+            (_env)->cp15._regname##_s = (_val);                 \
+        } else {                                                \
+            (_env)->cp15._regname##_ns = (_val);                \
+        }                                                       \
+    } while (0)
+
+/*
+ * Macros for automatically accessing a specific CP register bank depending on
+ * the current secure state of the system.  These macros are not intended for
+ * supporting instruction translation reads/writes as these are dependent
+ * solely on the SCR.NS bit and not the mode.
+ */
+#define A32_BANKED_CURRENT_REG_GET(_env, _regname)                          \
+    A32_BANKED_REG_GET((_env), _regname,                                    \
+                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)))
+
+#define A32_BANKED_CURRENT_REG_SET(_env, _regname, _val)                    \
+    A32_BANKED_REG_SET((_env), _regname,                                    \
+                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)), \
+                       (_val))
+
 #endif /* TARGET_ARM_CPREGS_H */
diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool access_secure_reg(CPUARMState *env)
     return ret;
 }
 
-/* Macros for accessing a specified CP register bank */
-#define A32_BANKED_REG_GET(_env, _regname, _secure)    \
-    ((_secure) ? (_env)->cp15._regname##_s : (_env)->cp15._regname##_ns)
-
-#define A32_BANKED_REG_SET(_env, _regname, _secure, _val)   \
-    do {                                                \
-        if (_secure) {                                   \
-            (_env)->cp15._regname##_s = (_val);            \
-        } else {                                        \
-            (_env)->cp15._regname##_ns = (_val);           \
-        }                                               \
-    } while (0)
-
-/* Macros for automatically accessing a specific CP register bank depending on
- * the current secure state of the system.  These macros are not intended for
- * supporting instruction translation reads/writes as these are dependent
- * solely on the SCR.NS bit and not the mode.
- */
-#define A32_BANKED_CURRENT_REG_GET(_env, _regname)        \
-    A32_BANKED_REG_GET((_env), _regname,                \
-                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)))
-
-#define A32_BANKED_CURRENT_REG_SET(_env, _regname, _val)                       \
-    A32_BANKED_REG_SET((_env), _regname,                                    \
-                       (arm_is_secure(_env) && !arm_el_is_aa64((_env), 3)), \
-                       (_val))
-
 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
                                  uint32_t cur_el, bool secure);
 
-- 
2.43.0

We would like to move arm_el_is_aa64() to internals.h; however, it is
used by access_secure_reg().  Make that function not be inline, so
that it can stay in cpu.h.

access_secure_reg() is used only in two places:
 * in hflags.c
 * in the user-mode arm emulators, to decide whether to store
   the TLS value in the secure or non-secure banked field

The second of these is not on a super-hot path that would care about
the inlining (and incidentally will always use the NS banked field
because our user-mode CPUs never set ARM_FEATURE_EL3); put the
definition of access_secure_reg() in hflags.c, near its only use
inside target/arm.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h        | 12 +++---------
 target/arm/tcg/hflags.c |  9 +++++++++
 2 files changed, 12 insertions(+), 9 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
     return aa64;
 }
 
-/* Function for determining whether guest cp register reads and writes should
+/*
+ * Function for determining whether guest cp register reads and writes should
  * access the secure or non-secure bank of a cp register.  When EL3 is
  * operating in AArch32 state, the NS-bit determines whether the secure
  * instance of a cp register should be used. When EL3 is AArch64 (or if
  * it doesn't exist at all) then there is no register banking, and all
  * accesses are to the non-secure version.
  */
-static inline bool access_secure_reg(CPUARMState *env)
-{
-    bool ret = (arm_feature(env, ARM_FEATURE_EL3) &&
-                !arm_el_is_aa64(env, 3) &&
-                !(env->cp15.scr_el3 & SCR_NS));
-
-    return ret;
-}
+bool access_secure_reg(CPUARMState *env);
 
 uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
                                  uint32_t cur_el, bool secure);
diff --git a/target/arm/tcg/hflags.c b/target/arm/tcg/hflags.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/hflags.c
+++ b/target/arm/tcg/hflags.c
@@ -XXX,XX +XXX,XX @@ static bool aprofile_require_alignment(CPUARMState *env, int el, uint64_t sctlr)
 #endif
 }
 
+bool access_secure_reg(CPUARMState *env)
+{
+    bool ret = (arm_feature(env, ARM_FEATURE_EL3) &&
+                !arm_el_is_aa64(env, 3) &&
+                !(env->cp15.scr_el3 & SCR_NS));
+
+    return ret;
+}
+
 static CPUARMTBFlags rebuild_hflags_common(CPUARMState *env, int fp_el,
                                            ARMMMUIdx mmu_idx,
                                            CPUARMTBFlags flags)
-- 
2.43.0

At the top of linux-user/aarch64/cpu_loop.c we define a set of
macros for reading and writing data and code words, but we never
use these macros. Delete them.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/aarch64/cpu_loop.c | 48 -----------------------------------
 1 file changed, 48 deletions(-)

diff --git a/linux-user/aarch64/cpu_loop.c b/linux-user/aarch64/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/aarch64/cpu_loop.c
+++ b/linux-user/aarch64/cpu_loop.c
@@ -XXX,XX +XXX,XX @@
 #include "target/arm/syndrome.h"
 #include "target/arm/cpu-features.h"
 
