Series comparison

-[Qemu-devel] [PULL 0/5] target-arm queue
+[PULL 0/7] target-arm queue
-A last arm pullreq before rc0. This is mostly bug fixes,
+A last small test of bug fixes before rc1.
 though you could call adding the missing local timer
 support to bcm2836_control a new feature I suppose --
 in any case it's a small and localised change.
 thanks
 -- PMM
-The following changes since commit 7074ab12c81a1b2b1e0e1c40983f56b2c5ccc494:
+The following changes since commit ed8ad9728a9c0eec34db9dff61dfa2f1dd625637:
-  Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-03-14 16:19:37 +0000)
+  Merge tag 'pull-tpm-2023-07-14-1' of https://github.com/stefanberger/qemu-tpm into staging (2023-07-15 14:54:04 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190315
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230717
-for you to fetch changes up to 5de56742a3c91de3d646326bec43a989bba83ca4:
+for you to fetch changes up to c2c1c4a35c7c2b1a4140b0942b9797c857e476a4:
-  target/arm: Check access permission to ADDVL/ADDPL/RDVL (2019-03-15 11:12:29 +0000)
+  hw/nvram: Avoid unnecessary Xilinx eFuse backstore write (2023-07-17 11:05:52 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * Add missing SVE-enabled check to ADDVL/ADDPL/RDVL
+ * hw/arm/sbsa-ref: set 'slots' property of xhci
- * virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
+ * linux-user: Remove pointless NULL check in clock_adjtime handling
- * virt-acpi-build: Fix SMMUv3 GSIV values
+ * ptw: Fix S1_ptw_translate() debug path
- * Allow EL0 to write to arch timer registers, not just read them
+ * ptw: Account for FEAT_RME when applying {N}SW, SA bits
- * bcm2836_control: Implement local timer
+ * accel/tcg: Zero-pad PC in TCG CPU exec trace lines
  * hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
 ----------------------------------------------------------------
-Amir Charif (1):
+Peter Maydell (5):
-      target/arm: Check access permission to ADDVL/ADDPL/RDVL
+      linux-user: Remove pointless NULL check in clock_adjtime handling
       target/arm/ptw.c: Add comments to S1Translate struct fields
       target/arm: Fix S1_ptw_translate() debug path
       target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
       accel/tcg: Zero-pad PC in TCG CPU exec trace lines
-Dongjiu Geng (1):
+Tong Ho (1):
-      target/arm: change arch timer registers access permission
+      hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
-Eric Auger (1):
+Yuquan Wang (1):
-      hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values
+      hw/arm/sbsa-ref: set 'slots' property of xhci
-Wei Yang (1):
+ accel/tcg/cpu-exec.c      |  4 +--
-      hw/arm/virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
+ accel/tcg/translate-all.c |  2 +-
+ hw/arm/sbsa-ref.c         |  1 +
-Zoltán Baldaszti (1):
+ hw/nvram/xlnx-efuse.c     | 11 ++++--
-      hw/intc/bcm2836_control: Implement local timer
+ linux-user/syscall.c      | 12 +++----
+ target/arm/ptw.c          | 90 +++++++++++++++++++++++++++++++++++++++++------
- include/hw/intc/bcm2836_control.h |   9 ++++
+files changed, 98 insertions(+), 22 deletions(-)
  hw/arm/virt-acpi-build.c          |   6 +--
  hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++++++++++-
  target/arm/helper.c               |  30 +++++------
  target/arm/translate-sve.c        |  22 ++++++---
 files changed, 140 insertions(+), 28 deletions(-)

-[Qemu-devel] [PULL 4/5] hw/arm/virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
+[PULL 1/7] hw/arm/sbsa-ref: set 'slots' property of xhci
-From: Wei Yang <richardw.yang@linux.intel.com>
+From: Yuquan Wang <wangyuquan1236@phytium.com.cn>
-This is more proper to use PCIE_MMCFG_BUS to retrieve end_bus_number.
+This extends the slots of xhci to 64, since the default xhci_sysbus
 just supports one slot.
-Signed-off-by: Wei Yang <richardw.yang@linux.intel.com>
+Signed-off-by: Wang Yuquan <wangyuquan1236@phytium.com.cn>
-Reviewed-by: Eric Auger <eric.auger@redhat.com>
+Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
-Reviewed-by: Igor Mammedov <imammedo@redhat.com>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190312074953.16671-1-richardw.yang@linux.intel.com
+Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 Message-id: 20230710063750.473510-2-wangyuquan1236@phytium.com.cn
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/virt-acpi-build.c | 4 ++--
+ hw/arm/sbsa-ref.c | 1 +
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+)
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
+diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
+--- a/hw/arm/sbsa-ref.c
-+++ b/hw/arm/virt-acpi-build.c
++++ b/hw/arm/sbsa-ref.c
-@@ -XXX,XX +XXX,XX @@ build_mcfg(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ static void create_xhci(const SBSAMachineState *sms)
-     /* Only a single allocation so no need to play with segments */
+     hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
-     mcfg->allocation[0].pci_segment = cpu_to_le16(0);
+     int irq = sbsa_ref_irqmap[SBSA_XHCI];
-     mcfg->allocation[0].start_bus_number = 0;
+     DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
--    mcfg->allocation[0].end_bus_number = (memmap[ecam_id].size
++    qdev_prop_set_uint32(dev, "slots", XHCI_MAXSLOTS);
--                                          / PCIE_MMCFG_SIZE_MIN) - 1;
-+    mcfg->allocation[0].end_bus_number =
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-+        PCIE_MMCFG_BUS(memmap[ecam_id].size - 1);
+     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
      build_header(linker, table_data, (void *)(table_data->data + mcfg_start),
                   "MCFG", table_data->len - mcfg_start, 1, NULL, NULL);
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 3/5] target/arm: change arch timer registers access permission
+[PULL 2/7] linux-user: Remove pointless NULL check in clock_adjtime handling
-From: Dongjiu Geng <gengdongjiu@huawei.com>
+In the code for TARGET_NR_clock_adjtime, we set the pointer phtx to
 the address of the local variable htx.  This means it can never be
 NULL, but later in the code we check it for NULL anyway.  Coverity
 complains about this (CID 1507683) because the NULL check comes after
 a call to clock_adjtime() that assumes it is non-NULL.
-Some generic arch timer registers are Config-RW in the EL0,
+Since phtx is always &htx, and is used only in three places, it's not
-which means the EL0 exception level can have write permission
+really necessary.  Remove it, bringing the code structure in to line
-if it is appropriately configured.
+with that for TARGET_NR_clock_adjtime64, which already uses a simple
 '&htx' when it wants a pointer to 'htx'.
-When VM access registers, QEMU firstly checks whether they have RW
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-permission, then check whether it is appropriately configured.
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-If they are defined to read only in EL0, even though they have been
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-appropriately configured, they still do not have write permission.
+Message-id: 20230623144410.1837261-1-peter.maydell@linaro.org
-So need to add the write permission according to ARMV8 spec when
+---
-define it.
+ linux-user/syscall.c | 12 +++++-------
 file changed, 5 insertions(+), 7 deletions(-)
-Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com>
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
 Message-id: 1552395177-12608-1-git-send-email-gengdongjiu@huawei.com
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.c | 30 +++++++++++++++---------------
 file changed, 15 insertions(+), 15 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/linux-user/syscall.c
-+++ b/target/arm/helper.c
++++ b/linux-user/syscall.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
-     /* per-timer control */
+ #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
-     { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
+     case TARGET_NR_clock_adjtime:
-       .secure = ARM_CP_SECSTATE_NS,
+         {
--      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+-            struct timex htx, *phtx = &htx;
-+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
++            struct timex htx;
-       .accessfn = gt_ptimer_access,
-       .fieldoffset = offsetoflow32(CPUARMState,
+-            if (target_to_host_timex(phtx, arg2) != 0) {
-                                    cp15.c14_timer[GTIMER_PHYS].ctl),
++            if (target_to_host_timex(&htx, arg2) != 0) {
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
+                 return -TARGET_EFAULT;
-     { .name = "CNTP_CTL_S",
+             }
-       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
+-            ret = get_errno(clock_adjtime(arg1, phtx));
-       .secure = ARM_CP_SECSTATE_S,
+-            if (!is_error(ret) && phtx) {
--      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+-                if (host_to_target_timex(arg2, phtx) != 0) {
-+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
+-                    return -TARGET_EFAULT;
-       .accessfn = gt_ptimer_access,
+-                }
-       .fieldoffset = offsetoflow32(CPUARMState,
++            ret = get_errno(clock_adjtime(arg1, &htx));
-                                    cp15.c14_timer[GTIMER_SEC].ctl),
++            if (!is_error(ret) && host_to_target_timex(arg2, &htx)) {
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
++                return -TARGET_EFAULT;
-     },
+             }
-     { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
+         }
-       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
+         return ret;
 -      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_ptimer_access,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
        .resetvalue = 0,
        .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
      },
      { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
 -      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
        .accessfn = gt_vtimer_access,
        .fieldoffset = offsetoflow32(CPUARMState,
                                     cp15.c14_timer[GTIMER_VIRT].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
 -      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_vtimer_access,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
        .resetvalue = 0,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      /* TimerValue views: a 32 bit downcounting view of the underlying state */
      { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
        .secure = ARM_CP_SECSTATE_NS,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_ptimer_access,
        .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
      },
      { .name = "CNTP_TVAL_S",
        .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
        .secure = ARM_CP_SECSTATE_S,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_ptimer_access,
        .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
      },
      { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
        .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
      },
      { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_vtimer_access,
        .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
      },
      { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
 -      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
 +      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
        .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
        .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
      },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      /* Comparison value, indicating when the timer goes off */
      { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
        .secure = ARM_CP_SECSTATE_NS,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
        .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
        .secure = ARM_CP_SECSTATE_S,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
        .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_IO,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
        .resetvalue = 0, .accessfn = gt_ptimer_access,
        .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
      },
      { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
        .accessfn = gt_vtimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
      },
      { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
        .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
 -      .access = PL1_RW | PL0_R,
 +      .access = PL0_RW,
        .type = ARM_CP_IO,
        .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
        .resetvalue = 0, .accessfn = gt_vtimer_access,
 --
-.20.1
+.34.1

