Series comparison

-[PULL 0/4] target-arm queue
+[PULL 0/7] target-arm queue
-Arm patches for rc3 : just a handful of bug fixes.
+It's been quiet on the arm front this week, so all I have is
 these coverity fixes I posted a while back...
-thanks
 -- PMM
+The following changes since commit 853546f8128476eefb701d4a55b2781bb3a46faa:
-The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:
+  Merge tag 'pull-loongarch-20240322' of https://gitlab.com/gaosong/qemu into staging (2024-03-22 10:59:57 +0000)
   Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240325
-for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:
+for you to fetch changes up to 55c79639d553c1b7a82b4cde781ad5f316f45b0e:
-  target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)
+  tests/qtest/libqtest.c: Check for g_setenv() failure (2024-03-25 10:41:01 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * handle FTYPE flag correctly in v7M exception return
+ * Fixes for seven minor coverity issues
    for v7M CPUs with an FPU (v8M CPUs were already correct)
  * versal: Add the CRP as unimplemented
  * Fix ISR_EL1 tracking when executing at EL2
  * Honor HCR_EL2.TID3 trapping requirements
 ----------------------------------------------------------------
-Edgar E. Iglesias (1):
+Peter Maydell (7):
-      hw/arm: versal: Add the CRP as unimplemented
+      tests/qtest/npcm7xx_emc_test: Don't leak cmd_line
       tests/unit/socket-helpers: Don't close(-1)
       net/af-xdp.c: Don't leak sock_fds array in net_init_af_xdp()
       hw/misc/pca9554: Correct error check bounds in get/set pin functions
       hw/nvram/mac_nvram: Report failure to write data
       tests/unit/test-throttle: Avoid unintended integer division
       tests/qtest/libqtest.c: Check for g_setenv() failure
-Jean-Hugues Deschênes (1):
+ hw/misc/pca9554.c              | 4 ++--
-      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
+ hw/nvram/mac_nvram.c           | 5 ++++-
+ net/af-xdp.c                   | 3 +--
-Marc Zyngier (2):
+ tests/qtest/libqtest.c         | 6 +++++-
-      target/arm: Fix ISR_EL1 tracking when executing at EL2
+ tests/qtest/npcm7xx_emc-test.c | 4 ++--
-      target/arm: Honor HCR_EL2.TID3 trapping requirements
+ tests/unit/socket-helpers.c    | 4 +++-
+ tests/unit/test-throttle.c     | 4 ++--
- include/hw/arm/xlnx-versal.h |  3 ++
+files changed, 19 insertions(+), 11 deletions(-)
  hw/arm/xlnx-versal.c         |  2 ++
  target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
  target/arm/m_helper.c        |  7 ++--
 files changed, 89 insertions(+), 6 deletions(-)

-New patch
+[PULL 1/7] tests/qtest/npcm7xx_emc_test: Don't leak cmd_line
+In test_rx() and test_tx() we allocate a GString *cmd_line
+but never free it. This is pretty harmless in a test case, but
+Coverity spotted it.
+Resolves: Coverity CID 1507122
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20240312183810.557768-2-peter.maydell@linaro.org
+---
+ tests/qtest/npcm7xx_emc-test.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/tests/qtest/npcm7xx_emc-test.c b/tests/qtest/npcm7xx_emc-test.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/npcm7xx_emc-test.c
++++ b/tests/qtest/npcm7xx_emc-test.c
+@@ -XXX,XX +XXX,XX @@ static void emc_test_ptle(QTestState *qts, const EMCModule *mod, int fd)
+ static void test_tx(gconstpointer test_data)
+ {
+     const TestData *td = test_data;
+-    GString *cmd_line = g_string_new("-machine quanta-gsj");
++    g_autoptr(GString) cmd_line = g_string_new("-machine quanta-gsj");
+     int *test_sockets = packet_test_init(emc_module_index(td->module),
+                                          cmd_line);
+     QTestState *qts = qtest_init(cmd_line->str);
+@@ -XXX,XX +XXX,XX @@ static void test_tx(gconstpointer test_data)
+ static void test_rx(gconstpointer test_data)
+ {
+     const TestData *td = test_data;
+-    GString *cmd_line = g_string_new("-machine quanta-gsj");
++    g_autoptr(GString) cmd_line = g_string_new("-machine quanta-gsj");
+     int *test_sockets = packet_test_init(emc_module_index(td->module),
+                                          cmd_line);
+     QTestState *qts = qtest_init(cmd_line->str);
+--
+.34.1

-New patch
+[PULL 2/7] tests/unit/socket-helpers: Don't close(-1)
+In socket_check_afunix_support() we call socket(PF_UNIX, SOCK_STREAM, 0)
+to see if it works, but we call close() on the result whether it
+worked or not. Only close the fd if the socket() call succeeded.
+Spotted by Coverity.
+Resolves: Coverity CID 1497481
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20240312183810.557768-3-peter.maydell@linaro.org
+---
+ tests/unit/socket-helpers.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/tests/unit/socket-helpers.c b/tests/unit/socket-helpers.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/unit/socket-helpers.c
++++ b/tests/unit/socket-helpers.c
+@@ -XXX,XX +XXX,XX @@ void socket_check_afunix_support(bool *has_afunix)
+     int fd;
+     fd = socket(PF_UNIX, SOCK_STREAM, 0);
+-    close(fd);
+ #ifdef _WIN32
+     *has_afunix = (fd != (int)INVALID_SOCKET);
+@@ -XXX,XX +XXX,XX @@ void socket_check_afunix_support(bool *has_afunix)
+     *has_afunix = (fd >= 0);
+ #endif
++    if (*has_afunix) {
++        close(fd);
++    }
+     return;
+ }
+--
+.34.1

