Series comparison

-[PULL 0/4] target-arm queue
+[PULL v2 00/37] target-arm queue
-Arm patches for rc3 : just a handful of bug fixes.
+v2: dropped the npcm7xx ethernet device, whose test case
 fails weirdly on the 'build-disabled' gitlab CI job:
 https://gitlab.com/qemu-project/qemu/-/jobs/1034174731#L12
-thanks
+The following changes since commit 8ba4bca570ace1e60614a0808631a517cf5df67a:
 -- PMM
+  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2021-02-15 17:13:57 +0000)
 The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:
   Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210217
-for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:
+for you to fetch changes up to 59c7a187dd8bd8ef675768dd8af9de11528ea7e2:
-  target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)
+  MAINTAINERS: add myself maintainer for the clock framework (2021-02-16 14:16:17 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * handle FTYPE flag correctly in v7M exception return
+ * Support ARMv8.5-MemTag for linux-user
-   for v7M CPUs with an FPU (v8M CPUs were already correct)
+ * ncpm7xx: Support SMBus
- * versal: Add the CRP as unimplemented
+ * MAINTAINERS: add section for Clock framework
  * Fix ISR_EL1 tracking when executing at EL2
  * Honor HCR_EL2.TID3 trapping requirements
 ----------------------------------------------------------------
-Edgar E. Iglesias (1):
+Hao Wu (5):
-      hw/arm: versal: Add the CRP as unimplemented
+      hw/i2c: Implement NPCM7XX SMBus Module Single Mode
       hw/arm: Add I2C sensors for NPCM750 eval board
       hw/arm: Add I2C sensors and EEPROM for GSJ machine
       hw/i2c: Add a QTest for NPCM7XX SMBus Device
       hw/i2c: Implement NPCM7XX SMBus Module FIFO Mode
-Jean-Hugues Deschênes (1):
+Luc Michel (1):
-      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
+      MAINTAINERS: add myself maintainer for the clock framework
-Marc Zyngier (2):
+Richard Henderson (31):
-      target/arm: Fix ISR_EL1 tracking when executing at EL2
+      tcg: Introduce target-specific page data for user-only
-      target/arm: Honor HCR_EL2.TID3 trapping requirements
+      linux-user: Introduce PAGE_ANON
       exec: Use uintptr_t for guest_base
       exec: Use uintptr_t in cpu_ldst.h
       exec: Improve types for guest_addr_valid
       linux-user: Check for overflow in access_ok
       linux-user: Tidy VERIFY_READ/VERIFY_WRITE
       bsd-user: Tidy VERIFY_READ/VERIFY_WRITE
       linux-user: Do not use guest_addr_valid for h2g_valid
       linux-user: Fix guest_addr_valid vs reserved_va
       exec: Introduce cpu_untagged_addr
       exec: Use cpu_untagged_addr in g2h; split out g2h_untagged
       linux-user: Explicitly untag memory management syscalls
       linux-user: Use guest_range_valid in access_ok
       exec: Rename guest_{addr,range}_valid to *_untagged
       linux-user: Use cpu_untagged_addr in access_ok; split out *_untagged
       linux-user: Move lock_user et al out of line
       linux-user: Fix types in uaccess.c
       linux-user: Handle tags in lock_user/unlock_user
       linux-user/aarch64: Implement PR_TAGGED_ADDR_ENABLE
       target/arm: Improve gen_top_byte_ignore
       target/arm: Use the proper TBI settings for linux-user
       linux-user/aarch64: Implement PR_MTE_TCF and PR_MTE_TAG
       linux-user/aarch64: Implement PROT_MTE
       target/arm: Split out syndrome.h from internals.h
       linux-user/aarch64: Pass syndrome to EXC_*_ABORT
       linux-user/aarch64: Signal SEGV_MTESERR for sync tag check fault
       linux-user/aarch64: Signal SEGV_MTEAERR for async tag check error
       target/arm: Add allocation tag storage for user mode
       target/arm: Enable MTE for user-only
       tests/tcg/aarch64: Add mte smoke tests
- include/hw/arm/xlnx-versal.h |  3 ++
+ docs/system/arm/nuvoton.rst         |    2 +-
- hw/arm/xlnx-versal.c         |  2 ++
+ bsd-user/qemu.h                     |   17 +-
- target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
+ include/exec/cpu-all.h              |   47 +-
- target/arm/m_helper.c        |  7 ++--
+ include/exec/cpu_ldst.h             |   39 +-
-files changed, 89 insertions(+), 6 deletions(-)
+ include/exec/exec-all.h             |    2 +-
  include/hw/arm/npcm7xx.h            |    2 +
  include/hw/i2c/npcm7xx_smbus.h      |  113 ++++
  linux-user/aarch64/target_signal.h  |    3 +
  linux-user/aarch64/target_syscall.h |   13 +
  linux-user/qemu.h                   |   76 +--
  linux-user/syscall_defs.h           |    1 +
  target/arm/cpu-param.h              |    3 +
  target/arm/cpu.h                    |   32 +
  target/arm/internals.h              |  249 +-------
  target/arm/syndrome.h               |  273 +++++++++
  tests/tcg/aarch64/mte.h             |   60 ++
  accel/tcg/translate-all.c           |   32 +-
  accel/tcg/user-exec.c               |   51 +-
  bsd-user/elfload.c                  |    2 +-
  bsd-user/main.c                     |    8 +-
  bsd-user/mmap.c                     |   23 +-
  hw/arm/npcm7xx.c                    |   68 ++-
  hw/arm/npcm7xx_boards.c             |   46 ++
  hw/i2c/npcm7xx_smbus.c              | 1099 +++++++++++++++++++++++++++++++++++
  linux-user/aarch64/cpu_loop.c       |   38 +-
  linux-user/elfload.c                |   18 +-
  linux-user/flatload.c               |    2 +-
  linux-user/hppa/cpu_loop.c          |   39 +-
  linux-user/i386/cpu_loop.c          |    6 +-
  linux-user/i386/signal.c            |    5 +-
  linux-user/main.c                   |    4 +-
  linux-user/mmap.c                   |   88 +--
  linux-user/ppc/signal.c             |    4 +-
  linux-user/syscall.c                |  165 ++++--
  linux-user/uaccess.c                |   82 ++-
  target/arm/cpu.c                    |   25 +-
  target/arm/helper-a64.c             |    4 +-
  target/arm/mte_helper.c             |   39 +-
  target/arm/tlb_helper.c             |   15 +-
  target/arm/translate-a64.c          |   25 +-
  target/hppa/op_helper.c             |    2 +-
  target/i386/tcg/mem_helper.c        |    2 +-
  target/s390x/mem_helper.c           |    4 +-
  tests/qtest/npcm7xx_smbus-test.c    |  495 ++++++++++++++++
  tests/tcg/aarch64/mte-1.c           |   28 +
  tests/tcg/aarch64/mte-2.c           |   45 ++
  tests/tcg/aarch64/mte-3.c           |   51 ++
  tests/tcg/aarch64/mte-4.c           |   45 ++
  tests/tcg/aarch64/pauth-2.c         |    1 -
  MAINTAINERS                         |   11 +
  hw/arm/Kconfig                      |    1 +
  hw/i2c/meson.build                  |    1 +
  hw/i2c/trace-events                 |   12 +
  tests/qtest/meson.build             |    1 +
  tests/tcg/aarch64/Makefile.target   |    6 +
  tests/tcg/configure.sh              |    4 +
 files changed, 2976 insertions(+), 553 deletions(-)
  create mode 100644 include/hw/i2c/npcm7xx_smbus.h
  create mode 100644 target/arm/syndrome.h
  create mode 100644 tests/tcg/aarch64/mte.h
  create mode 100644 hw/i2c/npcm7xx_smbus.c
  create mode 100644 tests/qtest/npcm7xx_smbus-test.c
  create mode 100644 tests/tcg/aarch64/mte-1.c
  create mode 100644 tests/tcg/aarch64/mte-2.c
  create mode 100644 tests/tcg/aarch64/mte-3.c
  create mode 100644 tests/tcg/aarch64/mte-4.c

