Series comparison

-[PULL 0/7] target-arm queue
+[Qemu-devel] [PULL v2 00/44] target-arm queue
-A last small test of bug fixes before rc1.
+v1->v2 changes: drop the "convert FEATURE_THUMB2EE" patch as
 it broke compilation on arm hosts (conversion of KVM related
 code had been forgotten)
 thanks
 -- PMM
-The following changes since commit ed8ad9728a9c0eec34db9dff61dfa2f1dd625637:
+The following changes since commit 13399aad4fa87b2878c49d02a5d3bafa6c966ba3:
-  Merge tag 'pull-tpm-2023-07-14-1' of https://github.com/stefanberger/qemu-tpm into staging (2023-07-15 14:54:04 +0100)
+  Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2018-10-22' into staging (2018-10-23 17:20:23 +0100)
 are available in the Git repository at:
-  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230717
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181024
-for you to fetch changes up to c2c1c4a35c7c2b1a4140b0942b9797c857e476a4:
+for you to fetch changes up to 93f379b0c43617b1361f742f261479eaed4959cb:
-  hw/nvram: Avoid unnecessary Xilinx eFuse backstore write (2023-07-17 11:05:52 +0100)
+  target/arm: Only flush tlb if ASID changes (2018-10-24 07:51:37 +0100)
 ----------------------------------------------------------------
 target-arm queue:
- * hw/arm/sbsa-ref: set 'slots' property of xhci
+ * ssi-sd: Make devices picking up backends unavailable with -device
- * linux-user: Remove pointless NULL check in clock_adjtime handling
+ * Add support for VCPU event states
- * ptw: Fix S1_ptw_translate() debug path
+ * Move towards making ID registers the source of truth for
- * ptw: Account for FEAT_RME when applying {N}SW, SA bits
+   whether a guest CPU implements a feature, rather than having
- * accel/tcg: Zero-pad PC in TCG CPU exec trace lines
+   parallel ID registers and feature bit flags
- * hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
+ * Implement various HCR hypervisor trap/config bits
  * Get IL bit correct for v7 syndrome values
  * Report correct syndrome for FP/SIMD traps to Hyp mode
  * hw/arm/boot: Increase compliance with kernel arm64 boot protocol
  * Refactor A32 Neon to use generic vector infrastructure
  * Fix a bug in A32 VLD2 "(multiple 2-element structures)" insn
  * net: cadence_gem: Report features correctly in ID register
  * Avoid some unnecessary TLB flushes on TTBR register writes
 ----------------------------------------------------------------
-Peter Maydell (5):
+Dongjiu Geng (1):
-      linux-user: Remove pointless NULL check in clock_adjtime handling
+      target/arm: Add support for VCPU event states
       target/arm/ptw.c: Add comments to S1Translate struct fields
       target/arm: Fix S1_ptw_translate() debug path
       target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
       accel/tcg: Zero-pad PC in TCG CPU exec trace lines
-Tong Ho (1):
+Edgar E. Iglesias (2):
-      hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
+      net: cadence_gem: Announce availability of priority queues
       net: cadence_gem: Announce 64bit addressing support
-Yuquan Wang (1):
+Markus Armbruster (1):
-      hw/arm/sbsa-ref: set 'slots' property of xhci
+      ssi-sd: Make devices picking up backends unavailable with -device
- accel/tcg/cpu-exec.c      |  4 +--
+Peter Maydell (10):
- accel/tcg/translate-all.c |  2 +-
+      target/arm: Improve debug logging of AArch32 exception return
- hw/arm/sbsa-ref.c         |  1 +
