Series comparison

-[PULL 0/4] target-arm queue
+[PULL 0/9] target-arm queue
-Arm patches for rc3 : just a handful of bug fixes.
+My OS Lock/DoubleLock patches, plus a small selection of other
 bug fixes and minor things.
 thanks
 -- PMM
+The following changes since commit 8e9398e3b1a860b8c29c670c1b6c36afe8d87849:
-The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:
+  Merge tag 'pull-ppc-20220706' of https://gitlab.com/danielhb/qemu into staging (2022-07-07 06:21:05 +0530)
   Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220707
-for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:
+for you to fetch changes up to c2360eaa0262a816faf8032b7762d0c73df2cc62:
-  target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)
+  target/arm: Fix qemu-system-arm handling of LPAE block descriptors for highmem (2022-07-07 11:41:04 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * handle FTYPE flag correctly in v7M exception return
+ * hw/arm/virt: dt: add rng-seed property
-   for v7M CPUs with an FPU (v8M CPUs were already correct)
+ * Fix MTE check in sve_ldnfff1_r
- * versal: Add the CRP as unimplemented
+ * Record tagged bit for user-only in sve_probe_page
- * Fix ISR_EL1 tracking when executing at EL2
+ * Correctly implement OS Lock and OS DoubleLock
- * Honor HCR_EL2.TID3 trapping requirements
+ * Implement DBGDEVID, DBGDEVID1, DBGDEVID2 registers
  * Fix qemu-system-arm handling of LPAE block descriptors for highmem
 ----------------------------------------------------------------
-Edgar E. Iglesias (1):
+Jason A. Donenfeld (1):
-      hw/arm: versal: Add the CRP as unimplemented
+      hw/arm/virt: dt: add rng-seed property
-Jean-Hugues Deschênes (1):
+Peter Maydell (6):
-      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
+      target/arm: Fix code style issues in debug helper functions
       target/arm: Move define_debug_regs() to debug_helper.c
       target/arm: Suppress debug exceptions when OS Lock set
       target/arm: Implement AArch32 DBGDEVID, DBGDEVID1, DBGDEVID2
       target/arm: Correctly implement Feat_DoubleLock
       target/arm: Fix qemu-system-arm handling of LPAE block descriptors for highmem
-Marc Zyngier (2):
+Richard Henderson (2):
-      target/arm: Fix ISR_EL1 tracking when executing at EL2
+      target/arm: Fix MTE check in sve_ldnfff1_r
-      target/arm: Honor HCR_EL2.TID3 trapping requirements
+      target/arm: Record tagged bit for user-only in sve_probe_page
- include/hw/arm/xlnx-versal.h |  3 ++
+ docs/about/deprecated.rst |   8 +
- hw/arm/xlnx-versal.c         |  2 ++
+ docs/system/arm/virt.rst  |  17 +-
- target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
+ include/hw/arm/virt.h     |   2 +-
- target/arm/m_helper.c        |  7 ++--
+ target/arm/cpregs.h       |   3 +
-files changed, 89 insertions(+), 6 deletions(-)
+ target/arm/cpu.h          |  27 +++
+ target/arm/internals.h    |   9 +
  hw/arm/virt.c             |  44 ++--
  target/arm/cpu64.c        |   6 +
  target/arm/cpu_tcg.c      |   6 +
  target/arm/debug_helper.c | 580 ++++++++++++++++++++++++++++++++++++++++++++++
  target/arm/helper.c       | 513 +---------------------------------------
  target/arm/ptw.c          |   2 +-
  target/arm/sve_helper.c   |   5 +-
 files changed, 684 insertions(+), 538 deletions(-)

-[PULL 1/4] target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
+[PULL 1/9] hw/arm/virt: dt: add rng-seed property
-From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>
+From: "Jason A. Donenfeld" <Jason@zx2c4.com>
-According to the PushStack() pseudocode in the armv7m RM,
+In 60592cfed2 ("hw/arm/virt: dt: add kaslr-seed property"), the
-bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
+kaslr-seed property was added, but the equally as important rng-seed
-an FPU is present. Current implementation is doing it for
+property was forgotten about, which has identical semantics for a
-armv8, but not for armv7. This patch makes the existing
+similar purpose. This commit implements it in exactly the same way as
-logic applicable to both code paths.
+kaslr-seed. It then changes the name of the disabling option to reflect
 that this has more to do with randomness vs determinism, rather than
 something particular about kaslr.
-Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
+Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
 [PMM: added deprecated.rst section for the deprecation]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/m_helper.c | 7 +++----
+ docs/about/deprecated.rst |  8 +++++++
-file changed, 3 insertions(+), 4 deletions(-)
+ docs/system/arm/virt.rst  | 17 +++++++++------
  include/hw/arm/virt.h     |  2 +-
  hw/arm/virt.c             | 44 ++++++++++++++++++++++++---------------
 files changed, 47 insertions(+), 24 deletions(-)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/docs/about/deprecated.rst
-+++ b/target/arm/m_helper.c
++++ b/docs/about/deprecated.rst
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ Use the more generic event ``DEVICE_UNPLUG_GUEST_ERROR`` instead.
-         if (env->v7m.secure) {
+ System emulator machines
-             lr |= R_V7M_EXCRET_S_MASK;
+ ------------------------
-         }
--        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
++Arm ``virt`` machine ``dtb-kaslr-seed`` property
--            lr |= R_V7M_EXCRET_FTYPE_MASK;
++''''''''''''''''''''''''''''''''''''''''''''''''
--        }
++
-     } else {
++The ``dtb-kaslr-seed`` property on the ``virt`` board has been
-         lr = R_V7M_EXCRET_RES1_MASK |
++deprecated; use the new name ``dtb-randomness`` instead. The new name
-             R_V7M_EXCRET_S_MASK |
++better reflects the way this property affects all random data within
-             R_V7M_EXCRET_DCRS_MASK |
++the device tree blob, not just the ``kaslr-seed`` node.
--            R_V7M_EXCRET_FTYPE_MASK |
++
-             R_V7M_EXCRET_ES_MASK;
+ PPC 405 ``taihu`` machine (since 7.0)
-         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
+ '''''''''''''''''''''''''''''''''''''
-             lr |= R_V7M_EXCRET_SPSEL_MASK;
 diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/arm/virt.rst
 +++ b/docs/system/arm/virt.rst
@@ -XXX,XX +XXX,XX @@ ras
    Set ``on``/``off`` to enable/disable reporting host memory errors to a guest
    using ACPI and guest external abort exceptions. The default is off.
 +dtb-randomness
 +  Set ``on``/``off`` to pass random seeds via the guest DTB
 +  rng-seed and kaslr-seed nodes (in both "/chosen" and
 +  "/secure-chosen") to use for features like the random number
 +  generator and address space randomisation. The default is
 +  ``on``. You will want to disable it if your trusted boot chain
 +  will verify the DTB it is passed, since this option causes the
 +  DTB to be non-deterministic. It would be the responsibility of
 +  the firmware to come up with a seed and pass it on if it wants to.
 +
  dtb-kaslr-seed
 -  Set ``on``/``off`` to pass a random seed via the guest dtb
 -  kaslr-seed node (in both "/chosen" and /secure-chosen) to use
 -  for features like address space randomisation. The default is
 -  ``on``. You will want to disable it if your trusted boot chain will
 -  verify the DTB it is passed. It would be the responsibility of the
 -  firmware to come up with a seed and pass it on if it wants to.
 +  A deprecated synonym for dtb-randomness.
  Linux guest kernel configuration
  """"""""""""""""""""""""""""""""
 diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/virt.h
 +++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {
      bool virt;
      bool ras;
      bool mte;
 -    bool dtb_kaslr_seed;
 +    bool dtb_randomness;
      OnOffAuto acpi;
      VirtGICType gic_version;
      VirtIOMMUType iommu;
 diff --git a/hw/arm/virt.c b/hw/arm/virt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/virt.c
 +++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_type_valid(const char *cpu)
      return false;
  }
 -static void create_kaslr_seed(MachineState *ms, const char *node)
 +static void create_randomness(MachineState *ms, const char *node)
  {
 -    uint64_t seed;
 +    struct {
 +        uint64_t kaslr;
 +        uint8_t rng[32];
 +    } seed;
      if (qemu_guest_getrandom(&seed, sizeof(seed), NULL)) {
          return;
      }
 -    qemu_fdt_setprop_u64(ms->fdt, node, "kaslr-seed", seed);
 +    qemu_fdt_setprop_u64(ms->fdt, node, "kaslr-seed", seed.kaslr);
 +    qemu_fdt_setprop(ms->fdt, node, "rng-seed", seed.rng, sizeof(seed.rng));
  }
  static void create_fdt(VirtMachineState *vms)
@@ -XXX,XX +XXX,XX @@ static void create_fdt(VirtMachineState *vms)
      /* /chosen must exist for load_dtb to fill in necessary properties later */
      qemu_fdt_add_subnode(fdt, "/chosen");
 -    if (vms->dtb_kaslr_seed) {
 -        create_kaslr_seed(ms, "/chosen");
 +    if (vms->dtb_randomness) {
 +        create_randomness(ms, "/chosen");
      }
      if (vms->secure) {
          qemu_fdt_add_subnode(fdt, "/secure-chosen");
 -        if (vms->dtb_kaslr_seed) {
 -            create_kaslr_seed(ms, "/secure-chosen");
 +        if (vms->dtb_randomness) {
 +            create_randomness(ms, "/secure-chosen");
          }
      }
-+    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-+        lr |= R_V7M_EXCRET_FTYPE_MASK;
+@@ -XXX,XX +XXX,XX @@ static void virt_set_its(Object *obj, bool value, Error **errp)
-+    }
+     vms->its = value;
-     if (!arm_v7m_is_handler_mode(env)) {
+ }
-         lr |= R_V7M_EXCRET_MODE_MASK;
-     }
+-static bool virt_get_dtb_kaslr_seed(Object *obj, Error **errp)
 +static bool virt_get_dtb_randomness(Object *obj, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
 -    return vms->dtb_kaslr_seed;
 +    return vms->dtb_randomness;
  }
 -static void virt_set_dtb_kaslr_seed(Object *obj, bool value, Error **errp)
 +static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
  {
      VirtMachineState *vms = VIRT_MACHINE(obj);
 -    vms->dtb_kaslr_seed = value;
 +    vms->dtb_randomness = value;
  }
  static char *virt_get_oem_id(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
                                            "Set on/off to enable/disable "
                                            "ITS instantiation");
 +    object_class_property_add_bool(oc, "dtb-randomness",
 +                                   virt_get_dtb_randomness,
 +                                   virt_set_dtb_randomness);
 +    object_class_property_set_description(oc, "dtb-randomness",
 +                                          "Set off to disable passing random or "
 +                                          "non-deterministic dtb nodes to guest");
 +
      object_class_property_add_bool(oc, "dtb-kaslr-seed",
 -                                   virt_get_dtb_kaslr_seed,
 -                                   virt_set_dtb_kaslr_seed);
 +                                   virt_get_dtb_randomness,
 +                                   virt_set_dtb_randomness);
      object_class_property_set_description(oc, "dtb-kaslr-seed",
 -                                          "Set off to disable passing of kaslr-seed "
 -                                          "dtb node to guest");
 +                                          "Deprecated synonym of dtb-randomness");
      object_class_property_add_str(oc, "x-oem-id",
                                    virt_get_oem_id,
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
      /* MTE is disabled by default.  */
      vms->mte = false;
 -    /* Supply a kaslr-seed by default */
 -    vms->dtb_kaslr_seed = true;
 +    /* Supply kaslr-seed and rng-seed by default */
 +    vms->dtb_randomness = true;
      vms->irqmap = a15irqmap;
 --
-.20.1
+.25.1

-New patch
+[PULL 2/9] target/arm: Fix MTE check in sve_ldnfff1_r
+From: Richard Henderson <richard.henderson@linaro.org>
+The comment was correct, but the test was not:
+disable mte if tagged is *not* set.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/sve_helper.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/sve_helper.c
++++ b/target/arm/sve_helper.c
+@@ -XXX,XX +XXX,XX @@ void sve_ldnfff1_r(CPUARMState *env, void *vg, const target_ulong addr,
+      * Disable MTE checking if the Tagged bit is not set.  Since TBI must
+      * be set within MTEDESC for MTE, !mtedesc => !mte_active.
+      */
+-    if (arm_tlb_mte_tagged(&info.page[0].attrs)) {
++    if (!arm_tlb_mte_tagged(&info.page[0].attrs)) {
+         mtedesc = 0;
+     }
+--
+.25.1

-New patch
+[PULL 3/9] target/arm: Record tagged bit for user-only in sve_probe_page
+From: Richard Henderson <richard.henderson@linaro.org>
+Fixes a bug in that we were not honoring MTE from user-only
+SVE. Copy the user-only MTE logic from allocation_tag_mem
+into sve_probe_page.
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/sve_helper.c | 3 +++
+file changed, 3 insertions(+)
+diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/sve_helper.c
++++ b/target/arm/sve_helper.c
+@@ -XXX,XX +XXX,XX @@ bool sve_probe_page(SVEHostPage *info, bool nofault, CPUARMState *env,
+ #ifdef CONFIG_USER_ONLY
+     memset(&info->attrs, 0, sizeof(info->attrs));
++    /* Require both MAP_ANON and PROT_MTE -- see allocation_tag_mem. */
++    arm_tlb_mte_tagged(&info->attrs) =
++        (flags & PAGE_ANON) && (flags & PAGE_MTE);
+ #else
+     /*
+      * Find the iotlbentry for addr and return the transaction attributes.
+--
+.25.1

-[PULL 4/4] target/arm: Honor HCR_EL2.TID3 trapping requirements
+[PULL 4/9] target/arm: Fix code style issues in debug helper functions
-From: Marc Zyngier <maz@kernel.org>
+Before moving debug system register helper functions to a
 different file, fix the code style issues (mostly block
 comment syntax) so checkpatch doesn't complain about the
 code-motion patch.
-HCR_EL2.TID3 mandates that access from EL1 to a long list of id
-registers traps to EL2, and QEMU has so far ignored this requirement.
-This breaks (among other things) KVM guests that have PtrAuth enabled,
-while the hypervisor doesn't want to expose the feature to its guest.
-To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
-case), and masks out the unsupported feature.
-QEMU not honoring the trap request means that the guest observes
-that the feature is present in the HW, starts using it, and dies
-a horrible death when KVM injects an UNDEF, because the feature
-*really* isn't supported.
-Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.
-Note that this change does not include trapping of the MVFR
-registers from AArch32 (they are accessed via the VMRS
-instruction and need to be handled in a different way).
-Reported-by: Will Deacon <will@kernel.org>
-Signed-off-by: Marc Zyngier <maz@kernel.org>
-Tested-by: Will Deacon <will@kernel.org>
-Message-id: 20191123115618.29230-1-maz@kernel.org
-[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
- changed names of access functions to include _tid3]
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220630194116.3438513-2-peter.maydell@linaro.org
 ---
- target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
+ target/arm/helper.c | 58 +++++++++++++++++++++++++++++----------------
-file changed, 76 insertions(+)
+file changed, 38 insertions(+), 20 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ static uint64_t arm_mdcr_el2_eff(CPUARMState *env)
-     REGINFO_SENTINEL
+     return arm_is_el2_enabled(env) ? env->cp15.mdcr_el2 : 0;
  }
 -/* Check for traps to "powerdown debug" registers, which are controlled
 +/*
 + * Check for traps to "powerdown debug" registers, which are controlled
   * by MDCR.TDOSA
   */
  static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
      return CP_ACCESS_OK;
  }
 -/* Check for traps to "debug ROM" registers, which are controlled
 +/*
 + * Check for traps to "debug ROM" registers, which are controlled
   * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
   */
  static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
      return CP_ACCESS_OK;
  }
 -/* Check for traps to general debug registers, which are controlled
 +/*
 + * Check for traps to general debug registers, which are controlled
   * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
   */
  static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
  static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
                          uint64_t value)
  {
 -    /* Writes to OSLAR_EL1 may update the OS lock status, which can be
 +    /*
 +     * Writes to OSLAR_EL1 may update the OS lock status, which can be
       * read via a bit in OSLSR_EL1.
       */
      int oslock;
@@ -XXX,XX +XXX,XX @@ static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
  }
  static const ARMCPRegInfo debug_cp_reginfo[] = {
 -    /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
 +    /*
 +     * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
       * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
       * unlike DBGDRAR it is never accessible from EL0.
       * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
        .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
        .access = PL1_RW, .accessfn = access_tdosa,
        .type = ARM_CP_NOP },
 -    /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
 +    /*
 +     * Dummy DBGVCR: Linux wants to clear this on startup, but we don't
       * implement vector catch debug events yet.
       */
      { .name = "DBGVCR",
        .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
        .access = PL1_RW, .accessfn = access_tda,
        .type = ARM_CP_NOP },
 -    /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
 +    /*
 +     * Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
       * to save and restore a 32-bit guest's DBGVCR)
       */
      { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
        .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
        .access = PL2_RW, .accessfn = access_tda,
        .type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
 -    /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications
 +    /*
 +     * Dummy MDCCINT_EL1, since we don't implement the Debug Communications
       * Channel but Linux may try to access this register. The 32-bit
       * alias is DBGDCCINT.
       */
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
  static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
      /* 64 bit access versions of the (dummy) debug registers */
      { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
 -      .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
 +      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
      { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
 -      .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
 +      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
  };
-+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+ /*
-+                                       bool isread)
+@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update(ARMCPU *cpu, int n)
-+{
+         break;
-+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
+     }
-+        return CP_ACCESS_TRAP_EL2;
-+    }
+-    /* Attempts to use both MASK and BAS fields simultaneously are
-+
++    /*
-+    return CP_ACCESS_OK;
++     * Attempts to use both MASK and BAS fields simultaneously are
-+}
+      * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
-+
+      * thus generating a watchpoint for every byte in the masked region.
-+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+      */
-+                                       bool isread)
+     mask = FIELD_EX64(wcr, DBGWCR, MASK);
-+{
+     if (mask == 1 || mask == 2) {
-+    if (arm_feature(env, ARM_FEATURE_V8)) {
+-        /* Reserved values of MASK; we must act as if the mask value was
-+        return access_aa64_tid3(env, ri, isread);
++        /*
-+    }
++         * Reserved values of MASK; we must act as if the mask value was
-+
+          * some non-reserved value, or as if the watchpoint were disabled.
-+    return CP_ACCESS_OK;
+          * We choose the latter.
-+}
+          */
-+
+@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update(ARMCPU *cpu, int n)
- void register_cp_regs_for_features(ARMCPU *cpu)
+     } else if (mask) {
          /* Watchpoint covers an aligned area up to 2GB in size */
          len = 1ULL << mask;
 -        /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
 +        /*
 +         * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
           * whether the watchpoint fires when the unmasked bits match; we opt
           * to generate the exceptions.
           */
@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update(ARMCPU *cpu, int n)
          int basstart;
          if (extract64(wvr, 2, 1)) {
 -            /* Deprecated case of an only 4-aligned address. BAS[7:4] are
 +            /*
 +             * Deprecated case of an only 4-aligned address. BAS[7:4] are
               * ignored, and BAS[3:0] define which bytes to watch.
               */
              bas &= 0xf;
@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update(ARMCPU *cpu, int n)
              return;
          }
 -        /* The BAS bits are supposed to be programmed to indicate a contiguous
 +        /*
 +         * The BAS bits are supposed to be programmed to indicate a contiguous
           * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
           * we fire for each byte in the word/doubleword addressed by the WVR.
           * We choose to ignore any non-zero bits after the first range of 1s.
@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update_all(ARMCPU *cpu)
      int i;
      CPUARMState *env = &cpu->env;
 -    /* Completely clear out existing QEMU watchpoints and our array, to
 +    /*
 +     * Completely clear out existing QEMU watchpoints and our array, to
       * avoid possible stale entries following migration load.
       */
      cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update(ARMCPU *cpu, int n)
      case 11: /* linked context ID and VMID match (reserved if no EL2) */
      case 3: /* linked context ID match */
      default:
 -        /* We must generate no events for Linked context matches (unless
 +        /*
 +         * We must generate no events for Linked context matches (unless
           * they are linked to by some other bp/wp, which is handled in
           * updates for the linking bp/wp). We choose to also generate no events
           * for reserved values.
@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update_all(ARMCPU *cpu)
      int i;
      CPUARMState *env = &cpu->env;
 -    /* Completely clear out existing QEMU breakpoints and our array, to
 +    /*
 +     * Completely clear out existing QEMU breakpoints and our array, to
       * avoid possible stale entries following migration load.
       */
      cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
@@ -XXX,XX +XXX,XX @@ static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
      ARMCPU *cpu = env_archcpu(env);
      int i = ri->crm;
 -    /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
 +    /*
 +     * BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
       * copy of BAS[0].
       */
      value = deposit64(value, 6, 1, extract64(value, 5, 1));
@@ -XXX,XX +XXX,XX @@ static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
  static void define_debug_regs(ARMCPU *cpu)
  {
-     /* Register all the coprocessor registers based on feature bits */
+-    /* Define v7 and v8 architectural debug registers.
-@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
++    /*
-             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
++     * Define v7 and v8 architectural debug registers.
-               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
+      * These are just dummy implementations for now.
-               .access = PL1_R, .type = ARM_CP_CONST,
+      */
-+              .accessfn = access_aa32_tid3,
+     int i;
                .resetvalue = cpu->id_pfr0 },
              /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
               * the value of the GIC field until after we define these regs.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_NO_RAW,
 +              .accessfn = access_aa32_tid3,
                .readfn = id_pfr1_read,
                .writefn = arm_cp_write_ignore },
              { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_dfr0 },
              { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_afr0 },
              { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr0 },
              { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr1 },
              { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr2 },
              { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr3 },
              { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar0 },
              { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar1 },
              { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar2 },
              { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar3 },
              { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar4 },
              { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar5 },
              { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr4 },
              { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar6 },
              REGINFO_SENTINEL
          };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_NO_RAW,
 +              .accessfn = access_aa64_tid3,
                .readfn = id_aa64pfr0_read,
                .writefn = arm_cp_write_ignore },
              { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64pfr1},
              { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                /* At present, only SVEver == 0 is defined anyway.  */
                .resetvalue = 0 },
              { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr0 },
              { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr1 },
              { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr0 },
              { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr1 },
              { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar0 },
              { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar1 },
              { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr0 },
              { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr1 },
              { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr0 },
              { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr1 },
              { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr2 },
              { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
                .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
 --
-.20.1
+.25.1

