Series comparison

-[Qemu-devel] [PULL 00/11] target-arm queue
+[PULL 0/4] target-arm queue
-Hi; this target-arm pull request has a collection of generally
+Arm patches for rc3 : just a handful of bug fixes.
 fairly minor bugs to sneak in before 3.0 rc0 tomorrow...
 thanks
 -- PMM
-The following changes since commit a98ff0ec2ba3538dd766b349518ee18d03942ed8:
-  Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-3.0-20180709' into staging (2018-07-09 11:00:45 +0100)
+The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:
   Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180709
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126
-for you to fetch changes up to 8fad0a65582c0a6e324580f45516461e9b6aa439:
+for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:
-  hw/net/dp8393x: don't make prom region 'nomigrate' (2018-07-09 14:51:35 +0100)
+  target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/net/dp8393x: don't make prom region 'nomigrate'
+ * handle FTYPE flag correctly in v7M exception return
- * boards.h: Remove doc comment reference to nonexistent function
+   for v7M CPUs with an FPU (v8M CPUs were already correct)
- * hw/sd/omap_mmc: Split 'pseudo-reset' from 'power-on-reset'
+ * versal: Add the CRP as unimplemented
- * target/arm: Fix do_predset for large VL
+ * Fix ISR_EL1 tracking when executing at EL2
- * tcg: Restrict check_size_impl to multiples of the line size
+ * Honor HCR_EL2.TID3 trapping requirements
  * target/arm: Suppress Coverity warning for PRF
  * hw/timer/cmsdk-apb-timer: fix minor corner-case bugs and
    suppress spurious warnings when running Linux's timer driver
  * hw/arm/smmu-common: Fix devfn computation in smmu_iommu_mr
 ----------------------------------------------------------------
-Eric Auger (1):
+Edgar E. Iglesias (1):
-      hw/arm/smmu-common: Fix devfn computation in smmu_iommu_mr
+      hw/arm: versal: Add the CRP as unimplemented
-Guenter Roeck (1):
+Jean-Hugues Deschênes (1):
-      hw/timer/cmsdk-apb-timer: Correctly identify and set one-shot mode
+      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
-Peter Maydell (5):
+Marc Zyngier (2):
-      ptimer: Add TRIGGER_ONLY_ON_DECREMENT policy option
+      target/arm: Fix ISR_EL1 tracking when executing at EL2
-      hw/timer/cmsdk-apb-timer: Correct ptimer policy settings
+      target/arm: Honor HCR_EL2.TID3 trapping requirements
       hw/timer/cmsdk-apb-timer: run or stop timer on writes to RELOAD and VALUE
       boards.h: Remove doc comment reference to nonexistent function
       hw/net/dp8393x: don't make prom region 'nomigrate'
-Philippe Mathieu-Daudé (1):
+ include/hw/arm/xlnx-versal.h |  3 ++
-      hw/sd/omap_mmc: Split 'pseudo-reset' from 'power-on-reset'
+ hw/arm/xlnx-versal.c         |  2 ++
  target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
  target/arm/m_helper.c        |  7 ++--
 files changed, 89 insertions(+), 6 deletions(-)
-Richard Henderson (3):
-      target/arm: Suppress Coverity warning for PRF
-      tcg: Restrict check_size_impl to multiples of the line size
-      target/arm: Fix do_predset for large VL
- include/hw/arm/smmu-common.h |  1 +
- include/hw/boards.h          |  3 +--
- include/hw/ptimer.h          |  9 +++++++++
- hw/arm/smmu-common.c         |  2 +-
- hw/core/ptimer.c             | 22 +++++++++++++++++++++-
- hw/net/dp8393x.c             |  2 +-
- hw/sd/omap_mmc.c             | 14 +++++++++++---
- hw/timer/cmsdk-apb-timer.c   | 20 ++++++++++++++++++--
- target/arm/translate-sve.c   | 14 ++++----------
- tcg/tcg-op-gvec.c            |  7 +++++--
- tests/ptimer-test.c          | 25 +++++++++++++++++++------
-files changed, 91 insertions(+), 28 deletions(-)

-[Qemu-devel] [PULL 01/11] hw/arm/smmu-common: Fix devfn computation in smmu_iommu_mr
+[PULL 1/4] target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
-From: Eric Auger <eric.auger@redhat.com>
+From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>
-smmu_iommu_mr() aims at returning the IOMMUMemoryRegion corresponding
+According to the PushStack() pseudocode in the armv7m RM,
-to a given sid. The function extracts both the PCIe bus number and
+bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
-the devfn to return this data. Current computation of devfn is wrong
+an FPU is present. Current implementation is doing it for
-as it only returns the PCIe function instead of slot | function.
+armv8, but not for armv7. This patch makes the existing
 logic applicable to both code paths.
-Fixes 32cfd7f39e08 ("hw/arm/smmuv3: Cache/invalidate config data")
+Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
 Signed-off-by: Eric Auger <eric.auger@redhat.com>
 Message-id: 1530775623-32399-1-git-send-email-eric.auger@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/smmu-common.h | 1 +
+ target/arm/m_helper.c | 7 +++----
- hw/arm/smmu-common.c         | 2 +-
+file changed, 3 insertions(+), 4 deletions(-)
 files changed, 2 insertions(+), 1 deletion(-)
-diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
+diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/smmu-common.h
+--- a/target/arm/m_helper.c
-+++ b/include/hw/arm/smmu-common.h
++++ b/target/arm/m_helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+         if (env->v7m.secure) {
- #define SMMU_PCI_BUS_MAX      256
+             lr |= R_V7M_EXCRET_S_MASK;
- #define SMMU_PCI_DEVFN_MAX    256
+         }
-+#define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
+-        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
+-            lr |= R_V7M_EXCRET_FTYPE_MASK;
- #define SMMU_MAX_VA_BITS      48
+-        }
+     } else {
-diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
+         lr = R_V7M_EXCRET_RES1_MASK |
-index XXXXXXX..XXXXXXX 100644
+             R_V7M_EXCRET_S_MASK |
---- a/hw/arm/smmu-common.c
+             R_V7M_EXCRET_DCRS_MASK |
-+++ b/hw/arm/smmu-common.c
+-            R_V7M_EXCRET_FTYPE_MASK |
-@@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid)
+             R_V7M_EXCRET_ES_MASK;
-     bus_n = PCI_BUS_NUM(sid);
+         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
-     smmu_bus = smmu_find_smmu_pcibus(s, bus_n);
+             lr |= R_V7M_EXCRET_SPSEL_MASK;
-     if (smmu_bus) {
+         }
--        devfn = sid & 0x7;
+     }
-+        devfn = SMMU_PCI_DEVFN(sid);
++    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-         smmu = smmu_bus->pbdev[devfn];
++        lr |= R_V7M_EXCRET_FTYPE_MASK;
-         if (smmu) {
++    }
-             return &smmu->iommu;
+     if (!arm_v7m_is_handler_mode(env)) {
          lr |= R_V7M_EXCRET_MODE_MASK;
      }
 --
-.17.1
+.20.1