-[PULL 1/4] target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
+Deleted patch
-From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>
-According to the PushStack() pseudocode in the armv7m RM,
-bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
-an FPU is present. Current implementation is doing it for
-armv8, but not for armv7. This patch makes the existing
-logic applicable to both code paths.
-Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/m_helper.c | 7 +++----
-file changed, 3 insertions(+), 4 deletions(-)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
-+++ b/target/arm/m_helper.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
-         if (env->v7m.secure) {
-             lr |= R_V7M_EXCRET_S_MASK;
-         }
--        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
--            lr |= R_V7M_EXCRET_FTYPE_MASK;
--        }
-     } else {
-         lr = R_V7M_EXCRET_RES1_MASK |
-             R_V7M_EXCRET_S_MASK |
-             R_V7M_EXCRET_DCRS_MASK |
--            R_V7M_EXCRET_FTYPE_MASK |
-             R_V7M_EXCRET_ES_MASK;
-         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
-             lr |= R_V7M_EXCRET_SPSEL_MASK;
-         }
-     }
-+    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-+        lr |= R_V7M_EXCRET_FTYPE_MASK;
-+    }
-     if (!arm_v7m_is_handler_mode(env)) {
-         lr |= R_V7M_EXCRET_MODE_MASK;
-     }
---
-.20.1