-[PULL 3/4] target/arm: Fix ISR_EL1 tracking when executing at EL2
+[PULL 5/9] target/arm: Move define_debug_regs() to debug_helper.c
-From: Marc Zyngier <maz@kernel.org>
+The target/arm/helper.c file is very long and is a grabbag of all
 kinds of functionality.  We have already a debug_helper.c which has
 code for implementing architectural debug.  Move the code which
 defines the debug-related system registers out to this file also.
 This affects the define_debug_regs() function and the various
 functions and arrays which are used only by it.
-The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
+The functions raw_write() and arm_mdcr_el2_eff() and
-ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
+define_debug_regs() now need to be global rather than local to
-SError interrupts.
+helper.c; everything else is pure code movement.
-Unfortunately, QEMU's implementation only considers the HCR_EL2
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-bits, and ignores the current exception level. This means a hypervisor
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-trying to look at its own interrupt state actually sees the guest
+Message-id: 20220630194116.3438513-3-peter.maydell@linaro.org
-state, which is unexpected and breaks KVM as of Linux 5.3.
+---
  target/arm/cpregs.h       |   3 +
  target/arm/internals.h    |   9 +
  target/arm/debug_helper.c | 525 +++++++++++++++++++++++++++++++++++++
  target/arm/helper.c       | 531 +-------------------------------------
 files changed, 538 insertions(+), 530 deletions(-)
-Instead, check for the running EL and return the physical bits
+diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
-if not running in a virtualized context.
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpregs.h
-Fixes: 636540e9c40b
++++ b/target/arm/cpregs.h
-Cc: qemu-stable@nongnu.org
+@@ -XXX,XX +XXX,XX @@ void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
-Reported-by: Quentin Perret <qperret@google.com>
+ /* CPReadFn that can be used for read-as-zero behaviour */
-Signed-off-by: Marc Zyngier <maz@kernel.org>
+ uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri);
-Message-id: 20191122135833.28953-1-maz@kernel.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
++/* CPWriteFn that just writes the value to ri->fieldoffset */
-Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
++void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value);
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
++
----
+ /*
- target/arm/helper.c | 7 +++++--
+  * CPResetFn that does nothing, for use if no reset is required even
-file changed, 5 insertions(+), 2 deletions(-)
+  * if fieldoffset is non zero.
+diff --git a/target/arm/internals.h b/target/arm/internals.h
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/internals.h
 +++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int exception_target_el(CPUARMState *env);
  bool arm_singlestep_active(CPUARMState *env);
  bool arm_generate_debug_exceptions(CPUARMState *env);
 +/* Add the cpreg definitions for debug related system registers */
 +void define_debug_regs(ARMCPU *cpu);
 +
 +/* Effective value of MDCR_EL2 */
 +static inline uint64_t arm_mdcr_el2_eff(CPUARMState *env)
 +{
 +    return arm_is_el2_enabled(env) ? env->cp15.mdcr_el2 : 0;
 +}
 +
  /* Powers of 2 for sve_vq_map et al. */
  #define SVE_VQ_POW2_MAP                                 \
      ((1 << (1 - 1)) | (1 << (2 - 1)) |                  \
 diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/debug_helper.c
 +++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
   * SPDX-License-Identifier: GPL-2.0-or-later
   */
  #include "qemu/osdep.h"
 +#include "qemu/log.h"
  #include "cpu.h"
  #include "internals.h"
 +#include "cpregs.h"
  #include "exec/exec-all.h"
  #include "exec/helper-proto.h"
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
      raise_exception_debug(env, EXCP_UDEF, syndrome);
  }
 +/*
 + * Check for traps to "powerdown debug" registers, which are controlled
 + * by MDCR.TDOSA
 + */
 +static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                   bool isread)
 +{
 +    int el = arm_current_el(env);
 +    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 +    bool mdcr_el2_tdosa = (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TDE) ||
 +        (arm_hcr_el2_eff(env) & HCR_TGE);
 +
 +    if (el < 2 && mdcr_el2_tdosa) {
 +        return CP_ACCESS_TRAP_EL2;
 +    }
 +    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
 +        return CP_ACCESS_TRAP_EL3;
 +    }
 +    return CP_ACCESS_OK;
 +}
 +
 +/*
 + * Check for traps to "debug ROM" registers, which are controlled
 + * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
 + */
 +static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                  bool isread)
 +{
 +    int el = arm_current_el(env);
 +    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 +    bool mdcr_el2_tdra = (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE) ||
 +        (arm_hcr_el2_eff(env) & HCR_TGE);
 +
 +    if (el < 2 && mdcr_el2_tdra) {
 +        return CP_ACCESS_TRAP_EL2;
 +    }
 +    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
 +        return CP_ACCESS_TRAP_EL3;
 +    }
 +    return CP_ACCESS_OK;
 +}
 +
 +/*
 + * Check for traps to general debug registers, which are controlled
 + * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
 + */
 +static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                  bool isread)
 +{
 +    int el = arm_current_el(env);
 +    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 +    bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) ||
 +        (arm_hcr_el2_eff(env) & HCR_TGE);
 +
 +    if (el < 2 && mdcr_el2_tda) {
 +        return CP_ACCESS_TRAP_EL2;
 +    }
 +    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
 +        return CP_ACCESS_TRAP_EL3;
 +    }
 +    return CP_ACCESS_OK;
 +}
 +
 +static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +                        uint64_t value)
 +{
 +    /*
 +     * Writes to OSLAR_EL1 may update the OS lock status, which can be
 +     * read via a bit in OSLSR_EL1.
 +     */
 +    int oslock;
 +
 +    if (ri->state == ARM_CP_STATE_AA32) {
 +        oslock = (value == 0xC5ACCE55);
 +    } else {
 +        oslock = value & 1;
 +    }
 +
 +    env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
 +}
 +
 +static const ARMCPRegInfo debug_cp_reginfo[] = {
 +    /*
 +     * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
 +     * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
 +     * unlike DBGDRAR it is never accessible from EL0.
 +     * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
 +     * accessor.
 +     */
 +    { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
 +      .access = PL0_R, .accessfn = access_tdra,
 +      .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
 +      .access = PL1_R, .accessfn = access_tdra,
 +      .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
 +      .access = PL0_R, .accessfn = access_tdra,
 +      .type = ARM_CP_CONST, .resetvalue = 0 },
 +    /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
 +    { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
 +      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
 +      .access = PL1_RW, .accessfn = access_tda,
 +      .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
 +      .resetvalue = 0 },
 +    /*
 +     * MDCCSR_EL0[30:29] map to EDSCR[30:29].  Simply RAZ as the external
 +     * Debug Communication Channel is not implemented.
 +     */
 +    { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 2, .opc1 = 3, .crn = 0, .crm = 1, .opc2 = 0,
 +      .access = PL0_R, .accessfn = access_tda,
 +      .type = ARM_CP_CONST, .resetvalue = 0 },
 +    /*
 +     * DBGDSCRint[15,12,5:2] map to MDSCR_EL1[15,12,5:2].  Map all bits as
 +     * it is unlikely a guest will care.
 +     * We don't implement the configurable EL0 access.
 +     */
 +    { .name = "DBGDSCRint", .state = ARM_CP_STATE_AA32,
 +      .cp = 14, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
 +      .type = ARM_CP_ALIAS,
 +      .access = PL1_R, .accessfn = access_tda,
 +      .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
 +    { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
 +      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
 +      .access = PL1_W, .type = ARM_CP_NO_RAW,
 +      .accessfn = access_tdosa,
 +      .writefn = oslar_write },
 +    { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
 +      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
 +      .access = PL1_R, .resetvalue = 10,
 +      .accessfn = access_tdosa,
 +      .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
 +    /* Dummy OSDLR_EL1: 32-bit Linux will read this */
 +    { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
 +      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
 +      .access = PL1_RW, .accessfn = access_tdosa,
 +      .type = ARM_CP_NOP },
 +    /*
 +     * Dummy DBGVCR: Linux wants to clear this on startup, but we don't
 +     * implement vector catch debug events yet.
 +     */
 +    { .name = "DBGVCR",
 +      .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
 +      .access = PL1_RW, .accessfn = access_tda,
 +      .type = ARM_CP_NOP },
 +    /*
 +     * Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
 +     * to save and restore a 32-bit guest's DBGVCR)
 +     */
 +    { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
 +      .access = PL2_RW, .accessfn = access_tda,
 +      .type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
 +    /*
 +     * Dummy MDCCINT_EL1, since we don't implement the Debug Communications
 +     * Channel but Linux may try to access this register. The 32-bit
 +     * alias is DBGDCCINT.
 +     */
 +    { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
 +      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
 +      .access = PL1_RW, .accessfn = access_tda,
 +      .type = ARM_CP_NOP },
 +};
 +
 +static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
 +    /* 64 bit access versions of the (dummy) debug registers */
 +    { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
 +      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 +    { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
 +      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 +};
 +
 +void hw_watchpoint_update(ARMCPU *cpu, int n)
 +{
 +    CPUARMState *env = &cpu->env;
 +    vaddr len = 0;
 +    vaddr wvr = env->cp15.dbgwvr[n];
 +    uint64_t wcr = env->cp15.dbgwcr[n];
 +    int mask;
 +    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
 +
 +    if (env->cpu_watchpoint[n]) {
 +        cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
 +        env->cpu_watchpoint[n] = NULL;
 +    }
 +
 +    if (!FIELD_EX64(wcr, DBGWCR, E)) {
 +        /* E bit clear : watchpoint disabled */
 +        return;
 +    }
 +
 +    switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
 +    case 0:
 +        /* LSC 00 is reserved and must behave as if the wp is disabled */
 +        return;
 +    case 1:
 +        flags |= BP_MEM_READ;
 +        break;
 +    case 2:
 +        flags |= BP_MEM_WRITE;
 +        break;
 +    case 3:
 +        flags |= BP_MEM_ACCESS;
 +        break;
 +    }
 +
 +    /*
 +     * Attempts to use both MASK and BAS fields simultaneously are
 +     * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
 +     * thus generating a watchpoint for every byte in the masked region.
 +     */
 +    mask = FIELD_EX64(wcr, DBGWCR, MASK);
 +    if (mask == 1 || mask == 2) {
 +        /*
 +         * Reserved values of MASK; we must act as if the mask value was
 +         * some non-reserved value, or as if the watchpoint were disabled.
 +         * We choose the latter.
 +         */
 +        return;
 +    } else if (mask) {
 +        /* Watchpoint covers an aligned area up to 2GB in size */
 +        len = 1ULL << mask;
 +        /*
 +         * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
 +         * whether the watchpoint fires when the unmasked bits match; we opt
 +         * to generate the exceptions.
 +         */
 +        wvr &= ~(len - 1);
 +    } else {
 +        /* Watchpoint covers bytes defined by the byte address select bits */
 +        int bas = FIELD_EX64(wcr, DBGWCR, BAS);
 +        int basstart;
 +
 +        if (extract64(wvr, 2, 1)) {
 +            /*
 +             * Deprecated case of an only 4-aligned address. BAS[7:4] are
 +             * ignored, and BAS[3:0] define which bytes to watch.
 +             */
 +            bas &= 0xf;
 +        }
 +
 +        if (bas == 0) {
 +            /* This must act as if the watchpoint is disabled */
 +            return;
 +        }
 +
 +        /*
 +         * The BAS bits are supposed to be programmed to indicate a contiguous
 +         * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
 +         * we fire for each byte in the word/doubleword addressed by the WVR.
 +         * We choose to ignore any non-zero bits after the first range of 1s.
 +         */
 +        basstart = ctz32(bas);
 +        len = cto32(bas >> basstart);
 +        wvr += basstart;
 +    }
 +
 +    cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
 +                          &env->cpu_watchpoint[n]);
 +}
 +
 +void hw_watchpoint_update_all(ARMCPU *cpu)
 +{
 +    int i;
 +    CPUARMState *env = &cpu->env;
 +
 +    /*
 +     * Completely clear out existing QEMU watchpoints and our array, to
 +     * avoid possible stale entries following migration load.
 +     */
 +    cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
 +    memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
 +
 +    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
 +        hw_watchpoint_update(cpu, i);
 +    }
 +}
 +
 +static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +                         uint64_t value)
 +{
 +    ARMCPU *cpu = env_archcpu(env);
 +    int i = ri->crm;
 +
 +    /*
 +     * Bits [1:0] are RES0.
 +     *
 +     * It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA)
 +     * are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if
 +     * they contain the value written.  It is CONSTRAINED UNPREDICTABLE
 +     * whether the RESS bits are ignored when comparing an address.
 +     *
 +     * Therefore we are allowed to compare the entire register, which lets
 +     * us avoid considering whether or not FEAT_LVA is actually enabled.
 +     */
 +    value &= ~3ULL;
 +
 +    raw_write(env, ri, value);
 +    hw_watchpoint_update(cpu, i);
 +}
 +
 +static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +                         uint64_t value)
 +{
 +    ARMCPU *cpu = env_archcpu(env);
 +    int i = ri->crm;
 +
 +    raw_write(env, ri, value);
 +    hw_watchpoint_update(cpu, i);
 +}
 +
 +void hw_breakpoint_update(ARMCPU *cpu, int n)
 +{
 +    CPUARMState *env = &cpu->env;
 +    uint64_t bvr = env->cp15.dbgbvr[n];
 +    uint64_t bcr = env->cp15.dbgbcr[n];
 +    vaddr addr;
 +    int bt;
 +    int flags = BP_CPU;
 +
 +    if (env->cpu_breakpoint[n]) {
 +        cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
 +        env->cpu_breakpoint[n] = NULL;
 +    }
 +
 +    if (!extract64(bcr, 0, 1)) {
 +        /* E bit clear : watchpoint disabled */
 +        return;
 +    }
 +
 +    bt = extract64(bcr, 20, 4);
 +
 +    switch (bt) {
 +    case 4: /* unlinked address mismatch (reserved if AArch64) */
 +    case 5: /* linked address mismatch (reserved if AArch64) */
 +        qemu_log_mask(LOG_UNIMP,
 +                      "arm: address mismatch breakpoint types not implemented\n");
 +        return;
 +    case 0: /* unlinked address match */
 +    case 1: /* linked address match */
 +    {
 +        /*
 +         * Bits [1:0] are RES0.
 +         *
 +         * It is IMPLEMENTATION DEFINED whether bits [63:49]
 +         * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
 +         * of the VA field ([48] or [52] for FEAT_LVA), or whether the
 +         * value is read as written.  It is CONSTRAINED UNPREDICTABLE
 +         * whether the RESS bits are ignored when comparing an address.
 +         * Therefore we are allowed to compare the entire register, which
 +         * lets us avoid considering whether FEAT_LVA is actually enabled.
 +         *
 +         * The BAS field is used to allow setting breakpoints on 16-bit
 +         * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
 +         * a bp will fire if the addresses covered by the bp and the addresses
 +         * covered by the insn overlap but the insn doesn't start at the
 +         * start of the bp address range. We choose to require the insn and
 +         * the bp to have the same address. The constraints on writing to
 +         * BAS enforced in dbgbcr_write mean we have only four cases:
 +         *  0b0000  => no breakpoint
 +         *  0b0011  => breakpoint on addr
 +         *  0b1100  => breakpoint on addr + 2
 +         *  0b1111  => breakpoint on addr
 +         * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
 +         */
 +        int bas = extract64(bcr, 5, 4);
 +        addr = bvr & ~3ULL;
 +        if (bas == 0) {
 +            return;
 +        }
 +        if (bas == 0xc) {
 +            addr += 2;
 +        }
 +        break;
 +    }
 +    case 2: /* unlinked context ID match */
 +    case 8: /* unlinked VMID match (reserved if no EL2) */
 +    case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
 +        qemu_log_mask(LOG_UNIMP,
 +                      "arm: unlinked context breakpoint types not implemented\n");
 +        return;
 +    case 9: /* linked VMID match (reserved if no EL2) */
 +    case 11: /* linked context ID and VMID match (reserved if no EL2) */
 +    case 3: /* linked context ID match */
 +    default:
 +        /*
 +         * We must generate no events for Linked context matches (unless
 +         * they are linked to by some other bp/wp, which is handled in
 +         * updates for the linking bp/wp). We choose to also generate no events
 +         * for reserved values.
 +         */
 +        return;
 +    }
 +
 +    cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
 +}
 +
 +void hw_breakpoint_update_all(ARMCPU *cpu)
 +{
 +    int i;
 +    CPUARMState *env = &cpu->env;
 +
 +    /*
 +     * Completely clear out existing QEMU breakpoints and our array, to
 +     * avoid possible stale entries following migration load.
 +     */
 +    cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
 +    memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
 +
 +    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
 +        hw_breakpoint_update(cpu, i);
 +    }
 +}
 +
 +static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +                         uint64_t value)
 +{
 +    ARMCPU *cpu = env_archcpu(env);
 +    int i = ri->crm;
 +
 +    raw_write(env, ri, value);
 +    hw_breakpoint_update(cpu, i);
 +}
 +
 +static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 +                         uint64_t value)
 +{
 +    ARMCPU *cpu = env_archcpu(env);
 +    int i = ri->crm;
 +
 +    /*
 +     * BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
 +     * copy of BAS[0].
 +     */
 +    value = deposit64(value, 6, 1, extract64(value, 5, 1));
 +    value = deposit64(value, 8, 1, extract64(value, 7, 1));
 +
 +    raw_write(env, ri, value);
 +    hw_breakpoint_update(cpu, i);
 +}
 +
 +void define_debug_regs(ARMCPU *cpu)
 +{
 +    /*
 +     * Define v7 and v8 architectural debug registers.
 +     * These are just dummy implementations for now.
 +     */
 +    int i;
 +    int wrps, brps, ctx_cmps;
 +
 +    /*
 +     * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
 +     * use AArch32.  Given that bit 15 is RES1, if the value is 0 then
 +     * the register must not exist for this cpu.
 +     */
 +    if (cpu->isar.dbgdidr != 0) {
 +        ARMCPRegInfo dbgdidr = {
 +            .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
 +            .opc1 = 0, .opc2 = 0,
 +            .access = PL0_R, .accessfn = access_tda,
 +            .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
 +        };
 +        define_one_arm_cp_reg(cpu, &dbgdidr);
 +    }
 +
 +    brps = arm_num_brps(cpu);
 +    wrps = arm_num_wrps(cpu);
 +    ctx_cmps = arm_num_ctx_cmps(cpu);
 +
 +    assert(ctx_cmps <= brps);
 +
 +    define_arm_cp_regs(cpu, debug_cp_reginfo);
 +
 +    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
 +        define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
 +    }
 +
 +    for (i = 0; i < brps; i++) {
 +        char *dbgbvr_el1_name = g_strdup_printf("DBGBVR%d_EL1", i);
 +        char *dbgbcr_el1_name = g_strdup_printf("DBGBCR%d_EL1", i);
 +        ARMCPRegInfo dbgregs[] = {
 +            { .name = dbgbvr_el1_name, .state = ARM_CP_STATE_BOTH,
 +              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
 +              .access = PL1_RW, .accessfn = access_tda,
 +              .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
 +              .writefn = dbgbvr_write, .raw_writefn = raw_write
 +            },
 +            { .name = dbgbcr_el1_name, .state = ARM_CP_STATE_BOTH,
 +              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
 +              .access = PL1_RW, .accessfn = access_tda,
 +              .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
 +              .writefn = dbgbcr_write, .raw_writefn = raw_write
 +            },
 +        };
 +        define_arm_cp_regs(cpu, dbgregs);
 +        g_free(dbgbvr_el1_name);
 +        g_free(dbgbcr_el1_name);
 +    }
 +
 +    for (i = 0; i < wrps; i++) {
 +        char *dbgwvr_el1_name = g_strdup_printf("DBGWVR%d_EL1", i);
 +        char *dbgwcr_el1_name = g_strdup_printf("DBGWCR%d_EL1", i);
 +        ARMCPRegInfo dbgregs[] = {
 +            { .name = dbgwvr_el1_name, .state = ARM_CP_STATE_BOTH,
 +              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
 +              .access = PL1_RW, .accessfn = access_tda,
 +              .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
 +              .writefn = dbgwvr_write, .raw_writefn = raw_write
 +            },
 +            { .name = dbgwcr_el1_name, .state = ARM_CP_STATE_BOTH,
 +              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
 +              .access = PL1_RW, .accessfn = access_tda,
 +              .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
 +              .writefn = dbgwcr_write, .raw_writefn = raw_write
 +            },
 +        };
 +        define_arm_cp_regs(cpu, dbgregs);
 +        g_free(dbgwvr_el1_name);
 +        g_free(dbgwcr_el1_name);
 +    }
 +}
 +
  #if !defined(CONFIG_USER_ONLY)
  vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+@@ -XXX,XX +XXX,XX @@ static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
      CPUState *cs = env_cpu(env);
      uint64_t hcr_el2 = arm_hcr_el2_eff(env);
      uint64_t ret = 0;
 +    bool allow_virt = (arm_current_el(env) == 1 &&
 +                       (!arm_is_secure_below_el3(env) ||
 +                        (env->cp15.scr_el3 & SCR_EEL2)));
 -    if (hcr_el2 & HCR_IMO) {
 +    if (allow_virt && (hcr_el2 & HCR_IMO)) {
          if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
              ret |= CPSR_I;
          }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
          }
      }
+ }
--    if (hcr_el2 & HCR_FMO) {
-+    if (allow_virt && (hcr_el2 & HCR_FMO)) {
+-static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
-         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
+-                      uint64_t value)
-             ret |= CPSR_F;
++void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
-         }
+ {
      assert(ri->fieldoffset);
      if (cpreg_field_is_64bit(ri)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
      return CP_ACCESS_TRAP_UNCATEGORIZED;
  }
 -static uint64_t arm_mdcr_el2_eff(CPUARMState *env)
 -{
 -    return arm_is_el2_enabled(env) ? env->cp15.mdcr_el2 : 0;
 -}
 -
 -/*
 - * Check for traps to "powerdown debug" registers, which are controlled
 - * by MDCR.TDOSA
 - */
 -static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
 -                                   bool isread)
 -{
 -    int el = arm_current_el(env);
 -    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 -    bool mdcr_el2_tdosa = (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TDE) ||
 -        (arm_hcr_el2_eff(env) & HCR_TGE);
 -
 -    if (el < 2 && mdcr_el2_tdosa) {
 -        return CP_ACCESS_TRAP_EL2;
 -    }
 -    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
 -        return CP_ACCESS_TRAP_EL3;
 -    }
 -    return CP_ACCESS_OK;
 -}
 -
 -/*
 - * Check for traps to "debug ROM" registers, which are controlled
 - * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
 - */
 -static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
 -                                  bool isread)
 -{
 -    int el = arm_current_el(env);
 -    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 -    bool mdcr_el2_tdra = (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE) ||
 -        (arm_hcr_el2_eff(env) & HCR_TGE);
 -
 -    if (el < 2 && mdcr_el2_tdra) {
 -        return CP_ACCESS_TRAP_EL2;
 -    }
 -    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
 -        return CP_ACCESS_TRAP_EL3;
 -    }
 -    return CP_ACCESS_OK;
 -}
 -
 -/*
 - * Check for traps to general debug registers, which are controlled
 - * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
 - */
 -static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
 -                                  bool isread)
 -{
 -    int el = arm_current_el(env);
 -    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
 -    bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) ||
 -        (arm_hcr_el2_eff(env) & HCR_TGE);
 -
 -    if (el < 2 && mdcr_el2_tda) {
 -        return CP_ACCESS_TRAP_EL2;
 -    }
 -    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
 -        return CP_ACCESS_TRAP_EL3;
 -    }
 -    return CP_ACCESS_OK;
 -}
 -
  /* Check for traps to performance monitor registers, which are controlled
   * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
   */
@@ -XXX,XX +XXX,XX @@ static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
      return CP_ACCESS_OK;
  }
 -static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
 -                        uint64_t value)
 -{
 -    /*
 -     * Writes to OSLAR_EL1 may update the OS lock status, which can be
 -     * read via a bit in OSLSR_EL1.
 -     */
 -    int oslock;
 -
 -    if (ri->state == ARM_CP_STATE_AA32) {
 -        oslock = (value == 0xC5ACCE55);
 -    } else {
 -        oslock = value & 1;
 -    }
 -
 -    env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
 -}
 -
 -static const ARMCPRegInfo debug_cp_reginfo[] = {
 -    /*
 -     * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
 -     * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
 -     * unlike DBGDRAR it is never accessible from EL0.
 -     * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
 -     * accessor.
 -     */
 -    { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
 -      .access = PL0_R, .accessfn = access_tdra,
 -      .type = ARM_CP_CONST, .resetvalue = 0 },
 -    { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
 -      .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
 -      .access = PL1_R, .accessfn = access_tdra,
 -      .type = ARM_CP_CONST, .resetvalue = 0 },
 -    { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
 -      .access = PL0_R, .accessfn = access_tdra,
 -      .type = ARM_CP_CONST, .resetvalue = 0 },
 -    /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
 -    { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
 -      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
 -      .access = PL1_RW, .accessfn = access_tda,
 -      .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
 -      .resetvalue = 0 },
 -    /*
 -     * MDCCSR_EL0[30:29] map to EDSCR[30:29].  Simply RAZ as the external
 -     * Debug Communication Channel is not implemented.
 -     */
 -    { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_AA64,
 -      .opc0 = 2, .opc1 = 3, .crn = 0, .crm = 1, .opc2 = 0,
 -      .access = PL0_R, .accessfn = access_tda,
 -      .type = ARM_CP_CONST, .resetvalue = 0 },
 -    /*
 -     * DBGDSCRint[15,12,5:2] map to MDSCR_EL1[15,12,5:2].  Map all bits as
 -     * it is unlikely a guest will care.
 -     * We don't implement the configurable EL0 access.
 -     */
 -    { .name = "DBGDSCRint", .state = ARM_CP_STATE_AA32,
 -      .cp = 14, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
 -      .type = ARM_CP_ALIAS,
 -      .access = PL1_R, .accessfn = access_tda,
 -      .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
 -    { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
 -      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
 -      .access = PL1_W, .type = ARM_CP_NO_RAW,
 -      .accessfn = access_tdosa,
 -      .writefn = oslar_write },
 -    { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
 -      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
 -      .access = PL1_R, .resetvalue = 10,
 -      .accessfn = access_tdosa,
 -      .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
 -    /* Dummy OSDLR_EL1: 32-bit Linux will read this */
 -    { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
 -      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
 -      .access = PL1_RW, .accessfn = access_tdosa,
 -      .type = ARM_CP_NOP },
 -    /*
 -     * Dummy DBGVCR: Linux wants to clear this on startup, but we don't
 -     * implement vector catch debug events yet.
 -     */
 -    { .name = "DBGVCR",
 -      .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
 -      .access = PL1_RW, .accessfn = access_tda,
 -      .type = ARM_CP_NOP },
 -    /*
 -     * Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
 -     * to save and restore a 32-bit guest's DBGVCR)
 -     */
 -    { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
 -      .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
 -      .access = PL2_RW, .accessfn = access_tda,
 -      .type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
 -    /*
 -     * Dummy MDCCINT_EL1, since we don't implement the Debug Communications
 -     * Channel but Linux may try to access this register. The 32-bit
 -     * alias is DBGDCCINT.
 -     */
 -    { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
 -      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
 -      .access = PL1_RW, .accessfn = access_tda,
 -      .type = ARM_CP_NOP },
 -};
 -
 -static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
 -    /* 64 bit access versions of the (dummy) debug registers */
 -    { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
 -      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 -    { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
 -      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 -};
 -
  /*
   * Check for traps to RAS registers, which are controlled
   * by HCR_EL2.TERR and SCR_EL3.TERR.
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
  };
  #endif /* TARGET_AARCH64 */
 -void hw_watchpoint_update(ARMCPU *cpu, int n)
 -{
 -    CPUARMState *env = &cpu->env;
 -    vaddr len = 0;
 -    vaddr wvr = env->cp15.dbgwvr[n];
 -    uint64_t wcr = env->cp15.dbgwcr[n];
 -    int mask;
 -    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
 -
 -    if (env->cpu_watchpoint[n]) {
 -        cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
 -        env->cpu_watchpoint[n] = NULL;
 -    }
 -
 -    if (!FIELD_EX64(wcr, DBGWCR, E)) {
 -        /* E bit clear : watchpoint disabled */
 -        return;
 -    }
 -
 -    switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
 -    case 0:
 -        /* LSC 00 is reserved and must behave as if the wp is disabled */
 -        return;
 -    case 1:
 -        flags |= BP_MEM_READ;
 -        break;
 -    case 2:
 -        flags |= BP_MEM_WRITE;
 -        break;
 -    case 3:
 -        flags |= BP_MEM_ACCESS;
 -        break;
 -    }
 -
 -    /*
 -     * Attempts to use both MASK and BAS fields simultaneously are
 -     * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
 -     * thus generating a watchpoint for every byte in the masked region.
 -     */
 -    mask = FIELD_EX64(wcr, DBGWCR, MASK);
 -    if (mask == 1 || mask == 2) {
 -        /*
 -         * Reserved values of MASK; we must act as if the mask value was
 -         * some non-reserved value, or as if the watchpoint were disabled.
 -         * We choose the latter.
 -         */
 -        return;
 -    } else if (mask) {
 -        /* Watchpoint covers an aligned area up to 2GB in size */
 -        len = 1ULL << mask;
 -        /*
 -         * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
 -         * whether the watchpoint fires when the unmasked bits match; we opt
 -         * to generate the exceptions.
 -         */
 -        wvr &= ~(len - 1);
 -    } else {
 -        /* Watchpoint covers bytes defined by the byte address select bits */
 -        int bas = FIELD_EX64(wcr, DBGWCR, BAS);
 -        int basstart;
 -
 -        if (extract64(wvr, 2, 1)) {
 -            /*
 -             * Deprecated case of an only 4-aligned address. BAS[7:4] are
 -             * ignored, and BAS[3:0] define which bytes to watch.
 -             */
 -            bas &= 0xf;
 -        }
 -
 -        if (bas == 0) {
 -            /* This must act as if the watchpoint is disabled */
 -            return;
 -        }
 -
 -        /*
 -         * The BAS bits are supposed to be programmed to indicate a contiguous
 -         * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
 -         * we fire for each byte in the word/doubleword addressed by the WVR.
 -         * We choose to ignore any non-zero bits after the first range of 1s.
 -         */
 -        basstart = ctz32(bas);
 -        len = cto32(bas >> basstart);
 -        wvr += basstart;
 -    }
 -
 -    cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
 -                          &env->cpu_watchpoint[n]);
 -}
 -
 -void hw_watchpoint_update_all(ARMCPU *cpu)
 -{
 -    int i;
 -    CPUARMState *env = &cpu->env;
 -
 -    /*
 -     * Completely clear out existing QEMU watchpoints and our array, to
 -     * avoid possible stale entries following migration load.
 -     */
 -    cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
 -    memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
 -
 -    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
 -        hw_watchpoint_update(cpu, i);
 -    }
 -}
 -
 -static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 -                         uint64_t value)
 -{
 -    ARMCPU *cpu = env_archcpu(env);
 -    int i = ri->crm;
 -
 -    /*
 -     * Bits [1:0] are RES0.
 -     *
 -     * It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA)
 -     * are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if
 -     * they contain the value written.  It is CONSTRAINED UNPREDICTABLE
 -     * whether the RESS bits are ignored when comparing an address.
 -     *
 -     * Therefore we are allowed to compare the entire register, which lets
 -     * us avoid considering whether or not FEAT_LVA is actually enabled.
 -     */
 -    value &= ~3ULL;
 -
 -    raw_write(env, ri, value);
 -    hw_watchpoint_update(cpu, i);
 -}
 -
 -static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 -                         uint64_t value)
 -{
 -    ARMCPU *cpu = env_archcpu(env);
 -    int i = ri->crm;
 -
 -    raw_write(env, ri, value);
 -    hw_watchpoint_update(cpu, i);
 -}
 -
 -void hw_breakpoint_update(ARMCPU *cpu, int n)
 -{
 -    CPUARMState *env = &cpu->env;
 -    uint64_t bvr = env->cp15.dbgbvr[n];
 -    uint64_t bcr = env->cp15.dbgbcr[n];
 -    vaddr addr;
 -    int bt;
 -    int flags = BP_CPU;
 -
 -    if (env->cpu_breakpoint[n]) {
 -        cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
 -        env->cpu_breakpoint[n] = NULL;
 -    }
 -
 -    if (!extract64(bcr, 0, 1)) {
 -        /* E bit clear : watchpoint disabled */
 -        return;
 -    }
 -
 -    bt = extract64(bcr, 20, 4);
 -
 -    switch (bt) {
 -    case 4: /* unlinked address mismatch (reserved if AArch64) */
 -    case 5: /* linked address mismatch (reserved if AArch64) */
 -        qemu_log_mask(LOG_UNIMP,
 -                      "arm: address mismatch breakpoint types not implemented\n");
 -        return;
 -    case 0: /* unlinked address match */
 -    case 1: /* linked address match */
 -    {
 -        /*
 -         * Bits [1:0] are RES0.
 -         *
 -         * It is IMPLEMENTATION DEFINED whether bits [63:49]
 -         * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
 -         * of the VA field ([48] or [52] for FEAT_LVA), or whether the
 -         * value is read as written.  It is CONSTRAINED UNPREDICTABLE
 -         * whether the RESS bits are ignored when comparing an address.
 -         * Therefore we are allowed to compare the entire register, which
 -         * lets us avoid considering whether FEAT_LVA is actually enabled.
 -         *
 -         * The BAS field is used to allow setting breakpoints on 16-bit
 -         * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
 -         * a bp will fire if the addresses covered by the bp and the addresses
 -         * covered by the insn overlap but the insn doesn't start at the
 -         * start of the bp address range. We choose to require the insn and
 -         * the bp to have the same address. The constraints on writing to
 -         * BAS enforced in dbgbcr_write mean we have only four cases:
 -         *  0b0000  => no breakpoint
 -         *  0b0011  => breakpoint on addr
 -         *  0b1100  => breakpoint on addr + 2
 -         *  0b1111  => breakpoint on addr
 -         * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
 -         */
 -        int bas = extract64(bcr, 5, 4);
 -        addr = bvr & ~3ULL;
 -        if (bas == 0) {
 -            return;
 -        }
 -        if (bas == 0xc) {
 -            addr += 2;
 -        }
 -        break;
 -    }
 -    case 2: /* unlinked context ID match */
 -    case 8: /* unlinked VMID match (reserved if no EL2) */
 -    case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
 -        qemu_log_mask(LOG_UNIMP,
 -                      "arm: unlinked context breakpoint types not implemented\n");
 -        return;
 -    case 9: /* linked VMID match (reserved if no EL2) */
 -    case 11: /* linked context ID and VMID match (reserved if no EL2) */
 -    case 3: /* linked context ID match */
 -    default:
 -        /*
 -         * We must generate no events for Linked context matches (unless
 -         * they are linked to by some other bp/wp, which is handled in
 -         * updates for the linking bp/wp). We choose to also generate no events
 -         * for reserved values.
 -         */
 -        return;
 -    }
 -
 -    cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
 -}
 -
 -void hw_breakpoint_update_all(ARMCPU *cpu)
 -{
 -    int i;
 -    CPUARMState *env = &cpu->env;
 -
 -    /*
 -     * Completely clear out existing QEMU breakpoints and our array, to
 -     * avoid possible stale entries following migration load.
 -     */
 -    cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
 -    memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
 -
 -    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
 -        hw_breakpoint_update(cpu, i);
 -    }
 -}
 -
 -static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 -                         uint64_t value)
 -{
 -    ARMCPU *cpu = env_archcpu(env);
 -    int i = ri->crm;
 -
 -    raw_write(env, ri, value);
 -    hw_breakpoint_update(cpu, i);
 -}
 -
 -static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 -                         uint64_t value)
 -{
 -    ARMCPU *cpu = env_archcpu(env);
 -    int i = ri->crm;
 -
 -    /*
 -     * BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
 -     * copy of BAS[0].
 -     */
 -    value = deposit64(value, 6, 1, extract64(value, 5, 1));
 -    value = deposit64(value, 8, 1, extract64(value, 7, 1));
 -
 -    raw_write(env, ri, value);
 -    hw_breakpoint_update(cpu, i);
 -}
 -
 -static void define_debug_regs(ARMCPU *cpu)
 -{
 -    /*
 -     * Define v7 and v8 architectural debug registers.
 -     * These are just dummy implementations for now.
 -     */
 -    int i;
 -    int wrps, brps, ctx_cmps;
 -
 -    /*
 -     * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
 -     * use AArch32.  Given that bit 15 is RES1, if the value is 0 then
 -     * the register must not exist for this cpu.
 -     */
 -    if (cpu->isar.dbgdidr != 0) {
 -        ARMCPRegInfo dbgdidr = {
 -            .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
 -            .opc1 = 0, .opc2 = 0,
 -            .access = PL0_R, .accessfn = access_tda,
 -            .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
 -        };
 -        define_one_arm_cp_reg(cpu, &dbgdidr);
 -    }
 -
 -    brps = arm_num_brps(cpu);
 -    wrps = arm_num_wrps(cpu);
 -    ctx_cmps = arm_num_ctx_cmps(cpu);
 -
 -    assert(ctx_cmps <= brps);
 -
 -    define_arm_cp_regs(cpu, debug_cp_reginfo);
 -
 -    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
 -        define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
 -    }
 -
 -    for (i = 0; i < brps; i++) {
 -        char *dbgbvr_el1_name = g_strdup_printf("DBGBVR%d_EL1", i);
 -        char *dbgbcr_el1_name = g_strdup_printf("DBGBCR%d_EL1", i);
 -        ARMCPRegInfo dbgregs[] = {
 -            { .name = dbgbvr_el1_name, .state = ARM_CP_STATE_BOTH,
 -              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
 -              .access = PL1_RW, .accessfn = access_tda,
 -              .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
 -              .writefn = dbgbvr_write, .raw_writefn = raw_write
 -            },
 -            { .name = dbgbcr_el1_name, .state = ARM_CP_STATE_BOTH,
 -              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
 -              .access = PL1_RW, .accessfn = access_tda,
 -              .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
 -              .writefn = dbgbcr_write, .raw_writefn = raw_write
 -            },
 -        };
 -        define_arm_cp_regs(cpu, dbgregs);
 -        g_free(dbgbvr_el1_name);
 -        g_free(dbgbcr_el1_name);
 -    }
 -
 -    for (i = 0; i < wrps; i++) {
 -        char *dbgwvr_el1_name = g_strdup_printf("DBGWVR%d_EL1", i);
 -        char *dbgwcr_el1_name = g_strdup_printf("DBGWCR%d_EL1", i);
 -        ARMCPRegInfo dbgregs[] = {
 -            { .name = dbgwvr_el1_name, .state = ARM_CP_STATE_BOTH,
 -              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
 -              .access = PL1_RW, .accessfn = access_tda,
 -              .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
 -              .writefn = dbgwvr_write, .raw_writefn = raw_write
 -            },
 -            { .name = dbgwcr_el1_name, .state = ARM_CP_STATE_BOTH,
 -              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
 -              .access = PL1_RW, .accessfn = access_tda,
 -              .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
 -              .writefn = dbgwcr_write, .raw_writefn = raw_write
 -            },
 -        };
 -        define_arm_cp_regs(cpu, dbgregs);
 -        g_free(dbgwvr_el1_name);
 -        g_free(dbgwcr_el1_name);
 -    }
 -}
 -
  static void define_pmu_regs(ARMCPU *cpu)
  {
      /*
 --
-.20.1
+.25.1

