Series comparison

-[PULL 0/4] target-arm queue
+[PULL 0/5] target-arm queue
-Arm patches for rc3 : just a handful of bug fixes.
+Just a few minor bugfixes, but we might as well get them in
 for rc0 tomorrow.
-thanks
 -- PMM
+The following changes since commit 787f82407c5056a8b1097e39e53d01dd1abe406b:
-The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:
+  Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200323' into staging (2020-03-23 15:38:30 +0000)
   Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200323
-for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:
+for you to fetch changes up to 550a04893c2bd4442211b353680b9a6408d94dba:
-  target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)
+  target/arm: Move computation of index in handle_simd_dupe (2020-03-23 17:22:30 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * handle FTYPE flag correctly in v7M exception return
+ * target/arm: avoid undefined behaviour shift in watchpoint code
-   for v7M CPUs with an FPU (v8M CPUs were already correct)
+ * target/arm: avoid undefined behaviour shift in handle_simd_dupe()
- * versal: Add the CRP as unimplemented
+ * target/arm: add assert that immh != 0 in disas_simd_shift_imm()
- * Fix ISR_EL1 tracking when executing at EL2
+ * aspeed/smc: Fix DMA support for AST2600
- * Honor HCR_EL2.TID3 trapping requirements
+ * hw/arm/bcm283x: Correct the license text ('and' vs 'or')
 ----------------------------------------------------------------
-Edgar E. Iglesias (1):
+Cédric Le Goater (1):
-      hw/arm: versal: Add the CRP as unimplemented
+      aspeed/smc: Fix DMA support for AST2600
-Jean-Hugues Deschênes (1):
+Philippe Mathieu-Daudé (1):
-      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
+      hw/arm/bcm283x: Correct the license text
-Marc Zyngier (2):
+Richard Henderson (3):
-      target/arm: Fix ISR_EL1 tracking when executing at EL2
+      target/arm: Rearrange disabled check for watchpoints
-      target/arm: Honor HCR_EL2.TID3 trapping requirements
+      target/arm: Assert immh != 0 in disas_simd_shift_imm
       target/arm: Move computation of index in handle_simd_dupe
- include/hw/arm/xlnx-versal.h |  3 ++
+ include/hw/arm/bcm2835_peripherals.h |  3 ++-
- hw/arm/xlnx-versal.c         |  2 ++
+ include/hw/arm/bcm2836.h             |  3 ++-
- target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
+ include/hw/char/bcm2835_aux.h        |  3 ++-
- target/arm/m_helper.c        |  7 ++--
+ include/hw/display/bcm2835_fb.h      |  3 ++-
-files changed, 89 insertions(+), 6 deletions(-)
+ include/hw/dma/bcm2835_dma.h         |  4 +++-
  include/hw/intc/bcm2835_ic.h         |  4 +++-
  include/hw/intc/bcm2836_control.h    |  3 ++-
  include/hw/misc/bcm2835_mbox.h       |  4 +++-
  include/hw/misc/bcm2835_mbox_defs.h  |  4 +++-
  include/hw/misc/bcm2835_property.h   |  4 +++-
  hw/arm/aspeed_ast2600.c              |  6 ++++++
  hw/arm/bcm2835_peripherals.c         |  3 ++-
  hw/arm/bcm2836.c                     |  3 ++-
  hw/arm/raspi.c                       |  3 ++-
  hw/display/bcm2835_fb.c              |  1 -
  hw/dma/bcm2835_dma.c                 |  4 +++-
  hw/intc/bcm2835_ic.c                 |  4 ++--
  hw/intc/bcm2836_control.c            |  4 +++-
  hw/misc/bcm2835_mbox.c               |  4 +++-
  hw/misc/bcm2835_property.c           |  4 +++-
  hw/ssi/aspeed_smc.c                  | 15 +++++++++++++--
  target/arm/helper.c                  | 11 ++++++-----
  target/arm/translate-a64.c           |  6 +++++-
  hw/ssi/trace-events                  |  1 +
 files changed, 76 insertions(+), 28 deletions(-)