-New patch
+[PULL 3/7] target/arm/ptw.c: Add comments to S1Translate struct fields
+Add comments to the in_* fields in the S1Translate struct
+that explain what they're doing.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230710152130.3928330-2-peter.maydell@linaro.org
+---
+ target/arm/ptw.c | 40 ++++++++++++++++++++++++++++++++++++++++
+file changed, 40 insertions(+)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@
+ #endif
+ typedef struct S1Translate {
++    /*
++     * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
++     * Together with in_space, specifies the architectural translation regime.
++     */
+     ARMMMUIdx in_mmu_idx;
++    /*
++     * in_ptw_idx: specifies which mmuidx to use for the actual
++     * page table descriptor load operations. This will be one of the
++     * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
++     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
++     * this field is updated accordingly.
++     */
+     ARMMMUIdx in_ptw_idx;
++    /*
++     * in_space: the security space for this walk. This plus
++     * the in_mmu_idx specify the architectural translation regime.
++     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
++     * this field is updated accordingly.
++     *
++     * Note that the security space for the in_ptw_idx may be different
++     * from that for the in_mmu_idx. We do not need to explicitly track
++     * the in_ptw_idx security space because:
++     *  - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
++     *    itself specifies the security space
++     *  - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
++     *    space used for ptw reads is the same as that of the security
++     *    space of the stage 1 translation for all cases except where
++     *    stage 1 is Secure; in that case the only possibilities for
++     *    the ptw read are Secure and NonSecure, and the in_ptw_idx
++     *    value being Stage2 vs Stage2_S distinguishes those.
++     */
+     ARMSecuritySpace in_space;
++    /*
++     * in_secure: whether the translation regime is a Secure one.
++     * This is always equal to arm_space_is_secure(in_space).
++     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
++     * this field is updated accordingly.
++     */
+     bool in_secure;
++    /*
++     * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
++     * accesses will not update the guest page table access flags
++     * and will not change the state of the softmmu TLBs.
++     */
+     bool in_debug;
+     /*
+      * If this is stage 2 of a stage 1+2 page table walk, then this must
+--
+.34.1