-[Qemu-devel] [PULL 02/11] ptimer: Add TRIGGER_ONLY_ON_DECREMENT policy option
+Deleted patch
-The CMSDK timer behaviour is that an interrupt is triggered when the
-counter counts down from 1 to 0; however one is not triggered if the
-counter is manually set to 0 by a guest write to the counter register.
-Currently ptimer can't handle this; add a policy option to allow
-a ptimer user to request this behaviour.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Guenter Roeck <linux@roeck-us.net>
-Message-id: 20180703171044.9503-2-peter.maydell@linaro.org
----
- include/hw/ptimer.h |  9 +++++++++
- hw/core/ptimer.c    | 22 +++++++++++++++++++++-
- tests/ptimer-test.c | 25 +++++++++++++++++++------
-files changed, 49 insertions(+), 7 deletions(-)
-diff --git a/include/hw/ptimer.h b/include/hw/ptimer.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/ptimer.h
-+++ b/include/hw/ptimer.h
-@@ -XXX,XX +XXX,XX @@
-  * not the one less.  */
- #define PTIMER_POLICY_NO_COUNTER_ROUND_DOWN (1 << 4)
-+/*
-+ * Starting to run with a zero counter, or setting the counter to "0" via
-+ * ptimer_set_count() or ptimer_set_limit() will not trigger the timer
-+ * (though it will cause a reload). Only a counter decrement to "0"
-+ * will cause a trigger. Not compatible with NO_IMMEDIATE_TRIGGER;
-+ * ptimer_init() will assert() that you don't set both.
-+ */
-+#define PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT (1 << 5)
-+
- /* ptimer.c */
- typedef struct ptimer_state ptimer_state;
- typedef void (*ptimer_cb)(void *opaque);
-diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/core/ptimer.c
-+++ b/hw/core/ptimer.c
-@@ -XXX,XX +XXX,XX @@ static void ptimer_reload(ptimer_state *s, int delta_adjust)
-     uint32_t period_frac = s->period_frac;
-     uint64_t period = s->period;
-     uint64_t delta = s->delta;
-+    bool suppress_trigger = false;
--    if (delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)) {
-+    /*
-+     * Note that if delta_adjust is 0 then we must be here because of
-+     * a count register write or timer start, not because of timer expiry.
-+     * In that case the policy might require us to suppress the timer trigger
-+     * that we would otherwise generate for a zero delta.
-+     */
-+    if (delta_adjust == 0 &&
-+        (s->policy_mask & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT)) {
-+        suppress_trigger = true;
-+    }
-+    if (delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)
-+        && !suppress_trigger) {
-         ptimer_trigger(s);
-     }
-@@ -XXX,XX +XXX,XX @@ ptimer_state *ptimer_init(QEMUBH *bh, uint8_t policy_mask)
-     s->bh = bh;
-     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ptimer_tick, s);
-     s->policy_mask = policy_mask;
-+
-+    /*
-+     * These two policies are incompatible -- trigger-on-decrement implies
-+     * a timer trigger when the count becomes 0, but no-immediate-trigger
-+     * implies a trigger when the count stops being 0.
-+     */
-+    assert(!((policy_mask & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT) &&
-+             (policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)));
-     return s;
- }
-diff --git a/tests/ptimer-test.c b/tests/ptimer-test.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/ptimer-test.c
-+++ b/tests/ptimer-test.c
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
-     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-+    bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
-                      no_immediate_reload ? 0 : 10);
--    if (no_immediate_trigger) {
-+    if (no_immediate_trigger || trig_only_on_dec) {
-         g_assert_false(triggered);
-     } else {
-         g_assert_true(triggered);
-@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
-     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
-+    bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
-                      no_immediate_reload ? 0 : 99);
--    if (no_immediate_trigger) {
-+    if (no_immediate_trigger || trig_only_on_dec) {
-         g_assert_false(triggered);
-     } else {
-         g_assert_true(triggered);
-@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
-                      no_immediate_reload ? 0 : 99);
--    if (no_immediate_trigger) {
-+    if (no_immediate_trigger || trig_only_on_dec) {
-         g_assert_false(triggered);
-     } else {
-         g_assert_true(triggered);
-@@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg)
-     ptimer_state *ptimer = ptimer_init(bh, *policy);
-     bool continuous_trigger = (*policy & PTIMER_POLICY_CONTINUOUS_TRIGGER);
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-+    bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg)
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
--    if (no_immediate_trigger) {
-+    if (no_immediate_trigger || trig_only_on_dec) {
-         g_assert_false(triggered);
-     } else {
-         g_assert_true(triggered);
-@@ -XXX,XX +XXX,XX @@ static void check_oneshot_with_load_0(gconstpointer arg)
-     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
-     ptimer_state *ptimer = ptimer_init(bh, *policy);
-     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
-+    bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
-     triggered = false;
-@@ -XXX,XX +XXX,XX @@ static void check_oneshot_with_load_0(gconstpointer arg)
-     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
--    if (no_immediate_trigger) {
-+    if (no_immediate_trigger || trig_only_on_dec) {
-         g_assert_false(triggered);
-     } else {
-         g_assert_true(triggered);
-@@ -XXX,XX +XXX,XX @@ static void add_ptimer_tests(uint8_t policy)
-         g_strlcat(policy_name, "no_counter_rounddown,", 256);
-     }
-+    if (policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT) {
-+        g_strlcat(policy_name, "trigger_only_on_decrement,", 256);
-+    }
-+
-     g_test_add_data_func_full(
-         tmp = g_strdup_printf("/ptimer/set_count policy=%s", policy_name),
-         g_memdup(&policy, 1), check_set_count, g_free);
-@@ -XXX,XX +XXX,XX @@ static void add_ptimer_tests(uint8_t policy)
- static void add_all_ptimer_policies_comb_tests(void)
- {
--    int last_policy = PTIMER_POLICY_NO_COUNTER_ROUND_DOWN;
-+    int last_policy = PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT;
-     int policy = PTIMER_POLICY_DEFAULT;
-     for (; policy < (last_policy << 1); policy++) {
-+        if ((policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT) &&
-+            (policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)) {
-+            /* Incompatible policy flag settings -- don't try to test them */
-+            continue;
-+        }
-         add_ptimer_tests(policy);
-     }
- }
---
-.17.1

-[Qemu-devel] [PULL 03/11] hw/timer/cmsdk-apb-timer: Correct ptimer policy settings
+Deleted patch
-The CMSDK timer interrupt triggers when the counter goes from 1 to 0,
-so we want to trigger immediately, rather than waiting for a
-clock cycle. Drop the incorrect NO_IMMEDIATE_TRIGGER setting.
-We also do not want to get an interrupt if the guest sets the
-counter directly to zero, so use the new TRIGGER_ONLY_ON_DECREMENT
-policy.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Guenter Roeck <linux@roeck-us.net>
-Message-id: 20180703171044.9503-3-peter.maydell@linaro.org
----
- hw/timer/cmsdk-apb-timer.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/cmsdk-apb-timer.c
-+++ b/hw/timer/cmsdk-apb-timer.c
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
-     bh = qemu_bh_new(cmsdk_apb_timer_tick, s);
-     s->timer = ptimer_init(bh,
-                            PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
--                           PTIMER_POLICY_NO_IMMEDIATE_TRIGGER |
-+                           PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
-                            PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
-                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
---
-.17.1

-[Qemu-devel] [PULL 04/11] hw/timer/cmsdk-apb-timer: Correctly identify and set one-shot mode
+[PULL 2/4] hw/arm: versal: Add the CRP as unimplemented
-From: Guenter Roeck <linux@roeck-us.net>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-The CMSDK APB timer is currently always configured as periodic timer.
+Add the CRP as unimplemented thus avoiding bus errors when
-This results in the following messages when trying to boot Linux.
+guests access these registers.
-Timer with delta zero, disabling
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-If the timer limit set with the RELOAD command is 0, the timer
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-needs to be enabled as one-shot timer.
+Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Tested-by: Guenter Roeck <linux@roeck-us.net>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/timer/cmsdk-apb-timer.c | 2 +-
+ include/hw/arm/xlnx-versal.h | 3 +++
-file changed, 1 insertion(+), 1 deletion(-)
+ hw/arm/xlnx-versal.c         | 2 ++
 files changed, 5 insertions(+)
-diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/cmsdk-apb-timer.c
+--- a/include/hw/arm/xlnx-versal.h
-+++ b/hw/timer/cmsdk-apb-timer.c
++++ b/include/hw/arm/xlnx-versal.h
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
+@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
-         }
+ #define MM_IOU_SCNTRS_SIZE          0x10000
-         s->ctrl = value & 0xf;
+ #define MM_FPD_CRF                  0xfd1a0000U
-         if (s->ctrl & R_CTRL_EN_MASK) {
+ #define MM_FPD_CRF_SIZE             0x140000
--            ptimer_run(s->timer, 0);
++
-+            ptimer_run(s->timer, ptimer_get_limit(s->timer) == 0);
++#define MM_PMC_CRP                  0xf1260000U
-         } else {
++#define MM_PMC_CRP_SIZE             0x10000
-             ptimer_stop(s->timer);
+ #endif
-         }
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal.c
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
                          MM_CRL, MM_CRL_SIZE);
      versal_unimp_area(s, "crf", &s->mr_ps,
                          MM_FPD_CRF, MM_FPD_CRF_SIZE);
 +    versal_unimp_area(s, "crp", &s->mr_ps,
 +                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
      versal_unimp_area(s, "iou-scntr", &s->mr_ps,
                          MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
      versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
 --
-.17.1
+.20.1

