Series comparison

-[PULL 0/9] target-arm queue
+[PULL 0/4] target-arm queue
-target-arm queue: nothing major here, but no point
+Arm patches for rc3 : just a handful of bug fixes.
 sitting on them waiting for more stuff to come along.
 thanks
 -- PMM
-The following changes since commit 1329132d28bf14b9508f7a1f04a2c63422bc3f99:
-  Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2019-09-26 16:14:03 +0100)
+The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:
   Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190927
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126
-for you to fetch changes up to e4e34855e658b78ecac50a651cc847662ff02cfd:
+for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:
-  hw/arm/boot: Use the IEC binary prefix definitions (2019-09-27 11:44:39 +0100)
+  target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * Fix the CBAR register implementation for Cortex-A53,
+ * handle FTYPE flag correctly in v7M exception return
-   Cortex-A57, Cortex-A72
+   for v7M CPUs with an FPU (v8M CPUs were already correct)
- * Fix direct booting of Linux kernels on emulated CPUs
+ * versal: Add the CRP as unimplemented
-   which have an AArch32 EL3 (incorrect NSACR settings
+ * Fix ISR_EL1 tracking when executing at EL2
-   meant they could not access the FPU)
+ * Honor HCR_EL2.TID3 trapping requirements
  * semihosting cleanup: do more work at translate time
    and less work at runtime
 ----------------------------------------------------------------
-Alex Bennée (6):
+Edgar E. Iglesias (1):
-      tests/tcg: clean-up some comments after the de-tangling
+      hw/arm: versal: Add the CRP as unimplemented
       target/arm: handle M-profile semihosting at translate time
       target/arm: handle A-profile semihosting at translate time
       target/arm: remove run time semihosting checks
       target/arm: remove run-time semihosting checks for linux-user
       tests/tcg: add linux-user semihosting smoke test for ARM
-Luc Michel (1):
+Jean-Hugues Deschênes (1):
-      target/arm: fix CBAR register for AArch64 CPUs
+      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
-Peter Maydell (1):
+Marc Zyngier (2):
-      hw/arm/boot.c: Set NSACR.{CP11,CP10} for NS kernel boots
+      target/arm: Fix ISR_EL1 tracking when executing at EL2
       target/arm: Honor HCR_EL2.TID3 trapping requirements
-Philippe Mathieu-Daudé (1):
+ include/hw/arm/xlnx-versal.h |  3 ++
-      hw/arm/boot: Use the IEC binary prefix definitions
+ hw/arm/xlnx-versal.c         |  2 ++
  target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
  target/arm/m_helper.c        |  7 ++--
 files changed, 89 insertions(+), 6 deletions(-)
- tests/tcg/Makefile.target         |   7 ++-
- tests/tcg/aarch64/Makefile.target |   8 ++-
- tests/tcg/arm/Makefile.target     |  20 ++++---
- linux-user/arm/target_syscall.h   |   3 -
- hw/arm/boot.c                     |  12 ++--
- linux-user/arm/cpu_loop.c         |   3 -
- target/arm/helper.c               | 115 +++++++++++++-------------------------
- target/arm/m_helper.c             |  18 ++----
- target/arm/translate.c            |  30 ++++++++--
- tests/tcg/arm/semihosting.c       |  45 +++++++++++++++
-files changed, 146 insertions(+), 115 deletions(-)
- create mode 100644 tests/tcg/arm/semihosting.c

-[PULL 3/9] target/arm: handle M-profile semihosting at translate time
+[PULL 1/4] target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>
-We do this for other semihosting calls so we might as well do it for
+According to the PushStack() pseudocode in the armv7m RM,
-M-profile as well.
+bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
 an FPU is present. Current implementation is doing it for
 armv8, but not for armv7. This patch makes the existing
 logic applicable to both code paths.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20190913151845.12582-3-alex.bennee@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/m_helper.c  | 18 ++++++------------
+ target/arm/m_helper.c | 7 +++----
- target/arm/translate.c | 11 ++++++++++-
+file changed, 3 insertions(+), 4 deletions(-)
 files changed, 16 insertions(+), 13 deletions(-)
 diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/m_helper.c
 +++ b/target/arm/m_helper.c
 @@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-             break;
+         if (env->v7m.secure) {
              lr |= R_V7M_EXCRET_S_MASK;
          }
-         break;
+-        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-+    case EXCP_SEMIHOST:
+-            lr |= R_V7M_EXCRET_FTYPE_MASK;
 +        qemu_log_mask(CPU_LOG_INT,
 +                      "...handling as semihosting call 0x%x\n",
 +                      env->regs[0]);
 +        env->regs[0] = do_arm_semihosting(env);
 +        return;
      case EXCP_BKPT:
 -        if (semihosting_enabled()) {
 -            int nr;
 -            nr = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) & 0xff;
 -            if (nr == 0xab) {
 -                env->regs[15] += 2;
 -                qemu_log_mask(CPU_LOG_INT,
 -                              "...handling as semihosting call 0x%x\n",
 -                              env->regs[0]);
 -                env->regs[0] = do_arm_semihosting(env);
 -                return;
 -            }
 -        }
-         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false);
+     } else {
-         break;
+         lr = R_V7M_EXCRET_RES1_MASK |
-     case EXCP_IRQ:
+             R_V7M_EXCRET_S_MASK |
-diff --git a/target/arm/translate.c b/target/arm/translate.c
+             R_V7M_EXCRET_DCRS_MASK |
-index XXXXXXX..XXXXXXX 100644
+-            R_V7M_EXCRET_FTYPE_MASK |
---- a/target/arm/translate.c
+             R_V7M_EXCRET_ES_MASK;
-+++ b/target/arm/translate.c
+         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
-@@ -XXX,XX +XXX,XX @@ static bool trans_BKPT(DisasContext *s, arg_BKPT *a)
+             lr |= R_V7M_EXCRET_SPSEL_MASK;
-     if (!ENABLE_ARCH_5) {
+         }
          return false;
      }
--    gen_exception_bkpt_insn(s, syn_aa32_bkpt(a->imm, false));
++    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-+    if (arm_dc_feature(s, ARM_FEATURE_M) &&
++        lr |= R_V7M_EXCRET_FTYPE_MASK;
 +        semihosting_enabled() &&
 +#ifndef CONFIG_USER_ONLY
 +        !IS_USER(s) &&
 +#endif
 +        (a->imm == 0xab)) {
 +        gen_exception_internal_insn(s, s->base.pc_next, EXCP_SEMIHOST);
 +    } else {
 +        gen_exception_bkpt_insn(s, syn_aa32_bkpt(a->imm, false));
 +    }
-     return true;
+     if (!arm_v7m_is_handler_mode(env)) {
- }
+         lr |= R_V7M_EXCRET_MODE_MASK;
+     }
 --
 .20.1