-[PULL 1/4] target/arm: Fix handling of cortex-m FTYPE flag in EXCRET
+[PULL 3/7] net/af-xdp.c: Don't leak sock_fds array in net_init_af_xdp()
-From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>
+In net_init_af_xdp() we parse the arguments and allocate
 a buffer of ints into sock_fds. However, although we
 free this in the error exit path, we don't ever free it
 in the successful return path. Coverity spots this leak.
-According to the PushStack() pseudocode in the armv7m RM,
+Switch to g_autofree so we don't need to manually free the
-bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
+array.
 an FPU is present. Current implementation is doing it for
 armv8, but not for armv7. This patch makes the existing
 logic applicable to both code paths.
-Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
+Resolves: Coverity CID 1534906
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20240312183810.557768-4-peter.maydell@linaro.org
 ---
- target/arm/m_helper.c | 7 +++----
+ net/af-xdp.c | 3 +--
-file changed, 3 insertions(+), 4 deletions(-)
+file changed, 1 insertion(+), 2 deletions(-)
-diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
+diff --git a/net/af-xdp.c b/net/af-xdp.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/m_helper.c
+--- a/net/af-xdp.c
-+++ b/target/arm/m_helper.c
++++ b/net/af-xdp.c
-@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
+@@ -XXX,XX +XXX,XX @@ int net_init_af_xdp(const Netdev *netdev,
-         if (env->v7m.secure) {
+     NetClientState *nc, *nc0 = NULL;
-             lr |= R_V7M_EXCRET_S_MASK;
+     unsigned int ifindex;
-         }
+     uint32_t prog_id = 0;
--        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
+-    int *sock_fds = NULL;
--            lr |= R_V7M_EXCRET_FTYPE_MASK;
++    g_autofree int *sock_fds = NULL;
--        }
+     int64_t i, queues;
-     } else {
+     Error *err = NULL;
-         lr = R_V7M_EXCRET_RES1_MASK |
+     AFXDPState *s;
-             R_V7M_EXCRET_S_MASK |
+@@ -XXX,XX +XXX,XX @@ int net_init_af_xdp(const Netdev *netdev,
-             R_V7M_EXCRET_DCRS_MASK |
+     return 0;
--            R_V7M_EXCRET_FTYPE_MASK |
-             R_V7M_EXCRET_ES_MASK;
+ err:
-         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
+-    g_free(sock_fds);
-             lr |= R_V7M_EXCRET_SPSEL_MASK;
+     if (nc0) {
-         }
+         qemu_del_net_client(nc0);
      }
 +    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
 +        lr |= R_V7M_EXCRET_FTYPE_MASK;
 +    }
      if (!arm_v7m_is_handler_mode(env)) {
          lr |= R_V7M_EXCRET_MODE_MASK;
      }
 --
-.20.1
+.34.1

-New patch
+[PULL 4/7] hw/misc/pca9554: Correct error check bounds in get/set pin functions
+In pca9554_get_pin() and pca9554_set_pin(), we try to detect an
+incorrect pin value, but we get the condition wrong, using ">"
+when ">=" was intended.
+This has no actual effect, because in pca9554_initfn() we
+use the correct test when creating the properties and so
+we'll never be called with an out of range value. However,
+Coverity complains about the mismatch between the check and
+the later use of the pin value in a shift operation.
+Use the correct condition.
+Resolves: Coverity CID 1534917
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20240312183810.557768-5-peter.maydell@linaro.org
+---
+ hw/misc/pca9554.c | 4 ++--
+file changed, 2 insertions(+), 2 deletions(-)
+diff --git a/hw/misc/pca9554.c b/hw/misc/pca9554.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/misc/pca9554.c
++++ b/hw/misc/pca9554.c
+@@ -XXX,XX +XXX,XX @@ static void pca9554_get_pin(Object *obj, Visitor *v, const char *name,
+         error_setg(errp, "%s: error reading %s", __func__, name);
+         return;
+     }
+-    if (pin < 0 || pin > PCA9554_PIN_COUNT) {
++    if (pin < 0 || pin >= PCA9554_PIN_COUNT) {
+         error_setg(errp, "%s invalid pin %s", __func__, name);
+         return;
+     }
+@@ -XXX,XX +XXX,XX @@ static void pca9554_set_pin(Object *obj, Visitor *v, const char *name,
+         error_setg(errp, "%s: error reading %s", __func__, name);
+         return;
+     }
+-    if (pin < 0 || pin > PCA9554_PIN_COUNT) {
++    if (pin < 0 || pin >= PCA9554_PIN_COUNT) {
+         error_setg(errp, "%s invalid pin %s", __func__, name);
+         return;
+     }
+--
+.34.1