+      target/arm: Make switch_mode() file-local
- hw/nvram/xlnx-efuse.c     | 11 ++++--
+      target/arm: Implement HCR.FB
- linux-user/syscall.c      | 12 +++----
+      target/arm: Implement HCR.DC
- target/arm/ptw.c          | 90 +++++++++++++++++++++++++++++++++++++++++------
+      target/arm: ISR_EL1 bits track virtual interrupts if IMO/FMO set
-files changed, 98 insertions(+), 22 deletions(-)
+      target/arm: Implement HCR.VI and VF
       target/arm: Implement HCR.PTW
       target/arm: New utility function to extract EC from syndrome
       target/arm: Get IL bit correct for v7 syndrome values
       target/arm: Report correct syndrome for FP/SIMD traps to Hyp mode
 Richard Henderson (29):
       target/arm: Move some system registers into a substructure
       target/arm: V8M should not imply V7VE
       target/arm: Convert v8 extensions from feature bits to isar tests
       target/arm: Convert division from feature bits to isar0 tests
       target/arm: Convert jazelle from feature bit to isar1 test
       target/arm: Convert sve from feature bit to aa64pfr0 test
       target/arm: Convert v8.2-fp16 from feature bit to aa64pfr0 test
       target/arm: Hoist address increment for vector memory ops
       target/arm: Don't call tcg_clear_temp_count
       target/arm: Use tcg_gen_gvec_dup_i64 for LD[1-4]R
       target/arm: Promote consecutive memory ops for aa64
       target/arm: Mark some arrays const
       target/arm: Use gvec for NEON VDUP
       target/arm: Use gvec for NEON VMOV, VMVN, VBIC & VORR (immediate)
       target/arm: Use gvec for NEON_3R_LOGIC insns
       target/arm: Use gvec for NEON_3R_VADD_VSUB insns
       target/arm: Use gvec for NEON_2RM_VMN, NEON_2RM_VNEG
       target/arm: Use gvec for NEON_3R_VMUL
       target/arm: Use gvec for VSHR, VSHL
       target/arm: Use gvec for VSRA
       target/arm: Use gvec for VSRI, VSLI
       target/arm: Use gvec for NEON_3R_VML
       target/arm: Use gvec for NEON_3R_VTST_VCEQ, NEON_3R_VCGT, NEON_3R_VCGE
       target/arm: Use gvec for NEON VLD all lanes
       target/arm: Reorg NEON VLD/VST all elements
       target/arm: Promote consecutive memory ops for aa32
       target/arm: Reorg NEON VLD/VST single element to one lane
       target/arm: Remove writefn from TTBR0_EL3
       target/arm: Only flush tlb if ASID changes
 Stewart Hildebrand (1):
       hw/arm/boot: Increase compliance with kernel arm64 boot protocol
  target/arm/cpu.h            |  221 ++++++-
  target/arm/internals.h      |   45 +-
  target/arm/kvm_arm.h        |   24 +
  target/arm/translate.h      |   21 +
  hw/arm/boot.c               |   18 +
  hw/intc/armv7m_nvic.c       |   12 +-
  hw/net/cadence_gem.c        |    9 +-
  hw/sd/ssi-sd.c              |    2 +
  linux-user/aarch64/signal.c |    4 +-
  linux-user/elfload.c        |   58 +-
  linux-user/syscall.c        |   10 +-
  target/arm/cpu.c            |  238 +++----
  target/arm/cpu64.c          |  148 +++--
  target/arm/helper.c         |  395 ++++++++----
  target/arm/kvm.c            |   60 ++
  target/arm/kvm32.c          |   13 +
  target/arm/kvm64.c          |   15 +-
  target/arm/machine.c        |   25 +-
  target/arm/op_helper.c      |    2 +-
  target/arm/translate-a64.c  |  715 ++++-----------------
  target/arm/translate.c      | 1451 ++++++++++++++++++++++++++++---------------
 files changed, 2013 insertions(+), 1473 deletions(-)

