Series comparison

-[PULL 00/16] target-arm queue
+[PULL 0/7] target-arm queue
-Patches for rc1: nothing major, just some minor bugfixes and
+A last small test of bug fixes before rc1.
 code cleanups.
+thanks
 -- PMM
-The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:
+The following changes since commit ed8ad9728a9c0eec34db9dff61dfa2f1dd625637:
-  Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)
+  Merge tag 'pull-tpm-2023-07-14-1' of https://github.com/stefanberger/qemu-tpm into staging (2023-07-15 14:54:04 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230717
-for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:
+for you to fetch changes up to c2c1c4a35c7c2b1a4140b0942b9797c857e476a4:
-  target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)
+  hw/nvram: Avoid unnecessary Xilinx eFuse backstore write (2023-07-17 11:05:52 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/Kconfig: ARM_V7M depends on PTIMER
+ * hw/arm/sbsa-ref: set 'slots' property of xhci
- * Minor coding style fixes
+ * linux-user: Remove pointless NULL check in clock_adjtime handling
- * docs: add some notes on the sbsa-ref machine
+ * ptw: Fix S1_ptw_translate() debug path
- * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+ * ptw: Account for FEAT_RME when applying {N}SW, SA bits
- * target/arm: Fix neon VTBL/VTBX for len > 1
+ * accel/tcg: Zero-pad PC in TCG CPU exec trace lines
- * hw/arm/armsse: Correct expansion MPC interrupt lines
+ * hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
  * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
  * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
  * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
  * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
  * hw/arm/nseries: Check return value from load_image_targphys()
  * tests/qtest/npcm7xx_rng-test: count runs properly
  * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
 ----------------------------------------------------------------
-Alex Bennée (1):
+Peter Maydell (5):
-      docs: add some notes on the sbsa-ref machine
+      linux-user: Remove pointless NULL check in clock_adjtime handling
       target/arm/ptw.c: Add comments to S1Translate struct fields
       target/arm: Fix S1_ptw_translate() debug path
       target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
       accel/tcg: Zero-pad PC in TCG CPU exec trace lines
-AlexChen (1):
+Tong Ho (1):
-      ssi: Fix bad printf format specifiers
+      hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
-Andrew Jones (1):
+Yuquan Wang (1):
-      hw/arm/Kconfig: ARM_V7M depends on PTIMER
+      hw/arm/sbsa-ref: set 'slots' property of xhci
-Havard Skinnemoen (1):
+ accel/tcg/cpu-exec.c      |  4 +--
-      tests/qtest/npcm7xx_rng-test: count runs properly
+ accel/tcg/translate-all.c |  2 +-
+ hw/arm/sbsa-ref.c         |  1 +
-Peter Maydell (2):
+ hw/nvram/xlnx-efuse.c     | 11 ++++--
-      hw/arm/nseries: Check return value from load_image_targphys()
+ linux-user/syscall.c      | 12 +++----
-      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
+ target/arm/ptw.c          | 90 +++++++++++++++++++++++++++++++++++++++++------
+files changed, 98 insertions(+), 22 deletions(-)
 Philippe Mathieu-Daudé (6):
       hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
       hw/arm/armsse: Correct expansion MPC interrupt lines
       hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
       hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
       hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
       hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 Richard Henderson (1):
       target/arm: Fix neon VTBL/VTBX for len > 1
 Xinhao Zhang (3):
       target/arm: add spaces around operator
       target/arm: Don't use '#' flag of printf format
       target/arm: add space before the open parenthesis '('
  docs/system/arm/sbsa.rst           | 32 ++++++++++++++++++++++
  docs/system/target-arm.rst         |  1 +
  include/hw/misc/stm32f2xx_syscfg.h |  2 --
  target/arm/helper.h                |  2 +-
  hw/arm/armsse.c                    |  3 +-
  hw/arm/musicpal.c                  | 40 +++++++++++++++++----------
  hw/arm/nseries.c                   | 26 ++++++++----------
  hw/arm/stm32f205_soc.c             |  1 -
  hw/misc/stm32f2xx_syscfg.c         |  2 --
  hw/ssi/imx_spi.c                   |  2 +-
  hw/ssi/xilinx_spi.c                |  2 +-
  target/arm/arch_dump.c             |  8 +++---
  target/arm/arm-semi.c              |  8 +++---
  target/arm/helper.c                |  2 +-
  target/arm/op_helper.c             | 23 +++++++++-------
  target/arm/translate-a64.c         |  4 +--
  target/arm/translate.c             |  2 +-
  tests/qtest/npcm7xx_rng-test.c     |  2 +-
  hw/arm/Kconfig                     |  3 +-
  target/arm/translate-neon.c.inc    | 56 ++++++++++++++------------------------
 files changed, 123 insertions(+), 98 deletions(-)
  create mode 100644 docs/system/arm/sbsa.rst

-[PULL 01/16] hw/arm/Kconfig: ARM_V7M depends on PTIMER
+[PULL 1/7] hw/arm/sbsa-ref: set 'slots' property of xhci
-From: Andrew Jones <drjones@redhat.com>
+From: Yuquan Wang <wangyuquan1236@phytium.com.cn>
-commit 32bd322a0134 ("hw/timer/armv7m_systick: Rewrite to use ptimers")
+This extends the slots of xhci to 64, since the default xhci_sysbus
-changed armv7m_systick to build on ptimers. Make sure we have ptimers
+just supports one slot.
 in the build when building armv7m_systick.
-Signed-off-by: Andrew Jones <drjones@redhat.com>
+Signed-off-by: Wang Yuquan <wangyuquan1236@phytium.com.cn>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
-Message-id: 20201104103343.30392-1-drjones@redhat.com
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 Message-id: 20230710063750.473510-2-wangyuquan1236@phytium.com.cn
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/arm/Kconfig | 1 +
+ hw/arm/sbsa-ref.c | 1 +
 file changed, 1 insertion(+)
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
+diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
+--- a/hw/arm/sbsa-ref.c
-+++ b/hw/arm/Kconfig
++++ b/hw/arm/sbsa-ref.c
-@@ -XXX,XX +XXX,XX @@ config ZYNQ
+@@ -XXX,XX +XXX,XX @@ static void create_xhci(const SBSAMachineState *sms)
+     hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
- config ARM_V7M
+     int irq = sbsa_ref_irqmap[SBSA_XHCI];
-     bool
+     DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
-+    select PTIMER
++    qdev_prop_set_uint32(dev, "slots", XHCI_MAXSLOTS);
- config ALLWINNER_A10
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-     bool
+     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
 --
-.20.1
+.34.1

-[PULL 15/16] tests/qtest/npcm7xx_rng-test: count runs properly
+[PULL 2/7] linux-user: Remove pointless NULL check in clock_adjtime handling
-From: Havard Skinnemoen <hskinnemoen@google.com>
+In the code for TARGET_NR_clock_adjtime, we set the pointer phtx to
 the address of the local variable htx.  This means it can never be
 NULL, but later in the code we check it for NULL anyway.  Coverity
 complains about this (CID 1507683) because the NULL check comes after
 a call to clock_adjtime() that assumes it is non-NULL.
-The number of runs is equal to the number of 0-1 and 1-0 transitions,
+Since phtx is always &htx, and is used only in three places, it's not
-plus one. Currently, it's counting the number of times these transitions
+really necessary.  Remove it, bringing the code structure in to line
-do _not_ happen, plus one.
+with that for TARGET_NR_clock_adjtime64, which already uses a simple
 '&htx' when it wants a pointer to 'htx'.
-Source:
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-section 2.3.4 point (3).
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230623144410.1837261-1-peter.maydell@linaro.org
 ---
  linux-user/syscall.c | 12 +++++-------
 file changed, 5 insertions(+), 7 deletions(-)
-Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
 Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  tests/qtest/npcm7xx_rng-test.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qtest/npcm7xx_rng-test.c
+--- a/linux-user/syscall.c
-+++ b/tests/qtest/npcm7xx_rng-test.c
++++ b/linux-user/syscall.c
-@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
+@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
-     pi = (double)nr_ones / nr_bits;
+ #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
+     case TARGET_NR_clock_adjtime:
-     for (k = 0; k < nr_bits - 1; k++) {
+         {
--        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+-            struct timex htx, *phtx = &htx;
-+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
++            struct timex htx;
-     }
-     vn_obs += 1;
+-            if (target_to_host_timex(phtx, arg2) != 0) {
++            if (target_to_host_timex(&htx, arg2) != 0) {
                  return -TARGET_EFAULT;
              }
 -            ret = get_errno(clock_adjtime(arg1, phtx));
 -            if (!is_error(ret) && phtx) {
 -                if (host_to_target_timex(arg2, phtx) != 0) {
 -                    return -TARGET_EFAULT;
 -                }
 +            ret = get_errno(clock_adjtime(arg1, &htx));
 +            if (!is_error(ret) && host_to_target_timex(arg2, &htx)) {
 +                return -TARGET_EFAULT;
              }
          }
          return ret;
 --
-.20.1
+.34.1

-[PULL 16/16] target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check
+[PULL 3/7] target/arm/ptw.c: Add comments to S1Translate struct fields
-Checks for UNDEF cases should go before the "is VFP enabled?" access
+Add comments to the in_* fields in the S1Translate struct
-check, except in special cases. Move a stray UNDEF check in the VTBL
+that explain what they're doing.
 trans function up above the access check.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
+Message-id: 20230710152130.3928330-2-peter.maydell@linaro.org
 ---
- target/arm/translate-neon.c.inc | 8 ++++----
+ target/arm/ptw.c | 40 ++++++++++++++++++++++++++++++++++++++++
-file changed, 4 insertions(+), 4 deletions(-)
+file changed, 40 insertions(+)
-diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-neon.c.inc
+--- a/target/arm/ptw.c
-+++ b/target/arm/translate-neon.c.inc
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
+@@ -XXX,XX +XXX,XX @@
-         return false;
+ #endif
-     }
+ typedef struct S1Translate {
--    if (!vfp_access_check(s)) {
++    /*
--        return true;
++     * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
--    }
++     * Together with in_space, specifies the architectural translation regime.
--
++     */
-     if ((a->vn + a->len + 1) > 32) {
+     ARMMMUIdx in_mmu_idx;
-         /*
++    /*
-          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
++     * in_ptw_idx: specifies which mmuidx to use for the actual
-@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
++     * page table descriptor load operations. This will be one of the
-         return false;
++     * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
-     }
++     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
++     * this field is updated accordingly.
-+    if (!vfp_access_check(s)) {
++     */
-+        return true;
+     ARMMMUIdx in_ptw_idx;
-+    }
++    /*
-+
++     * in_space: the security space for this walk. This plus
-     desc = tcg_const_i32((a->vn << 2) | a->len);
++     * the in_mmu_idx specify the architectural translation regime.
-     def = tcg_temp_new_i64();
++     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
-     if (a->op) {
++     * this field is updated accordingly.
 +     *
 +     * Note that the security space for the in_ptw_idx may be different
 +     * from that for the in_mmu_idx. We do not need to explicitly track
 +     * the in_ptw_idx security space because:
 +     *  - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
 +     *    itself specifies the security space
 +     *  - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
 +     *    space used for ptw reads is the same as that of the security
 +     *    space of the stage 1 translation for all cases except where
 +     *    stage 1 is Secure; in that case the only possibilities for
 +     *    the ptw read are Secure and NonSecure, and the in_ptw_idx
 +     *    value being Stage2 vs Stage2_S distinguishes those.
 +     */
      ARMSecuritySpace in_space;
 +    /*
 +     * in_secure: whether the translation regime is a Secure one.
 +     * This is always equal to arm_space_is_secure(in_space).
 +     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
 +     * this field is updated accordingly.
 +     */
      bool in_secure;
 +    /*
 +     * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
 +     * accesses will not update the guest page table access flags
 +     * and will not change the state of the softmmu TLBs.
 +     */
      bool in_debug;
      /*
       * If this is stage 2 of a stage 1+2 page table walk, then this must
 --
-.20.1
+.34.1