-New patch
+[PULL 1/5] hw/arm/bcm283x: Correct the license text
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
 The license is the 'GNU General Public License v2.0 or later',
 not 'and':
   This program is free software; you can redistribute it and/ori
   modify it under the terms of the GNU General Public License as
   published by the Free Software Foundation; either version 2 of
   the License, or (at your option) any later version.
 Fix the license comment.
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20200312213455.15854-1-philmd@redhat.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/arm/bcm2835_peripherals.h | 3 ++-
  include/hw/arm/bcm2836.h             | 3 ++-
  include/hw/char/bcm2835_aux.h        | 3 ++-
  include/hw/display/bcm2835_fb.h      | 3 ++-
  include/hw/dma/bcm2835_dma.h         | 4 +++-
  include/hw/intc/bcm2835_ic.h         | 4 +++-
  include/hw/intc/bcm2836_control.h    | 3 ++-
  include/hw/misc/bcm2835_mbox.h       | 4 +++-
  include/hw/misc/bcm2835_mbox_defs.h  | 4 +++-
  include/hw/misc/bcm2835_property.h   | 4 +++-
  hw/arm/bcm2835_peripherals.c         | 3 ++-
  hw/arm/bcm2836.c                     | 3 ++-
  hw/arm/raspi.c                       | 3 ++-
  hw/display/bcm2835_fb.c              | 1 -
  hw/dma/bcm2835_dma.c                 | 4 +++-
  hw/intc/bcm2835_ic.c                 | 4 ++--
  hw/intc/bcm2836_control.c            | 4 +++-
  hw/misc/bcm2835_mbox.c               | 4 +++-
  hw/misc/bcm2835_property.c           | 4 +++-
 files changed, 45 insertions(+), 20 deletions(-)
 diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/bcm2835_peripherals.h
 +++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@
   * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
   * Written by Andrew Baumann
   *
 - * This code is licensed under the GNU GPLv2 and later.
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #ifndef BCM2835_PERIPHERALS_H
 diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/bcm2836.h
 +++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
   * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
   * Written by Andrew Baumann
   *
 - * This code is licensed under the GNU GPLv2 and later.
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #ifndef BCM2836_H
 diff --git a/include/hw/char/bcm2835_aux.h b/include/hw/char/bcm2835_aux.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/char/bcm2835_aux.h
 +++ b/include/hw/char/bcm2835_aux.h
@@ -XXX,XX +XXX,XX @@
   * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
   * Written by Andrew Baumann
   *
 - * This code is licensed under the GNU GPLv2 and later.
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #ifndef BCM2835_AUX_H
 diff --git a/include/hw/display/bcm2835_fb.h b/include/hw/display/bcm2835_fb.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/display/bcm2835_fb.h
 +++ b/include/hw/display/bcm2835_fb.h
@@ -XXX,XX +XXX,XX @@
   * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
   * Written by Andrew Baumann
   *
 - * This code is licensed under the GNU GPLv2 and later.
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #ifndef BCM2835_FB_H
 diff --git a/include/hw/dma/bcm2835_dma.h b/include/hw/dma/bcm2835_dma.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/dma/bcm2835_dma.h
 +++ b/include/hw/dma/bcm2835_dma.h
@@ -XXX,XX +XXX,XX @@
  /*
   * Raspberry Pi emulation (c) 2012 Gregory Estrade
 - * This code is licensed under the GNU GPLv2 and later.
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #ifndef BCM2835_DMA_H
 diff --git a/include/hw/intc/bcm2835_ic.h b/include/hw/intc/bcm2835_ic.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/bcm2835_ic.h
 +++ b/include/hw/intc/bcm2835_ic.h
@@ -XXX,XX +XXX,XX @@
  /*
   * Raspberry Pi emulation (c) 2012 Gregory Estrade
 - * This code is licensed under the GNU GPLv2 and later.
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #ifndef BCM2835_IC_H
 diff --git a/include/hw/intc/bcm2836_control.h b/include/hw/intc/bcm2836_control.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/intc/bcm2836_control.h
 +++ b/include/hw/intc/bcm2836_control.h
@@ -XXX,XX +XXX,XX @@
   * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
   * Added basic IRQ_TIMER interrupt support
   *
 - * This code is licensed under the GNU GPLv2 and later.
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #ifndef BCM2836_CONTROL_H
 diff --git a/include/hw/misc/bcm2835_mbox.h b/include/hw/misc/bcm2835_mbox.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/bcm2835_mbox.h
 +++ b/include/hw/misc/bcm2835_mbox.h
@@ -XXX,XX +XXX,XX @@
  /*
   * Raspberry Pi emulation (c) 2012 Gregory Estrade
 - * This code is licensed under the GNU GPLv2 and later.
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #ifndef BCM2835_MBOX_H
 diff --git a/include/hw/misc/bcm2835_mbox_defs.h b/include/hw/misc/bcm2835_mbox_defs.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/bcm2835_mbox_defs.h
 +++ b/include/hw/misc/bcm2835_mbox_defs.h
@@ -XXX,XX +XXX,XX @@
  /*
   * Raspberry Pi emulation (c) 2012 Gregory Estrade
 - * This code is licensed under the GNU GPLv2 and later.
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #ifndef BCM2835_MBOX_DEFS_H
 diff --git a/include/hw/misc/bcm2835_property.h b/include/hw/misc/bcm2835_property.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/misc/bcm2835_property.h
 +++ b/include/hw/misc/bcm2835_property.h
@@ -XXX,XX +XXX,XX @@
  /*
   * Raspberry Pi emulation (c) 2012 Gregory Estrade
 - * This code is licensed under the GNU GPLv2 and later.
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #ifndef BCM2835_PROPERTY_H
 diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/bcm2835_peripherals.c
 +++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@
   * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
   * Written by Andrew Baumann
   *
 - * This code is licensed under the GNU GPLv2 and later.
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #include "qemu/osdep.h"
 diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/bcm2836.c
 +++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
   * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
   * Written by Andrew Baumann
   *
 - * This code is licensed under the GNU GPLv2 and later.
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #include "qemu/osdep.h"
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
   * Raspberry Pi 3 emulation Copyright (c) 2018 Zoltán Baldaszti
   * Upstream code cleanup (c) 2018 Pekka Enberg
   *
 - * This code is licensed under the GNU GPLv2 and later.
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #include "qemu/osdep.h"
 diff --git a/hw/display/bcm2835_fb.c b/hw/display/bcm2835_fb.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/display/bcm2835_fb.c
 +++ b/hw/display/bcm2835_fb.c
@@ -XXX,XX +XXX,XX @@
  /*
   * Raspberry Pi emulation (c) 2012 Gregory Estrade
   * Refactoring for Pi2 Copyright (c) 2015, Microsoft. Written by Andrew Baumann.
 - * This code is licensed under the GNU GPLv2 and later.
   *
   * Heavily based on milkymist-vgafb.c, copyright terms below:
   *  QEMU model of the Milkymist VGA framebuffer.
 diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/dma/bcm2835_dma.c
 +++ b/hw/dma/bcm2835_dma.c
@@ -XXX,XX +XXX,XX @@
  /*
   * Raspberry Pi emulation (c) 2012 Gregory Estrade
 - * This code is licensed under the GNU GPLv2 and later.
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #include "qemu/osdep.h"
 diff --git a/hw/intc/bcm2835_ic.c b/hw/intc/bcm2835_ic.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/bcm2835_ic.c
 +++ b/hw/intc/bcm2835_ic.c
@@ -XXX,XX +XXX,XX @@
  /*
   * Raspberry Pi emulation (c) 2012 Gregory Estrade
   * Refactoring for Pi2 Copyright (c) 2015, Microsoft. Written by Andrew Baumann.
 - * This code is licensed under the GNU GPLv2 and later.
   * Heavily based on pl190.c, copyright terms below:
   *
   * Arm PrimeCell PL190 Vector Interrupt Controller
@@ -XXX,XX +XXX,XX @@
   * Copyright (c) 2006 CodeSourcery.
   * Written by Paul Brook
   *
 - * This code is licensed under the GPL.
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #include "qemu/osdep.h"
 diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/intc/bcm2836_control.c
 +++ b/hw/intc/bcm2836_control.c
@@ -XXX,XX +XXX,XX @@
   * Written by Andrew Baumann
   *
   * Based on bcm2835_ic.c (Raspberry Pi emulation) (c) 2012 Gregory Estrade
 - * This code is licensed under the GNU GPLv2 and later.
   *
   * At present, only implements interrupt routing, and mailboxes (i.e.,
   * not PMU interrupt, or AXI counters).
@@ -XXX,XX +XXX,XX @@
   *
   * Ref:
   * https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2836/QA7_rev3.4.pdf
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #include "qemu/osdep.h"
 diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/bcm2835_mbox.c
 +++ b/hw/misc/bcm2835_mbox.c
@@ -XXX,XX +XXX,XX @@
  /*
   * Raspberry Pi emulation (c) 2012 Gregory Estrade
 - * This code is licensed under the GNU GPLv2 and later.
   *
   * This file models the system mailboxes, which are used for
   * communication with low-bandwidth GPU peripherals. Refs:
   *   https://github.com/raspberrypi/firmware/wiki/Mailboxes
   *   https://github.com/raspberrypi/firmware/wiki/Accessing-mailboxes
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #include "qemu/osdep.h"
 diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/misc/bcm2835_property.c
 +++ b/hw/misc/bcm2835_property.c
@@ -XXX,XX +XXX,XX @@
  /*
   * Raspberry Pi emulation (c) 2012 Gregory Estrade
 - * This code is licensed under the GNU GPLv2 and later.
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2 or later.
 + * See the COPYING file in the top-level directory.
   */
  #include "qemu/osdep.h"
 --
 .20.1