-[PULL 4/4] target/arm: Honor HCR_EL2.TID3 trapping requirements
+[PULL 5/7] hw/nvram/mac_nvram: Report failure to write data
-From: Marc Zyngier <maz@kernel.org>
+There's no way for the macio_nvram device to report failure to write
 data, but we can at least report it to the user with error_report()
 as we do in other devices like xlnx-efuse.
-HCR_EL2.TID3 mandates that access from EL1 to a long list of id
+Spotted by Coverity.
 registers traps to EL2, and QEMU has so far ignored this requirement.
-This breaks (among other things) KVM guests that have PtrAuth enabled,
+Resolves: Coverity CID 1507628
-while the hypervisor doesn't want to expose the feature to its guest.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-case), and masks out the unsupported feature.
+Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20240312183810.557768-6-peter.maydell@linaro.org
 ---
  hw/nvram/mac_nvram.c | 5 ++++-
 file changed, 4 insertions(+), 1 deletion(-)
-QEMU not honoring the trap request means that the guest observes
+diff --git a/hw/nvram/mac_nvram.c b/hw/nvram/mac_nvram.c
 that the feature is present in the HW, starts using it, and dies
 a horrible death when KVM injects an UNDEF, because the feature
 *really* isn't supported.
 Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.
 Note that this change does not include trapping of the MVFR
 registers from AArch32 (they are accessed via the VMRS
 instruction and need to be handled in a different way).
 Reported-by: Will Deacon <will@kernel.org>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Tested-by: Will Deacon <will@kernel.org>
 Message-id: 20191123115618.29230-1-maz@kernel.org
 [PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
  changed names of access functions to include _tid3]
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
 file changed, 76 insertions(+)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/nvram/mac_nvram.c
-+++ b/target/arm/helper.c
++++ b/hw/nvram/mac_nvram.c
-@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
+@@ -XXX,XX +XXX,XX @@ static void macio_nvram_writeb(void *opaque, hwaddr addr,
-     REGINFO_SENTINEL
+     trace_macio_nvram_write(addr, value);
- };
+     s->data[addr] = value;
+     if (s->blk) {
-+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+-        blk_pwrite(s->blk, addr, 1, &s->data[addr], 0);
-+                                       bool isread)
++        if (blk_pwrite(s->blk, addr, 1, &s->data[addr], 0) < 0) {
-+{
++            error_report("%s: write of NVRAM data to backing store failed",
-+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
++                         blk_name(s->blk));
-+        return CP_ACCESS_TRAP_EL2;
++        }
-+    }
+     }
-+
+ }
-+    return CP_ACCESS_OK;
 +}
 +
 +static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
 +                                       bool isread)
 +{
 +    if (arm_feature(env, ARM_FEATURE_V8)) {
 +        return access_aa64_tid3(env, ri, isread);
 +    }
 +
 +    return CP_ACCESS_OK;
 +}
 +
  void register_cp_regs_for_features(ARMCPU *cpu)
  {
      /* Register all the coprocessor registers based on feature bits */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_pfr0 },
              /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
               * the value of the GIC field until after we define these regs.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_NO_RAW,
 +              .accessfn = access_aa32_tid3,
                .readfn = id_pfr1_read,
                .writefn = arm_cp_write_ignore },
              { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_dfr0 },
              { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_afr0 },
              { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr0 },
              { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr1 },
              { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr2 },
              { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr3 },
              { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar0 },
              { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar1 },
              { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar2 },
              { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar3 },
              { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar4 },
              { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar5 },
              { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->id_mmfr4 },
              { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa32_tid3,
                .resetvalue = cpu->isar.id_isar6 },
              REGINFO_SENTINEL
          };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
              { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_NO_RAW,
 +              .accessfn = access_aa64_tid3,
                .readfn = id_aa64pfr0_read,
                .writefn = arm_cp_write_ignore },
              { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64pfr1},
              { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                /* At present, only SVEver == 0 is defined anyway.  */
                .resetvalue = 0 },
              { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr0 },
              { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64dfr1 },
              { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr0 },
              { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->id_aa64afr1 },
              { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar0 },
              { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64isar1 },
              { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr0 },
              { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.id_aa64mmfr1 },
              { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr0 },
              { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr1 },
              { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = cpu->isar.mvfr2 },
              { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
                .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
                .access = PL1_R, .type = ARM_CP_CONST,
 +              .accessfn = access_aa64_tid3,
                .resetvalue = 0 },
              { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
                .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
 --
-.20.1
+.34.1

