Series comparison

-[PULL 0/6] target-arm queue
+[PULL 0/7] target-arm queue
-Some small arm bug fixes for rc3.
+A last small test of bug fixes before rc1.
+thanks
 -- PMM
-The following changes since commit 9b617b1bb4056e60b39be4c33be20c10928a6a5c:
+The following changes since commit ed8ad9728a9c0eec34db9dff61dfa2f1dd625637:
-  Merge tag 'trivial-branch-for-7.0-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-04-01 10:23:27 +0100)
+  Merge tag 'pull-tpm-2023-07-14-1' of https://github.com/stefanberger/qemu-tpm into staging (2023-07-15 14:54:04 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220401
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230717
-for you to fetch changes up to a5b1e1ab662aa6dc42d5a913080fccbb8bf82e9b:
+for you to fetch changes up to c2c1c4a35c7c2b1a4140b0942b9797c857e476a4:
-  target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen (2022-04-01 15:35:49 +0100)
+  hw/nvram: Avoid unnecessary Xilinx eFuse backstore write (2023-07-17 11:05:52 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * target/arm: Fix some bugs in secure EL2 handling
+ * hw/arm/sbsa-ref: set 'slots' property of xhci
- * target/arm: Fix assert when !HAVE_CMPXCHG128
+ * linux-user: Remove pointless NULL check in clock_adjtime handling
- * MAINTAINERS: change Fred Konrad's email address
+ * ptw: Fix S1_ptw_translate() debug path
  * ptw: Account for FEAT_RME when applying {N}SW, SA bits
  * accel/tcg: Zero-pad PC in TCG CPU exec trace lines
  * hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
 ----------------------------------------------------------------
-Frederic Konrad (1):
+Peter Maydell (5):
-      MAINTAINERS: change Fred Konrad's email address
+      linux-user: Remove pointless NULL check in clock_adjtime handling
       target/arm/ptw.c: Add comments to S1Translate struct fields
       target/arm: Fix S1_ptw_translate() debug path
       target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
       accel/tcg: Zero-pad PC in TCG CPU exec trace lines
-Idan Horowitz (4):
+Tong Ho (1):
-      target/arm: Fix MTE access checks for disabled SEL2
+      hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
       target/arm: Check VSTCR.SW when assigning the stage 2 output PA space
       target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk
       target/arm: Determine final stage 2 output PA space based on original IPA
-Peter Maydell (1):
+Yuquan Wang (1):
-      target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen
+      hw/arm/sbsa-ref: set 'slots' property of xhci
- target/arm/internals.h     |  2 +-
+ accel/tcg/cpu-exec.c      |  4 +--
- target/arm/helper.c        | 18 +++++++++++++++---
+ accel/tcg/translate-all.c |  2 +-
- target/arm/translate-a64.c |  7 ++++++-
+ hw/arm/sbsa-ref.c         |  1 +
- .mailmap                   |  3 ++-
+ hw/nvram/xlnx-efuse.c     | 11 ++++--
- MAINTAINERS                |  2 +-
+ linux-user/syscall.c      | 12 +++----
-files changed, 25 insertions(+), 7 deletions(-)
+ target/arm/ptw.c          | 90 +++++++++++++++++++++++++++++++++++++++++------
 files changed, 98 insertions(+), 22 deletions(-)

-[PULL 4/6] target/arm: Determine final stage 2 output PA space based on original IPA
+[PULL 1/7] hw/arm/sbsa-ref: set 'slots' property of xhci
-From: Idan Horowitz <idan.horowitz@gmail.com>
+From: Yuquan Wang <wangyuquan1236@phytium.com.cn>
-As per the AArch64.S2Walk() pseudo-code in the ARMv8 ARM, the final
+This extends the slots of xhci to 64, since the default xhci_sysbus
-decision as to the output address's PA space based on the SA/SW/NSA/NSW
+just supports one slot.
 bits needs to take the input IPA's PA space into account, and not the
 PA space of the result of the stage 2 walk itself.
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
+Signed-off-by: Wang Yuquan <wangyuquan1236@phytium.com.cn>
 Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220327093427.1548629-4-idan.horowitz@gmail.com
+Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-[PMM: fixed commit message typo]
+Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
 Message-id: 20230710063750.473510-2-wangyuquan1236@phytium.com.cn
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 8 +++++---
+ hw/arm/sbsa-ref.c | 1 +
-file changed, 5 insertions(+), 3 deletions(-)
+file changed, 1 insertion(+)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/hw/arm/sbsa-ref.c
-+++ b/target/arm/helper.c
++++ b/hw/arm/sbsa-ref.c
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ static void create_xhci(const SBSAMachineState *sms)
-             hwaddr ipa;
+     hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
-             int s2_prot;
+     int irq = sbsa_ref_irqmap[SBSA_XHCI];
-             int ret;
+     DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
-+            bool ipa_secure;
++    qdev_prop_set_uint32(dev, "slots", XHCI_MAXSLOTS);
-             ARMCacheAttrs cacheattrs2 = {};
-             ARMMMUIdx s2_mmu_idx;
+     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-             bool is_el0;
+     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                  return ret;
              }
 +            ipa_secure = attrs->secure;
              if (arm_is_secure_below_el3(env)) {
 -                if (attrs->secure) {
 +                if (ipa_secure) {
                      attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
                  } else {
                      attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
                  }
              } else {
 -                assert(!attrs->secure);
 +                assert(!ipa_secure);
              }
              s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
              /* Check if IPA translates to secure or non-secure PA space. */
              if (arm_is_secure_below_el3(env)) {
 -                if (attrs->secure) {
 +                if (ipa_secure) {
                      attrs->secure =
                          !(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));
                  } else {
 --
-.25.1
+.34.1