-[Qemu-devel] [PULL 05/11] hw/timer/cmsdk-apb-timer: run or stop timer on writes to RELOAD and VALUE
+Deleted patch
-If the CMSDK APB timer is set up with a zero RELOAD value
-then it will count down to zero, fire once and then stay
-at zero. From the point of view of the ptimer system, the
-timer is disabled; but the enable bit in the CTRL register
-is still set and if the guest subsequently writes to the
-RELOAD or VALUE registers this should cause the timer to
-start counting down again.
-Add code to the write paths for RELOAD and VALUE so that
-we correctly restart the timer in this situation.
-Conversely, if the new RELOAD and VALUE are both zero,
-we should stop the ptimer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Tested-by: Guenter Roeck <linux@roeck-us.net>
-Message-id: 20180703171044.9503-5-peter.maydell@linaro.org
----
- hw/timer/cmsdk-apb-timer.c | 16 ++++++++++++++++
-file changed, 16 insertions(+)
-diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/timer/cmsdk-apb-timer.c
-+++ b/hw/timer/cmsdk-apb-timer.c
-@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
-         break;
-     case A_RELOAD:
-         /* Writing to reload also sets the current timer value */
-+        if (!value) {
-+            ptimer_stop(s->timer);
-+        }
-         ptimer_set_limit(s->timer, value, 1);
-+        if (value && (s->ctrl & R_CTRL_EN_MASK)) {
-+            /*
-+             * Make sure timer is running (it might have stopped if this
-+             * was an expired one-shot timer)
-+             */
-+            ptimer_run(s->timer, 0);
-+        }
-         break;
-     case A_VALUE:
-+        if (!value && !ptimer_get_limit(s->timer)) {
-+            ptimer_stop(s->timer);
-+        }
-         ptimer_set_count(s->timer, value);
-+        if (value && (s->ctrl & R_CTRL_EN_MASK)) {
-+            ptimer_run(s->timer, ptimer_get_limit(s->timer) == 0);
-+        }
-         break;
-     case A_INTSTATUS:
-         /* Just one bit, which is W1C. */
---
-.17.1

-[Qemu-devel] [PULL 06/11] target/arm: Suppress Coverity warning for PRF
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-These instructions must perform the sve_access_check, but
-since they are implemented as NOPs there is no generated
-code to elide when the access check fails.
-Fixes: Coverity issues 1393780 & 1393779.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-sve.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
-+++ b/target/arm/translate-sve.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_ST1_zpiz(DisasContext *s, arg_ST1_zpiz *a, uint32_t insn)
- static bool trans_PRF(DisasContext *s, arg_PRF *a, uint32_t insn)
- {
-     /* Prefetch is a nop within QEMU.  */
--    sve_access_check(s);
-+    (void)sve_access_check(s);
-     return true;
- }
-@@ -XXX,XX +XXX,XX @@ static bool trans_PRF_rr(DisasContext *s, arg_PRF_rr *a, uint32_t insn)
-         return false;
-     }
-     /* Prefetch is a nop within QEMU.  */
--    sve_access_check(s);
-+    (void)sve_access_check(s);
-     return true;
- }
---
-.17.1

-[Qemu-devel] [PULL 07/11] tcg: Restrict check_size_impl to multiples of the line size
+Deleted patch
-From: Richard Henderson <richard.henderson@linaro.org>
-Normally this is automatic in the size restrictions that are placed
-on vector sizes coming from the implementation.  However, for the
-legitimate size tuple [oprsz=8, maxsz=32], we need to clear the final
-bytes of the vector register.  Without this check, do_dup selects
-TCG_TYPE_V128 and clears only 16 bytes.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180705191929.30773-2-richard.henderson@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tcg/tcg-op-gvec.c | 7 +++++--
-file changed, 5 insertions(+), 2 deletions(-)
-diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
-index XXXXXXX..XXXXXXX 100644
---- a/tcg/tcg-op-gvec.c
-+++ b/tcg/tcg-op-gvec.c
-@@ -XXX,XX +XXX,XX @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
-    in units of LNSZ.  This limits the expansion of inline code.  */
- static inline bool check_size_impl(uint32_t oprsz, uint32_t lnsz)
- {
--    uint32_t lnct = oprsz / lnsz;
--    return lnct >= 1 && lnct <= MAX_UNROLL;
-+    if (oprsz % lnsz == 0) {
-+        uint32_t lnct = oprsz / lnsz;
-+        return lnct >= 1 && lnct <= MAX_UNROLL;
-+    }
-+    return false;
- }
- static void expand_clr(uint32_t dofs, uint32_t maxsz);
---
-.17.1

-[Qemu-devel] [PULL 08/11] target/arm: Fix do_predset for large VL
+[PULL 3/4] target/arm: Fix ISR_EL1 tracking when executing at EL2
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Marc Zyngier <maz@kernel.org>
-Use MAKE_64BIT_MASK instead of open-coding.  Remove an odd
+The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
-vector size check that is unlikely to be more profitable
+ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
-than 3 64-bit integer stores.  Correct the iteration for WORD
+SError interrupts.
 to avoid writing too much data.
-Fixes RISU tests of PTRUE for VL 256.
+Unfortunately, QEMU's implementation only considers the HCR_EL2
 bits, and ignores the current exception level. This means a hypervisor
 trying to look at its own interrupt state actually sees the guest
 state, which is unexpected and breaks KVM as of Linux 5.3.
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Instead, check for the running EL and return the physical bits
-Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
+if not running in a virtualized context.
-Tested-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20180705191929.30773-3-richard.henderson@linaro.org
+Fixes: 636540e9c40b
 Cc: qemu-stable@nongnu.org
 Reported-by: Quentin Perret <qperret@google.com>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Message-id: 20191122135833.28953-1-maz@kernel.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-sve.c | 10 ++--------
+ target/arm/helper.c | 7 +++++--
-file changed, 2 insertions(+), 8 deletions(-)
+file changed, 5 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
+--- a/target/arm/helper.c
-+++ b/target/arm/translate-sve.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool do_predset(DisasContext *s, int esz, int rd, int pat, bool setflag)
+@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-         setsz = numelem << esz;
+     CPUState *cs = env_cpu(env);
-         lastword = word = pred_esz_masks[esz];
+     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
-         if (setsz % 64) {
+     uint64_t ret = 0;
--            lastword &= ~(-1ull << (setsz % 64));
++    bool allow_virt = (arm_current_el(env) == 1 &&
-+            lastword &= MAKE_64BIT_MASK(0, setsz % 64);
++                       (!arm_is_secure_below_el3(env) ||
 +                        (env->cp15.scr_el3 & SCR_EEL2)));
 -    if (hcr_el2 & HCR_IMO) {
 +    if (allow_virt && (hcr_el2 & HCR_IMO)) {
          if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
              ret |= CPSR_I;
          }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
          }
      }
-@@ -XXX,XX +XXX,XX @@ static bool do_predset(DisasContext *s, int esz, int rd, int pat, bool setflag)
+-    if (hcr_el2 & HCR_FMO) {
-             tcg_gen_gvec_dup64i(ofs, oprsz, maxsz, word);
++    if (allow_virt && (hcr_el2 & HCR_FMO)) {
-             goto done;
+         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
              ret |= CPSR_F;
          }
--        if (oprsz * 8 == setsz + 8) {
--            tcg_gen_gvec_dup64i(ofs, oprsz, maxsz, word);
--            tcg_gen_movi_i64(t, 0);
--            tcg_gen_st_i64(t, cpu_env, ofs + oprsz - 8);
--            goto done;
--        }
-     }
-     setsz /= 8;
-     fullsz /= 8;
-     tcg_gen_movi_i64(t, word);
--    for (i = 0; i < setsz; i += 8) {
-+    for (i = 0; i < QEMU_ALIGN_DOWN(setsz, 8); i += 8) {
-         tcg_gen_st_i64(t, cpu_env, ofs + i);
-     }
-     if (lastword != word) {
 --
-.17.1
+.20.1