-[Qemu-devel] [PULL 1/5] hw/intc/bcm2836_control: Implement local timer
+[PULL 4/7] target/arm: Fix S1_ptw_translate() debug path
-From: Zoltán Baldaszti <bztemail@gmail.com>
+In commit fe4a5472ccd6 we rearranged the logic in S1_ptw_translate()
 so that the debug-access "call get_phys_addr_*" codepath is used both
 when S1 is doing ptw reads from stage 2 and when it is doing ptw
 reads from physical memory.  However, we didn't update the
 calculation of s2ptw->in_space and s2ptw->in_secure to account for
 the "ptw reads from physical memory" case.  This meant that debug
 accesses when in Secure state broke.
-The BCM2836 control logic module includes a simple
+Create a new function S2_security_space() which returns the
-"local timer" which is a programmable down-counter that
+correct security space to use for the ptw load, and use it to
-can generates an interrupt. Implement this functionality.
+determine the correct .in_secure and .in_space fields for the
 stage 2 lookup for the ptw load.
-Signed-off-by: Zoltán Baldaszti <bztemail@gmail.com>
+Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-[PMM: wrote commit message; wrapped long line; tweaked
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
- some comments to match the final version of the code]
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org
 Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate")
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/intc/bcm2836_control.h |   9 +++
+ target/arm/ptw.c | 37 ++++++++++++++++++++++++++++++++-----
- hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++-
+file changed, 32 insertions(+), 5 deletions(-)
 files changed, 108 insertions(+), 2 deletions(-)
-diff --git a/include/hw/intc/bcm2836_control.h b/include/hw/intc/bcm2836_control.h
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/intc/bcm2836_control.h
+--- a/target/arm/ptw.c
-+++ b/include/hw/intc/bcm2836_control.h
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
   * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
   * Written by Andrew Baumann
   *
 + * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
 + * Added basic IRQ_TIMER interrupt support
 + *
   * This code is licensed under the GNU GPLv2 and later.
   */
@@ -XXX,XX +XXX,XX @@
  #define BCM2836_CONTROL_H
  #include "hw/sysbus.h"
 +#include "qemu/timer.h"
  /* 4 mailboxes per core, for 16 total */
  #define BCM2836_NCORES 4
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836ControlState {
      bool gpu_irq, gpu_fiq;
      uint8_t timerirqs[BCM2836_NCORES];
 +    /* local timer */
 +    QEMUTimer timer;
 +    uint32_t local_timer_control;
 +    uint8_t route_localtimer;
 +
      /* interrupt source registers, post-routing (also input-derived; visible) */
      uint32_t irqsrc[BCM2836_NCORES];
      uint32_t fiqsrc[BCM2836_NCORES];
 diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/bcm2836_control.c
 +++ b/hw/intc/bcm2836_control.c
@@ -XXX,XX +XXX,XX @@
   * This code is licensed under the GNU GPLv2 and later.
   *
   * At present, only implements interrupt routing, and mailboxes (i.e.,
 - * not local timer, PMU interrupt, or AXI counters).
 + * not PMU interrupt, or AXI counters).
 + *
 + * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
   *
   * Ref:
   * https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2836/QA7_rev3.4.pdf
@@ -XXX,XX +XXX,XX @@
  #include "qemu/log.h"
  #define REG_GPU_ROUTE           0x0c
 +#define REG_LOCALTIMERROUTING   0x24
 +#define REG_LOCALTIMERCONTROL   0x34
 +#define REG_LOCALTIMERACK       0x38
  #define REG_TIMERCONTROL        0x40
  #define REG_MBOXCONTROL         0x50
  #define REG_IRQSRC              0x60
@@ -XXX,XX +XXX,XX @@
  #define IRQ_TIMER       11
  #define IRQ_MAX         IRQ_TIMER
 +#define LOCALTIMER_FREQ      38400000
 +#define LOCALTIMER_INTFLAG   (1 << 31)
 +#define LOCALTIMER_RELOAD    (1 << 30)
 +#define LOCALTIMER_INTENABLE (1 << 29)
 +#define LOCALTIMER_ENABLE    (1 << 28)
 +#define LOCALTIMER_VALUE(x)  ((x) & 0xfffffff)
 +
  static void deliver_local(BCM2836ControlState *s, uint8_t core, uint8_t irq,
                            uint32_t controlreg, uint8_t controlidx)
  {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_update(BCM2836ControlState *s)
          s->fiqsrc[s->route_gpu_fiq] |= (uint32_t)1 << IRQ_GPU;
      }
+ }
 +static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
 +                                          ARMMMUIdx s2_mmu_idx)
 +{
 +    /*
-+     * handle the control module 'local timer' interrupt for one of the
++     * Return the security space to use for stage 2 when doing
-+     * cores' IRQ/FIQ;  this is distinct from the per-CPU timer
++     * the S1 page table descriptor load.
 +     * interrupts handled below.
 +     */
-+    if ((s->local_timer_control & LOCALTIMER_INTENABLE) &&
++    if (regime_is_stage2(s2_mmu_idx)) {
-+        (s->local_timer_control & LOCALTIMER_INTFLAG)) {
++        /*
-+        if (s->route_localtimer & 4) {
++         * The security space for ptw reads is almost always the same
-+            s->fiqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
++         * as that of the security space of the stage 1 translation.
 +         * The only exception is when stage 1 is Secure; in that case
 +         * the ptw read might be to the Secure or the NonSecure space
 +         * (but never Realm or Root), and the s2_mmu_idx tells us which.
 +         * Root translations are always single-stage.
 +         */
 +        if (s1_space == ARMSS_Secure) {
 +            return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
 +        } else {
-+            s->irqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
++            assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
 +            assert(s1_space != ARMSS_Root);
 +            return s1_space;
 +        }
-+    }
-+
-     for (i = 0; i < BCM2836_NCORES; i++) {
-         /* handle local timer interrupts for this core */
-         if (s->timerirqs[i]) {
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_set_gpu_fiq(void *opaque, int irq, int level)
-     bcm2836_control_update(s);
- }
-+static void bcm2836_control_local_timer_set_next(void *opaque)
-+{
-+    BCM2836ControlState *s = opaque;
-+    uint64_t next_event;
-+
-+    assert(LOCALTIMER_VALUE(s->local_timer_control) > 0);
-+
-+    next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
-+        muldiv64(LOCALTIMER_VALUE(s->local_timer_control),
-+            NANOSECONDS_PER_SECOND, LOCALTIMER_FREQ);
-+    timer_mod(&s->timer, next_event);
-+}
-+
-+static void bcm2836_control_local_timer_tick(void *opaque)
-+{
-+    BCM2836ControlState *s = opaque;
-+
-+    bcm2836_control_local_timer_set_next(s);
-+
-+    s->local_timer_control |= LOCALTIMER_INTFLAG;
-+    bcm2836_control_update(s);
-+}
-+
-+static void bcm2836_control_local_timer_control(void *opaque, uint32_t val)
-+{
-+    BCM2836ControlState *s = opaque;
-+
-+    s->local_timer_control = val;
-+    if (val & LOCALTIMER_ENABLE) {
-+        bcm2836_control_local_timer_set_next(s);
 +    } else {
-+        timer_del(&s->timer);
++        /* ptw loads are from phys: the mmu idx itself says which space */
 +        return arm_phys_to_space(s2_mmu_idx);
 +    }
 +}
 +
-+static void bcm2836_control_local_timer_ack(void *opaque, uint32_t val)
+ /* Translate a S1 pagetable walk through S2 if needed.  */
-+{
+ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-+    BCM2836ControlState *s = opaque;
+                              hwaddr addr, ARMMMUFaultInfo *fi)
 +
 +    if (val & LOCALTIMER_INTFLAG) {
 +        s->local_timer_control &= ~LOCALTIMER_INTFLAG;
 +    }
 +    if ((val & LOCALTIMER_RELOAD) &&
 +        (s->local_timer_control & LOCALTIMER_ENABLE)) {
 +            bcm2836_control_local_timer_set_next(s);
 +    }
 +}
 +
  static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
  {
-     BCM2836ControlState *s = opaque;
+-    ARMSecuritySpace space = ptw->in_space;
-@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
+     bool is_secure = ptw->in_secure;
-         assert(s->route_gpu_fiq < BCM2836_NCORES
+     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-                && s->route_gpu_irq < BCM2836_NCORES);
+     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
-         return ((uint32_t)s->route_gpu_fiq << 2) | s->route_gpu_irq;
+@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-+    } else if (offset == REG_LOCALTIMERROUTING) {
+          * From gdbstub, do not use softmmu so that we don't modify the
-+        return s->route_localtimer;
+          * state of the cpu at all, including softmmu tlb contents.
-+    } else if (offset == REG_LOCALTIMERCONTROL) {
+          */
-+        return s->local_timer_control;
++        ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
-+    } else if (offset == REG_LOCALTIMERACK) {
+         S1Translate s2ptw = {
-+        return 0;
+             .in_mmu_idx = s2_mmu_idx,
-     } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
+             .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-         return s->timercontrol[(offset - REG_TIMERCONTROL) >> 2];
+-            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
-     } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
+-            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_write(void *opaque, hwaddr offset,
+-                         : space == ARMSS_Realm ? ARMSS_Realm
-     if (offset == REG_GPU_ROUTE) {
+-                         : ARMSS_NonSecure),
-         s->route_gpu_irq = val & 0x3;
++            .in_secure = arm_space_is_secure(s2_space),
-         s->route_gpu_fiq = (val >> 2) & 0x3;
++            .in_space = s2_space,
-+    } else if (offset == REG_LOCALTIMERROUTING) {
+             .in_debug = true,
-+        s->route_localtimer = val & 7;
+         };
-+    } else if (offset == REG_LOCALTIMERCONTROL) {
+         GetPhysAddrResult s2 = { };
 +        bcm2836_control_local_timer_control(s, val);
 +    } else if (offset == REG_LOCALTIMERACK) {
 +        bcm2836_control_local_timer_ack(s, val);
      } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
          s->timercontrol[(offset - REG_TIMERCONTROL) >> 2] = val & 0xff;
      } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_reset(DeviceState *d)
      s->route_gpu_irq = s->route_gpu_fiq = 0;
 +    timer_del(&s->timer);
 +    s->route_localtimer = 0;
 +    s->local_timer_control = 0;
 +
      for (i = 0; i < BCM2836_NCORES; i++) {
          s->timercontrol[i] = 0;
          s->mailboxcontrol[i] = 0;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_init(Object *obj)
      /* outputs to CPU cores */
      qdev_init_gpio_out_named(dev, s->irq, "irq", BCM2836_NCORES);
      qdev_init_gpio_out_named(dev, s->fiq, "fiq", BCM2836_NCORES);
 +
 +    /* create a qemu virtual timer */
 +    timer_init_ns(&s->timer, QEMU_CLOCK_VIRTUAL,
 +                  bcm2836_control_local_timer_tick, s);
  }
  static const VMStateDescription vmstate_bcm2836_control = {
      .name = TYPE_BCM2836_CONTROL,
 -    .version_id = 1,
 +    .version_id = 2,
      .minimum_version_id = 1,
      .fields = (VMStateField[]) {
          VMSTATE_UINT32_ARRAY(mailboxes, BCM2836ControlState,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_bcm2836_control = {
          VMSTATE_UINT32_ARRAY(timercontrol, BCM2836ControlState, BCM2836_NCORES),
          VMSTATE_UINT32_ARRAY(mailboxcontrol, BCM2836ControlState,
                               BCM2836_NCORES),
 +        VMSTATE_TIMER_V(timer, BCM2836ControlState, 2),
 +        VMSTATE_UINT32_V(local_timer_control, BCM2836ControlState, 2),
 +        VMSTATE_UINT8_V(route_localtimer, BCM2836ControlState, 2),
          VMSTATE_END_OF_LIST()
      }
  };
 --
-.20.1
+.34.1

