Series comparison

-[PULL 00/11] target-arm queue
+[PULL 0/3] target-arm queue
-A collection of bug fixes for rc2...
+Only thing for Arm for rc1 is RTH's fix for the KVM SVE probe code.
-The following changes since commit 146aa0f104bb3bf88e43c4082a0bfc4bbda4fbd8:
+-- PMM
-  Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging (2020-04-03 15:30:11 +0100)
+The following changes since commit 4e06b3fc1b5e1ec03f22190eabe56891dc9c2236:
   Merge tag 'pull-hex-20220731' of https://github.com/quic/qemu into staging (2022-07-31 21:38:54 -0700)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200406
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220801
-for you to fetch changes up to 8893790966d9c964557ad01be4a68ef50696ace8:
+for you to fetch changes up to 5265d24c981dfdda8d29b44f7e84a514da75eedc:
-  dma/xlnx-zdma: Reorg to fix CUR_DSCR (2020-04-06 10:59:56 +0100)
+  target/arm: Move sve probe inside kvm >= 4.15 branch (2022-08-01 16:21:18 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * don't expose "ieee_half" via gdbstub (prevents gdb crashes or errors
+ * Fix KVM SVE ID register probe code
    with older GDB versions)
  * hw/arm/collie: Put StrongARMState* into a CollieMachineState struct
  * PSTATE.PAN should not clear exec bits
  * hw/gpio/aspeed_gpio.c: Don't directly include assert.h
    (fixes compilation on some Windows build scenarios)
  * dump: Fix writing of ELF section
  * dma/xlnx-zdma: various bug fixes
  * target/arm/helperc. delete obsolete TODO comment
 ----------------------------------------------------------------
-Alex Bennée (1):
+Richard Henderson (3):
-      target/arm: don't expose "ieee_half" via gdbstub
+      target/arm: Use kvm_arm_sve_supported in kvm_arm_get_host_cpu_features
       target/arm: Set KVM_ARM_VCPU_SVE while probing the host
       target/arm: Move sve probe inside kvm >= 4.15 branch
-Edgar E. Iglesias (5):
+ target/arm/kvm64.c | 45 ++++++++++++++++++++++-----------------------
-      dma/xlnx-zdma: Remove comment
+file changed, 22 insertions(+), 23 deletions(-)
       dma/xlnx-zdma: Populate DBG0.CMN_BUF_FREE
       dma/xlnx-zdma: Clear DMA_DONE when halting
       dma/xlnx-zdma: Advance the descriptor address when stopping
       dma/xlnx-zdma: Reorg to fix CUR_DSCR
 Peter Maydell (5):
       hw/arm/collie: Put StrongARMState* into a CollieMachineState struct
       target/arm: PSTATE.PAN should not clear exec bits
       target/arm: Remove obsolete TODO note from get_phys_addr_lpae()
       hw/gpio/aspeed_gpio.c: Don't directly include assert.h
       dump: Fix writing of ELF section
  dump/dump.c           |  2 +-
  hw/arm/collie.c       | 33 +++++++++++++++++++++++++-----
  hw/dma/xlnx-zdma.c    | 56 ++++++++++++++++++++++++++-------------------------
  hw/gpio/aspeed_gpio.c |  2 --
  target/arm/gdbstub.c  |  7 ++++++-
  target/arm/helper.c   | 13 +++++-------
 files changed, 69 insertions(+), 44 deletions(-)

-[PULL 01/11] target/arm: don't expose "ieee_half" via gdbstub
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-While support for parsing ieee_half in the XML description was added
-to gdb in 2019 (a6d0f249) there is no easy way for the gdbstub to know
-if the gdb end will understand it. Disable it for now and allow older
-gdbs to successfully connect to the default -cpu max SVE enabled
-QEMUs.
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200402143913.24005-1-alex.bennee@linaro.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/gdbstub.c | 7 ++++++-
-file changed, 6 insertions(+), 1 deletion(-)
-diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/gdbstub.c
-+++ b/target/arm/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static const struct TypeSize vec_lanes[] = {
-     /* 16 bit */
-     { "uint16", 16, 'h', 'u' },
-     { "int16", 16, 'h', 's' },
--    { "ieee_half", 16, 'h', 'f' },
-+    /*
-+     * TODO: currently there is no reliable way of telling
-+     * if the remote gdb actually understands ieee_half so
-+     * we don't expose it in the target description for now.
-+     * { "ieee_half", 16, 'h', 'f' },
-+     */
-     /* bytes */
-     { "uint8", 8, 'b', 'u' },
-     { "int8", 8, 'b', 's' },
---
-.20.1