-[PULL 02/16] ssi: Fix bad printf format specifiers
+[PULL 4/7] target/arm: Fix S1_ptw_translate() debug path
-From: AlexChen <alex.chen@huawei.com>
+In commit fe4a5472ccd6 we rearranged the logic in S1_ptw_translate()
 so that the debug-access "call get_phys_addr_*" codepath is used both
 when S1 is doing ptw reads from stage 2 and when it is doing ptw
 reads from physical memory.  However, we didn't update the
 calculation of s2ptw->in_space and s2ptw->in_secure to account for
 the "ptw reads from physical memory" case.  This meant that debug
 accesses when in Secure state broke.
-We should use printf format specifier "%u" instead of "%d" for
+Create a new function S2_security_space() which returns the
-argument of type "unsigned int".
+correct security space to use for the ptw load, and use it to
 determine the correct .in_secure and .in_space fields for the
 stage 2 lookup for the ptw load.
-Reported-by: Euler Robot <euler.robot@huawei.com>
+Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Signed-off-by: Alex Chen <alex.chen@huawei.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Message-id: 5FA280F5.8060902@huawei.com
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org
 Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate")
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/ssi/imx_spi.c    | 2 +-
+ target/arm/ptw.c | 37 ++++++++++++++++++++++++++++++++-----
- hw/ssi/xilinx_spi.c | 2 +-
+file changed, 32 insertions(+), 5 deletions(-)
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/ssi/imx_spi.c
+--- a/target/arm/ptw.c
-+++ b/hw/ssi/imx_spi.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
+@@ -XXX,XX +XXX,XX @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
      case ECSPI_MSGDATA:
          return  "ECSPI_MSGDATA";
      default:
 -        sprintf(unknown, "%d ?", reg);
 +        sprintf(unknown, "%u ?", reg);
          return unknown;
      }
  }
-diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
-index XXXXXXX..XXXXXXX 100644
++static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
---- a/hw/ssi/xilinx_spi.c
++                                          ARMMMUIdx s2_mmu_idx)
-+++ b/hw/ssi/xilinx_spi.c
++{
-@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
++    /*
-        irq chain unless things really changed.  */
++     * Return the security space to use for stage 2 when doing
-     if (pending != s->irqline) {
++     * the S1 page table descriptor load.
-         s->irqline = pending;
++     */
--        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
++    if (regime_is_stage2(s2_mmu_idx)) {
-+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
++        /*
-                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
++         * The security space for ptw reads is almost always the same
-         qemu_set_irq(s->irq, pending);
++         * as that of the security space of the stage 1 translation.
-     }
++         * The only exception is when stage 1 is Secure; in that case
 +         * the ptw read might be to the Secure or the NonSecure space
 +         * (but never Realm or Root), and the s2_mmu_idx tells us which.
 +         * Root translations are always single-stage.
 +         */
 +        if (s1_space == ARMSS_Secure) {
 +            return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
 +        } else {
 +            assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
 +            assert(s1_space != ARMSS_Root);
 +            return s1_space;
 +        }
 +    } else {
 +        /* ptw loads are from phys: the mmu idx itself says which space */
 +        return arm_phys_to_space(s2_mmu_idx);
 +    }
 +}
 +
  /* Translate a S1 pagetable walk through S2 if needed.  */
  static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                               hwaddr addr, ARMMMUFaultInfo *fi)
  {
 -    ARMSecuritySpace space = ptw->in_space;
      bool is_secure = ptw->in_secure;
      ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
      ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
           * From gdbstub, do not use softmmu so that we don't modify the
           * state of the cpu at all, including softmmu tlb contents.
           */
 +        ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
          S1Translate s2ptw = {
              .in_mmu_idx = s2_mmu_idx,
              .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
 -            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
 -            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
 -                         : space == ARMSS_Realm ? ARMSS_Realm
 -                         : ARMSS_NonSecure),
 +            .in_secure = arm_space_is_secure(s2_space),
 +            .in_space = s2_space,
              .in_debug = true,
          };
          GetPhysAddrResult s2 = { };
 --
-.20.1
+.34.1

-[PULL 03/16] target/arm: add spaces around operator
+[PULL 5/7] target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
+In get_phys_addr_twostage() the code that applies the effects of
 VSTCR.{SA,SW} and VTCR.{NSA,NSW} only updates result->f.attrs.secure.
 Now we also have f.attrs.space for FEAT_RME, we need to keep the two
 in sync.
-Fix code style. Operator needs spaces both sides.
+These bits only have an effect for Secure space translations, not
 for Root, so use the input in_space field to determine whether to
 apply them rather than the input is_secure. This doesn't actually
 make a difference because Root translations are never two-stage,
 but it's a little clearer.
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
-Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230710152130.3928330-4-peter.maydell@linaro.org
 ---
- target/arm/arch_dump.c | 8 ++++----
+ target/arm/ptw.c | 13 ++++++++-----
- target/arm/arm-semi.c  | 8 ++++----
+file changed, 8 insertions(+), 5 deletions(-)
  target/arm/helper.c    | 2 +-
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/arch_dump.c
+--- a/target/arm/ptw.c
-+++ b/target/arm/arch_dump.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
+     hwaddr ipa;
-     for (i = 0; i < 32; ++i) {
+     int s1_prot, s1_lgpgsz;
-         uint64_t *q = aa64_vfp_qreg(env, i);
+     bool is_secure = ptw->in_secure;
--        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
++    ARMSecuritySpace in_space = ptw->in_space;
--        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+     bool ret, ipa_secure;
-+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+     ARMCacheAttrs cacheattrs1;
-+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
+     ARMSecuritySpace ipa_space;
-     }
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
+      * Check if IPA translates to secure or non-secure PA space.
-     if (s->dump_info.d_endian == ELFDATA2MSB) {
+      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
-@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
+      */
-          */
+-    result->f.attrs.secure =
-         for (i = 0; i < 32; ++i) {
+-        (is_secure
-             uint64_t tmp = note.vfp.vregs[2*i];
+-         && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
--            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
+-         && (ipa_secure
--            note.vfp.vregs[2*i+1] = tmp;
+-             || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
-+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
++    if (in_space == ARMSS_Secure) {
-+            note.vfp.vregs[2 * i + 1] = tmp;
++        result->f.attrs.secure =
-         }
++            !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
-     }
++            && (ipa_secure
++                || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
-diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
++        result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
-index XXXXXXX..XXXXXXX 100644
++    }
---- a/target/arm/arm-semi.c
-+++ b/target/arm/arm-semi.c
+     return false;
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          if (use_gdb_syscalls()) {
              arm_semi_open_guestfd = guestfd;
              ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
 -                                  (int)arg2+1, gdb_open_modeflags[arg1]);
 +                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
          } else {
              ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
              if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
 -                                  arg0, (int)arg1+1);
 +                                  arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(3);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
 -                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
 +                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
          } else {
              char *s2;
              s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
          GET_ARG(1);
          if (use_gdb_syscalls()) {
              return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
 -                                   arg0, (int)arg1+1);
 +                                   arg0, (int)arg1 + 1);
          } else {
              s = lock_user_string(arg0);
              if (!s) {
 diff --git a/target/arm/helper.c b/target/arm/helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/helper.c
 +++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
      uint32_t sum;
      sum = do_usad(a, b);
      sum += do_usad(a >> 8, b >> 8);
 -    sum += do_usad(a >> 16, b >>16);
 +    sum += do_usad(a >> 16, b >> 16);
      sum += do_usad(a >> 24, b >> 24);
      return sum;
  }
 --
-.20.1
+.34.1

-[PULL 04/16] target/arm: Don't use '#' flag of printf format
+Deleted patch
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
-Fix code style. Don't use '#' flag of printf format ('%#') in
-format strings, use '0x' prefix instead
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
-Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate-a64.c | 4 ++--
-file changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
-+++ b/target/arm/translate-a64.c
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
-                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
-                 break;
-             default:
--                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
-+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
-                         __func__, insn, fpopcode, s->pc_curr);
-                 g_assert_not_reached();
-             }
-@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
-     case 0x7f: /* FSQRT (vector) */
-         break;
-     default:
--        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
-+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
-         g_assert_not_reached();
-     }
---
-.20.1

-[PULL 05/16] target/arm: add space before the open parenthesis '('
+Deleted patch
-From: Xinhao Zhang <zhangxinhao1@huawei.com>
-Fix code style. Space required before the open parenthesis '('.
-Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
-Signed-off-by: Kai Deng <dengkai1@huawei.com>
-Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/translate.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/target/arm/translate.c b/target/arm/translate.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate.c
-+++ b/target/arm/translate.c
-@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
-             - Hardware watchpoints.
-            Hardware breakpoints have already been handled and skip this code.
-          */
--        switch(dc->base.is_jmp) {
-+        switch (dc->base.is_jmp) {
-         case DISAS_NEXT:
-         case DISAS_TOO_MANY:
-             gen_goto_tb(dc, 1, dc->base.pc_next);
---
-.20.1