-[PULL 9/9] hw/arm/boot: Use the IEC binary prefix definitions
+[PULL 2/4] hw/arm: versal: Add the CRP as unimplemented
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-IEC binary prefixes ease code review: the unit is explicit.
+Add the CRP as unimplemented thus avoiding bus errors when
 guests access these registers.
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
+Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
 Message-id: 20190923131108.21459-1-philmd@redhat.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/boot.c | 10 +++++-----
+ include/hw/arm/xlnx-versal.h | 3 +++
-file changed, 5 insertions(+), 5 deletions(-)
+ hw/arm/xlnx-versal.c         | 2 ++
 files changed, 5 insertions(+)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/include/hw/arm/xlnx-versal.h
-+++ b/hw/arm/boot.c
++++ b/include/hw/arm/xlnx-versal.h
-@@ -XXX,XX +XXX,XX @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
+@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
-         goto fail;
+ #define MM_IOU_SCNTRS_SIZE          0x10000
-     }
+ #define MM_FPD_CRF                  0xfd1a0000U
+ #define MM_FPD_CRF_SIZE             0x140000
--    if (scells < 2 && binfo->ram_size >= (1ULL << 32)) {
++
-+    if (scells < 2 && binfo->ram_size >= 4 * GiB) {
++#define MM_PMC_CRP                  0xf1260000U
-         /* This is user error so deserves a friendlier error message
++#define MM_PMC_CRP_SIZE             0x10000
-          * than the failure of setprop_sized_cells would provide
+ #endif
-          */
+diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+index XXXXXXX..XXXXXXX 100644
-      * we might still make a bad choice here.
+--- a/hw/arm/xlnx-versal.c
-      */
++++ b/hw/arm/xlnx-versal.c
-     info->initrd_start = info->loader_start +
+@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
--        MIN(info->ram_size / 2, 128 * 1024 * 1024);
+                         MM_CRL, MM_CRL_SIZE);
-+        MIN(info->ram_size / 2, 128 * MiB);
+     versal_unimp_area(s, "crf", &s->mr_ps,
-     if (image_high_addr) {
+                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
-         info->initrd_start = MAX(info->initrd_start, image_high_addr);
++    versal_unimp_area(s, "crp", &s->mr_ps,
-     }
++                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
-@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
+     versal_unimp_area(s, "iou-scntr", &s->mr_ps,
-                  *
+                         MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
-                  * Let's play safe and prealign it to 2MB to give us some space.
+     versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
                   */
 -                align = 2 * 1024 * 1024;
 +                align = 2 * MiB;
              } else {
                  /*
                   * Some 32bit kernels will trash anything in the 4K page the
                   * initrd ends in, so make sure the DTB isn't caught up in that.
                   */
 -                align = 4096;
 +                align = 4 * KiB;
              }
              /* Place the DTB after the initrd in memory with alignment. */
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
                  info->loader_start + KERNEL_ARGS_ADDR;
              fixupcontext[FIXUP_ARGPTR_HI] =
                  (info->loader_start + KERNEL_ARGS_ADDR) >> 32;
 -            if (info->ram_size >= (1ULL << 32)) {
 +            if (info->ram_size >= 4 * GiB) {
                  error_report("RAM size must be less than 4GB to boot"
                               " Linux kernel using ATAGS (try passing a device tree"
                               " using -dtb)");
 --
 .20.1

-[PULL 5/9] target/arm: remove run time semihosting checks
+[PULL 3/4] target/arm: Fix ISR_EL1 tracking when executing at EL2
-From: Alex Bennée <alex.bennee@linaro.org>
+From: Marc Zyngier <maz@kernel.org>
-Now we do all our checking and use a common EXCP_SEMIHOST for
+The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
-semihosting operations we can make helper code a lot simpler.
+ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
 SError interrupts.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
+Unfortunately, QEMU's implementation only considers the HCR_EL2
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+bits, and ignores the current exception level. This means a hypervisor
-Message-id: 20190913151845.12582-5-alex.bennee@linaro.org
+trying to look at its own interrupt state actually sees the guest
 state, which is unexpected and breaks KVM as of Linux 5.3.
 Instead, check for the running EL and return the physical bits
 if not running in a virtualized context.
 Fixes: 636540e9c40b
 Cc: qemu-stable@nongnu.org
 Reported-by: Quentin Perret <qperret@google.com>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Message-id: 20191122135833.28953-1-maz@kernel.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 96 +++++++++++----------------------------------
+ target/arm/helper.c | 7 +++++--
-file changed, 22 insertions(+), 74 deletions(-)
+file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-                   new_el, env->pc, pstate_read(env));
+     CPUState *cs = env_cpu(env);
- }
+     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
+     uint64_t ret = 0;
--static inline bool check_for_semihosting(CPUState *cs)
++    bool allow_virt = (arm_current_el(env) == 1 &&
--{
++                       (!arm_is_secure_below_el3(env) ||
-+/*
++                        (env->cp15.scr_el3 & SCR_EEL2)));
-+ * Do semihosting call and set the appropriate return value. All the
-+ * permission and validity checks have been done at translate time.
+-    if (hcr_el2 & HCR_IMO) {
-+ *
++    if (allow_virt && (hcr_el2 & HCR_IMO)) {
-+ * We only see semihosting exceptions in TCG only as they are not
+         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
-+ * trapped to the hypervisor in KVM.
+             ret |= CPSR_I;
-+ */
+         }
- #ifdef CONFIG_TCG
+@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
--    /* Check whether this exception is a semihosting call; if so
+         }
 -     * then handle it and return true; otherwise return false.
 -     */
 +static void handle_semihosting(CPUState *cs)
 +{
      ARMCPU *cpu = ARM_CPU(cs);
      CPUARMState *env = &cpu->env;
      if (is_a64(env)) {
 -        if (cs->exception_index == EXCP_SEMIHOST) {
 -            /* This is always the 64-bit semihosting exception.
 -             * The "is this usermode" and "is semihosting enabled"
 -             * checks have been done at translate time.
 -             */
 -            qemu_log_mask(CPU_LOG_INT,
 -                          "...handling as semihosting call 0x%" PRIx64 "\n",
 -                          env->xregs[0]);
 -            env->xregs[0] = do_arm_semihosting(env);
 -            return true;
 -        }
 -        return false;
 +        qemu_log_mask(CPU_LOG_INT,
 +                      "...handling as semihosting call 0x%" PRIx64 "\n",
 +                      env->xregs[0]);
 +        env->xregs[0] = do_arm_semihosting(env);
      } else {
 -        uint32_t imm;
 -
 -        /* Only intercept calls from privileged modes, to provide some
 -         * semblance of security.
 -         */
 -        if (cs->exception_index != EXCP_SEMIHOST &&
 -            (!semihosting_enabled() ||
 -             ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR))) {
 -            return false;
 -        }
 -
 -        switch (cs->exception_index) {
 -        case EXCP_SEMIHOST:
 -            /* This is always a semihosting call; the "is this usermode"
 -             * and "is semihosting enabled" checks have been done at
 -             * translate time.
 -             */
 -            break;
 -        case EXCP_SWI:
 -            /* Check for semihosting interrupt.  */
 -            if (env->thumb) {
 -                imm = arm_lduw_code(env, env->regs[15] - 2, arm_sctlr_b(env))
 -                    & 0xff;
 -                if (imm == 0xab) {
 -                    break;
 -                }
 -            } else {
 -                imm = arm_ldl_code(env, env->regs[15] - 4, arm_sctlr_b(env))
 -                    & 0xffffff;
 -                if (imm == 0x123456) {
 -                    break;
 -                }
 -            }
 -            return false;
 -        case EXCP_BKPT:
 -            /* See if this is a semihosting syscall.  */
 -            if (env->thumb) {
 -                imm = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env))
 -                    & 0xff;
 -                if (imm == 0xab) {
 -                    env->regs[15] += 2;
 -                    break;
 -                }
 -            }
 -            return false;
 -        default:
 -            return false;
 -        }
 -
          qemu_log_mask(CPU_LOG_INT,
                        "...handling as semihosting call 0x%x\n",
                        env->regs[0]);
          env->regs[0] = do_arm_semihosting(env);
 -        return true;
      }
--#else
--    return false;
+-    if (hcr_el2 & HCR_FMO) {
--#endif
++    if (allow_virt && (hcr_el2 & HCR_FMO)) {
- }
+         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
-+#endif
+             ret |= CPSR_F;
+         }
  /* Handle a CPU exception for A and R profile CPUs.
   * Do any appropriate logging, handle PSCI calls, and then hand off
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
          return;
      }
 -    /* Semihosting semantics depend on the register width of the
 -     * code that caused the exception, not the target exception level,
 -     * so must be handled here.
 +    /*
 +     * Semihosting semantics depend on the register width of the code
 +     * that caused the exception, not the target exception level, so
 +     * must be handled here.
       */
 -    if (check_for_semihosting(cs)) {
 +#ifdef CONFIG_TCG
 +    if (cs->exception_index == EXCP_SEMIHOST) {
 +        handle_semihosting(cs);
          return;
      }
 +#endif
      /* Hooks may change global state so BQL should be held, also the
       * BQL needs to be held for any modification of
 --
 .20.1