-[PULL 3/4] target/arm: Fix ISR_EL1 tracking when executing at EL2
+[PULL 6/7] tests/unit/test-throttle: Avoid unintended integer division
-From: Marc Zyngier <maz@kernel.org>
+In test_compute_wait() we do
  double units = bkt.max / 10;
 which does an integer division and then assigns it to a double variable,
 and similarly later on in the expression for an assertion.
-The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
+Use 10.0 so that we do a floating point division and calculate the
-ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
+exact value, rather than doing an integer division.
 SError interrupts.
-Unfortunately, QEMU's implementation only considers the HCR_EL2
+Spotted by Coverity.
 bits, and ignores the current exception level. This means a hypervisor
 trying to look at its own interrupt state actually sees the guest
 state, which is unexpected and breaks KVM as of Linux 5.3.
-Instead, check for the running EL and return the physical bits
+Resolves: Coverity CID 1432564
-if not running in a virtualized context.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20240312183810.557768-7-peter.maydell@linaro.org
 ---
  tests/unit/test-throttle.c | 4 ++--
 file changed, 2 insertions(+), 2 deletions(-)
-Fixes: 636540e9c40b
+diff --git a/tests/unit/test-throttle.c b/tests/unit/test-throttle.c
 Cc: qemu-stable@nongnu.org
 Reported-by: Quentin Perret <qperret@google.com>
 Signed-off-by: Marc Zyngier <maz@kernel.org>
 Message-id: 20191122135833.28953-1-maz@kernel.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  target/arm/helper.c | 7 +++++--
 file changed, 5 insertions(+), 2 deletions(-)
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/tests/unit/test-throttle.c
-+++ b/target/arm/helper.c
++++ b/tests/unit/test-throttle.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+@@ -XXX,XX +XXX,XX @@ static void test_compute_wait(void)
-     CPUState *cs = env_cpu(env);
+     bkt.avg = 10;
-     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
+     bkt.max = 200;
-     uint64_t ret = 0;
+     for (i = 0; i < 22; i++) {
-+    bool allow_virt = (arm_current_el(env) == 1 &&
+-        double units = bkt.max / 10;
-+                       (!arm_is_secure_below_el3(env) ||
++        double units = bkt.max / 10.0;
-+                        (env->cp15.scr_el3 & SCR_EEL2)));
+         bkt.level += units;
+         bkt.burst_level += units;
--    if (hcr_el2 & HCR_IMO) {
+         throttle_leak_bucket(&bkt, NANOSECONDS_PER_SECOND / 10);
-+    if (allow_virt && (hcr_el2 & HCR_IMO)) {
+         wait = throttle_compute_wait(&bkt);
-         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
+         g_assert(double_cmp(bkt.burst_level, 0));
-             ret |= CPSR_I;
+-        g_assert(double_cmp(bkt.level, (i + 1) * (bkt.max - bkt.avg) / 10));
-         }
++        g_assert(double_cmp(bkt.level, (i + 1) * (bkt.max - bkt.avg) / 10.0));
-@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
+         /* We can do bursts for the 2 seconds we have configured in
-         }
+          * burst_length. We have 100 extra milliseconds of burst
-     }
+          * because bkt.level has been leaking during this time.
 -    if (hcr_el2 & HCR_FMO) {
 +    if (allow_virt && (hcr_el2 & HCR_FMO)) {
          if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
              ret |= CPSR_F;
          }
 --
-.20.1
+.34.1

-[PULL 2/4] hw/arm: versal: Add the CRP as unimplemented
+[PULL 7/7] tests/qtest/libqtest.c: Check for g_setenv() failure
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+Coverity points out that g_setenv() can fail and we don't
 check for this in qtest_inproc_init(). In practice this will
 only fail if a memory allocation failed in setenv() or if
 the caller passed an invalid architecture name (e.g. one
 with an '=' in it), so rather than requiring the callsite
 to check for failure, make g_setenv() failure fatal here,
 similarly to what we did in commit aca68d95c515.
-Add the CRP as unimplemented thus avoiding bus errors when
+Resolves: Coverity CID 1497485
-guests access these registers.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20240312183810.557768-8-peter.maydell@linaro.org
 ---
  tests/qtest/libqtest.c | 6 +++++-
 file changed, 5 insertions(+), 1 deletion(-)
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Luc Michel <luc.michel@greensocs.com>
 Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/arm/xlnx-versal.h | 3 +++
  hw/arm/xlnx-versal.c         | 2 ++
 files changed, 5 insertions(+)
 diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/xlnx-versal.h
+--- a/tests/qtest/libqtest.c
-+++ b/include/hw/arm/xlnx-versal.h
++++ b/tests/qtest/libqtest.c
-@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
+@@ -XXX,XX +XXX,XX @@ QTestState *qtest_inproc_init(QTestState **s, bool log, const char* arch,
- #define MM_IOU_SCNTRS_SIZE          0x10000
+      * way, qtest_get_arch works for inproc qtest.
- #define MM_FPD_CRF                  0xfd1a0000U
+      */
- #define MM_FPD_CRF_SIZE             0x140000
+     gchar *bin_path = g_strconcat("/qemu-system-", arch, NULL);
-+
+-    g_setenv("QTEST_QEMU_BINARY", bin_path, 0);
-+#define MM_PMC_CRP                  0xf1260000U
++    if (!g_setenv("QTEST_QEMU_BINARY", bin_path, 0)) {
-+#define MM_PMC_CRP_SIZE             0x10000
++        fprintf(stderr,
- #endif
++                "Could not set environment variable QTEST_QEMU_BINARY\n");
-diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
++        exit(1);
-index XXXXXXX..XXXXXXX 100644
++    }
---- a/hw/arm/xlnx-versal.c
+     g_free(bin_path);
-+++ b/hw/arm/xlnx-versal.c
-@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
+     return qts;
                          MM_CRL, MM_CRL_SIZE);
      versal_unimp_area(s, "crf", &s->mr_ps,
                          MM_FPD_CRF, MM_FPD_CRF_SIZE);
 +    versal_unimp_area(s, "crp", &s->mr_ps,
 +                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
      versal_unimp_area(s, "iou-scntr", &s->mr_ps,
                          MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
      versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
 --
-.20.1
+.34.1

Arm patches for rc3 : just a handful of bug fixes.

thanks
-- PMM

The following changes since commit 4ecc984210ca1bf508a96a550ec8a93a5f833f6c:

Merge remote-tracking branch 'remotes/palmer/tags/riscv-for-master-4.2-rc3' into staging (2019-11-26 12:36:40 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20191126

for you to fetch changes up to 6a4ef4e5d1084ce41fafa7d470a644b0fd3d9317:

target/arm: Honor HCR_EL2.TID3 trapping requirements (2019-11-26 13:55:37 +0000)