-#define get_user_code_u32(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u32((x), (gaddr));       \
-        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
-            (x) = bswap32(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define get_user_code_u16(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
-        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
-            (x) = bswap16(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define get_user_data_u32(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u32((x), (gaddr));       \
-        if (!__r && arm_cpu_bswap_data(env)) {          \
-            (x) = bswap32(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define get_user_data_u16(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
-        if (!__r && arm_cpu_bswap_data(env)) {          \
-            (x) = bswap16(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define put_user_data_u32(x, gaddr, env)                \
-    ({ typeof(x) __x = (x);                             \
-        if (arm_cpu_bswap_data(env)) {                  \
-            __x = bswap32(__x);                         \
-        }                                               \
-        put_user_u32(__x, (gaddr));                     \
-    })
-
-#define put_user_data_u16(x, gaddr, env)                \
-    ({ typeof(x) __x = (x);                             \
-        if (arm_cpu_bswap_data(env)) {                  \
-            __x = bswap16(__x);                         \
-        }                                               \
-        put_user_u16(__x, (gaddr));                     \
-    })
-
 /* AArch64 main loop */
 void cpu_loop(CPUARMState *env)
 {
-- 
2.43.0

In linux-user/arm/cpu_loop.c we define a full set of get/put
macros for both code and data (since the endianness handling
is different between the two). However the only one we actually
use is get_user_code_u32(). Remove the rest.

We leave a comment noting how data-side accesses should be handled
for big-endian, because that's a subtle point and we just removed the
macros that were effectively documenting it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 linux-user/arm/cpu_loop.c | 43 ++++-----------------------------------
 1 file changed, 4 insertions(+), 39 deletions(-)

diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -XXX,XX +XXX,XX @@
         __r;                                            \
     })
 
-#define get_user_code_u16(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
-        if (!__r && bswap_code(arm_sctlr_b(env))) {     \
-            (x) = bswap16(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define get_user_data_u32(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u32((x), (gaddr));       \
-        if (!__r && arm_cpu_bswap_data(env)) {          \
-            (x) = bswap32(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define get_user_data_u16(x, gaddr, env)                \
-    ({ abi_long __r = get_user_u16((x), (gaddr));       \
-        if (!__r && arm_cpu_bswap_data(env)) {          \
-            (x) = bswap16(x);                           \
-        }                                               \
-        __r;                                            \
-    })
-
-#define put_user_data_u32(x, gaddr, env)                \
-    ({ typeof(x) __x = (x);                             \
-        if (arm_cpu_bswap_data(env)) {                  \
-            __x = bswap32(__x);                         \
-        }                                               \
-        put_user_u32(__x, (gaddr));                     \
-    })
-
-#define put_user_data_u16(x, gaddr, env)                \
-    ({ typeof(x) __x = (x);                             \
-        if (arm_cpu_bswap_data(env)) {                  \
-            __x = bswap16(__x);                         \
-        }                                               \
-        put_user_u16(__x, (gaddr));                     \
-    })
+/*
+ * Note that if we need to do data accesses here, they should do a
+ * bswap if arm_cpu_bswap_data() returns true.
+ */
 
 /*
  * Similar to code in accel/tcg/user-exec.c, but outside the execution loop.
-- 
2.43.0

The arm_cpu_data_is_big_endian() and related functions are now used
only in target/arm; they can be moved to internals.h.

The motivation here is that we would like to move arm_current_el()
to internals.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h       | 48 ------------------------------------------
 target/arm/internals.h | 48 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 48 insertions(+), 48 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ static inline bool arm_sctlr_b(CPUARMState *env)
 
 uint64_t arm_sctlr(CPUARMState *env, int el);
 
-static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
-                                                  bool sctlr_b)
-{
-#ifdef CONFIG_USER_ONLY
-    /*
-     * In system mode, BE32 is modelled in line with the
-     * architecture (as word-invariant big-endianness), where loads
-     * and stores are done little endian but from addresses which
-     * are adjusted by XORing with the appropriate constant. So the
-     * endianness to use for the raw data access is not affected by
-     * SCTLR.B.
-     * In user mode, however, we model BE32 as byte-invariant
-     * big-endianness (because user-only code cannot tell the
-     * difference), and so we need to use a data access endianness
-     * that depends on SCTLR.B.
-     */
-    if (sctlr_b) {
-        return true;
-    }
-#endif
-    /* In 32bit endianness is determined by looking at CPSR's E bit */
-    return env->uncached_cpsr & CPSR_E;
-}
-
-static inline bool arm_cpu_data_is_big_endian_a64(int el, uint64_t sctlr)
-{
-    return sctlr & (el ? SCTLR_EE : SCTLR_E0E);
-}
-
-/* Return true if the processor is in big-endian mode. */
-static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
-{
-    if (!is_a64(env)) {
-        return arm_cpu_data_is_big_endian_a32(env, arm_sctlr_b(env));
-    } else {
-        int cur_el = arm_current_el(env);
-        uint64_t sctlr = arm_sctlr(env, cur_el);
-        return arm_cpu_data_is_big_endian_a64(cur_el, sctlr);
-    }
-}
-
 #include "exec/cpu-all.h"
 