-[PULL 1/9] target/arm: fix CBAR register for AArch64 CPUs
+[PULL 4/4] target/arm: Honor HCR_EL2.TID3 trapping requirements
-From: Luc Michel <luc.michel@greensocs.com>
+From: Marc Zyngier <maz@kernel.org>
-For AArch64 CPUs with a CBAR register, we have two views for it:
+HCR_EL2.TID3 mandates that access from EL1 to a long list of id
-  - in AArch64 state, the CBAR_EL1 register (S3_1_C15_C3_0), returns the
+registers traps to EL2, and QEMU has so far ignored this requirement.
-    full 64 bits CBAR value
-  - in AArch32 state, the CBAR register (cp15, opc1=1, CRn=15, CRm=3, opc2=0)
+This breaks (among other things) KVM guests that have PtrAuth enabled,
-    returns a 32 bits view such that:
+while the hypervisor doesn't want to expose the feature to its guest.
-      CBAR = CBAR_EL1[31:18] 0..0 CBAR_EL1[43:32]
+To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
+case), and masks out the unsupported feature.
-This commit fixes the current implementation where:
-  - CBAR_EL1 was returning the 32 bits view instead of the full 64 bits
+QEMU not honoring the trap request means that the guest observes
-    value,
+that the feature is present in the HW, starts using it, and dies
-  - CBAR was returning a truncated 32 bits version of the full 64 bits
+a horrible death when KVM injects an UNDEF, because the feature
-    one, instead of the 32 bits view
+*really* isn't supported.
-  - CBAR was declared as cp15, opc1=4, CRn=15, CRm=0, opc2=0, which is
-    the CBAR register found in the ARMv7 Cortex-Ax CPUs, but not in
+Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.
-    ARMv8 CPUs.
+Note that this change does not include trapping of the MVFR
-Signed-off-by: Luc Michel <luc.michel@greensocs.com>
+registers from AArch32 (they are accessed via the VMRS
-Message-id: 20190912110103.1417887-1-luc.michel@greensocs.com
+instruction and need to be handled in a different way).
-[PMM: Added a comment about the two different kinds of CBAR]
 Reported-by: Will Deacon <will@kernel.org>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Tested-by: Will Deacon <will@kernel.org>
 Message-id: 20191123115618.29230-1-maz@kernel.org
 [PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
  changed names of access functions to include _tid3]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 19 ++++++++++++++++---
+ target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
-file changed, 16 insertions(+), 3 deletions(-)
+file changed, 76 insertions(+)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
+     REGINFO_SENTINEL
+ };
++static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
++                                       bool isread)
++{
++    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
++        return CP_ACCESS_TRAP_EL2;
++    }
++
++    return CP_ACCESS_OK;
++}
++
++static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
++                                       bool isread)
++{
++    if (arm_feature(env, ARM_FEATURE_V8)) {
++        return access_aa64_tid3(env, ri, isread);
++    }
++
++    return CP_ACCESS_OK;
++}
++
+ void register_cp_regs_for_features(ARMCPU *cpu)
+ {
+     /* Register all the coprocessor registers based on feature bits */
 @@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-     }
+             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
+               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
-     if (arm_feature(env, ARM_FEATURE_CBAR)) {
+               .access = PL1_R, .type = ARM_CP_CONST,
-+        /*
++              .accessfn = access_aa32_tid3,
-+         * CBAR is IMPDEF, but common on Arm Cortex-A implementations.
+               .resetvalue = cpu->id_pfr0 },
-+         * There are two flavours:
+             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
-+         *  (1) older 32-bit only cores have a simple 32-bit CBAR
+              * the value of the GIC field until after we define these regs.
 +         *  (2) 64-bit cores have a 64-bit CBAR visible to AArch64, plus a
 +         *      32-bit register visible to AArch32 at a different encoding
 +         *      to the "flavour 1" register and with the bits rearranged to
 +         *      be able to squash a 64-bit address into the 32-bit view.
 +         * We distinguish the two via the ARM_FEATURE_AARCH64 flag, but
 +         * in future if we support AArch32-only configs of some of the
 +         * AArch64 cores we might need to add a specific feature flag
 +         * to indicate cores with "flavour 2" CBAR.
 +         */
          if (arm_feature(env, ARM_FEATURE_AARCH64)) {
              /* 32 bit view is [31:18] 0...0 [43:32]. */
              uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
 @@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-             ARMCPRegInfo cbar_reginfo[] = {
+             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
-                 { .name = "CBAR",
+               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
-                   .type = ARM_CP_CONST,
+               .access = PL1_R, .type = ARM_CP_NO_RAW,
--                  .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
++              .accessfn = access_aa32_tid3,
--                  .access = PL1_R, .resetvalue = cpu->reset_cbar },
+               .readfn = id_pfr1_read,
-+                  .cp = 15, .crn = 15, .crm = 3, .opc1 = 1, .opc2 = 0,
+               .writefn = arm_cp_write_ignore },
-+                  .access = PL1_R, .resetvalue = cbar32 },
+             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
-                 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
+               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
-                   .type = ARM_CP_CONST,
+               .access = PL1_R, .type = ARM_CP_CONST,
-                   .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
++              .accessfn = access_aa32_tid3,
--                  .access = PL1_R, .resetvalue = cbar32 },
+               .resetvalue = cpu->id_dfr0 },
-+                  .access = PL1_R, .resetvalue = cpu->reset_cbar },
+             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
-                 REGINFO_SENTINEL
+               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
-             };
+               .access = PL1_R, .type = ARM_CP_CONST,
-             /* We don't implement a r/w 64 bit CBAR currently */
++              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_afr0 },
              { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr0 },
              { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr1 },
              { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr2 },
              { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr3 },
              { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar0 },
              { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar1 },
              { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar2 },
              { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar3 },
              { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar4 },
              { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar5 },
              { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr4 },
              { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar6 },
              REGINFO_SENTINEL
          };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_NO_RAW,
 +              .accessfn = access_aa64_tid3,
                .readfn = id_aa64pfr0_read,
                .writefn = arm_cp_write_ignore },
              { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64pfr1},
              { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                /* At present, only SVEver == 0 is defined anyway.  */
                .resetvalue = 0 },
              { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr0 },
              { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr1 },
              { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr0 },
              { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr1 },
              { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar0 },
              { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar1 },
              { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr0 },
              { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr1 },
              { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr0 },
              { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr1 },
              { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr2 },
              { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
                .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
 --
 .20.1