----------------------------------------------------------------
target-arm queue:
 * handle FTYPE flag correctly in v7M exception return
   for v7M CPUs with an FPU (v8M CPUs were already correct)
 * versal: Add the CRP as unimplemented
 * Fix ISR_EL1 tracking when executing at EL2
 * Honor HCR_EL2.TID3 trapping requirements

----------------------------------------------------------------
Edgar E. Iglesias (1):
      hw/arm: versal: Add the CRP as unimplemented

Jean-Hugues Deschênes (1):
      target/arm: Fix handling of cortex-m FTYPE flag in EXCRET

Marc Zyngier (2):
      target/arm: Fix ISR_EL1 tracking when executing at EL2
      target/arm: Honor HCR_EL2.TID3 trapping requirements

include/hw/arm/xlnx-versal.h |  3 ++
 hw/arm/xlnx-versal.c         |  2 ++
 target/arm/helper.c          | 83 ++++++++++++++++++++++++++++++++++++++++++--
 target/arm/m_helper.c        |  7 ++--
 4 files changed, 89 insertions(+), 6 deletions(-)

From: Jean-Hugues Deschênes <Jean-Hugues.Deschenes@ossiaco.com>

According to the PushStack() pseudocode in the armv7m RM,
bit 4 of the LR should be set to NOT(CONTROL.PFCA) when
an FPU is present. Current implementation is doing it for
armv8, but not for armv7. This patch makes the existing
logic applicable to both code paths.

Signed-off-by: Jean-Hugues Deschenes <jean-hugues.deschenes@ossiaco.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/m_helper.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/target/arm/m_helper.c b/target/arm/m_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/m_helper.c
+++ b/target/arm/m_helper.c
@@ -XXX,XX +XXX,XX @@ void arm_v7m_cpu_do_interrupt(CPUState *cs)
         if (env->v7m.secure) {
             lr |= R_V7M_EXCRET_S_MASK;
         }
-        if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
-            lr |= R_V7M_EXCRET_FTYPE_MASK;
-        }
     } else {
         lr = R_V7M_EXCRET_RES1_MASK |
             R_V7M_EXCRET_S_MASK |
             R_V7M_EXCRET_DCRS_MASK |
-            R_V7M_EXCRET_FTYPE_MASK |
             R_V7M_EXCRET_ES_MASK;
         if (env->v7m.control[M_REG_NS] & R_V7M_CONTROL_SPSEL_MASK) {
             lr |= R_V7M_EXCRET_SPSEL_MASK;
         }
     }
+    if (!(env->v7m.control[M_REG_S] & R_V7M_CONTROL_FPCA_MASK)) {
+        lr |= R_V7M_EXCRET_FTYPE_MASK;
+    }
     if (!arm_v7m_is_handler_mode(env)) {
         lr |= R_V7M_EXCRET_MODE_MASK;
     }
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Add the CRP as unimplemented thus avoiding bus errors when
guests access these registers.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Luc Michel <luc.michel@greensocs.com>
Message-id: 20191115154734.26449-2-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/xlnx-versal.h | 3 +++
 hw/arm/xlnx-versal.c         | 2 ++
 2 files changed, 5 insertions(+)

diff --git a/include/hw/arm/xlnx-versal.h b/include/hw/arm/xlnx-versal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/xlnx-versal.h
+++ b/include/hw/arm/xlnx-versal.h
@@ -XXX,XX +XXX,XX @@ typedef struct Versal {
 #define MM_IOU_SCNTRS_SIZE          0x10000
 #define MM_FPD_CRF                  0xfd1a0000U
 #define MM_FPD_CRF_SIZE             0x140000
+
+#define MM_PMC_CRP                  0xf1260000U
+#define MM_PMC_CRP_SIZE             0x10000
 #endif
diff --git a/hw/arm/xlnx-versal.c b/hw/arm/xlnx-versal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/xlnx-versal.c
+++ b/hw/arm/xlnx-versal.c
@@ -XXX,XX +XXX,XX @@ static void versal_unimp(Versal *s)
                         MM_CRL, MM_CRL_SIZE);
     versal_unimp_area(s, "crf", &s->mr_ps,
                         MM_FPD_CRF, MM_FPD_CRF_SIZE);
+    versal_unimp_area(s, "crp", &s->mr_ps,
+                        MM_PMC_CRP, MM_PMC_CRP_SIZE);
     versal_unimp_area(s, "iou-scntr", &s->mr_ps,
                         MM_IOU_SCNTR, MM_IOU_SCNTR_SIZE);
     versal_unimp_area(s, "iou-scntr-seucre", &s->mr_ps,
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

The ARMv8 ARM states when executing at EL2, EL3 or Secure EL1,
ISR_EL1 shows the pending status of the physical IRQ, FIQ, or
SError interrupts.

Unfortunately, QEMU's implementation only considers the HCR_EL2
bits, and ignores the current exception level. This means a hypervisor
trying to look at its own interrupt state actually sees the guest
state, which is unexpected and breaks KVM as of Linux 5.3.

Instead, check for the running EL and return the physical bits
if not running in a virtualized context.