-[PULL 02/11] hw/arm/collie: Put StrongARMState* into a CollieMachineState struct
+Deleted patch
-Coverity complains that the collie_init() function leaks the memory
-allocated in sa1110_init().  This is true but not significant since
-the function is called only once on machine init and the memory must
-remain in existence until QEMU exits anyway.
-Still, we can avoid the technical memory leak by keeping the pointer
-to the StrongARMState inside the machine state struct.  Switch from
-the simple DEFINE_MACHINE() style to defining a subclass of
-TYPE_MACHINE which extends the MachineState struct, and keep the
-pointer there.
-Fixes: CID 1421921
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20200326204919.22006-1-peter.maydell@linaro.org
----
- hw/arm/collie.c | 33 ++++++++++++++++++++++++++++-----
-file changed, 28 insertions(+), 5 deletions(-)
-diff --git a/hw/arm/collie.c b/hw/arm/collie.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/collie.c
-+++ b/hw/arm/collie.c
-@@ -XXX,XX +XXX,XX @@
- #include "exec/address-spaces.h"
- #include "cpu.h"
-+typedef struct {
-+    MachineState parent;
-+
-+    StrongARMState *sa1110;
-+} CollieMachineState;
-+
-+#define TYPE_COLLIE_MACHINE MACHINE_TYPE_NAME("collie")
-+#define COLLIE_MACHINE(obj) \
-+    OBJECT_CHECK(CollieMachineState, obj, TYPE_COLLIE_MACHINE)
-+
- static struct arm_boot_info collie_binfo = {
-     .loader_start = SA_SDCS0,
-     .ram_size = 0x20000000,
-@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info collie_binfo = {
- static void collie_init(MachineState *machine)
- {
--    StrongARMState *s;
-     DriveInfo *dinfo;
-     MachineClass *mc = MACHINE_GET_CLASS(machine);
-+    CollieMachineState *cms = COLLIE_MACHINE(machine);
-     if (machine->ram_size != mc->default_ram_size) {
-         char *sz = size_to_str(mc->default_ram_size);
-@@ -XXX,XX +XXX,XX @@ static void collie_init(MachineState *machine)
-         exit(EXIT_FAILURE);
-     }
--    s = sa1110_init(machine->cpu_type);
-+    cms->sa1110 = sa1110_init(machine->cpu_type);
-     memory_region_add_subregion(get_system_memory(), SA_SDCS0, machine->ram);
-@@ -XXX,XX +XXX,XX @@ static void collie_init(MachineState *machine)
-     sysbus_create_simple("scoop", 0x40800000, NULL);
-     collie_binfo.board_id = 0x208;
--    arm_load_kernel(s->cpu, machine, &collie_binfo);
-+    arm_load_kernel(cms->sa1110->cpu, machine, &collie_binfo);
- }
--static void collie_machine_init(MachineClass *mc)
-+static void collie_machine_class_init(ObjectClass *oc, void *data)
- {
-+    MachineClass *mc = MACHINE_CLASS(oc);
-+
-     mc->desc = "Sharp SL-5500 (Collie) PDA (SA-1110)";
-     mc->init = collie_init;
-     mc->ignore_memory_transaction_failures = true;
-@@ -XXX,XX +XXX,XX @@ static void collie_machine_init(MachineClass *mc)
-     mc->default_ram_id = "strongarm.sdram";
- }
--DEFINE_MACHINE("collie", collie_machine_init)
-+static const TypeInfo collie_machine_typeinfo = {
-+    .name = TYPE_COLLIE_MACHINE,
-+    .parent = TYPE_MACHINE,
-+    .class_init = collie_machine_class_init,
-+    .instance_size = sizeof(CollieMachineState),
-+};
-+
-+static void collie_machine_register_types(void)
-+{
-+    type_register_static(&collie_machine_typeinfo);
-+}
-+type_init(collie_machine_register_types);
---
-.20.1

-[PULL 03/11] target/arm: PSTATE.PAN should not clear exec bits
+Deleted patch
-Our implementation of the PSTATE.PAN bit incorrectly cleared all
-access permission bits for privileged access to memory which is
-user-accessible.  It should only affect the privileged read and write
-permissions; execute permission is dealt with via XN/PXN instead.
-Fixes: 81636b70c226dc27d7ebc8d
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200330170651.20901-1-peter.maydell@linaro.org
----
- target/arm/helper.c | 6 ++++--
-file changed, 4 insertions(+), 2 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
-         prot_rw = user_rw;
-     } else {
-         if (user_rw && regime_is_pan(env, mmu_idx)) {
--            return 0;
-+            /* PAN forbids data accesses but doesn't affect insn fetch */
-+            prot_rw = 0;
-+        } else {
-+            prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
-         }
--        prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
-     }
-     if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
---
-.20.1

-[PULL 04/11] target/arm: Remove obsolete TODO note from get_phys_addr_lpae()
+Deleted patch
-An old comment in get_phys_addr_lpae() claims that the code does not
-support the different format TCR for VTCR_EL2.  This used to be true
-but it is not true now (in particular the aa64_va_parameters() and
-aa32_va_parameters() functions correctly handle the different
-register format by checking whether the mmu_idx is Stage2).
-Remove the out of date parts of the comment.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20200331143407.3186-1-peter.maydell@linaro.org
----
- target/arm/helper.c | 7 +------
-file changed, 1 insertion(+), 6 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
-+++ b/target/arm/helper.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
-     bool aarch64 = arm_el_is_aa64(env, el);
-     bool guarded = false;
--    /* TODO:
--     * This code does not handle the different format TCR for VTCR_EL2.
--     * This code also does not support shareability levels.
--     * Attribute and permission bit handling should also be checked when adding
--     * support for those page table walks.
--     */
-+    /* TODO: This code does not support shareability levels. */
-     if (aarch64) {
-         param = aa64_va_parameters(env, address, mmu_idx,
-                                    access_type != MMU_INST_FETCH);
---
-.20.1

-[PULL 05/11] hw/gpio/aspeed_gpio.c: Don't directly include assert.h
+Deleted patch
-Remove a direct include of assert.h -- this is already
-provided by qemu/osdep.h, and it breaks our rule that the
-first include must always be osdep.h.
-In particular we must get the assert() macro via osdep.h
-to avoid compile failures on mingw (see the comment in
-osdep.h where we redefine assert() for that platform).
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Message-id: 20200403124712.24826-1-peter.maydell@linaro.org
----
- hw/gpio/aspeed_gpio.c | 2 --
-file changed, 2 deletions(-)
-diff --git a/hw/gpio/aspeed_gpio.c b/hw/gpio/aspeed_gpio.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/gpio/aspeed_gpio.c
-+++ b/hw/gpio/aspeed_gpio.c
-@@ -XXX,XX +XXX,XX @@
-  * SPDX-License-Identifier: GPL-2.0-or-later
-  */
--#include <assert.h>
--
- #include "qemu/osdep.h"
- #include "qemu/host-utils.h"
- #include "qemu/log.h"
---
-.20.1