 /*
@@ -XXX,XX +XXX,XX @@ static inline bool bswap_code(bool sctlr_b)
 #endif
 }
 
-#ifdef CONFIG_USER_ONLY
-static inline bool arm_cpu_bswap_data(CPUARMState *env)
-{
-    return TARGET_BIG_ENDIAN ^ arm_cpu_data_is_big_endian(env);
-}
-#endif
-
 void cpu_get_tb_cpu_state(CPUARMState *env, vaddr *pc,
                           uint64_t *cs_base, uint32_t *flags);
 
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
     return arm_rmode_to_sf_map[rmode];
 }
 
+static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
+                                                  bool sctlr_b)
+{
+#ifdef CONFIG_USER_ONLY
+    /*
+     * In system mode, BE32 is modelled in line with the
+     * architecture (as word-invariant big-endianness), where loads
+     * and stores are done little endian but from addresses which
+     * are adjusted by XORing with the appropriate constant. So the
+     * endianness to use for the raw data access is not affected by
+     * SCTLR.B.
+     * In user mode, however, we model BE32 as byte-invariant
+     * big-endianness (because user-only code cannot tell the
+     * difference), and so we need to use a data access endianness
+     * that depends on SCTLR.B.
+     */
+    if (sctlr_b) {
+        return true;
+    }
+#endif
+    /* In 32bit endianness is determined by looking at CPSR's E bit */
+    return env->uncached_cpsr & CPSR_E;
+}
+
+static inline bool arm_cpu_data_is_big_endian_a64(int el, uint64_t sctlr)
+{
+    return sctlr & (el ? SCTLR_EE : SCTLR_E0E);
+}
+
+/* Return true if the processor is in big-endian mode. */
+static inline bool arm_cpu_data_is_big_endian(CPUARMState *env)
+{
+    if (!is_a64(env)) {
+        return arm_cpu_data_is_big_endian_a32(env, arm_sctlr_b(env));
+    } else {
+        int cur_el = arm_current_el(env);
+        uint64_t sctlr = arm_sctlr(env, cur_el);
+        return arm_cpu_data_is_big_endian_a64(cur_el, sctlr);
+    }
+}
+
+#ifdef CONFIG_USER_ONLY
+static inline bool arm_cpu_bswap_data(CPUARMState *env)
+{
+    return TARGET_BIG_ENDIAN ^ arm_cpu_data_is_big_endian(env);
+}
+#endif
+
 static inline void aarch64_save_sp(CPUARMState *env, int el)
 {
     if (env->pstate & PSTATE_SP) {
-- 
2.43.0

The functions arm_current_el() and arm_el_is_aa64() are used only in
target/arm and in hw/intc/arm_gicv3_cpuif.c.  They're functions that
query internal state of the CPU.  Move them out of cpu.h and into
internals.h.

This means we need to include internals.h in arm_gicv3_cpuif.c, but
this is justifiable because that file is implementing the GICv3 CPU
interface, which really is part of the CPU proper; we just ended up
implementing it in code in hw/intc/ for historical reasons.

The motivation for this move is that we'd like to change
arm_el_is_aa64() to add a condition that uses cpu_isar_feature();
but we don't want to include cpu-features.h in cpu.h.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/cpu.h          | 66 --------------------------------------
 target/arm/internals.h    | 67 +++++++++++++++++++++++++++++++++++++++
 hw/intc/arm_gicv3_cpuif.c |  1 +
 target/arm/arch_dump.c    |  1 +
 4 files changed, 69 insertions(+), 66 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ uint64_t arm_hcr_el2_eff_secstate(CPUARMState *env, ARMSecuritySpace space);
 uint64_t arm_hcr_el2_eff(CPUARMState *env);
 uint64_t arm_hcrx_el2_eff(CPUARMState *env);
 
-/* Return true if the specified exception level is running in AArch64 state. */
-static inline bool arm_el_is_aa64(CPUARMState *env, int el)
-{
-    /* This isn't valid for EL0 (if we're in EL0, is_a64() is what you want,
-     * and if we're not in EL0 then the state of EL0 isn't well defined.)
-     */
-    assert(el >= 1 && el <= 3);
-    bool aa64 = arm_feature(env, ARM_FEATURE_AARCH64);
-
-    /* The highest exception level is always at the maximum supported
-     * register width, and then lower levels have a register width controlled
-     * by bits in the SCR or HCR registers.
-     */
-    if (el == 3) {
-        return aa64;
-    }
-
-    if (arm_feature(env, ARM_FEATURE_EL3) &&
-        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
-        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
-    }
-
-    if (el == 2) {
-        return aa64;
-    }
-
-    if (arm_is_el2_enabled(env)) {
-        aa64 = aa64 && (env->cp15.hcr_el2 & HCR_RW);
-    }
-
-    return aa64;
-}
-
 /*
  * Function for determining whether guest cp register reads and writes should
  * access the secure or non-secure bank of a cp register.  When EL3 is
@@ -XXX,XX +XXX,XX @@ static inline bool arm_v7m_is_handler_mode(CPUARMState *env)
     return env->v7m.exception != 0;
 }
 