-[PULL 3/6] target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk
+[PULL 2/7] linux-user: Remove pointless NULL check in clock_adjtime handling
-From: Idan Horowitz <idan.horowitz@gmail.com>
+In the code for TARGET_NR_clock_adjtime, we set the pointer phtx to
 the address of the local variable htx.  This means it can never be
 NULL, but later in the code we check it for NULL anyway.  Coverity
 complains about this (CID 1507683) because the NULL check comes after
 a call to clock_adjtime() that assumes it is non-NULL.
-As per the AArch64.SS2InitialTTWState() psuedo-code in the ARMv8 ARM the
+Since phtx is always &htx, and is used only in three places, it's not
-initial PA space used for stage 2 table walks is assigned based on the SW
+really necessary.  Remove it, bringing the code structure in to line
-and NSW bits of the VSTCR and VTCR registers.
+with that for TARGET_NR_clock_adjtime64, which already uses a simple
-This was already implemented for the recursive stage 2 page table walks
+'&htx' when it wants a pointer to 'htx'.
 in S1_ptw_translate(), but was missing for the final stage 2 walk.
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220327093427.1548629-3-idan.horowitz@gmail.com
+Message-id: 20230623144410.1837261-1-peter.maydell@linaro.org
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 10 ++++++++++
+ linux-user/syscall.c | 12 +++++-------
-file changed, 10 insertions(+)
+file changed, 5 insertions(+), 7 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/linux-user/syscall.c b/linux-user/syscall.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/linux-user/syscall.c
-+++ b/target/arm/helper.c
++++ b/linux-user/syscall.c
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
-                 return ret;
+ #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
      case TARGET_NR_clock_adjtime:
          {
 -            struct timex htx, *phtx = &htx;
 +            struct timex htx;
 -            if (target_to_host_timex(phtx, arg2) != 0) {
 +            if (target_to_host_timex(&htx, arg2) != 0) {
                  return -TARGET_EFAULT;
              }
+-            ret = get_errno(clock_adjtime(arg1, phtx));
-+            if (arm_is_secure_below_el3(env)) {
+-            if (!is_error(ret) && phtx) {
-+                if (attrs->secure) {
+-                if (host_to_target_timex(arg2, phtx) != 0) {
-+                    attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
+-                    return -TARGET_EFAULT;
-+                } else {
+-                }
-+                    attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
++            ret = get_errno(clock_adjtime(arg1, &htx));
-+                }
++            if (!is_error(ret) && host_to_target_timex(arg2, &htx)) {
-+            } else {
++                return -TARGET_EFAULT;
-+                assert(!attrs->secure);
+             }
-+            }
+         }
-+
+         return ret;
              s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
              is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
 --
-.25.1
+.34.1

-New patch
+[PULL 3/7] target/arm/ptw.c: Add comments to S1Translate struct fields
+Add comments to the in_* fields in the S1Translate struct
+that explain what they're doing.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Message-id: 20230710152130.3928330-2-peter.maydell@linaro.org
+---
+ target/arm/ptw.c | 40 ++++++++++++++++++++++++++++++++++++++++
+file changed, 40 insertions(+)
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
+index XXXXXXX..XXXXXXX 100644
+--- a/target/arm/ptw.c
++++ b/target/arm/ptw.c
+@@ -XXX,XX +XXX,XX @@
+ #endif
+ typedef struct S1Translate {
++    /*
++     * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
++     * Together with in_space, specifies the architectural translation regime.
++     */
+     ARMMMUIdx in_mmu_idx;
++    /*
++     * in_ptw_idx: specifies which mmuidx to use for the actual
++     * page table descriptor load operations. This will be one of the
++     * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
++     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
++     * this field is updated accordingly.
++     */
+     ARMMMUIdx in_ptw_idx;
++    /*
++     * in_space: the security space for this walk. This plus
++     * the in_mmu_idx specify the architectural translation regime.
++     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
++     * this field is updated accordingly.
++     *
++     * Note that the security space for the in_ptw_idx may be different
++     * from that for the in_mmu_idx. We do not need to explicitly track
++     * the in_ptw_idx security space because:
++     *  - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
++     *    itself specifies the security space
++     *  - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
++     *    space used for ptw reads is the same as that of the security
++     *    space of the stage 1 translation for all cases except where
++     *    stage 1 is Secure; in that case the only possibilities for
++     *    the ptw read are Secure and NonSecure, and the in_ptw_idx
++     *    value being Stage2 vs Stage2_S distinguishes those.
++     */
+     ARMSecuritySpace in_space;
++    /*
++     * in_secure: whether the translation regime is a Secure one.
++     * This is always equal to arm_space_is_secure(in_space).
++     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
++     * this field is updated accordingly.
++     */
+     bool in_secure;
++    /*
++     * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
++     * accesses will not update the guest page table access flags
++     * and will not change the state of the softmmu TLBs.
++     */
+     bool in_debug;
+     /*
+      * If this is stage 2 of a stage 1+2 page table walk, then this must
+--
+.34.1