-[PULL 06/11] dump: Fix writing of ELF section
+Deleted patch
-In write_elf_section() we set the 'shdr' pointer to point to local
-structures shdr32 or shdr64, which we fill in to be written out to
-the ELF dump.  Unfortunately the address we pass to fd_write_vmcore()
-has a spurious '&' operator, so instead of writing out the section
-header we write out the literal pointer value followed by whatever is
-on the stack after the 'shdr' local variable.
-Pass the correct address into fd_write_vmcore().
-Spotted by Coverity: CID 1421970.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20200324173630.12221-1-peter.maydell@linaro.org
----
- dump/dump.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/dump/dump.c b/dump/dump.c
-index XXXXXXX..XXXXXXX 100644
---- a/dump/dump.c
-+++ b/dump/dump.c
-@@ -XXX,XX +XXX,XX @@ static void write_elf_section(DumpState *s, int type, Error **errp)
-         shdr = &shdr64;
-     }
--    ret = fd_write_vmcore(&shdr, shdr_size, s);
-+    ret = fd_write_vmcore(shdr, shdr_size, s);
-     if (ret < 0) {
-         error_setg_errno(errp, -ret,
-                          "dump: failed to write section header table");
---
-.20.1

-[PULL 10/11] dma/xlnx-zdma: Advance the descriptor address when stopping
+[PULL 1/3] target/arm: Use kvm_arm_sve_supported in kvm_arm_get_host_cpu_features
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Advance the descriptor address when stopping the channel.
+Indication for support for SVE will not depend on whether we
 perform the query on the main kvm_state or the temp vcpu.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Message-id: 20220726045828.53697-2-richard.henderson@linaro.org
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20200402134721.27863-5-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/dma/xlnx-zdma.c | 1 -
+ target/arm/kvm64.c | 2 +-
-file changed, 1 deletion(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xlnx-zdma.c
+--- a/target/arm/kvm64.c
-+++ b/hw/dma/xlnx-zdma.c
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ static void zdma_process_descr(XlnxZDMA *s)
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-     if (ptype == PT_REG || src_cmd == CMD_STOP) {
+         }
          ARRAY_FIELD_DP32(s->regs, ZDMA_CH_CTRL2, EN, 0);
          zdma_set_state(s, DISABLED);
 -        return;
      }
-     if (src_cmd == CMD_HALT) {
+-    sve_supported = ioctl(fdarray[0], KVM_CHECK_EXTENSION, KVM_CAP_ARM_SVE) > 0;
 +    sve_supported = kvm_arm_sve_supported();
      /* Add feature bits that can't appear until after VCPU init. */
      if (sve_supported) {
 --
-.20.1
+.25.1