-[PULL 1/7] hw/arm/sbsa-ref: set 'slots' property of xhci
+Deleted patch
-From: Yuquan Wang <wangyuquan1236@phytium.com.cn>
-This extends the slots of xhci to 64, since the default xhci_sysbus
-just supports one slot.
-Signed-off-by: Wang Yuquan <wangyuquan1236@phytium.com.cn>
-Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
-Message-id: 20230710063750.473510-2-wangyuquan1236@phytium.com.cn
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/arm/sbsa-ref.c | 1 +
-file changed, 1 insertion(+)
-diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/sbsa-ref.c
-+++ b/hw/arm/sbsa-ref.c
-@@ -XXX,XX +XXX,XX @@ static void create_xhci(const SBSAMachineState *sms)
-     hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
-     int irq = sbsa_ref_irqmap[SBSA_XHCI];
-     DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
-+    qdev_prop_set_uint32(dev, "slots", XHCI_MAXSLOTS);
-     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
-     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
---
-.34.1

-[PULL 2/7] linux-user: Remove pointless NULL check in clock_adjtime handling
+Deleted patch
-In the code for TARGET_NR_clock_adjtime, we set the pointer phtx to
-the address of the local variable htx.  This means it can never be
-NULL, but later in the code we check it for NULL anyway.  Coverity
-complains about this (CID 1507683) because the NULL check comes after
-a call to clock_adjtime() that assumes it is non-NULL.
-Since phtx is always &htx, and is used only in three places, it's not
-really necessary.  Remove it, bringing the code structure in to line
-with that for TARGET_NR_clock_adjtime64, which already uses a simple
-'&htx' when it wants a pointer to 'htx'.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230623144410.1837261-1-peter.maydell@linaro.org
----
- linux-user/syscall.c | 12 +++++-------
-file changed, 5 insertions(+), 7 deletions(-)
-diff --git a/linux-user/syscall.c b/linux-user/syscall.c
-index XXXXXXX..XXXXXXX 100644
---- a/linux-user/syscall.c
-+++ b/linux-user/syscall.c
-@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
- #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
-     case TARGET_NR_clock_adjtime:
-         {
--            struct timex htx, *phtx = &htx;
-+            struct timex htx;
--            if (target_to_host_timex(phtx, arg2) != 0) {
-+            if (target_to_host_timex(&htx, arg2) != 0) {
-                 return -TARGET_EFAULT;
-             }
--            ret = get_errno(clock_adjtime(arg1, phtx));
--            if (!is_error(ret) && phtx) {
--                if (host_to_target_timex(arg2, phtx) != 0) {
--                    return -TARGET_EFAULT;
--                }
-+            ret = get_errno(clock_adjtime(arg1, &htx));
-+            if (!is_error(ret) && host_to_target_timex(arg2, &htx)) {
-+                return -TARGET_EFAULT;
-             }
-         }
-         return ret;
---
-.34.1

-[PULL 3/7] target/arm/ptw.c: Add comments to S1Translate struct fields
+Deleted patch
-Add comments to the in_* fields in the S1Translate struct
-that explain what they're doing.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230710152130.3928330-2-peter.maydell@linaro.org
----
- target/arm/ptw.c | 40 ++++++++++++++++++++++++++++++++++++++++
-file changed, 40 insertions(+)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@
- #endif
- typedef struct S1Translate {
-+    /*
-+     * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
-+     * Together with in_space, specifies the architectural translation regime.
-+     */
-     ARMMMUIdx in_mmu_idx;
-+    /*
-+     * in_ptw_idx: specifies which mmuidx to use for the actual
-+     * page table descriptor load operations. This will be one of the
-+     * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
-+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
-+     * this field is updated accordingly.
-+     */
-     ARMMMUIdx in_ptw_idx;
-+    /*
-+     * in_space: the security space for this walk. This plus
-+     * the in_mmu_idx specify the architectural translation regime.
-+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
-+     * this field is updated accordingly.
-+     *
-+     * Note that the security space for the in_ptw_idx may be different
-+     * from that for the in_mmu_idx. We do not need to explicitly track
-+     * the in_ptw_idx security space because:
-+     *  - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
-+     *    itself specifies the security space
-+     *  - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
-+     *    space used for ptw reads is the same as that of the security
-+     *    space of the stage 1 translation for all cases except where
-+     *    stage 1 is Secure; in that case the only possibilities for
-+     *    the ptw read are Secure and NonSecure, and the in_ptw_idx
-+     *    value being Stage2 vs Stage2_S distinguishes those.
-+     */
-     ARMSecuritySpace in_space;
-+    /*
-+     * in_secure: whether the translation regime is a Secure one.
-+     * This is always equal to arm_space_is_secure(in_space).
-+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
-+     * this field is updated accordingly.
-+     */
-     bool in_secure;
-+    /*
-+     * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
-+     * accesses will not update the guest page table access flags
-+     * and will not change the state of the softmmu TLBs.
-+     */
-     bool in_debug;
-     /*
-      * If this is stage 2 of a stage 1+2 page table walk, then this must
---
-.34.1