-New patch
+[PULL 6/9] target/arm: Suppress debug exceptions when OS Lock set
+The "OS Lock" in the Arm debug architecture is a way for software
+to suppress debug exceptions while it is trying to power down
+a CPU and save the state of the breakpoint and watchpoint
+registers. In QEMU we implemented the support for writing
+the OS Lock bit via OSLAR_EL1 and reading it via OSLSR_EL1,
+but didn't implement the actual behaviour.
+The required behaviour with the OS Lock set is:
+ * debug exceptions (apart from BKPT insns) are suppressed
+ * some MDSCR_EL1 bits allow write access to the corresponding
+   EDSCR external debug status register that they shadow
+   (we can ignore this because we don't implement external debug)
+ * similarly with the OSECCR_EL1 which shadows the EDECCR
+   (but we don't implement OSECCR_EL1 anyway)
+Implement the missing behaviour of suppressing debug
+exceptions.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220630194116.3438513-4-peter.maydell@linaro.org
+---
+ target/arm/debug_helper.c | 3 +++
+file changed, 3 insertions(+)
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@ static bool aa32_generate_debug_exceptions(CPUARMState *env)
+  */
+ bool arm_generate_debug_exceptions(CPUARMState *env)
+ {
++    if (env->cp15.oslsr_el1 & 1) {
++        return false;
++    }
+     if (is_a64(env)) {
+         return aa64_generate_debug_exceptions(env);
+     } else {
+--
+.25.1