-[PULL 2/4] hw/arm: versal: Add the CRP as unimplemented
+[PULL 2/5] aspeed/smc: Fix DMA support for AST2600
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Cédric Le Goater <clg@kaod.org>
-Add the CRP as unimplemented thus avoiding bus errors when
+Recent firmwares uses SPI DMA transfers in U-Boot to load the
-guests access these registers.
+different images (kernel, initrd, dtb) in the SoC DRAM. The AST2600
 FMC model is missing the masks to be applied on the DMA registers
 which resulted in incorrect values. Fix that and wire the SPI
 controllers which have DMA support on the AST2600.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Fixes: bcaa8ddd081c ("aspeed/smc: Add AST2600 support")
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
+Reviewed-by: Joel Stanley <joel@jms.id.au>
-Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
+Message-id: 20200320053923.20565-1-clg@kaod.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/xlnx-versal.h | 3 +++
+ hw/arm/aspeed_ast2600.c |  6 ++++++
- hw/arm/xlnx-versal.c         | 2 ++
+ hw/ssi/aspeed_smc.c     | 15 +++++++++++++--
-files changed, 5 insertions(+)
+ hw/ssi/trace-events     |  1 +
 files changed, 20 insertions(+), 2 deletions(-)
-diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
+--- a/hw/arm/aspeed_ast2600.c
-+++ b/include/hw/arm/xlnx-versal.h
++++ b/hw/arm/aspeed_ast2600.c
-@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
+@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
- #define MM_IOU_SCNTRS_SIZE          0x10000
- #define MM_FPD_CRF                  0xfd1a0000U
+     /* SPI */
- #define MM_FPD_CRF_SIZE             0x140000
+     for (i = 0; i < sc->spis_num; i++) {
-+
++        object_property_set_link(OBJECT(&s->spi[i]), OBJECT(s->dram_mr),
-+#define MM_PMC_CRP                  0xf1260000U
++                                 "dram", &err);
-+#define MM_PMC_CRP_SIZE             0x10000
++        if (err) {
- #endif
++            error_propagate(errp, err);
-diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
++            return;
 +        }
          object_property_set_int(OBJECT(&s->spi[i]), 1, "num-cs", &err);
          object_property_set_bool(OBJECT(&s->spi[i]), true, "realized",
                                   &local_err);
 diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-versal.c
+--- a/hw/ssi/aspeed_smc.c
-+++ b/hw/arm/xlnx-versal.c
++++ b/hw/ssi/aspeed_smc.c
-@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
+@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
-                         MM_CRL, MM_CRL_SIZE);
+         .flash_window_base = ASPEED26_SOC_FMC_FLASH_BASE,
-     versal_unimp_area(s, "crf", &s->mr_ps,
+         .flash_window_size = 0x10000000,
-                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
+         .has_dma           = true,
-+    versal_unimp_area(s, "crp", &s->mr_ps,
++        .dma_flash_mask    = 0x0FFFFFFC,
-+                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
++        .dma_dram_mask     = 0x3FFFFFFC,
-     versal_unimp_area(s, "iou-scntr", &s->mr_ps,
+         .nregs             = ASPEED_SMC_R_MAX,
-                         MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
+         .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
-     versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
+         .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .segments          = aspeed_segments_ast2600_spi1,
          .flash_window_base = ASPEED26_SOC_SPI_FLASH_BASE,
          .flash_window_size = 0x10000000,
 -        .has_dma           = false,
 +        .has_dma           = true,
 +        .dma_flash_mask    = 0x0FFFFFFC,
 +        .dma_dram_mask     = 0x3FFFFFFC,
          .nregs             = ASPEED_SMC_R_MAX,
          .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
          .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
          .segments          = aspeed_segments_ast2600_spi2,
          .flash_window_base = ASPEED26_SOC_SPI2_FLASH_BASE,
          .flash_window_size = 0x10000000,
 -        .has_dma           = false,
 +        .has_dma           = true,
 +        .dma_flash_mask    = 0x0FFFFFFC,
 +        .dma_dram_mask     = 0x3FFFFFFC,
          .nregs             = ASPEED_SMC_R_MAX,
          .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
          .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_rw(AspeedSMCState *s)
      MemTxResult result;
      uint32_t data;
 +    trace_aspeed_smc_dma_rw(s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE ?
 +                            "write" : "read",
 +                            s->regs[R_DMA_FLASH_ADDR],
 +                            s->regs[R_DMA_DRAM_ADDR],
 +                            s->regs[R_DMA_LEN]);
      while (s->regs[R_DMA_LEN]) {
          if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
              data = address_space_ldl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
 diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ssi/trace-events
 +++ b/hw/ssi/trace-events
@@ -XXX,XX +XXX,XX @@ aspeed_smc_do_snoop(int cs, int index, int dummies, int data) "CS%d index:0x%x d
  aspeed_smc_flash_write(int cs, uint64_t addr,  uint32_t size, uint64_t data, int mode) "CS%d @0x%" PRIx64 " size %u: 0x%" PRIx64" mode:%d"
  aspeed_smc_read(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
  aspeed_smc_dma_checksum(uint32_t addr, uint32_t data) "0x%08x: 0x%08x"
 +aspeed_smc_dma_rw(const char *dir, uint32_t flash_addr, uint32_t dram_addr, uint32_t size) "%s flash:@0x%08x dram:@0x%08x size:0x%08x"
  aspeed_smc_write(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
  aspeed_smc_flash_select(int cs, const char *prefix) "CS%d %sselect"
 --
 .20.1