-[PULL 2/6] target/arm: Check VSTCR.SW when assigning the stage 2 output PA space
+[PULL 4/7] target/arm: Fix S1_ptw_translate() debug path
-From: Idan Horowitz <idan.horowitz@gmail.com>
+In commit fe4a5472ccd6 we rearranged the logic in S1_ptw_translate()
 so that the debug-access "call get_phys_addr_*" codepath is used both
 when S1 is doing ptw reads from stage 2 and when it is doing ptw
 reads from physical memory.  However, we didn't update the
 calculation of s2ptw->in_space and s2ptw->in_secure to account for
 the "ptw reads from physical memory" case.  This meant that debug
 accesses when in Secure state broke.
-As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the
+Create a new function S2_security_space() which returns the
-PA space of the IPA is non secure, the output PA space is secure if and only
+correct security space to use for the ptw load, and use it to
-if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.
+determine the correct .in_secure and .in_space fields for the
 stage 2 lookup for the ptw load.
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
+Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220327093427.1548629-2-idan.horowitz@gmail.com
+Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org
 Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate")
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/helper.c | 2 +-
+ target/arm/ptw.c | 37 ++++++++++++++++++++++++++++++++-----
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 32 insertions(+), 5 deletions(-)
-diff --git a/target/arm/helper.c b/target/arm/helper.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/helper.c
+--- a/target/arm/ptw.c
-+++ b/target/arm/helper.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
+@@ -XXX,XX +XXX,XX @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
-                 } else {
+     }
-                     attrs->secure =
+ }
-                         !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
--                        || (env->cp15.vstcr_el2.raw_tcr & VSTCR_SA));
++static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
-+                        || (env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW)));
++                                          ARMMMUIdx s2_mmu_idx)
-                 }
++{
-             }
++    /*
-             return 0;
++     * Return the security space to use for stage 2 when doing
 +     * the S1 page table descriptor load.
 +     */
 +    if (regime_is_stage2(s2_mmu_idx)) {
 +        /*
 +         * The security space for ptw reads is almost always the same
 +         * as that of the security space of the stage 1 translation.
 +         * The only exception is when stage 1 is Secure; in that case
 +         * the ptw read might be to the Secure or the NonSecure space
 +         * (but never Realm or Root), and the s2_mmu_idx tells us which.
 +         * Root translations are always single-stage.
 +         */
 +        if (s1_space == ARMSS_Secure) {
 +            return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
 +        } else {
 +            assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
 +            assert(s1_space != ARMSS_Root);
 +            return s1_space;
 +        }
 +    } else {
 +        /* ptw loads are from phys: the mmu idx itself says which space */
 +        return arm_phys_to_space(s2_mmu_idx);
 +    }
 +}
 +
  /* Translate a S1 pagetable walk through S2 if needed.  */
  static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                               hwaddr addr, ARMMMUFaultInfo *fi)
  {
 -    ARMSecuritySpace space = ptw->in_space;
      bool is_secure = ptw->in_secure;
      ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
      ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
           * From gdbstub, do not use softmmu so that we don't modify the
           * state of the cpu at all, including softmmu tlb contents.
           */
 +        ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
          S1Translate s2ptw = {
              .in_mmu_idx = s2_mmu_idx,
              .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
 -            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
 -            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
 -                         : space == ARMSS_Realm ? ARMSS_Realm
 -                         : ARMSS_NonSecure),
 +            .in_secure = arm_space_is_secure(s2_space),
 +            .in_space = s2_space,
              .in_debug = true,
          };
          GetPhysAddrResult s2 = { };
 --
-.25.1
+.34.1

-[PULL 6/6] target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen
+[PULL 5/7] target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
-In gen_store_exclusive(), if the host does not have a cmpxchg128
+In get_phys_addr_twostage() the code that applies the effects of
-primitive then we generate bad code for STXP for storing two 64-bit
+VSTCR.{SA,SW} and VTCR.{NSA,NSW} only updates result->f.attrs.secure.
-values.  We generate a call to the exit_atomic helper, which never
+Now we also have f.attrs.space for FEAT_RME, we need to keep the two
-returns, and set is_jmp to DISAS_NORETURN.  However, this is
+in sync.
 forgetting that we have already emitted a brcond that jumps over this
 call for the case where we don't hold the exclusive.  The effect is
 that we don't generate any code to end the TB for the
 exclusive-not-held execution path, which falls into the "exit with
 TB_EXIT_REQUESTED" code that gen_tb_end() emits.  This then causes an
 assert at runtime when cpu_loop_exec_tb() sees an EXIT_REQUESTED TB
 return that wasn't for an interrupt or icount.
-In particular, you can hit this case when using the clang sanitizers
+These bits only have an effect for Secure space translations, not
-and trying to run the xlnx-versal-virt acceptance test in 'make
+for Root, so use the input in_space field to determine whether to
-check-acceptance'.  This bug was masked until commit 848126d11e93ff
+apply them rather than the input is_secure. This doesn't actually
-("meson: move int128 checks from configure") because we used to set
+make a difference because Root translations are never two-stage,
-CONFIG_CMPXCHG128=1 and avoid the buggy codepath, but after that we
+but it's a little clearer.
 do not.
-Fix the bug by not setting is_jmp.  The code after the exit_atomic
-call up to the fail_label is dead, but TCG is smart enough to
-eliminate it.  We do need to set 'tmp' to some valid value, though
-(in the same way the exit_atomic-using code in tcg/tcg-op.c does).
-Resolves: https://gitlab.com/qemu-project/qemu/-/issues/953
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20220331150858.96348-1-peter.maydell@linaro.org
+Message-id: 20230710152130.3928330-4-peter.maydell@linaro.org
 ---
- target/arm/translate-a64.c | 7 ++++++-
+ target/arm/ptw.c | 13 ++++++++-----
-file changed, 6 insertions(+), 1 deletion(-)
+file changed, 8 insertions(+), 5 deletions(-)
-diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
+diff --git a/target/arm/ptw.c b/target/arm/ptw.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/translate-a64.c
+--- a/target/arm/ptw.c
-+++ b/target/arm/translate-a64.c
++++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-         } else if (tb_cflags(s->base.tb) & CF_PARALLEL) {
+     hwaddr ipa;
-             if (!HAVE_CMPXCHG128) {
+     int s1_prot, s1_lgpgsz;
-                 gen_helper_exit_atomic(cpu_env);
+     bool is_secure = ptw->in_secure;
--                s->base.is_jmp = DISAS_NORETURN;
++    ARMSecuritySpace in_space = ptw->in_space;
-+                /*
+     bool ret, ipa_secure;
-+                 * Produce a result so we have a well-formed opcode
+     ARMCacheAttrs cacheattrs1;
-+                 * stream when the following (dead) code uses 'tmp'.
+     ARMSecuritySpace ipa_space;
-+                 * TCG will remove the dead ops for us.
+@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-+                 */
+      * Check if IPA translates to secure or non-secure PA space.
-+                tcg_gen_movi_i64(tmp, 0);
+      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
-             } else if (s->be_data == MO_LE) {
+      */
-                 gen_helper_paired_cmpxchg64_le_parallel(tmp, cpu_env,
+-    result->f.attrs.secure =
-                                                         cpu_exclusive_addr,
+-        (is_secure
 -         && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
 -         && (ipa_secure
 -             || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
 +    if (in_space == ARMSS_Secure) {
 +        result->f.attrs.secure =
 +            !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
 +            && (ipa_secure
 +                || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
 +        result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
 +    }
      return false;
  }
 --
-.25.1
+.34.1