-[PULL 11/11] dma/xlnx-zdma: Reorg to fix CUR_DSCR
+[PULL 2/3] target/arm: Set KVM_ARM_VCPU_SVE while probing the host
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Reorganize the descriptor handling so that CUR_DSCR always
+Because we weren't setting this flag, our probe of ID_AA64ZFR0
-points to the next descriptor to be processed.
+was always returning zero.  This also obviates the adjustment
 of ID_AA64PFR0, which had sanitized the SVE field.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+The effects of the bug are not visible, because the only thing that
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+ID_AA64ZFR0 is used for within qemu at present is tcg translation.
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+The other tests for SVE within KVM are via ID_AA64PFR0.SVE.
-Message-id: 20200402134721.27863-6-edgar.iglesias@gmail.com
 Reported-by: Zenghui Yu <yuzenghui@huawei.com>
 Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20220726045828.53697-3-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/dma/xlnx-zdma.c | 47 ++++++++++++++++++++++------------------------
+ target/arm/kvm64.c | 27 +++++++++++++--------------
-file changed, 22 insertions(+), 25 deletions(-)
+file changed, 13 insertions(+), 14 deletions(-)
-diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xlnx-zdma.c
+--- a/target/arm/kvm64.c
-+++ b/hw/dma/xlnx-zdma.c
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ static void zdma_load_src_descriptor(XlnxZDMA *s)
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-     }
+     bool sve_supported;
- }
+     bool pmu_supported = false;
+     uint64_t features = 0;
-+static void zdma_update_descr_addr(XlnxZDMA *s, bool type,
+-    uint64_t t;
-+                                   unsigned int basereg)
+     int err;
-+{
-+    uint64_t addr, next;
+     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
-+
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-+    if (type == DTYPE_LINEAR) {
+     struct kvm_vcpu_init init = { .target = -1, };
-+        addr = zdma_get_regaddr64(s, basereg);
-+        next = addr + sizeof(s->dsc_dst);
+     /*
-+    } else {
+-     * Ask for Pointer Authentication if supported. We can't play the
-+        addr = zdma_get_regaddr64(s, basereg);
+-     * SVE trick of synthesising the ID reg as KVM won't tell us
-+        addr += sizeof(s->dsc_dst);
+-     * whether we have the architected or IMPDEF version of PAuth, so
-+        address_space_read(s->dma_as, addr, s->attr, (void *) &next, 8);
+-     * we have to use the actual ID regs.
 +     * Ask for SVE if supported, so that we can query ID_AA64ZFR0,
 +     * which is otherwise RAZ.
 +     */
 +    sve_supported = kvm_arm_sve_supported();
 +    if (sve_supported) {
 +        init.features[0] |= 1 << KVM_ARM_VCPU_SVE;
 +    }
 +
-+    zdma_put_regaddr64(s, basereg, next);
++    /*
-+}
++     * Ask for Pointer Authentication if supported, so that we get
-+
++     * the unsanitized field values for AA64ISAR1_EL1.
- static void zdma_load_dst_descriptor(XlnxZDMA *s)
+      */
- {
+     if (kvm_arm_pauth_supported()) {
-     uint64_t dst_addr;
+         init.features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS |
-     unsigned int ptype = ARRAY_FIELD_EX32(s->regs, ZDMA_CH_CTRL0, POINT_TYPE);
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-+    bool dst_type;
+         }
      if (ptype == PT_REG) {
          memcpy(&s->dsc_dst, &s->regs[R_ZDMA_CH_DST_DSCR_WORD0],
@@ -XXX,XX +XXX,XX @@ static void zdma_load_dst_descriptor(XlnxZDMA *s)
      if (!zdma_load_descriptor(s, dst_addr, &s->dsc_dst)) {
          ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, AXI_RD_DST_DSCR, true);
      }
--}
+-    sve_supported = kvm_arm_sve_supported();
 -static uint64_t zdma_update_descr_addr(XlnxZDMA *s, bool type,
 -                                       unsigned int basereg)
 -{
 -    uint64_t addr, next;
 -
--    if (type == DTYPE_LINEAR) {
+-    /* Add feature bits that can't appear until after VCPU init. */
--        next = zdma_get_regaddr64(s, basereg);
+     if (sve_supported) {
--        next += sizeof(s->dsc_dst);
+-        t = ahcf->isar.id_aa64pfr0;
--        zdma_put_regaddr64(s, basereg, next);
+-        t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
--    } else {
+-        ahcf->isar.id_aa64pfr0 = t;
 -        addr = zdma_get_regaddr64(s, basereg);
 -        addr += sizeof(s->dsc_dst);
 -        address_space_read(s->dma_as, addr, s->attr, &next, 8);
 -        zdma_put_regaddr64(s, basereg, next);
 -    }
 -    return next;
 +    /* Advance the descriptor pointer.  */
 +    dst_type = FIELD_EX32(s->dsc_dst.words[3], ZDMA_CH_DST_DSCR_WORD3, TYPE);
 +    zdma_update_descr_addr(s, dst_type, R_ZDMA_CH_DST_CUR_DSCR_LSB);
  }
  static void zdma_write_dst(XlnxZDMA *s, uint8_t *buf, uint32_t len)
@@ -XXX,XX +XXX,XX @@ static void zdma_write_dst(XlnxZDMA *s, uint8_t *buf, uint32_t len)
          dst_size = FIELD_EX32(s->dsc_dst.words[2], ZDMA_CH_DST_DSCR_WORD2,
                                SIZE);
          if (dst_size == 0 && ptype == PT_MEM) {
 -            uint64_t next;
 -            bool dst_type = FIELD_EX32(s->dsc_dst.words[3],
 -                                       ZDMA_CH_DST_DSCR_WORD3,
 -                                       TYPE);
 -
--            next = zdma_update_descr_addr(s, dst_type,
+         /*
--                                          R_ZDMA_CH_DST_CUR_DSCR_LSB);
+          * There is a range of kernels between kernel commit 73433762fcae
--            zdma_load_descriptor(s, next, &s->dsc_dst);
+          * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
-+            zdma_load_dst_descriptor(s);
+          * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
-             dst_size = FIELD_EX32(s->dsc_dst.words[2], ZDMA_CH_DST_DSCR_WORD2,
+-         * SVE support, so we only read it here, rather than together with all
-                                   SIZE);
+-         * the other ID registers earlier.
-         }
++         * SVE support, which resulted in an error rather than RAZ.
 +         * So only read the register if we set KVM_ARM_VCPU_SVE above.
           */
          err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
                                ARM64_SYS_REG(3, 0, 0, 4, 4));
 --
-.20.1
+.25.1

-[PULL 07/11] dma/xlnx-zdma: Remove comment
+[PULL 3/3] target/arm: Move sve probe inside kvm >= 4.15 branch
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
+From: Richard Henderson <richard.henderson@linaro.org>
-Remove comment.
+The test for the IF block indicates no ID registers are exposed, much
 less host support for SVE.  Move the SVE probe into the ELSE block.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Message-id: 20220726045828.53697-4-richard.henderson@linaro.org
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Message-id: 20200402134721.27863-2-edgar.iglesias@gmail.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/dma/xlnx-zdma.c | 1 -
+ target/arm/kvm64.c | 22 +++++++++++-----------
-file changed, 1 deletion(-)
+file changed, 11 insertions(+), 11 deletions(-)
-diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
+diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xlnx-zdma.c
+--- a/target/arm/kvm64.c
-+++ b/hw/dma/xlnx-zdma.c
++++ b/target/arm/kvm64.c
-@@ -XXX,XX +XXX,XX @@ static void zdma_process_descr(XlnxZDMA *s)
+@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
-         zdma_src_done(s);
+             err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
                                    ARM64_SYS_REG(3, 3, 9, 12, 0));
          }
 -    }
 -    if (sve_supported) {
 -        /*
 -         * There is a range of kernels between kernel commit 73433762fcae
 -         * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
 -         * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
 -         * SVE support, which resulted in an error rather than RAZ.
 -         * So only read the register if we set KVM_ARM_VCPU_SVE above.
 -         */
 -        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
 -                              ARM64_SYS_REG(3, 0, 0, 4, 4));
 +        if (sve_supported) {
 +            /*
 +             * There is a range of kernels between kernel commit 73433762fcae
 +             * and f81cb2c3ad41 which have a bug where the kernel doesn't
 +             * expose SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has
 +             * enabled SVE support, which resulted in an error rather than RAZ.
 +             * So only read the register if we set KVM_ARM_VCPU_SVE above.
 +             */
 +            err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
 +                                  ARM64_SYS_REG(3, 0, 0, 4, 4));
 +        }
      }
--    /* Load next descriptor.  */
+     kvm_arm_destroy_scratch_host_vcpu(fdarray);
      if (ptype == PT_REG || src_cmd == CMD_STOP) {
          ARRAY_FIELD_DP32(s->regs, ZDMA_CH_CTRL2, EN, 0);
          zdma_set_state(s, DISABLED);
 --
-.20.1
+.25.1