Fixes: 636540e9c40b
Cc: qemu-stable@nongnu.org
Reported-by: Quentin Perret <qperret@google.com>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Message-id: 20191122135833.28953-1-maz@kernel.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
     CPUState *cs = env_cpu(env);
     uint64_t hcr_el2 = arm_hcr_el2_eff(env);
     uint64_t ret = 0;
+    bool allow_virt = (arm_current_el(env) == 1 &&
+                       (!arm_is_secure_below_el3(env) ||
+                        (env->cp15.scr_el3 & SCR_EEL2)));
 
-    if (hcr_el2 & HCR_IMO) {
+    if (allow_virt && (hcr_el2 & HCR_IMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VIRQ) {
             ret |= CPSR_I;
         }
@@ -XXX,XX +XXX,XX @@ static uint64_t isr_read(CPUARMState *env, const ARMCPRegInfo *ri)
         }
     }
 
-    if (hcr_el2 & HCR_FMO) {
+    if (allow_virt && (hcr_el2 & HCR_FMO)) {
         if (cs->interrupt_request & CPU_INTERRUPT_VFIQ) {
             ret |= CPSR_F;
         }
-- 
2.20.1

From: Marc Zyngier <maz@kernel.org>

HCR_EL2.TID3 mandates that access from EL1 to a long list of id
registers traps to EL2, and QEMU has so far ignored this requirement.

This breaks (among other things) KVM guests that have PtrAuth enabled,
while the hypervisor doesn't want to expose the feature to its guest.
To achieve this, KVM traps the ID registers (ID_AA64ISAR1_EL1 in this
case), and masks out the unsupported feature.

QEMU not honoring the trap request means that the guest observes
that the feature is present in the HW, starts using it, and dies
a horrible death when KVM injects an UNDEF, because the feature
*really* isn't supported.

Do the right thing by trapping to EL2 if HCR_EL2.TID3 is set.

Note that this change does not include trapping of the MVFR
registers from AArch32 (they are accessed via the VMRS
instruction and need to be handled in a different way).

Reported-by: Will Deacon <will@kernel.org>
Signed-off-by: Marc Zyngier <maz@kernel.org>
Tested-by: Will Deacon <will@kernel.org>
Message-id: 20191123115618.29230-1-maz@kernel.org
[PMM: added missing accessfn line for ID_AA4PFR2_EL1_RESERVED;
 changed names of access functions to include _tid3]
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 76 +++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 76 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static const ARMCPRegInfo predinv_reginfo[] = {
     REGINFO_SENTINEL
 };
 
+static CPAccessResult access_aa64_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if ((arm_current_el(env) < 2) && (arm_hcr_el2_eff(env) & HCR_TID3)) {
+        return CP_ACCESS_TRAP_EL2;
+    }
+
+    return CP_ACCESS_OK;
+}
+
+static CPAccessResult access_aa32_tid3(CPUARMState *env, const ARMCPRegInfo *ri,
+                                       bool isread)
+{
+    if (arm_feature(env, ARM_FEATURE_V8)) {
+        return access_aa64_tid3(env, ri, isread);
+    }
+
+    return CP_ACCESS_OK;
+}
+
 void register_cp_regs_for_features(ARMCPU *cpu)
 {
     /* Register all the coprocessor registers based on feature bits */
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_pfr0 },
             /* ID_PFR1 is not a plain ARM_CP_CONST because we don't know
              * the value of the GIC field until after we define these regs.
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_PFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa32_tid3,
               .readfn = id_pfr1_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_DFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_dfr0 },
             { .name = "ID_AFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_afr0 },
             { .name = "ID_MMFR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr0 },
             { .name = "ID_MMFR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr1 },
             { .name = "ID_MMFR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr2 },
             { .name = "ID_MMFR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 1, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr3 },
             { .name = "ID_ISAR0", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar0 },
             { .name = "ID_ISAR1", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar1 },
             { .name = "ID_ISAR2", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar2 },
             { .name = "ID_ISAR3", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar3 },
             { .name = "ID_ISAR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar4 },
             { .name = "ID_ISAR5", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar5 },
             { .name = "ID_MMFR4", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->id_mmfr4 },
             { .name = "ID_ISAR6", .state = ARM_CP_STATE_BOTH,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 2, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa32_tid3,
               .resetvalue = cpu->isar.id_isar6 },
             REGINFO_SENTINEL
         };
@@ -XXX,XX +XXX,XX @@ void register_cp_regs_for_features(ARMCPU *cpu)
             { .name = "ID_AA64PFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_NO_RAW,
+              .accessfn = access_aa64_tid3,
               .readfn = id_aa64pfr0_read,
               .writefn = arm_cp_write_ignore },
             { .name = "ID_AA64PFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64pfr1},
             { .name = "ID_AA64PFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ZFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               /* At present, only SVEver == 0 is defined anyway.  */
               .resetvalue = 0 },
             { .name = "ID_AA64PFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64PFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 4, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr0 },
             { .name = "ID_AA64DFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64dfr1 },
             { .name = "ID_AA64DFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64DFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr0 },
             { .name = "ID_AA64AFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->id_aa64afr1 },
             { .name = "ID_AA64AFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64AFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 5, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar0 },
             { .name = "ID_AA64ISAR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64isar1 },
             { .name = "ID_AA64ISAR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64ISAR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 6, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr0 },
             { .name = "ID_AA64MMFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.id_aa64mmfr1 },
             { .name = "ID_AA64MMFR2_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "ID_AA64MMFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 7, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR0_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 0,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr0 },
             { .name = "MVFR1_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 1,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr1 },
             { .name = "MVFR2_EL1", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 2,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = cpu->isar.mvfr2 },
             { .name = "MVFR3_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 3,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR4_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 4,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR5_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 5,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR6_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 6,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "MVFR7_EL1_RESERVED", .state = ARM_CP_STATE_AA64,
               .opc0 = 3, .opc1 = 0, .crn = 0, .crm = 3, .opc2 = 7,
               .access = PL1_R, .type = ARM_CP_CONST,
+              .accessfn = access_aa64_tid3,
               .resetvalue = 0 },
             { .name = "PMCEID0", .state = ARM_CP_STATE_AA32,
               .cp = 15, .opc1 = 0, .crn = 9, .crm = 12, .opc2 = 6,
-- 
2.20.1

It's been quiet on the arm front this week, so all I have is
these coverity fixes I posted a while back...