-[PULL 2/9] tests/tcg: clean-up some comments after the de-tangling
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-These were missed in the recent de-tangling so have been updated to be
-more actuate. I've also built up ARM_TESTS in a manner similar to
-AARCH64_TESTS for better consistency.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20190913151845.12582-2-alex.bennee@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/tcg/Makefile.target         |  7 +++++--
- tests/tcg/aarch64/Makefile.target |  3 ++-
- tests/tcg/arm/Makefile.target     | 15 ++++++++-------
-files changed, 15 insertions(+), 10 deletions(-)
-diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
-index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/Makefile.target
-+++ b/tests/tcg/Makefile.target
-@@ -XXX,XX +XXX,XX @@ TIMEOUT=15
- endif
- ifdef CONFIG_USER_ONLY
--# The order we include is important. We include multiarch, base arch
--# and finally arch if it's not the same as base arch.
-+# The order we include is important. We include multiarch first and
-+# then the target. If there are common tests shared between
-+# sub-targets (e.g. ARM & AArch64) then it is up to
-+# $(TARGET_NAME)/Makefile.target to include the common parent
-+# architecture in its VPATH.
- -include $(SRC_PATH)/tests/tcg/multiarch/Makefile.target
- -include $(SRC_PATH)/tests/tcg/$(TARGET_NAME)/Makefile.target
-diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
-index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/aarch64/Makefile.target
-+++ b/tests/tcg/aarch64/Makefile.target
-@@ -XXX,XX +XXX,XX @@ VPATH         += $(ARM_SRC)
- AARCH64_SRC=$(SRC_PATH)/tests/tcg/aarch64
- VPATH         += $(AARCH64_SRC)
--# we don't build any other ARM test
-+# Float-convert Tests
- AARCH64_TESTS=fcvt
- fcvt: LDFLAGS+=-lm
-@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
-     $(call run-test,$<,$(QEMU) $<, "$< on $(TARGET_NAME)")
-     $(call diff-out,$<,$(AARCH64_SRC)/fcvt.ref)
-+# Pauth Tests
- AARCH64_TESTS += pauth-1 pauth-2
- run-pauth-%: QEMU_OPTS += -cpu max
-diff --git a/tests/tcg/arm/Makefile.target b/tests/tcg/arm/Makefile.target
-index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/arm/Makefile.target
-+++ b/tests/tcg/arm/Makefile.target
-@@ -XXX,XX +XXX,XX @@ ARM_SRC=$(SRC_PATH)/tests/tcg/arm
- # Set search path for all sources
- VPATH         += $(ARM_SRC)
--ARM_TESTS=hello-arm test-arm-iwmmxt
--
--TESTS += $(ARM_TESTS) fcvt
--
-+# Basic Hello World
-+ARM_TESTS = hello-arm
- hello-arm: CFLAGS+=-marm -ffreestanding
- hello-arm: LDFLAGS+=-nostdlib
-+# IWMXT floating point extensions
-+ARM_TESTS += test-arm-iwmmxt
- test-arm-iwmmxt: CFLAGS+=-marm -march=iwmmxt -mabi=aapcs -mfpu=fpv4-sp-d16
- test-arm-iwmmxt: test-arm-iwmmxt.S
-     $(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
--ifeq ($(TARGET_NAME), arm)
-+# Float-convert Tests
-+ARM_TESTS += fcvt
- fcvt: LDFLAGS+=-lm
- # fcvt: CFLAGS+=-march=armv8.2-a+fp16 -mfpu=neon-fp-armv8
--
- run-fcvt: fcvt
-     $(call run-test,fcvt,$(QEMU) $<,"$< on $(TARGET_NAME)")
-     $(call diff-out,fcvt,$(ARM_SRC)/fcvt.ref)
--endif
-+
-+TESTS += $(ARM_TESTS)
- # On ARM Linux only supports 4k pages
- EXTRA_RUNS+=run-test-mmap-4096
---
-.20.1

-[PULL 4/9] target/arm: handle A-profile semihosting at translate time
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-As for the other semihosting calls we can resolve this at translate
-time.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20190913151845.12582-4-alex.bennee@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate.c | 19 +++++++++++++++----
-file changed, 15 insertions(+), 4 deletions(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_CBZ(DisasContext *s, arg_CBZ *a)
- }
- /*
-- * Supervisor call
-+ * Supervisor call - both T32 & A32 come here so we need to check
-+ * which mode we are in when checking for semihosting.
-  */
- static bool trans_SVC(DisasContext *s, arg_SVC *a)
- {
--    gen_set_pc_im(s, s->base.pc_next);
--    s->svc_imm = a->imm;
--    s->base.is_jmp = DISAS_SWI;
-+    const uint32_t semihost_imm = s->thumb ? 0xab : 0x123456;
-+
-+    if (!arm_dc_feature(s, ARM_FEATURE_M) && semihosting_enabled() &&
-+#ifndef CONFIG_USER_ONLY
-+        !IS_USER(s) &&
-+#endif
-+        (a->imm == semihost_imm)) {
-+        gen_exception_internal_insn(s, s->base.pc_next, EXCP_SEMIHOST);
-+    } else {
-+        gen_set_pc_im(s, s->base.pc_next);
-+        s->svc_imm = a->imm;
-+        s->base.is_jmp = DISAS_SWI;
-+    }
-     return true;
- }
---
-.20.1

-[PULL 6/9] target/arm: remove run-time semihosting checks for linux-user
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-Now we do all our checking at translate time we can make cpu_loop a
-little bit simpler. We also introduce a simple linux-user semihosting
-test case to defend the functionality. The out-of-tree softmmu based
-semihosting tests are still more comprehensive.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190913151845.12582-6-alex.bennee@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- linux-user/arm/target_syscall.h | 3 ---
- linux-user/arm/cpu_loop.c       | 3 ---
-files changed, 6 deletions(-)
-diff --git a/linux-user/arm/target_syscall.h b/linux-user/arm/target_syscall.h
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/arm/target_syscall.h
-+++ b/linux-user/arm/target_syscall.h
-@@ -XXX,XX +XXX,XX @@ struct target_pt_regs {
- #define ARM_NR_set_tls      (ARM_NR_BASE + 5)
- #define ARM_NR_get_tls    (ARM_NR_BASE + 6)
--#define ARM_NR_semihosting      0x123456
--#define ARM_NR_thumb_semihosting  0xAB
--
- #if defined(TARGET_WORDS_BIGENDIAN)
- #define UNAME_MACHINE "armv5teb"
- #else
-diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/arm/cpu_loop.c
-+++ b/linux-user/arm/cpu_loop.c
-@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
-                 if (n == ARM_NR_cacheflush) {
-                     /* nop */
--                } else if (n == ARM_NR_semihosting
--                           || n == ARM_NR_thumb_semihosting) {
--                    env->regs[0] = do_arm_semihosting (env);
-                 } else if (n == 0 || n >= ARM_SYSCALL_BASE || env->thumb) {
-                     /* linux syscall */
-                     if (env->thumb || n == 0) {
---
-.20.1

-[PULL 7/9] tests/tcg: add linux-user semihosting smoke test for ARM
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-We already use semihosting for the system stuff so this is a simple
-smoke test to ensure we are working OK on linux-user.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20190913151845.12582-7-alex.bennee@linaro.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- tests/tcg/aarch64/Makefile.target |  5 ++++
- tests/tcg/arm/Makefile.target     |  5 ++++
- tests/tcg/arm/semihosting.c       | 45 +++++++++++++++++++++++++++++++
-files changed, 55 insertions(+)
- create mode 100644 tests/tcg/arm/semihosting.c
-diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
-index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/aarch64/Makefile.target
-+++ b/tests/tcg/aarch64/Makefile.target
-@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
- AARCH64_TESTS += pauth-1 pauth-2
- run-pauth-%: QEMU_OPTS += -cpu max
-+# Semihosting smoke test for linux-user
-+AARCH64_TESTS += semihosting
-+run-semihosting: semihosting
-+    $(call run-test,$<,$(QEMU) $< 2> $<.err, "$< on $(TARGET_NAME)")
-+
- TESTS += $(AARCH64_TESTS)
-diff --git a/tests/tcg/arm/Makefile.target b/tests/tcg/arm/Makefile.target
-index XXXXXXX..XXXXXXX 100644
---- a/tests/tcg/arm/Makefile.target
-+++ b/tests/tcg/arm/Makefile.target
-@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
-     $(call run-test,fcvt,$(QEMU) $<,"$< on $(TARGET_NAME)")
-     $(call diff-out,fcvt,$(ARM_SRC)/fcvt.ref)
-+# Semihosting smoke test for linux-user
-+ARM_TESTS += semihosting
-+run-semihosting: semihosting
-+    $(call run-test,$<,$(QEMU) $< 2> $<.err, "$< on $(TARGET_NAME)")
-+
- TESTS += $(ARM_TESTS)
- # On ARM Linux only supports 4k pages
-diff --git a/tests/tcg/arm/semihosting.c b/tests/tcg/arm/semihosting.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/tests/tcg/arm/semihosting.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * linux-user semihosting checks
-+ *
-+ * Copyright (c) 2019
-+ * Written by Alex Bennée <alex.bennee@linaro.org>
-+ *
-+ * SPDX-License-Identifier: GPL-3.0-or-later
-+ */
-+
-+#include <stdint.h>
-+
-+#define SYS_WRITE0      0x04
-+#define SYS_REPORTEXC   0x18
-+
-+void __semi_call(uintptr_t type, uintptr_t arg0)
-+{
-+#if defined(__arm__)
-+    register uintptr_t t asm("r0") = type;
-+    register uintptr_t a0 asm("r1") = arg0;
-+    asm("svc 0xab"
-+        : /* no return */
-+        : "r" (t), "r" (a0));
-+#else
-+    register uintptr_t t asm("x0") = type;
-+    register uintptr_t a0 asm("x1") = arg0;
-+    asm("hlt 0xf000"
-+        : /* no return */
-+        : "r" (t), "r" (a0));
-+#endif
-+}
-+
-+int main(int argc, char *argv[argc])
-+{
-+#if defined(__arm__)
-+    uintptr_t exit_code = 0x20026;
-+#else
-+    uintptr_t exit_block[2] = {0x20026, 0};
-+    uintptr_t exit_code = (uintptr_t) &exit_block;
-+#endif
-+
-+    __semi_call(SYS_WRITE0, (uintptr_t) "Hello World");
-+    __semi_call(SYS_REPORTEXC, exit_code);
-+    /* if we get here we failed */
-+    return -1;
-+}
---
-.20.1