-/* Return the current Exception Level (as per ARMv8; note that this differs
- * from the ARMv7 Privilege Level).
- */
-static inline int arm_current_el(CPUARMState *env)
-{
-    if (arm_feature(env, ARM_FEATURE_M)) {
-        return arm_v7m_is_handler_mode(env) ||
-            !(env->v7m.control[env->v7m.secure] & 1);
-    }
-
-    if (is_a64(env)) {
-        return extract32(env->pstate, 2, 2);
-    }
-
-    switch (env->uncached_cpsr & 0x1f) {
-    case ARM_CPU_MODE_USR:
-        return 0;
-    case ARM_CPU_MODE_HYP:
-        return 2;
-    case ARM_CPU_MODE_MON:
-        return 3;
-    default:
-        if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
-            /* If EL3 is 32-bit then all secure privileged modes run in
-             * EL3
-             */
-            return 3;
-        }
-
-        return 1;
-    }
-}
-
 /**
  * write_list_to_cpustate
  * @cpu: ARMCPU
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
     return arm_rmode_to_sf_map[rmode];
 }
 
+/* Return true if the specified exception level is running in AArch64 state. */
+static inline bool arm_el_is_aa64(CPUARMState *env, int el)
+{
+    /*
+     * This isn't valid for EL0 (if we're in EL0, is_a64() is what you want,
+     * and if we're not in EL0 then the state of EL0 isn't well defined.)
+     */
+    assert(el >= 1 && el <= 3);
+    bool aa64 = arm_feature(env, ARM_FEATURE_AARCH64);
+
+    /*
+     * The highest exception level is always at the maximum supported
+     * register width, and then lower levels have a register width controlled
+     * by bits in the SCR or HCR registers.
+     */
+    if (el == 3) {
+        return aa64;
+    }
+
+    if (arm_feature(env, ARM_FEATURE_EL3) &&
+        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
+        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
+    }
+
+    if (el == 2) {
+        return aa64;
+    }
+
+    if (arm_is_el2_enabled(env)) {
+        aa64 = aa64 && (env->cp15.hcr_el2 & HCR_RW);
+    }
+
+    return aa64;
+}
+
+/*
+ * Return the current Exception Level (as per ARMv8; note that this differs
+ * from the ARMv7 Privilege Level).
+ */
+static inline int arm_current_el(CPUARMState *env)
+{
+    if (arm_feature(env, ARM_FEATURE_M)) {
+        return arm_v7m_is_handler_mode(env) ||
+            !(env->v7m.control[env->v7m.secure] & 1);
+    }
+
+    if (is_a64(env)) {
+        return extract32(env->pstate, 2, 2);
+    }
+
+    switch (env->uncached_cpsr & 0x1f) {
+    case ARM_CPU_MODE_USR:
+        return 0;
+    case ARM_CPU_MODE_HYP:
+        return 2;
+    case ARM_CPU_MODE_MON:
+        return 3;
+    default:
+        if (arm_is_secure(env) && !arm_el_is_aa64(env, 3)) {
+            /* If EL3 is 32-bit then all secure privileged modes run in EL3 */
+            return 3;
+        }
+
+        return 1;
+    }
+}
+
 static inline bool arm_cpu_data_is_big_endian_a32(CPUARMState *env,
                                                   bool sctlr_b)
 {
diff --git a/hw/intc/arm_gicv3_cpuif.c b/hw/intc/arm_gicv3_cpuif.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/arm_gicv3_cpuif.c
+++ b/hw/intc/arm_gicv3_cpuif.c
@@ -XXX,XX +XXX,XX @@
 #include "cpu.h"
 #include "target/arm/cpregs.h"
 #include "target/arm/cpu-features.h"
+#include "target/arm/internals.h"
 #include "system/tcg.h"
 #include "system/qtest.h"
 
diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@
 #include "elf.h"
 #include "system/dump.h"
 #include "cpu-features.h"
+#include "internals.h"
 
 /* struct user_pt_regs from arch/arm64/include/uapi/asm/ptrace.h */
 struct aarch64_user_regs {
-- 
2.43.0

The definition of SCR_EL3.RW says that its effective value is 1 if:
 - EL2 is implemented and does not support AArch32, and SCR_EL3.NS is 1
 - the effective value of SCR_EL3.{EEL2,NS} is {1,0} (i.e. we are
   Secure and Secure EL2 is disabled)

We implement the second of these in arm_el_is_aa64(), but forgot the
first.

Provide a new function arm_scr_rw_eff() to return the effective
value of SCR_EL3.RW, and use it in arm_el_is_aa64() and the other
places that currently look directly at the bit value.

(scr_write() enforces that the RW bit is RAO/WI if neither EL1 nor
EL2 have AArch32 support, but if EL1 does but EL2 does not then the
bit must still be writeable.)

This will mean that if code at EL3 attempts to perform an exception
return to AArch32 EL2 when EL2 is AArch64-only we will correctly
handle this as an illegal exception return: it will be caught by the
"return to an EL which is configured for a different register width"
check in HELPER(exception_return).