-[PULL 4/4] target/arm: Honor HCR_EL2.TID3 trapping requirements
+[PULL 3/5] target/arm: Rearrange disabled check for watchpoints
-From: Marc Zyngier <maz@kernel.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-HCR_EL2.TID3 mandates that access from EL1 to a long list of id
+Coverity rightly notes that ctz32(bas) on 0 will return 32,
-registers traps to EL2, and QEMU has so far ignored this requirement.
+which makes the len calculation a BAD_SHIFT.
-This breaks (among other things) KVM guests that have PtrAuth enabled,
+A value of 0 in DBGWCR<n>_EL1.BAS is reserved.  Simply move
-while the hypervisor doesn't want to expose the feature to its guest.
+the existing check we have for this case.
 To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
 case), and masks out the unsupported feature.
-QEMU not honoring the trap request means that the guest observes
+Reported-by: Coverity (CID 1421964)
-that the feature is present in the HW, starts using it, and dies
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-a horrible death when KVM injects an UNDEF, because the feature
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-*really* isn't supported.
+Message-id: 20200320160622.8040-2-richard.henderson@linaro.org
 Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.
 Note that this change does not include trapping of the MVFR
 registers from AArch32 (they are accessed via the VMRS
 instruction and need to be handled in a different way).
 Reported-by: Will Deacon <will@kernel.org>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Tested-by: Will Deacon <will@kernel.org>
 Message-id: 20191123115618.29230-1-maz@kernel.org
 [PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
  changed names of access functions to include _tid3]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/helper.c | 11 ++++++-----
-file changed, 76 insertions(+)
+file changed, 6 insertions(+), 5 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update(ARMCPU *cpu, int n)
-     REGINFO_SENTINEL
+         int bas = extract64(wcr, 5, 8);
- };
+         int basstart;
-+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+-        if (bas == 0) {
-+                                       bool isread)
+-            /* This must act as if the watchpoint is disabled */
-+{
+-            return;
-+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
+-        }
-+        return CP_ACCESS_TRAP_EL2;
+-
-+    }
+         if (extract64(wvr, 2, 1)) {
              /* Deprecated case of an only 4-aligned address. BAS[7:4] are
               * ignored, and BAS[3:0] define which bytes to watch.
               */
              bas &= 0xf;
          }
 +
-+    return CP_ACCESS_OK;
++        if (bas == 0) {
-+}
++            /* This must act as if the watchpoint is disabled */
 +            return;
 +        }
 +
-+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+         /* The BAS bits are supposed to be programmed to indicate a contiguous
-+                                       bool isread)
+          * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
-+{
+          * we fire for each byte in the word/doubleword addressed by the WVR.
 +    if (arm_feature(env, ARM_FEATURE_V8)) {
 +        return access_aa64_tid3(env, ri, isread);
 +    }
 +
 +    return CP_ACCESS_OK;
 +}
 +
  void register_cp_regs_for_features(ARMCPU *cpu)
  {
      /* Register all the coprocessor registers based on feature bits */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_pfr0 },
              /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
               * the value of the GIC field until after we define these regs.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_NO_RAW,
 +              .accessfn = access_aa32_tid3,
                .readfn = id_pfr1_read,
                .writefn = arm_cp_write_ignore },
              { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_dfr0 },
              { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_afr0 },
              { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr0 },
              { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr1 },
              { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr2 },
              { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr3 },
              { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar0 },
              { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar1 },
              { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar2 },
              { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar3 },
              { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar4 },
              { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar5 },
              { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr4 },
              { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar6 },
              REGINFO_SENTINEL
          };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_NO_RAW,
 +              .accessfn = access_aa64_tid3,
                .readfn = id_aa64pfr0_read,
                .writefn = arm_cp_write_ignore },
              { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64pfr1},
              { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                /* At present, only SVEver == 0 is defined anyway.  */
                .resetvalue = 0 },
              { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr0 },
              { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr1 },
              { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr0 },
              { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr1 },
              { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar0 },
              { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar1 },
              { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr0 },
              { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr1 },
              { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr0 },
              { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr1 },
              { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr2 },
              { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
                .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
 --
 .20.1

-[PULL 1/4] target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
+[PULL 4/5] target/arm: Assert immh != 0 in disas_simd_shift_imm
-From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-According to the PushStack() pseudocode in the armv7m RM,
+Coverity raised a shed-load of errors cascading from inferring
-bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
+that clz32(immh) might yield 32, from immh might be 0.
 an FPU is present. Current implementation is doing it for
 armv8, but not for armv7. This patch makes the existing
 logic applicable to both code paths.
-Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
+While immh cannot be 0 from encoding, it is not obvious even to
 a human how we've checked that: via the filtering provided by
 data_proc_simd[].
 Reported-by: Coverity (CID 1421923, and more)
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20200320160622.8040-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/m_helper.c | 7 +++----
+ target/arm/translate-a64.c | 3 +++
-file changed, 3 insertions(+), 4 deletions(-)
+file changed, 3 insertions(+)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/m_helper.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ static void disas_simd_shift_imm(DisasContext *s, uint32_t insn)
-         if (env->v7m.secure) {
+     bool is_u = extract32(insn, 29, 1);
-             lr |= R_V7M_EXCRET_S_MASK;
+     bool is_q = extract32(insn, 30, 1);
-         }
--        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
++    /* data_proc_simd[] has sent immh == 0 to disas_simd_mod_imm. */
--            lr |= R_V7M_EXCRET_FTYPE_MASK;
++    assert(immh != 0);
--        }
++
-     } else {
+     switch (opcode) {
-         lr = R_V7M_EXCRET_RES1_MASK |
+     case 0x08: /* SRI */
-             R_V7M_EXCRET_S_MASK |
+         if (!is_u) {
              R_V7M_EXCRET_DCRS_MASK |
 -            R_V7M_EXCRET_FTYPE_MASK |
              R_V7M_EXCRET_ES_MASK;
          if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
              lr |= R_V7M_EXCRET_SPSEL_MASK;
          }
      }
 +    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
 +        lr |= R_V7M_EXCRET_FTYPE_MASK;
 +    }
      if (!arm_v7m_is_handler_mode(env)) {
          lr |= R_V7M_EXCRET_MODE_MASK;
      }
 --
 .20.1