-[PULL 8/9] hw/arm/boot.c: Set NSACR.{CP11,CP10} for NS kernel boots
+Deleted patch
-If we're booting a Linux kernel directly into Non-Secure
-state on a CPU which has Secure state, then make sure we
-set the NSACR CP11 and CP10 bits, so that Non-Secure is allowed
-to access the FPU. Otherwise an AArch32 kernel will UNDEF as
-soon as it tries to use the FPU.
-It used to not matter that we didn't do this until commit
-fc1120a7f5f2d4b6, where we implemented actually honouring
-these NSACR bits.
-The problem only exists for CPUs where EL3 is AArch32; the
-equivalent AArch64 trap bits are in CPTR_EL3 and are "0 to
-not trap, 1 to trap", so the reset value of the register
-permits NS access, unlike NSACR.
-Fixes: fc1120a7f5
-Fixes: https://bugs.launchpad.net/qemu/+bug/1844597
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20190920174039.3916-1-peter.maydell@linaro.org
----
- hw/arm/boot.c | 2 ++
-file changed, 2 insertions(+)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
-+++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
-                     (cs != first_cpu || !info->secure_board_setup)) {
-                     /* Linux expects non-secure state */
-                     env->cp15.scr_el3 |= SCR_NS;
-+                    /* Set NSACR.{CP11,CP10} so NS can access the FPU */
-+                    env->cp15.nsacr |= 3 << 10;
-                 }
-             }
---
-.20.1

target-arm queue: nothing major here, but no point
sitting on them waiting for more stuff to come along.

thanks
-- PMM

The following changes since commit 1329132d28bf14b9508f7a1f04a2c63422bc3f99:

Merge remote-tracking branch 'remotes/mst/tags/for_upstream' into staging (2019-09-26 16:14:03 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20190927

for you to fetch changes up to e4e34855e658b78ecac50a651cc847662ff02cfd:

hw/arm/boot: Use the IEC binary prefix definitions (2019-09-27 11:44:39 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix the CBAR register implementation for Cortex-A53,
   Cortex-A57, Cortex-A72
 * Fix direct booting of Linux kernels on emulated CPUs
   which have an AArch32 EL3 (incorrect NSACR settings
   meant they could not access the FPU)
 * semihosting cleanup: do more work at translate time
   and less work at runtime

----------------------------------------------------------------
Alex Bennée (6):
      tests/tcg: clean-up some comments after the de-tangling
      target/arm: handle M-profile semihosting at translate time
      target/arm: handle A-profile semihosting at translate time
      target/arm: remove run time semihosting checks
      target/arm: remove run-time semihosting checks for linux-user
      tests/tcg: add linux-user semihosting smoke test for ARM

Luc Michel (1):
      target/arm: fix CBAR register for AArch64 CPUs

Peter Maydell (1):
      hw/arm/boot.c: Set NSACR.{CP11,CP10} for NS kernel boots

Philippe Mathieu-Daudé (1):
      hw/arm/boot: Use the IEC binary prefix definitions

tests/tcg/Makefile.target         |   7 ++-
 tests/tcg/aarch64/Makefile.target |   8 ++-
 tests/tcg/arm/Makefile.target     |  20 ++++---
 linux-user/arm/target_syscall.h   |   3 -
 hw/arm/boot.c                     |  12 ++--
 linux-user/arm/cpu_loop.c         |   3 -
 target/arm/helper.c               | 115 +++++++++++++-------------------------
 target/arm/m_helper.c             |  18 ++----
 target/arm/translate.c            |  30 ++++++++--
 tests/tcg/arm/semihosting.c       |  45 +++++++++++++++
 10 files changed, 146 insertions(+), 115 deletions(-)
 create mode 100644 tests/tcg/arm/semihosting.c

From: Luc Michel <luc.michel@greensocs.com>

For AArch64 CPUs with a CBAR register, we have two views for it:
  - in AArch64 state, the CBAR_EL1 register (S3_1_C15_C3_0), returns the
    full 64 bits CBAR value
  - in AArch32 state, the CBAR register (cp15, opc1=1, CRn=15, CRm=3, opc2=0)
    returns a 32 bits view such that:
      CBAR = CBAR_EL1[31:18] 0..0 CBAR_EL1[43:32]

This commit fixes the current implementation where:
  - CBAR_EL1 was returning the 32 bits view instead of the full 64 bits
    value,
  - CBAR was returning a truncated 32 bits version of the full 64 bits
    one, instead of the 32 bits view
  - CBAR was declared as cp15, opc1=4, CRn=15, CRm=0, opc2=0, which is
    the CBAR register found in the ARMv7 Cortex-Ax CPUs, but not in
    ARMv8 CPUs.

Signed-off-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20190912110103.1417887-1-luc.michel@greensocs.com
[PMM: Added a comment about the two different kinds of CBAR]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 19 ++++++++++++++++---
 1 file changed, 16 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
     }
 
     if (arm_feature(env, ARM_FEATURE_CBAR)) {
+        /*
+         * CBAR is IMPDEF, but common on Arm Cortex-A implementations.
+         * There are two flavours:
+         *  (1) older 32-bit only cores have a simple 32-bit CBAR
+         *  (2) 64-bit cores have a 64-bit CBAR visible to AArch64, plus a
+         *      32-bit register visible to AArch32 at a different encoding
+         *      to the "flavour 1" register and with the bits rearranged to
+         *      be able to squash a 64-bit address into the 32-bit view.
+         * We distinguish the two via the ARM_FEATURE_AARCH64 flag, but
+         * in future if we support AArch32-only configs of some of the
+         * AArch64 cores we might need to add a specific feature flag
+         * to indicate cores with "flavour 2" CBAR.
+         */
         if (arm_feature(env, ARM_FEATURE_AARCH64)) {
             /* 32 bit view is [31:18] 0...0 [43:32]. */
             uint32_t cbar32 = (extract64(cpu->reset_cbar, 18, 14) << 18)
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             ARMCPRegInfo cbar_reginfo[] = {
                 { .name = "CBAR",
                   .type = ARM_CP_CONST,
-                  .cp = 15, .crn = 15, .crm = 0, .opc1 = 4, .opc2 = 0,
-                  .access = PL1_R, .resetvalue = cpu->reset_cbar },
+                  .cp = 15, .crn = 15, .crm = 3, .opc1 = 1, .opc2 = 0,
+                  .access = PL1_R, .resetvalue = cbar32 },
                 { .name = "CBAR_EL1", .state = ARM_CP_STATE_AA64,
                   .type = ARM_CP_CONST,
                   .opc0 = 3, .opc1 = 1, .crn = 15, .crm = 3, .opc2 = 0,
-                  .access = PL1_R, .resetvalue = cbar32 },
+                  .access = PL1_R, .resetvalue = cpu->reset_cbar },
                 REGINFO_SENTINEL
             };
             /* We don't implement a r/w 64 bit CBAR currently */
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