-[Qemu-devel] [PULL 09/11] hw/sd/omap_mmc: Split 'pseudo-reset' from 'power-on-reset'
+[PULL 4/4] target/arm: Honor HCR_EL2.TID3 trapping requirements
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Marc Zyngier <maz@kernel.org>
-DeviceClass::reset models a "cold power-on" reset which can
+HCR_EL2.TID3 mandates that access from EL1 to a long list of id
-also be used to powercycle a device; but there is no "hot reset"
+registers traps to EL2, and QEMU has so far ignored this requirement.
-(a.k.a. soft-reset) method available.
+This breaks (among other things) KVM guests that have PtrAuth enabled,
-The OMAP MMC Power-Up Control bit is not designed to powercycle
+while the hypervisor doesn't want to expose the feature to its guest.
-a card, but to disable it without powering it off (pseudo-reset):
+To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
+case), and masks out the unsupported feature.
-  Multimedia Card (MMC/SD/SDIO) Interface [SPRU765A]
+QEMU not honoring the trap request means that the guest observes
-  MMC_CON[11] Power-Up Control (POW)
+that the feature is present in the HW, starts using it, and dies
-  This bit must be set to 1 before any valid transaction to either
+a horrible death when KVM injects an UNDEF, because the feature
-  MMC/SD or SPI memory cards.
+*really* isn't supported.
-  When 1, the card is considered powered-up and the controller core
-  is enabled.
+Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.
-  When 0, the card is considered powered-down (system dependent),
-  and the controller core logic is in pseudo-reset state. This is,
+Note that this change does not include trapping of the MVFR
-  the MMC_STAT flags and the FIFO pointers are reset, any access to
+registers from AArch32 (they are accessed via the VMRS
-  MMC_DATA[DATA] has no effect, a write into the MMC.CMD register
+instruction and need to be handled in a different way).
-  is ignored, and a setting of MMC_SPI[STR] to 1 is ignored.
+Reported-by: Will Deacon <will@kernel.org>
-By splitting the 'pseudo-reset' code out of the 'power-on' reset
+Signed-off-by: Marc Zyngier <maz@kernel.org>
-function, this patch fixes a latent bug in omap_mmc_write(MMC_CON)i
+Tested-by: Will Deacon <will@kernel.org>
-recently exposed by ecd219f7abb.
+Message-id: 20191123115618.29230-1-maz@kernel.org
+[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+ changed names of access functions to include _tid3]
 Message-id: 20180706162155.8432-2-f4bug@amsat.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/sd/omap_mmc.c | 14 +++++++++++---
+ target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
-file changed, 11 insertions(+), 3 deletions(-)
+file changed, 76 insertions(+)
-diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
+diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/sd/omap_mmc.c
+--- a/target/arm/helper.c
-+++ b/hw/sd/omap_mmc.c
++++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
- /*
+     REGINFO_SENTINEL
-  * OMAP on-chip MMC/SD host emulation.
+ };
-  *
-+ * Datasheet: TI Multimedia Card (MMC/SD/SDIO) Interface (SPRU765A)
++static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
-+ *
++                                       bool isread)
   * Copyright (C) 2006-2007 Andrzej Zaborowski  <balrog@zabor.org>
   *
   * This program is free software; you can redistribute it and/or
@@ -XXX,XX +XXX,XX @@ static void omap_mmc_update(void *opaque)
      omap_mmc_interrupts_update(s);
  }
 +static void omap_mmc_pseudo_reset(struct omap_mmc_s *host)
 +{
-+    host->status = 0;
++    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
-+    host->fifo_len = 0;
++        return CP_ACCESS_TRAP_EL2;
 +    }
 +
 +    return CP_ACCESS_OK;
 +}
 +
- void omap_mmc_reset(struct omap_mmc_s *host)
++static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                       bool isread)
 +{
 +    if (arm_feature(env, ARM_FEATURE_V8)) {
 +        return access_aa64_tid3(env, ri, isread);
 +    }
 +
 +    return CP_ACCESS_OK;
 +}
 +
  void register_cp_regs_for_features(ARMCPU *cpu)
  {
-     host->last_cmd = 0;
+     /* Register all the coprocessor registers based on feature bits */
-@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-     host->dw = 0;
+             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
-     host->mode = 0;
+               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
-     host->enable = 0;
+               .access = PL1_R, .type = ARM_CP_CONST,
--    host->status = 0;
++              .accessfn = access_aa32_tid3,
-     host->mask = 0;
+               .resetvalue = cpu->id_pfr0 },
-     host->cto = 0;
+             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
-     host->dto = 0;
+              * the value of the GIC field until after we define these regs.
--    host->fifo_len = 0;
+@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-     host->blen = 0;
+             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
-     host->blen_counter = 0;
+               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
-     host->nblk = 0;
+               .access = PL1_R, .type = ARM_CP_NO_RAW,
-@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
++              .accessfn = access_aa32_tid3,
-     qemu_set_irq(host->coverswitch, host->cdet_state);
+               .readfn = id_pfr1_read,
-     host->clkdiv = 0;
+               .writefn = arm_cp_write_ignore },
+             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
-+    omap_mmc_pseudo_reset(host);
+               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
-+
+               .access = PL1_R, .type = ARM_CP_CONST,
-     /* Since we're still using the legacy SD API the card is not plugged
++              .accessfn = access_aa32_tid3,
-      * into any bus, and we must reset it manually. When omap_mmc is
+               .resetvalue = cpu->id_dfr0 },
-      * QOMified this must move into the QOM reset function.
+             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
-@@ -XXX,XX +XXX,XX @@ static void omap_mmc_write(void *opaque, hwaddr offset,
+               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
-         if (s->dw != 0 && s->lines < 4)
+               .access = PL1_R, .type = ARM_CP_CONST,
-             printf("4-bit SD bus enabled\n");
++              .accessfn = access_aa32_tid3,
-         if (!s->enable)
+               .resetvalue = cpu->id_afr0 },
--            omap_mmc_reset(s);
+             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
-+            omap_mmc_pseudo_reset(s);
+               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
-         break;
+               .access = PL1_R, .type = ARM_CP_CONST,
++              .accessfn = access_aa32_tid3,
-     case 0x10:    /* MMC_STAT */
+               .resetvalue = cpu->id_mmfr0 },
              { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr1 },
              { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr2 },
              { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr3 },
              { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar0 },
              { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar1 },
              { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar2 },
              { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar3 },
              { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar4 },
              { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar5 },
              { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr4 },
              { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar6 },
              REGINFO_SENTINEL
          };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_NO_RAW,
 +              .accessfn = access_aa64_tid3,
                .readfn = id_aa64pfr0_read,
                .writefn = arm_cp_write_ignore },
              { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64pfr1},
              { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                /* At present, only SVEver == 0 is defined anyway.  */
                .resetvalue = 0 },
              { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr0 },
              { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr1 },
              { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr0 },
              { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr1 },
              { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar0 },
              { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar1 },
              { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr0 },
              { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr1 },
              { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr0 },
              { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr1 },
              { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr2 },
              { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
                .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
 --
-.17.1
+.20.1