-[PULL 2/4] hw/arm: versal: Add the CRP as unimplemented
+Deleted patch
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-Add the CRP as unimplemented thus avoiding bus errors when
-guests access these registers.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/arm/xlnx-versal.h | 3 +++
- hw/arm/xlnx-versal.c         | 2 ++
-files changed, 5 insertions(+)
-diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
-+++ b/include/hw/arm/xlnx-versal.h
-@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
- #define MM_IOU_SCNTRS_SIZE          0x10000
- #define MM_FPD_CRF                  0xfd1a0000U
- #define MM_FPD_CRF_SIZE             0x140000
-+
-+#define MM_PMC_CRP                  0xf1260000U
-+#define MM_PMC_CRP_SIZE             0x10000
- #endif
-diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/xlnx-versal.c
-+++ b/hw/arm/xlnx-versal.c
-@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
-                         MM_CRL, MM_CRL_SIZE);
-     versal_unimp_area(s, "crf", &s->mr_ps,
-                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
-+    versal_unimp_area(s, "crp", &s->mr_ps,
-+                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
-     versal_unimp_area(s, "iou-scntr", &s->mr_ps,
-                         MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
-     versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
---
-.20.1

-[PULL 3/4] target/arm: Fix ISR_EL1 tracking when executing at EL2
+Deleted patch
-From: Marc Zyngier <maz@kernel.org>
-The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
-ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
-SError interrupts.
-Unfortunately, QEMU's implementation only considers the HCR_EL2
-bits, and ignores the current exception level. This means a hypervisor
-trying to look at its own interrupt state actually sees the guest
-state, which is unexpected and breaks KVM as of Linux 5.3.
-Instead, check for the running EL and return the physical bits
-if not running in a virtualized context.
-Fixes: 636540e9c40b
-Cc: qemu-stable@nongnu.org
-Reported-by: Quentin Perret <qperret@google.com>
-Signed-off-by: Marc Zyngier <maz@kernel.org>
-Message-id: 20191122135833.28953-1-maz@kernel.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 7 +++++--
-file changed, 5 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-     CPUState *cs = env_cpu(env);
-     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
-     uint64_t ret = 0;
-+    bool allow_virt = (arm_current_el(env) == 1 &&
-+                       (!arm_is_secure_below_el3(env) ||
-+                        (env->cp15.scr_el3 & SCR_EEL2)));
--    if (hcr_el2 & HCR_IMO) {
-+    if (allow_virt && (hcr_el2 & HCR_IMO)) {
-         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
-             ret |= CPSR_I;
-         }
-@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
-         }
-     }
--    if (hcr_el2 & HCR_FMO) {
-+    if (allow_virt && (hcr_el2 & HCR_FMO)) {
-         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
-             ret |= CPSR_F;
-         }
---
-.20.1