-[PULL 3/4] target/arm: Fix ISR_EL1 tracking when executing at EL2
+[PULL 5/5] target/arm: Move computation of index in handle_simd_dupe
-From: Marc Zyngier <maz@kernel.org>
+From: Richard Henderson <richard.henderson@linaro.org>
-The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
+Coverity reports a BAD_SHIFT with ctz32(imm5), with imm5 == 0.
-ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
+This is an invalid encoding, but we diagnose that just below
-SError interrupts.
+by rejecting size > 3.  Avoid the warning by sinking the
 computation of index below the check.
-Unfortunately, QEMU's implementation only considers the HCR_EL2
+Reported-by: Coverity (CID 1421965)
-bits, and ignores the current exception level. This means a hypervisor
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-trying to look at its own interrupt state actually sees the guest
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-state, which is unexpected and breaks KVM as of Linux 5.3.
+Message-id: 20200320160622.8040-4-richard.henderson@linaro.org
 Instead, check for the running EL and return the physical bits
 if not running in a virtualized context.
 Fixes: 636540e9c40b
 Cc: qemu-stable@nongnu.org
 Reported-by: Quentin Perret <qperret@google.com>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Message-id: 20191122135833.28953-1-maz@kernel.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 7 +++++--
+ target/arm/translate-a64.c | 3 ++-
-file changed, 5 insertions(+), 2 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/translate-a64.c
-+++ b/target/arm/helper.c
++++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+@@ -XXX,XX +XXX,XX @@ static void handle_simd_dupe(DisasContext *s, int is_q, int rd, int rn,
-     CPUState *cs = env_cpu(env);
+                              int imm5)
-     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
+ {
-     uint64_t ret = 0;
+     int size = ctz32(imm5);
-+    bool allow_virt = (arm_current_el(env) == 1 &&
+-    int index = imm5 >> (size + 1);
-+                       (!arm_is_secure_below_el3(env) ||
++    int index;
-+                        (env->cp15.scr_el3 & SCR_EEL2)));
+     if (size > 3 || (size == 3 && !is_q)) {
--    if (hcr_el2 & HCR_IMO) {
+         unallocated_encoding(s);
-+    if (allow_virt && (hcr_el2 & HCR_IMO)) {
+@@ -XXX,XX +XXX,XX @@ static void handle_simd_dupe(DisasContext *s, int is_q, int rd, int rn,
-         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
+         return;
              ret |= CPSR_I;
          }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
          }
      }
--    if (hcr_el2 & HCR_FMO) {
++    index = imm5 >> (size + 1);
-+    if (allow_virt && (hcr_el2 & HCR_FMO)) {
+     tcg_gen_gvec_dup_mem(size, vec_full_reg_offset(s, rd),
-         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
+                          vec_reg_offset(s, rn, index, size),
-             ret |= CPSR_F;
+                          is_q ? 16 : 8, vec_full_reg_size(s));
          }
 --
 .20.1

Arm patches for rc3 : just a handful of bug fixes.

thanks
-- PMM

The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:

Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126

for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:

target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)

----------------------------------------------------------------
target-arm queue:
 * handle FTYPE flag correctly in v7M exception return
   for v7M CPUs with an FPU (v8M CPUs were already correct)
 * versal: Add the CRP as unimplemented
 * Fix ISR_EL1 tracking when executing at EL2
 * Honor HCR_EL2.TID3 trapping requirements

----------------------------------------------------------------
Edgar E. Iglesias (1):
      hw/arm: versal: Add the CRP as unimplemented

Jean-Hugues Deschênes (1):
      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET

Marc Zyngier (2):
      target/arm: Fix ISR_EL1 tracking when executing at EL2
      target/arm: Honor HCR_EL2.TID3 trapping requirements

include/hw/arm/xlnx-versal.h |  3 ++
 hw/arm/xlnx-versal.c         |  2 ++
 target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
 target/arm/m_helper.c        |  7 ++--
 4 files changed, 89 insertions(+), 6 deletions(-)

From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>

According to the PushStack() pseudocode in the armv7m RM,
bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
an FPU is present. Current implementation is doing it for
armv8, but not for armv7. This patch makes the existing
logic applicable to both code paths.

Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/m_helper.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         if (env->v7m.secure) {
             lr |= R_V7M_EXCRET_S_MASK;
         }
-        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-            lr |= R_V7M_EXCRET_FTYPE_MASK;
-        }
     } else {
         lr = R_V7M_EXCRET_RES1_MASK |
             R_V7M_EXCRET_S_MASK |
             R_V7M_EXCRET_DCRS_MASK |
-            R_V7M_EXCRET_FTYPE_MASK |
             R_V7M_EXCRET_ES_MASK;
         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
             lr |= R_V7M_EXCRET_SPSEL_MASK;
         }
     }
+    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
+        lr |= R_V7M_EXCRET_FTYPE_MASK;
+    }
     if (!arm_v7m_is_handler_mode(env)) {
         lr |= R_V7M_EXCRET_MODE_MASK;
     }
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add the CRP as unimplemented thus avoiding bus errors when
guests access these registers.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 3 +++
 hw/arm/xlnx-versal.c         | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 #define MM_IOU_SCNTRS_SIZE          0x10000
 #define MM_FPD_CRF                  0xfd1a0000U
 #define MM_FPD_CRF_SIZE             0x140000
+
+#define MM_PMC_CRP                  0xf1260000U
+#define MM_PMC_CRP_SIZE             0x10000
 #endif
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
                         MM_CRL, MM_CRL_SIZE);
     versal_unimp_area(s, "crf", &s->mr_ps,
                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
+    versal_unimp_area(s, "crp", &s->mr_ps,
+                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
     versal_unimp_area(s, "iou-scntr", &s->mr_ps,
                         MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
     versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
SError interrupts.

Unfortunately, QEMU's implementation only considers the HCR_EL2
bits, and ignores the current exception level. This means a hypervisor
trying to look at its own interrupt state actually sees the guest
state, which is unexpected and breaks KVM as of Linux 5.3.

Instead, check for the running EL and return the physical bits
if not running in a virtualized context.

Fixes: 636540e9c40b
Cc: qemu-stable@nongnu.org
Reported-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Message-id: 20191122135833.28953-1-maz@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     CPUState *cs = env_cpu(env);
     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
     uint64_t ret = 0;
+    bool allow_virt = (arm_current_el(env) == 1 &&
+                       (!arm_is_secure_below_el3(env) ||
+                        (env->cp15.scr_el3 & SCR_EEL2)));
 
-    if (hcr_el2 & HCR_IMO) {
+    if (allow_virt && (hcr_el2 & HCR_IMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
             ret |= CPSR_I;
         }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
         }
     }
 
-    if (hcr_el2 & HCR_FMO) {
+    if (allow_virt && (hcr_el2 & HCR_FMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
             ret |= CPSR_F;
         }
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

HCR_EL2.TID3 mandates that access from EL1 to a long list of id
registers traps to EL2, and QEMU has so far ignored this requirement.

This breaks (among other things) KVM guests that have PtrAuth enabled,
while the hypervisor doesn't want to expose the feature to its guest.
To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
case), and masks out the unsupported feature.

QEMU not honoring the trap request means that the guest observes
that the feature is present in the HW, starts using it, and dies
a horrible death when KVM injects an UNDEF, because the feature
*really* isn't supported.

Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.

Note that this change does not include trapping of the MVFR
registers from AArch32 (they are accessed via the VMRS
instruction and need to be handled in a different way).