-[Qemu-devel] [PULL 10/11] boards.h: Remove doc comment reference to nonexistent function
+Deleted patch
-commit b08199c6fbea1 accidentally added a reference to a doc
-comment to a nonexistent memory_region_allocate_aux_memory().
-This was a leftover from a previous version of the patchset
-which defined memory_region_allocate_aux_memory() for
-"allocate RAM MemoryRegion and register it for migration"
-and left "memory_region_init_ram()" with its original semantics
-of "allocate RAM MR but do not register for migration". In
-the end we decided on the approach of "memory_region_init_ram()
-registers the MR for migration, and memory_region_init_ram_nomigrate()
-is a new function which does not", but this comment change
-got left in by mistake. Revert that part of the commit.
-Reported-by: Thomas Huth <huth@tuxfamily.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180702130605.13611-1-peter.maydell@linaro.org
----
- include/hw/boards.h | 3 +--
-file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/include/hw/boards.h b/include/hw/boards.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/boards.h
-+++ b/include/hw/boards.h
-@@ -XXX,XX +XXX,XX @@
-  *
-  * Smaller pieces of memory (display RAM, static RAMs, etc) don't need
-  * to be backed via the -mem-path memory backend and can simply
-- * be created via memory_region_allocate_aux_memory() or
-- * memory_region_init_ram().
-+ * be created via memory_region_init_ram().
-  */
- void memory_region_allocate_system_memory(MemoryRegion *mr, Object *owner,
-                                           const char *name,
---
-.17.1

-[Qemu-devel] [PULL 11/11] hw/net/dp8393x: don't make prom region 'nomigrate'
+Deleted patch
-Currently we use memory_region_init_rom_nomigrate() to create
-the "dp3893x-prom" memory region, and we don't manually register
-it with vmstate_register_ram(). This currently means that its
-contents are migrated but as a ram block whose name is the empty
-string; in future it may mean they are not migrated at all. Use
-memory_region_init_ram() instead.
-Note that this is a a cross-version migration compatibility break
-for the MIPS "magnum" and "pica61" machines.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Aleksandar Markovic <aleksandar.markovic@wavecomp.com>
-Message-id: 20180706174309.27110-1-peter.maydell@linaro.org
----
- hw/net/dp8393x.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/dp8393x.c
-+++ b/hw/net/dp8393x.c
-@@ -XXX,XX +XXX,XX @@ static void dp8393x_realize(DeviceState *dev, Error **errp)
-     s->watchdog = timer_new_ns(QEMU_CLOCK_VIRTUAL, dp8393x_watchdog, s);
-     s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */
--    memory_region_init_ram_nomigrate(&s->prom, OBJECT(dev),
-+    memory_region_init_ram(&s->prom, OBJECT(dev),
-                            "dp8393x-prom", SONIC_PROM_SIZE, &local_err);
-     if (local_err) {
-         error_propagate(errp, local_err);
---
-.17.1

Hi; this target-arm pull request has a collection of generally
fairly minor bugs to sneak in before 3.0 rc0 tomorrow...

thanks
-- PMM

The following changes since commit a98ff0ec2ba3538dd766b349518ee18d03942ed8:

Merge remote-tracking branch 'remotes/dgibson/tags/ppc-for-3.0-20180709' into staging (2018-07-09 11:00:45 +0100)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180709

for you to fetch changes up to 8fad0a65582c0a6e324580f45516461e9b6aa439:

hw/net/dp8393x: don't make prom region 'nomigrate' (2018-07-09 14:51:35 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/net/dp8393x: don't make prom region 'nomigrate'
 * boards.h: Remove doc comment reference to nonexistent function
 * hw/sd/omap_mmc: Split 'pseudo-reset' from 'power-on-reset'
 * target/arm: Fix do_predset for large VL
 * tcg: Restrict check_size_impl to multiples of the line size
 * target/arm: Suppress Coverity warning for PRF
 * hw/timer/cmsdk-apb-timer: fix minor corner-case bugs and
   suppress spurious warnings when running Linux's timer driver
 * hw/arm/smmu-common: Fix devfn computation in smmu_iommu_mr

----------------------------------------------------------------
Eric Auger (1):
      hw/arm/smmu-common: Fix devfn computation in smmu_iommu_mr

Guenter Roeck (1):
      hw/timer/cmsdk-apb-timer: Correctly identify and set one-shot mode

Peter Maydell (5):
      ptimer: Add TRIGGER_ONLY_ON_DECREMENT policy option
      hw/timer/cmsdk-apb-timer: Correct ptimer policy settings
      hw/timer/cmsdk-apb-timer: run or stop timer on writes to RELOAD and VALUE
      boards.h: Remove doc comment reference to nonexistent function
      hw/net/dp8393x: don't make prom region 'nomigrate'

Philippe Mathieu-Daudé (1):
      hw/sd/omap_mmc: Split 'pseudo-reset' from 'power-on-reset'

Richard Henderson (3):
      target/arm: Suppress Coverity warning for PRF
      tcg: Restrict check_size_impl to multiples of the line size
      target/arm: Fix do_predset for large VL

From: Eric Auger <eric.auger@redhat.com>

smmu_iommu_mr() aims at returning the IOMMUMemoryRegion corresponding
to a given sid. The function extracts both the PCIe bus number and
the devfn to return this data. Current computation of devfn is wrong
as it only returns the PCIe function instead of slot | function.

Fixes 32cfd7f39e08 ("hw/arm/smmuv3: Cache/invalidate config data")

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 1530775623-32399-1-git-send-email-eric.auger@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/smmu-common.h | 1 +
 hw/arm/smmu-common.c         | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/include/hw/arm/smmu-common.h b/include/hw/arm/smmu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/smmu-common.h
+++ b/include/hw/arm/smmu-common.h
@@ -XXX,XX +XXX,XX @@
 
 #define SMMU_PCI_BUS_MAX      256
 #define SMMU_PCI_DEVFN_MAX    256
+#define SMMU_PCI_DEVFN(sid)   (sid & 0xFF)
 
 #define SMMU_MAX_VA_BITS      48
 
diff --git a/hw/arm/smmu-common.c b/hw/arm/smmu-common.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/smmu-common.c
+++ b/hw/arm/smmu-common.c
@@ -XXX,XX +XXX,XX @@ IOMMUMemoryRegion *smmu_iommu_mr(SMMUState *s, uint32_t sid)
     bus_n = PCI_BUS_NUM(sid);
     smmu_bus = smmu_find_smmu_pcibus(s, bus_n);
     if (smmu_bus) {
-        devfn = sid & 0x7;
+        devfn = SMMU_PCI_DEVFN(sid);
         smmu = smmu_bus->pbdev[devfn];
         if (smmu) {
             return &smmu->iommu;
-- 
2.17.1

The CMSDK timer behaviour is that an interrupt is triggered when the
counter counts down from 1 to 0; however one is not triggered if the
counter is manually set to 0 by a guest write to the counter register.
Currently ptimer can't handle this; add a policy option to allow
a ptimer user to request this behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20180703171044.9503-2-peter.maydell@linaro.org
---
 include/hw/ptimer.h |  9 +++++++++
 hw/core/ptimer.c    | 22 +++++++++++++++++++++-
 tests/ptimer-test.c | 25 +++++++++++++++++++------
 3 files changed, 49 insertions(+), 7 deletions(-)

diff --git a/include/hw/ptimer.h b/include/hw/ptimer.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ptimer.h
+++ b/include/hw/ptimer.h
@@ -XXX,XX +XXX,XX @@
  * not the one less.  */
 #define PTIMER_POLICY_NO_COUNTER_ROUND_DOWN (1 << 4)
 
+/*
+ * Starting to run with a zero counter, or setting the counter to "0" via
+ * ptimer_set_count() or ptimer_set_limit() will not trigger the timer
+ * (though it will cause a reload). Only a counter decrement to "0"
+ * will cause a trigger. Not compatible with NO_IMMEDIATE_TRIGGER;
+ * ptimer_init() will assert() that you don't set both.
+ */
+#define PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT (1 << 5)
+
 /* ptimer.c */
 typedef struct ptimer_state ptimer_state;
 typedef void (*ptimer_cb)(void *opaque);
diff --git a/hw/core/ptimer.c b/hw/core/ptimer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/ptimer.c
+++ b/hw/core/ptimer.c
@@ -XXX,XX +XXX,XX @@ static void ptimer_reload(ptimer_state *s, int delta_adjust)
     uint32_t period_frac = s->period_frac;
     uint64_t period = s->period;
     uint64_t delta = s->delta;
+    bool suppress_trigger = false;
 