-[PULL 4/4] target/arm: Honor HCR_EL2.TID3 trapping requirements
+Deleted patch
-From: Marc Zyngier <maz@kernel.org>
-HCR_EL2.TID3 mandates that access from EL1 to a long list of id
-registers traps to EL2, and QEMU has so far ignored this requirement.
-This breaks (among other things) KVM guests that have PtrAuth enabled,
-while the hypervisor doesn't want to expose the feature to its guest.
-To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
-case), and masks out the unsupported feature.
-QEMU not honoring the trap request means that the guest observes
-that the feature is present in the HW, starts using it, and dies
-a horrible death when KVM injects an UNDEF, because the feature
-*really* isn't supported.
-Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.
-Note that this change does not include trapping of the MVFR
-registers from AArch32 (they are accessed via the VMRS
-instruction and need to be handled in a different way).
-Reported-by: Will Deacon <will@kernel.org>
-Signed-off-by: Marc Zyngier <maz@kernel.org>
-Tested-by: Will Deacon <will@kernel.org>
-Message-id: 20191123115618.29230-1-maz@kernel.org
-[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
- changed names of access functions to include _tid3]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
-file changed, 76 insertions(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
-     REGINFO_SENTINEL
- };
-+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
-+                                       bool isread)
-+{
-+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
-+        return CP_ACCESS_TRAP_EL2;
-+    }
-+
-+    return CP_ACCESS_OK;
-+}
-+
-+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
-+                                       bool isread)
-+{
-+    if (arm_feature(env, ARM_FEATURE_V8)) {
-+        return access_aa64_tid3(env, ri, isread);
-+    }
-+
-+    return CP_ACCESS_OK;
-+}
-+
- void register_cp_regs_for_features(ARMCPU *cpu)
- {
-     /* Register all the coprocessor registers based on feature bits */
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->id_pfr0 },
-             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
-              * the value of the GIC field until after we define these regs.
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
-               .access = PL1_R, .type = ARM_CP_NO_RAW,
-+              .accessfn = access_aa32_tid3,
-               .readfn = id_pfr1_read,
-               .writefn = arm_cp_write_ignore },
-             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->id_dfr0 },
-             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->id_afr0 },
-             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->id_mmfr0 },
-             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->id_mmfr1 },
-             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->id_mmfr2 },
-             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->id_mmfr3 },
-             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->isar.id_isar0 },
-             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->isar.id_isar1 },
-             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->isar.id_isar2 },
-             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->isar.id_isar3 },
-             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->isar.id_isar4 },
-             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->isar.id_isar5 },
-             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->id_mmfr4 },
-             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa32_tid3,
-               .resetvalue = cpu->isar.id_isar6 },
-             REGINFO_SENTINEL
-         };
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
-             { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
-               .access = PL1_R, .type = ARM_CP_NO_RAW,
-+              .accessfn = access_aa64_tid3,
-               .readfn = id_aa64pfr0_read,
-               .writefn = arm_cp_write_ignore },
-             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->isar.id_aa64pfr1},
-             { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               /* At present, only SVEver == 0 is defined anyway.  */
-               .resetvalue = 0 },
-             { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->id_aa64dfr0 },
-             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->id_aa64dfr1 },
-             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->id_aa64afr0 },
-             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->id_aa64afr1 },
-             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->isar.id_aa64isar0 },
-             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->isar.id_aa64isar1 },
-             { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->isar.id_aa64mmfr0 },
-             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->isar.id_aa64mmfr1 },
-             { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->isar.mvfr0 },
-             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->isar.mvfr1 },
-             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = cpu->isar.mvfr2 },
-             { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
-               .access = PL1_R, .type = ARM_CP_CONST,
-+              .accessfn = access_aa64_tid3,
-               .resetvalue = 0 },
-             { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
-               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
---
-.20.1

Arm patches for rc3 : just a handful of bug fixes.

thanks
-- PMM

The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:

Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126

for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:

target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)

----------------------------------------------------------------
target-arm queue:
 * handle FTYPE flag correctly in v7M exception return
   for v7M CPUs with an FPU (v8M CPUs were already correct)
 * versal: Add the CRP as unimplemented
 * Fix ISR_EL1 tracking when executing at EL2
 * Honor HCR_EL2.TID3 trapping requirements

----------------------------------------------------------------
Edgar E. Iglesias (1):
      hw/arm: versal: Add the CRP as unimplemented

Jean-Hugues Deschênes (1):
      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET

Marc Zyngier (2):
      target/arm: Fix ISR_EL1 tracking when executing at EL2
      target/arm: Honor HCR_EL2.TID3 trapping requirements

include/hw/arm/xlnx-versal.h |  3 ++
 hw/arm/xlnx-versal.c         |  2 ++
 target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
 target/arm/m_helper.c        |  7 ++--
 4 files changed, 89 insertions(+), 6 deletions(-)

From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>

According to the PushStack() pseudocode in the armv7m RM,
bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
an FPU is present. Current implementation is doing it for
armv8, but not for armv7. This patch makes the existing
logic applicable to both code paths.

Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/m_helper.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         if (env->v7m.secure) {
             lr |= R_V7M_EXCRET_S_MASK;
         }
-        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-            lr |= R_V7M_EXCRET_FTYPE_MASK;
-        }
     } else {
         lr = R_V7M_EXCRET_RES1_MASK |
             R_V7M_EXCRET_S_MASK |
             R_V7M_EXCRET_DCRS_MASK |
-            R_V7M_EXCRET_FTYPE_MASK |
             R_V7M_EXCRET_ES_MASK;
         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
             lr |= R_V7M_EXCRET_SPSEL_MASK;
         }
     }
+    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
+        lr |= R_V7M_EXCRET_FTYPE_MASK;
+    }
     if (!arm_v7m_is_handler_mode(env)) {
         lr |= R_V7M_EXCRET_MODE_MASK;
     }
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add the CRP as unimplemented thus avoiding bus errors when
guests access these registers.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 3 +++
 hw/arm/xlnx-versal.c         | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 #define MM_IOU_SCNTRS_SIZE          0x10000
 #define MM_FPD_CRF                  0xfd1a0000U
 #define MM_FPD_CRF_SIZE             0x140000
+
+#define MM_PMC_CRP                  0xf1260000U
+#define MM_PMC_CRP_SIZE             0x10000
 #endif
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
                         MM_CRL, MM_CRL_SIZE);
     versal_unimp_area(s, "crf", &s->mr_ps,
                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
+    versal_unimp_area(s, "crp", &s->mr_ps,
+                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
     versal_unimp_area(s, "iou-scntr", &s->mr_ps,
                         MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
     versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
SError interrupts.

Unfortunately, QEMU's implementation only considers the HCR_EL2
bits, and ignores the current exception level. This means a hypervisor
trying to look at its own interrupt state actually sees the guest
state, which is unexpected and breaks KVM as of Linux 5.3.

Instead, check for the running EL and return the physical bits
if not running in a virtualized context.

Fixes: 636540e9c40b
Cc: qemu-stable@nongnu.org
Reported-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Message-id: 20191122135833.28953-1-maz@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     CPUState *cs = env_cpu(env);
     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
     uint64_t ret = 0;
+    bool allow_virt = (arm_current_el(env) == 1 &&
+                       (!arm_is_secure_below_el3(env) ||
+                        (env->cp15.scr_el3 & SCR_EEL2)));
 
-    if (hcr_el2 & HCR_IMO) {
+    if (allow_virt && (hcr_el2 & HCR_IMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
             ret |= CPSR_I;
         }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
         }
     }
 
-    if (hcr_el2 & HCR_FMO) {
+    if (allow_virt && (hcr_el2 & HCR_FMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
             ret |= CPSR_F;
         }
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

HCR_EL2.TID3 mandates that access from EL1 to a long list of id
registers traps to EL2, and QEMU has so far ignored this requirement.

This breaks (among other things) KVM guests that have PtrAuth enabled,
while the hypervisor doesn't want to expose the feature to its guest.
To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
case), and masks out the unsupported feature.

QEMU not honoring the trap request means that the guest observes
that the feature is present in the HW, starts using it, and dies
a horrible death when KVM injects an UNDEF, because the feature
*really* isn't supported.

Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.

Note that this change does not include trapping of the MVFR
registers from AArch32 (they are accessed via the VMRS
instruction and need to be handled in a different way).