-New patch
+[PULL 5/7] target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
+In get_phys_addr_twostage() the code that applies the effects of
+VSTCR.{SA,SW} and VTCR.{NSA,NSW} only updates result->f.attrs.secure.
+Now we also have f.attrs.space for FEAT_RME, we need to keep the two
+in sync.
+These bits only have an effect for Secure space translations, not
+for Root, so use the input in_space field to determine whether to
+apply them rather than the input is_secure. This doesn't actually
+make a difference because Root translations are never two-stage,
+but it's a little clearer.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230710152130.3928330-4-peter.maydell@linaro.org
+---
+ target/arm/ptw.c | 13 ++++++++-----
+file changed, 8 insertions(+), 5 deletions(-)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
+     hwaddr ipa;
+     int s1_prot, s1_lgpgsz;
+     bool is_secure = ptw->in_secure;
++    ARMSecuritySpace in_space = ptw->in_space;
+     bool ret, ipa_secure;
+     ARMCacheAttrs cacheattrs1;
+     ARMSecuritySpace ipa_space;
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
+      * Check if IPA translates to secure or non-secure PA space.
+      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
+      */
+-    result->f.attrs.secure =
+-        (is_secure
+-         && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
+-         && (ipa_secure
+-             || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
++    if (in_space == ARMSS_Secure) {
++        result->f.attrs.secure =
++            !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
++            && (ipa_secure
++                || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
++        result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
++    }
+     return false;
+ }
+--
+.34.1

-[Qemu-devel] [PULL 2/5] hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values
+[PULL 6/7] accel/tcg: Zero-pad PC in TCG CPU exec trace lines
-From: Eric Auger <eric.auger@redhat.com>
+In commit f0a08b0913befbd we changed the type of the PC from
 target_ulong to vaddr.  In doing so we inadvertently dropped the
 zero-padding on the PC in trace lines (the second item inside the []
 in these lines).  They used to look like this on AArch64, for
 instance:
-The GSIV numbers of the SPI based interrupts is not correct as
+Trace 0: 0x7f2260000100 [00000000/0000000040000000/00000061/ff200000]
 ARM_SPI_BASE was not added to the irqmap[VIRT_SMMU] value. So
 this may collide with VIRTIO_MMIO irq window.
-Signed-off-by: Eric Auger <eric.auger@redhat.com>
+and now they look like this:
-Message-id: 20190312091031.5185-1-eric.auger@redhat.com
+Trace 0: 0x7f4f50000100 [00000000/40000000/00000061/ff200000]
-Reviewed-by: Shannon Zhao <shannon.zhaosl@gmail.com>
 and if the PC happens to be somewhere low like 0x5000
 then the field is shown as /5000/.
 This is because TARGET_FMT_lx is a "%08x" or "%016x" specifier,
 depending on TARGET_LONG_SIZE, whereas VADDR_PRIx is just PRIx64
 with no width specifier.
 Restore the zero-padding by adding an 016 width specifier to
 this tracing and a couple of others that were similarly recently
 changed to use VADDR_PRIx without a width specifier.
 We can't unfortunately restore the "32-bit guests are padded to
 hex digits and 64-bit guests to 16 hex digits" behaviour so
 easily.
 Fixes: f0a08b0913befbd ("accel/tcg/cpu-exec.c: Widen pc to vaddr")
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Anton Johansson <anjo@rev.ng>
+Message-id: 20230711165434.4123674-1-peter.maydell@linaro.org
 ---
- hw/arm/virt-acpi-build.c | 2 +-
+ accel/tcg/cpu-exec.c      | 4 ++--
-file changed, 1 insertion(+), 1 deletion(-)
+ accel/tcg/translate-all.c | 2 +-
 files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/virt-acpi-build.c
+--- a/accel/tcg/cpu-exec.c
-+++ b/hw/arm/virt-acpi-build.c
++++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ build_iort(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
+@@ -XXX,XX +XXX,XX @@ static void log_cpu_exec(vaddr pc, CPUState *cpu,
-     its->identifiers[0] = 0; /* MADT translation_id */
+     if (qemu_log_in_addr_range(pc)) {
+         qemu_log_mask(CPU_LOG_EXEC,
-     if (vms->iommu == VIRT_IOMMU_SMMUV3) {
+                       "Trace %d: %p [%08" PRIx64
--        int irq =  vms->irqmap[VIRT_SMMU];
+-                      "/%" VADDR_PRIx "/%08x/%08x] %s\n",
-+        int irq =  vms->irqmap[VIRT_SMMU] + ARM_SPI_BASE;
++                      "/%016" VADDR_PRIx "/%08x/%08x] %s\n",
+                       cpu->cpu_index, tb->tc.ptr, tb->cs_base, pc,
-         /* SMMUv3 node */
+                       tb->flags, tb->cflags, lookup_symbol(pc));
-         smmu_offset = iort_node_offset + node_size;
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
          if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
              vaddr pc = log_pc(cpu, last_tb);
              if (qemu_log_in_addr_range(pc)) {
 -                qemu_log("Stopped execution of TB chain before %p [%"
 +                qemu_log("Stopped execution of TB chain before %p [%016"
                           VADDR_PRIx "] %s\n",
                           last_tb->tc.ptr, pc, lookup_symbol(pc));
              }
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
 --- a/accel/tcg/translate-all.c
 +++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
      if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
          vaddr pc = log_pc(cpu, tb);
          if (qemu_log_in_addr_range(pc)) {
 -            qemu_log("cpu_io_recompile: rewound execution of TB to %"
 +            qemu_log("cpu_io_recompile: rewound execution of TB to %016"
                       VADDR_PRIx "\n", pc);
          }
      }
 --
-.20.1
+.34.1

-[Qemu-devel] [PULL 5/5] target/arm: Check access permission to ADDVL/ADDPL/RDVL
+[PULL 7/7] hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
-From: Amir Charif <amir.charif@cea.fr>
+From: Tong Ho <tong.ho@amd.com>
-These instructions do not trap when SVE is disabled in EL0,
+Add a check in the bit-set operation to write the backstore
-causing them to be executed with wrong size information.
+only if the affected bit is 0 before.
-Signed-off-by: Amir Charif <amir.charif@cea.fr>
+With this in place, there will be no need for callers to
-Message-id: 1552579248-31025-1-git-send-email-amir.charif@cea.fr
+do the checking in order to avoid unnecessary writes.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Tong Ho <tong.ho@amd.com>
-[PMM: added 'target/arm' prefix to subject]
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/translate-sve.c | 22 ++++++++++++++--------
+ hw/nvram/xlnx-efuse.c | 11 +++++++++--
-file changed, 14 insertions(+), 8 deletions(-)
+file changed, 9 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
+diff --git a/hw/nvram/xlnx-efuse.c b/hw/nvram/xlnx-efuse.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-sve.c
+--- a/hw/nvram/xlnx-efuse.c
-+++ b/target/arm/translate-sve.c
++++ b/hw/nvram/xlnx-efuse.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_INDEX_rr(DisasContext *s, arg_INDEX_rr *a)
+@@ -XXX,XX +XXX,XX @@ static bool efuse_ro_bits_find(XlnxEFuse *s, uint32_t k)
- static bool trans_ADDVL(DisasContext *s, arg_ADDVL *a)
+ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
  {
--    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
++    uint32_t set, *row;
--    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
++
--    tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
+     if (efuse_ro_bits_find(s, bit)) {
-+    if (sve_access_check(s)) {
+         g_autofree char *path = object_get_canonical_path(OBJECT(s));
-+        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
-+        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
+@@ -XXX,XX +XXX,XX @@ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
-+        tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
+         return false;
      }
 -    s->fuse32[bit / 32] |= 1 << (bit % 32);
 -    efuse_bdrv_sync(s, bit);
 +    /* Avoid back-end write unless there is a real update */
 +    row = &s->fuse32[bit / 32];
 +    set = 1 << (bit % 32);
 +    if (!(set & *row)) {
 +        *row |= set;
 +        efuse_bdrv_sync(s, bit);
 +    }
      return true;
  }
- static bool trans_ADDPL(DisasContext *s, arg_ADDPL *a)
- {
--    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
--    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
--    tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
-+    if (sve_access_check(s)) {
-+        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
-+        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
-+        tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
-+    }
-     return true;
- }
- static bool trans_RDVL(DisasContext *s, arg_RDVL *a)
- {
--    TCGv_i64 reg = cpu_reg(s, a->rd);
--    tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
-+    if (sve_access_check(s)) {
-+        TCGv_i64 reg = cpu_reg(s, a->rd);
-+        tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
-+    }
-     return true;
- }
 --
-.20.1
+.34.1