-    if (delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)) {
+    /*
+     * Note that if delta_adjust is 0 then we must be here because of
+     * a count register write or timer start, not because of timer expiry.
+     * In that case the policy might require us to suppress the timer trigger
+     * that we would otherwise generate for a zero delta.
+     */
+    if (delta_adjust == 0 &&
+        (s->policy_mask & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT)) {
+        suppress_trigger = true;
+    }
+    if (delta == 0 && !(s->policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)
+        && !suppress_trigger) {
         ptimer_trigger(s);
     }
 
@@ -XXX,XX +XXX,XX @@ ptimer_state *ptimer_init(QEMUBH *bh, uint8_t policy_mask)
     s->bh = bh;
     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, ptimer_tick, s);
     s->policy_mask = policy_mask;
+
+    /*
+     * These two policies are incompatible -- trigger-on-decrement implies
+     * a timer trigger when the count becomes 0, but no-immediate-trigger
+     * implies a trigger when the count stops being 0.
+     */
+    assert(!((policy_mask & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT) &&
+             (policy_mask & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)));
     return s;
 }
 
diff --git a/tests/ptimer-test.c b/tests/ptimer-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/ptimer-test.c
+++ b/tests/ptimer-test.c
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
+    bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
 
     triggered = false;
 
@@ -XXX,XX +XXX,XX @@ static void check_periodic(gconstpointer arg)
     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
                      no_immediate_reload ? 0 : 10);
 
-    if (no_immediate_trigger) {
+    if (no_immediate_trigger || trig_only_on_dec) {
         g_assert_false(triggered);
     } else {
         g_assert_true(triggered);
@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
     bool no_immediate_reload = (*policy & PTIMER_POLICY_NO_IMMEDIATE_RELOAD);
     bool no_round_down = (*policy & PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
+    bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
 
     triggered = false;
 
@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
                      no_immediate_reload ? 0 : 99);
 
-    if (no_immediate_trigger) {
+    if (no_immediate_trigger || trig_only_on_dec) {
         g_assert_false(triggered);
     } else {
         g_assert_true(triggered);
@@ -XXX,XX +XXX,XX @@ static void check_run_with_delta_0(gconstpointer arg)
     g_assert_cmpuint(ptimer_get_count(ptimer), ==,
                      no_immediate_reload ? 0 : 99);
 
-    if (no_immediate_trigger) {
+    if (no_immediate_trigger || trig_only_on_dec) {
         g_assert_false(triggered);
     } else {
         g_assert_true(triggered);
@@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg)
     ptimer_state *ptimer = ptimer_init(bh, *policy);
     bool continuous_trigger = (*policy & PTIMER_POLICY_CONTINUOUS_TRIGGER);
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
+    bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
 
     triggered = false;
 
@@ -XXX,XX +XXX,XX @@ static void check_periodic_with_load_0(gconstpointer arg)
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
 
-    if (no_immediate_trigger) {
+    if (no_immediate_trigger || trig_only_on_dec) {
         g_assert_false(triggered);
     } else {
         g_assert_true(triggered);
@@ -XXX,XX +XXX,XX @@ static void check_oneshot_with_load_0(gconstpointer arg)
     QEMUBH *bh = qemu_bh_new(ptimer_trigger, NULL);
     ptimer_state *ptimer = ptimer_init(bh, *policy);
     bool no_immediate_trigger = (*policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER);
+    bool trig_only_on_dec = (*policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT);
 
     triggered = false;
 
@@ -XXX,XX +XXX,XX @@ static void check_oneshot_with_load_0(gconstpointer arg)
 
     g_assert_cmpuint(ptimer_get_count(ptimer), ==, 0);
 
-    if (no_immediate_trigger) {
+    if (no_immediate_trigger || trig_only_on_dec) {
         g_assert_false(triggered);
     } else {
         g_assert_true(triggered);
@@ -XXX,XX +XXX,XX @@ static void add_ptimer_tests(uint8_t policy)
         g_strlcat(policy_name, "no_counter_rounddown,", 256);
     }
 
+    if (policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT) {
+        g_strlcat(policy_name, "trigger_only_on_decrement,", 256);
+    }
+
     g_test_add_data_func_full(
         tmp = g_strdup_printf("/ptimer/set_count policy=%s", policy_name),
         g_memdup(&policy, 1), check_set_count, g_free);
@@ -XXX,XX +XXX,XX @@ static void add_ptimer_tests(uint8_t policy)
 
 static void add_all_ptimer_policies_comb_tests(void)
 {
-    int last_policy = PTIMER_POLICY_NO_COUNTER_ROUND_DOWN;
+    int last_policy = PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT;
     int policy = PTIMER_POLICY_DEFAULT;
 
     for (; policy < (last_policy << 1); policy++) {
+        if ((policy & PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT) &&
+            (policy & PTIMER_POLICY_NO_IMMEDIATE_TRIGGER)) {
+            /* Incompatible policy flag settings -- don't try to test them */
+            continue;
+        }
         add_ptimer_tests(policy);
     }
 }
-- 
2.17.1

The CMSDK timer interrupt triggers when the counter goes from 1 to 0,
so we want to trigger immediately, rather than waiting for a
clock cycle. Drop the incorrect NO_IMMEDIATE_TRIGGER setting.
We also do not want to get an interrupt if the guest sets the
counter directly to zero, so use the new TRIGGER_ONLY_ON_DECREMENT
policy.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20180703171044.9503-3-peter.maydell@linaro.org
---
 hw/timer/cmsdk-apb-timer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_realize(DeviceState *dev, Error **errp)
     bh = qemu_bh_new(cmsdk_apb_timer_tick, s);
     s->timer = ptimer_init(bh,
                            PTIMER_POLICY_WRAP_AFTER_ONE_PERIOD |
-                           PTIMER_POLICY_NO_IMMEDIATE_TRIGGER |
+                           PTIMER_POLICY_TRIGGER_ONLY_ON_DECREMENT |
                            PTIMER_POLICY_NO_IMMEDIATE_RELOAD |
                            PTIMER_POLICY_NO_COUNTER_ROUND_DOWN);
 
-- 
2.17.1

From: Guenter Roeck <linux@roeck-us.net>

The CMSDK APB timer is currently always configured as periodic timer.
This results in the following messages when trying to boot Linux.

Timer with delta zero, disabling

If the timer limit set with the RELOAD command is 0, the timer
needs to be enabled as one-shot timer.

Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/timer/cmsdk-apb-timer.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

If the CMSDK APB timer is set up with a zero RELOAD value
then it will count down to zero, fire once and then stay
at zero. From the point of view of the ptimer system, the
timer is disabled; but the enable bit in the CTRL register
is still set and if the guest subsequently writes to the
RELOAD or VALUE registers this should cause the timer to
start counting down again.

Add code to the write paths for RELOAD and VALUE so that
we correctly restart the timer in this situation.

Conversely, if the new RELOAD and VALUE are both zero,
we should stop the ptimer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 20180703171044.9503-5-peter.maydell@linaro.org
---
 hw/timer/cmsdk-apb-timer.c | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)

diff --git a/hw/timer/cmsdk-apb-timer.c b/hw/timer/cmsdk-apb-timer.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/timer/cmsdk-apb-timer.c
+++ b/hw/timer/cmsdk-apb-timer.c
@@ -XXX,XX +XXX,XX @@ static void cmsdk_apb_timer_write(void *opaque, hwaddr offset, uint64_t value,
         break;
     case A_RELOAD:
         /* Writing to reload also sets the current timer value */
+        if (!value) {
+            ptimer_stop(s->timer);
+        }
         ptimer_set_limit(s->timer, value, 1);
+        if (value && (s->ctrl & R_CTRL_EN_MASK)) {
+            /*
+             * Make sure timer is running (it might have stopped if this
+             * was an expired one-shot timer)
+             */
+            ptimer_run(s->timer, 0);
+        }
         break;
     case A_VALUE:
+        if (!value && !ptimer_get_limit(s->timer)) {
+            ptimer_stop(s->timer);
+        }
         ptimer_set_count(s->timer, value);
+        if (value && (s->ctrl & R_CTRL_EN_MASK)) {
+            ptimer_run(s->timer, ptimer_get_limit(s->timer) == 0);
+        }
         break;
     case A_INTSTATUS:
         /* Just one bit, which is W1C. */
-- 
2.17.1

From: Richard Henderson <richard.henderson@linaro.org>

These instructions must perform the sve_access_check, but
since they are implemented as NOPs there is no generated
code to elide when the access check fails.