-[PULL 08/11] dma/xlnx-zdma: Populate DBG0.CMN_BUF_FREE
+Deleted patch
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-Populate DBG0.CMN_BUF_FREE so that SW can see some free space.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-Message-id: 20200402134721.27863-3-edgar.iglesias@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/dma/xlnx-zdma.c | 6 ++++++
-file changed, 6 insertions(+)
-diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xlnx-zdma.c
-+++ b/hw/dma/xlnx-zdma.c
-@@ -XXX,XX +XXX,XX @@ static RegisterAccessInfo zdma_regs_info[] = {
-     },{ .name = "ZDMA_CH_DBG0",  .addr = A_ZDMA_CH_DBG0,
-         .rsvd = 0xfffffe00,
-         .ro = 0x1ff,
-+
-+        /*
-+         * There's SW out there that will check the debug regs for free space.
-+         * Claim that we always have 0x100 free.
-+         */
-+        .reset = 0x100
-     },{ .name = "ZDMA_CH_DBG1",  .addr = A_ZDMA_CH_DBG1,
-         .rsvd = 0xfffffe00,
-         .ro = 0x1ff,
---
-.20.1

-[PULL 09/11] dma/xlnx-zdma: Clear DMA_DONE when halting
+Deleted patch
-From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>
-Clear DMA_DONE when halting the DMA channel.
-Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-Acked-by: Alistair Francis <alistair.francis@wdc.com>
-Message-id: 20200402134721.27863-4-edgar.iglesias@gmail.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/dma/xlnx-zdma.c | 1 +
-file changed, 1 insertion(+)
-diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/dma/xlnx-zdma.c
-+++ b/hw/dma/xlnx-zdma.c
-@@ -XXX,XX +XXX,XX @@ static void zdma_process_descr(XlnxZDMA *s)
-     if (src_cmd == CMD_HALT) {
-         zdma_set_state(s, PAUSED);
-         ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, DMA_PAUSE, 1);
-+        ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, DMA_DONE, false);
-         zdma_ch_imr_update_irq(s);
-         return;
-     }
---
-.20.1

A collection of bug fixes for rc2...

The following changes since commit 146aa0f104bb3bf88e43c4082a0bfc4bbda4fbd8:

Merge remote-tracking branch 'remotes/stefanha/tags/block-pull-request' into staging (2020-04-03 15:30:11 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20200406

for you to fetch changes up to 8893790966d9c964557ad01be4a68ef50696ace8:

dma/xlnx-zdma: Reorg to fix CUR_DSCR (2020-04-06 10:59:56 +0100)

----------------------------------------------------------------
target-arm queue:
 * don't expose "ieee_half" via gdbstub (prevents gdb crashes or errors
   with older GDB versions)
 * hw/arm/collie: Put StrongARMState* into a CollieMachineState struct
 * PSTATE.PAN should not clear exec bits
 * hw/gpio/aspeed_gpio.c: Don't directly include assert.h
   (fixes compilation on some Windows build scenarios)
 * dump: Fix writing of ELF section
 * dma/xlnx-zdma: various bug fixes
 * target/arm/helperc. delete obsolete TODO comment

----------------------------------------------------------------
Alex Bennée (1):
      target/arm: don't expose "ieee_half" via gdbstub

Edgar E. Iglesias (5):
      dma/xlnx-zdma: Remove comment
      dma/xlnx-zdma: Populate DBG0.CMN_BUF_FREE
      dma/xlnx-zdma: Clear DMA_DONE when halting
      dma/xlnx-zdma: Advance the descriptor address when stopping
      dma/xlnx-zdma: Reorg to fix CUR_DSCR

Peter Maydell (5):
      hw/arm/collie: Put StrongARMState* into a CollieMachineState struct
      target/arm: PSTATE.PAN should not clear exec bits
      target/arm: Remove obsolete TODO note from get_phys_addr_lpae()
      hw/gpio/aspeed_gpio.c: Don't directly include assert.h
      dump: Fix writing of ELF section

From: Alex Bennée <alex.bennee@linaro.org>

While support for parsing ieee_half in the XML description was added
to gdb in 2019 (a6d0f249) there is no easy way for the gdbstub to know
if the gdb end will understand it. Disable it for now and allow older
gdbs to successfully connect to the default -cpu max SVE enabled
QEMUs.

Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200402143913.24005-1-alex.bennee@linaro.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ static const struct TypeSize vec_lanes[] = {
     /* 16 bit */
     { "uint16", 16, 'h', 'u' },
     { "int16", 16, 'h', 's' },
-    { "ieee_half", 16, 'h', 'f' },
+    /*
+     * TODO: currently there is no reliable way of telling
+     * if the remote gdb actually understands ieee_half so
+     * we don't expose it in the target description for now.
+     * { "ieee_half", 16, 'h', 'f' },
+     */
     /* bytes */
     { "uint8", 8, 'b', 'u' },
     { "int8", 8, 'b', 's' },
-- 
2.20.1

Coverity complains that the collie_init() function leaks the memory
allocated in sa1110_init().  This is true but not significant since
the function is called only once on machine init and the memory must
remain in existence until QEMU exits anyway.