Reported-by: Will Deacon <will@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Tested-by: Will Deacon <will@kernel.org>
Message-id: 20191123115618.29230-1-maz@kernel.org
[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
 changed names of access functions to include _tid3]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        return access_aa64_tid3(env, ri, isread);
+    }
+
+    return CP_ACCESS_OK;
+}
+
 void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_pfr0 },
             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
              * the value of the GIC field until after we define these regs.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa32_tid3,
               .readfn = id_pfr1_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_dfr0 },
             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_afr0 },
             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr0 },
             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr1 },
             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr2 },
             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr3 },
             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar0 },
             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar1 },
             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar2 },
             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar3 },
             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar4 },
             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar5 },
             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr4 },
             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar6 },
             REGINFO_SENTINEL
         };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa64_tid3,
               .readfn = id_aa64pfr0_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64pfr1},
             { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               /* At present, only SVEver == 0 is defined anyway.  */
               .resetvalue = 0 },
             { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr0 },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr1 },
             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr0 },
             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr1 },
             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar0 },
             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar1 },
             { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr0 },
             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr1 },
             { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr0 },
             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr1 },
             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr2 },
             { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
-- 
2.20.1

Just a few minor bugfixes, but we might as well get them in
for rc0 tomorrow.

-- PMM

The following changes since commit 787f82407c5056a8b1097e39e53d01dd1abe406b:

Merge remote-tracking branch 'remotes/cohuck/tags/s390x-20200323' into staging (2020-03-23 15:38:30 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200323

for you to fetch changes up to 550a04893c2bd4442211b353680b9a6408d94dba:

target/arm: Move computation of index in handle_simd_dupe (2020-03-23 17:22:30 +0000)

----------------------------------------------------------------
target-arm queue:
 * target/arm: avoid undefined behaviour shift in watchpoint code
 * target/arm: avoid undefined behaviour shift in handle_simd_dupe()
 * target/arm: add assert that immh != 0 in disas_simd_shift_imm()
 * aspeed/smc: Fix DMA support for AST2600
 * hw/arm/bcm283x: Correct the license text ('and' vs 'or')

----------------------------------------------------------------
Cédric Le Goater (1):
      aspeed/smc: Fix DMA support for AST2600

Philippe Mathieu-Daudé (1):
      hw/arm/bcm283x: Correct the license text

Richard Henderson (3):
      target/arm: Rearrange disabled check for watchpoints
      target/arm: Assert immh != 0 in disas_simd_shift_imm
      target/arm: Move computation of index in handle_simd_dupe

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The license is the 'GNU General Public License v2.0 or later',
not 'and':

This program is free software; you can redistribute it and/ori
  modify it under the terms of the GNU General Public License as
  published by the Free Software Foundation; either version 2 of
  the License, or (at your option) any later version.

Fix the license comment.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200312213455.15854-1-philmd@redhat.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/bcm2835_peripherals.h | 3 ++-
 include/hw/arm/bcm2836.h             | 3 ++-
 include/hw/char/bcm2835_aux.h        | 3 ++-
 include/hw/display/bcm2835_fb.h      | 3 ++-
 include/hw/dma/bcm2835_dma.h         | 4 +++-
 include/hw/intc/bcm2835_ic.h         | 4 +++-
 include/hw/intc/bcm2836_control.h    | 3 ++-
 include/hw/misc/bcm2835_mbox.h       | 4 +++-
 include/hw/misc/bcm2835_mbox_defs.h  | 4 +++-
 include/hw/misc/bcm2835_property.h   | 4 +++-
 hw/arm/bcm2835_peripherals.c         | 3 ++-
 hw/arm/bcm2836.c                     | 3 ++-
 hw/arm/raspi.c                       | 3 ++-
 hw/display/bcm2835_fb.c              | 1 -
 hw/dma/bcm2835_dma.c                 | 4 +++-
 hw/intc/bcm2835_ic.c                 | 4 ++--
 hw/intc/bcm2836_control.c            | 4 +++-
 hw/misc/bcm2835_mbox.c               | 4 +++-
 hw/misc/bcm2835_property.c           | 4 +++-
 19 files changed, 45 insertions(+), 20 deletions(-)