A last arm pullreq before rc0. This is mostly bug fixes,
though you could call adding the missing local timer
support to bcm2836_control a new feature I suppose --
in any case it's a small and localised change.

thanks
-- PMM

The following changes since commit 7074ab12c81a1b2b1e0e1c40983f56b2c5ccc494:

Merge remote-tracking branch 'remotes/vivier2/tags/trivial-branch-pull-request' into staging (2019-03-14 16:19:37 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190315

for you to fetch changes up to 5de56742a3c91de3d646326bec43a989bba83ca4:

target/arm: Check access permission to ADDVL/ADDPL/RDVL (2019-03-15 11:12:29 +0000)

----------------------------------------------------------------
target-arm queue:
 * Add missing SVE-enabled check to ADDVL/ADDPL/RDVL
 * virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number
 * virt-acpi-build: Fix SMMUv3 GSIV values
 * Allow EL0 to write to arch timer registers, not just read them
 * bcm2836_control: Implement local timer

----------------------------------------------------------------
Amir Charif (1):
      target/arm: Check access permission to ADDVL/ADDPL/RDVL

Dongjiu Geng (1):
      target/arm: change arch timer registers access permission

Eric Auger (1):
      hw/arm/virt-acpi-build: Fix SMMUv3 GSIV values

Wei Yang (1):
      hw/arm/virt-acpi-build: use PCIE_MMCFG_BUS to retrieve end_bus_number

Zoltán Baldaszti (1):
      hw/intc/bcm2836_control: Implement local timer

include/hw/intc/bcm2836_control.h |   9 ++++
 hw/arm/virt-acpi-build.c          |   6 +--
 hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++++++++++-
 target/arm/helper.c               |  30 +++++------
 target/arm/translate-sve.c        |  22 ++++++---
 5 files changed, 140 insertions(+), 28 deletions(-)

From: Zoltán Baldaszti <bztemail@gmail.com>

The BCM2836 control logic module includes a simple
"local timer" which is a programmable down-counter that
can generates an interrupt. Implement this functionality.

Signed-off-by: Zoltán Baldaszti <bztemail@gmail.com>
[PMM: wrote commit message; wrapped long line; tweaked
 some comments to match the final version of the code]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/intc/bcm2836_control.h |   9 +++
 hw/intc/bcm2836_control.c         | 101 +++++++++++++++++++++++++++++-
 2 files changed, 108 insertions(+), 2 deletions(-)

diff --git a/include/hw/intc/bcm2836_control.h b/include/hw/intc/bcm2836_control.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/bcm2836_control.h
+++ b/include/hw/intc/bcm2836_control.h
@@ -XXX,XX +XXX,XX @@
  * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
  * Written by Andrew Baumann
  *
+ * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
+ * Added basic IRQ_TIMER interrupt support
+ *
  * This code is licensed under the GNU GPLv2 and later.
  */
 
@@ -XXX,XX +XXX,XX @@
 #define BCM2836_CONTROL_H
 
 #include "hw/sysbus.h"
+#include "qemu/timer.h"
 
 /* 4 mailboxes per core, for 16 total */
 #define BCM2836_NCORES 4
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836ControlState {
     bool gpu_irq, gpu_fiq;
     uint8_t timerirqs[BCM2836_NCORES];
 
+    /* local timer */
+    QEMUTimer timer;
+    uint32_t local_timer_control;
+    uint8_t route_localtimer;
+
     /* interrupt source registers, post-routing (also input-derived; visible) */
     uint32_t irqsrc[BCM2836_NCORES];
     uint32_t fiqsrc[BCM2836_NCORES];
diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/bcm2836_control.c
+++ b/hw/intc/bcm2836_control.c
@@ -XXX,XX +XXX,XX @@
  * This code is licensed under the GNU GPLv2 and later.
  *
  * At present, only implements interrupt routing, and mailboxes (i.e.,
- * not local timer, PMU interrupt, or AXI counters).
+ * not PMU interrupt, or AXI counters).
+ *
+ * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
  *
  * Ref:
  * https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2836/QA7_rev3.4.pdf
@@ -XXX,XX +XXX,XX @@
 #include "qemu/log.h"
 
 #define REG_GPU_ROUTE           0x0c
+#define REG_LOCALTIMERROUTING   0x24
+#define REG_LOCALTIMERCONTROL   0x34
+#define REG_LOCALTIMERACK       0x38
 #define REG_TIMERCONTROL        0x40
 #define REG_MBOXCONTROL         0x50
 #define REG_IRQSRC              0x60
@@ -XXX,XX +XXX,XX @@
 #define IRQ_TIMER       11
 #define IRQ_MAX         IRQ_TIMER
 
+#define LOCALTIMER_FREQ      38400000
+#define LOCALTIMER_INTFLAG   (1 << 31)
+#define LOCALTIMER_RELOAD    (1 << 30)
+#define LOCALTIMER_INTENABLE (1 << 29)
+#define LOCALTIMER_ENABLE    (1 << 28)
+#define LOCALTIMER_VALUE(x)  ((x) & 0xfffffff)
+
 static void deliver_local(BCM2836ControlState *s, uint8_t core, uint8_t irq,
                           uint32_t controlreg, uint8_t controlidx)
 {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_update(BCM2836ControlState *s)
         s->fiqsrc[s->route_gpu_fiq] |= (uint32_t)1 << IRQ_GPU;
     }
 
+    /*
+     * handle the control module 'local timer' interrupt for one of the
+     * cores' IRQ/FIQ;  this is distinct from the per-CPU timer
+     * interrupts handled below.
+     */
+    if ((s->local_timer_control & LOCALTIMER_INTENABLE) &&
+        (s->local_timer_control & LOCALTIMER_INTFLAG)) {
+        if (s->route_localtimer & 4) {
+            s->fiqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
+        } else {
+            s->irqsrc[(s->route_localtimer & 3)] |= (uint32_t)1 << IRQ_TIMER;
+        }
+    }
+
     for (i = 0; i < BCM2836_NCORES; i++) {
         /* handle local timer interrupts for this core */
         if (s->timerirqs[i]) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_set_gpu_fiq(void *opaque, int irq, int level)
     bcm2836_control_update(s);
 }
 