We do already have some CPU types which don't implement AArch32
above EL0, so this is technically a bug; it doesn't seem worth
backporting to stable because no sensible guest code will be
deliberately attempting to set the RW bit to a value corresponding
to an unimplemented execution state and then checking that we
did the right thing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/internals.h | 26 +++++++++++++++++++++++---
 target/arm/helper.c    |  4 ++--
 2 files changed, 25 insertions(+), 5 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline FloatRoundMode arm_rmode_to_sf(ARMFPRounding rmode)
     return arm_rmode_to_sf_map[rmode];
 }
 
+/* Return the effective value of SCR_EL3.RW */
+static inline bool arm_scr_rw_eff(CPUARMState *env)
+{
+    /*
+     * SCR_EL3.RW has an effective value of 1 if:
+     *  - we are NS and EL2 is implemented but doesn't support AArch32
+     *  - we are S and EL2 is enabled (in which case it must be AArch64)
+     */
+    ARMCPU *cpu = env_archcpu(env);
+
+    if (env->cp15.scr_el3 & SCR_RW) {
+        return true;
+    }
+    if (env->cp15.scr_el3 & SCR_NS) {
+        return arm_feature(env, ARM_FEATURE_EL2) &&
+            !cpu_isar_feature(aa64_aa32_el2, cpu);
+    } else {
+        return env->cp15.scr_el3 & SCR_EEL2;
+    }
+}
+
 /* Return true if the specified exception level is running in AArch64 state. */
 static inline bool arm_el_is_aa64(CPUARMState *env, int el)
 {
@@ -XXX,XX +XXX,XX @@ static inline bool arm_el_is_aa64(CPUARMState *env, int el)
         return aa64;
     }
 
-    if (arm_feature(env, ARM_FEATURE_EL3) &&
-        ((env->cp15.scr_el3 & SCR_NS) || !(env->cp15.scr_el3 & SCR_EEL2))) {
-        aa64 = aa64 && (env->cp15.scr_el3 & SCR_RW);
+    if (arm_feature(env, ARM_FEATURE_EL3)) {
+        aa64 = aa64 && arm_scr_rw_eff(env);
     }
 
     if (el == 2) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t arm_phys_excp_target_el(CPUState *cs, uint32_t excp_idx,
     uint64_t hcr_el2;
 
     if (arm_feature(env, ARM_FEATURE_EL3)) {
-        rw = ((env->cp15.scr_el3 & SCR_RW) == SCR_RW);
+        rw = arm_scr_rw_eff(env);
     } else {
         /*
          * Either EL2 is the highest EL (and so the EL2 register width
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
 
         switch (new_el) {
         case 3:
-            is_aa64 = (env->cp15.scr_el3 & SCR_RW) != 0;
+            is_aa64 = arm_scr_rw_eff(env);
             break;
         case 2:
             hcr = arm_hcr_el2_eff(env);
-- 
2.43.0

When EL1 doesn't support AArch32, the HCR_EL2.RW bit is supposed to
be RAO/WI. Enforce the RAO/WI behaviour.

Note that we handle "reset value should honour RES1 bits" in the same
way that SCR_EL3 does, via a reset function.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/helper.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void do_hcr_write(CPUARMState *env, uint64_t value, uint64_t valid_mask)
     /* Clear RES0 bits.  */
     value &= valid_mask;
 
+    /* RW is RAO/WI if EL1 is AArch64 only */
+    if (!cpu_isar_feature(aa64_aa32_el1, cpu)) {
+        value |= HCR_RW;
+    }
+
     /*
      * These bits change the MMU setup:
      * HCR_VM enables stage 2 translation
@@ -XXX,XX +XXX,XX @@ static void hcr_writelow(CPUARMState *env, const ARMCPRegInfo *ri,
     do_hcr_write(env, value, MAKE_64BIT_MASK(32, 32));
 }
 
+static void hcr_reset(CPUARMState *env, const ARMCPRegInfo *ri)
+{
+    /* hcr_write will set the RES1 bits on an AArch64-only CPU */
+    hcr_write(env, ri, 0);
+}
+
 /*
  * Return the effective value of HCR_EL2, at the given security state.
  * Bits that are not included here:
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo el2_cp_reginfo[] = {
       .opc0 = 3, .opc1 = 4, .crn = 1, .crm = 1, .opc2 = 0,
       .access = PL2_RW, .fieldoffset = offsetof(CPUARMState, cp15.hcr_el2),
       .nv2_redirect_offset = 0x78,
+      .resetfn = hcr_reset,
       .writefn = hcr_write, .raw_writefn = raw_write },
     { .name = "HCR", .state = ARM_CP_STATE_AA32,
       .type = ARM_CP_ALIAS | ARM_CP_IO,
-- 
2.43.0

We already call env_archcpu() multiple times within the
exception_return helper function, and we're about to want to
add another use of the ARMCPU pointer. Add a local variable
cpu so we can call env_archcpu() just once.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-a64.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ static void cpsr_write_from_spsr_elx(CPUARMState *env,
 
 void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
 {
+    ARMCPU *cpu = env_archcpu(env);
     int cur_el = arm_current_el(env);
     unsigned int spsr_idx = aarch64_banked_spsr_index(cur_el);
     uint32_t spsr = env->banked_spsr[spsr_idx];
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
     }
 
     bql_lock();
-    arm_call_pre_el_change_hook(env_archcpu(env));
+    arm_call_pre_el_change_hook(cpu);
     bql_unlock();
 
     if (!return_to_aa64) {
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
         int tbii;
 
         env->aarch64 = true;
-        spsr &= aarch64_pstate_valid_mask(&env_archcpu(env)->isar);
+        spsr &= aarch64_pstate_valid_mask(&cpu->isar);
         pstate_write(env, spsr);
         if (!arm_singlestep_active(env)) {
             env->pstate &= ~PSTATE_SS;
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
     aarch64_sve_change_el(env, cur_el, new_el, return_to_aa64);
 
     bql_lock();
-    arm_call_el_change_hook(env_archcpu(env));
+    arm_call_el_change_hook(cpu);
     bql_unlock();
 
     return;
-- 
2.43.0

In the Arm ARM, rule R_TYTWB states that returning to AArch32
is an illegal exception return if:
 * AArch32 is not supported at any exception level
 * the target EL is configured for AArch64 via SCR_EL3.RW
   or HCR_EL2.RW or via CPU state at reset

We check the second of these, but not the first (which can only be
relevant for the case of a return to EL0, because if AArch32 is not
supported at one of the higher ELs then the RW bits will have an
effective value of 1 and the the "configured for AArch64" condition
will hold also).