-[PULL 06/16] docs: add some notes on the sbsa-ref machine
+Deleted patch
-From: Alex Bennée <alex.bennee@linaro.org>
-We should at least document what this machine is about.
-Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
-Cc: Leif Lindholm <leif@nuviainc.com>
-Cc: Shashi Mallela <shashi.mallela@linaro.org>
-Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
-[PMM: fixed filename mismatch]
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
- docs/system/target-arm.rst |  1 +
-files changed, 33 insertions(+)
- create mode 100644 docs/system/arm/sbsa.rst
-diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/docs/system/arm/sbsa.rst
-@@ -XXX,XX +XXX,XX @@
-+Arm Server Base System Architecture Reference board (``sbsa-ref``)
-+==================================================================
-+
-+While the `virt` board is a generic board platform that doesn't match
-+any real hardware the `sbsa-ref` board intends to look like real
-+hardware. The `Server Base System Architecture
-+<https://developer.arm.com/documentation/den0029/latest>` defines a
-+minimum base line of hardware support and importantly how the firmware
-+reports that to any operating system. It is a static system that
-+reports a very minimal DT to the firmware for non-discoverable
-+information about components affected by the qemu command line (i.e.
-+cpus and memory). As a result it must have a firmware specifically
-+built to expect a certain hardware layout (as you would in a real
-+machine).
-+
-+It is intended to be a machine for developing firmware and testing
-+standards compliance with operating systems.
-+
-+Supported devices
-+"""""""""""""""""
-+
-+The sbsa-ref board supports:
-+
-+  - A configurable number of AArch64 CPUs
-+  - GIC version 3
-+  - System bus AHCI controller
-+  - System bus EHCI controller
-+  - CDROM and hard disc on AHCI bus
-+  - E1000E ethernet card on PCIe bus
-+  - VGA display adaptor on PCIe bus
-+  - A generic SBSA watchdog device
-+
-diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/system/target-arm.rst
-+++ b/docs/system/target-arm.rst
-@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
-    arm/mps2
-    arm/musca
-    arm/realview
-+   arm/sbsa
-    arm/versatile
-    arm/vexpress
-    arm/aspeed
---
-.20.1

-[PULL 07/16] hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
-When using a Cortex-A15, the Virt machine does not use any
-MPCore peripherals. Remove the dependency.
-Fixes: 7951c7b7c05 ("hw/arm: Express dependencies of the virt machine with Kconfig")
-Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-id: 20201107114852.271922-1-philmd@redhat.com
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/Kconfig | 1 -
-file changed, 1 deletion(-)
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
-+++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config ARM_VIRT
-     imply VFIO_PLATFORM
-     imply VFIO_XGMAC
-     imply TPM_TIS_SYSBUS
--    select A15MPCORE
-     select ACPI
-     select ARM_SMMUV3
-     select GPIO_KEY
---
-.20.1

-[PULL 11/16] hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
+[PULL 6/7] accel/tcg: Zero-pad PC in TCG CPU exec trace lines
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+In commit f0a08b0913befbd we changed the type of the PC from
 target_ulong to vaddr.  In doing so we inadvertently dropped the
 zero-padding on the PC in trace lines (the second item inside the []
 in these lines).  They used to look like this on AArch64, for
 instance:
-omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
+Trace 0: 0x7f2260000100 [00000000/0000000040000000/00000061/ff200000]
 OMAP2 chip support") takes care of creating the 3 UARTs.
-Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
+and now they look like this:
-extensions and attach to n8x0's UART") added n8x0_uart_setup()
+Trace 0: 0x7f4f50000100 [00000000/40000000/00000061/ff200000]
 which create the UART and connects it to an IRQ output,
 overwritting the existing peripheral and its IRQ connection.
 This is incorrect.
-Fortunately we don't need to fix this, because commit 6da68df7f9b
+and if the PC happens to be somewhere low like 0x5000
-("hw/arm/nseries: Replace the bluetooth chardev with a "null"
+then the field is shown as /5000/.
 chardev") removed the use of this peripheral. We can simply
 remove the code.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+This is because TARGET_FMT_lx is a "%08x" or "%016x" specifier,
-Message-id: 20201107193403.436146-4-f4bug@amsat.org
+depending on TARGET_LONG_SIZE, whereas VADDR_PRIx is just PRIx64
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+with no width specifier.
 Restore the zero-padding by adding an 016 width specifier to
 this tracing and a couple of others that were similarly recently
 changed to use VADDR_PRIx without a width specifier.
 We can't unfortunately restore the "32-bit guests are padded to
 hex digits and 64-bit guests to 16 hex digits" behaviour so
 easily.
 Fixes: f0a08b0913befbd ("accel/tcg/cpu-exec.c: Widen pc to vaddr")
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Anton Johansson <anjo@rev.ng>
+Message-id: 20230711165434.4123674-1-peter.maydell@linaro.org
 ---
- hw/arm/nseries.c | 11 -----------
+ accel/tcg/cpu-exec.c      | 4 ++--
-file changed, 11 deletions(-)
+ accel/tcg/translate-all.c | 2 +-
 files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/nseries.c
+--- a/accel/tcg/cpu-exec.c
-+++ b/hw/arm/nseries.c
++++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
+@@ -XXX,XX +XXX,XX @@ static void log_cpu_exec(vaddr pc, CPUState *cpu,
-     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
+     if (qemu_log_in_addr_range(pc)) {
- }
+         qemu_log_mask(CPU_LOG_EXEC,
+                       "Trace %d: %p [%08" PRIx64
--static void n8x0_uart_setup(struct n800_s *s)
+-                      "/%" VADDR_PRIx "/%08x/%08x] %s\n",
--{
++                      "/%016" VADDR_PRIx "/%08x/%08x] %s\n",
--    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
+                       cpu->cpu_index, tb->tc.ptr, tb->cs_base, pc,
--    /*
+                       tb->flags, tb->cflags, lookup_symbol(pc));
--     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
--     * here, but this code has been removed with the bluetooth backend.
+@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
--     */
+         if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
--    omap_uart_attach(s->mpu->uart[BT_UART], radio);
+             vaddr pc = log_pc(cpu, last_tb);
--}
+             if (qemu_log_in_addr_range(pc)) {
--
+-                qemu_log("Stopped execution of TB chain before %p [%"
- static void n8x0_usb_setup(struct n800_s *s)
++                qemu_log("Stopped execution of TB chain before %p [%016"
- {
+                          VADDR_PRIx "] %s\n",
-     SysBusDevice *dev;
+                          last_tb->tc.ptr, pc, lookup_symbol(pc));
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
+             }
-     n8x0_spi_setup(s);
+diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
-     n8x0_dss_setup(s);
+index XXXXXXX..XXXXXXX 100644
-     n8x0_cbus_setup(s);
+--- a/accel/tcg/translate-all.c
--    n8x0_uart_setup(s);
++++ b/accel/tcg/translate-all.c
-     if (machine_usb(machine)) {
+@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
-         n8x0_usb_setup(s);
+     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
          vaddr pc = log_pc(cpu, tb);
          if (qemu_log_in_addr_range(pc)) {
 -            qemu_log("cpu_io_recompile: rewound execution of TB to %"
 +            qemu_log("cpu_io_recompile: rewound execution of TB to %016"
                       VADDR_PRIx "\n", pc);
          }
      }
 --
-.20.1
+.34.1

-[PULL 08/16] target/arm: Fix neon VTBL/VTBX for len > 1
+[PULL 7/7] hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
-From: Richard Henderson <richard.henderson@linaro.org>
+From: Tong Ho <tong.ho@amd.com>
-The helper function did not get updated when we reorganized
+Add a check in the bit-set operation to write the backstore
-the vector register file for SVE.  Since then, the neon dregs
+only if the affected bit is 0 before.
 are non-sequential and cannot be simply indexed.
-At the same time, make the helper function operate on 64-bit
+With this in place, there will be no need for callers to
-quantities so that we do not have to call it twice.
+do the checking in order to avoid unnecessary writes.
-Fixes: c39c2b9043e
+Signed-off-by: Tong Ho <tong.ho@amd.com>
-Reported-by: Ard Biesheuvel <ardb@kernel.org>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
+Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-[PMM: use aa32_vfp_dreg() rather than opencoding]
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.h             |  2 +-
+ hw/nvram/xlnx-efuse.c | 11 +++++++++--
- target/arm/op_helper.c          | 23 +++++++++--------
+file changed, 9 insertions(+), 2 deletions(-)
  target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 files changed, 29 insertions(+), 40 deletions(-)
-diff --git a/target/arm/helper.h b/target/arm/helper.h
+diff --git a/hw/nvram/xlnx-efuse.c b/hw/nvram/xlnx-efuse.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.h
+--- a/hw/nvram/xlnx-efuse.c
-+++ b/target/arm/helper.h
++++ b/hw/nvram/xlnx-efuse.c
-@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
+@@ -XXX,XX +XXX,XX @@ static bool efuse_ro_bits_find(XlnxEFuse *s, uint32_t k)
- DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
- DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
+ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
  DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
 -DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
 +DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
  DEF_HELPER_3(shl_cc, i32, env, i32, i32)
  DEF_HELPER_3(shr_cc, i32, env, i32, i32)
 diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/op_helper.c
 +++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
      cpu_loop_exit_restore(cs, ra);
  }
 -uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
 -                          uint32_t maxindex)
 +uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
 +                          uint64_t ireg, uint64_t def)
  {
--    uint32_t val, shift;
++    uint32_t set, *row;
--    uint64_t *table = vn;
++
-+    uint64_t tmp, val = 0;
+     if (efuse_ro_bits_find(s, bit)) {
-+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+         g_autofree char *path = object_get_canonical_path(OBJECT(s));
-+    uint32_t base_reg = desc >> 2;
-+    uint32_t shift, index, reg;
+@@ -XXX,XX +XXX,XX @@ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
 -    val = 0;
 -    for (shift = 0; shift < 32; shift += 8) {
 -        uint32_t index = (ireg >> shift) & 0xff;
 +    for (shift = 0; shift < 64; shift += 8) {
 +        index = (ireg >> shift) & 0xff;
          if (index < maxindex) {
 -            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
 -            val |= tmp << shift;
 +            reg = base_reg + (index >> 3);
 +            tmp = *aa32_vfp_dreg(env, reg);
 +            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
          } else {
 -            val |= def & (0xff << shift);
 +            tmp = def & (0xffull << shift);
          }
 +        val |= tmp;
      }
      return val;
  }
 diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
 index XXXXXXX..XXXXXXX 100644
 --- a/target/arm/translate-neon.c.inc
 +++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
  static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
  {
 -    int n;
 -    TCGv_i32 tmp, tmp2, tmp3, tmp4;
 -    TCGv_ptr ptr1;
 +    TCGv_i64 val, def;
 +    TCGv_i32 desc;
      if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
          return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
          return true;
      }
 -    n = a->len + 1;
 -    if ((a->vn + n) > 32) {
 +    if ((a->vn + a->len + 1) > 32) {
          /*
           * This is UNPREDICTABLE; we choose to UNDEF to avoid the
           * helper function running off the end of the register file.
           */
          return false;
      }
--    n <<= 3;
--    tmp = tcg_temp_new_i32();
+-    s->fuse32[bit / 32] |= 1 << (bit % 32);
--    if (a->op) {
+-    efuse_bdrv_sync(s, bit);
--        read_neon_element32(tmp, a->vd, 0, MO_32);
++    /* Avoid back-end write unless there is a real update */
--    } else {
++    row = &s->fuse32[bit / 32];
--        tcg_gen_movi_i32(tmp, 0);
++    set = 1 << (bit % 32);
--    }
++    if (!(set & *row)) {
--    tmp2 = tcg_temp_new_i32();
++        *row |= set;
--    read_neon_element32(tmp2, a->vm, 0, MO_32);
++        efuse_bdrv_sync(s, bit);
--    ptr1 = vfp_reg_ptr(true, a->vn);
++    }
 -    tmp4 = tcg_const_i32(n);
 -    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 +    desc = tcg_const_i32((a->vn << 2) | a->len);
 +    def = tcg_temp_new_i64();
      if (a->op) {
 -        read_neon_element32(tmp, a->vd, 1, MO_32);
 +        read_neon_element64(def, a->vd, 0, MO_64);
      } else {
 -        tcg_gen_movi_i32(tmp, 0);
 +        tcg_gen_movi_i64(def, 0);
      }
 -    tmp3 = tcg_temp_new_i32();
 -    read_neon_element32(tmp3, a->vm, 1, MO_32);
 -    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
 -    tcg_temp_free_i32(tmp);
 -    tcg_temp_free_i32(tmp4);
 -    tcg_temp_free_ptr(ptr1);
 +    val = tcg_temp_new_i64();
 +    read_neon_element64(val, a->vm, 0, MO_64);
 -    write_neon_element32(tmp2, a->vd, 0, MO_32);
 -    write_neon_element32(tmp3, a->vd, 1, MO_32);
 -    tcg_temp_free_i32(tmp2);
 -    tcg_temp_free_i32(tmp3);
 +    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
 +    write_neon_element64(val, a->vd, 0, MO_64);
 +
 +    tcg_temp_free_i64(def);
 +    tcg_temp_free_i64(val);
 +    tcg_temp_free_i32(desc);
      return true;
  }
 --
-.20.1
+.34.1