+static void bcm2836_control_local_timer_set_next(void *opaque)
+{
+    BCM2836ControlState *s = opaque;
+    uint64_t next_event;
+
+    assert(LOCALTIMER_VALUE(s->local_timer_control) > 0);
+
+    next_event = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
+        muldiv64(LOCALTIMER_VALUE(s->local_timer_control),
+            NANOSECONDS_PER_SECOND, LOCALTIMER_FREQ);
+    timer_mod(&s->timer, next_event);
+}
+
+static void bcm2836_control_local_timer_tick(void *opaque)
+{
+    BCM2836ControlState *s = opaque;
+
+    bcm2836_control_local_timer_set_next(s);
+
+    s->local_timer_control |= LOCALTIMER_INTFLAG;
+    bcm2836_control_update(s);
+}
+
+static void bcm2836_control_local_timer_control(void *opaque, uint32_t val)
+{
+    BCM2836ControlState *s = opaque;
+
+    s->local_timer_control = val;
+    if (val & LOCALTIMER_ENABLE) {
+        bcm2836_control_local_timer_set_next(s);
+    } else {
+        timer_del(&s->timer);
+    }
+}
+
+static void bcm2836_control_local_timer_ack(void *opaque, uint32_t val)
+{
+    BCM2836ControlState *s = opaque;
+
+    if (val & LOCALTIMER_INTFLAG) {
+        s->local_timer_control &= ~LOCALTIMER_INTFLAG;
+    }
+    if ((val & LOCALTIMER_RELOAD) &&
+        (s->local_timer_control & LOCALTIMER_ENABLE)) {
+            bcm2836_control_local_timer_set_next(s);
+    }
+}
+
 static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
 {
     BCM2836ControlState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static uint64_t bcm2836_control_read(void *opaque, hwaddr offset, unsigned size)
         assert(s->route_gpu_fiq < BCM2836_NCORES
                && s->route_gpu_irq < BCM2836_NCORES);
         return ((uint32_t)s->route_gpu_fiq << 2) | s->route_gpu_irq;
+    } else if (offset == REG_LOCALTIMERROUTING) {
+        return s->route_localtimer;
+    } else if (offset == REG_LOCALTIMERCONTROL) {
+        return s->local_timer_control;
+    } else if (offset == REG_LOCALTIMERACK) {
+        return 0;
     } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
         return s->timercontrol[(offset - REG_TIMERCONTROL) >> 2];
     } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_write(void *opaque, hwaddr offset,
     if (offset == REG_GPU_ROUTE) {
         s->route_gpu_irq = val & 0x3;
         s->route_gpu_fiq = (val >> 2) & 0x3;
+    } else if (offset == REG_LOCALTIMERROUTING) {
+        s->route_localtimer = val & 7;
+    } else if (offset == REG_LOCALTIMERCONTROL) {
+        bcm2836_control_local_timer_control(s, val);
+    } else if (offset == REG_LOCALTIMERACK) {
+        bcm2836_control_local_timer_ack(s, val);
     } else if (offset >= REG_TIMERCONTROL && offset < REG_MBOXCONTROL) {
         s->timercontrol[(offset - REG_TIMERCONTROL) >> 2] = val & 0xff;
     } else if (offset >= REG_MBOXCONTROL && offset < REG_IRQSRC) {
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_reset(DeviceState *d)
 
     s->route_gpu_irq = s->route_gpu_fiq = 0;
 
+    timer_del(&s->timer);
+    s->route_localtimer = 0;
+    s->local_timer_control = 0;
+
     for (i = 0; i < BCM2836_NCORES; i++) {
         s->timercontrol[i] = 0;
         s->mailboxcontrol[i] = 0;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_control_init(Object *obj)
     /* outputs to CPU cores */
     qdev_init_gpio_out_named(dev, s->irq, "irq", BCM2836_NCORES);
     qdev_init_gpio_out_named(dev, s->fiq, "fiq", BCM2836_NCORES);
+
+    /* create a qemu virtual timer */
+    timer_init_ns(&s->timer, QEMU_CLOCK_VIRTUAL,
+                  bcm2836_control_local_timer_tick, s);
 }
 
 static const VMStateDescription vmstate_bcm2836_control = {
     .name = TYPE_BCM2836_CONTROL,
-    .version_id = 1,
+    .version_id = 2,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(mailboxes, BCM2836ControlState,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_bcm2836_control = {
         VMSTATE_UINT32_ARRAY(timercontrol, BCM2836ControlState, BCM2836_NCORES),
         VMSTATE_UINT32_ARRAY(mailboxcontrol, BCM2836ControlState,
                              BCM2836_NCORES),
+        VMSTATE_TIMER_V(timer, BCM2836ControlState, 2),
+        VMSTATE_UINT32_V(local_timer_control, BCM2836ControlState, 2),
+        VMSTATE_UINT8_V(route_localtimer, BCM2836ControlState, 2),
         VMSTATE_END_OF_LIST()
     }
 };
-- 
2.20.1

From: Eric Auger <eric.auger@redhat.com>

The GSIV numbers of the SPI based interrupts is not correct as
ARM_SPI_BASE was not added to the irqmap[VIRT_SMMU] value. So
this may collide with VIRTIO_MMIO irq window.

Signed-off-by: Eric Auger <eric.auger@redhat.com>
Message-id: 20190312091031.5185-1-eric.auger@redhat.com
Reviewed-by: Shannon Zhao <shannon.zhaosl@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

From: Dongjiu Geng <gengdongjiu@huawei.com>

Some generic arch timer registers are Config-RW in the EL0,
which means the EL0 exception level can have write permission
if it is appropriately configured.

When VM access registers, QEMU firstly checks whether they have RW
permission, then check whether it is appropriately configured.
If they are defined to read only in EL0, even though they have been
appropriately configured, they still do not have write permission.
So need to add the write permission according to ARMV8 spec when
define it.

Signed-off-by: Dongjiu Geng <gengdongjiu@huawei.com>
Message-id: 1552395177-12608-1-git-send-email-gengdongjiu@huawei.com
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 30 +++++++++++++++---------------
 1 file changed, 15 insertions(+), 15 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     /* per-timer control */
     { .name = "CNTP_CTL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
       .secure = ARM_CP_SECSTATE_NS,
-      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .fieldoffset = offsetoflow32(CPUARMState,
                                    cp15.c14_timer[GTIMER_PHYS].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     { .name = "CNTP_CTL_S",
       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 1,
       .secure = ARM_CP_SECSTATE_S,
-      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .fieldoffset = offsetoflow32(CPUARMState,
                                    cp15.c14_timer[GTIMER_SEC].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTP_CTL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 1,
-      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].ctl),
       .resetvalue = 0,
       .writefn = gt_phys_ctl_write, .raw_writefn = raw_write,
     },
     { .name = "CNTV_CTL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 1,
-      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO | ARM_CP_ALIAS, .access = PL0_RW,
       .accessfn = gt_vtimer_access,
       .fieldoffset = offsetoflow32(CPUARMState,
                                    cp15.c14_timer[GTIMER_VIRT].ctl),
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTV_CTL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 1,
-      .type = ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_vtimer_access,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].ctl),
       .resetvalue = 0,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     /* TimerValue views: a 32 bit downcounting view of the underlying state */
     { .name = "CNTP_TVAL", .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
       .secure = ARM_CP_SECSTATE_NS,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
     },
     { .name = "CNTP_TVAL_S",
       .cp = 15, .crn = 14, .crm = 2, .opc1 = 0, .opc2 = 0,
       .secure = ARM_CP_SECSTATE_S,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access,
       .readfn = gt_sec_tval_read, .writefn = gt_sec_tval_write,
     },
     { .name = "CNTP_TVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 0,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_ptimer_access, .resetfn = gt_phys_timer_reset,
       .readfn = gt_phys_tval_read, .writefn = gt_phys_tval_write,
     },
     { .name = "CNTV_TVAL", .cp = 15, .crn = 14, .crm = 3, .opc1 = 0, .opc2 = 0,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_vtimer_access,
       .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
     },
     { .name = "CNTV_TVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 0,
-      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL1_RW | PL0_R,
+      .type = ARM_CP_NO_RAW | ARM_CP_IO, .access = PL0_RW,
       .accessfn = gt_vtimer_access, .resetfn = gt_virt_timer_reset,
       .readfn = gt_virt_tval_read, .writefn = gt_virt_tval_write,
     },
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     /* Comparison value, indicating when the timer goes off */
     { .name = "CNTP_CVAL", .cp = 15, .crm = 14, .opc1 = 2,
       .secure = ARM_CP_SECSTATE_NS,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTP_CVAL_S", .cp = 15, .crm = 14, .opc1 = 2,
       .secure = ARM_CP_SECSTATE_S,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_SEC].cval),
       .accessfn = gt_ptimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTP_CVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 2, .opc2 = 2,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_IO,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_PHYS].cval),
       .resetvalue = 0, .accessfn = gt_ptimer_access,
       .writefn = gt_phys_cval_write, .raw_writefn = raw_write,
     },
     { .name = "CNTV_CVAL", .cp = 15, .crm = 14, .opc1 = 3,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_64BIT | ARM_CP_IO | ARM_CP_ALIAS,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
       .accessfn = gt_vtimer_access,
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo generic_timer_cp_reginfo[] = {
     },
     { .name = "CNTV_CVAL_EL0", .state = ARM_CP_STATE_AA64,
       .opc0 = 3, .opc1 = 3, .crn = 14, .crm = 3, .opc2 = 2,
-      .access = PL1_RW | PL0_R,
+      .access = PL0_RW,
       .type = ARM_CP_IO,
       .fieldoffset = offsetof(CPUARMState, cp15.c14_timer[GTIMER_VIRT].cval),
       .resetvalue = 0, .accessfn = gt_vtimer_access,
-- 
2.20.1

From: Wei Yang <richardw.yang@linux.intel.com>

This is more proper to use PCIE_MMCFG_BUS to retrieve end_bus_number.