These were missed in the recent de-tangling so have been updated to be
more actuate. I've also built up ARM_TESTS in a manner similar to
AARCH64_TESTS for better consistency.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190913151845.12582-2-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/tcg/Makefile.target         |  7 +++++--
 tests/tcg/aarch64/Makefile.target |  3 ++-
 tests/tcg/arm/Makefile.target     | 15 ++++++++-------
 3 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/tests/tcg/Makefile.target b/tests/tcg/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/Makefile.target
+++ b/tests/tcg/Makefile.target
@@ -XXX,XX +XXX,XX @@ TIMEOUT=15
 endif
 
 ifdef CONFIG_USER_ONLY
-# The order we include is important. We include multiarch, base arch
-# and finally arch if it's not the same as base arch.
+# The order we include is important. We include multiarch first and
+# then the target. If there are common tests shared between
+# sub-targets (e.g. ARM & AArch64) then it is up to
+# $(TARGET_NAME)/Makefile.target to include the common parent
+# architecture in its VPATH.
 -include $(SRC_PATH)/tests/tcg/multiarch/Makefile.target
 -include $(SRC_PATH)/tests/tcg/$(TARGET_NAME)/Makefile.target
 
diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ VPATH 		+= $(ARM_SRC)
 AARCH64_SRC=$(SRC_PATH)/tests/tcg/aarch64
 VPATH 		+= $(AARCH64_SRC)
 
-# we don't build any other ARM test
+# Float-convert Tests
 AARCH64_TESTS=fcvt
 
 fcvt: LDFLAGS+=-lm
@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
 	$(call run-test,$<,$(QEMU) $<, "$< on $(TARGET_NAME)")
 	$(call diff-out,$<,$(AARCH64_SRC)/fcvt.ref)
 
+# Pauth Tests
 AARCH64_TESTS += pauth-1 pauth-2
 run-pauth-%: QEMU_OPTS += -cpu max
 
diff --git a/tests/tcg/arm/Makefile.target b/tests/tcg/arm/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/arm/Makefile.target
+++ b/tests/tcg/arm/Makefile.target
@@ -XXX,XX +XXX,XX @@ ARM_SRC=$(SRC_PATH)/tests/tcg/arm
 # Set search path for all sources
 VPATH 		+= $(ARM_SRC)
 
-ARM_TESTS=hello-arm test-arm-iwmmxt
-
-TESTS += $(ARM_TESTS) fcvt
-
+# Basic Hello World
+ARM_TESTS = hello-arm
 hello-arm: CFLAGS+=-marm -ffreestanding
 hello-arm: LDFLAGS+=-nostdlib
 
+# IWMXT floating point extensions
+ARM_TESTS += test-arm-iwmmxt
 test-arm-iwmmxt: CFLAGS+=-marm -march=iwmmxt -mabi=aapcs -mfpu=fpv4-sp-d16
 test-arm-iwmmxt: test-arm-iwmmxt.S
 	$(CC) $(CFLAGS) $< -o $@ $(LDFLAGS)
 
-ifeq ($(TARGET_NAME), arm)
+# Float-convert Tests
+ARM_TESTS += fcvt
 fcvt: LDFLAGS+=-lm
 # fcvt: CFLAGS+=-march=armv8.2-a+fp16 -mfpu=neon-fp-armv8
-
 run-fcvt: fcvt
 	$(call run-test,fcvt,$(QEMU) $<,"$< on $(TARGET_NAME)")
 	$(call diff-out,fcvt,$(ARM_SRC)/fcvt.ref)
-endif
+
+TESTS += $(ARM_TESTS)
 
 # On ARM Linux only supports 4k pages
 EXTRA_RUNS+=run-test-mmap-4096
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We do this for other semihosting calls so we might as well do it for
M-profile as well.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190913151845.12582-3-alex.bennee@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/m_helper.c  | 18 ++++++------------
 target/arm/translate.c | 11 ++++++++++-
 2 files changed, 16 insertions(+), 13 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
             break;
         }
         break;
+    case EXCP_SEMIHOST:
+        qemu_log_mask(CPU_LOG_INT,
+                      "...handling as semihosting call 0x%x\n",
+                      env->regs[0]);
+        env->regs[0] = do_arm_semihosting(env);
+        return;
     case EXCP_BKPT:
-        if (semihosting_enabled()) {
-            int nr;
-            nr = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env)) & 0xff;
-            if (nr == 0xab) {
-                env->regs[15] += 2;
-                qemu_log_mask(CPU_LOG_INT,
-                              "...handling as semihosting call 0x%x\n",
-                              env->regs[0]);
-                env->regs[0] = do_arm_semihosting(env);
-                return;
-            }
-        }
         armv7m_nvic_set_pending(env->nvic, ARMV7M_EXCP_DEBUG, false);
         break;
     case EXCP_IRQ:
diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_BKPT(DisasContext *s, arg_BKPT *a)
     if (!ENABLE_ARCH_5) {
         return false;
     }
-    gen_exception_bkpt_insn(s, syn_aa32_bkpt(a->imm, false));
+    if (arm_dc_feature(s, ARM_FEATURE_M) &&
+        semihosting_enabled() &&
+#ifndef CONFIG_USER_ONLY
+        !IS_USER(s) &&
+#endif
+        (a->imm == 0xab)) {
+        gen_exception_internal_insn(s, s->base.pc_next, EXCP_SEMIHOST);
+    } else {
+        gen_exception_bkpt_insn(s, syn_aa32_bkpt(a->imm, false));
+    }
     return true;
 }
 
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

As for the other semihosting calls we can resolve this at translate
time.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20190913151845.12582-4-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static bool trans_CBZ(DisasContext *s, arg_CBZ *a)
 }
 
 /*
- * Supervisor call
+ * Supervisor call - both T32 & A32 come here so we need to check
+ * which mode we are in when checking for semihosting.
  */
 
 static bool trans_SVC(DisasContext *s, arg_SVC *a)
 {
-    gen_set_pc_im(s, s->base.pc_next);
-    s->svc_imm = a->imm;
-    s->base.is_jmp = DISAS_SWI;
+    const uint32_t semihost_imm = s->thumb ? 0xab : 0x123456;
+
+    if (!arm_dc_feature(s, ARM_FEATURE_M) && semihosting_enabled() &&
+#ifndef CONFIG_USER_ONLY
+        !IS_USER(s) &&
+#endif
+        (a->imm == semihost_imm)) {
+        gen_exception_internal_insn(s, s->base.pc_next, EXCP_SEMIHOST);
+    } else {
+        gen_set_pc_im(s, s->base.pc_next);
+        s->svc_imm = a->imm;
+        s->base.is_jmp = DISAS_SWI;
+    }
     return true;
 }
 
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

Now we do all our checking and use a common EXCP_SEMIHOST for
semihosting operations we can make helper code a lot simpler.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190913151845.12582-5-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 96 +++++++++++----------------------------------
 1 file changed, 22 insertions(+), 74 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static void arm_cpu_do_interrupt_aarch64(CPUState *cs)
                   new_el, env->pc, pstate_read(env));
 }
 
-static inline bool check_for_semihosting(CPUState *cs)
-{
+/*
+ * Do semihosting call and set the appropriate return value. All the
+ * permission and validity checks have been done at translate time.
+ *
+ * We only see semihosting exceptions in TCG only as they are not
+ * trapped to the hypervisor in KVM.
+ */
 #ifdef CONFIG_TCG
-    /* Check whether this exception is a semihosting call; if so
-     * then handle it and return true; otherwise return false.
-     */
+static void handle_semihosting(CPUState *cs)
+{
     ARMCPU *cpu = ARM_CPU(cs);
     CPUARMState *env = &cpu->env;
 