-[PULL 09/16] hw/arm/armsse: Correct expansion MPC interrupt lines
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-We can use one MPC per SRAM bank, but we currently only wire the
-IRQ from the first expansion MPC to the IRQ splitter. Fix that.
-Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-2-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/armsse.c | 3 ++-
-file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/armsse.c
-+++ b/hw/arm/armsse.c
-@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
-                                         qdev_get_gpio_in(dev_splitter, 0));
-             qdev_connect_gpio_out(dev_splitter, 0,
-                                   qdev_get_gpio_in_named(dev_secctl,
--                                                         "mpc_status", 0));
-+                                                         "mpc_status",
-+                                                         i - IOTS_NUM_EXP_MPC));
-         }
-         qdev_connect_gpio_out(dev_splitter, 1,
---
-.20.1

-[PULL 10/16] hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The system configuration controller (SYSCFG) doesn't have
-any output IRQ (and the INTC input #71 belongs to the UART6).
-Remove the invalid code.
-Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-3-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- include/hw/misc/stm32f2xx_syscfg.h | 2 --
- hw/arm/stm32f205_soc.c             | 1 -
- hw/misc/stm32f2xx_syscfg.c         | 2 --
-files changed, 5 deletions(-)
-diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/misc/stm32f2xx_syscfg.h
-+++ b/include/hw/misc/stm32f2xx_syscfg.h
-@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
-     uint32_t syscfg_exticr3;
-     uint32_t syscfg_exticr4;
-     uint32_t syscfg_cmpcr;
--
--    qemu_irq irq;
- };
- #endif /* HW_STM32F2XX_SYSCFG_H */
-diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/stm32f205_soc.c
-+++ b/hw/arm/stm32f205_soc.c
-@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
-     }
-     busdev = SYS_BUS_DEVICE(dev);
-     sysbus_mmio_map(busdev, 0, 0x40013800);
--    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
-     /* Attach UART (uses USART registers) and USART controllers */
-     for (i = 0; i < STM_NUM_USARTS; i++) {
-diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/misc/stm32f2xx_syscfg.c
-+++ b/hw/misc/stm32f2xx_syscfg.c
-@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
- {
-     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
--    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
--
-     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
-                           TYPE_STM32F2XX_SYSCFG, 0x400);
-     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
---
-.20.1

-[PULL 12/16] hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The MusicPal board code connects both of the IRQ outputs of the UART
-to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
-to the same input is not valid as it produces subtly wrong behaviour
-(for instance if both the IRQ lines are high, and then one goes
-low, the INTC input will see this as a high-to-low transition
-even though the second IRQ line should still be holding it high).
-This kind of wiring needs an explicitly created OR gate; add one.
-Inspired-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-5-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/musicpal.c | 17 +++++++++++++----
- hw/arm/Kconfig    |  1 +
-files changed, 14 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/musicpal.c
-+++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@
- #include "ui/console.h"
- #include "hw/i2c/i2c.h"
- #include "hw/irq.h"
-+#include "hw/or-irq.h"
- #include "hw/audio/wm8750.h"
- #include "sysemu/block-backend.h"
- #include "sysemu/runstate.h"
-@@ -XXX,XX +XXX,XX @@
- #define MP_TIMER4_IRQ           7
- #define MP_EHCI_IRQ             8
- #define MP_ETH_IRQ              9
--#define MP_UART1_IRQ            11
--#define MP_UART2_IRQ            11
-+#define MP_UART_SHARED_IRQ      11
- #define MP_GPIO_IRQ             12
- #define MP_RTC_IRQ              28
- #define MP_AUDIO_IRQ            30
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-     ARMCPU *cpu;
-     qemu_irq pic[32];
-     DeviceState *dev;
-+    DeviceState *uart_orgate;
-     DeviceState *i2c_dev;
-     DeviceState *lcd_dev;
-     DeviceState *key_dev;
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                           pic[MP_TIMER4_IRQ], NULL);
--    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
-+    /* Logically OR both UART IRQs together */
-+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
-+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
-+
-+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
-+                   qdev_get_gpio_in(uart_orgate, 0),
-                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
--    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
-+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
-+                   qdev_get_gpio_in(uart_orgate, 1),
-                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
-     /* Register flash */
-diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/Kconfig
-+++ b/hw/arm/Kconfig
-@@ -XXX,XX +XXX,XX @@ config MUSCA
- config MUSICPAL
-     bool
-+    select OR_IRQ
-     select BITBANG_I2C
-     select MARVELL_88W8618
-     select PTIMER
---
-.20.1

-[PULL 13/16] hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-We don't need to fill the full pic[] array if we only use
-few of the interrupt lines. Directly call qdev_get_gpio_in()
-when necessary.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201107193403.436146-6-f4bug@amsat.org
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/musicpal.c | 25 +++++++++++++------------
-file changed, 13 insertions(+), 12 deletions(-)
-diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/musicpal.c
-+++ b/hw/arm/musicpal.c
-@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
- static void musicpal_init(MachineState *machine)
- {
-     ARMCPU *cpu;
--    qemu_irq pic[32];
-     DeviceState *dev;
-+    DeviceState *pic;
-     DeviceState *uart_orgate;
-     DeviceState *i2c_dev;
-     DeviceState *lcd_dev;
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-                            &error_fatal);
-     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
--    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
-+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
-                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
--    for (i = 0; i < 32; i++) {
--        pic[i] = qdev_get_gpio_in(dev, i);
--    }
--    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
--                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
--                          pic[MP_TIMER4_IRQ], NULL);
-+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
-+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
-+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
-+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
-+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
-     /* Logically OR both UART IRQs together */
-     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
-     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
-     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
--    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
-+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
-+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
-     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
-                    qdev_get_gpio_in(uart_orgate, 0),
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-                              OBJECT(get_system_memory()), &error_fatal);
-     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
--    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
-+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
-+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
-     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
-     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
-     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
--                               pic[MP_GPIO_IRQ]);
-+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
-     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
-     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
-@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
-                              NULL);
-     sysbus_realize_and_unref(s, &error_fatal);
-     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
--    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
-+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
-     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
-     arm_load_kernel(cpu, machine, &musicpal_binfo);
---
-.20.1

-[PULL 14/16] hw/arm/nseries: Check return value from load_image_targphys()
+Deleted patch
-The nseries machines have a codepath that allows them to load a
-secondary bootloader.  This code wasn't checking that the
-load_image_targphys() succeeded.  Check the return value and report
-the error to the user.
-While we're in the vicinity, fix the comment style of the
-comment documenting what this image load is doing.
-Fixes: Coverity CID 1192904
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
----
- hw/arm/nseries.c | 15 +++++++++++----
-file changed, 11 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/nseries.c
-+++ b/hw/arm/nseries.c
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-         /* No, wait, better start at the ROM.  */
-         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
--        /* This is intended for loading the `secondary.bin' program from
-+        /*
-+         * This is intended for loading the `secondary.bin' program from
-          * Nokia images (the NOLO bootloader).  The entry point seems
-          * to be at OMAP2_Q2_BASE + 0x400000.
-          *
-@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
-          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
-          *
-          * The code above is for loading the `zImage' file from Nokia
--         * images.  */
--        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
--                            machine->ram_size - 0x400000);
-+         * images.
-+         */
-+        if (load_image_targphys(option_rom[0].name,
-+                                OMAP2_Q2_BASE + 0x400000,
-+                                machine->ram_size - 0x400000) < 0) {
-+            error_report("Failed to load secondary bootloader %s",
-+                         option_rom[0].name);
-+            exit(EXIT_FAILURE);
-+        }
-         n800_setup_nolo_tags(nolo_tags);
-         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
---
-.20.1

Patches for rc1: nothing major, just some minor bugfixes and
code cleanups.