Signed-off-by: Wei Yang <richardw.yang@linux.intel.com>
Reviewed-by: Eric Auger <eric.auger@redhat.com>
Reviewed-by: Igor Mammedov <imammedo@redhat.com>
Message-id: 20190312074953.16671-1-richardw.yang@linux.intel.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/virt-acpi-build.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/arm/virt-acpi-build.c b/hw/arm/virt-acpi-build.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt-acpi-build.c
+++ b/hw/arm/virt-acpi-build.c
@@ -XXX,XX +XXX,XX @@ build_mcfg(GArray *table_data, BIOSLinker *linker, VirtMachineState *vms)
     /* Only a single allocation so no need to play with segments */
     mcfg->allocation[0].pci_segment = cpu_to_le16(0);
     mcfg->allocation[0].start_bus_number = 0;
-    mcfg->allocation[0].end_bus_number = (memmap[ecam_id].size
-                                          / PCIE_MMCFG_SIZE_MIN) - 1;
+    mcfg->allocation[0].end_bus_number =
+        PCIE_MMCFG_BUS(memmap[ecam_id].size - 1);
 
     build_header(linker, table_data, (void *)(table_data->data + mcfg_start),
                  "MCFG", table_data->len - mcfg_start, 1, NULL, NULL);
-- 
2.20.1

From: Amir Charif <amir.charif@cea.fr>

These instructions do not trap when SVE is disabled in EL0,
causing them to be executed with wrong size information.

Signed-off-by: Amir Charif <amir.charif@cea.fr>
Message-id: 1552579248-31025-1-git-send-email-amir.charif@cea.fr
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
[PMM: added 'target/arm' prefix to subject]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-sve.c | 22 ++++++++++++++--------
 1 file changed, 14 insertions(+), 8 deletions(-)

diff --git a/target/arm/translate-sve.c b/target/arm/translate-sve.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-sve.c
+++ b/target/arm/translate-sve.c
@@ -XXX,XX +XXX,XX @@ static bool trans_INDEX_rr(DisasContext *s, arg_INDEX_rr *a)
 
 static bool trans_ADDVL(DisasContext *s, arg_ADDVL *a)
 {
-    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
-    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
-    tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
+    if (sve_access_check(s)) {
+        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
+        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
+        tcg_gen_addi_i64(rd, rn, a->imm * vec_full_reg_size(s));
+    }
     return true;
 }
 
 static bool trans_ADDPL(DisasContext *s, arg_ADDPL *a)
 {
-    TCGv_i64 rd = cpu_reg_sp(s, a->rd);
-    TCGv_i64 rn = cpu_reg_sp(s, a->rn);
-    tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
+    if (sve_access_check(s)) {
+        TCGv_i64 rd = cpu_reg_sp(s, a->rd);
+        TCGv_i64 rn = cpu_reg_sp(s, a->rn);
+        tcg_gen_addi_i64(rd, rn, a->imm * pred_full_reg_size(s));
+    }
     return true;
 }
 
 static bool trans_RDVL(DisasContext *s, arg_RDVL *a)
 {
-    TCGv_i64 reg = cpu_reg(s, a->rd);
-    tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
+    if (sve_access_check(s)) {
+        TCGv_i64 reg = cpu_reg(s, a->rd);
+        tcg_gen_movi_i64(reg, a->imm * vec_full_reg_size(s));
+    }
     return true;
 }
 
-- 
2.20.1

A last small test of bug fixes before rc1.

thanks
-- PMM

The following changes since commit ed8ad9728a9c0eec34db9dff61dfa2f1dd625637:

Merge tag 'pull-tpm-2023-07-14-1' of https://github.com/stefanberger/qemu-tpm into staging (2023-07-15 14:54:04 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230717

for you to fetch changes up to c2c1c4a35c7c2b1a4140b0942b9797c857e476a4:

hw/nvram: Avoid unnecessary Xilinx eFuse backstore write (2023-07-17 11:05:52 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/sbsa-ref: set 'slots' property of xhci
 * linux-user: Remove pointless NULL check in clock_adjtime handling
 * ptw: Fix S1_ptw_translate() debug path
 * ptw: Account for FEAT_RME when applying {N}SW, SA bits
 * accel/tcg: Zero-pad PC in TCG CPU exec trace lines
 * hw/nvram: Avoid unnecessary Xilinx eFuse backstore write

----------------------------------------------------------------
Peter Maydell (5):
      linux-user: Remove pointless NULL check in clock_adjtime handling
      target/arm/ptw.c: Add comments to S1Translate struct fields
      target/arm: Fix S1_ptw_translate() debug path
      target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
      accel/tcg: Zero-pad PC in TCG CPU exec trace lines

Tong Ho (1):
      hw/nvram: Avoid unnecessary Xilinx eFuse backstore write

Yuquan Wang (1):
      hw/arm/sbsa-ref: set 'slots' property of xhci

From: Yuquan Wang <wangyuquan1236@phytium.com.cn>

This extends the slots of xhci to 64, since the default xhci_sysbus
just supports one slot.

Signed-off-by: Wang Yuquan <wangyuquan1236@phytium.com.cn>
Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20230710063750.473510-2-wangyuquan1236@phytium.com.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static void create_xhci(const SBSAMachineState *sms)
     hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
     int irq = sbsa_ref_irqmap[SBSA_XHCI];
     DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
+    qdev_prop_set_uint32(dev, "slots", XHCI_MAXSLOTS);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
-- 
2.34.1

In the code for TARGET_NR_clock_adjtime, we set the pointer phtx to
the address of the local variable htx.  This means it can never be
NULL, but later in the code we check it for NULL anyway.  Coverity
complains about this (CID 1507683) because the NULL check comes after
a call to clock_adjtime() that assumes it is non-NULL.

Since phtx is always &htx, and is used only in three places, it's not
really necessary.  Remove it, bringing the code structure in to line
with that for TARGET_NR_clock_adjtime64, which already uses a simple
'&htx' when it wants a pointer to 'htx'.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230623144410.1837261-1-peter.maydell@linaro.org
---
 linux-user/syscall.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
     case TARGET_NR_clock_adjtime:
         {
-            struct timex htx, *phtx = &htx;
+            struct timex htx;
 
-            if (target_to_host_timex(phtx, arg2) != 0) {
+            if (target_to_host_timex(&htx, arg2) != 0) {
                 return -TARGET_EFAULT;
             }
-            ret = get_errno(clock_adjtime(arg1, phtx));
-            if (!is_error(ret) && phtx) {
-                if (host_to_target_timex(arg2, phtx) != 0) {
-                    return -TARGET_EFAULT;
-                }
+            ret = get_errno(clock_adjtime(arg1, &htx));
+            if (!is_error(ret) && host_to_target_timex(arg2, &htx)) {
+                return -TARGET_EFAULT;
             }
         }
         return ret;
-- 
2.34.1

Add comments to the in_* fields in the S1Translate struct
that explain what they're doing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-2-peter.maydell@linaro.org
---
 target/arm/ptw.c | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@
 #endif
 
 typedef struct S1Translate {
+    /*
+     * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
+     * Together with in_space, specifies the architectural translation regime.
+     */
     ARMMMUIdx in_mmu_idx;
+    /*
+     * in_ptw_idx: specifies which mmuidx to use for the actual
+     * page table descriptor load operations. This will be one of the
+     * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     */
     ARMMMUIdx in_ptw_idx;
+    /*
+     * in_space: the security space for this walk. This plus
+     * the in_mmu_idx specify the architectural translation regime.
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     *
+     * Note that the security space for the in_ptw_idx may be different
+     * from that for the in_mmu_idx. We do not need to explicitly track
+     * the in_ptw_idx security space because:
+     *  - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
+     *    itself specifies the security space
+     *  - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
+     *    space used for ptw reads is the same as that of the security
+     *    space of the stage 1 translation for all cases except where
+     *    stage 1 is Secure; in that case the only possibilities for
+     *    the ptw read are Secure and NonSecure, and the in_ptw_idx
+     *    value being Stage2 vs Stage2_S distinguishes those.
+     */
     ARMSecuritySpace in_space;
+    /*
+     * in_secure: whether the translation regime is a Secure one.
+     * This is always equal to arm_space_is_secure(in_space).
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     */
     bool in_secure;
+    /*
+     * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
+     * accesses will not update the guest page table access flags
+     * and will not change the state of the softmmu TLBs.
+     */
     bool in_debug;
     /*
      * If this is stage 2 of a stage 1+2 page table walk, then this must
-- 
2.34.1

In commit fe4a5472ccd6 we rearranged the logic in S1_ptw_translate()
so that the debug-access "call get_phys_addr_*" codepath is used both
when S1 is doing ptw reads from stage 2 and when it is doing ptw
reads from physical memory.  However, we didn't update the
calculation of s2ptw->in_space and s2ptw->in_secure to account for
the "ptw reads from physical memory" case.  This meant that debug
accesses when in Secure state broke.