     if (is_a64(env)) {
-        if (cs->exception_index == EXCP_SEMIHOST) {
-            /* This is always the 64-bit semihosting exception.
-             * The "is this usermode" and "is semihosting enabled"
-             * checks have been done at translate time.
-             */
-            qemu_log_mask(CPU_LOG_INT,
-                          "...handling as semihosting call 0x%" PRIx64 "\n",
-                          env->xregs[0]);
-            env->xregs[0] = do_arm_semihosting(env);
-            return true;
-        }
-        return false;
+        qemu_log_mask(CPU_LOG_INT,
+                      "...handling as semihosting call 0x%" PRIx64 "\n",
+                      env->xregs[0]);
+        env->xregs[0] = do_arm_semihosting(env);
     } else {
-        uint32_t imm;
-
-        /* Only intercept calls from privileged modes, to provide some
-         * semblance of security.
-         */
-        if (cs->exception_index != EXCP_SEMIHOST &&
-            (!semihosting_enabled() ||
-             ((env->uncached_cpsr & CPSR_M) == ARM_CPU_MODE_USR))) {
-            return false;
-        }
-
-        switch (cs->exception_index) {
-        case EXCP_SEMIHOST:
-            /* This is always a semihosting call; the "is this usermode"
-             * and "is semihosting enabled" checks have been done at
-             * translate time.
-             */
-            break;
-        case EXCP_SWI:
-            /* Check for semihosting interrupt.  */
-            if (env->thumb) {
-                imm = arm_lduw_code(env, env->regs[15] - 2, arm_sctlr_b(env))
-                    & 0xff;
-                if (imm == 0xab) {
-                    break;
-                }
-            } else {
-                imm = arm_ldl_code(env, env->regs[15] - 4, arm_sctlr_b(env))
-                    & 0xffffff;
-                if (imm == 0x123456) {
-                    break;
-                }
-            }
-            return false;
-        case EXCP_BKPT:
-            /* See if this is a semihosting syscall.  */
-            if (env->thumb) {
-                imm = arm_lduw_code(env, env->regs[15], arm_sctlr_b(env))
-                    & 0xff;
-                if (imm == 0xab) {
-                    env->regs[15] += 2;
-                    break;
-                }
-            }
-            return false;
-        default:
-            return false;
-        }
-
         qemu_log_mask(CPU_LOG_INT,
                       "...handling as semihosting call 0x%x\n",
                       env->regs[0]);
         env->regs[0] = do_arm_semihosting(env);
-        return true;
     }
-#else
-    return false;
-#endif
 }
+#endif
 
 /* Handle a CPU exception for A and R profile CPUs.
  * Do any appropriate logging, handle PSCI calls, and then hand off
@@ -XXX,XX +XXX,XX @@ void arm_cpu_do_interrupt(CPUState *cs)
         return;
     }
 
-    /* Semihosting semantics depend on the register width of the
-     * code that caused the exception, not the target exception level,
-     * so must be handled here.
+    /*
+     * Semihosting semantics depend on the register width of the code
+     * that caused the exception, not the target exception level, so
+     * must be handled here.
      */
-    if (check_for_semihosting(cs)) {
+#ifdef CONFIG_TCG
+    if (cs->exception_index == EXCP_SEMIHOST) {
+        handle_semihosting(cs);
         return;
     }
+#endif
 
     /* Hooks may change global state so BQL should be held, also the
      * BQL needs to be held for any modification of
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

Now we do all our checking at translate time we can make cpu_loop a
little bit simpler. We also introduce a simple linux-user semihosting
test case to defend the functionality. The out-of-tree softmmu based
semihosting tests are still more comprehensive.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190913151845.12582-6-alex.bennee@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 linux-user/arm/target_syscall.h | 3 ---
 linux-user/arm/cpu_loop.c       | 3 ---
 2 files changed, 6 deletions(-)

diff --git a/linux-user/arm/target_syscall.h b/linux-user/arm/target_syscall.h
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/target_syscall.h
+++ b/linux-user/arm/target_syscall.h
@@ -XXX,XX +XXX,XX @@ struct target_pt_regs {
 #define ARM_NR_set_tls	  (ARM_NR_BASE + 5)
 #define ARM_NR_get_tls    (ARM_NR_BASE + 6)
 
-#define ARM_NR_semihosting	  0x123456
-#define ARM_NR_thumb_semihosting  0xAB
-
 #if defined(TARGET_WORDS_BIGENDIAN)
 #define UNAME_MACHINE "armv5teb"
 #else
diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/arm/cpu_loop.c
+++ b/linux-user/arm/cpu_loop.c
@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)
 
                 if (n == ARM_NR_cacheflush) {
                     /* nop */
-                } else if (n == ARM_NR_semihosting
-                           || n == ARM_NR_thumb_semihosting) {
-                    env->regs[0] = do_arm_semihosting (env);
                 } else if (n == 0 || n >= ARM_SYSCALL_BASE || env->thumb) {
                     /* linux syscall */
                     if (env->thumb || n == 0) {
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We already use semihosting for the system stuff so this is a simple
smoke test to ensure we are working OK on linux-user.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20190913151845.12582-7-alex.bennee@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/tcg/aarch64/Makefile.target |  5 ++++
 tests/tcg/arm/Makefile.target     |  5 ++++
 tests/tcg/arm/semihosting.c       | 45 +++++++++++++++++++++++++++++++
 3 files changed, 55 insertions(+)
 create mode 100644 tests/tcg/arm/semihosting.c

diff --git a/tests/tcg/aarch64/Makefile.target b/tests/tcg/aarch64/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/aarch64/Makefile.target
+++ b/tests/tcg/aarch64/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
 AARCH64_TESTS += pauth-1 pauth-2
 run-pauth-%: QEMU_OPTS += -cpu max
 
+# Semihosting smoke test for linux-user
+AARCH64_TESTS += semihosting
+run-semihosting: semihosting
+	$(call run-test,$<,$(QEMU) $< 2> $<.err, "$< on $(TARGET_NAME)")
+
 TESTS += $(AARCH64_TESTS)
diff --git a/tests/tcg/arm/Makefile.target b/tests/tcg/arm/Makefile.target
index XXXXXXX..XXXXXXX 100644
--- a/tests/tcg/arm/Makefile.target
+++ b/tests/tcg/arm/Makefile.target
@@ -XXX,XX +XXX,XX @@ run-fcvt: fcvt
 	$(call run-test,fcvt,$(QEMU) $<,"$< on $(TARGET_NAME)")
 	$(call diff-out,fcvt,$(ARM_SRC)/fcvt.ref)
 
+# Semihosting smoke test for linux-user
+ARM_TESTS += semihosting
+run-semihosting: semihosting
+	$(call run-test,$<,$(QEMU) $< 2> $<.err, "$< on $(TARGET_NAME)")
+
 TESTS += $(ARM_TESTS)
 
 # On ARM Linux only supports 4k pages
diff --git a/tests/tcg/arm/semihosting.c b/tests/tcg/arm/semihosting.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/tcg/arm/semihosting.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * linux-user semihosting checks
+ *
+ * Copyright (c) 2019
+ * Written by Alex Bennée <alex.bennee@linaro.org>
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ */
+
+#include <stdint.h>
+
+#define SYS_WRITE0      0x04
+#define SYS_REPORTEXC   0x18
+
+void __semi_call(uintptr_t type, uintptr_t arg0)
+{
+#if defined(__arm__)
+    register uintptr_t t asm("r0") = type;
+    register uintptr_t a0 asm("r1") = arg0;
+    asm("svc 0xab"
+        : /* no return */
+        : "r" (t), "r" (a0));
+#else
+    register uintptr_t t asm("x0") = type;
+    register uintptr_t a0 asm("x1") = arg0;
+    asm("hlt 0xf000"
+        : /* no return */
+        : "r" (t), "r" (a0));
+#endif
+}
+
+int main(int argc, char *argv[argc])
+{
+#if defined(__arm__)
+    uintptr_t exit_code = 0x20026;
+#else
+    uintptr_t exit_block[2] = {0x20026, 0};
+    uintptr_t exit_code = (uintptr_t) &exit_block;
+#endif
+
+    __semi_call(SYS_WRITE0, (uintptr_t) "Hello World");
+    __semi_call(SYS_REPORTEXC, exit_code);
+    /* if we get here we failed */
+    return -1;
+}
-- 
2.20.1

If we're booting a Linux kernel directly into Non-Secure
state on a CPU which has Secure state, then make sure we
set the NSACR CP11 and CP10 bits, so that Non-Secure is allowed
to access the FPU. Otherwise an AArch32 kernel will UNDEF as
soon as it tries to use the FPU.

It used to not matter that we didn't do this until commit
fc1120a7f5f2d4b6, where we implemented actually honouring
these NSACR bits.

The problem only exists for CPUs where EL3 is AArch32; the
equivalent AArch64 trap bits are in CPTR_EL3 and are "0 to
not trap, 1 to trap", so the reset value of the register
permits NS access, unlike NSACR.