-New patch
+[PULL 7/9] target/arm: Implement AArch32 DBGDEVID, DBGDEVID1, DBGDEVID2
+Starting with v7 of the debug architecture, there are three extra
+ID registers that add information on top of that provided in
+DBGDIDR. These are DBGDEVID, DBGDEVID1 and DBGDEVID2. In the
+v7 debug architecture, DBGDEVID is optional, present only of
+DBGDIDR.DEVID_imp is set. In v7.1 all three must be present.
+Implement the missing registers.  Note that we only need to set the
+values in the ARMISARegisters struct for the CPUs Cortex-A7, A15,
+A53, A57 and A72 (plus the 32-bit 'max' which uses the Cortex-A53
+values): earlier CPUs didn't implement v7 of the architecture, and
+our other 64-bit CPUs (Cortex-A76, Neoverse-N1 and A64fx) don't have
+AArch32 support at EL1.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20220630194116.3438513-5-peter.maydell@linaro.org
+---
+ target/arm/cpu.h          |  7 +++++++
+ target/arm/cpu64.c        |  6 ++++++
+ target/arm/cpu_tcg.c      |  6 ++++++
+ target/arm/debug_helper.c | 36 ++++++++++++++++++++++++++++++++++++
+files changed, 55 insertions(+)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
+         uint32_t mvfr2;
+         uint32_t id_dfr0;
+         uint32_t dbgdidr;
++        uint32_t dbgdevid;
++        uint32_t dbgdevid1;
+         uint64_t id_aa64isar0;
+         uint64_t id_aa64isar1;
+         uint64_t id_aa64pfr0;
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_ssbs(const ARMISARegisters *id)
+     return FIELD_EX32(id->id_pfr2, ID_PFR2, SSBS) != 0;
+ }
++static inline bool isar_feature_aa32_debugv7p1(const ARMISARegisters *id)
++{
++    return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 5;
++}
++
+ static inline bool isar_feature_aa32_debugv8p2(const ARMISARegisters *id)
+ {
+     return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 8;
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu64.c
++++ b/target/arm/cpu64.c
+@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
+     cpu->isar.id_aa64isar0 = 0x00011120;
+     cpu->isar.id_aa64mmfr0 = 0x00001124;
+     cpu->isar.dbgdidr = 0x3516d000;
++    cpu->isar.dbgdevid = 0x01110f13;
++    cpu->isar.dbgdevid1 = 0x2;
+     cpu->isar.reset_pmcr_el0 = 0x41013000;
+     cpu->clidr = 0x0a200023;
+     cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
+@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
+     cpu->isar.id_aa64isar0 = 0x00011120;
+     cpu->isar.id_aa64mmfr0 = 0x00001122; /* 40 bit physical addr */
+     cpu->isar.dbgdidr = 0x3516d000;
++    cpu->isar.dbgdevid = 0x00110f13;
++    cpu->isar.dbgdevid1 = 0x1;
+     cpu->isar.reset_pmcr_el0 = 0x41033000;
+     cpu->clidr = 0x0a200023;
+     cpu->ccsidr[0] = 0x700fe01a; /* 32KB L1 dcache */
+@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
+     cpu->isar.id_aa64isar0 = 0x00011120;
+     cpu->isar.id_aa64mmfr0 = 0x00001124;
+     cpu->isar.dbgdidr = 0x3516d000;
++    cpu->isar.dbgdevid = 0x01110f13;
++    cpu->isar.dbgdevid1 = 0x2;
+     cpu->isar.reset_pmcr_el0 = 0x41023000;
+     cpu->clidr = 0x0a200023;
+     cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
+diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu_tcg.c
++++ b/target/arm/cpu_tcg.c
+@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
+     cpu->isar.id_isar3 = 0x11112131;
+     cpu->isar.id_isar4 = 0x10011142;
+     cpu->isar.dbgdidr = 0x3515f005;
++    cpu->isar.dbgdevid = 0x01110f13;
++    cpu->isar.dbgdevid1 = 0x1;
+     cpu->clidr = 0x0a200023;
+     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
+     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
+@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
+     cpu->isar.id_isar3 = 0x11112131;
+     cpu->isar.id_isar4 = 0x10011142;
+     cpu->isar.dbgdidr = 0x3515f021;
++    cpu->isar.dbgdevid = 0x01110f13;
++    cpu->isar.dbgdevid1 = 0x0;
+     cpu->clidr = 0x0a200023;
+     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
+     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
+@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
+     cpu->isar.id_isar5 = 0x00011121;
+     cpu->isar.id_isar6 = 0;
+     cpu->isar.dbgdidr = 0x3516d000;
++    cpu->isar.dbgdevid = 0x00110f13;
++    cpu->isar.dbgdevid1 = 0x2;
+     cpu->isar.reset_pmcr_el0 = 0x41013000;
+     cpu->clidr = 0x0a200023;
+     cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@ void define_debug_regs(ARMCPU *cpu)
+         define_one_arm_cp_reg(cpu, &dbgdidr);
+     }
++    /*
++     * DBGDEVID is present in the v7 debug architecture if
++     * DBGDIDR.DEVID_imp is 1 (bit 15); from v7.1 and on it is
++     * mandatory (and bit 15 is RES1). DBGDEVID1 and DBGDEVID2 exist
++     * from v7.1 of the debug architecture. Because no fields have yet
++     * been defined in DBGDEVID2 (and quite possibly none will ever
++     * be) we don't define an ARMISARegisters field for it.
++     * These registers exist only if EL1 can use AArch32, but that
++     * happens naturally because they are only PL1 accessible anyway.
++     */
++    if (extract32(cpu->isar.dbgdidr, 15, 1)) {
++        ARMCPRegInfo dbgdevid = {
++            .name = "DBGDEVID",
++            .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 2, .crn = 7,
++            .access = PL1_R, .accessfn = access_tda,
++            .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid,
++        };
++        define_one_arm_cp_reg(cpu, &dbgdevid);
++    }
++    if (cpu_isar_feature(aa32_debugv7p1, cpu)) {
++        ARMCPRegInfo dbgdevid12[] = {
++            {
++                .name = "DBGDEVID1",
++                .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 1, .crn = 7,
++                .access = PL1_R, .accessfn = access_tda,
++                .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid1,
++            }, {
++                .name = "DBGDEVID2",
++                .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 0, .crn = 7,
++                .access = PL1_R, .accessfn = access_tda,
++                .type = ARM_CP_CONST, .resetvalue = 0,
++            },
++        };
++        define_arm_cp_regs(cpu, dbgdevid12);
++    }
++
+     brps = arm_num_brps(cpu);
+     wrps = arm_num_wrps(cpu);
+     ctx_cmps = arm_num_ctx_cmps(cpu);
+--
+.25.1

-New patch
+[PULL 8/9] target/arm: Correctly implement Feat_DoubleLock
+The architecture defines the OS DoubleLock as a register which
+(similarly to the OS Lock) suppresses debug events for use in CPU
+powerdown sequences.  This functionality is required in Arm v7 and
+v8.0; from v8.2 it becomes optional and in v9 it must not be
+implemented.
+Currently in QEMU we implement the OSDLR_EL1 register as a NOP.  This
+is wrong both for the "feature implemented" and the "feature not
+implemented" cases: if the feature is implemented then the DLK bit
+should read as written and cause suppression of debug exceptions, and
+if it is not implemented then the bit must be RAZ/WI.
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+---
+ target/arm/cpu.h          | 20 ++++++++++++++++++++
+ target/arm/debug_helper.c | 20 ++++++++++++++++++--
+files changed, 38 insertions(+), 2 deletions(-)
+diff --git a/target/arm/cpu.h b/target/arm/cpu.h
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/cpu.h
++++ b/target/arm/cpu.h
+@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
+         uint64_t dbgwcr[16]; /* watchpoint control registers */
+         uint64_t mdscr_el1;
+         uint64_t oslsr_el1; /* OS Lock Status */
++        uint64_t osdlr_el1; /* OS DoubleLock status */
+         uint64_t mdcr_el2;
+         uint64_t mdcr_el3;
+         /* Stores the architectural value of the counter *the last time it was
+@@ -XXX,XX +XXX,XX @@ FIELD(DBGDIDR, CTX_CMPS, 20, 4)
+ FIELD(DBGDIDR, BRPS, 24, 4)
+ FIELD(DBGDIDR, WRPS, 28, 4)
++FIELD(DBGDEVID, PCSAMPLE, 0, 4)
++FIELD(DBGDEVID, WPADDRMASK, 4, 4)
++FIELD(DBGDEVID, BPADDRMASK, 8, 4)
++FIELD(DBGDEVID, VECTORCATCH, 12, 4)
++FIELD(DBGDEVID, VIRTEXTNS, 16, 4)
++FIELD(DBGDEVID, DOUBLELOCK, 20, 4)
++FIELD(DBGDEVID, AUXREGS, 24, 4)
++FIELD(DBGDEVID, CIDMASK, 28, 4)
++
+ FIELD(MVFR0, SIMDREG, 0, 4)
+ FIELD(MVFR0, FPSP, 4, 4)
+ FIELD(MVFR0, FPDP, 8, 4)
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_debugv8p2(const ARMISARegisters *id)
+     return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 8;
+ }
++static inline bool isar_feature_aa32_doublelock(const ARMISARegisters *id)
++{
++    return FIELD_EX32(id->dbgdevid, DBGDEVID, DOUBLELOCK) > 0;
++}
++
+ /*
+  * 64-bit feature tests via id registers.
+  */
+@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_sme_fa64(const ARMISARegisters *id)
+     return FIELD_EX64(id->id_aa64smfr0, ID_AA64SMFR0, FA64);
+ }
++static inline bool isar_feature_aa64_doublelock(const ARMISARegisters *id)
++{
++    return FIELD_SEX64(id->id_aa64dfr0, ID_AA64DFR0, DOUBLELOCK) >= 0;
++}
++
+ /*
+  * Feature tests for "does this exist in either 32-bit or 64-bit?"
+  */
+diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/debug_helper.c
++++ b/target/arm/debug_helper.c
+@@ -XXX,XX +XXX,XX @@ static bool aa32_generate_debug_exceptions(CPUARMState *env)
+  */
+ bool arm_generate_debug_exceptions(CPUARMState *env)
+ {
+-    if (env->cp15.oslsr_el1 & 1) {
++    if ((env->cp15.oslsr_el1 & 1) || (env->cp15.osdlr_el1 & 1)) {
+         return false;
+     }
+     if (is_a64(env)) {
+@@ -XXX,XX +XXX,XX @@ static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
+     env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
+ }
++static void osdlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
++                        uint64_t value)
++{
++    ARMCPU *cpu = env_archcpu(env);
++    /*
++     * Only defined bit is bit 0 (DLK); if Feat_DoubleLock is not
++     * implemented this is RAZ/WI.
++     */
++    if(arm_feature(env, ARM_FEATURE_AARCH64)
++       ? cpu_isar_feature(aa64_doublelock, cpu)
++       : cpu_isar_feature(aa32_doublelock, cpu)) {
++        env->cp15.osdlr_el1 = value & 1;
++    }
++}
++
+ static const ARMCPRegInfo debug_cp_reginfo[] = {
+     /*
+      * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
+@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
+     { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
+       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
+       .access = PL1_RW, .accessfn = access_tdosa,
+-      .type = ARM_CP_NOP },
++      .writefn = osdlr_write,
++      .fieldoffset = offsetof(CPUARMState, cp15.osdlr_el1) },
+     /*
+      * Dummy DBGVCR: Linux wants to clear this on startup, but we don't
+      * implement vector catch debug events yet.
+--
+.25.1

-[PULL 2/4] hw/arm: versal: Add the CRP as unimplemented
+[PULL 9/9] target/arm: Fix qemu-system-arm handling of LPAE block descriptors for highmem
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+In commit 39a1fd25287f5d we fixed a bug in the handling of LPAE block
 descriptors where we weren't correctly zeroing out some RES0 bits.
 However this fix has a bug because the calculation of the mask is
 done at the wrong width: in
   descaddr &= ~(page_size - 1);
 page_size is a target_ulong, so in the 'qemu-system-arm' binary it is
 only 32 bits, and the effect is that we always zero out the top 32
 bits of the calculated address.  Fix the calculation by forcing the
 mask to be calculated with the same type as descaddr.
-Add the CRP as unimplemented thus avoiding bus errors when
+This only affects 32-bit CPUs which support LPAE (e.g. cortex-a15)
-guests access these registers.
+when used on board models which put RAM or devices above the 4GB
 mark and when the 'qemu-system-arm' executable is being used.
 It was also masked in 7.0 by the main bug reported in
 https://gitlab.com/qemu-project/qemu/-/issues/1078 where the
 virt board incorrectly does not enable 'highmem' for 32-bit CPUs.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+The workaround is to use 'qemu-system-aarch64' with the same
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+command line.
-Reviewed-by: Luc Michel <luc.michel@greensocs.com>
-Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
+Reported-by: He Zhe <zhe.he@windriver.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220627134620.3190252-1-peter.maydell@linaro.org
 Fixes: 39a1fd25287f5de ("target/arm: Fix handling of LPAE block descriptors")
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/xlnx-versal.h | 3 +++
+ target/arm/ptw.c | 2 +-
- hw/arm/xlnx-versal.c         | 2 ++
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 5 insertions(+)
-diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
+--- a/target/arm/ptw.c
-+++ b/include/hw/arm/xlnx-versal.h
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
- #define MM_IOU_SCNTRS_SIZE          0x10000
+          * clear the lower bits here before ORing in the low vaddr bits.
- #define MM_FPD_CRF                  0xfd1a0000U
+          */
- #define MM_FPD_CRF_SIZE             0x140000
+         page_size = (1ULL << ((stride * (4 - level)) + 3));
-+
+-        descaddr &= ~(page_size - 1);
-+#define MM_PMC_CRP                  0xf1260000U
++        descaddr &= ~(hwaddr)(page_size - 1);
-+#define MM_PMC_CRP_SIZE             0x10000
+         descaddr |= (address & (page_size - 1));
- #endif
+         /* Extract attributes from the descriptor */
-diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
+         attrs = extract64(descriptor, 2, 10)
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/xlnx-versal.c
 +++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
                          MM_CRL, MM_CRL_SIZE);
      versal_unimp_area(s, "crf", &s->mr_ps,
                          MM_FPD_CRF, MM_FPD_CRF_SIZE);
 +    versal_unimp_area(s, "crp", &s->mr_ps,
 +                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
      versal_unimp_area(s, "iou-scntr", &s->mr_ps,
                          MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
      versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
 --
-.20.1
+.25.1

Arm patches for rc3 : just a handful of bug fixes.

thanks
-- PMM

The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:

Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126

for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:

target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)

----------------------------------------------------------------
target-arm queue:
 * handle FTYPE flag correctly in v7M exception return
   for v7M CPUs with an FPU (v8M CPUs were already correct)
 * versal: Add the CRP as unimplemented
 * Fix ISR_EL1 tracking when executing at EL2
 * Honor HCR_EL2.TID3 trapping requirements

----------------------------------------------------------------
Edgar E. Iglesias (1):
      hw/arm: versal: Add the CRP as unimplemented

Jean-Hugues Deschênes (1):
      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET

Marc Zyngier (2):
      target/arm: Fix ISR_EL1 tracking when executing at EL2
      target/arm: Honor HCR_EL2.TID3 trapping requirements

include/hw/arm/xlnx-versal.h |  3 ++
 hw/arm/xlnx-versal.c         |  2 ++
 target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
 target/arm/m_helper.c        |  7 ++--
 4 files changed, 89 insertions(+), 6 deletions(-)

From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>

According to the PushStack() pseudocode in the armv7m RM,
bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
an FPU is present. Current implementation is doing it for
armv8, but not for armv7. This patch makes the existing
logic applicable to both code paths.

Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/m_helper.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         if (env->v7m.secure) {
             lr |= R_V7M_EXCRET_S_MASK;
         }
-        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-            lr |= R_V7M_EXCRET_FTYPE_MASK;
-        }
     } else {
         lr = R_V7M_EXCRET_RES1_MASK |
             R_V7M_EXCRET_S_MASK |
             R_V7M_EXCRET_DCRS_MASK |
-            R_V7M_EXCRET_FTYPE_MASK |
             R_V7M_EXCRET_ES_MASK;
         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
             lr |= R_V7M_EXCRET_SPSEL_MASK;
         }
     }
+    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
+        lr |= R_V7M_EXCRET_FTYPE_MASK;
+    }
     if (!arm_v7m_is_handler_mode(env)) {
         lr |= R_V7M_EXCRET_MODE_MASK;
     }
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add the CRP as unimplemented thus avoiding bus errors when
guests access these registers.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 3 +++
 hw/arm/xlnx-versal.c         | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 #define MM_IOU_SCNTRS_SIZE          0x10000
 #define MM_FPD_CRF                  0xfd1a0000U
 #define MM_FPD_CRF_SIZE             0x140000
+
+#define MM_PMC_CRP                  0xf1260000U
+#define MM_PMC_CRP_SIZE             0x10000
 #endif
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
                         MM_CRL, MM_CRL_SIZE);
     versal_unimp_area(s, "crf", &s->mr_ps,
                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
+    versal_unimp_area(s, "crp", &s->mr_ps,
+                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
     versal_unimp_area(s, "iou-scntr", &s->mr_ps,
                         MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
     versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
SError interrupts.

Unfortunately, QEMU's implementation only considers the HCR_EL2
bits, and ignores the current exception level. This means a hypervisor
trying to look at its own interrupt state actually sees the guest
state, which is unexpected and breaks KVM as of Linux 5.3.

Instead, check for the running EL and return the physical bits
if not running in a virtualized context.

Fixes: 636540e9c40b
Cc: qemu-stable@nongnu.org
Reported-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Message-id: 20191122135833.28953-1-maz@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     CPUState *cs = env_cpu(env);
     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
     uint64_t ret = 0;
+    bool allow_virt = (arm_current_el(env) == 1 &&
+                       (!arm_is_secure_below_el3(env) ||
+                        (env->cp15.scr_el3 & SCR_EEL2)));
 
-    if (hcr_el2 & HCR_IMO) {
+    if (allow_virt && (hcr_el2 & HCR_IMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
             ret |= CPSR_I;
         }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
         }
     }
 
-    if (hcr_el2 & HCR_FMO) {
+    if (allow_virt && (hcr_el2 & HCR_FMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
             ret |= CPSR_F;
         }
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

HCR_EL2.TID3 mandates that access from EL1 to a long list of id
registers traps to EL2, and QEMU has so far ignored this requirement.

This breaks (among other things) KVM guests that have PtrAuth enabled,
while the hypervisor doesn't want to expose the feature to its guest.
To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
case), and masks out the unsupported feature.

QEMU not honoring the trap request means that the guest observes
that the feature is present in the HW, starts using it, and dies
a horrible death when KVM injects an UNDEF, because the feature
*really* isn't supported.

Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.

Note that this change does not include trapping of the MVFR
registers from AArch32 (they are accessed via the VMRS
instruction and need to be handled in a different way).

Reported-by: Will Deacon <will@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Tested-by: Will Deacon <will@kernel.org>
Message-id: 20191123115618.29230-1-maz@kernel.org
[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
 changed names of access functions to include _tid3]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        return access_aa64_tid3(env, ri, isread);
+    }
+
+    return CP_ACCESS_OK;
+}
+
 void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_pfr0 },
             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
              * the value of the GIC field until after we define these regs.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa32_tid3,
               .readfn = id_pfr1_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_dfr0 },
             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_afr0 },
             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr0 },
             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr1 },
             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr2 },
             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr3 },
             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar0 },
             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar1 },
             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar2 },
             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar3 },
             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar4 },
             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar5 },
             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr4 },
             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar6 },
             REGINFO_SENTINEL
         };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa64_tid3,
               .readfn = id_aa64pfr0_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64pfr1},
             { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               /* At present, only SVEver == 0 is defined anyway.  */
               .resetvalue = 0 },
             { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr0 },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr1 },
             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr0 },
             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr1 },
             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar0 },
             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar1 },
             { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr0 },
             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr1 },
             { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr0 },
             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr1 },
             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr2 },
             { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
-- 
2.20.1

My OS Lock/DoubleLock patches, plus a small selection of other
bug fixes and minor things.

thanks
-- PMM

The following changes since commit 8e9398e3b1a860b8c29c670c1b6c36afe8d87849:

Merge tag 'pull-ppc-20220706' of https://gitlab.com/danielhb/qemu into staging (2022-07-07 06:21:05 +0530)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220707

for you to fetch changes up to c2360eaa0262a816faf8032b7762d0c73df2cc62:

target/arm: Fix qemu-system-arm handling of LPAE block descriptors for highmem (2022-07-07 11:41:04 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/virt: dt: add rng-seed property
 * Fix MTE check in sve_ldnfff1_r
 * Record tagged bit for user-only in sve_probe_page
 * Correctly implement OS Lock and OS DoubleLock
 * Implement DBGDEVID, DBGDEVID1, DBGDEVID2 registers
 * Fix qemu-system-arm handling of LPAE block descriptors for highmem

----------------------------------------------------------------
Jason A. Donenfeld (1):
      hw/arm/virt: dt: add rng-seed property

Peter Maydell (6):
      target/arm: Fix code style issues in debug helper functions
      target/arm: Move define_debug_regs() to debug_helper.c
      target/arm: Suppress debug exceptions when OS Lock set
      target/arm: Implement AArch32 DBGDEVID, DBGDEVID1, DBGDEVID2
      target/arm: Correctly implement Feat_DoubleLock
      target/arm: Fix qemu-system-arm handling of LPAE block descriptors for highmem

Richard Henderson (2):
      target/arm: Fix MTE check in sve_ldnfff1_r
      target/arm: Record tagged bit for user-only in sve_probe_page

From: "Jason A. Donenfeld" <Jason@zx2c4.com>

In 60592cfed2 ("hw/arm/virt: dt: add kaslr-seed property"), the
kaslr-seed property was added, but the equally as important rng-seed
property was forgotten about, which has identical semantics for a
similar purpose. This commit implements it in exactly the same way as
kaslr-seed. It then changes the name of the disabling option to reflect
that this has more to do with randomness vs determinism, rather than
something particular about kaslr.

Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
[PMM: added deprecated.rst section for the deprecation]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/about/deprecated.rst |  8 +++++++
 docs/system/arm/virt.rst  | 17 +++++++++------
 include/hw/arm/virt.h     |  2 +-
 hw/arm/virt.c             | 44 ++++++++++++++++++++++++---------------
 4 files changed, 47 insertions(+), 24 deletions(-)

diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/about/deprecated.rst
+++ b/docs/about/deprecated.rst
@@ -XXX,XX +XXX,XX @@ Use the more generic event ``DEVICE_UNPLUG_GUEST_ERROR`` instead.
 System emulator machines
 ------------------------
 
+Arm ``virt`` machine ``dtb-kaslr-seed`` property
+''''''''''''''''''''''''''''''''''''''''''''''''
+
+The ``dtb-kaslr-seed`` property on the ``virt`` board has been
+deprecated; use the new name ``dtb-randomness`` instead. The new name
+better reflects the way this property affects all random data within
+the device tree blob, not just the ``kaslr-seed`` node.
+
 PPC 405 ``taihu`` machine (since 7.0)
 '''''''''''''''''''''''''''''''''''''
 
diff --git a/docs/system/arm/virt.rst b/docs/system/arm/virt.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/virt.rst
+++ b/docs/system/arm/virt.rst
@@ -XXX,XX +XXX,XX @@ ras
   Set ``on``/``off`` to enable/disable reporting host memory errors to a guest
   using ACPI and guest external abort exceptions. The default is off.
 
+dtb-randomness
+  Set ``on``/``off`` to pass random seeds via the guest DTB
+  rng-seed and kaslr-seed nodes (in both "/chosen" and
+  "/secure-chosen") to use for features like the random number
+  generator and address space randomisation. The default is
+  ``on``. You will want to disable it if your trusted boot chain
+  will verify the DTB it is passed, since this option causes the
+  DTB to be non-deterministic. It would be the responsibility of
+  the firmware to come up with a seed and pass it on if it wants to.
+
 dtb-kaslr-seed
-  Set ``on``/``off`` to pass a random seed via the guest dtb
-  kaslr-seed node (in both "/chosen" and /secure-chosen) to use
-  for features like address space randomisation. The default is
-  ``on``. You will want to disable it if your trusted boot chain will
-  verify the DTB it is passed. It would be the responsibility of the
-  firmware to come up with a seed and pass it on if it wants to.
+  A deprecated synonym for dtb-randomness.
 
 Linux guest kernel configuration
 """"""""""""""""""""""""""""""""
diff --git a/include/hw/arm/virt.h b/include/hw/arm/virt.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/virt.h
+++ b/include/hw/arm/virt.h
@@ -XXX,XX +XXX,XX @@ struct VirtMachineState {
     bool virt;
     bool ras;
     bool mte;
-    bool dtb_kaslr_seed;
+    bool dtb_randomness;
     OnOffAuto acpi;
     VirtGICType gic_version;
     VirtIOMMUType iommu;
diff --git a/hw/arm/virt.c b/hw/arm/virt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/virt.c
+++ b/hw/arm/virt.c
@@ -XXX,XX +XXX,XX @@ static bool cpu_type_valid(const char *cpu)
     return false;
 }
 
-static void create_kaslr_seed(MachineState *ms, const char *node)
+static void create_randomness(MachineState *ms, const char *node)
 {
-    uint64_t seed;
+    struct {
+        uint64_t kaslr;
+        uint8_t rng[32];
+    } seed;
 
     if (qemu_guest_getrandom(&seed, sizeof(seed), NULL)) {
         return;
     }
-    qemu_fdt_setprop_u64(ms->fdt, node, "kaslr-seed", seed);
+    qemu_fdt_setprop_u64(ms->fdt, node, "kaslr-seed", seed.kaslr);
+    qemu_fdt_setprop(ms->fdt, node, "rng-seed", seed.rng, sizeof(seed.rng));
 }
 
 static void create_fdt(VirtMachineState *vms)
@@ -XXX,XX +XXX,XX @@ static void create_fdt(VirtMachineState *vms)
 
     /* /chosen must exist for load_dtb to fill in necessary properties later */
     qemu_fdt_add_subnode(fdt, "/chosen");
-    if (vms->dtb_kaslr_seed) {
-        create_kaslr_seed(ms, "/chosen");
+    if (vms->dtb_randomness) {
+        create_randomness(ms, "/chosen");
     }
 
     if (vms->secure) {
         qemu_fdt_add_subnode(fdt, "/secure-chosen");
-        if (vms->dtb_kaslr_seed) {
-            create_kaslr_seed(ms, "/secure-chosen");
+        if (vms->dtb_randomness) {
+            create_randomness(ms, "/secure-chosen");
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static void virt_set_its(Object *obj, bool value, Error **errp)
     vms->its = value;
 }
 
-static bool virt_get_dtb_kaslr_seed(Object *obj, Error **errp)
+static bool virt_get_dtb_randomness(Object *obj, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
 
-    return vms->dtb_kaslr_seed;
+    return vms->dtb_randomness;
 }
 
-static void virt_set_dtb_kaslr_seed(Object *obj, bool value, Error **errp)
+static void virt_set_dtb_randomness(Object *obj, bool value, Error **errp)
 {
     VirtMachineState *vms = VIRT_MACHINE(obj);
 
-    vms->dtb_kaslr_seed = value;
+    vms->dtb_randomness = value;
 }
 
 static char *virt_get_oem_id(Object *obj, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void virt_machine_class_init(ObjectClass *oc, void *data)
                                           "Set on/off to enable/disable "
                                           "ITS instantiation");
 
+    object_class_property_add_bool(oc, "dtb-randomness",
+                                   virt_get_dtb_randomness,
+                                   virt_set_dtb_randomness);
+    object_class_property_set_description(oc, "dtb-randomness",
+                                          "Set off to disable passing random or "
+                                          "non-deterministic dtb nodes to guest");
+
     object_class_property_add_bool(oc, "dtb-kaslr-seed",
-                                   virt_get_dtb_kaslr_seed,
-                                   virt_set_dtb_kaslr_seed);
+                                   virt_get_dtb_randomness,
+                                   virt_set_dtb_randomness);
     object_class_property_set_description(oc, "dtb-kaslr-seed",
-                                          "Set off to disable passing of kaslr-seed "
-                                          "dtb node to guest");
+                                          "Deprecated synonym of dtb-randomness");
 
     object_class_property_add_str(oc, "x-oem-id",
                                   virt_get_oem_id,
@@ -XXX,XX +XXX,XX @@ static void virt_instance_init(Object *obj)
     /* MTE is disabled by default.  */
     vms->mte = false;
 
-    /* Supply a kaslr-seed by default */
-    vms->dtb_kaslr_seed = true;
+    /* Supply kaslr-seed and rng-seed by default */
+    vms->dtb_randomness = true;
 
     vms->irqmap = a15irqmap;
 
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

Fixes a bug in that we were not honoring MTE from user-only
SVE. Copy the user-only MTE logic from allocation_tag_mem
into sve_probe_page.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/sve_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/sve_helper.c b/target/arm/sve_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/sve_helper.c
+++ b/target/arm/sve_helper.c
@@ -XXX,XX +XXX,XX @@ bool sve_probe_page(SVEHostPage *info, bool nofault, CPUARMState *env,
 
 #ifdef CONFIG_USER_ONLY
     memset(&info->attrs, 0, sizeof(info->attrs));
+    /* Require both MAP_ANON and PROT_MTE -- see allocation_tag_mem. */
+    arm_tlb_mte_tagged(&info->attrs) =
+        (flags & PAGE_ANON) && (flags & PAGE_MTE);
 #else
     /*
      * Find the iotlbentry for addr and return the transaction attributes.
-- 
2.25.1

Before moving debug system register helper functions to a
different file, fix the code style issues (mostly block
comment syntax) so checkpatch doesn't complain about the
code-motion patch.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220630194116.3438513-2-peter.maydell@linaro.org
---
 target/arm/helper.c | 58 +++++++++++++++++++++++++++++----------------
 1 file changed, 38 insertions(+), 20 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t arm_mdcr_el2_eff(CPUARMState *env)
     return arm_is_el2_enabled(env) ? env->cp15.mdcr_el2 : 0;
 }
 
-/* Check for traps to "powerdown debug" registers, which are controlled
+/*
+ * Check for traps to "powerdown debug" registers, which are controlled
  * by MDCR.TDOSA
  */
 static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
-/* Check for traps to "debug ROM" registers, which are controlled
+/*
+ * Check for traps to "debug ROM" registers, which are controlled
  * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
  */
 static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
-/* Check for traps to general debug registers, which are controlled
+/*
+ * Check for traps to general debug registers, which are controlled
  * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
  */
 static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
@@ -XXX,XX +XXX,XX @@ static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
 static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
                         uint64_t value)
 {
-    /* Writes to OSLAR_EL1 may update the OS lock status, which can be
+    /*
+     * Writes to OSLAR_EL1 may update the OS lock status, which can be
      * read via a bit in OSLSR_EL1.
      */
     int oslock;
@@ -XXX,XX +XXX,XX @@ static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
 }
 
 static const ARMCPRegInfo debug_cp_reginfo[] = {
-    /* DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
+    /*
+     * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
      * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
      * unlike DBGDRAR it is never accessible from EL0.
      * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
       .access = PL1_RW, .accessfn = access_tdosa,
       .type = ARM_CP_NOP },
-    /* Dummy DBGVCR: Linux wants to clear this on startup, but we don't
+    /*
+     * Dummy DBGVCR: Linux wants to clear this on startup, but we don't
      * implement vector catch debug events yet.
      */
     { .name = "DBGVCR",
       .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
       .access = PL1_RW, .accessfn = access_tda,
       .type = ARM_CP_NOP },
-    /* Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
+    /*
+     * Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
      * to save and restore a 32-bit guest's DBGVCR)
      */
     { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
       .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
       .access = PL2_RW, .accessfn = access_tda,
       .type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
-    /* Dummy MDCCINT_EL1, since we don't implement the Debug Communications
+    /*
+     * Dummy MDCCINT_EL1, since we don't implement the Debug Communications
      * Channel but Linux may try to access this register. The 32-bit
      * alias is DBGDCCINT.
      */
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
 static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
     /* 64 bit access versions of the (dummy) debug registers */
     { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
-      .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
+      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
     { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
-      .access = PL0_R, .type = ARM_CP_CONST|ARM_CP_64BIT, .resetvalue = 0 },
+      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
 };
 
 /*
@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update(ARMCPU *cpu, int n)
         break;
     }
 
-    /* Attempts to use both MASK and BAS fields simultaneously are
+    /*
+     * Attempts to use both MASK and BAS fields simultaneously are
      * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
      * thus generating a watchpoint for every byte in the masked region.
      */
     mask = FIELD_EX64(wcr, DBGWCR, MASK);
     if (mask == 1 || mask == 2) {
-        /* Reserved values of MASK; we must act as if the mask value was
+        /*
+         * Reserved values of MASK; we must act as if the mask value was
          * some non-reserved value, or as if the watchpoint were disabled.
          * We choose the latter.
          */
@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update(ARMCPU *cpu, int n)
     } else if (mask) {
         /* Watchpoint covers an aligned area up to 2GB in size */
         len = 1ULL << mask;
-        /* If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
+        /*
+         * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
          * whether the watchpoint fires when the unmasked bits match; we opt
          * to generate the exceptions.
          */
@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update(ARMCPU *cpu, int n)
         int basstart;
 
         if (extract64(wvr, 2, 1)) {
-            /* Deprecated case of an only 4-aligned address. BAS[7:4] are
+            /*
+             * Deprecated case of an only 4-aligned address. BAS[7:4] are
              * ignored, and BAS[3:0] define which bytes to watch.
              */
             bas &= 0xf;
@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update(ARMCPU *cpu, int n)
             return;
         }
 
-        /* The BAS bits are supposed to be programmed to indicate a contiguous
+        /*
+         * The BAS bits are supposed to be programmed to indicate a contiguous
          * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
          * we fire for each byte in the word/doubleword addressed by the WVR.
          * We choose to ignore any non-zero bits after the first range of 1s.
@@ -XXX,XX +XXX,XX @@ void hw_watchpoint_update_all(ARMCPU *cpu)
     int i;
     CPUARMState *env = &cpu->env;
 
-    /* Completely clear out existing QEMU watchpoints and our array, to
+    /*
+     * Completely clear out existing QEMU watchpoints and our array, to
      * avoid possible stale entries following migration load.
      */
     cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update(ARMCPU *cpu, int n)
     case 11: /* linked context ID and VMID match (reserved if no EL2) */
     case 3: /* linked context ID match */
     default:
-        /* We must generate no events for Linked context matches (unless
+        /*
+         * We must generate no events for Linked context matches (unless
          * they are linked to by some other bp/wp, which is handled in
          * updates for the linking bp/wp). We choose to also generate no events
          * for reserved values.
@@ -XXX,XX +XXX,XX @@ void hw_breakpoint_update_all(ARMCPU *cpu)
     int i;
     CPUARMState *env = &cpu->env;
 
-    /* Completely clear out existing QEMU breakpoints and our array, to
+    /*
+     * Completely clear out existing QEMU breakpoints and our array, to
      * avoid possible stale entries following migration load.
      */
     cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
@@ -XXX,XX +XXX,XX @@ static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
     ARMCPU *cpu = env_archcpu(env);
     int i = ri->crm;
 
-    /* BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
+    /*
+     * BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
      * copy of BAS[0].
      */
     value = deposit64(value, 6, 1, extract64(value, 5, 1));
@@ -XXX,XX +XXX,XX @@ static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
 
 static void define_debug_regs(ARMCPU *cpu)
 {
-    /* Define v7 and v8 architectural debug registers.
+    /*
+     * Define v7 and v8 architectural debug registers.
      * These are just dummy implementations for now.
      */
     int i;
-- 
2.25.1

The target/arm/helper.c file is very long and is a grabbag of all
kinds of functionality.  We have already a debug_helper.c which has
code for implementing architectural debug.  Move the code which
defines the debug-related system registers out to this file also.
This affects the define_debug_regs() function and the various
functions and arrays which are used only by it.