Still, we can avoid the technical memory leak by keeping the pointer
to the StrongARMState inside the machine state struct.  Switch from
the simple DEFINE_MACHINE() style to defining a subclass of
TYPE_MACHINE which extends the MachineState struct, and keep the
pointer there.

Fixes: CID 1421921
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200326204919.22006-1-peter.maydell@linaro.org
---
 hw/arm/collie.c | 33 ++++++++++++++++++++++++++++-----
 1 file changed, 28 insertions(+), 5 deletions(-)

diff --git a/hw/arm/collie.c b/hw/arm/collie.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/collie.c
+++ b/hw/arm/collie.c
@@ -XXX,XX +XXX,XX @@
 #include "exec/address-spaces.h"
 #include "cpu.h"
 
+typedef struct {
+    MachineState parent;
+
+    StrongARMState *sa1110;
+} CollieMachineState;
+
+#define TYPE_COLLIE_MACHINE MACHINE_TYPE_NAME("collie")
+#define COLLIE_MACHINE(obj) \
+    OBJECT_CHECK(CollieMachineState, obj, TYPE_COLLIE_MACHINE)
+
 static struct arm_boot_info collie_binfo = {
     .loader_start = SA_SDCS0,
     .ram_size = 0x20000000,
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info collie_binfo = {
 
 static void collie_init(MachineState *machine)
 {
-    StrongARMState *s;
     DriveInfo *dinfo;
     MachineClass *mc = MACHINE_GET_CLASS(machine);
+    CollieMachineState *cms = COLLIE_MACHINE(machine);
 
     if (machine->ram_size != mc->default_ram_size) {
         char *sz = size_to_str(mc->default_ram_size);
@@ -XXX,XX +XXX,XX @@ static void collie_init(MachineState *machine)
         exit(EXIT_FAILURE);
     }
 
-    s = sa1110_init(machine->cpu_type);
+    cms->sa1110 = sa1110_init(machine->cpu_type);
 
     memory_region_add_subregion(get_system_memory(), SA_SDCS0, machine->ram);
 
@@ -XXX,XX +XXX,XX @@ static void collie_init(MachineState *machine)
     sysbus_create_simple("scoop", 0x40800000, NULL);
 
     collie_binfo.board_id = 0x208;
-    arm_load_kernel(s->cpu, machine, &collie_binfo);
+    arm_load_kernel(cms->sa1110->cpu, machine, &collie_binfo);
 }
 
-static void collie_machine_init(MachineClass *mc)
+static void collie_machine_class_init(ObjectClass *oc, void *data)
 {
+    MachineClass *mc = MACHINE_CLASS(oc);
+
     mc->desc = "Sharp SL-5500 (Collie) PDA (SA-1110)";
     mc->init = collie_init;
     mc->ignore_memory_transaction_failures = true;
@@ -XXX,XX +XXX,XX @@ static void collie_machine_init(MachineClass *mc)
     mc->default_ram_id = "strongarm.sdram";
 }
 
-DEFINE_MACHINE("collie", collie_machine_init)
+static const TypeInfo collie_machine_typeinfo = {
+    .name = TYPE_COLLIE_MACHINE,
+    .parent = TYPE_MACHINE,
+    .class_init = collie_machine_class_init,
+    .instance_size = sizeof(CollieMachineState),
+};
+
+static void collie_machine_register_types(void)
+{
+    type_register_static(&collie_machine_typeinfo);
+}
+type_init(collie_machine_register_types);
-- 
2.20.1

Our implementation of the PSTATE.PAN bit incorrectly cleared all
access permission bits for privileged access to memory which is
user-accessible.  It should only affect the privileged read and write
permissions; execute permission is dealt with via XN/PXN instead.

Fixes: 81636b70c226dc27d7ebc8d
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200330170651.20901-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static int get_S1prot(CPUARMState *env, ARMMMUIdx mmu_idx, bool is_aa64,
         prot_rw = user_rw;
     } else {
         if (user_rw && regime_is_pan(env, mmu_idx)) {
-            return 0;
+            /* PAN forbids data accesses but doesn't affect insn fetch */
+            prot_rw = 0;
+        } else {
+            prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
         }
-        prot_rw = simple_ap_to_rw_prot_is_user(ap, false);
     }
 
     if (ns && arm_is_secure(env) && (env->cp15.scr_el3 & SCR_SIF)) {
-- 
2.20.1

An old comment in get_phys_addr_lpae() claims that the code does not
support the different format TCR for VTCR_EL2.  This used to be true
but it is not true now (in particular the aa64_va_parameters() and
aa32_va_parameters() functions correctly handle the different
register format by checking whether the mmu_idx is Stage2).
Remove the out of date parts of the comment.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20200331143407.3186-1-peter.maydell@linaro.org
---
 target/arm/helper.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,
     bool aarch64 = arm_el_is_aa64(env, el);
     bool guarded = false;
 
-    /* TODO:
-     * This code does not handle the different format TCR for VTCR_EL2.
-     * This code also does not support shareability levels.
-     * Attribute and permission bit handling should also be checked when adding
-     * support for those page table walks.
-     */
+    /* TODO: This code does not support shareability levels. */
     if (aarch64) {
         param = aa64_va_parameters(env, address, mmu_idx,
                                    access_type != MMU_INST_FETCH);
-- 
2.20.1

In write_elf_section() we set the 'shdr' pointer to point to local
structures shdr32 or shdr64, which we fill in to be written out to
the ELF dump.  Unfortunately the address we pass to fd_write_vmcore()
has a spurious '&' operator, so instead of writing out the section
header we write out the literal pointer value followed by whatever is
on the stack after the 'shdr' local variable.

Pass the correct address into fd_write_vmcore().