Add the missing condition. Although this is technically a bug
(because we have one AArch64-only CPU: a64fx) it isn't worth
backporting to stable because no sensible guest code will
deliberately try to return to a nonexistent execution state
to check that it gets an illegal exception return.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
---
 target/arm/tcg/helper-a64.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/target/arm/tcg/helper-a64.c b/target/arm/tcg/helper-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/helper-a64.c
+++ b/target/arm/tcg/helper-a64.c
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_return)(CPUARMState *env, uint64_t new_pc)
         goto illegal_return;
     }
 
+    if (!return_to_aa64 && !cpu_isar_feature(aa64_aa32, cpu)) {
+        /* Return to AArch32 when CPU is AArch64-only */
+        goto illegal_return;
+    }
+
     if (new_el == 1 && (arm_hcr_el2_eff(env) & HCR_TGE)) {
         goto illegal_return;
     }
-- 
2.43.0

I'm down as the only listed maintainer for quite a lot of Arm SoC and
board types.  In some cases this is only as the "maintainer of last
resort" and I'm not in practice doing anything beyond patch review
and the odd bit of tidyup.

Move these entries in MAINTAINERS from "Maintained" to "Odd Fixes",
to better represent reality.  Entries for other boards and SoCs where
I do more actively care (or where there is a listed co-maintainer)
remain as they are.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250307152838.3226398-1-peter.maydell@linaro.org
---
 MAINTAINERS | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/kzm.rst
 Integrator CP
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/integratorcp.c
 F: hw/misc/arm_integrator_debug.c
 F: include/hw/misc/arm_integrator_debug.h
@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/mps2.rst
 Musca
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/musca.c
 F: docs/system/arm/musca.rst
 
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_aarch64_raspi4.py
 Real View
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/realview*
 F: hw/cpu/realview_mpcore.c
 F: hw/intc/realview_gic.c
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_arm_collie.py
 Stellaris
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/stellaris*
 F: hw/display/ssd03*
 F: include/hw/input/gamepad.h
@@ -XXX,XX +XXX,XX @@ F: docs/system/arm/stm32.rst
 Versatile Express
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/arm/vexpress.c
 F: hw/display/sii9022.c
 F: docs/system/arm/vexpress.rst
@@ -XXX,XX +XXX,XX @@ F: tests/functional/test_arm_vexpress.py
 Versatile PB
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/versatile*
 F: hw/i2c/arm_sbcon_i2c.c
 F: include/hw/i2c/arm_sbcon_i2c.h
@@ -XXX,XX +XXX,XX @@ F: include/hw/hyperv/vmbus*.h
 OMAP
 M: Peter Maydell <peter.maydell@linaro.org>
 L: qemu-arm@nongnu.org
-S: Maintained
+S: Odd Fixes
 F: hw/*/omap*
 F: include/hw/arm/omap.h
 F: docs/system/arm/sx1.rst
-- 
2.43.0

From: Paolo Bonzini <pbonzini@redhat.com>

The guest does not control whether characters are sent on the UART.
Sending them before the guest happens to boot will now result in a
"guest error" log entry that is only because of timing, even if the
guest _would_ later setup the receiver correctly.

This reverts the bulk of commit abf2b6a028670bd2890bb3aee7e103fe53e4b0df,
and instead adds a comment about why we don't check the enable bits.

Cc: Philippe Mathieu-Daudé <philmd@linaro.org>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20250311153717.206129-1-pbonzini@redhat.com
[PMM: expanded comment]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/pl011.c | 19 ++++++++++---------
 1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/hw/char/pl011.c b/hw/char/pl011.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/pl011.c
+++ b/hw/char/pl011.c
@@ -XXX,XX +XXX,XX @@ static int pl011_can_receive(void *opaque)
     unsigned fifo_depth = pl011_get_fifo_depth(s);
     unsigned fifo_available = fifo_depth - s->read_count;
 
-    if (!(s->cr & CR_UARTEN)) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "PL011 receiving data on disabled UART\n");
-    }
-    if (!(s->cr & CR_RXE)) {
-        qemu_log_mask(LOG_GUEST_ERROR,
-                      "PL011 receiving data on disabled RX UART\n");
-    }
-    trace_pl011_can_receive(s->lcr, s->read_count, fifo_depth, fifo_available);
+    /*
+     * In theory we should check the UART and RX enable bits here and
+     * return 0 if they are not set (so the guest can't receive data
+     * until you have enabled the UART). In practice we suspect there
+     * is at least some guest code out there which has been tested only
+     * on QEMU and which never bothers to enable the UART because we
+     * historically never enforced that. So we effectively keep the
+     * UART continuously enabled regardless of the enable bits.
+     */
 
+    trace_pl011_can_receive(s->lcr, s->read_count, fifo_depth, fifo_available);
     return fifo_available;
 }
 
-- 
2.43.0

From: Joe Komlodi <komlodi@google.com>

On ARM hosts with CTR_EL0.DIC and CTR_EL0.IDC set, this would only cause
an ISB to be executed during cache maintenance, which could lead to QEMU
executing TBs containing garbage instructions.