diff --git a/include/hw/arm/bcm2835_peripherals.h b/include/hw/arm/bcm2835_peripherals.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2835_peripherals.h
+++ b/include/hw/arm/bcm2835_peripherals.h
@@ -XXX,XX +XXX,XX @@
  * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
  * Written by Andrew Baumann
  *
- * This code is licensed under the GNU GPLv2 and later.
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #ifndef BCM2835_PERIPHERALS_H
diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
  * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
  * Written by Andrew Baumann
  *
- * This code is licensed under the GNU GPLv2 and later.
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #ifndef BCM2836_H
diff --git a/include/hw/char/bcm2835_aux.h b/include/hw/char/bcm2835_aux.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/bcm2835_aux.h
+++ b/include/hw/char/bcm2835_aux.h
@@ -XXX,XX +XXX,XX @@
  * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
  * Written by Andrew Baumann
  *
- * This code is licensed under the GNU GPLv2 and later.
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #ifndef BCM2835_AUX_H
diff --git a/include/hw/display/bcm2835_fb.h b/include/hw/display/bcm2835_fb.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/display/bcm2835_fb.h
+++ b/include/hw/display/bcm2835_fb.h
@@ -XXX,XX +XXX,XX @@
  * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
  * Written by Andrew Baumann
  *
- * This code is licensed under the GNU GPLv2 and later.
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #ifndef BCM2835_FB_H
diff --git a/include/hw/dma/bcm2835_dma.h b/include/hw/dma/bcm2835_dma.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/dma/bcm2835_dma.h
+++ b/include/hw/dma/bcm2835_dma.h
@@ -XXX,XX +XXX,XX @@
 /*
  * Raspberry Pi emulation (c) 2012 Gregory Estrade
- * This code is licensed under the GNU GPLv2 and later.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #ifndef BCM2835_DMA_H
diff --git a/include/hw/intc/bcm2835_ic.h b/include/hw/intc/bcm2835_ic.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/bcm2835_ic.h
+++ b/include/hw/intc/bcm2835_ic.h
@@ -XXX,XX +XXX,XX @@
 /*
  * Raspberry Pi emulation (c) 2012 Gregory Estrade
- * This code is licensed under the GNU GPLv2 and later.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #ifndef BCM2835_IC_H
diff --git a/include/hw/intc/bcm2836_control.h b/include/hw/intc/bcm2836_control.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/intc/bcm2836_control.h
+++ b/include/hw/intc/bcm2836_control.h
@@ -XXX,XX +XXX,XX @@
  * ARM Local Timer IRQ Copyright (c) 2019. Zoltán Baldaszti
  * Added basic IRQ_TIMER interrupt support
  *
- * This code is licensed under the GNU GPLv2 and later.
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #ifndef BCM2836_CONTROL_H
diff --git a/include/hw/misc/bcm2835_mbox.h b/include/hw/misc/bcm2835_mbox.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/bcm2835_mbox.h
+++ b/include/hw/misc/bcm2835_mbox.h
@@ -XXX,XX +XXX,XX @@
 /*
  * Raspberry Pi emulation (c) 2012 Gregory Estrade
- * This code is licensed under the GNU GPLv2 and later.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #ifndef BCM2835_MBOX_H
diff --git a/include/hw/misc/bcm2835_mbox_defs.h b/include/hw/misc/bcm2835_mbox_defs.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/bcm2835_mbox_defs.h
+++ b/include/hw/misc/bcm2835_mbox_defs.h
@@ -XXX,XX +XXX,XX @@
 /*
  * Raspberry Pi emulation (c) 2012 Gregory Estrade
- * This code is licensed under the GNU GPLv2 and later.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #ifndef BCM2835_MBOX_DEFS_H
diff --git a/include/hw/misc/bcm2835_property.h b/include/hw/misc/bcm2835_property.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/bcm2835_property.h
+++ b/include/hw/misc/bcm2835_property.h
@@ -XXX,XX +XXX,XX @@
 /*
  * Raspberry Pi emulation (c) 2012 Gregory Estrade
- * This code is licensed under the GNU GPLv2 and later.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #ifndef BCM2835_PROPERTY_H
diff --git a/hw/arm/bcm2835_peripherals.c b/hw/arm/bcm2835_peripherals.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2835_peripherals.c
+++ b/hw/arm/bcm2835_peripherals.c
@@ -XXX,XX +XXX,XX @@
  * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
  * Written by Andrew Baumann
  *
- * This code is licensed under the GNU GPLv2 and later.
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #include "qemu/osdep.h"
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
  * Rasperry Pi 2 emulation and refactoring Copyright (c) 2015, Microsoft
  * Written by Andrew Baumann
  *
- * This code is licensed under the GNU GPLv2 and later.
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #include "qemu/osdep.h"
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
  * Raspberry Pi 3 emulation Copyright (c) 2018 Zoltán Baldaszti
  * Upstream code cleanup (c) 2018 Pekka Enberg
  *
- * This code is licensed under the GNU GPLv2 and later.
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #include "qemu/osdep.h"
diff --git a/hw/display/bcm2835_fb.c b/hw/display/bcm2835_fb.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/display/bcm2835_fb.c
+++ b/hw/display/bcm2835_fb.c
@@ -XXX,XX +XXX,XX @@
 /*
  * Raspberry Pi emulation (c) 2012 Gregory Estrade
  * Refactoring for Pi2 Copyright (c) 2015, Microsoft. Written by Andrew Baumann.
- * This code is licensed under the GNU GPLv2 and later.
  *
  * Heavily based on milkymist-vgafb.c, copyright terms below:
  *  QEMU model of the Milkymist VGA framebuffer.
diff --git a/hw/dma/bcm2835_dma.c b/hw/dma/bcm2835_dma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/bcm2835_dma.c
+++ b/hw/dma/bcm2835_dma.c
@@ -XXX,XX +XXX,XX @@
 /*
  * Raspberry Pi emulation (c) 2012 Gregory Estrade
- * This code is licensed under the GNU GPLv2 and later.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #include "qemu/osdep.h"
diff --git a/hw/intc/bcm2835_ic.c b/hw/intc/bcm2835_ic.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/bcm2835_ic.c
+++ b/hw/intc/bcm2835_ic.c
@@ -XXX,XX +XXX,XX @@
 /*
  * Raspberry Pi emulation (c) 2012 Gregory Estrade
  * Refactoring for Pi2 Copyright (c) 2015, Microsoft. Written by Andrew Baumann.
- * This code is licensed under the GNU GPLv2 and later.
  * Heavily based on pl190.c, copyright terms below:
  *
  * Arm PrimeCell PL190 Vector Interrupt Controller
@@ -XXX,XX +XXX,XX @@
  * Copyright (c) 2006 CodeSourcery.
  * Written by Paul Brook
  *
- * This code is licensed under the GPL.
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #include "qemu/osdep.h"
diff --git a/hw/intc/bcm2836_control.c b/hw/intc/bcm2836_control.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/intc/bcm2836_control.c
+++ b/hw/intc/bcm2836_control.c
@@ -XXX,XX +XXX,XX @@
  * Written by Andrew Baumann
  *
  * Based on bcm2835_ic.c (Raspberry Pi emulation) (c) 2012 Gregory Estrade
- * This code is licensed under the GNU GPLv2 and later.
  *
  * At present, only implements interrupt routing, and mailboxes (i.e.,
  * not PMU interrupt, or AXI counters).
@@ -XXX,XX +XXX,XX @@
  *
  * Ref:
  * https://www.raspberrypi.org/documentation/hardware/raspberrypi/bcm2836/QA7_rev3.4.pdf
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #include "qemu/osdep.h"
diff --git a/hw/misc/bcm2835_mbox.c b/hw/misc/bcm2835_mbox.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/bcm2835_mbox.c
+++ b/hw/misc/bcm2835_mbox.c
@@ -XXX,XX +XXX,XX @@
 /*
  * Raspberry Pi emulation (c) 2012 Gregory Estrade
- * This code is licensed under the GNU GPLv2 and later.
  *
  * This file models the system mailboxes, which are used for
  * communication with low-bandwidth GPU peripherals. Refs:
  *   https://github.com/raspberrypi/firmware/wiki/Mailboxes
  *   https://github.com/raspberrypi/firmware/wiki/Accessing-mailboxes
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #include "qemu/osdep.h"
diff --git a/hw/misc/bcm2835_property.c b/hw/misc/bcm2835_property.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/bcm2835_property.c
+++ b/hw/misc/bcm2835_property.c
@@ -XXX,XX +XXX,XX @@
 /*
  * Raspberry Pi emulation (c) 2012 Gregory Estrade
- * This code is licensed under the GNU GPLv2 and later.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
  */
 
 #include "qemu/osdep.h"
-- 
2.20.1

From: Cédric Le Goater <clg@kaod.org>

Recent firmwares uses SPI DMA transfers in U-Boot to load the
different images (kernel, initrd, dtb) in the SoC DRAM. The AST2600
FMC model is missing the masks to be applied on the DMA registers
which resulted in incorrect values. Fix that and wire the SPI
controllers which have DMA support on the AST2600.