-- PMM

The following changes since commit f7e1914adad8885a5d4c70239ab90d901ed97e9f:

Merge remote-tracking branch 'remotes/alistair/tags/pull-riscv-to-apply-20201109' into staging (2020-11-10 09:24:56 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20201110

for you to fetch changes up to b6c56c8a9a4064ea783f352f43c5df6231a110fa:

target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check (2020-11-10 11:03:48 +0000)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/Kconfig: ARM_V7M depends on PTIMER
 * Minor coding style fixes
 * docs: add some notes on the sbsa-ref machine
 * hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
 * target/arm: Fix neon VTBL/VTBX for len > 1
 * hw/arm/armsse: Correct expansion MPC interrupt lines
 * hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
 * hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
 * hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
 * hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary
 * hw/arm/nseries: Check return value from load_image_targphys()
 * tests/qtest/npcm7xx_rng-test: count runs properly
 * target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

----------------------------------------------------------------
Alex Bennée (1):
      docs: add some notes on the sbsa-ref machine

AlexChen (1):
      ssi: Fix bad printf format specifiers

Andrew Jones (1):
      hw/arm/Kconfig: ARM_V7M depends on PTIMER

Havard Skinnemoen (1):
      tests/qtest/npcm7xx_rng-test: count runs properly

Peter Maydell (2):
      hw/arm/nseries: Check return value from load_image_targphys()
      target/arm/translate-neon.c: Handle VTBL UNDEF case before VFP access check

Philippe Mathieu-Daudé (6):
      hw/arm/virt: Remove dependency on Cortex-A15 MPCore peripherals
      hw/arm/armsse: Correct expansion MPC interrupt lines
      hw/misc/stm32f2xx_syscfg: Remove extraneous IRQ
      hw/arm/nseries: Remove invalid/unnecessary n8x0_uart_setup()
      hw/arm/musicpal: Don't connect two qemu_irqs directly to the same input
      hw/arm/musicpal: Only use qdev_get_gpio_in() when necessary

Richard Henderson (1):
      target/arm: Fix neon VTBL/VTBX for len > 1

Xinhao Zhang (3):
      target/arm: add spaces around operator
      target/arm: Don't use '#' flag of printf format
      target/arm: add space before the open parenthesis '('

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%d" for
argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>
Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Message-id: 5FA280F5.8060902@huawei.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/ssi/imx_spi.c    | 2 +-
 hw/ssi/xilinx_spi.c | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/ssi/imx_spi.c b/hw/ssi/imx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/imx_spi.c
+++ b/hw/ssi/imx_spi.c
@@ -XXX,XX +XXX,XX @@ static const char *imx_spi_reg_name(uint32_t reg)
     case ECSPI_MSGDATA:
         return  "ECSPI_MSGDATA";
     default:
-        sprintf(unknown, "%d ?", reg);
+        sprintf(unknown, "%u ?", reg);
         return unknown;
     }
 }
diff --git a/hw/ssi/xilinx_spi.c b/hw/ssi/xilinx_spi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ssi/xilinx_spi.c
+++ b/hw/ssi/xilinx_spi.c
@@ -XXX,XX +XXX,XX @@ static void xlx_spi_update_irq(XilinxSPI *s)
        irq chain unless things really changed.  */
     if (pending != s->irqline) {
         s->irqline = pending;
-        DB_PRINT("irq_change of state %d ISR:%x IER:%X\n",
+        DB_PRINT("irq_change of state %u ISR:%x IER:%X\n",
                     pending, s->regs[R_IPISR], s->regs[R_IPIER]);
         qemu_set_irq(s->irq, pending);
     }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Operator needs spaces both sides.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-1-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/arch_dump.c | 8 ++++----
 target/arm/arm-semi.c  | 8 ++++----
 target/arm/helper.c    | 2 +-
 3 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/target/arm/arch_dump.c b/target/arm/arch_dump.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arch_dump.c
+++ b/target/arm/arch_dump.c
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
 
     for (i = 0; i < 32; ++i) {
         uint64_t *q = aa64_vfp_qreg(env, i);
-        note.vfp.vregs[2*i + 0] = cpu_to_dump64(s, q[0]);
-        note.vfp.vregs[2*i + 1] = cpu_to_dump64(s, q[1]);
+        note.vfp.vregs[2 * i + 0] = cpu_to_dump64(s, q[0]);
+        note.vfp.vregs[2 * i + 1] = cpu_to_dump64(s, q[1]);
     }
 
     if (s->dump_info.d_endian == ELFDATA2MSB) {
@@ -XXX,XX +XXX,XX @@ static int aarch64_write_elf64_prfpreg(WriteCoreDumpFunction f,
          */
         for (i = 0; i < 32; ++i) {
             uint64_t tmp = note.vfp.vregs[2*i];
-            note.vfp.vregs[2*i] = note.vfp.vregs[2*i+1];
-            note.vfp.vregs[2*i+1] = tmp;
+            note.vfp.vregs[2 * i] = note.vfp.vregs[2 * i + 1];
+            note.vfp.vregs[2 * i + 1] = tmp;
         }
     }
 
diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/arm-semi.c
+++ b/target/arm/arm-semi.c
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         if (use_gdb_syscalls()) {
             arm_semi_open_guestfd = guestfd;
             ret = arm_gdb_syscall(cpu, arm_semi_open_cb, "open,%s,%x,1a4", arg0,
-                                  (int)arg2+1, gdb_open_modeflags[arg1]);
+                                  (int)arg2 + 1, gdb_open_modeflags[arg1]);
         } else {
             ret = set_swi_errno(env, open(s, open_modeflags[arg1], 0644));
             if (ret == (uint32_t)-1) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             ret = arm_gdb_syscall(cpu, arm_semi_cb, "unlink,%s",
-                                  arg0, (int)arg1+1);
+                                  arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(3);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "rename,%s,%s",
-                                   arg0, (int)arg1+1, arg2, (int)arg3+1);
+                                   arg0, (int)arg1 + 1, arg2, (int)arg3 + 1);
         } else {
             char *s2;
             s = lock_user_string(arg0);
@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)
         GET_ARG(1);
         if (use_gdb_syscalls()) {
             return arm_gdb_syscall(cpu, arm_semi_cb, "system,%s",
-                                   arg0, (int)arg1+1);
+                                   arg0, (int)arg1 + 1);
         } else {
             s = lock_user_string(arg0);
             if (!s) {
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ uint32_t HELPER(usad8)(uint32_t a, uint32_t b)
     uint32_t sum;
     sum = do_usad(a, b);
     sum += do_usad(a >> 8, b >> 8);
-    sum += do_usad(a >> 16, b >>16);
+    sum += do_usad(a >> 16, b >> 16);
     sum += do_usad(a >> 24, b >> 24);
     return sum;
 }
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Don't use '#' flag of printf format ('%#') in
format strings, use '0x' prefix instead

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-2-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate-a64.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void disas_simd_three_reg_same_fp16(DisasContext *s, uint32_t insn)
                 gen_helper_advsimd_acgt_f16(tcg_res, tcg_op1, tcg_op2, fpst);
                 break;
             default:
-                fprintf(stderr, "%s: insn %#04x, fpop %#2x @ %#" PRIx64 "\n",
+                fprintf(stderr, "%s: insn 0x%04x, fpop 0x%2x @ 0x%" PRIx64 "\n",
                         __func__, insn, fpopcode, s->pc_curr);
                 g_assert_not_reached();
             }
@@ -XXX,XX +XXX,XX @@ static void disas_simd_two_reg_misc_fp16(DisasContext *s, uint32_t insn)
     case 0x7f: /* FSQRT (vector) */
         break;
     default:
-        fprintf(stderr, "%s: insn %#04x fpop %#2x\n", __func__, insn, fpop);
+        fprintf(stderr, "%s: insn 0x%04x fpop 0x%2x\n", __func__, insn, fpop);
         g_assert_not_reached();
     }
 
-- 
2.20.1

From: Xinhao Zhang <zhangxinhao1@huawei.com>

Fix code style. Space required before the open parenthesis '('.

Signed-off-by: Xinhao Zhang <zhangxinhao1@huawei.com>
Signed-off-by: Kai Deng <dengkai1@huawei.com>
Message-id: 20201103114529.638233-3-zhangxinhao1@huawei.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/translate.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/translate.c b/target/arm/translate.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate.c
+++ b/target/arm/translate.c
@@ -XXX,XX +XXX,XX @@ static void arm_tr_tb_stop(DisasContextBase *dcbase, CPUState *cpu)
             - Hardware watchpoints.
            Hardware breakpoints have already been handled and skip this code.
          */
-        switch(dc->base.is_jmp) {
+        switch (dc->base.is_jmp) {
         case DISAS_NEXT:
         case DISAS_TOO_MANY:
             gen_goto_tb(dc, 1, dc->base.pc_next);
-- 
2.20.1

From: Alex Bennée <alex.bennee@linaro.org>

We should at least document what this machine is about.

Reviewed-by: Graeme Gregory <graeme@nuviainc.com>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
Message-id: 20201104165254.24822-1-alex.bennee@linaro.org
Cc: Leif Lindholm <leif@nuviainc.com>
Cc: Shashi Mallela <shashi.mallela@linaro.org>
Signed-off-by: Alex Bennée <alex.bennee@linaro.org>
[PMM: fixed filename mismatch]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 docs/system/arm/sbsa.rst   | 32 ++++++++++++++++++++++++++++++++
 docs/system/target-arm.rst |  1 +
 2 files changed, 33 insertions(+)
 create mode 100644 docs/system/arm/sbsa.rst

diff --git a/docs/system/arm/sbsa.rst b/docs/system/arm/sbsa.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/system/arm/sbsa.rst
@@ -XXX,XX +XXX,XX @@
+Arm Server Base System Architecture Reference board (``sbsa-ref``)
+==================================================================
+
+While the `virt` board is a generic board platform that doesn't match
+any real hardware the `sbsa-ref` board intends to look like real
+hardware. The `Server Base System Architecture
+<https://developer.arm.com/documentation/den0029/latest>` defines a
+minimum base line of hardware support and importantly how the firmware
+reports that to any operating system. It is a static system that
+reports a very minimal DT to the firmware for non-discoverable
+information about components affected by the qemu command line (i.e.
+cpus and memory). As a result it must have a firmware specifically
+built to expect a certain hardware layout (as you would in a real
+machine).
+
+It is intended to be a machine for developing firmware and testing
+standards compliance with operating systems.
+
+Supported devices
+"""""""""""""""""
+
+The sbsa-ref board supports:
+
+  - A configurable number of AArch64 CPUs
+  - GIC version 3
+  - System bus AHCI controller
+  - System bus EHCI controller
+  - CDROM and hard disc on AHCI bus
+  - E1000E ethernet card on PCIe bus
+  - VGA display adaptor on PCIe bus
+  - A generic SBSA watchdog device
+
diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/target-arm.rst
+++ b/docs/system/target-arm.rst
@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running
    arm/mps2
    arm/musca
    arm/realview
+   arm/sbsa
    arm/versatile
    arm/vexpress
    arm/aspeed
-- 
2.20.1

From: Richard Henderson <richard.henderson@linaro.org>

The helper function did not get updated when we reorganized
the vector register file for SVE.  Since then, the neon dregs
are non-sequential and cannot be simply indexed.

At the same time, make the helper function operate on 64-bit
quantities so that we do not have to call it twice.