Fixes: Coverity issues 1393780 & 1393779.
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_ST1_zpiz(DisasContext *s, arg_ST1_zpiz *a, uint32_t insn)
 static bool trans_PRF(DisasContext *s, arg_PRF *a, uint32_t insn)
 {
     /* Prefetch is a nop within QEMU.  */
-    sve_access_check(s);
+    (void)sve_access_check(s);
     return true;
 }
 
@@ -XXX,XX +XXX,XX @@ static bool trans_PRF_rr(DisasContext *s, arg_PRF_rr *a, uint32_t insn)
         return false;
     }
     /* Prefetch is a nop within QEMU.  */
-    sve_access_check(s);
+    (void)sve_access_check(s);
     return true;
 }
 
-- 
2.17.1

From: Richard Henderson <richard.henderson@linaro.org>

Normally this is automatic in the size restrictions that are placed
on vector sizes coming from the implementation.  However, for the
legitimate size tuple [oprsz=8, maxsz=32], we need to clear the final
24 bytes of the vector register.  Without this check, do_dup selects
TCG_TYPE_V128 and clears only 16 bytes.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180705191929.30773-2-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tcg/tcg-op-gvec.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/tcg/tcg-op-gvec.c b/tcg/tcg-op-gvec.c
index XXXXXXX..XXXXXXX 100644
--- a/tcg/tcg-op-gvec.c
+++ b/tcg/tcg-op-gvec.c
@@ -XXX,XX +XXX,XX @@ void tcg_gen_gvec_4_ptr(uint32_t dofs, uint32_t aofs, uint32_t bofs,
    in units of LNSZ.  This limits the expansion of inline code.  */
 static inline bool check_size_impl(uint32_t oprsz, uint32_t lnsz)
 {
-    uint32_t lnct = oprsz / lnsz;
-    return lnct >= 1 && lnct <= MAX_UNROLL;
+    if (oprsz % lnsz == 0) {
+        uint32_t lnct = oprsz / lnsz;
+        return lnct >= 1 && lnct <= MAX_UNROLL;
+    }
+    return false;
 }
 
 static void expand_clr(uint32_t dofs, uint32_t maxsz);
-- 
2.17.1

From: Richard Henderson <richard.henderson@linaro.org>

Use MAKE_64BIT_MASK instead of open-coding.  Remove an odd
vector size check that is unlikely to be more profitable
than 3 64-bit integer stores.  Correct the iteration for WORD
to avoid writing too much data.

Fixes RISU tests of PTRUE for VL 256.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Alex Bennée <alex.bennee@linaro.org>
Tested-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20180705191929.30773-3-richard.henderson@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool do_predset(DisasContext *s, int esz, int rd, int pat, bool setflag)
         setsz = numelem << esz;
         lastword = word = pred_esz_masks[esz];
         if (setsz % 64) {
-            lastword &= ~(-1ull << (setsz % 64));
+            lastword &= MAKE_64BIT_MASK(0, setsz % 64);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static bool do_predset(DisasContext *s, int esz, int rd, int pat, bool setflag)
             tcg_gen_gvec_dup64i(ofs, oprsz, maxsz, word);
             goto done;
         }
-        if (oprsz * 8 == setsz + 8) {
-            tcg_gen_gvec_dup64i(ofs, oprsz, maxsz, word);
-            tcg_gen_movi_i64(t, 0);
-            tcg_gen_st_i64(t, cpu_env, ofs + oprsz - 8);
-            goto done;
-        }
     }
 
     setsz /= 8;
     fullsz /= 8;
 
     tcg_gen_movi_i64(t, word);
-    for (i = 0; i < setsz; i += 8) {
+    for (i = 0; i < QEMU_ALIGN_DOWN(setsz, 8); i += 8) {
         tcg_gen_st_i64(t, cpu_env, ofs + i);
     }
     if (lastword != word) {
-- 
2.17.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

DeviceClass::reset models a "cold power-on" reset which can
also be used to powercycle a device; but there is no "hot reset"
(a.k.a. soft-reset) method available.

The OMAP MMC Power-Up Control bit is not designed to powercycle
a card, but to disable it without powering it off (pseudo-reset):

Multimedia Card (MMC/SD/SDIO) Interface [SPRU765A]

MMC_CON[11] Power-Up Control (POW)
  This bit must be set to 1 before any valid transaction to either
  MMC/SD or SPI memory cards.
  When 1, the card is considered powered-up and the controller core
  is enabled.
  When 0, the card is considered powered-down (system dependent),
  and the controller core logic is in pseudo-reset state. This is,
  the MMC_STAT flags and the FIFO pointers are reset, any access to
  MMC_DATA[DATA] has no effect, a write into the MMC.CMD register
  is ignored, and a setting of MMC_SPI[STR] to 1 is ignored.

By splitting the 'pseudo-reset' code out of the 'power-on' reset
function, this patch fixes a latent bug in omap_mmc_write(MMC_CON)i
recently exposed by ecd219f7abb.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180706162155.8432-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/sd/omap_mmc.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/hw/sd/omap_mmc.c b/hw/sd/omap_mmc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/sd/omap_mmc.c
+++ b/hw/sd/omap_mmc.c
@@ -XXX,XX +XXX,XX @@
 /*
  * OMAP on-chip MMC/SD host emulation.
  *
+ * Datasheet: TI Multimedia Card (MMC/SD/SDIO) Interface (SPRU765A)
+ *
  * Copyright (C) 2006-2007 Andrzej Zaborowski  <balrog@zabor.org>
  *
  * This program is free software; you can redistribute it and/or
@@ -XXX,XX +XXX,XX @@ static void omap_mmc_update(void *opaque)
     omap_mmc_interrupts_update(s);
 }
 
+static void omap_mmc_pseudo_reset(struct omap_mmc_s *host)
+{
+    host->status = 0;
+    host->fifo_len = 0;
+}
+
 void omap_mmc_reset(struct omap_mmc_s *host)
 {
     host->last_cmd = 0;
@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
     host->dw = 0;
     host->mode = 0;
     host->enable = 0;
-    host->status = 0;
     host->mask = 0;
     host->cto = 0;
     host->dto = 0;
-    host->fifo_len = 0;
     host->blen = 0;
     host->blen_counter = 0;
     host->nblk = 0;
@@ -XXX,XX +XXX,XX @@ void omap_mmc_reset(struct omap_mmc_s *host)
     qemu_set_irq(host->coverswitch, host->cdet_state);
     host->clkdiv = 0;
 
+    omap_mmc_pseudo_reset(host);
+
     /* Since we're still using the legacy SD API the card is not plugged
      * into any bus, and we must reset it manually. When omap_mmc is
      * QOMified this must move into the QOM reset function.
@@ -XXX,XX +XXX,XX @@ static void omap_mmc_write(void *opaque, hwaddr offset,
         if (s->dw != 0 && s->lines < 4)
             printf("4-bit SD bus enabled\n");
         if (!s->enable)
-            omap_mmc_reset(s);
+            omap_mmc_pseudo_reset(s);
         break;
 
     case 0x10:	/* MMC_STAT */
-- 
2.17.1

commit b08199c6fbea1 accidentally added a reference to a doc
comment to a nonexistent memory_region_allocate_aux_memory().
This was a leftover from a previous version of the patchset
which defined memory_region_allocate_aux_memory() for
"allocate RAM MemoryRegion and register it for migration"
and left "memory_region_init_ram()" with its original semantics
of "allocate RAM MR but do not register for migration". In
the end we decided on the approach of "memory_region_init_ram()
registers the MR for migration, and memory_region_init_ram_nomigrate()
is a new function which does not", but this comment change
got left in by mistake. Revert that part of the commit.