-[PULL 5/6] MAINTAINERS: change Fred Konrad's email address
+[PULL 6/7] accel/tcg: Zero-pad PC in TCG CPU exec trace lines
-From: Frederic Konrad <konrad@adacore.com>
+In commit f0a08b0913befbd we changed the type of the PC from
 target_ulong to vaddr.  In doing so we inadvertently dropped the
 zero-padding on the PC in trace lines (the second item inside the []
 in these lines).  They used to look like this on AArch64, for
 instance:
-frederic.konrad@adacore.com and konrad@adacore.com will stop working starting
+Trace 0: 0x7f2260000100 [00000000/0000000040000000/00000061/ff200000]
 -04-01.
-Use my personal email instead.
+and now they look like this:
 Trace 0: 0x7f4f50000100 [00000000/40000000/00000061/ff200000]
-Signed-off-by: Frederic Konrad <frederic.konrad@adacore.com>
+and if the PC happens to be somewhere low like 0x5000
-Reviewed-by: Fabien Chouteau <chouteau@adacore.com <clg@kaod.org>>
+then the field is shown as /5000/.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 1648643217-15811-1-git-send-email-frederic.konrad@adacore.com
+This is because TARGET_FMT_lx is a "%08x" or "%016x" specifier,
 depending on TARGET_LONG_SIZE, whereas VADDR_PRIx is just PRIx64
 with no width specifier.
 Restore the zero-padding by adding an 016 width specifier to
 this tracing and a couple of others that were similarly recently
 changed to use VADDR_PRIx without a width specifier.
 We can't unfortunately restore the "32-bit guests are padded to
 hex digits and 64-bit guests to 16 hex digits" behaviour so
 easily.
 Fixes: f0a08b0913befbd ("accel/tcg/cpu-exec.c: Widen pc to vaddr")
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reviewed-by: Anton Johansson <anjo@rev.ng>
+Message-id: 20230711165434.4123674-1-peter.maydell@linaro.org
 ---
- .mailmap    | 3 ++-
+ accel/tcg/cpu-exec.c      | 4 ++--
- MAINTAINERS | 2 +-
+ accel/tcg/translate-all.c | 2 +-
-files changed, 3 insertions(+), 2 deletions(-)
+files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/.mailmap b/.mailmap
+diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
 index XXXXXXX..XXXXXXX 100644
---- a/.mailmap
+--- a/accel/tcg/cpu-exec.c
-+++ b/.mailmap
++++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ Alexander Graf <agraf@csgraf.de> <agraf@suse.de>
+@@ -XXX,XX +XXX,XX @@ static void log_cpu_exec(vaddr pc, CPUState *cpu,
- Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
+     if (qemu_log_in_addr_range(pc)) {
- Christian Borntraeger <borntraeger@linux.ibm.com> <borntraeger@de.ibm.com>
+         qemu_log_mask(CPU_LOG_EXEC,
- Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>
+                       "Trace %d: %p [%08" PRIx64
--Frederic Konrad <konrad@adacore.com> <fred.konrad@greensocs.com>
+-                      "/%" VADDR_PRIx "/%08x/%08x] %s\n",
-+Frederic Konrad <konrad.frederic@yahoo.fr> <fred.konrad@greensocs.com>
++                      "/%016" VADDR_PRIx "/%08x/%08x] %s\n",
-+Frederic Konrad <konrad.frederic@yahoo.fr> <konrad@adacore.com>
+                       cpu->cpu_index, tb->tc.ptr, tb->cs_base, pc,
- Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>
+                       tb->flags, tb->cflags, lookup_symbol(pc));
- Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
- Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
+@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
-diff --git a/MAINTAINERS b/MAINTAINERS
+         if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
              vaddr pc = log_pc(cpu, last_tb);
              if (qemu_log_in_addr_range(pc)) {
 -                qemu_log("Stopped execution of TB chain before %p [%"
 +                qemu_log("Stopped execution of TB chain before %p [%016"
                           VADDR_PRIx "] %s\n",
                           last_tb->tc.ptr, pc, lookup_symbol(pc));
              }
 diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/accel/tcg/translate-all.c
-+++ b/MAINTAINERS
++++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/sun4v-rtc.h
+@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
+     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
- Leon3
+         vaddr pc = log_pc(cpu, tb);
- M: Fabien Chouteau <chouteau@adacore.com>
+         if (qemu_log_in_addr_range(pc)) {
--M: KONRAD Frederic <frederic.konrad@adacore.com>
+-            qemu_log("cpu_io_recompile: rewound execution of TB to %"
-+M: Frederic Konrad <konrad.frederic@yahoo.fr>
++            qemu_log("cpu_io_recompile: rewound execution of TB to %016"
- S: Maintained
+                      VADDR_PRIx "\n", pc);
- F: hw/sparc/leon3.c
+         }
- F: hw/*/grlib*
+     }
 --
-.25.1
+.34.1

-[PULL 1/6] target/arm: Fix MTE access checks for disabled SEL2
+[PULL 7/7] hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
-From: Idan Horowitz <idan.horowitz@gmail.com>
+From: Tong Ho <tong.ho@amd.com>
-While not mentioned anywhere in the actual specification text, the
+Add a check in the bit-set operation to write the backstore
-HCR_EL2.ATA bit is treated as '1' when EL2 is disabled at the current
+only if the affected bit is 0 before.
 security state. This can be observed in the psuedo-code implementation
 of AArch64.AllocationTagAccessIsEnabled().
-Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
+With this in place, there will be no need for callers to
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+do the checking in order to avoid unnecessary writes.
-Message-id: 20220328173107.311267-1-idan.horowitz@gmail.com
 Signed-off-by: Tong Ho <tong.ho@amd.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- target/arm/internals.h | 2 +-
+ hw/nvram/xlnx-efuse.c | 11 +++++++++--
- target/arm/helper.c    | 2 +-
+file changed, 9 insertions(+), 2 deletions(-)
 files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/target/arm/internals.h b/target/arm/internals.h
+diff --git a/hw/nvram/xlnx-efuse.c b/hw/nvram/xlnx-efuse.c
 index XXXXXXX..XXXXXXX 100644
---- a/target/arm/internals.h
+--- a/hw/nvram/xlnx-efuse.c
-+++ b/target/arm/internals.h
++++ b/hw/nvram/xlnx-efuse.c
-@@ -XXX,XX +XXX,XX @@ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
+@@ -XXX,XX +XXX,XX @@ static bool efuse_ro_bits_find(XlnxEFuse *s, uint32_t k)
-         && !(env->cp15.scr_el3 & SCR_ATA)) {
  bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
  {
 +    uint32_t set, *row;
 +
      if (efuse_ro_bits_find(s, bit)) {
          g_autofree char *path = object_get_canonical_path(OBJECT(s));
@@ -XXX,XX +XXX,XX @@ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
          return false;
      }
--    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
-+    if (el < 2 && arm_is_el2_enabled(env)) {
+-    s->fuse32[bit / 32] |= 1 << (bit % 32);
-         uint64_t hcr = arm_hcr_el2_eff(env);
+-    efuse_bdrv_sync(s, bit);
-         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
++    /* Avoid back-end write unless there is a real update */
-             return false;
++    row = &s->fuse32[bit / 32];
-diff --git a/target/arm/helper.c b/target/arm/helper.c
++    set = 1 << (bit % 32);
-index XXXXXXX..XXXXXXX 100644
++    if (!(set & *row)) {
---- a/target/arm/helper.c
++        *row |= set;
-+++ b/target/arm/helper.c
++        efuse_bdrv_sync(s, bit);
-@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri,
++    }
- {
+     return true;
-     int el = arm_current_el(env);
+ }
 -    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
 +    if (el < 2 && arm_is_el2_enabled(env)) {
          uint64_t hcr = arm_hcr_el2_eff(env);
          if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
              return CP_ACCESS_TRAP_EL2;
 --
-.25.1
+.34.1