-[PULL 4/7] target/arm: Fix S1_ptw_translate() debug path
+Deleted patch
-In commit fe4a5472ccd6 we rearranged the logic in S1_ptw_translate()
-so that the debug-access "call get_phys_addr_*" codepath is used both
-when S1 is doing ptw reads from stage 2 and when it is doing ptw
-reads from physical memory.  However, we didn't update the
-calculation of s2ptw->in_space and s2ptw->in_secure to account for
-the "ptw reads from physical memory" case.  This meant that debug
-accesses when in Secure state broke.
-Create a new function S2_security_space() which returns the
-correct security space to use for the ptw load, and use it to
-determine the correct .in_secure and .in_space fields for the
-stage 2 lookup for the ptw load.
-Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org
-Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate")
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- target/arm/ptw.c | 37 ++++++++++++++++++++++++++++++++-----
-file changed, 32 insertions(+), 5 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
-     }
- }
-+static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
-+                                          ARMMMUIdx s2_mmu_idx)
-+{
-+    /*
-+     * Return the security space to use for stage 2 when doing
-+     * the S1 page table descriptor load.
-+     */
-+    if (regime_is_stage2(s2_mmu_idx)) {
-+        /*
-+         * The security space for ptw reads is almost always the same
-+         * as that of the security space of the stage 1 translation.
-+         * The only exception is when stage 1 is Secure; in that case
-+         * the ptw read might be to the Secure or the NonSecure space
-+         * (but never Realm or Root), and the s2_mmu_idx tells us which.
-+         * Root translations are always single-stage.
-+         */
-+        if (s1_space == ARMSS_Secure) {
-+            return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
-+        } else {
-+            assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
-+            assert(s1_space != ARMSS_Root);
-+            return s1_space;
-+        }
-+    } else {
-+        /* ptw loads are from phys: the mmu idx itself says which space */
-+        return arm_phys_to_space(s2_mmu_idx);
-+    }
-+}
-+
- /* Translate a S1 pagetable walk through S2 if needed.  */
- static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-                              hwaddr addr, ARMMMUFaultInfo *fi)
- {
--    ARMSecuritySpace space = ptw->in_space;
-     bool is_secure = ptw->in_secure;
-     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
-     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
-@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
-          * From gdbstub, do not use softmmu so that we don't modify the
-          * state of the cpu at all, including softmmu tlb contents.
-          */
-+        ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
-         S1Translate s2ptw = {
-             .in_mmu_idx = s2_mmu_idx,
-             .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
--            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
--            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
--                         : space == ARMSS_Realm ? ARMSS_Realm
--                         : ARMSS_NonSecure),
-+            .in_secure = arm_space_is_secure(s2_space),
-+            .in_space = s2_space,
-             .in_debug = true,
-         };
-         GetPhysAddrResult s2 = { };
---
-.34.1

-[PULL 5/7] target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
+Deleted patch
-In get_phys_addr_twostage() the code that applies the effects of
-VSTCR.{SA,SW} and VTCR.{NSA,NSW} only updates result->f.attrs.secure.
-Now we also have f.attrs.space for FEAT_RME, we need to keep the two
-in sync.
-These bits only have an effect for Secure space translations, not
-for Root, so use the input in_space field to determine whether to
-apply them rather than the input is_secure. This doesn't actually
-make a difference because Root translations are never two-stage,
-but it's a little clearer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
-Message-id: 20230710152130.3928330-4-peter.maydell@linaro.org
----
- target/arm/ptw.c | 13 ++++++++-----
-file changed, 8 insertions(+), 5 deletions(-)
-diff --git a/target/arm/ptw.c b/target/arm/ptw.c
-index XXXXXXX..XXXXXXX 100644
---- a/target/arm/ptw.c
-+++ b/target/arm/ptw.c
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-     hwaddr ipa;
-     int s1_prot, s1_lgpgsz;
-     bool is_secure = ptw->in_secure;
-+    ARMSecuritySpace in_space = ptw->in_space;
-     bool ret, ipa_secure;
-     ARMCacheAttrs cacheattrs1;
-     ARMSecuritySpace ipa_space;
-@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
-      * Check if IPA translates to secure or non-secure PA space.
-      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
-      */
--    result->f.attrs.secure =
--        (is_secure
--         && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
--         && (ipa_secure
--             || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
-+    if (in_space == ARMSS_Secure) {
-+        result->f.attrs.secure =
-+            !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
-+            && (ipa_secure
-+                || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
-+        result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
-+    }
-     return false;
- }
---
-.34.1