This seems to be because the ISB finishes executing instructions and
flushes the pipeline, but the ISB doesn't guarantee that writes from the
executed instructions are committed. If a small enough TB is created, it's
possible that the writes setting up the TB aren't committed by the time the
TB is executed.

This function is intended to be a port of the gcc implementation
(https://github.com/gcc-mirror/gcc/blob/85b46d0795ac76bc192cb8f88b646a647acf98c1/libgcc/config/aarch64/sync-cache.c#L67)
which makes the first DSB unconditional, so we can fix the synchronization
issue by doing that as well.

Cc: qemu-stable@nongnu.org
Fixes: 664a79735e4deb1 ("util: Specialize flush_idcache_range for aarch64")
Signed-off-by: Joe Komlodi <komlodi@google.com>
Message-id: 20250310203622.1827940-2-komlodi@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 util/cacheflush.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/util/cacheflush.c b/util/cacheflush.c
index XXXXXXX..XXXXXXX 100644
--- a/util/cacheflush.c
+++ b/util/cacheflush.c
@@ -XXX,XX +XXX,XX @@ void flush_idcache_range(uintptr_t rx, uintptr_t rw, size_t len)
         for (p = rw & -dcache_lsize; p < rw + len; p += dcache_lsize) {
             asm volatile("dc\tcvau, %0" : : "r" (p) : "memory");
         }
-        asm volatile("dsb\tish" : : : "memory");
     }
 
+    /* DSB unconditionally to ensure any outstanding writes are committed. */
+    asm volatile("dsb\tish" : : : "memory");
+
     /*
      * If CTR_EL0.DIC is enabled, Instruction cache cleaning to the Point
      * of Unification is not required for instruction to data coherence.
-- 
2.43.0

From: Richard Henderson <richard.henderson@linaro.org>

The check for fp_excp_el in assert_fp_access_checked is
incorrect.  For SME, with StreamingMode enabled, the access
is really against the streaming mode vectors, and access
to the normal fp registers is allowed to be disabled.
C.f. sme_enabled_check.

Convert sve_access_checked to match, even though we don't
currently check the exception state.

Cc: qemu-stable@nongnu.org
Fixes: 3d74825f4d6 ("target/arm: Add SME enablement checks")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250307190415.982049-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.h |  2 +-
 target/arm/tcg/translate.h     | 10 +++++++---
 target/arm/tcg/translate-a64.c | 17 +++++++++--------
 3 files changed, 17 insertions(+), 12 deletions(-)

diff --git a/target/arm/tcg/translate-a64.h b/target/arm/tcg/translate-a64.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.h
+++ b/target/arm/tcg/translate-a64.h
@@ -XXX,XX +XXX,XX @@ TCGv_i64 gen_mte_checkN(DisasContext *s, TCGv_i64 addr, bool is_write,
 static inline void assert_fp_access_checked(DisasContext *s)
 {
 #ifdef CONFIG_DEBUG_TCG
-    if (unlikely(!s->fp_access_checked || s->fp_excp_el)) {
+    if (unlikely(s->fp_access_checked <= 0)) {
         fprintf(stderr, "target-arm: FP access check missing for "
                 "instruction 0x%08x\n", s->insn);
         abort();
diff --git a/target/arm/tcg/translate.h b/target/arm/tcg/translate.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate.h
+++ b/target/arm/tcg/translate.h
@@ -XXX,XX +XXX,XX @@ typedef struct DisasContext {
     bool aarch64;
     bool thumb;
     bool lse2;
-    /* Because unallocated encodings generate different exception syndrome
+    /*
+     * Because unallocated encodings generate different exception syndrome
      * information from traps due to FP being disabled, we can't do a single
      * "is fp access disabled" check at a high level in the decode tree.
      * To help in catching bugs where the access check was forgotten in some
      * code path, we set this flag when the access check is done, and assert
      * that it is set at the point where we actually touch the FP regs.
+     *   0: not checked,
+     *   1: checked, access ok
+     *  -1: checked, access denied
      */
-    bool fp_access_checked;
-    bool sve_access_checked;
+    int8_t fp_access_checked;
+    int8_t sve_access_checked;
     /* ARMv8 single-step state (this is distinct from the QEMU gdbstub
      * single-step support).
      */
diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static bool fp_access_check_only(DisasContext *s)
 {
     if (s->fp_excp_el) {
         assert(!s->fp_access_checked);
-        s->fp_access_checked = true;
+        s->fp_access_checked = -1;
 
         gen_exception_insn_el(s, 0, EXCP_UDEF,
                               syn_fp_access_trap(1, 0xe, false, 0),
                               s->fp_excp_el);
         return false;
     }
-    s->fp_access_checked = true;
+    s->fp_access_checked = 1;
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ bool sve_access_check(DisasContext *s)
                               syn_sve_access_trap(), s->sve_excp_el);
         goto fail_exit;
     }
-    s->sve_access_checked = true;
+    s->sve_access_checked = 1;
     return fp_access_check(s);
 
  fail_exit:
     /* Assert that we only raise one exception per instruction. */
     assert(!s->sve_access_checked);
-    s->sve_access_checked = true;
+    s->sve_access_checked = -1;
     return false;
 }
 