Fixes: c39c2b9043e
Reported-by: Ard Biesheuvel <ardb@kernel.org>
Signed-off-by: Richard Henderson <richard.henderson@linaro.org>
[PMM: use aa32_vfp_dreg() rather than opencoding]
Message-id: 20201105171126.88014-1-richard.henderson@linaro.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.h             |  2 +-
 target/arm/op_helper.c          | 23 +++++++++--------
 target/arm/translate-neon.c.inc | 44 +++++++++++----------------------
 3 files changed, 29 insertions(+), 40 deletions(-)

diff --git a/target/arm/helper.h b/target/arm/helper.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.h
+++ b/target/arm/helper.h
@@ -XXX,XX +XXX,XX @@ DEF_HELPER_FLAGS_2(rsqrte_f32, TCG_CALL_NO_RWG, f32, f32, ptr)
 DEF_HELPER_FLAGS_2(rsqrte_f64, TCG_CALL_NO_RWG, f64, f64, ptr)
 DEF_HELPER_FLAGS_1(recpe_u32, TCG_CALL_NO_RWG, i32, i32)
 DEF_HELPER_FLAGS_1(rsqrte_u32, TCG_CALL_NO_RWG, i32, i32)
-DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i32, i32, i32, ptr, i32)
+DEF_HELPER_FLAGS_4(neon_tbl, TCG_CALL_NO_RWG, i64, env, i32, i64, i64)
 
 DEF_HELPER_3(shl_cc, i32, env, i32, i32)
 DEF_HELPER_3(shr_cc, i32, env, i32, i32)
diff --git a/target/arm/op_helper.c b/target/arm/op_helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/op_helper.c
+++ b/target/arm/op_helper.c
@@ -XXX,XX +XXX,XX @@ void raise_exception_ra(CPUARMState *env, uint32_t excp, uint32_t syndrome,
     cpu_loop_exit_restore(cs, ra);
 }
 
-uint32_t HELPER(neon_tbl)(uint32_t ireg, uint32_t def, void *vn,
-                          uint32_t maxindex)
+uint64_t HELPER(neon_tbl)(CPUARMState *env, uint32_t desc,
+                          uint64_t ireg, uint64_t def)
 {
-    uint32_t val, shift;
-    uint64_t *table = vn;
+    uint64_t tmp, val = 0;
+    uint32_t maxindex = ((desc & 3) + 1) * 8;
+    uint32_t base_reg = desc >> 2;
+    uint32_t shift, index, reg;
 
-    val = 0;
-    for (shift = 0; shift < 32; shift += 8) {
-        uint32_t index = (ireg >> shift) & 0xff;
+    for (shift = 0; shift < 64; shift += 8) {
+        index = (ireg >> shift) & 0xff;
         if (index < maxindex) {
-            uint32_t tmp = (table[index >> 3] >> ((index & 7) << 3)) & 0xff;
-            val |= tmp << shift;
+            reg = base_reg + (index >> 3);
+            tmp = *aa32_vfp_dreg(env, reg);
+            tmp = ((tmp >> ((index & 7) << 3)) & 0xff) << shift;
         } else {
-            val |= def & (0xff << shift);
+            tmp = def & (0xffull << shift);
         }
+        val |= tmp;
     }
     return val;
 }
diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VEXT(DisasContext *s, arg_VEXT *a)
 
 static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
 {
-    int n;
-    TCGv_i32 tmp, tmp2, tmp3, tmp4;
-    TCGv_ptr ptr1;
+    TCGv_i64 val, def;
+    TCGv_i32 desc;
 
     if (!arm_dc_feature(s, ARM_FEATURE_NEON)) {
         return false;
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return true;
     }
 
-    n = a->len + 1;
-    if ((a->vn + n) > 32) {
+    if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
          * helper function running off the end of the register file.
          */
         return false;
     }
-    n <<= 3;
-    tmp = tcg_temp_new_i32();
-    if (a->op) {
-        read_neon_element32(tmp, a->vd, 0, MO_32);
-    } else {
-        tcg_gen_movi_i32(tmp, 0);
-    }
-    tmp2 = tcg_temp_new_i32();
-    read_neon_element32(tmp2, a->vm, 0, MO_32);
-    ptr1 = vfp_reg_ptr(true, a->vn);
-    tmp4 = tcg_const_i32(n);
-    gen_helper_neon_tbl(tmp2, tmp2, tmp, ptr1, tmp4);
 
+    desc = tcg_const_i32((a->vn << 2) | a->len);
+    def = tcg_temp_new_i64();
     if (a->op) {
-        read_neon_element32(tmp, a->vd, 1, MO_32);
+        read_neon_element64(def, a->vd, 0, MO_64);
     } else {
-        tcg_gen_movi_i32(tmp, 0);
+        tcg_gen_movi_i64(def, 0);
     }
-    tmp3 = tcg_temp_new_i32();
-    read_neon_element32(tmp3, a->vm, 1, MO_32);
-    gen_helper_neon_tbl(tmp3, tmp3, tmp, ptr1, tmp4);
-    tcg_temp_free_i32(tmp);
-    tcg_temp_free_i32(tmp4);
-    tcg_temp_free_ptr(ptr1);
+    val = tcg_temp_new_i64();
+    read_neon_element64(val, a->vm, 0, MO_64);
 
-    write_neon_element32(tmp2, a->vd, 0, MO_32);
-    write_neon_element32(tmp3, a->vd, 1, MO_32);
-    tcg_temp_free_i32(tmp2);
-    tcg_temp_free_i32(tmp3);
+    gen_helper_neon_tbl(val, cpu_env, desc, val, def);
+    write_neon_element64(val, a->vd, 0, MO_64);
+
+    tcg_temp_free_i64(def);
+    tcg_temp_free_i64(val);
+    tcg_temp_free_i32(desc);
     return true;
 }
 
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We can use one MPC per SRAM bank, but we currently only wire the
IRQ from the first expansion MPC to the IRQ splitter. Fix that.

Fixes: bb75e16d5e6 ("hw/arm/iotkit: Wire up MPC interrupt lines")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-2-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/armsse.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/arm/armsse.c b/hw/arm/armsse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/armsse.c
+++ b/hw/arm/armsse.c
@@ -XXX,XX +XXX,XX @@ static void armsse_realize(DeviceState *dev, Error **errp)
                                         qdev_get_gpio_in(dev_splitter, 0));
             qdev_connect_gpio_out(dev_splitter, 0,
                                   qdev_get_gpio_in_named(dev_secctl,
-                                                         "mpc_status", 0));
+                                                         "mpc_status",
+                                                         i - IOTS_NUM_EXP_MPC));
         }
 
         qdev_connect_gpio_out(dev_splitter, 1,
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The system configuration controller (SYSCFG) doesn't have
any output IRQ (and the INTC input #71 belongs to the UART6).
Remove the invalid code.

Fixes: db635521a02 ("stm32f205: Add the stm32f205 SoC")
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-3-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/misc/stm32f2xx_syscfg.h | 2 --
 hw/arm/stm32f205_soc.c             | 1 -
 hw/misc/stm32f2xx_syscfg.c         | 2 --
 3 files changed, 5 deletions(-)

diff --git a/include/hw/misc/stm32f2xx_syscfg.h b/include/hw/misc/stm32f2xx_syscfg.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/misc/stm32f2xx_syscfg.h
+++ b/include/hw/misc/stm32f2xx_syscfg.h
@@ -XXX,XX +XXX,XX @@ struct STM32F2XXSyscfgState {
     uint32_t syscfg_exticr3;
     uint32_t syscfg_exticr4;
     uint32_t syscfg_cmpcr;
-
-    qemu_irq irq;
 };
 
 #endif /* HW_STM32F2XX_SYSCFG_H */
diff --git a/hw/arm/stm32f205_soc.c b/hw/arm/stm32f205_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/stm32f205_soc.c
+++ b/hw/arm/stm32f205_soc.c
@@ -XXX,XX +XXX,XX @@ static void stm32f205_soc_realize(DeviceState *dev_soc, Error **errp)
     }
     busdev = SYS_BUS_DEVICE(dev);
     sysbus_mmio_map(busdev, 0, 0x40013800);
-    sysbus_connect_irq(busdev, 0, qdev_get_gpio_in(armv7m, 71));
 
     /* Attach UART (uses USART registers) and USART controllers */
     for (i = 0; i < STM_NUM_USARTS; i++) {
diff --git a/hw/misc/stm32f2xx_syscfg.c b/hw/misc/stm32f2xx_syscfg.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/misc/stm32f2xx_syscfg.c
+++ b/hw/misc/stm32f2xx_syscfg.c
@@ -XXX,XX +XXX,XX @@ static void stm32f2xx_syscfg_init(Object *obj)
 {
     STM32F2XXSyscfgState *s = STM32F2XX_SYSCFG(obj);
 
-    sysbus_init_irq(SYS_BUS_DEVICE(obj), &s->irq);
-
     memory_region_init_io(&s->mmio, obj, &stm32f2xx_syscfg_ops, s,
                           TYPE_STM32F2XX_SYSCFG, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(obj), &s->mmio);
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

omap2420_mpu_init() introduced in commit 827df9f3c5f ("Add basic
OMAP2 chip support") takes care of creating the 3 UARTs.

Then commit 58a26b477e9 ("Emulate a serial bluetooth HCI with H4+
extensions and attach to n8x0's UART") added n8x0_uart_setup()
which create the UART and connects it to an IRQ output,
overwritting the existing peripheral and its IRQ connection.
This is incorrect.

Fortunately we don't need to fix this, because commit 6da68df7f9b
("hw/arm/nseries: Replace the bluetooth chardev with a "null"
chardev") removed the use of this peripheral. We can simply
remove the code.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-4-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/nseries.c | 11 -----------
 1 file changed, 11 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_cbus_setup(struct n800_s *s)
     cbus_attach(cbus, s->tahvo = tahvo_init(tahvo_irq, 1));
 }
 
-static void n8x0_uart_setup(struct n800_s *s)
-{
-    Chardev *radio = qemu_chr_new("bt-dummy-uart", "null", NULL);
-    /*
-     * Note: We used to connect N8X0_BT_RESET_GPIO and N8X0_BT_WKUP_GPIO
-     * here, but this code has been removed with the bluetooth backend.
-     */
-    omap_uart_attach(s->mpu->uart[BT_UART], radio);
-}
-
 static void n8x0_usb_setup(struct n800_s *s)
 {
     SysBusDevice *dev;
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
     n8x0_spi_setup(s);
     n8x0_dss_setup(s);
     n8x0_cbus_setup(s);
-    n8x0_uart_setup(s);
     if (machine_usb(machine)) {
         n8x0_usb_setup(s);
     }
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The MusicPal board code connects both of the IRQ outputs of the UART
to the same INTC qemu_irq. Connecting two qemu_irqs outputs directly
to the same input is not valid as it produces subtly wrong behaviour
(for instance if both the IRQ lines are high, and then one goes
low, the INTC input will see this as a high-to-low transition
even though the second IRQ line should still be holding it high).

This kind of wiring needs an explicitly created OR gate; add one.