Spotted by Coverity: CID 1421970.

Cc: qemu-stable@nongnu.org
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200324173630.12221-1-peter.maydell@linaro.org
---
 dump/dump.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/dump/dump.c b/dump/dump.c
index XXXXXXX..XXXXXXX 100644
--- a/dump/dump.c
+++ b/dump/dump.c
@@ -XXX,XX +XXX,XX @@ static void write_elf_section(DumpState *s, int type, Error **errp)
         shdr = &shdr64;
     }
 
-    ret = fd_write_vmcore(&shdr, shdr_size, s);
+    ret = fd_write_vmcore(shdr, shdr_size, s);
     if (ret < 0) {
         error_setg_errno(errp, -ret,
                          "dump: failed to write section header table");
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Populate DBG0.CMN_BUF_FREE so that SW can see some free space.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20200402134721.27863-3-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/dma/xlnx-zdma.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xlnx-zdma.c
+++ b/hw/dma/xlnx-zdma.c
@@ -XXX,XX +XXX,XX @@ static RegisterAccessInfo zdma_regs_info[] = {
     },{ .name = "ZDMA_CH_DBG0",  .addr = A_ZDMA_CH_DBG0,
         .rsvd = 0xfffffe00,
         .ro = 0x1ff,
+
+        /*
+         * There's SW out there that will check the debug regs for free space.
+         * Claim that we always have 0x100 free.
+         */
+        .reset = 0x100
     },{ .name = "ZDMA_CH_DBG1",  .addr = A_ZDMA_CH_DBG1,
         .rsvd = 0xfffffe00,
         .ro = 0x1ff,
-- 
2.20.1

From: "Edgar E. Iglesias" <edgar.iglesias@xilinx.com>

Reorganize the descriptor handling so that CUR_DSCR always
points to the next descriptor to be processed.

Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Message-id: 20200402134721.27863-6-edgar.iglesias@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/dma/xlnx-zdma.c | 47 ++++++++++++++++++++++------------------------
 1 file changed, 22 insertions(+), 25 deletions(-)

diff --git a/hw/dma/xlnx-zdma.c b/hw/dma/xlnx-zdma.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/dma/xlnx-zdma.c
+++ b/hw/dma/xlnx-zdma.c
@@ -XXX,XX +XXX,XX @@ static void zdma_load_src_descriptor(XlnxZDMA *s)
     }
 }
 
+static void zdma_update_descr_addr(XlnxZDMA *s, bool type,
+                                   unsigned int basereg)
+{
+    uint64_t addr, next;
+
+    if (type == DTYPE_LINEAR) {
+        addr = zdma_get_regaddr64(s, basereg);
+        next = addr + sizeof(s->dsc_dst);
+    } else {
+        addr = zdma_get_regaddr64(s, basereg);
+        addr += sizeof(s->dsc_dst);
+        address_space_read(s->dma_as, addr, s->attr, (void *) &next, 8);
+    }
+
+    zdma_put_regaddr64(s, basereg, next);
+}
+
 static void zdma_load_dst_descriptor(XlnxZDMA *s)
 {
     uint64_t dst_addr;
     unsigned int ptype = ARRAY_FIELD_EX32(s->regs, ZDMA_CH_CTRL0, POINT_TYPE);
+    bool dst_type;
 
     if (ptype == PT_REG) {
         memcpy(&s->dsc_dst, &s->regs[R_ZDMA_CH_DST_DSCR_WORD0],
@@ -XXX,XX +XXX,XX @@ static void zdma_load_dst_descriptor(XlnxZDMA *s)
     if (!zdma_load_descriptor(s, dst_addr, &s->dsc_dst)) {
         ARRAY_FIELD_DP32(s->regs, ZDMA_CH_ISR, AXI_RD_DST_DSCR, true);
     }
-}
 
-static uint64_t zdma_update_descr_addr(XlnxZDMA *s, bool type,
-                                       unsigned int basereg)
-{
-    uint64_t addr, next;
-
-    if (type == DTYPE_LINEAR) {
-        next = zdma_get_regaddr64(s, basereg);
-        next += sizeof(s->dsc_dst);
-        zdma_put_regaddr64(s, basereg, next);
-    } else {
-        addr = zdma_get_regaddr64(s, basereg);
-        addr += sizeof(s->dsc_dst);
-        address_space_read(s->dma_as, addr, s->attr, &next, 8);
-        zdma_put_regaddr64(s, basereg, next);
-    }
-    return next;
+    /* Advance the descriptor pointer.  */
+    dst_type = FIELD_EX32(s->dsc_dst.words[3], ZDMA_CH_DST_DSCR_WORD3, TYPE);
+    zdma_update_descr_addr(s, dst_type, R_ZDMA_CH_DST_CUR_DSCR_LSB);
 }
 
 static void zdma_write_dst(XlnxZDMA *s, uint8_t *buf, uint32_t len)
@@ -XXX,XX +XXX,XX @@ static void zdma_write_dst(XlnxZDMA *s, uint8_t *buf, uint32_t len)
         dst_size = FIELD_EX32(s->dsc_dst.words[2], ZDMA_CH_DST_DSCR_WORD2,
                               SIZE);
         if (dst_size == 0 && ptype == PT_MEM) {
-            uint64_t next;
-            bool dst_type = FIELD_EX32(s->dsc_dst.words[3],
-                                       ZDMA_CH_DST_DSCR_WORD3,
-                                       TYPE);
-
-            next = zdma_update_descr_addr(s, dst_type,
-                                          R_ZDMA_CH_DST_CUR_DSCR_LSB);
-            zdma_load_descriptor(s, next, &s->dsc_dst);
+            zdma_load_dst_descriptor(s);
             dst_size = FIELD_EX32(s->dsc_dst.words[2], ZDMA_CH_DST_DSCR_WORD2,
                                   SIZE);
         }
-- 
2.20.1

Only thing for Arm for rc1 is RTH's fix for the KVM SVE probe code.