@@ -XXX,XX +XXX,XX @@ bool sme_enabled_check(DisasContext *s)
      * sme_excp_el by itself for cpregs access checks.
      */
     if (!s->fp_excp_el || s->sme_excp_el < s->fp_excp_el) {
-        s->fp_access_checked = true;
-        return sme_access_check(s);
+        bool ret = sme_access_check(s);
+        s->fp_access_checked = (ret ? 1 : -1);
+        return ret;
     }
     return fp_access_check_only(s);
 }
@@ -XXX,XX +XXX,XX @@ static void aarch64_tr_translate_insn(DisasContextBase *dcbase, CPUState *cpu)
     s->insn = insn;
     s->base.pc_next = pc + 4;
 
-    s->fp_access_checked = false;
-    s->sve_access_checked = false;
+    s->fp_access_checked = 0;
+    s->sve_access_checked = 0;
 
     if (s->pstate_il) {
         /*
-- 
2.43.0

From: Richard Henderson <richard.henderson@linaro.org>

In StreamingMode, fp_access_checked is handled already.
We cannot fall through to fp_access_check lest we fall
foul of the double-check assertion.

Cc: qemu-stable@nongnu.org
Fixes: 285b1d5fcef ("target/arm: Handle SME in sve_access_check")
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20250307190415.982049-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: move declaration of 'ret' to top of block]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/tcg/translate-a64.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/target/arm/tcg/translate-a64.c b/target/arm/tcg/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/tcg/translate-a64.c
+++ b/target/arm/tcg/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static int fp_access_check_vector_hsd(DisasContext *s, bool is_q, MemOp esz)
 bool sve_access_check(DisasContext *s)
 {
     if (s->pstate_sm || !dc_isar_feature(aa64_sve, s)) {
+        bool ret;
+
         assert(dc_isar_feature(aa64_sme, s));
-        if (!sme_sm_enabled_check(s)) {
-            goto fail_exit;
-        }
-    } else if (s->sve_excp_el) {
+        ret = sme_sm_enabled_check(s);
+        s->sve_access_checked = (ret ? 1 : -1);
+        return ret;
+    }
+    if (s->sve_excp_el) {
+        /* Assert that we only raise one exception per instruction. */
+        assert(!s->sve_access_checked);
         gen_exception_insn_el(s, 0, EXCP_UDEF,
                               syn_sve_access_trap(), s->sve_excp_el);
-        goto fail_exit;
+        s->sve_access_checked = -1;
+        return false;
     }
     s->sve_access_checked = 1;
     return fp_access_check(s);
-
- fail_exit:
-    /* Assert that we only raise one exception per instruction. */
-    assert(!s->sve_access_checked);
-    s->sve_access_checked = -1;
-    return false;
 }
 
 /*
-- 
2.43.0

We want to capture potential Rust backtraces on panics in our test
logs, which isn't Rust's default behaviour.  Set RUST_BACKTRACE=1 in
the add_test_setup environments, so that all our tests get run with
this environment variable set.

This makes the setting of that variable in the gitlab CI template
redundant, so we can remove it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20250310102950.3752908-1-peter.maydell@linaro.org
---
 meson.build                         | 9 ++++++---
 .gitlab-ci.d/buildtest-template.yml | 1 -
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ project('qemu', ['c'], meson_version: '>=1.5.0',
 
 meson.add_devenv({ 'MESON_BUILD_ROOT' : meson.project_build_root() })
 
-add_test_setup('quick', exclude_suites: ['slow', 'thorough'], is_default: true)
-add_test_setup('slow', exclude_suites: ['thorough'], env: ['G_TEST_SLOW=1', 'SPEED=slow'])
-add_test_setup('thorough', env: ['G_TEST_SLOW=1', 'SPEED=thorough'])
+add_test_setup('quick', exclude_suites: ['slow', 'thorough'], is_default: true,
+               env: ['RUST_BACKTRACE=1'])
+add_test_setup('slow', exclude_suites: ['thorough'],
+               env: ['G_TEST_SLOW=1', 'SPEED=slow', 'RUST_BACKTRACE=1'])
+add_test_setup('thorough',
+               env: ['G_TEST_SLOW=1', 'SPEED=thorough', 'RUST_BACKTRACE=1'])
 
 meson.add_postconf_script(find_program('scripts/symlink-install-tree.py'))
 
diff --git a/.gitlab-ci.d/buildtest-template.yml b/.gitlab-ci.d/buildtest-template.yml
index XXXXXXX..XXXXXXX 100644
--- a/.gitlab-ci.d/buildtest-template.yml
+++ b/.gitlab-ci.d/buildtest-template.yml
@@ -XXX,XX +XXX,XX @@
   stage: test
   image: $CI_REGISTRY_IMAGE/qemu/$IMAGE:$QEMU_CI_CONTAINER_TAG
   script:
-    - export RUST_BACKTRACE=1
     - source scripts/ci/gitlab-ci-section
     - section_start buildenv "Setting up to run tests"
     - scripts/git-submodule.sh update roms/SLOF
-- 
2.43.0