Reported-by: Will Deacon <will@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Tested-by: Will Deacon <will@kernel.org>
Message-id: 20191123115618.29230-1-maz@kernel.org
[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
 changed names of access functions to include _tid3]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        return access_aa64_tid3(env, ri, isread);
+    }
+
+    return CP_ACCESS_OK;
+}
+
 void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_pfr0 },
             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
              * the value of the GIC field until after we define these regs.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa32_tid3,
               .readfn = id_pfr1_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_dfr0 },
             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_afr0 },
             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr0 },
             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr1 },
             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr2 },
             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr3 },
             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar0 },
             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar1 },
             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar2 },
             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar3 },
             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar4 },
             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar5 },
             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr4 },
             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar6 },
             REGINFO_SENTINEL
         };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa64_tid3,
               .readfn = id_aa64pfr0_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64pfr1},
             { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               /* At present, only SVEver == 0 is defined anyway.  */
               .resetvalue = 0 },
             { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr0 },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr1 },
             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr0 },
             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr1 },
             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar0 },
             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar1 },
             { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr0 },
             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr1 },
             { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr0 },
             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr1 },
             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr2 },
             { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
-- 
2.20.1

v2: dropped the npcm7xx ethernet device, whose test case
fails weirdly on the 'build-disabled' gitlab CI job:
https://gitlab.com/qemu-project/qemu/-/jobs/1034174731#L12

The following changes since commit 8ba4bca570ace1e60614a0808631a517cf5df67a:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2021-02-15 17:13:57 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20210217

for you to fetch changes up to 59c7a187dd8bd8ef675768dd8af9de11528ea7e2:

MAINTAINERS: add myself maintainer for the clock framework (2021-02-16 14:16:17 +0000)

----------------------------------------------------------------
target-arm queue:
 * Support ARMv8.5-MemTag for linux-user
 * ncpm7xx: Support SMBus
 * MAINTAINERS: add section for Clock framework

----------------------------------------------------------------
Hao Wu (5):
      hw/i2c: Implement NPCM7XX SMBus Module Single Mode
      hw/arm: Add I2C sensors for NPCM750 eval board
      hw/arm: Add I2C sensors and EEPROM for GSJ machine
      hw/i2c: Add a QTest for NPCM7XX SMBus Device
      hw/i2c: Implement NPCM7XX SMBus Module FIFO Mode

Luc Michel (1):
      MAINTAINERS: add myself maintainer for the clock framework

Richard Henderson (31):
      tcg: Introduce target-specific page data for user-only
      linux-user: Introduce PAGE_ANON
      exec: Use uintptr_t for guest_base
      exec: Use uintptr_t in cpu_ldst.h
      exec: Improve types for guest_addr_valid
      linux-user: Check for overflow in access_ok
      linux-user: Tidy VERIFY_READ/VERIFY_WRITE
      bsd-user: Tidy VERIFY_READ/VERIFY_WRITE
      linux-user: Do not use guest_addr_valid for h2g_valid
      linux-user: Fix guest_addr_valid vs reserved_va
      exec: Introduce cpu_untagged_addr
      exec: Use cpu_untagged_addr in g2h; split out g2h_untagged
      linux-user: Explicitly untag memory management syscalls
      linux-user: Use guest_range_valid in access_ok
      exec: Rename guest_{addr,range}_valid to *_untagged
      linux-user: Use cpu_untagged_addr in access_ok; split out *_untagged
      linux-user: Move lock_user et al out of line
      linux-user: Fix types in uaccess.c
      linux-user: Handle tags in lock_user/unlock_user
      linux-user/aarch64: Implement PR_TAGGED_ADDR_ENABLE
      target/arm: Improve gen_top_byte_ignore
      target/arm: Use the proper TBI settings for linux-user
      linux-user/aarch64: Implement PR_MTE_TCF and PR_MTE_TAG
      linux-user/aarch64: Implement PROT_MTE
      target/arm: Split out syndrome.h from internals.h
      linux-user/aarch64: Pass syndrome to EXC_*_ABORT
      linux-user/aarch64: Signal SEGV_MTESERR for sync tag check fault
      linux-user/aarch64: Signal SEGV_MTEAERR for async tag check error
      target/arm: Add allocation tag storage for user mode
      target/arm: Enable MTE for user-only
      tests/tcg/aarch64: Add mte smoke tests