Some small arm bug fixes for rc3.

-- PMM

The following changes since commit 9b617b1bb4056e60b39be4c33be20c10928a6a5c:

Merge tag 'trivial-branch-for-7.0-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-04-01 10:23:27 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20220401

for you to fetch changes up to a5b1e1ab662aa6dc42d5a913080fccbb8bf82e9b:

target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen (2022-04-01 15:35:49 +0100)

----------------------------------------------------------------
target-arm queue:
 * target/arm: Fix some bugs in secure EL2 handling
 * target/arm: Fix assert when !HAVE_CMPXCHG128
 * MAINTAINERS: change Fred Konrad's email address

----------------------------------------------------------------
Frederic Konrad (1):
      MAINTAINERS: change Fred Konrad's email address

Idan Horowitz (4):
      target/arm: Fix MTE access checks for disabled SEL2
      target/arm: Check VSTCR.SW when assigning the stage 2 output PA space
      target/arm: Take VSTCR.SW, VTCR.NSW into account in final stage 2 walk
      target/arm: Determine final stage 2 output PA space based on original IPA

Peter Maydell (1):
      target/arm: Don't use DISAS_NORETURN in STXP !HAVE_CMPXCHG128 codegen

From: Idan Horowitz <idan.horowitz@gmail.com>

While not mentioned anywhere in the actual specification text, the
HCR_EL2.ATA bit is treated as '1' when EL2 is disabled at the current
security state. This can be observed in the psuedo-code implementation
of AArch64.AllocationTagAccessIsEnabled().

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220328173107.311267-1-idan.horowitz@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/internals.h | 2 +-
 target/arm/helper.c    | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/internals.h b/target/arm/internals.h
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/internals.h
+++ b/target/arm/internals.h
@@ -XXX,XX +XXX,XX @@ static inline bool allocation_tag_access_enabled(CPUARMState *env, int el,
         && !(env->cp15.scr_el3 & SCR_ATA)) {
         return false;
     }
-    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
+    if (el < 2 && arm_is_el2_enabled(env)) {
         uint64_t hcr = arm_hcr_el2_eff(env);
         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
             return false;
diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ static CPAccessResult access_mte(CPUARMState *env, const ARMCPRegInfo *ri,
 {
     int el = arm_current_el(env);
 
-    if (el < 2 && arm_feature(env, ARM_FEATURE_EL2)) {
+    if (el < 2 && arm_is_el2_enabled(env)) {
         uint64_t hcr = arm_hcr_el2_eff(env);
         if (!(hcr & HCR_ATA) && (!(hcr & HCR_E2H) || !(hcr & HCR_TGE))) {
             return CP_ACCESS_TRAP_EL2;
-- 
2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.SS2OutputPASpace() psuedo-code in the ARMv8 ARM when the
PA space of the IPA is non secure, the output PA space is secure if and only
if all of the bits VTCR.<NSW, NSA>, VSTCR.<SW, SA> are not set.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220327093427.1548629-2-idan.horowitz@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 } else {
                     attrs->secure =
                         !((env->cp15.vtcr_el2.raw_tcr & (VTCR_NSA | VTCR_NSW))
-                        || (env->cp15.vstcr_el2.raw_tcr & VSTCR_SA));
+                        || (env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW)));
                 }
             }
             return 0;
-- 
2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.SS2InitialTTWState() psuedo-code in the ARMv8 ARM the
initial PA space used for stage 2 table walks is assigned based on the SW
and NSW bits of the VSTCR and VTCR registers.
This was already implemented for the recursive stage 2 page table walks
in S1_ptw_translate(), but was missing for the final stage 2 walk.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220327093427.1548629-3-idan.horowitz@gmail.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 return ret;
             }
 
+            if (arm_is_secure_below_el3(env)) {
+                if (attrs->secure) {
+                    attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
+                } else {
+                    attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
+                }
+            } else {
+                assert(!attrs->secure);
+            }
+
             s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
             is_el0 = mmu_idx == ARMMMUIdx_E10_0 || mmu_idx == ARMMMUIdx_SE10_0;
 
-- 
2.25.1

From: Idan Horowitz <idan.horowitz@gmail.com>

As per the AArch64.S2Walk() pseudo-code in the ARMv8 ARM, the final
decision as to the output address's PA space based on the SA/SW/NSA/NSW
bits needs to take the input IPA's PA space into account, and not the
PA space of the result of the stage 2 walk itself.