Reported-by: Thomas Huth <huth@tuxfamily.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180702130605.13611-1-peter.maydell@linaro.org
---
 include/hw/boards.h | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/include/hw/boards.h b/include/hw/boards.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/boards.h
+++ b/include/hw/boards.h
@@ -XXX,XX +XXX,XX @@
  *
  * Smaller pieces of memory (display RAM, static RAMs, etc) don't need
  * to be backed via the -mem-path memory backend and can simply
- * be created via memory_region_allocate_aux_memory() or
- * memory_region_init_ram().
+ * be created via memory_region_init_ram().
  */
 void memory_region_allocate_system_memory(MemoryRegion *mr, Object *owner,
                                           const char *name,
-- 
2.17.1

Currently we use memory_region_init_rom_nomigrate() to create
the "dp3893x-prom" memory region, and we don't manually register
it with vmstate_register_ram(). This currently means that its
contents are migrated but as a ram block whose name is the empty
string; in future it may mean they are not migrated at all. Use
memory_region_init_ram() instead.

Note that this is a a cross-version migration compatibility break
for the MIPS "magnum" and "pica61" machines.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Aleksandar Markovic <aleksandar.markovic@wavecomp.com>
Message-id: 20180706174309.27110-1-peter.maydell@linaro.org
---
 hw/net/dp8393x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -XXX,XX +XXX,XX @@ static void dp8393x_realize(DeviceState *dev, Error **errp)
     s->watchdog = timer_new_ns(QEMU_CLOCK_VIRTUAL, dp8393x_watchdog, s);
     s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */
 
-    memory_region_init_ram_nomigrate(&s->prom, OBJECT(dev),
+    memory_region_init_ram(&s->prom, OBJECT(dev),
                            "dp8393x-prom", SONIC_PROM_SIZE, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
-- 
2.17.1

Arm patches for rc3 : just a handful of bug fixes.

thanks
-- PMM

The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:

Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126

for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:

target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)

----------------------------------------------------------------
target-arm queue:
 * handle FTYPE flag correctly in v7M exception return
   for v7M CPUs with an FPU (v8M CPUs were already correct)
 * versal: Add the CRP as unimplemented
 * Fix ISR_EL1 tracking when executing at EL2
 * Honor HCR_EL2.TID3 trapping requirements

----------------------------------------------------------------
Edgar E. Iglesias (1):
      hw/arm: versal: Add the CRP as unimplemented

Jean-Hugues Deschênes (1):
      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET

Marc Zyngier (2):
      target/arm: Fix ISR_EL1 tracking when executing at EL2
      target/arm: Honor HCR_EL2.TID3 trapping requirements

include/hw/arm/xlnx-versal.h |  3 ++
 hw/arm/xlnx-versal.c         |  2 ++
 target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
 target/arm/m_helper.c        |  7 ++--
 4 files changed, 89 insertions(+), 6 deletions(-)

From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>

According to the PushStack() pseudocode in the armv7m RM,
bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
an FPU is present. Current implementation is doing it for
armv8, but not for armv7. This patch makes the existing
logic applicable to both code paths.

Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/m_helper.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         if (env->v7m.secure) {
             lr |= R_V7M_EXCRET_S_MASK;
         }
-        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-            lr |= R_V7M_EXCRET_FTYPE_MASK;
-        }
     } else {
         lr = R_V7M_EXCRET_RES1_MASK |
             R_V7M_EXCRET_S_MASK |
             R_V7M_EXCRET_DCRS_MASK |
-            R_V7M_EXCRET_FTYPE_MASK |
             R_V7M_EXCRET_ES_MASK;
         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
             lr |= R_V7M_EXCRET_SPSEL_MASK;
         }
     }
+    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
+        lr |= R_V7M_EXCRET_FTYPE_MASK;
+    }
     if (!arm_v7m_is_handler_mode(env)) {
         lr |= R_V7M_EXCRET_MODE_MASK;
     }
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add the CRP as unimplemented thus avoiding bus errors when
guests access these registers.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 3 +++
 hw/arm/xlnx-versal.c         | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 #define MM_IOU_SCNTRS_SIZE          0x10000
 #define MM_FPD_CRF                  0xfd1a0000U
 #define MM_FPD_CRF_SIZE             0x140000
+
+#define MM_PMC_CRP                  0xf1260000U
+#define MM_PMC_CRP_SIZE             0x10000
 #endif
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
                         MM_CRL, MM_CRL_SIZE);
     versal_unimp_area(s, "crf", &s->mr_ps,
                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
+    versal_unimp_area(s, "crp", &s->mr_ps,
+                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
     versal_unimp_area(s, "iou-scntr", &s->mr_ps,
                         MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
     versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
SError interrupts.

Unfortunately, QEMU's implementation only considers the HCR_EL2
bits, and ignores the current exception level. This means a hypervisor
trying to look at its own interrupt state actually sees the guest
state, which is unexpected and breaks KVM as of Linux 5.3.

Instead, check for the running EL and return the physical bits
if not running in a virtualized context.

Fixes: 636540e9c40b
Cc: qemu-stable@nongnu.org
Reported-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Message-id: 20191122135833.28953-1-maz@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     CPUState *cs = env_cpu(env);
     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
     uint64_t ret = 0;
+    bool allow_virt = (arm_current_el(env) == 1 &&
+                       (!arm_is_secure_below_el3(env) ||
+                        (env->cp15.scr_el3 & SCR_EEL2)));
 
-    if (hcr_el2 & HCR_IMO) {
+    if (allow_virt && (hcr_el2 & HCR_IMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
             ret |= CPSR_I;
         }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
         }
     }
 
-    if (hcr_el2 & HCR_FMO) {
+    if (allow_virt && (hcr_el2 & HCR_FMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
             ret |= CPSR_F;
         }
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

HCR_EL2.TID3 mandates that access from EL1 to a long list of id
registers traps to EL2, and QEMU has so far ignored this requirement.

This breaks (among other things) KVM guests that have PtrAuth enabled,
while the hypervisor doesn't want to expose the feature to its guest.
To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
case), and masks out the unsupported feature.

QEMU not honoring the trap request means that the guest observes
that the feature is present in the HW, starts using it, and dies
a horrible death when KVM injects an UNDEF, because the feature
*really* isn't supported.

Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.

Note that this change does not include trapping of the MVFR
registers from AArch32 (they are accessed via the VMRS
instruction and need to be handled in a different way).

Reported-by: Will Deacon <will@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Tested-by: Will Deacon <will@kernel.org>
Message-id: 20191123115618.29230-1-maz@kernel.org
[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
 changed names of access functions to include _tid3]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        return access_aa64_tid3(env, ri, isread);
+    }
+
+    return CP_ACCESS_OK;
+}
+
 void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_pfr0 },
             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
              * the value of the GIC field until after we define these regs.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa32_tid3,
               .readfn = id_pfr1_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_dfr0 },
             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_afr0 },
             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr0 },
             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr1 },
             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr2 },
             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr3 },
             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar0 },
             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar1 },
             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar2 },
             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar3 },
             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar4 },
             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar5 },
             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr4 },
             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar6 },
             REGINFO_SENTINEL
         };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa64_tid3,
               .readfn = id_aa64pfr0_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64pfr1},
             { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               /* At present, only SVEver == 0 is defined anyway.  */
               .resetvalue = 0 },
             { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr0 },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr1 },
             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr0 },
             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr1 },
             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar0 },
             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar1 },
             { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr0 },
             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr1 },
             { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr0 },
             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr1 },
             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr2 },
             { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
-- 
2.20.1