Create a new function S2_security_space() which returns the
correct security space to use for the ptw load, and use it to
determine the correct .in_secure and .in_space fields for the
stage 2 lookup for the ptw load.

Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org
Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 37 ++++++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
     }
 }
 
+static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
+                                          ARMMMUIdx s2_mmu_idx)
+{
+    /*
+     * Return the security space to use for stage 2 when doing
+     * the S1 page table descriptor load.
+     */
+    if (regime_is_stage2(s2_mmu_idx)) {
+        /*
+         * The security space for ptw reads is almost always the same
+         * as that of the security space of the stage 1 translation.
+         * The only exception is when stage 1 is Secure; in that case
+         * the ptw read might be to the Secure or the NonSecure space
+         * (but never Realm or Root), and the s2_mmu_idx tells us which.
+         * Root translations are always single-stage.
+         */
+        if (s1_space == ARMSS_Secure) {
+            return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
+        } else {
+            assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
+            assert(s1_space != ARMSS_Root);
+            return s1_space;
+        }
+    } else {
+        /* ptw loads are from phys: the mmu idx itself says which space */
+        return arm_phys_to_space(s2_mmu_idx);
+    }
+}
+
 /* Translate a S1 pagetable walk through S2 if needed.  */
 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                              hwaddr addr, ARMMMUFaultInfo *fi)
 {
-    ARMSecuritySpace space = ptw->in_space;
     bool is_secure = ptw->in_secure;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
          * From gdbstub, do not use softmmu so that we don't modify the
          * state of the cpu at all, including softmmu tlb contents.
          */
+        ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
         S1Translate s2ptw = {
             .in_mmu_idx = s2_mmu_idx,
             .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
-            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
-                         : space == ARMSS_Realm ? ARMSS_Realm
-                         : ARMSS_NonSecure),
+            .in_secure = arm_space_is_secure(s2_space),
+            .in_space = s2_space,
             .in_debug = true,
         };
         GetPhysAddrResult s2 = { };
-- 
2.34.1

In get_phys_addr_twostage() the code that applies the effects of
VSTCR.{SA,SW} and VTCR.{NSA,NSW} only updates result->f.attrs.secure.
Now we also have f.attrs.space for FEAT_RME, we need to keep the two
in sync.

These bits only have an effect for Secure space translations, not
for Root, so use the input in_space field to determine whether to
apply them rather than the input is_secure. This doesn't actually
make a difference because Root translations are never two-stage,
but it's a little clearer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-4-peter.maydell@linaro.org
---
 target/arm/ptw.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     hwaddr ipa;
     int s1_prot, s1_lgpgsz;
     bool is_secure = ptw->in_secure;
+    ARMSecuritySpace in_space = ptw->in_space;
     bool ret, ipa_secure;
     ARMCacheAttrs cacheattrs1;
     ARMSecuritySpace ipa_space;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      * Check if IPA translates to secure or non-secure PA space.
      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
      */
-    result->f.attrs.secure =
-        (is_secure
-         && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
-         && (ipa_secure
-             || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
+    if (in_space == ARMSS_Secure) {
+        result->f.attrs.secure =
+            !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
+            && (ipa_secure
+                || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
+        result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
+    }
 
     return false;
 }
-- 
2.34.1

In commit f0a08b0913befbd we changed the type of the PC from
target_ulong to vaddr.  In doing so we inadvertently dropped the
zero-padding on the PC in trace lines (the second item inside the []
in these lines).  They used to look like this on AArch64, for
instance:

Trace 0: 0x7f2260000100 [00000000/0000000040000000/00000061/ff200000]

and now they look like this:
Trace 0: 0x7f4f50000100 [00000000/40000000/00000061/ff200000]

and if the PC happens to be somewhere low like 0x5000
then the field is shown as /5000/.

This is because TARGET_FMT_lx is a "%08x" or "%016x" specifier,
depending on TARGET_LONG_SIZE, whereas VADDR_PRIx is just PRIx64
with no width specifier.

Restore the zero-padding by adding an 016 width specifier to
this tracing and a couple of others that were similarly recently
changed to use VADDR_PRIx without a width specifier.

We can't unfortunately restore the "32-bit guests are padded to
8 hex digits and 64-bit guests to 16 hex digits" behaviour so
easily.

Fixes: f0a08b0913befbd ("accel/tcg/cpu-exec.c: Widen pc to vaddr")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-id: 20230711165434.4123674-1-peter.maydell@linaro.org
---
 accel/tcg/cpu-exec.c      | 4 ++--
 accel/tcg/translate-all.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static void log_cpu_exec(vaddr pc, CPUState *cpu,
     if (qemu_log_in_addr_range(pc)) {
         qemu_log_mask(CPU_LOG_EXEC,
                       "Trace %d: %p [%08" PRIx64
-                      "/%" VADDR_PRIx "/%08x/%08x] %s\n",
+                      "/%016" VADDR_PRIx "/%08x/%08x] %s\n",
                       cpu->cpu_index, tb->tc.ptr, tb->cs_base, pc,
                       tb->flags, tb->cflags, lookup_symbol(pc));
 
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
         if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
             vaddr pc = log_pc(cpu, last_tb);
             if (qemu_log_in_addr_range(pc)) {
-                qemu_log("Stopped execution of TB chain before %p [%"
+                qemu_log("Stopped execution of TB chain before %p [%016"
                          VADDR_PRIx "] %s\n",
                          last_tb->tc.ptr, pc, lookup_symbol(pc));
             }
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
         vaddr pc = log_pc(cpu, tb);
         if (qemu_log_in_addr_range(pc)) {
-            qemu_log("cpu_io_recompile: rewound execution of TB to %"
+            qemu_log("cpu_io_recompile: rewound execution of TB to %016"
                      VADDR_PRIx "\n", pc);
         }
     }
-- 
2.34.1

From: Tong Ho <tong.ho@amd.com>

Add a check in the bit-set operation to write the backstore
only if the affected bit is 0 before.

With this in place, there will be no need for callers to
do the checking in order to avoid unnecessary writes.

Signed-off-by: Tong Ho <tong.ho@amd.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/nvram/xlnx-efuse.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/nvram/xlnx-efuse.c b/hw/nvram/xlnx-efuse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/xlnx-efuse.c
+++ b/hw/nvram/xlnx-efuse.c
@@ -XXX,XX +XXX,XX @@ static bool efuse_ro_bits_find(XlnxEFuse *s, uint32_t k)
 
 bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
 {
+    uint32_t set, *row;
+
     if (efuse_ro_bits_find(s, bit)) {
         g_autofree char *path = object_get_canonical_path(OBJECT(s));
 
@@ -XXX,XX +XXX,XX @@ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
         return false;
     }
 
-    s->fuse32[bit / 32] |= 1 << (bit % 32);
-    efuse_bdrv_sync(s, bit);
+    /* Avoid back-end write unless there is a real update */
+    row = &s->fuse32[bit / 32];
+    set = 1 << (bit % 32);
+    if (!(set & *row)) {
+        *row |= set;
+        efuse_bdrv_sync(s, bit);
+    }
     return true;
 }
 
-- 
2.34.1