Signed-off-by: Idan Horowitz <idan.horowitz@gmail.com>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220327093427.1548629-4-idan.horowitz@gmail.com
[PMM: fixed commit message typo]
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/helper.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/helper.c
+++ b/target/arm/helper.c
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
             hwaddr ipa;
             int s2_prot;
             int ret;
+            bool ipa_secure;
             ARMCacheAttrs cacheattrs2 = {};
             ARMMMUIdx s2_mmu_idx;
             bool is_el0;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
                 return ret;
             }
 
+            ipa_secure = attrs->secure;
             if (arm_is_secure_below_el3(env)) {
-                if (attrs->secure) {
+                if (ipa_secure) {
                     attrs->secure = !(env->cp15.vstcr_el2.raw_tcr & VSTCR_SW);
                 } else {
                     attrs->secure = !(env->cp15.vtcr_el2.raw_tcr & VTCR_NSW);
                 }
             } else {
-                assert(!attrs->secure);
+                assert(!ipa_secure);
             }
 
             s2_mmu_idx = attrs->secure ? ARMMMUIdx_Stage2_S : ARMMMUIdx_Stage2;
@@ -XXX,XX +XXX,XX @@ bool get_phys_addr(CPUARMState *env, target_ulong address,
 
             /* Check if IPA translates to secure or non-secure PA space. */
             if (arm_is_secure_below_el3(env)) {
-                if (attrs->secure) {
+                if (ipa_secure) {
                     attrs->secure =
                         !(env->cp15.vstcr_el2.raw_tcr & (VSTCR_SA | VSTCR_SW));
                 } else {
-- 
2.25.1

From: Frederic Konrad <konrad@adacore.com>

frederic.konrad@adacore.com and konrad@adacore.com will stop working starting
2022-04-01.

Use my personal email instead.

Signed-off-by: Frederic Konrad <frederic.konrad@adacore.com>
Reviewed-by: Fabien Chouteau <chouteau@adacore.com <clg@kaod.org>>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 1648643217-15811-1-git-send-email-frederic.konrad@adacore.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 .mailmap    | 3 ++-
 MAINTAINERS | 2 +-
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/.mailmap b/.mailmap
index XXXXXXX..XXXXXXX 100644
--- a/.mailmap
+++ b/.mailmap
@@ -XXX,XX +XXX,XX @@ Alexander Graf <agraf@csgraf.de> <agraf@suse.de>
 Anthony Liguori <anthony@codemonkey.ws> Anthony Liguori <aliguori@us.ibm.com>
 Christian Borntraeger <borntraeger@linux.ibm.com> <borntraeger@de.ibm.com>
 Filip Bozuta <filip.bozuta@syrmia.com> <filip.bozuta@rt-rk.com.com>
-Frederic Konrad <konrad@adacore.com> <fred.konrad@greensocs.com>
+Frederic Konrad <konrad.frederic@yahoo.fr> <fred.konrad@greensocs.com>
+Frederic Konrad <konrad.frederic@yahoo.fr> <konrad@adacore.com>
 Greg Kurz <groug@kaod.org> <gkurz@linux.vnet.ibm.com>
 Huacai Chen <chenhuacai@kernel.org> <chenhc@lemote.com>
 Huacai Chen <chenhuacai@kernel.org> <chenhuacai@loongson.cn>
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: include/hw/rtc/sun4v-rtc.h
 
 Leon3
 M: Fabien Chouteau <chouteau@adacore.com>
-M: KONRAD Frederic <frederic.konrad@adacore.com>
+M: Frederic Konrad <konrad.frederic@yahoo.fr>
 S: Maintained
 F: hw/sparc/leon3.c
 F: hw/*/grlib*
-- 
2.25.1

In gen_store_exclusive(), if the host does not have a cmpxchg128
primitive then we generate bad code for STXP for storing two 64-bit
values.  We generate a call to the exit_atomic helper, which never
returns, and set is_jmp to DISAS_NORETURN.  However, this is
forgetting that we have already emitted a brcond that jumps over this
call for the case where we don't hold the exclusive.  The effect is
that we don't generate any code to end the TB for the
exclusive-not-held execution path, which falls into the "exit with
TB_EXIT_REQUESTED" code that gen_tb_end() emits.  This then causes an
assert at runtime when cpu_loop_exec_tb() sees an EXIT_REQUESTED TB
return that wasn't for an interrupt or icount.

In particular, you can hit this case when using the clang sanitizers
and trying to run the xlnx-versal-virt acceptance test in 'make
check-acceptance'.  This bug was masked until commit 848126d11e93ff
("meson: move int128 checks from configure") because we used to set
CONFIG_CMPXCHG128=1 and avoid the buggy codepath, but after that we
do not.

Fix the bug by not setting is_jmp.  The code after the exit_atomic
call up to the fail_label is dead, but TCG is smart enough to
eliminate it.  We do need to set 'tmp' to some valid value, though
(in the same way the exit_atomic-using code in tcg/tcg-op.c does).

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/953
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20220331150858.96348-1-peter.maydell@linaro.org
---
 target/arm/translate-a64.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/target/arm/translate-a64.c b/target/arm/translate-a64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/translate-a64.c
+++ b/target/arm/translate-a64.c
@@ -XXX,XX +XXX,XX @@ static void gen_store_exclusive(DisasContext *s, int rd, int rt, int rt2,
         } else if (tb_cflags(s->base.tb) & CF_PARALLEL) {
             if (!HAVE_CMPXCHG128) {
                 gen_helper_exit_atomic(cpu_env);
-                s->base.is_jmp = DISAS_NORETURN;
+                /*
+                 * Produce a result so we have a well-formed opcode
+                 * stream when the following (dead) code uses 'tmp'.
+                 * TCG will remove the dead ops for us.
+                 */
+                tcg_gen_movi_i64(tmp, 0);
             } else if (s->be_data == MO_LE) {
                 gen_helper_paired_cmpxchg64_le_parallel(tmp, cpu_env,
                                                         cpu_exclusive_addr,
-- 
2.25.1

A last small test of bug fixes before rc1.

thanks
-- PMM

The following changes since commit ed8ad9728a9c0eec34db9dff61dfa2f1dd625637:

Merge tag 'pull-tpm-2023-07-14-1' of https://github.com/stefanberger/qemu-tpm into staging (2023-07-15 14:54:04 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230717

for you to fetch changes up to c2c1c4a35c7c2b1a4140b0942b9797c857e476a4:

hw/nvram: Avoid unnecessary Xilinx eFuse backstore write (2023-07-17 11:05:52 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/sbsa-ref: set 'slots' property of xhci
 * linux-user: Remove pointless NULL check in clock_adjtime handling
 * ptw: Fix S1_ptw_translate() debug path
 * ptw: Account for FEAT_RME when applying {N}SW, SA bits
 * accel/tcg: Zero-pad PC in TCG CPU exec trace lines
 * hw/nvram: Avoid unnecessary Xilinx eFuse backstore write

----------------------------------------------------------------
Peter Maydell (5):
      linux-user: Remove pointless NULL check in clock_adjtime handling
      target/arm/ptw.c: Add comments to S1Translate struct fields
      target/arm: Fix S1_ptw_translate() debug path
      target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
      accel/tcg: Zero-pad PC in TCG CPU exec trace lines

Tong Ho (1):
      hw/nvram: Avoid unnecessary Xilinx eFuse backstore write

Yuquan Wang (1):
      hw/arm/sbsa-ref: set 'slots' property of xhci

From: Yuquan Wang <wangyuquan1236@phytium.com.cn>

This extends the slots of xhci to 64, since the default xhci_sysbus
just supports one slot.

Signed-off-by: Wang Yuquan <wangyuquan1236@phytium.com.cn>
Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20230710063750.473510-2-wangyuquan1236@phytium.com.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static void create_xhci(const SBSAMachineState *sms)
     hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
     int irq = sbsa_ref_irqmap[SBSA_XHCI];
     DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
+    qdev_prop_set_uint32(dev, "slots", XHCI_MAXSLOTS);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
-- 
2.34.1

In the code for TARGET_NR_clock_adjtime, we set the pointer phtx to
the address of the local variable htx.  This means it can never be
NULL, but later in the code we check it for NULL anyway.  Coverity
complains about this (CID 1507683) because the NULL check comes after
a call to clock_adjtime() that assumes it is non-NULL.

Since phtx is always &htx, and is used only in three places, it's not
really necessary.  Remove it, bringing the code structure in to line
with that for TARGET_NR_clock_adjtime64, which already uses a simple
'&htx' when it wants a pointer to 'htx'.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230623144410.1837261-1-peter.maydell@linaro.org
---
 linux-user/syscall.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
     case TARGET_NR_clock_adjtime:
         {
-            struct timex htx, *phtx = &htx;
+            struct timex htx;
 
-            if (target_to_host_timex(phtx, arg2) != 0) {
+            if (target_to_host_timex(&htx, arg2) != 0) {
                 return -TARGET_EFAULT;
             }
-            ret = get_errno(clock_adjtime(arg1, phtx));
-            if (!is_error(ret) && phtx) {
-                if (host_to_target_timex(arg2, phtx) != 0) {
-                    return -TARGET_EFAULT;
-                }
+            ret = get_errno(clock_adjtime(arg1, &htx));
+            if (!is_error(ret) && host_to_target_timex(arg2, &htx)) {
+                return -TARGET_EFAULT;
             }
         }
         return ret;
-- 
2.34.1

Add comments to the in_* fields in the S1Translate struct
that explain what they're doing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-2-peter.maydell@linaro.org
---
 target/arm/ptw.c | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@
 #endif
 
 typedef struct S1Translate {
+    /*
+     * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
+     * Together with in_space, specifies the architectural translation regime.
+     */
     ARMMMUIdx in_mmu_idx;
+    /*
+     * in_ptw_idx: specifies which mmuidx to use for the actual
+     * page table descriptor load operations. This will be one of the
+     * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     */
     ARMMMUIdx in_ptw_idx;
+    /*
+     * in_space: the security space for this walk. This plus
+     * the in_mmu_idx specify the architectural translation regime.
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     *
+     * Note that the security space for the in_ptw_idx may be different
+     * from that for the in_mmu_idx. We do not need to explicitly track
+     * the in_ptw_idx security space because:
+     *  - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
+     *    itself specifies the security space
+     *  - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
+     *    space used for ptw reads is the same as that of the security
+     *    space of the stage 1 translation for all cases except where
+     *    stage 1 is Secure; in that case the only possibilities for
+     *    the ptw read are Secure and NonSecure, and the in_ptw_idx
+     *    value being Stage2 vs Stage2_S distinguishes those.
+     */
     ARMSecuritySpace in_space;
+    /*
+     * in_secure: whether the translation regime is a Secure one.
+     * This is always equal to arm_space_is_secure(in_space).
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     */
     bool in_secure;
+    /*
+     * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
+     * accesses will not update the guest page table access flags
+     * and will not change the state of the softmmu TLBs.
+     */
     bool in_debug;
     /*
      * If this is stage 2 of a stage 1+2 page table walk, then this must
-- 
2.34.1

In commit fe4a5472ccd6 we rearranged the logic in S1_ptw_translate()
so that the debug-access "call get_phys_addr_*" codepath is used both
when S1 is doing ptw reads from stage 2 and when it is doing ptw
reads from physical memory.  However, we didn't update the
calculation of s2ptw->in_space and s2ptw->in_secure to account for
the "ptw reads from physical memory" case.  This meant that debug
accesses when in Secure state broke.

Create a new function S2_security_space() which returns the
correct security space to use for the ptw load, and use it to
determine the correct .in_secure and .in_space fields for the
stage 2 lookup for the ptw load.

Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org
Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 37 ++++++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
     }
 }
 
+static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
+                                          ARMMMUIdx s2_mmu_idx)
+{
+    /*
+     * Return the security space to use for stage 2 when doing
+     * the S1 page table descriptor load.
+     */
+    if (regime_is_stage2(s2_mmu_idx)) {
+        /*
+         * The security space for ptw reads is almost always the same
+         * as that of the security space of the stage 1 translation.
+         * The only exception is when stage 1 is Secure; in that case
+         * the ptw read might be to the Secure or the NonSecure space
+         * (but never Realm or Root), and the s2_mmu_idx tells us which.
+         * Root translations are always single-stage.
+         */
+        if (s1_space == ARMSS_Secure) {
+            return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
+        } else {
+            assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
+            assert(s1_space != ARMSS_Root);
+            return s1_space;
+        }
+    } else {
+        /* ptw loads are from phys: the mmu idx itself says which space */
+        return arm_phys_to_space(s2_mmu_idx);
+    }
+}
+
 /* Translate a S1 pagetable walk through S2 if needed.  */
 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                              hwaddr addr, ARMMMUFaultInfo *fi)
 {
-    ARMSecuritySpace space = ptw->in_space;
     bool is_secure = ptw->in_secure;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
          * From gdbstub, do not use softmmu so that we don't modify the
          * state of the cpu at all, including softmmu tlb contents.
          */
+        ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
         S1Translate s2ptw = {
             .in_mmu_idx = s2_mmu_idx,
             .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
-            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
-                         : space == ARMSS_Realm ? ARMSS_Realm
-                         : ARMSS_NonSecure),
+            .in_secure = arm_space_is_secure(s2_space),
+            .in_space = s2_space,
             .in_debug = true,
         };
         GetPhysAddrResult s2 = { };
-- 
2.34.1

In get_phys_addr_twostage() the code that applies the effects of
VSTCR.{SA,SW} and VTCR.{NSA,NSW} only updates result->f.attrs.secure.
Now we also have f.attrs.space for FEAT_RME, we need to keep the two
in sync.

These bits only have an effect for Secure space translations, not
for Root, so use the input in_space field to determine whether to
apply them rather than the input is_secure. This doesn't actually
make a difference because Root translations are never two-stage,
but it's a little clearer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-4-peter.maydell@linaro.org
---
 target/arm/ptw.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     hwaddr ipa;
     int s1_prot, s1_lgpgsz;
     bool is_secure = ptw->in_secure;
+    ARMSecuritySpace in_space = ptw->in_space;
     bool ret, ipa_secure;
     ARMCacheAttrs cacheattrs1;
     ARMSecuritySpace ipa_space;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      * Check if IPA translates to secure or non-secure PA space.
      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
      */
-    result->f.attrs.secure =
-        (is_secure
-         && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
-         && (ipa_secure
-             || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
+    if (in_space == ARMSS_Secure) {
+        result->f.attrs.secure =
+            !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
+            && (ipa_secure
+                || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
+        result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
+    }
 
     return false;
 }
-- 
2.34.1

In commit f0a08b0913befbd we changed the type of the PC from
target_ulong to vaddr.  In doing so we inadvertently dropped the
zero-padding on the PC in trace lines (the second item inside the []
in these lines).  They used to look like this on AArch64, for
instance:

Trace 0: 0x7f2260000100 [00000000/0000000040000000/00000061/ff200000]

and now they look like this:
Trace 0: 0x7f4f50000100 [00000000/40000000/00000061/ff200000]

and if the PC happens to be somewhere low like 0x5000
then the field is shown as /5000/.

This is because TARGET_FMT_lx is a "%08x" or "%016x" specifier,
depending on TARGET_LONG_SIZE, whereas VADDR_PRIx is just PRIx64
with no width specifier.

Restore the zero-padding by adding an 016 width specifier to
this tracing and a couple of others that were similarly recently
changed to use VADDR_PRIx without a width specifier.

We can't unfortunately restore the "32-bit guests are padded to
8 hex digits and 64-bit guests to 16 hex digits" behaviour so
easily.

Fixes: f0a08b0913befbd ("accel/tcg/cpu-exec.c: Widen pc to vaddr")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-id: 20230711165434.4123674-1-peter.maydell@linaro.org
---
 accel/tcg/cpu-exec.c      | 4 ++--
 accel/tcg/translate-all.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static void log_cpu_exec(vaddr pc, CPUState *cpu,
     if (qemu_log_in_addr_range(pc)) {
         qemu_log_mask(CPU_LOG_EXEC,
                       "Trace %d: %p [%08" PRIx64
-                      "/%" VADDR_PRIx "/%08x/%08x] %s\n",
+                      "/%016" VADDR_PRIx "/%08x/%08x] %s\n",
                       cpu->cpu_index, tb->tc.ptr, tb->cs_base, pc,
                       tb->flags, tb->cflags, lookup_symbol(pc));
 
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
         if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
             vaddr pc = log_pc(cpu, last_tb);
             if (qemu_log_in_addr_range(pc)) {
-                qemu_log("Stopped execution of TB chain before %p [%"
+                qemu_log("Stopped execution of TB chain before %p [%016"
                          VADDR_PRIx "] %s\n",
                          last_tb->tc.ptr, pc, lookup_symbol(pc));
             }
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
         vaddr pc = log_pc(cpu, tb);
         if (qemu_log_in_addr_range(pc)) {
-            qemu_log("cpu_io_recompile: rewound execution of TB to %"
+            qemu_log("cpu_io_recompile: rewound execution of TB to %016"
                      VADDR_PRIx "\n", pc);
         }
     }
-- 
2.34.1

From: Tong Ho <tong.ho@amd.com>

Add a check in the bit-set operation to write the backstore
only if the affected bit is 0 before.

With this in place, there will be no need for callers to
do the checking in order to avoid unnecessary writes.

Signed-off-by: Tong Ho <tong.ho@amd.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/nvram/xlnx-efuse.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/nvram/xlnx-efuse.c b/hw/nvram/xlnx-efuse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/xlnx-efuse.c
+++ b/hw/nvram/xlnx-efuse.c
@@ -XXX,XX +XXX,XX @@ static bool efuse_ro_bits_find(XlnxEFuse *s, uint32_t k)
 
 bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
 {
+    uint32_t set, *row;
+
     if (efuse_ro_bits_find(s, bit)) {
         g_autofree char *path = object_get_canonical_path(OBJECT(s));
 
@@ -XXX,XX +XXX,XX @@ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
         return false;
     }
 
-    s->fuse32[bit / 32] |= 1 << (bit % 32);
-    efuse_bdrv_sync(s, bit);
+    /* Avoid back-end write unless there is a real update */
+    row = &s->fuse32[bit / 32];
+    set = 1 << (bit % 32);
+    if (!(set & *row)) {
+        *row |= set;
+        efuse_bdrv_sync(s, bit);
+    }
     return true;
 }
 
-- 
2.34.1