Fixes: bcaa8ddd081c ("aspeed/smc: Add AST2600 support")
Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Message-id: 20200320053923.20565-1-clg@kaod.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/aspeed_ast2600.c |  6 ++++++
 hw/ssi/aspeed_smc.c     | 15 +++++++++++++--
 hw/ssi/trace-events     |  1 +
 3 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/hw/arm/aspeed_ast2600.c b/hw/arm/aspeed_ast2600.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_ast2600.c
+++ b/hw/arm/aspeed_ast2600.c
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_ast2600_realize(DeviceState *dev, Error **errp)
 
     /* SPI */
     for (i = 0; i < sc->spis_num; i++) {
+        object_property_set_link(OBJECT(&s->spi[i]), OBJECT(s->dram_mr),
+                                 "dram", &err);
+        if (err) {
+            error_propagate(errp, err);
+            return;
+        }
         object_property_set_int(OBJECT(&s->spi[i]), 1, "num-cs", &err);
         object_property_set_bool(OBJECT(&s->spi[i]), true, "realized",
                                  &local_err);
diff --git a/hw/ssi/aspeed_smc.c b/hw/ssi/aspeed_smc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/aspeed_smc.c
+++ b/hw/ssi/aspeed_smc.c
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .flash_window_base = ASPEED26_SOC_FMC_FLASH_BASE,
         .flash_window_size = 0x10000000,
         .has_dma           = true,
+        .dma_flash_mask    = 0x0FFFFFFC,
+        .dma_dram_mask     = 0x3FFFFFFC,
         .nregs             = ASPEED_SMC_R_MAX,
         .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
         .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .segments          = aspeed_segments_ast2600_spi1,
         .flash_window_base = ASPEED26_SOC_SPI_FLASH_BASE,
         .flash_window_size = 0x10000000,
-        .has_dma           = false,
+        .has_dma           = true,
+        .dma_flash_mask    = 0x0FFFFFFC,
+        .dma_dram_mask     = 0x3FFFFFFC,
         .nregs             = ASPEED_SMC_R_MAX,
         .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
         .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
@@ -XXX,XX +XXX,XX @@ static const AspeedSMCController controllers[] = {
         .segments          = aspeed_segments_ast2600_spi2,
         .flash_window_base = ASPEED26_SOC_SPI2_FLASH_BASE,
         .flash_window_size = 0x10000000,
-        .has_dma           = false,
+        .has_dma           = true,
+        .dma_flash_mask    = 0x0FFFFFFC,
+        .dma_dram_mask     = 0x3FFFFFFC,
         .nregs             = ASPEED_SMC_R_MAX,
         .segment_to_reg    = aspeed_2600_smc_segment_to_reg,
         .reg_to_segment    = aspeed_2600_smc_reg_to_segment,
@@ -XXX,XX +XXX,XX @@ static void aspeed_smc_dma_rw(AspeedSMCState *s)
     MemTxResult result;
     uint32_t data;
 
+    trace_aspeed_smc_dma_rw(s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE ?
+                            "write" : "read",
+                            s->regs[R_DMA_FLASH_ADDR],
+                            s->regs[R_DMA_DRAM_ADDR],
+                            s->regs[R_DMA_LEN]);
     while (s->regs[R_DMA_LEN]) {
         if (s->regs[R_DMA_CTRL] & DMA_CTRL_WRITE) {
             data = address_space_ldl_le(&s->dram_as, s->regs[R_DMA_DRAM_ADDR],
diff --git a/hw/ssi/trace-events b/hw/ssi/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/trace-events
+++ b/hw/ssi/trace-events
@@ -XXX,XX +XXX,XX @@ aspeed_smc_do_snoop(int cs, int index, int dummies, int data) "CS%d index:0x%x d
 aspeed_smc_flash_write(int cs, uint64_t addr,  uint32_t size, uint64_t data, int mode) "CS%d @0x%" PRIx64 " size %u: 0x%" PRIx64" mode:%d"
 aspeed_smc_read(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
 aspeed_smc_dma_checksum(uint32_t addr, uint32_t data) "0x%08x: 0x%08x"
+aspeed_smc_dma_rw(const char *dir, uint32_t flash_addr, uint32_t dram_addr, uint32_t size) "%s flash:@0x%08x dram:@0x%08x size:0x%08x"
 aspeed_smc_write(uint64_t addr,  uint32_t size, uint64_t data) "@0x%" PRIx64 " size %u: 0x%" PRIx64
 aspeed_smc_flash_select(int cs, const char *prefix) "CS%d %sselect"
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Coverity rightly notes that ctz32(bas) on 0 will return 32,
which makes the len calculation a BAD_SHIFT.

A value of 0 in DBGWCR<n>_EL1.BAS is reserved.  Simply move
the existing check we have for this case.

Reported-by: Coverity (CID 1421964)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200320160622.8040-2-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update(ARMCPU *cpu, int n)
         int bas = extract64(wcr, 5, 8);
         int basstart;
 
-        if (bas == 0) {
-            /* This must act as if the watchpoint is disabled */
-            return;
-        }
-
         if (extract64(wvr, 2, 1)) {
             /* Deprecated case of an only 4-aligned address. BAS[7:4] are
              * ignored, and BAS[3:0] define which bytes to watch.
              */
             bas &= 0xf;
         }
+
+        if (bas == 0) {
+            /* This must act as if the watchpoint is disabled */
+            return;
+        }
+
         /* The BAS bits are supposed to be programmed to indicate a contiguous
          * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
          * we fire for each byte in the word/doubleword addressed by the WVR.
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Coverity raised a shed-load of errors cascading from inferring
that clz32(immh) might yield 32, from immh might be 0.

While immh cannot be 0 from encoding, it is not obvious even to
a human how we've checked that: via the filtering provided by
data_proc_simd[].

Reported-by: Coverity (CID 1421923, and more)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200320160622.8040-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_shift_imm(DisasContext *s, uint32_t insn)
     bool is_u = extract32(insn, 29, 1);
     bool is_q = extract32(insn, 30, 1);
 
+    /* data_proc_simd[] has sent immh == 0 to disas_simd_mod_imm. */
+    assert(immh != 0);
+
     switch (opcode) {
     case 0x08: /* SRI */
         if (!is_u) {
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

Coverity reports a BAD_SHIFT with ctz32(imm5), with imm5 == 0.
This is an invalid encoding, but we diagnose that just below
by rejecting size > 3.  Avoid the warning by sinking the
computation of index below the check.

Reported-by: Coverity (CID 1421965)
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200320160622.8040-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void handle_simd_dupe(DisasContext *s, int is_q, int rd, int rn,
                              int imm5)
 {
     int size = ctz32(imm5);
-    int index = imm5 >> (size + 1);
+    int index;
 
     if (size > 3 || (size == 3 && !is_q)) {
         unallocated_encoding(s);
@@ -XXX,XX +XXX,XX @@ static void handle_simd_dupe(DisasContext *s, int is_q, int rd, int rn,
         return;
     }
 
+    index = imm5 >> (size + 1);
     tcg_gen_gvec_dup_mem(size, vec_full_reg_offset(s, rd),
                          vec_reg_offset(s, rn, index, size),
                          is_q ? 16 : 8, vec_full_reg_size(s));
-- 
2.20.1