-[PULL 6/7] accel/tcg: Zero-pad PC in TCG CPU exec trace lines
+Deleted patch
-In commit f0a08b0913befbd we changed the type of the PC from
-target_ulong to vaddr.  In doing so we inadvertently dropped the
-zero-padding on the PC in trace lines (the second item inside the []
-in these lines).  They used to look like this on AArch64, for
-instance:
-Trace 0: 0x7f2260000100 [00000000/0000000040000000/00000061/ff200000]
-and now they look like this:
-Trace 0: 0x7f4f50000100 [00000000/40000000/00000061/ff200000]
-and if the PC happens to be somewhere low like 0x5000
-then the field is shown as /5000/.
-This is because TARGET_FMT_lx is a "%08x" or "%016x" specifier,
-depending on TARGET_LONG_SIZE, whereas VADDR_PRIx is just PRIx64
-with no width specifier.
-Restore the zero-padding by adding an 016 width specifier to
-this tracing and a couple of others that were similarly recently
-changed to use VADDR_PRIx without a width specifier.
-We can't unfortunately restore the "32-bit guests are padded to
-hex digits and 64-bit guests to 16 hex digits" behaviour so
-easily.
-Fixes: f0a08b0913befbd ("accel/tcg/cpu-exec.c: Widen pc to vaddr")
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Reviewed-by: Anton Johansson <anjo@rev.ng>
-Message-id: 20230711165434.4123674-1-peter.maydell@linaro.org
----
- accel/tcg/cpu-exec.c      | 4 ++--
- accel/tcg/translate-all.c | 2 +-
-files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/cpu-exec.c
-+++ b/accel/tcg/cpu-exec.c
-@@ -XXX,XX +XXX,XX @@ static void log_cpu_exec(vaddr pc, CPUState *cpu,
-     if (qemu_log_in_addr_range(pc)) {
-         qemu_log_mask(CPU_LOG_EXEC,
-                       "Trace %d: %p [%08" PRIx64
--                      "/%" VADDR_PRIx "/%08x/%08x] %s\n",
-+                      "/%016" VADDR_PRIx "/%08x/%08x] %s\n",
-                       cpu->cpu_index, tb->tc.ptr, tb->cs_base, pc,
-                       tb->flags, tb->cflags, lookup_symbol(pc));
-@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
-         if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
-             vaddr pc = log_pc(cpu, last_tb);
-             if (qemu_log_in_addr_range(pc)) {
--                qemu_log("Stopped execution of TB chain before %p [%"
-+                qemu_log("Stopped execution of TB chain before %p [%016"
-                          VADDR_PRIx "] %s\n",
-                          last_tb->tc.ptr, pc, lookup_symbol(pc));
-             }
-diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
-index XXXXXXX..XXXXXXX 100644
---- a/accel/tcg/translate-all.c
-+++ b/accel/tcg/translate-all.c
-@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
-     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
-         vaddr pc = log_pc(cpu, tb);
-         if (qemu_log_in_addr_range(pc)) {
--            qemu_log("cpu_io_recompile: rewound execution of TB to %"
-+            qemu_log("cpu_io_recompile: rewound execution of TB to %016"
-                      VADDR_PRIx "\n", pc);
-         }
-     }
---
-.34.1