Inspired-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-5-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 17 +++++++++++++----
 hw/arm/Kconfig    |  1 +
 2 files changed, 14 insertions(+), 4 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@
 #include "ui/console.h"
 #include "hw/i2c/i2c.h"
 #include "hw/irq.h"
+#include "hw/or-irq.h"
 #include "hw/audio/wm8750.h"
 #include "sysemu/block-backend.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@
 #define MP_TIMER4_IRQ           7
 #define MP_EHCI_IRQ             8
 #define MP_ETH_IRQ              9
-#define MP_UART1_IRQ            11
-#define MP_UART2_IRQ            11
+#define MP_UART_SHARED_IRQ      11
 #define MP_GPIO_IRQ             12
 #define MP_RTC_IRQ              28
 #define MP_AUDIO_IRQ            30
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
     ARMCPU *cpu;
     qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
     DeviceState *key_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                           pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
                           pic[MP_TIMER4_IRQ], NULL);
 
-    serial_mm_init(address_space_mem, MP_UART1_BASE, 2, pic[MP_UART1_IRQ],
+    /* Logically OR both UART IRQs together */
+    uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
+    object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
+    qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+
+    serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 0),
                    1825000, serial_hd(0), DEVICE_NATIVE_ENDIAN);
-    serial_mm_init(address_space_mem, MP_UART2_BASE, 2, pic[MP_UART2_IRQ],
+    serial_mm_init(address_space_mem, MP_UART2_BASE, 2,
+                   qdev_get_gpio_in(uart_orgate, 1),
                    1825000, serial_hd(1), DEVICE_NATIVE_ENDIAN);
 
     /* Register flash */
diff --git a/hw/arm/Kconfig b/hw/arm/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/Kconfig
+++ b/hw/arm/Kconfig
@@ -XXX,XX +XXX,XX @@ config MUSCA
 
 config MUSICPAL
     bool
+    select OR_IRQ
     select BITBANG_I2C
     select MARVELL_88W8618
     select PTIMER
-- 
2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

We don't need to fill the full pic[] array if we only use
few of the interrupt lines. Directly call qdev_get_gpio_in()
when necessary.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201107193403.436146-6-f4bug@amsat.org
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/musicpal.c | 25 +++++++++++++------------
 1 file changed, 13 insertions(+), 12 deletions(-)

diff --git a/hw/arm/musicpal.c b/hw/arm/musicpal.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/musicpal.c
+++ b/hw/arm/musicpal.c
@@ -XXX,XX +XXX,XX @@ static struct arm_boot_info musicpal_binfo = {
 static void musicpal_init(MachineState *machine)
 {
     ARMCPU *cpu;
-    qemu_irq pic[32];
     DeviceState *dev;
+    DeviceState *pic;
     DeviceState *uart_orgate;
     DeviceState *i2c_dev;
     DeviceState *lcd_dev;
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                            &error_fatal);
     memory_region_add_subregion(address_space_mem, MP_SRAM_BASE, sram);
 
-    dev = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
+    pic = sysbus_create_simple(TYPE_MV88W8618_PIC, MP_PIC_BASE,
                                qdev_get_gpio_in(DEVICE(cpu), ARM_CPU_IRQ));
-    for (i = 0; i < 32; i++) {
-        pic[i] = qdev_get_gpio_in(dev, i);
-    }
-    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE, pic[MP_TIMER1_IRQ],
-                          pic[MP_TIMER2_IRQ], pic[MP_TIMER3_IRQ],
-                          pic[MP_TIMER4_IRQ], NULL);
+    sysbus_create_varargs(TYPE_MV88W8618_PIT, MP_PIT_BASE,
+                          qdev_get_gpio_in(pic, MP_TIMER1_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER2_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER3_IRQ),
+                          qdev_get_gpio_in(pic, MP_TIMER4_IRQ), NULL);
 
     /* Logically OR both UART IRQs together */
     uart_orgate = DEVICE(object_new(TYPE_OR_IRQ));
     object_property_set_int(OBJECT(uart_orgate), "num-lines", 2, &error_fatal);
     qdev_realize_and_unref(uart_orgate, NULL, &error_fatal);
-    qdev_connect_gpio_out(DEVICE(uart_orgate), 0, pic[MP_UART_SHARED_IRQ]);
+    qdev_connect_gpio_out(DEVICE(uart_orgate), 0,
+                          qdev_get_gpio_in(pic, MP_UART_SHARED_IRQ));
 
     serial_mm_init(address_space_mem, MP_UART1_BASE, 2,
                    qdev_get_gpio_in(uart_orgate, 0),
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              OBJECT(get_system_memory()), &error_fatal);
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, MP_ETH_BASE);
-    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0, pic[MP_ETH_IRQ]);
+    sysbus_connect_irq(SYS_BUS_DEVICE(dev), 0,
+                       qdev_get_gpio_in(pic, MP_ETH_IRQ));
 
     sysbus_create_simple("mv88w8618_wlan", MP_WLAN_BASE, NULL);
 
     sysbus_create_simple(TYPE_MUSICPAL_MISC, MP_MISC_BASE, NULL);
 
     dev = sysbus_create_simple(TYPE_MUSICPAL_GPIO, MP_GPIO_BASE,
-                               pic[MP_GPIO_IRQ]);
+                               qdev_get_gpio_in(pic, MP_GPIO_IRQ));
     i2c_dev = sysbus_create_simple("gpio_i2c", -1, NULL);
     i2c = (I2CBus *)qdev_get_child_bus(i2c_dev, "i2c");
 
@@ -XXX,XX +XXX,XX @@ static void musicpal_init(MachineState *machine)
                              NULL);
     sysbus_realize_and_unref(s, &error_fatal);
     sysbus_mmio_map(s, 0, MP_AUDIO_BASE);
-    sysbus_connect_irq(s, 0, pic[MP_AUDIO_IRQ]);
+    sysbus_connect_irq(s, 0, qdev_get_gpio_in(pic, MP_AUDIO_IRQ));
 
     musicpal_binfo.ram_size = MP_RAM_DEFAULT_SIZE;
     arm_load_kernel(cpu, machine, &musicpal_binfo);
-- 
2.20.1

The nseries machines have a codepath that allows them to load a
secondary bootloader.  This code wasn't checking that the
load_image_targphys() succeeded.  Check the return value and report
the error to the user.

While we're in the vicinity, fix the comment style of the
comment documenting what this image load is doing.

Fixes: Coverity CID 1192904
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20201103114918.11807-1-peter.maydell@linaro.org
---
 hw/arm/nseries.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/arm/nseries.c b/hw/arm/nseries.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/nseries.c
+++ b/hw/arm/nseries.c
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
         /* No, wait, better start at the ROM.  */
         s->mpu->cpu->env.regs[15] = OMAP2_Q2_BASE + 0x400000;
 
-        /* This is intended for loading the `secondary.bin' program from
+        /*
+         * This is intended for loading the `secondary.bin' program from
          * Nokia images (the NOLO bootloader).  The entry point seems
          * to be at OMAP2_Q2_BASE + 0x400000.
          *
@@ -XXX,XX +XXX,XX @@ static void n8x0_init(MachineState *machine,
          * for them the entry point needs to be set to OMAP2_SRAM_BASE.
          *
          * The code above is for loading the `zImage' file from Nokia
-         * images.  */
-        load_image_targphys(option_rom[0].name, OMAP2_Q2_BASE + 0x400000,
-                            machine->ram_size - 0x400000);
+         * images.
+         */
+        if (load_image_targphys(option_rom[0].name,
+                                OMAP2_Q2_BASE + 0x400000,
+                                machine->ram_size - 0x400000) < 0) {
+            error_report("Failed to load secondary bootloader %s",
+                         option_rom[0].name);
+            exit(EXIT_FAILURE);
+        }
 
         n800_setup_nolo_tags(nolo_tags);
         cpu_physical_memory_write(OMAP2_SRAM_BASE, nolo_tags, 0x10000);
-- 
2.20.1

From: Havard Skinnemoen <hskinnemoen@google.com>

The number of runs is equal to the number of 0-1 and 1-0 transitions,
plus one. Currently, it's counting the number of times these transitions
do _not_ happen, plus one.

Source:
https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-22r1a.pdf
section 2.3.4 point (3).

Signed-off-by: Havard Skinnemoen <hskinnemoen@google.com>
Message-id: 20201103011457.2959989-2-hskinnemoen@google.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 tests/qtest/npcm7xx_rng-test.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qtest/npcm7xx_rng-test.c b/tests/qtest/npcm7xx_rng-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/npcm7xx_rng-test.c
+++ b/tests/qtest/npcm7xx_rng-test.c
@@ -XXX,XX +XXX,XX @@ static double calc_runs_p(const unsigned long *buf, unsigned int nr_bits)
     pi = (double)nr_ones / nr_bits;
 
     for (k = 0; k < nr_bits - 1; k++) {
-        vn_obs += !(test_bit(k, buf) ^ test_bit(k + 1, buf));
+        vn_obs += (test_bit(k, buf) ^ test_bit(k + 1, buf));
     }
     vn_obs += 1;
 
-- 
2.20.1

Checks for UNDEF cases should go before the "is VFP enabled?" access
check, except in special cases. Move a stray UNDEF check in the VTBL
trans function up above the access check.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20201109145324.2859-1-peter.maydell@linaro.org
---
 target/arm/translate-neon.c.inc | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/target/arm/translate-neon.c.inc b/target/arm/translate-neon.c.inc
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-neon.c.inc
+++ b/target/arm/translate-neon.c.inc
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
-    if (!vfp_access_check(s)) {
-        return true;
-    }
-
     if ((a->vn + a->len + 1) > 32) {
         /*
          * This is UNPREDICTABLE; we choose to UNDEF to avoid the
@@ -XXX,XX +XXX,XX @@ static bool trans_VTBL(DisasContext *s, arg_VTBL *a)
         return false;
     }
 
+    if (!vfp_access_check(s)) {
+        return true;
+    }
+
     desc = tcg_const_i32((a->vn << 2) | a->len);
     def = tcg_temp_new_i64();
     if (a->op) {
-- 
2.20.1

A last small test of bug fixes before rc1.

thanks
-- PMM

The following changes since commit ed8ad9728a9c0eec34db9dff61dfa2f1dd625637:

Merge tag 'pull-tpm-2023-07-14-1' of https://github.com/stefanberger/qemu-tpm into staging (2023-07-15 14:54:04 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230717

for you to fetch changes up to c2c1c4a35c7c2b1a4140b0942b9797c857e476a4:

hw/nvram: Avoid unnecessary Xilinx eFuse backstore write (2023-07-17 11:05:52 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/sbsa-ref: set 'slots' property of xhci
 * linux-user: Remove pointless NULL check in clock_adjtime handling
 * ptw: Fix S1_ptw_translate() debug path
 * ptw: Account for FEAT_RME when applying {N}SW, SA bits
 * accel/tcg: Zero-pad PC in TCG CPU exec trace lines
 * hw/nvram: Avoid unnecessary Xilinx eFuse backstore write

----------------------------------------------------------------
Peter Maydell (5):
      linux-user: Remove pointless NULL check in clock_adjtime handling
      target/arm/ptw.c: Add comments to S1Translate struct fields
      target/arm: Fix S1_ptw_translate() debug path
      target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
      accel/tcg: Zero-pad PC in TCG CPU exec trace lines

Tong Ho (1):
      hw/nvram: Avoid unnecessary Xilinx eFuse backstore write

Yuquan Wang (1):
      hw/arm/sbsa-ref: set 'slots' property of xhci

From: Yuquan Wang <wangyuquan1236@phytium.com.cn>

This extends the slots of xhci to 64, since the default xhci_sysbus
just supports one slot.