-- PMM

The following changes since commit 853546f8128476eefb701d4a55b2781bb3a46faa:

Merge tag 'pull-loongarch-20240322' of https://gitlab.com/gaosong/qemu into staging (2024-03-22 10:59:57 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20240325

for you to fetch changes up to 55c79639d553c1b7a82b4cde781ad5f316f45b0e:

tests/qtest/libqtest.c: Check for g_setenv() failure (2024-03-25 10:41:01 +0000)

----------------------------------------------------------------
target-arm queue:
 * Fixes for seven minor coverity issues

----------------------------------------------------------------
Peter Maydell (7):
      tests/qtest/npcm7xx_emc_test: Don't leak cmd_line
      tests/unit/socket-helpers: Don't close(-1)
      net/af-xdp.c: Don't leak sock_fds array in net_init_af_xdp()
      hw/misc/pca9554: Correct error check bounds in get/set pin functions
      hw/nvram/mac_nvram: Report failure to write data
      tests/unit/test-throttle: Avoid unintended integer division
      tests/qtest/libqtest.c: Check for g_setenv() failure

In test_rx() and test_tx() we allocate a GString *cmd_line
but never free it. This is pretty harmless in a test case, but
Coverity spotted it.

Resolves: Coverity CID 1507122
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240312183810.557768-2-peter.maydell@linaro.org
---
 tests/qtest/npcm7xx_emc-test.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/qtest/npcm7xx_emc-test.c b/tests/qtest/npcm7xx_emc-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_emc-test.c
+++ b/tests/qtest/npcm7xx_emc-test.c
@@ -XXX,XX +XXX,XX @@ static void emc_test_ptle(QTestState *qts, const EMCModule *mod, int fd)
 static void test_tx(gconstpointer test_data)
 {
     const TestData *td = test_data;
-    GString *cmd_line = g_string_new("-machine quanta-gsj");
+    g_autoptr(GString) cmd_line = g_string_new("-machine quanta-gsj");
     int *test_sockets = packet_test_init(emc_module_index(td->module),
                                          cmd_line);
     QTestState *qts = qtest_init(cmd_line->str);
@@ -XXX,XX +XXX,XX @@ static void test_tx(gconstpointer test_data)
 static void test_rx(gconstpointer test_data)
 {
     const TestData *td = test_data;
-    GString *cmd_line = g_string_new("-machine quanta-gsj");
+    g_autoptr(GString) cmd_line = g_string_new("-machine quanta-gsj");
     int *test_sockets = packet_test_init(emc_module_index(td->module),
                                          cmd_line);
     QTestState *qts = qtest_init(cmd_line->str);
-- 
2.34.1

In socket_check_afunix_support() we call socket(PF_UNIX, SOCK_STREAM, 0)
to see if it works, but we call close() on the result whether it
worked or not. Only close the fd if the socket() call succeeded.
Spotted by Coverity.

Resolves: Coverity CID 1497481

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240312183810.557768-3-peter.maydell@linaro.org
---
 tests/unit/socket-helpers.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tests/unit/socket-helpers.c b/tests/unit/socket-helpers.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/unit/socket-helpers.c
+++ b/tests/unit/socket-helpers.c
@@ -XXX,XX +XXX,XX @@ void socket_check_afunix_support(bool *has_afunix)
     int fd;
 
     fd = socket(PF_UNIX, SOCK_STREAM, 0);
-    close(fd);
 
 #ifdef _WIN32
     *has_afunix = (fd != (int)INVALID_SOCKET);
@@ -XXX,XX +XXX,XX @@ void socket_check_afunix_support(bool *has_afunix)
     *has_afunix = (fd >= 0);
 #endif
 
+    if (*has_afunix) {
+        close(fd);
+    }
     return;
 }
-- 
2.34.1

In net_init_af_xdp() we parse the arguments and allocate
a buffer of ints into sock_fds. However, although we
free this in the error exit path, we don't ever free it
in the successful return path. Coverity spots this leak.

Switch to g_autofree so we don't need to manually free the
array.

Resolves: Coverity CID 1534906
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240312183810.557768-4-peter.maydell@linaro.org
---
 net/af-xdp.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/net/af-xdp.c b/net/af-xdp.c
index XXXXXXX..XXXXXXX 100644
--- a/net/af-xdp.c
+++ b/net/af-xdp.c
@@ -XXX,XX +XXX,XX @@ int net_init_af_xdp(const Netdev *netdev,
     NetClientState *nc, *nc0 = NULL;
     unsigned int ifindex;
     uint32_t prog_id = 0;
-    int *sock_fds = NULL;
+    g_autofree int *sock_fds = NULL;
     int64_t i, queues;
     Error *err = NULL;
     AFXDPState *s;
@@ -XXX,XX +XXX,XX @@ int net_init_af_xdp(const Netdev *netdev,
     return 0;
 
 err:
-    g_free(sock_fds);
     if (nc0) {
         qemu_del_net_client(nc0);
     }
-- 
2.34.1

In pca9554_get_pin() and pca9554_set_pin(), we try to detect an
incorrect pin value, but we get the condition wrong, using ">"
when ">=" was intended.