-- PMM

The following changes since commit 4e06b3fc1b5e1ec03f22190eabe56891dc9c2236:

Merge tag 'pull-hex-20220731' of https://github.com/quic/qemu into staging (2022-07-31 21:38:54 -0700)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220801

for you to fetch changes up to 5265d24c981dfdda8d29b44f7e84a514da75eedc:

target/arm: Move sve probe inside kvm >= 4.15 branch (2022-08-01 16:21:18 +0100)

----------------------------------------------------------------
target-arm queue:
 * Fix KVM SVE ID register probe code

----------------------------------------------------------------
Richard Henderson (3):
      target/arm: Use kvm_arm_sve_supported in kvm_arm_get_host_cpu_features
      target/arm: Set KVM_ARM_VCPU_SVE while probing the host
      target/arm: Move sve probe inside kvm >= 4.15 branch

target/arm/kvm64.c | 45 ++++++++++++++++++++++-----------------------
 1 file changed, 22 insertions(+), 23 deletions(-)

From: Richard Henderson <richard.henderson@linaro.org>

Because we weren't setting this flag, our probe of ID_AA64ZFR0
was always returning zero.  This also obviates the adjustment
of ID_AA64PFR0, which had sanitized the SVE field.

The effects of the bug are not visible, because the only thing that
ID_AA64ZFR0 is used for within qemu at present is tcg translation.
The other tests for SVE within KVM are via ID_AA64PFR0.SVE.

Reported-by: Zenghui Yu <yuzenghui@huawei.com>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220726045828.53697-3-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     bool sve_supported;
     bool pmu_supported = false;
     uint64_t features = 0;
-    uint64_t t;
     int err;
 
     /* Old kernels may not know about the PREFERRED_TARGET ioctl: however
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
     struct kvm_vcpu_init init = { .target = -1, };
 
     /*
-     * Ask for Pointer Authentication if supported. We can't play the
-     * SVE trick of synthesising the ID reg as KVM won't tell us
-     * whether we have the architected or IMPDEF version of PAuth, so
-     * we have to use the actual ID regs.
+     * Ask for SVE if supported, so that we can query ID_AA64ZFR0,
+     * which is otherwise RAZ.
+     */
+    sve_supported = kvm_arm_sve_supported();
+    if (sve_supported) {
+        init.features[0] |= 1 << KVM_ARM_VCPU_SVE;
+    }
+
+    /*
+     * Ask for Pointer Authentication if supported, so that we get
+     * the unsanitized field values for AA64ISAR1_EL1.
      */
     if (kvm_arm_pauth_supported()) {
         init.features[0] |= (1 << KVM_ARM_VCPU_PTRAUTH_ADDRESS |
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
         }
     }
 
-    sve_supported = kvm_arm_sve_supported();
-
-    /* Add feature bits that can't appear until after VCPU init. */
     if (sve_supported) {
-        t = ahcf->isar.id_aa64pfr0;
-        t = FIELD_DP64(t, ID_AA64PFR0, SVE, 1);
-        ahcf->isar.id_aa64pfr0 = t;
-
         /*
          * There is a range of kernels between kernel commit 73433762fcae
          * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
          * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
-         * SVE support, so we only read it here, rather than together with all
-         * the other ID registers earlier.
+         * SVE support, which resulted in an error rather than RAZ.
+         * So only read the register if we set KVM_ARM_VCPU_SVE above.
          */
         err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
                               ARM64_SYS_REG(3, 0, 0, 4, 4));
-- 
2.25.1

From: Richard Henderson <richard.henderson@linaro.org>

The test for the IF block indicates no ID registers are exposed, much
less host support for SVE.  Move the SVE probe into the ELSE block.

Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220726045828.53697-4-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/kvm64.c | 22 +++++++++++-----------
 1 file changed, 11 insertions(+), 11 deletions(-)

diff --git a/target/arm/kvm64.c b/target/arm/kvm64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/kvm64.c
+++ b/target/arm/kvm64.c
@@ -XXX,XX +XXX,XX @@ bool kvm_arm_get_host_cpu_features(ARMHostCPUFeatures *ahcf)
             err |= read_sys_reg64(fdarray[2], &ahcf->isar.reset_pmcr_el0,
                                   ARM64_SYS_REG(3, 3, 9, 12, 0));
         }
-    }
 
-    if (sve_supported) {
-        /*
-         * There is a range of kernels between kernel commit 73433762fcae
-         * and f81cb2c3ad41 which have a bug where the kernel doesn't expose
-         * SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has enabled
-         * SVE support, which resulted in an error rather than RAZ.
-         * So only read the register if we set KVM_ARM_VCPU_SVE above.
-         */
-        err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
-                              ARM64_SYS_REG(3, 0, 0, 4, 4));
+        if (sve_supported) {
+            /*
+             * There is a range of kernels between kernel commit 73433762fcae
+             * and f81cb2c3ad41 which have a bug where the kernel doesn't
+             * expose SYS_ID_AA64ZFR0_EL1 via the ONE_REG API unless the VM has
+             * enabled SVE support, which resulted in an error rather than RAZ.
+             * So only read the register if we set KVM_ARM_VCPU_SVE above.
+             */
+            err |= read_sys_reg64(fdarray[2], &ahcf->isar.id_aa64zfr0,
+                                  ARM64_SYS_REG(3, 0, 0, 4, 4));
+        }
     }
 
     kvm_arm_destroy_scratch_host_vcpu(fdarray);
-- 
2.25.1