The functions raw_write() and arm_mdcr_el2_eff() and
define_debug_regs() now need to be global rather than local to
helper.c; everything else is pure code movement.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220630194116.3438513-3-peter.maydell@linaro.org
---
 target/arm/cpregs.h       |   3 +
 target/arm/internals.h    |   9 +
 target/arm/debug_helper.c | 525 +++++++++++++++++++++++++++++++++++++
 target/arm/helper.c       | 531 +-------------------------------------
 4 files changed, 538 insertions(+), 530 deletions(-)

diff --git a/target/arm/cpregs.h b/target/arm/cpregs.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpregs.h
+++ b/target/arm/cpregs.h
@@ -XXX,XX +XXX,XX @@ void arm_cp_write_ignore(CPUARMState *env, const ARMCPRegInfo *ri,
 /* CPReadFn that can be used for read-as-zero behaviour */
 uint64_t arm_cp_read_zero(CPUARMState *env, const ARMCPRegInfo *ri);
 
+/* CPWriteFn that just writes the value to ri->fieldoffset */
+void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value);
+
 /*
  * CPResetFn that does nothing, for use if no reset is required even
  * if fieldoffset is non zero.
diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ int exception_target_el(CPUARMState *env);
 bool arm_singlestep_active(CPUARMState *env);
 bool arm_generate_debug_exceptions(CPUARMState *env);
 
+/* Add the cpreg definitions for debug related system registers */
+void define_debug_regs(ARMCPU *cpu);
+
+/* Effective value of MDCR_EL2 */
+static inline uint64_t arm_mdcr_el2_eff(CPUARMState *env)
+{
+    return arm_is_el2_enabled(env) ? env->cp15.mdcr_el2 : 0;
+}
+
 /* Powers of 2 for sve_vq_map et al. */
 #define SVE_VQ_POW2_MAP                                 \
     ((1 << (1 - 1)) | (1 << (2 - 1)) |                  \
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@
  * SPDX-License-Identifier: GPL-2.0-or-later
  */
 #include "qemu/osdep.h"
+#include "qemu/log.h"
 #include "cpu.h"
 #include "internals.h"
+#include "cpregs.h"
 #include "exec/exec-all.h"
 #include "exec/helper-proto.h"
 
@@ -XXX,XX +XXX,XX @@ void HELPER(exception_swstep)(CPUARMState *env, uint32_t syndrome)
     raise_exception_debug(env, EXCP_UDEF, syndrome);
 }
 
+/*
+ * Check for traps to "powerdown debug" registers, which are controlled
+ * by MDCR.TDOSA
+ */
+static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
+                                   bool isread)
+{
+    int el = arm_current_el(env);
+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
+    bool mdcr_el2_tdosa = (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TDE) ||
+        (arm_hcr_el2_eff(env) & HCR_TGE);
+
+    if (el < 2 && mdcr_el2_tdosa) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+/*
+ * Check for traps to "debug ROM" registers, which are controlled
+ * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
+ */
+static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
+                                  bool isread)
+{
+    int el = arm_current_el(env);
+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
+    bool mdcr_el2_tdra = (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE) ||
+        (arm_hcr_el2_eff(env) & HCR_TGE);
+
+    if (el < 2 && mdcr_el2_tdra) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+/*
+ * Check for traps to general debug registers, which are controlled
+ * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
+ */
+static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
+                                  bool isread)
+{
+    int el = arm_current_el(env);
+    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
+    bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) ||
+        (arm_hcr_el2_eff(env) & HCR_TGE);
+
+    if (el < 2 && mdcr_el2_tda) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
+        return CP_ACCESS_TRAP_EL3;
+    }
+    return CP_ACCESS_OK;
+}
+
+static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                        uint64_t value)
+{
+    /*
+     * Writes to OSLAR_EL1 may update the OS lock status, which can be
+     * read via a bit in OSLSR_EL1.
+     */
+    int oslock;
+
+    if (ri->state == ARM_CP_STATE_AA32) {
+        oslock = (value == 0xC5ACCE55);
+    } else {
+        oslock = value & 1;
+    }
+
+    env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
+}
+
+static const ARMCPRegInfo debug_cp_reginfo[] = {
+    /*
+     * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
+     * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
+     * unlike DBGDRAR it is never accessible from EL0.
+     * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
+     * accessor.
+     */
+    { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
+      .access = PL0_R, .accessfn = access_tdra,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
+      .access = PL1_R, .accessfn = access_tdra,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
+      .access = PL0_R, .accessfn = access_tdra,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
+    /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
+    { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
+      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
+      .access = PL1_RW, .accessfn = access_tda,
+      .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
+      .resetvalue = 0 },
+    /*
+     * MDCCSR_EL0[30:29] map to EDSCR[30:29].  Simply RAZ as the external
+     * Debug Communication Channel is not implemented.
+     */
+    { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_AA64,
+      .opc0 = 2, .opc1 = 3, .crn = 0, .crm = 1, .opc2 = 0,
+      .access = PL0_R, .accessfn = access_tda,
+      .type = ARM_CP_CONST, .resetvalue = 0 },
+    /*
+     * DBGDSCRint[15,12,5:2] map to MDSCR_EL1[15,12,5:2].  Map all bits as
+     * it is unlikely a guest will care.
+     * We don't implement the configurable EL0 access.
+     */
+    { .name = "DBGDSCRint", .state = ARM_CP_STATE_AA32,
+      .cp = 14, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
+      .type = ARM_CP_ALIAS,
+      .access = PL1_R, .accessfn = access_tda,
+      .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
+    { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
+      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
+      .access = PL1_W, .type = ARM_CP_NO_RAW,
+      .accessfn = access_tdosa,
+      .writefn = oslar_write },
+    { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
+      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
+      .access = PL1_R, .resetvalue = 10,
+      .accessfn = access_tdosa,
+      .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
+    /* Dummy OSDLR_EL1: 32-bit Linux will read this */
+    { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
+      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
+      .access = PL1_RW, .accessfn = access_tdosa,
+      .type = ARM_CP_NOP },
+    /*
+     * Dummy DBGVCR: Linux wants to clear this on startup, but we don't
+     * implement vector catch debug events yet.
+     */
+    { .name = "DBGVCR",
+      .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
+      .access = PL1_RW, .accessfn = access_tda,
+      .type = ARM_CP_NOP },
+    /*
+     * Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
+     * to save and restore a 32-bit guest's DBGVCR)
+     */
+    { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
+      .access = PL2_RW, .accessfn = access_tda,
+      .type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
+    /*
+     * Dummy MDCCINT_EL1, since we don't implement the Debug Communications
+     * Channel but Linux may try to access this register. The 32-bit
+     * alias is DBGDCCINT.
+     */
+    { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
+      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
+      .access = PL1_RW, .accessfn = access_tda,
+      .type = ARM_CP_NOP },
+};
+
+static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
+    /* 64 bit access versions of the (dummy) debug registers */
+    { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
+      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
+    { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
+      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
+};
+
+void hw_watchpoint_update(ARMCPU *cpu, int n)
+{
+    CPUARMState *env = &cpu->env;
+    vaddr len = 0;
+    vaddr wvr = env->cp15.dbgwvr[n];
+    uint64_t wcr = env->cp15.dbgwcr[n];
+    int mask;
+    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
+
+    if (env->cpu_watchpoint[n]) {
+        cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
+        env->cpu_watchpoint[n] = NULL;
+    }
+
+    if (!FIELD_EX64(wcr, DBGWCR, E)) {
+        /* E bit clear : watchpoint disabled */
+        return;
+    }
+
+    switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
+    case 0:
+        /* LSC 00 is reserved and must behave as if the wp is disabled */
+        return;
+    case 1:
+        flags |= BP_MEM_READ;
+        break;
+    case 2:
+        flags |= BP_MEM_WRITE;
+        break;
+    case 3:
+        flags |= BP_MEM_ACCESS;
+        break;
+    }
+
+    /*
+     * Attempts to use both MASK and BAS fields simultaneously are
+     * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
+     * thus generating a watchpoint for every byte in the masked region.
+     */
+    mask = FIELD_EX64(wcr, DBGWCR, MASK);
+    if (mask == 1 || mask == 2) {
+        /*
+         * Reserved values of MASK; we must act as if the mask value was
+         * some non-reserved value, or as if the watchpoint were disabled.
+         * We choose the latter.
+         */
+        return;
+    } else if (mask) {
+        /* Watchpoint covers an aligned area up to 2GB in size */
+        len = 1ULL << mask;
+        /*
+         * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
+         * whether the watchpoint fires when the unmasked bits match; we opt
+         * to generate the exceptions.
+         */
+        wvr &= ~(len - 1);
+    } else {
+        /* Watchpoint covers bytes defined by the byte address select bits */
+        int bas = FIELD_EX64(wcr, DBGWCR, BAS);
+        int basstart;
+
+        if (extract64(wvr, 2, 1)) {
+            /*
+             * Deprecated case of an only 4-aligned address. BAS[7:4] are
+             * ignored, and BAS[3:0] define which bytes to watch.
+             */
+            bas &= 0xf;
+        }
+
+        if (bas == 0) {
+            /* This must act as if the watchpoint is disabled */
+            return;
+        }
+
+        /*
+         * The BAS bits are supposed to be programmed to indicate a contiguous
+         * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
+         * we fire for each byte in the word/doubleword addressed by the WVR.
+         * We choose to ignore any non-zero bits after the first range of 1s.
+         */
+        basstart = ctz32(bas);
+        len = cto32(bas >> basstart);
+        wvr += basstart;
+    }
+
+    cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
+                          &env->cpu_watchpoint[n]);
+}
+
+void hw_watchpoint_update_all(ARMCPU *cpu)
+{
+    int i;
+    CPUARMState *env = &cpu->env;
+
+    /*
+     * Completely clear out existing QEMU watchpoints and our array, to
+     * avoid possible stale entries following migration load.
+     */
+    cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
+    memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
+
+    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
+        hw_watchpoint_update(cpu, i);
+    }
+}
+
+static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+    int i = ri->crm;
+
+    /*
+     * Bits [1:0] are RES0.
+     *
+     * It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA)
+     * are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if
+     * they contain the value written.  It is CONSTRAINED UNPREDICTABLE
+     * whether the RESS bits are ignored when comparing an address.
+     *
+     * Therefore we are allowed to compare the entire register, which lets
+     * us avoid considering whether or not FEAT_LVA is actually enabled.
+     */
+    value &= ~3ULL;
+
+    raw_write(env, ri, value);
+    hw_watchpoint_update(cpu, i);
+}
+
+static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+    int i = ri->crm;
+
+    raw_write(env, ri, value);
+    hw_watchpoint_update(cpu, i);
+}
+
+void hw_breakpoint_update(ARMCPU *cpu, int n)
+{
+    CPUARMState *env = &cpu->env;
+    uint64_t bvr = env->cp15.dbgbvr[n];
+    uint64_t bcr = env->cp15.dbgbcr[n];
+    vaddr addr;
+    int bt;
+    int flags = BP_CPU;
+
+    if (env->cpu_breakpoint[n]) {
+        cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
+        env->cpu_breakpoint[n] = NULL;
+    }
+
+    if (!extract64(bcr, 0, 1)) {
+        /* E bit clear : watchpoint disabled */
+        return;
+    }
+
+    bt = extract64(bcr, 20, 4);
+
+    switch (bt) {
+    case 4: /* unlinked address mismatch (reserved if AArch64) */
+    case 5: /* linked address mismatch (reserved if AArch64) */
+        qemu_log_mask(LOG_UNIMP,
+                      "arm: address mismatch breakpoint types not implemented\n");
+        return;
+    case 0: /* unlinked address match */
+    case 1: /* linked address match */
+    {
+        /*
+         * Bits [1:0] are RES0.
+         *
+         * It is IMPLEMENTATION DEFINED whether bits [63:49]
+         * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
+         * of the VA field ([48] or [52] for FEAT_LVA), or whether the
+         * value is read as written.  It is CONSTRAINED UNPREDICTABLE
+         * whether the RESS bits are ignored when comparing an address.
+         * Therefore we are allowed to compare the entire register, which
+         * lets us avoid considering whether FEAT_LVA is actually enabled.
+         *
+         * The BAS field is used to allow setting breakpoints on 16-bit
+         * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
+         * a bp will fire if the addresses covered by the bp and the addresses
+         * covered by the insn overlap but the insn doesn't start at the
+         * start of the bp address range. We choose to require the insn and
+         * the bp to have the same address. The constraints on writing to
+         * BAS enforced in dbgbcr_write mean we have only four cases:
+         *  0b0000  => no breakpoint
+         *  0b0011  => breakpoint on addr
+         *  0b1100  => breakpoint on addr + 2
+         *  0b1111  => breakpoint on addr
+         * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
+         */
+        int bas = extract64(bcr, 5, 4);
+        addr = bvr & ~3ULL;
+        if (bas == 0) {
+            return;
+        }
+        if (bas == 0xc) {
+            addr += 2;
+        }
+        break;
+    }
+    case 2: /* unlinked context ID match */
+    case 8: /* unlinked VMID match (reserved if no EL2) */
+    case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
+        qemu_log_mask(LOG_UNIMP,
+                      "arm: unlinked context breakpoint types not implemented\n");
+        return;
+    case 9: /* linked VMID match (reserved if no EL2) */
+    case 11: /* linked context ID and VMID match (reserved if no EL2) */
+    case 3: /* linked context ID match */
+    default:
+        /*
+         * We must generate no events for Linked context matches (unless
+         * they are linked to by some other bp/wp, which is handled in
+         * updates for the linking bp/wp). We choose to also generate no events
+         * for reserved values.
+         */
+        return;
+    }
+
+    cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
+}
+
+void hw_breakpoint_update_all(ARMCPU *cpu)
+{
+    int i;
+    CPUARMState *env = &cpu->env;
+
+    /*
+     * Completely clear out existing QEMU breakpoints and our array, to
+     * avoid possible stale entries following migration load.
+     */
+    cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
+    memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
+
+    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
+        hw_breakpoint_update(cpu, i);
+    }
+}
+
+static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+    int i = ri->crm;
+
+    raw_write(env, ri, value);
+    hw_breakpoint_update(cpu, i);
+}
+
+static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                         uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+    int i = ri->crm;
+
+    /*
+     * BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
+     * copy of BAS[0].
+     */
+    value = deposit64(value, 6, 1, extract64(value, 5, 1));
+    value = deposit64(value, 8, 1, extract64(value, 7, 1));
+
+    raw_write(env, ri, value);
+    hw_breakpoint_update(cpu, i);
+}
+
+void define_debug_regs(ARMCPU *cpu)
+{
+    /*
+     * Define v7 and v8 architectural debug registers.
+     * These are just dummy implementations for now.
+     */
+    int i;
+    int wrps, brps, ctx_cmps;
+
+    /*
+     * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
+     * use AArch32.  Given that bit 15 is RES1, if the value is 0 then
+     * the register must not exist for this cpu.
+     */
+    if (cpu->isar.dbgdidr != 0) {
+        ARMCPRegInfo dbgdidr = {
+            .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
+            .opc1 = 0, .opc2 = 0,
+            .access = PL0_R, .accessfn = access_tda,
+            .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
+        };
+        define_one_arm_cp_reg(cpu, &dbgdidr);
+    }
+
+    brps = arm_num_brps(cpu);
+    wrps = arm_num_wrps(cpu);
+    ctx_cmps = arm_num_ctx_cmps(cpu);
+
+    assert(ctx_cmps <= brps);
+
+    define_arm_cp_regs(cpu, debug_cp_reginfo);
+
+    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
+        define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
+    }
+
+    for (i = 0; i < brps; i++) {
+        char *dbgbvr_el1_name = g_strdup_printf("DBGBVR%d_EL1", i);
+        char *dbgbcr_el1_name = g_strdup_printf("DBGBCR%d_EL1", i);
+        ARMCPRegInfo dbgregs[] = {
+            { .name = dbgbvr_el1_name, .state = ARM_CP_STATE_BOTH,
+              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
+              .access = PL1_RW, .accessfn = access_tda,
+              .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
+              .writefn = dbgbvr_write, .raw_writefn = raw_write
+            },
+            { .name = dbgbcr_el1_name, .state = ARM_CP_STATE_BOTH,
+              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
+              .access = PL1_RW, .accessfn = access_tda,
+              .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
+              .writefn = dbgbcr_write, .raw_writefn = raw_write
+            },
+        };
+        define_arm_cp_regs(cpu, dbgregs);
+        g_free(dbgbvr_el1_name);
+        g_free(dbgbcr_el1_name);
+    }
+
+    for (i = 0; i < wrps; i++) {
+        char *dbgwvr_el1_name = g_strdup_printf("DBGWVR%d_EL1", i);
+        char *dbgwcr_el1_name = g_strdup_printf("DBGWCR%d_EL1", i);
+        ARMCPRegInfo dbgregs[] = {
+            { .name = dbgwvr_el1_name, .state = ARM_CP_STATE_BOTH,
+              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
+              .access = PL1_RW, .accessfn = access_tda,
+              .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
+              .writefn = dbgwvr_write, .raw_writefn = raw_write
+            },
+            { .name = dbgwcr_el1_name, .state = ARM_CP_STATE_BOTH,
+              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
+              .access = PL1_RW, .accessfn = access_tda,
+              .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
+              .writefn = dbgwcr_write, .raw_writefn = raw_write
+            },
+        };
+        define_arm_cp_regs(cpu, dbgregs);
+        g_free(dbgwvr_el1_name);
+        g_free(dbgwcr_el1_name);
+    }
+}
+
 #if !defined(CONFIG_USER_ONLY)
 
 vaddr arm_adjust_watchpoint_address(CPUState *cs, vaddr addr, int len)
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t raw_read(CPUARMState *env, const ARMCPRegInfo *ri)
     }
 }
 