This has no actual effect, because in pca9554_initfn() we
use the correct test when creating the properties and so
we'll never be called with an out of range value. However,
Coverity complains about the mismatch between the check and
the later use of the pin value in a shift operation.

Use the correct condition.

Resolves: Coverity CID 1534917
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20240312183810.557768-5-peter.maydell@linaro.org
---
 hw/misc/pca9554.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/misc/pca9554.c b/hw/misc/pca9554.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/pca9554.c
+++ b/hw/misc/pca9554.c
@@ -XXX,XX +XXX,XX @@ static void pca9554_get_pin(Object *obj, Visitor *v, const char *name,
         error_setg(errp, "%s: error reading %s", __func__, name);
         return;
     }
-    if (pin < 0 || pin > PCA9554_PIN_COUNT) {
+    if (pin < 0 || pin >= PCA9554_PIN_COUNT) {
         error_setg(errp, "%s invalid pin %s", __func__, name);
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void pca9554_set_pin(Object *obj, Visitor *v, const char *name,
         error_setg(errp, "%s: error reading %s", __func__, name);
         return;
     }
-    if (pin < 0 || pin > PCA9554_PIN_COUNT) {
+    if (pin < 0 || pin >= PCA9554_PIN_COUNT) {
         error_setg(errp, "%s invalid pin %s", __func__, name);
         return;
     }
-- 
2.34.1

There's no way for the macio_nvram device to report failure to write
data, but we can at least report it to the user with error_report()
as we do in other devices like xlnx-efuse.

Spotted by Coverity.

Resolves: Coverity CID 1507628
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240312183810.557768-6-peter.maydell@linaro.org
---
 hw/nvram/mac_nvram.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/hw/nvram/mac_nvram.c b/hw/nvram/mac_nvram.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/mac_nvram.c
+++ b/hw/nvram/mac_nvram.c
@@ -XXX,XX +XXX,XX @@ static void macio_nvram_writeb(void *opaque, hwaddr addr,
     trace_macio_nvram_write(addr, value);
     s->data[addr] = value;
     if (s->blk) {
-        blk_pwrite(s->blk, addr, 1, &s->data[addr], 0);
+        if (blk_pwrite(s->blk, addr, 1, &s->data[addr], 0) < 0) {
+            error_report("%s: write of NVRAM data to backing store failed",
+                         blk_name(s->blk));
+        }
     }
 }
 
-- 
2.34.1

In test_compute_wait() we do
 double units = bkt.max / 10;
which does an integer division and then assigns it to a double variable,
and similarly later on in the expression for an assertion.

Use 10.0 so that we do a floating point division and calculate the
exact value, rather than doing an integer division.

Spotted by Coverity.

Resolves: Coverity CID 1432564
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240312183810.557768-7-peter.maydell@linaro.org
---
 tests/unit/test-throttle.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tests/unit/test-throttle.c b/tests/unit/test-throttle.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/unit/test-throttle.c
+++ b/tests/unit/test-throttle.c
@@ -XXX,XX +XXX,XX @@ static void test_compute_wait(void)
     bkt.avg = 10;
     bkt.max = 200;
     for (i = 0; i < 22; i++) {
-        double units = bkt.max / 10;
+        double units = bkt.max / 10.0;
         bkt.level += units;
         bkt.burst_level += units;
         throttle_leak_bucket(&bkt, NANOSECONDS_PER_SECOND / 10);
         wait = throttle_compute_wait(&bkt);
         g_assert(double_cmp(bkt.burst_level, 0));
-        g_assert(double_cmp(bkt.level, (i + 1) * (bkt.max - bkt.avg) / 10));
+        g_assert(double_cmp(bkt.level, (i + 1) * (bkt.max - bkt.avg) / 10.0));
         /* We can do bursts for the 2 seconds we have configured in
          * burst_length. We have 100 extra milliseconds of burst
          * because bkt.level has been leaking during this time.
-- 
2.34.1

Coverity points out that g_setenv() can fail and we don't
check for this in qtest_inproc_init(). In practice this will
only fail if a memory allocation failed in setenv() or if
the caller passed an invalid architecture name (e.g. one
with an '=' in it), so rather than requiring the callsite
to check for failure, make g_setenv() failure fatal here,
similarly to what we did in commit aca68d95c515.

Resolves: Coverity CID 1497485
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Message-id: 20240312183810.557768-8-peter.maydell@linaro.org
---
 tests/qtest/libqtest.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/tests/qtest/libqtest.c b/tests/qtest/libqtest.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/libqtest.c
+++ b/tests/qtest/libqtest.c
@@ -XXX,XX +XXX,XX @@ QTestState *qtest_inproc_init(QTestState **s, bool log, const char* arch,
      * way, qtest_get_arch works for inproc qtest.
      */
     gchar *bin_path = g_strconcat("/qemu-system-", arch, NULL);
-    g_setenv("QTEST_QEMU_BINARY", bin_path, 0);
+    if (!g_setenv("QTEST_QEMU_BINARY", bin_path, 0)) {
+        fprintf(stderr,
+                "Could not set environment variable QTEST_QEMU_BINARY\n");
+        exit(1);
+    }
     g_free(bin_path);
 
     return qts;
-- 
2.34.1