Signed-off-by: Wang Yuquan <wangyuquan1236@phytium.com.cn>
Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20230710063750.473510-2-wangyuquan1236@phytium.com.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static void create_xhci(const SBSAMachineState *sms)
     hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
     int irq = sbsa_ref_irqmap[SBSA_XHCI];
     DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
+    qdev_prop_set_uint32(dev, "slots", XHCI_MAXSLOTS);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
-- 
2.34.1

In the code for TARGET_NR_clock_adjtime, we set the pointer phtx to
the address of the local variable htx.  This means it can never be
NULL, but later in the code we check it for NULL anyway.  Coverity
complains about this (CID 1507683) because the NULL check comes after
a call to clock_adjtime() that assumes it is non-NULL.

Since phtx is always &htx, and is used only in three places, it's not
really necessary.  Remove it, bringing the code structure in to line
with that for TARGET_NR_clock_adjtime64, which already uses a simple
'&htx' when it wants a pointer to 'htx'.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230623144410.1837261-1-peter.maydell@linaro.org
---
 linux-user/syscall.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
     case TARGET_NR_clock_adjtime:
         {
-            struct timex htx, *phtx = &htx;
+            struct timex htx;
 
-            if (target_to_host_timex(phtx, arg2) != 0) {
+            if (target_to_host_timex(&htx, arg2) != 0) {
                 return -TARGET_EFAULT;
             }
-            ret = get_errno(clock_adjtime(arg1, phtx));
-            if (!is_error(ret) && phtx) {
-                if (host_to_target_timex(arg2, phtx) != 0) {
-                    return -TARGET_EFAULT;
-                }
+            ret = get_errno(clock_adjtime(arg1, &htx));
+            if (!is_error(ret) && host_to_target_timex(arg2, &htx)) {
+                return -TARGET_EFAULT;
             }
         }
         return ret;
-- 
2.34.1

Add comments to the in_* fields in the S1Translate struct
that explain what they're doing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-2-peter.maydell@linaro.org
---
 target/arm/ptw.c | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@
 #endif
 
 typedef struct S1Translate {
+    /*
+     * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
+     * Together with in_space, specifies the architectural translation regime.
+     */
     ARMMMUIdx in_mmu_idx;
+    /*
+     * in_ptw_idx: specifies which mmuidx to use for the actual
+     * page table descriptor load operations. This will be one of the
+     * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     */
     ARMMMUIdx in_ptw_idx;
+    /*
+     * in_space: the security space for this walk. This plus
+     * the in_mmu_idx specify the architectural translation regime.
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     *
+     * Note that the security space for the in_ptw_idx may be different
+     * from that for the in_mmu_idx. We do not need to explicitly track
+     * the in_ptw_idx security space because:
+     *  - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
+     *    itself specifies the security space
+     *  - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
+     *    space used for ptw reads is the same as that of the security
+     *    space of the stage 1 translation for all cases except where
+     *    stage 1 is Secure; in that case the only possibilities for
+     *    the ptw read are Secure and NonSecure, and the in_ptw_idx
+     *    value being Stage2 vs Stage2_S distinguishes those.
+     */
     ARMSecuritySpace in_space;
+    /*
+     * in_secure: whether the translation regime is a Secure one.
+     * This is always equal to arm_space_is_secure(in_space).
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     */
     bool in_secure;
+    /*
+     * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
+     * accesses will not update the guest page table access flags
+     * and will not change the state of the softmmu TLBs.
+     */
     bool in_debug;
     /*
      * If this is stage 2 of a stage 1+2 page table walk, then this must
-- 
2.34.1

In commit fe4a5472ccd6 we rearranged the logic in S1_ptw_translate()
so that the debug-access "call get_phys_addr_*" codepath is used both
when S1 is doing ptw reads from stage 2 and when it is doing ptw
reads from physical memory.  However, we didn't update the
calculation of s2ptw->in_space and s2ptw->in_secure to account for
the "ptw reads from physical memory" case.  This meant that debug
accesses when in Secure state broke.

Create a new function S2_security_space() which returns the
correct security space to use for the ptw load, and use it to
determine the correct .in_secure and .in_space fields for the
stage 2 lookup for the ptw load.

Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org
Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 37 ++++++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
     }
 }
 
+static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
+                                          ARMMMUIdx s2_mmu_idx)
+{
+    /*
+     * Return the security space to use for stage 2 when doing
+     * the S1 page table descriptor load.
+     */
+    if (regime_is_stage2(s2_mmu_idx)) {
+        /*
+         * The security space for ptw reads is almost always the same
+         * as that of the security space of the stage 1 translation.
+         * The only exception is when stage 1 is Secure; in that case
+         * the ptw read might be to the Secure or the NonSecure space
+         * (but never Realm or Root), and the s2_mmu_idx tells us which.
+         * Root translations are always single-stage.
+         */
+        if (s1_space == ARMSS_Secure) {
+            return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
+        } else {
+            assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
+            assert(s1_space != ARMSS_Root);
+            return s1_space;
+        }
+    } else {
+        /* ptw loads are from phys: the mmu idx itself says which space */
+        return arm_phys_to_space(s2_mmu_idx);
+    }
+}
+
 /* Translate a S1 pagetable walk through S2 if needed.  */
 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                              hwaddr addr, ARMMMUFaultInfo *fi)
 {
-    ARMSecuritySpace space = ptw->in_space;
     bool is_secure = ptw->in_secure;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
          * From gdbstub, do not use softmmu so that we don't modify the
          * state of the cpu at all, including softmmu tlb contents.
          */
+        ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
         S1Translate s2ptw = {
             .in_mmu_idx = s2_mmu_idx,
             .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
-            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
-                         : space == ARMSS_Realm ? ARMSS_Realm
-                         : ARMSS_NonSecure),
+            .in_secure = arm_space_is_secure(s2_space),
+            .in_space = s2_space,
             .in_debug = true,
         };
         GetPhysAddrResult s2 = { };
-- 
2.34.1

In get_phys_addr_twostage() the code that applies the effects of
VSTCR.{SA,SW} and VTCR.{NSA,NSW} only updates result->f.attrs.secure.
Now we also have f.attrs.space for FEAT_RME, we need to keep the two
in sync.

These bits only have an effect for Secure space translations, not
for Root, so use the input in_space field to determine whether to
apply them rather than the input is_secure. This doesn't actually
make a difference because Root translations are never two-stage,
but it's a little clearer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-4-peter.maydell@linaro.org
---
 target/arm/ptw.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     hwaddr ipa;
     int s1_prot, s1_lgpgsz;
     bool is_secure = ptw->in_secure;
+    ARMSecuritySpace in_space = ptw->in_space;
     bool ret, ipa_secure;
     ARMCacheAttrs cacheattrs1;
     ARMSecuritySpace ipa_space;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      * Check if IPA translates to secure or non-secure PA space.
      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
      */
-    result->f.attrs.secure =
-        (is_secure
-         && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
-         && (ipa_secure
-             || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
+    if (in_space == ARMSS_Secure) {
+        result->f.attrs.secure =
+            !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
+            && (ipa_secure
+                || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
+        result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
+    }
 
     return false;
 }
-- 
2.34.1

In commit f0a08b0913befbd we changed the type of the PC from
target_ulong to vaddr.  In doing so we inadvertently dropped the
zero-padding on the PC in trace lines (the second item inside the []
in these lines).  They used to look like this on AArch64, for
instance:

Trace 0: 0x7f2260000100 [00000000/0000000040000000/00000061/ff200000]

and now they look like this:
Trace 0: 0x7f4f50000100 [00000000/40000000/00000061/ff200000]

and if the PC happens to be somewhere low like 0x5000
then the field is shown as /5000/.

This is because TARGET_FMT_lx is a "%08x" or "%016x" specifier,
depending on TARGET_LONG_SIZE, whereas VADDR_PRIx is just PRIx64
with no width specifier.

Restore the zero-padding by adding an 016 width specifier to
this tracing and a couple of others that were similarly recently
changed to use VADDR_PRIx without a width specifier.

We can't unfortunately restore the "32-bit guests are padded to
8 hex digits and 64-bit guests to 16 hex digits" behaviour so
easily.

Fixes: f0a08b0913befbd ("accel/tcg/cpu-exec.c: Widen pc to vaddr")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-id: 20230711165434.4123674-1-peter.maydell@linaro.org
---
 accel/tcg/cpu-exec.c      | 4 ++--
 accel/tcg/translate-all.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static void log_cpu_exec(vaddr pc, CPUState *cpu,
     if (qemu_log_in_addr_range(pc)) {
         qemu_log_mask(CPU_LOG_EXEC,
                       "Trace %d: %p [%08" PRIx64
-                      "/%" VADDR_PRIx "/%08x/%08x] %s\n",
+                      "/%016" VADDR_PRIx "/%08x/%08x] %s\n",
                       cpu->cpu_index, tb->tc.ptr, tb->cs_base, pc,
                       tb->flags, tb->cflags, lookup_symbol(pc));
 
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
         if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
             vaddr pc = log_pc(cpu, last_tb);
             if (qemu_log_in_addr_range(pc)) {
-                qemu_log("Stopped execution of TB chain before %p [%"
+                qemu_log("Stopped execution of TB chain before %p [%016"
                          VADDR_PRIx "] %s\n",
                          last_tb->tc.ptr, pc, lookup_symbol(pc));
             }
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
         vaddr pc = log_pc(cpu, tb);
         if (qemu_log_in_addr_range(pc)) {
-            qemu_log("cpu_io_recompile: rewound execution of TB to %"
+            qemu_log("cpu_io_recompile: rewound execution of TB to %016"
                      VADDR_PRIx "\n", pc);
         }
     }
-- 
2.34.1

From: Tong Ho <tong.ho@amd.com>

Add a check in the bit-set operation to write the backstore
only if the affected bit is 0 before.

With this in place, there will be no need for callers to
do the checking in order to avoid unnecessary writes.

Signed-off-by: Tong Ho <tong.ho@amd.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/nvram/xlnx-efuse.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/nvram/xlnx-efuse.c b/hw/nvram/xlnx-efuse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/xlnx-efuse.c
+++ b/hw/nvram/xlnx-efuse.c
@@ -XXX,XX +XXX,XX @@ static bool efuse_ro_bits_find(XlnxEFuse *s, uint32_t k)
 
 bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
 {
+    uint32_t set, *row;
+
     if (efuse_ro_bits_find(s, bit)) {
         g_autofree char *path = object_get_canonical_path(OBJECT(s));
 
@@ -XXX,XX +XXX,XX @@ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
         return false;
     }
 
-    s->fuse32[bit / 32] |= 1 << (bit % 32);
-    efuse_bdrv_sync(s, bit);
+    /* Avoid back-end write unless there is a real update */
+    row = &s->fuse32[bit / 32];
+    set = 1 << (bit % 32);
+    if (!(set & *row)) {
+        *row |= set;
+        efuse_bdrv_sync(s, bit);
+    }
     return true;
 }
 
-- 
2.34.1