-static void raw_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                      uint64_t value)
+void raw_write(CPUARMState *env, const ARMCPRegInfo *ri, uint64_t value)
 {
     assert(ri->fieldoffset);
     if (cpreg_field_is_64bit(ri)) {
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_trap_aa32s_el1(CPUARMState *env,
     return CP_ACCESS_TRAP_UNCATEGORIZED;
 }
 
-static uint64_t arm_mdcr_el2_eff(CPUARMState *env)
-{
-    return arm_is_el2_enabled(env) ? env->cp15.mdcr_el2 : 0;
-}
-
-/*
- * Check for traps to "powerdown debug" registers, which are controlled
- * by MDCR.TDOSA
- */
-static CPAccessResult access_tdosa(CPUARMState *env, const ARMCPRegInfo *ri,
-                                   bool isread)
-{
-    int el = arm_current_el(env);
-    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
-    bool mdcr_el2_tdosa = (mdcr_el2 & MDCR_TDOSA) || (mdcr_el2 & MDCR_TDE) ||
-        (arm_hcr_el2_eff(env) & HCR_TGE);
-
-    if (el < 2 && mdcr_el2_tdosa) {
-        return CP_ACCESS_TRAP_EL2;
-    }
-    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDOSA)) {
-        return CP_ACCESS_TRAP_EL3;
-    }
-    return CP_ACCESS_OK;
-}
-
-/*
- * Check for traps to "debug ROM" registers, which are controlled
- * by MDCR_EL2.TDRA for EL2 but by the more general MDCR_EL3.TDA for EL3.
- */
-static CPAccessResult access_tdra(CPUARMState *env, const ARMCPRegInfo *ri,
-                                  bool isread)
-{
-    int el = arm_current_el(env);
-    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
-    bool mdcr_el2_tdra = (mdcr_el2 & MDCR_TDRA) || (mdcr_el2 & MDCR_TDE) ||
-        (arm_hcr_el2_eff(env) & HCR_TGE);
-
-    if (el < 2 && mdcr_el2_tdra) {
-        return CP_ACCESS_TRAP_EL2;
-    }
-    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
-        return CP_ACCESS_TRAP_EL3;
-    }
-    return CP_ACCESS_OK;
-}
-
-/*
- * Check for traps to general debug registers, which are controlled
- * by MDCR_EL2.TDA for EL2 and MDCR_EL3.TDA for EL3.
- */
-static CPAccessResult access_tda(CPUARMState *env, const ARMCPRegInfo *ri,
-                                  bool isread)
-{
-    int el = arm_current_el(env);
-    uint64_t mdcr_el2 = arm_mdcr_el2_eff(env);
-    bool mdcr_el2_tda = (mdcr_el2 & MDCR_TDA) || (mdcr_el2 & MDCR_TDE) ||
-        (arm_hcr_el2_eff(env) & HCR_TGE);
-
-    if (el < 2 && mdcr_el2_tda) {
-        return CP_ACCESS_TRAP_EL2;
-    }
-    if (el < 3 && (env->cp15.mdcr_el3 & MDCR_TDA)) {
-        return CP_ACCESS_TRAP_EL3;
-    }
-    return CP_ACCESS_OK;
-}
-
 /* Check for traps to performance monitor registers, which are controlled
  * by MDCR_EL2.TPM for EL2 and MDCR_EL3.TPM for EL3.
  */
@@ -XXX,XX +XXX,XX @@ static CPAccessResult ctr_el0_access(CPUARMState *env, const ARMCPRegInfo *ri,
     return CP_ACCESS_OK;
 }
 
-static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                        uint64_t value)
-{
-    /*
-     * Writes to OSLAR_EL1 may update the OS lock status, which can be
-     * read via a bit in OSLSR_EL1.
-     */
-    int oslock;
-
-    if (ri->state == ARM_CP_STATE_AA32) {
-        oslock = (value == 0xC5ACCE55);
-    } else {
-        oslock = value & 1;
-    }
-
-    env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
-}
-
-static const ARMCPRegInfo debug_cp_reginfo[] = {
-    /*
-     * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
-     * debug components. The AArch64 version of DBGDRAR is named MDRAR_EL1;
-     * unlike DBGDRAR it is never accessible from EL0.
-     * DBGDSAR is deprecated and must RAZ from v8 anyway, so it has no AArch64
-     * accessor.
-     */
-    { .name = "DBGDRAR", .cp = 14, .crn = 1, .crm = 0, .opc1 = 0, .opc2 = 0,
-      .access = PL0_R, .accessfn = access_tdra,
-      .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "MDRAR_EL1", .state = ARM_CP_STATE_AA64,
-      .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 0,
-      .access = PL1_R, .accessfn = access_tdra,
-      .type = ARM_CP_CONST, .resetvalue = 0 },
-    { .name = "DBGDSAR", .cp = 14, .crn = 2, .crm = 0, .opc1 = 0, .opc2 = 0,
-      .access = PL0_R, .accessfn = access_tdra,
-      .type = ARM_CP_CONST, .resetvalue = 0 },
-    /* Monitor debug system control register; the 32-bit alias is DBGDSCRext. */
-    { .name = "MDSCR_EL1", .state = ARM_CP_STATE_BOTH,
-      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
-      .access = PL1_RW, .accessfn = access_tda,
-      .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1),
-      .resetvalue = 0 },
-    /*
-     * MDCCSR_EL0[30:29] map to EDSCR[30:29].  Simply RAZ as the external
-     * Debug Communication Channel is not implemented.
-     */
-    { .name = "MDCCSR_EL0", .state = ARM_CP_STATE_AA64,
-      .opc0 = 2, .opc1 = 3, .crn = 0, .crm = 1, .opc2 = 0,
-      .access = PL0_R, .accessfn = access_tda,
-      .type = ARM_CP_CONST, .resetvalue = 0 },
-    /*
-     * DBGDSCRint[15,12,5:2] map to MDSCR_EL1[15,12,5:2].  Map all bits as
-     * it is unlikely a guest will care.
-     * We don't implement the configurable EL0 access.
-     */
-    { .name = "DBGDSCRint", .state = ARM_CP_STATE_AA32,
-      .cp = 14, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
-      .type = ARM_CP_ALIAS,
-      .access = PL1_R, .accessfn = access_tda,
-      .fieldoffset = offsetof(CPUARMState, cp15.mdscr_el1), },
-    { .name = "OSLAR_EL1", .state = ARM_CP_STATE_BOTH,
-      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 0, .opc2 = 4,
-      .access = PL1_W, .type = ARM_CP_NO_RAW,
-      .accessfn = access_tdosa,
-      .writefn = oslar_write },
-    { .name = "OSLSR_EL1", .state = ARM_CP_STATE_BOTH,
-      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 1, .opc2 = 4,
-      .access = PL1_R, .resetvalue = 10,
-      .accessfn = access_tdosa,
-      .fieldoffset = offsetof(CPUARMState, cp15.oslsr_el1) },
-    /* Dummy OSDLR_EL1: 32-bit Linux will read this */
-    { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
-      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
-      .access = PL1_RW, .accessfn = access_tdosa,
-      .type = ARM_CP_NOP },
-    /*
-     * Dummy DBGVCR: Linux wants to clear this on startup, but we don't
-     * implement vector catch debug events yet.
-     */
-    { .name = "DBGVCR",
-      .cp = 14, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
-      .access = PL1_RW, .accessfn = access_tda,
-      .type = ARM_CP_NOP },
-    /*
-     * Dummy DBGVCR32_EL2 (which is only for a 64-bit hypervisor
-     * to save and restore a 32-bit guest's DBGVCR)
-     */
-    { .name = "DBGVCR32_EL2", .state = ARM_CP_STATE_AA64,
-      .opc0 = 2, .opc1 = 4, .crn = 0, .crm = 7, .opc2 = 0,
-      .access = PL2_RW, .accessfn = access_tda,
-      .type = ARM_CP_NOP | ARM_CP_EL3_NO_EL2_KEEP },
-    /*
-     * Dummy MDCCINT_EL1, since we don't implement the Debug Communications
-     * Channel but Linux may try to access this register. The 32-bit
-     * alias is DBGDCCINT.
-     */
-    { .name = "MDCCINT_EL1", .state = ARM_CP_STATE_BOTH,
-      .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
-      .access = PL1_RW, .accessfn = access_tda,
-      .type = ARM_CP_NOP },
-};
-
-static const ARMCPRegInfo debug_lpae_cp_reginfo[] = {
-    /* 64 bit access versions of the (dummy) debug registers */
-    { .name = "DBGDRAR", .cp = 14, .crm = 1, .opc1 = 0,
-      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
-    { .name = "DBGDSAR", .cp = 14, .crm = 2, .opc1 = 0,
-      .access = PL0_R, .type = ARM_CP_CONST | ARM_CP_64BIT, .resetvalue = 0 },
-};
-
 /*
  * Check for traps to RAS registers, which are controlled
  * by HCR_EL2.TERR and SCR_EL3.TERR.
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo sme_reginfo[] = {
 };
 #endif /* TARGET_AARCH64 */
 
-void hw_watchpoint_update(ARMCPU *cpu, int n)
-{
-    CPUARMState *env = &cpu->env;
-    vaddr len = 0;
-    vaddr wvr = env->cp15.dbgwvr[n];
-    uint64_t wcr = env->cp15.dbgwcr[n];
-    int mask;
-    int flags = BP_CPU | BP_STOP_BEFORE_ACCESS;
-
-    if (env->cpu_watchpoint[n]) {
-        cpu_watchpoint_remove_by_ref(CPU(cpu), env->cpu_watchpoint[n]);
-        env->cpu_watchpoint[n] = NULL;
-    }
-
-    if (!FIELD_EX64(wcr, DBGWCR, E)) {
-        /* E bit clear : watchpoint disabled */
-        return;
-    }
-
-    switch (FIELD_EX64(wcr, DBGWCR, LSC)) {
-    case 0:
-        /* LSC 00 is reserved and must behave as if the wp is disabled */
-        return;
-    case 1:
-        flags |= BP_MEM_READ;
-        break;
-    case 2:
-        flags |= BP_MEM_WRITE;
-        break;
-    case 3:
-        flags |= BP_MEM_ACCESS;
-        break;
-    }
-
-    /*
-     * Attempts to use both MASK and BAS fields simultaneously are
-     * CONSTRAINED UNPREDICTABLE; we opt to ignore BAS in this case,
-     * thus generating a watchpoint for every byte in the masked region.
-     */
-    mask = FIELD_EX64(wcr, DBGWCR, MASK);
-    if (mask == 1 || mask == 2) {
-        /*
-         * Reserved values of MASK; we must act as if the mask value was
-         * some non-reserved value, or as if the watchpoint were disabled.
-         * We choose the latter.
-         */
-        return;
-    } else if (mask) {
-        /* Watchpoint covers an aligned area up to 2GB in size */
-        len = 1ULL << mask;
-        /*
-         * If masked bits in WVR are not zero it's CONSTRAINED UNPREDICTABLE
-         * whether the watchpoint fires when the unmasked bits match; we opt
-         * to generate the exceptions.
-         */
-        wvr &= ~(len - 1);
-    } else {
-        /* Watchpoint covers bytes defined by the byte address select bits */
-        int bas = FIELD_EX64(wcr, DBGWCR, BAS);
-        int basstart;
-
-        if (extract64(wvr, 2, 1)) {
-            /*
-             * Deprecated case of an only 4-aligned address. BAS[7:4] are
-             * ignored, and BAS[3:0] define which bytes to watch.
-             */
-            bas &= 0xf;
-        }
-
-        if (bas == 0) {
-            /* This must act as if the watchpoint is disabled */
-            return;
-        }
-
-        /*
-         * The BAS bits are supposed to be programmed to indicate a contiguous
-         * range of bytes. Otherwise it is CONSTRAINED UNPREDICTABLE whether
-         * we fire for each byte in the word/doubleword addressed by the WVR.
-         * We choose to ignore any non-zero bits after the first range of 1s.
-         */
-        basstart = ctz32(bas);
-        len = cto32(bas >> basstart);
-        wvr += basstart;
-    }
-
-    cpu_watchpoint_insert(CPU(cpu), wvr, len, flags,
-                          &env->cpu_watchpoint[n]);
-}
-
-void hw_watchpoint_update_all(ARMCPU *cpu)
-{
-    int i;
-    CPUARMState *env = &cpu->env;
-
-    /*
-     * Completely clear out existing QEMU watchpoints and our array, to
-     * avoid possible stale entries following migration load.
-     */
-    cpu_watchpoint_remove_all(CPU(cpu), BP_CPU);
-    memset(env->cpu_watchpoint, 0, sizeof(env->cpu_watchpoint));
-
-    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_watchpoint); i++) {
-        hw_watchpoint_update(cpu, i);
-    }
-}
-
-static void dbgwvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                         uint64_t value)
-{
-    ARMCPU *cpu = env_archcpu(env);
-    int i = ri->crm;
-
-    /*
-     * Bits [1:0] are RES0.
-     *
-     * It is IMPLEMENTATION DEFINED whether [63:49] ([63:53] with FEAT_LVA)
-     * are hardwired to the value of bit [48] ([52] with FEAT_LVA), or if
-     * they contain the value written.  It is CONSTRAINED UNPREDICTABLE
-     * whether the RESS bits are ignored when comparing an address.
-     *
-     * Therefore we are allowed to compare the entire register, which lets
-     * us avoid considering whether or not FEAT_LVA is actually enabled.
-     */
-    value &= ~3ULL;
-
-    raw_write(env, ri, value);
-    hw_watchpoint_update(cpu, i);
-}
-
-static void dbgwcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                         uint64_t value)
-{
-    ARMCPU *cpu = env_archcpu(env);
-    int i = ri->crm;
-
-    raw_write(env, ri, value);
-    hw_watchpoint_update(cpu, i);
-}
-
-void hw_breakpoint_update(ARMCPU *cpu, int n)
-{
-    CPUARMState *env = &cpu->env;
-    uint64_t bvr = env->cp15.dbgbvr[n];
-    uint64_t bcr = env->cp15.dbgbcr[n];
-    vaddr addr;
-    int bt;
-    int flags = BP_CPU;
-
-    if (env->cpu_breakpoint[n]) {
-        cpu_breakpoint_remove_by_ref(CPU(cpu), env->cpu_breakpoint[n]);
-        env->cpu_breakpoint[n] = NULL;
-    }
-
-    if (!extract64(bcr, 0, 1)) {
-        /* E bit clear : watchpoint disabled */
-        return;
-    }
-
-    bt = extract64(bcr, 20, 4);
-
-    switch (bt) {
-    case 4: /* unlinked address mismatch (reserved if AArch64) */
-    case 5: /* linked address mismatch (reserved if AArch64) */
-        qemu_log_mask(LOG_UNIMP,
-                      "arm: address mismatch breakpoint types not implemented\n");
-        return;
-    case 0: /* unlinked address match */
-    case 1: /* linked address match */
-    {
-        /*
-         * Bits [1:0] are RES0.
-         *
-         * It is IMPLEMENTATION DEFINED whether bits [63:49]
-         * ([63:53] for FEAT_LVA) are hardwired to a copy of the sign bit
-         * of the VA field ([48] or [52] for FEAT_LVA), or whether the
-         * value is read as written.  It is CONSTRAINED UNPREDICTABLE
-         * whether the RESS bits are ignored when comparing an address.
-         * Therefore we are allowed to compare the entire register, which
-         * lets us avoid considering whether FEAT_LVA is actually enabled.
-         *
-         * The BAS field is used to allow setting breakpoints on 16-bit
-         * wide instructions; it is CONSTRAINED UNPREDICTABLE whether
-         * a bp will fire if the addresses covered by the bp and the addresses
-         * covered by the insn overlap but the insn doesn't start at the
-         * start of the bp address range. We choose to require the insn and
-         * the bp to have the same address. The constraints on writing to
-         * BAS enforced in dbgbcr_write mean we have only four cases:
-         *  0b0000  => no breakpoint
-         *  0b0011  => breakpoint on addr
-         *  0b1100  => breakpoint on addr + 2
-         *  0b1111  => breakpoint on addr
-         * See also figure D2-3 in the v8 ARM ARM (DDI0487A.c).
-         */
-        int bas = extract64(bcr, 5, 4);
-        addr = bvr & ~3ULL;
-        if (bas == 0) {
-            return;
-        }
-        if (bas == 0xc) {
-            addr += 2;
-        }
-        break;
-    }
-    case 2: /* unlinked context ID match */
-    case 8: /* unlinked VMID match (reserved if no EL2) */
-    case 10: /* unlinked context ID and VMID match (reserved if no EL2) */
-        qemu_log_mask(LOG_UNIMP,
-                      "arm: unlinked context breakpoint types not implemented\n");
-        return;
-    case 9: /* linked VMID match (reserved if no EL2) */
-    case 11: /* linked context ID and VMID match (reserved if no EL2) */
-    case 3: /* linked context ID match */
-    default:
-        /*
-         * We must generate no events for Linked context matches (unless
-         * they are linked to by some other bp/wp, which is handled in
-         * updates for the linking bp/wp). We choose to also generate no events
-         * for reserved values.
-         */
-        return;
-    }
-
-    cpu_breakpoint_insert(CPU(cpu), addr, flags, &env->cpu_breakpoint[n]);
-}
-
-void hw_breakpoint_update_all(ARMCPU *cpu)
-{
-    int i;
-    CPUARMState *env = &cpu->env;
-
-    /*
-     * Completely clear out existing QEMU breakpoints and our array, to
-     * avoid possible stale entries following migration load.
-     */
-    cpu_breakpoint_remove_all(CPU(cpu), BP_CPU);
-    memset(env->cpu_breakpoint, 0, sizeof(env->cpu_breakpoint));
-
-    for (i = 0; i < ARRAY_SIZE(cpu->env.cpu_breakpoint); i++) {
-        hw_breakpoint_update(cpu, i);
-    }
-}
-
-static void dbgbvr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                         uint64_t value)
-{
-    ARMCPU *cpu = env_archcpu(env);
-    int i = ri->crm;
-
-    raw_write(env, ri, value);
-    hw_breakpoint_update(cpu, i);
-}
-
-static void dbgbcr_write(CPUARMState *env, const ARMCPRegInfo *ri,
-                         uint64_t value)
-{
-    ARMCPU *cpu = env_archcpu(env);
-    int i = ri->crm;
-
-    /*
-     * BAS[3] is a read-only copy of BAS[2], and BAS[1] a read-only
-     * copy of BAS[0].
-     */
-    value = deposit64(value, 6, 1, extract64(value, 5, 1));
-    value = deposit64(value, 8, 1, extract64(value, 7, 1));
-
-    raw_write(env, ri, value);
-    hw_breakpoint_update(cpu, i);
-}
-
-static void define_debug_regs(ARMCPU *cpu)
-{
-    /*
-     * Define v7 and v8 architectural debug registers.
-     * These are just dummy implementations for now.
-     */
-    int i;
-    int wrps, brps, ctx_cmps;
-
-    /*
-     * The Arm ARM says DBGDIDR is optional and deprecated if EL1 cannot
-     * use AArch32.  Given that bit 15 is RES1, if the value is 0 then
-     * the register must not exist for this cpu.
-     */
-    if (cpu->isar.dbgdidr != 0) {
-        ARMCPRegInfo dbgdidr = {
-            .name = "DBGDIDR", .cp = 14, .crn = 0, .crm = 0,
-            .opc1 = 0, .opc2 = 0,
-            .access = PL0_R, .accessfn = access_tda,
-            .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdidr,
-        };
-        define_one_arm_cp_reg(cpu, &dbgdidr);
-    }
-
-    brps = arm_num_brps(cpu);
-    wrps = arm_num_wrps(cpu);
-    ctx_cmps = arm_num_ctx_cmps(cpu);
-
-    assert(ctx_cmps <= brps);
-
-    define_arm_cp_regs(cpu, debug_cp_reginfo);
-
-    if (arm_feature(&cpu->env, ARM_FEATURE_LPAE)) {
-        define_arm_cp_regs(cpu, debug_lpae_cp_reginfo);
-    }
-
-    for (i = 0; i < brps; i++) {
-        char *dbgbvr_el1_name = g_strdup_printf("DBGBVR%d_EL1", i);
-        char *dbgbcr_el1_name = g_strdup_printf("DBGBCR%d_EL1", i);
-        ARMCPRegInfo dbgregs[] = {
-            { .name = dbgbvr_el1_name, .state = ARM_CP_STATE_BOTH,
-              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 4,
-              .access = PL1_RW, .accessfn = access_tda,
-              .fieldoffset = offsetof(CPUARMState, cp15.dbgbvr[i]),
-              .writefn = dbgbvr_write, .raw_writefn = raw_write
-            },
-            { .name = dbgbcr_el1_name, .state = ARM_CP_STATE_BOTH,
-              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 5,
-              .access = PL1_RW, .accessfn = access_tda,
-              .fieldoffset = offsetof(CPUARMState, cp15.dbgbcr[i]),
-              .writefn = dbgbcr_write, .raw_writefn = raw_write
-            },
-        };
-        define_arm_cp_regs(cpu, dbgregs);
-        g_free(dbgbvr_el1_name);
-        g_free(dbgbcr_el1_name);
-    }
-
-    for (i = 0; i < wrps; i++) {
-        char *dbgwvr_el1_name = g_strdup_printf("DBGWVR%d_EL1", i);
-        char *dbgwcr_el1_name = g_strdup_printf("DBGWCR%d_EL1", i);
-        ARMCPRegInfo dbgregs[] = {
-            { .name = dbgwvr_el1_name, .state = ARM_CP_STATE_BOTH,
-              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 6,
-              .access = PL1_RW, .accessfn = access_tda,
-              .fieldoffset = offsetof(CPUARMState, cp15.dbgwvr[i]),
-              .writefn = dbgwvr_write, .raw_writefn = raw_write
-            },
-            { .name = dbgwcr_el1_name, .state = ARM_CP_STATE_BOTH,
-              .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 0, .crm = i, .opc2 = 7,
-              .access = PL1_RW, .accessfn = access_tda,
-              .fieldoffset = offsetof(CPUARMState, cp15.dbgwcr[i]),
-              .writefn = dbgwcr_write, .raw_writefn = raw_write
-            },
-        };
-        define_arm_cp_regs(cpu, dbgregs);
-        g_free(dbgwvr_el1_name);
-        g_free(dbgwcr_el1_name);
-    }
-}
-
 static void define_pmu_regs(ARMCPU *cpu)
 {
     /*
-- 
2.25.1