Fixes: fc1120a7f5
Fixes: https://bugs.launchpad.net/qemu/+bug/1844597
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20190920174039.3916-1-peter.maydell@linaro.org
---
 hw/arm/boot.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     (cs != first_cpu || !info->secure_board_setup)) {
                     /* Linux expects non-secure state */
                     env->cp15.scr_el3 |= SCR_NS;
+                    /* Set NSACR.{CP11,CP10} so NS can access the FPU */
+                    env->cp15.nsacr |= 3 << 10;
                 }
             }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <philmd@redhat.com>

IEC binary prefixes ease code review: the unit is explicit.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20190923131108.21459-1-philmd@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/boot.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ int arm_load_dtb(hwaddr addr, const struct arm_boot_info *binfo,
         goto fail;
     }
 
-    if (scells < 2 && binfo->ram_size >= (1ULL << 32)) {
+    if (scells < 2 && binfo->ram_size >= 4 * GiB) {
         /* This is user error so deserves a friendlier error message
          * than the failure of setprop_sized_cells would provide
          */
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
      * we might still make a bad choice here.
      */
     info->initrd_start = info->loader_start +
-        MIN(info->ram_size / 2, 128 * 1024 * 1024);
+        MIN(info->ram_size / 2, 128 * MiB);
     if (image_high_addr) {
         info->initrd_start = MAX(info->initrd_start, image_high_addr);
     }
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
                  *
                  * Let's play safe and prealign it to 2MB to give us some space.
                  */
-                align = 2 * 1024 * 1024;
+                align = 2 * MiB;
             } else {
                 /*
                  * Some 32bit kernels will trash anything in the 4K page the
                  * initrd ends in, so make sure the DTB isn't caught up in that.
                  */
-                align = 4096;
+                align = 4 * KiB;
             }
 
             /* Place the DTB after the initrd in memory with alignment. */
@@ -XXX,XX +XXX,XX @@ static void arm_setup_direct_kernel_boot(ARMCPU *cpu,
                 info->loader_start + KERNEL_ARGS_ADDR;
             fixupcontext[FIXUP_ARGPTR_HI] =
                 (info->loader_start + KERNEL_ARGS_ADDR) >> 32;
-            if (info->ram_size >= (1ULL << 32)) {
+            if (info->ram_size >= 4 * GiB) {
                 error_report("RAM size must be less than 4GB to boot"
                              " Linux kernel using ATAGS (try passing a device tree"
                              " using -dtb)");
-- 
2.20.1

Arm patches for rc3 : just a handful of bug fixes.

thanks
-- PMM

The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:

Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126

for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:

target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)

----------------------------------------------------------------
target-arm queue:
 * handle FTYPE flag correctly in v7M exception return
   for v7M CPUs with an FPU (v8M CPUs were already correct)
 * versal: Add the CRP as unimplemented
 * Fix ISR_EL1 tracking when executing at EL2
 * Honor HCR_EL2.TID3 trapping requirements

----------------------------------------------------------------
Edgar E. Iglesias (1):
      hw/arm: versal: Add the CRP as unimplemented

Jean-Hugues Deschênes (1):
      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET

Marc Zyngier (2):
      target/arm: Fix ISR_EL1 tracking when executing at EL2
      target/arm: Honor HCR_EL2.TID3 trapping requirements

include/hw/arm/xlnx-versal.h |  3 ++
 hw/arm/xlnx-versal.c         |  2 ++
 target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
 target/arm/m_helper.c        |  7 ++--
 4 files changed, 89 insertions(+), 6 deletions(-)

From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>

According to the PushStack() pseudocode in the armv7m RM,
bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
an FPU is present. Current implementation is doing it for
armv8, but not for armv7. This patch makes the existing
logic applicable to both code paths.

Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/m_helper.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         if (env->v7m.secure) {
             lr |= R_V7M_EXCRET_S_MASK;
         }
-        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-            lr |= R_V7M_EXCRET_FTYPE_MASK;
-        }
     } else {
         lr = R_V7M_EXCRET_RES1_MASK |
             R_V7M_EXCRET_S_MASK |
             R_V7M_EXCRET_DCRS_MASK |
-            R_V7M_EXCRET_FTYPE_MASK |
             R_V7M_EXCRET_ES_MASK;
         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
             lr |= R_V7M_EXCRET_SPSEL_MASK;
         }
     }
+    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
+        lr |= R_V7M_EXCRET_FTYPE_MASK;
+    }
     if (!arm_v7m_is_handler_mode(env)) {
         lr |= R_V7M_EXCRET_MODE_MASK;
     }
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add the CRP as unimplemented thus avoiding bus errors when
guests access these registers.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 3 +++
 hw/arm/xlnx-versal.c         | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 #define MM_IOU_SCNTRS_SIZE          0x10000
 #define MM_FPD_CRF                  0xfd1a0000U
 #define MM_FPD_CRF_SIZE             0x140000
+
+#define MM_PMC_CRP                  0xf1260000U
+#define MM_PMC_CRP_SIZE             0x10000
 #endif
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
                         MM_CRL, MM_CRL_SIZE);
     versal_unimp_area(s, "crf", &s->mr_ps,
                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
+    versal_unimp_area(s, "crp", &s->mr_ps,
+                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
     versal_unimp_area(s, "iou-scntr", &s->mr_ps,
                         MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
     versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
SError interrupts.

Unfortunately, QEMU's implementation only considers the HCR_EL2
bits, and ignores the current exception level. This means a hypervisor
trying to look at its own interrupt state actually sees the guest
state, which is unexpected and breaks KVM as of Linux 5.3.

Instead, check for the running EL and return the physical bits
if not running in a virtualized context.

Fixes: 636540e9c40b
Cc: qemu-stable@nongnu.org
Reported-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Message-id: 20191122135833.28953-1-maz@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     CPUState *cs = env_cpu(env);
     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
     uint64_t ret = 0;
+    bool allow_virt = (arm_current_el(env) == 1 &&
+                       (!arm_is_secure_below_el3(env) ||
+                        (env->cp15.scr_el3 & SCR_EEL2)));
 
-    if (hcr_el2 & HCR_IMO) {
+    if (allow_virt && (hcr_el2 & HCR_IMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
             ret |= CPSR_I;
         }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
         }
     }
 
-    if (hcr_el2 & HCR_FMO) {
+    if (allow_virt && (hcr_el2 & HCR_FMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
             ret |= CPSR_F;
         }
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

HCR_EL2.TID3 mandates that access from EL1 to a long list of id
registers traps to EL2, and QEMU has so far ignored this requirement.

This breaks (among other things) KVM guests that have PtrAuth enabled,
while the hypervisor doesn't want to expose the feature to its guest.
To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
case), and masks out the unsupported feature.

QEMU not honoring the trap request means that the guest observes
that the feature is present in the HW, starts using it, and dies
a horrible death when KVM injects an UNDEF, because the feature
*really* isn't supported.

Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.

Note that this change does not include trapping of the MVFR
registers from AArch32 (they are accessed via the VMRS
instruction and need to be handled in a different way).

Reported-by: Will Deacon <will@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Tested-by: Will Deacon <will@kernel.org>
Message-id: 20191123115618.29230-1-maz@kernel.org
[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
 changed names of access functions to include _tid3]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        return access_aa64_tid3(env, ri, isread);
+    }
+
+    return CP_ACCESS_OK;
+}
+
 void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_pfr0 },
             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
              * the value of the GIC field until after we define these regs.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa32_tid3,
               .readfn = id_pfr1_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_dfr0 },
             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_afr0 },
             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr0 },
             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr1 },
             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr2 },
             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr3 },
             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar0 },
             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar1 },
             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar2 },
             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar3 },
             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar4 },
             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar5 },
             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr4 },
             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar6 },
             REGINFO_SENTINEL
         };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa64_tid3,
               .readfn = id_aa64pfr0_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64pfr1},
             { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               /* At present, only SVEver == 0 is defined anyway.  */
               .resetvalue = 0 },
             { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr0 },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr1 },
             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr0 },
             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr1 },
             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar0 },
             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar1 },
             { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr0 },
             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr1 },
             { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr0 },
             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr1 },
             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr2 },
             { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
-- 
2.20.1