The "OS Lock" in the Arm debug architecture is a way for software
to suppress debug exceptions while it is trying to power down
a CPU and save the state of the breakpoint and watchpoint
registers. In QEMU we implemented the support for writing
the OS Lock bit via OSLAR_EL1 and reading it via OSLSR_EL1,
but didn't implement the actual behaviour.

The required behaviour with the OS Lock set is:
 * debug exceptions (apart from BKPT insns) are suppressed
 * some MDSCR_EL1 bits allow write access to the corresponding
   EDSCR external debug status register that they shadow
   (we can ignore this because we don't implement external debug)
 * similarly with the OSECCR_EL1 which shadows the EDECCR
   (but we don't implement OSECCR_EL1 anyway)

Implement the missing behaviour of suppressing debug
exceptions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220630194116.3438513-4-peter.maydell@linaro.org
---
 target/arm/debug_helper.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ static bool aa32_generate_debug_exceptions(CPUARMState *env)
  */
 bool arm_generate_debug_exceptions(CPUARMState *env)
 {
+    if (env->cp15.oslsr_el1 & 1) {
+        return false;
+    }
     if (is_a64(env)) {
         return aa64_generate_debug_exceptions(env);
     } else {
-- 
2.25.1

Starting with v7 of the debug architecture, there are three extra
ID registers that add information on top of that provided in
DBGDIDR. These are DBGDEVID, DBGDEVID1 and DBGDEVID2. In the
v7 debug architecture, DBGDEVID is optional, present only of
DBGDIDR.DEVID_imp is set. In v7.1 all three must be present.

Implement the missing registers.  Note that we only need to set the
values in the ARMISARegisters struct for the CPUs Cortex-A7, A15,
A53, A57 and A72 (plus the 32-bit 'max' which uses the Cortex-A53
values): earlier CPUs didn't implement v7 of the architecture, and
our other 64-bit CPUs (Cortex-A76, Neoverse-N1 and A64fx) don't have
AArch32 support at EL1.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220630194116.3438513-5-peter.maydell@linaro.org
---
 target/arm/cpu.h          |  7 +++++++
 target/arm/cpu64.c        |  6 ++++++
 target/arm/cpu_tcg.c      |  6 ++++++
 target/arm/debug_helper.c | 36 ++++++++++++++++++++++++++++++++++++
 4 files changed, 55 insertions(+)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ struct ArchCPU {
         uint32_t mvfr2;
         uint32_t id_dfr0;
         uint32_t dbgdidr;
+        uint32_t dbgdevid;
+        uint32_t dbgdevid1;
         uint64_t id_aa64isar0;
         uint64_t id_aa64isar1;
         uint64_t id_aa64pfr0;
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_ssbs(const ARMISARegisters *id)
     return FIELD_EX32(id->id_pfr2, ID_PFR2, SSBS) != 0;
 }
 
+static inline bool isar_feature_aa32_debugv7p1(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 5;
+}
+
 static inline bool isar_feature_aa32_debugv8p2(const ARMISARegisters *id)
 {
     return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 8;
diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@ static void aarch64_a57_initfn(Object *obj)
     cpu->isar.id_aa64isar0 = 0x00011120;
     cpu->isar.id_aa64mmfr0 = 0x00001124;
     cpu->isar.dbgdidr = 0x3516d000;
+    cpu->isar.dbgdevid = 0x01110f13;
+    cpu->isar.dbgdevid1 = 0x2;
     cpu->isar.reset_pmcr_el0 = 0x41013000;
     cpu->clidr = 0x0a200023;
     cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
@@ -XXX,XX +XXX,XX @@ static void aarch64_a53_initfn(Object *obj)
     cpu->isar.id_aa64isar0 = 0x00011120;
     cpu->isar.id_aa64mmfr0 = 0x00001122; /* 40 bit physical addr */
     cpu->isar.dbgdidr = 0x3516d000;
+    cpu->isar.dbgdevid = 0x00110f13;
+    cpu->isar.dbgdevid1 = 0x1;
     cpu->isar.reset_pmcr_el0 = 0x41033000;
     cpu->clidr = 0x0a200023;
     cpu->ccsidr[0] = 0x700fe01a; /* 32KB L1 dcache */
@@ -XXX,XX +XXX,XX @@ static void aarch64_a72_initfn(Object *obj)
     cpu->isar.id_aa64isar0 = 0x00011120;
     cpu->isar.id_aa64mmfr0 = 0x00001124;
     cpu->isar.dbgdidr = 0x3516d000;
+    cpu->isar.dbgdevid = 0x01110f13;
+    cpu->isar.dbgdevid1 = 0x2;
     cpu->isar.reset_pmcr_el0 = 0x41023000;
     cpu->clidr = 0x0a200023;
     cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
diff --git a/target/arm/cpu_tcg.c b/target/arm/cpu_tcg.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu_tcg.c
+++ b/target/arm/cpu_tcg.c
@@ -XXX,XX +XXX,XX @@ static void cortex_a7_initfn(Object *obj)
     cpu->isar.id_isar3 = 0x11112131;
     cpu->isar.id_isar4 = 0x10011142;
     cpu->isar.dbgdidr = 0x3515f005;
+    cpu->isar.dbgdevid = 0x01110f13;
+    cpu->isar.dbgdevid1 = 0x1;
     cpu->clidr = 0x0a200023;
     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
@@ -XXX,XX +XXX,XX @@ static void cortex_a15_initfn(Object *obj)
     cpu->isar.id_isar3 = 0x11112131;
     cpu->isar.id_isar4 = 0x10011142;
     cpu->isar.dbgdidr = 0x3515f021;
+    cpu->isar.dbgdevid = 0x01110f13;
+    cpu->isar.dbgdevid1 = 0x0;
     cpu->clidr = 0x0a200023;
     cpu->ccsidr[0] = 0x701fe00a; /* 32K L1 dcache */
     cpu->ccsidr[1] = 0x201fe00a; /* 32K L1 icache */
@@ -XXX,XX +XXX,XX @@ static void arm_max_initfn(Object *obj)
     cpu->isar.id_isar5 = 0x00011121;
     cpu->isar.id_isar6 = 0;
     cpu->isar.dbgdidr = 0x3516d000;
+    cpu->isar.dbgdevid = 0x00110f13;
+    cpu->isar.dbgdevid1 = 0x2;
     cpu->isar.reset_pmcr_el0 = 0x41013000;
     cpu->clidr = 0x0a200023;
     cpu->ccsidr[0] = 0x701fe00a; /* 32KB L1 dcache */
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ void define_debug_regs(ARMCPU *cpu)
         define_one_arm_cp_reg(cpu, &dbgdidr);
     }
 
+    /*
+     * DBGDEVID is present in the v7 debug architecture if
+     * DBGDIDR.DEVID_imp is 1 (bit 15); from v7.1 and on it is
+     * mandatory (and bit 15 is RES1). DBGDEVID1 and DBGDEVID2 exist
+     * from v7.1 of the debug architecture. Because no fields have yet
+     * been defined in DBGDEVID2 (and quite possibly none will ever
+     * be) we don't define an ARMISARegisters field for it.
+     * These registers exist only if EL1 can use AArch32, but that
+     * happens naturally because they are only PL1 accessible anyway.
+     */
+    if (extract32(cpu->isar.dbgdidr, 15, 1)) {
+        ARMCPRegInfo dbgdevid = {
+            .name = "DBGDEVID",
+            .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 2, .crn = 7,
+            .access = PL1_R, .accessfn = access_tda,
+            .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid,
+        };
+        define_one_arm_cp_reg(cpu, &dbgdevid);
+    }
+    if (cpu_isar_feature(aa32_debugv7p1, cpu)) {
+        ARMCPRegInfo dbgdevid12[] = {
+            {
+                .name = "DBGDEVID1",
+                .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 1, .crn = 7,
+                .access = PL1_R, .accessfn = access_tda,
+                .type = ARM_CP_CONST, .resetvalue = cpu->isar.dbgdevid1,
+            }, {
+                .name = "DBGDEVID2",
+                .cp = 14, .opc1 = 0, .crn = 7, .opc2 = 0, .crn = 7,
+                .access = PL1_R, .accessfn = access_tda,
+                .type = ARM_CP_CONST, .resetvalue = 0,
+            },
+        };
+        define_arm_cp_regs(cpu, dbgdevid12);
+    }
+
     brps = arm_num_brps(cpu);
     wrps = arm_num_wrps(cpu);
     ctx_cmps = arm_num_ctx_cmps(cpu);
-- 
2.25.1

The architecture defines the OS DoubleLock as a register which
(similarly to the OS Lock) suppresses debug events for use in CPU
powerdown sequences.  This functionality is required in Arm v7 and
v8.0; from v8.2 it becomes optional and in v9 it must not be
implemented.

Currently in QEMU we implement the OSDLR_EL1 register as a NOP.  This
is wrong both for the "feature implemented" and the "feature not
implemented" cases: if the feature is implemented then the DLK bit
should read as written and cause suppression of debug exceptions, and
if it is not implemented then the bit must be RAZ/WI.

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu.h          | 20 ++++++++++++++++++++
 target/arm/debug_helper.c | 20 ++++++++++++++++++--
 2 files changed, 38 insertions(+), 2 deletions(-)

diff --git a/target/arm/cpu.h b/target/arm/cpu.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu.h
+++ b/target/arm/cpu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CPUArchState {
         uint64_t dbgwcr[16]; /* watchpoint control registers */
         uint64_t mdscr_el1;
         uint64_t oslsr_el1; /* OS Lock Status */
+        uint64_t osdlr_el1; /* OS DoubleLock status */
         uint64_t mdcr_el2;
         uint64_t mdcr_el3;
         /* Stores the architectural value of the counter *the last time it was
@@ -XXX,XX +XXX,XX @@ FIELD(DBGDIDR, CTX_CMPS, 20, 4)
 FIELD(DBGDIDR, BRPS, 24, 4)
 FIELD(DBGDIDR, WRPS, 28, 4)
 
+FIELD(DBGDEVID, PCSAMPLE, 0, 4)
+FIELD(DBGDEVID, WPADDRMASK, 4, 4)
+FIELD(DBGDEVID, BPADDRMASK, 8, 4)
+FIELD(DBGDEVID, VECTORCATCH, 12, 4)
+FIELD(DBGDEVID, VIRTEXTNS, 16, 4)
+FIELD(DBGDEVID, DOUBLELOCK, 20, 4)
+FIELD(DBGDEVID, AUXREGS, 24, 4)
+FIELD(DBGDEVID, CIDMASK, 28, 4)
+
 FIELD(MVFR0, SIMDREG, 0, 4)
 FIELD(MVFR0, FPSP, 4, 4)
 FIELD(MVFR0, FPDP, 8, 4)
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa32_debugv8p2(const ARMISARegisters *id)
     return FIELD_EX32(id->id_dfr0, ID_DFR0, COPDBG) >= 8;
 }
 
+static inline bool isar_feature_aa32_doublelock(const ARMISARegisters *id)
+{
+    return FIELD_EX32(id->dbgdevid, DBGDEVID, DOUBLELOCK) > 0;
+}
+
 /*
  * 64-bit feature tests via id registers.
  */
@@ -XXX,XX +XXX,XX @@ static inline bool isar_feature_aa64_sme_fa64(const ARMISARegisters *id)
     return FIELD_EX64(id->id_aa64smfr0, ID_AA64SMFR0, FA64);
 }
 
+static inline bool isar_feature_aa64_doublelock(const ARMISARegisters *id)
+{
+    return FIELD_SEX64(id->id_aa64dfr0, ID_AA64DFR0, DOUBLELOCK) >= 0;
+}
+
 /*
  * Feature tests for "does this exist in either 32-bit or 64-bit?"
  */
diff --git a/target/arm/debug_helper.c b/target/arm/debug_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/debug_helper.c
+++ b/target/arm/debug_helper.c
@@ -XXX,XX +XXX,XX @@ static bool aa32_generate_debug_exceptions(CPUARMState *env)
  */
 bool arm_generate_debug_exceptions(CPUARMState *env)
 {
-    if (env->cp15.oslsr_el1 & 1) {
+    if ((env->cp15.oslsr_el1 & 1) || (env->cp15.osdlr_el1 & 1)) {
         return false;
     }
     if (is_a64(env)) {
@@ -XXX,XX +XXX,XX @@ static void oslar_write(CPUARMState *env, const ARMCPRegInfo *ri,
     env->cp15.oslsr_el1 = deposit32(env->cp15.oslsr_el1, 1, 1, oslock);
 }
 
+static void osdlr_write(CPUARMState *env, const ARMCPRegInfo *ri,
+                        uint64_t value)
+{
+    ARMCPU *cpu = env_archcpu(env);
+    /*
+     * Only defined bit is bit 0 (DLK); if Feat_DoubleLock is not
+     * implemented this is RAZ/WI.
+     */
+    if(arm_feature(env, ARM_FEATURE_AARCH64)
+       ? cpu_isar_feature(aa64_doublelock, cpu)
+       : cpu_isar_feature(aa32_doublelock, cpu)) {
+        env->cp15.osdlr_el1 = value & 1;
+    }
+}
+
 static const ARMCPRegInfo debug_cp_reginfo[] = {
     /*
      * DBGDRAR, DBGDSAR: always RAZ since we don't implement memory mapped
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo debug_cp_reginfo[] = {
     { .name = "OSDLR_EL1", .state = ARM_CP_STATE_BOTH,
       .cp = 14, .opc0 = 2, .opc1 = 0, .crn = 1, .crm = 3, .opc2 = 4,
       .access = PL1_RW, .accessfn = access_tdosa,
-      .type = ARM_CP_NOP },
+      .writefn = osdlr_write,
+      .fieldoffset = offsetof(CPUARMState, cp15.osdlr_el1) },
     /*
      * Dummy DBGVCR: Linux wants to clear this on startup, but we don't
      * implement vector catch debug events yet.
-- 
2.25.1

In commit 39a1fd25287f5d we fixed a bug in the handling of LPAE block
descriptors where we weren't correctly zeroing out some RES0 bits.
However this fix has a bug because the calculation of the mask is
done at the wrong width: in
  descaddr &= ~(page_size - 1);
page_size is a target_ulong, so in the 'qemu-system-arm' binary it is
only 32 bits, and the effect is that we always zero out the top 32
bits of the calculated address.  Fix the calculation by forcing the
mask to be calculated with the same type as descaddr.

This only affects 32-bit CPUs which support LPAE (e.g. cortex-a15)
when used on board models which put RAM or devices above the 4GB
mark and when the 'qemu-system-arm' executable is being used.
It was also masked in 7.0 by the main bug reported in
https://gitlab.com/qemu-project/qemu/-/issues/1078 where the
virt board incorrectly does not enable 'highmem' for 32-bit CPUs.

The workaround is to use 'qemu-system-aarch64' with the same
command line.

Reported-by: He Zhe <zhe.he@windriver.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220627134620.3190252-1-peter.maydell@linaro.org
Fixes: 39a1fd25287f5de ("target/arm: Fix handling of LPAE block descriptors")
Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,
          * clear the lower bits here before ORing in the low vaddr bits.
          */
         page_size = (1ULL << ((stride * (4 - level)) + 3));
-        descaddr &= ~(page_size - 1);
+        descaddr &= ~(hwaddr)(page_size - 1);
         descaddr |= (address & (page_size - 1));
         /* Extract attributes from the descriptor */
         attrs = extract64(descriptor, 2, 10)
-- 
2.25.1