-[PULL 7/7] hw/nvram: Avoid unnecessary Xilinx eFuse backstore write
+Deleted patch
-From: Tong Ho <tong.ho@amd.com>
-Add a check in the bit-set operation to write the backstore
-only if the affected bit is 0 before.
-With this in place, there will be no need for callers to
-do the checking in order to avoid unnecessary writes.
-Signed-off-by: Tong Ho <tong.ho@amd.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- hw/nvram/xlnx-efuse.c | 11 +++++++++--
-file changed, 9 insertions(+), 2 deletions(-)
-diff --git a/hw/nvram/xlnx-efuse.c b/hw/nvram/xlnx-efuse.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/nvram/xlnx-efuse.c
-+++ b/hw/nvram/xlnx-efuse.c
-@@ -XXX,XX +XXX,XX @@ static bool efuse_ro_bits_find(XlnxEFuse *s, uint32_t k)
- bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
- {
-+    uint32_t set, *row;
-+
-     if (efuse_ro_bits_find(s, bit)) {
-         g_autofree char *path = object_get_canonical_path(OBJECT(s));
-@@ -XXX,XX +XXX,XX @@ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
-         return false;
-     }
--    s->fuse32[bit / 32] |= 1 << (bit % 32);
--    efuse_bdrv_sync(s, bit);
-+    /* Avoid back-end write unless there is a real update */
-+    row = &s->fuse32[bit / 32];
-+    set = 1 << (bit % 32);
-+    if (!(set & *row)) {
-+        *row |= set;
-+        efuse_bdrv_sync(s, bit);
-+    }
-     return true;
- }
---
-.34.1

A last small test of bug fixes before rc1.

thanks
-- PMM

The following changes since commit ed8ad9728a9c0eec34db9dff61dfa2f1dd625637:

Merge tag 'pull-tpm-2023-07-14-1' of https://github.com/stefanberger/qemu-tpm into staging (2023-07-15 14:54:04 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230717

for you to fetch changes up to c2c1c4a35c7c2b1a4140b0942b9797c857e476a4:

hw/nvram: Avoid unnecessary Xilinx eFuse backstore write (2023-07-17 11:05:52 +0100)

----------------------------------------------------------------
target-arm queue:
 * hw/arm/sbsa-ref: set 'slots' property of xhci
 * linux-user: Remove pointless NULL check in clock_adjtime handling
 * ptw: Fix S1_ptw_translate() debug path
 * ptw: Account for FEAT_RME when applying {N}SW, SA bits
 * accel/tcg: Zero-pad PC in TCG CPU exec trace lines
 * hw/nvram: Avoid unnecessary Xilinx eFuse backstore write

----------------------------------------------------------------
Peter Maydell (5):
      linux-user: Remove pointless NULL check in clock_adjtime handling
      target/arm/ptw.c: Add comments to S1Translate struct fields
      target/arm: Fix S1_ptw_translate() debug path
      target/arm/ptw.c: Account for FEAT_RME when applying {N}SW, SA bits
      accel/tcg: Zero-pad PC in TCG CPU exec trace lines

Tong Ho (1):
      hw/nvram: Avoid unnecessary Xilinx eFuse backstore write

Yuquan Wang (1):
      hw/arm/sbsa-ref: set 'slots' property of xhci

From: Yuquan Wang <wangyuquan1236@phytium.com.cn>

This extends the slots of xhci to 64, since the default xhci_sysbus
just supports one slot.

Signed-off-by: Wang Yuquan <wangyuquan1236@phytium.com.cn>
Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Reviewed-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20230710063750.473510-2-wangyuquan1236@phytium.com.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/arm/sbsa-ref.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/arm/sbsa-ref.c b/hw/arm/sbsa-ref.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/sbsa-ref.c
+++ b/hw/arm/sbsa-ref.c
@@ -XXX,XX +XXX,XX @@ static void create_xhci(const SBSAMachineState *sms)
     hwaddr base = sbsa_ref_memmap[SBSA_XHCI].base;
     int irq = sbsa_ref_irqmap[SBSA_XHCI];
     DeviceState *dev = qdev_new(TYPE_XHCI_SYSBUS);
+    qdev_prop_set_uint32(dev, "slots", XHCI_MAXSLOTS);
 
     sysbus_realize_and_unref(SYS_BUS_DEVICE(dev), &error_fatal);
     sysbus_mmio_map(SYS_BUS_DEVICE(dev), 0, base);
-- 
2.34.1

In the code for TARGET_NR_clock_adjtime, we set the pointer phtx to
the address of the local variable htx.  This means it can never be
NULL, but later in the code we check it for NULL anyway.  Coverity
complains about this (CID 1507683) because the NULL check comes after
a call to clock_adjtime() that assumes it is non-NULL.

Since phtx is always &htx, and is used only in three places, it's not
really necessary.  Remove it, bringing the code structure in to line
with that for TARGET_NR_clock_adjtime64, which already uses a simple
'&htx' when it wants a pointer to 'htx'.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230623144410.1837261-1-peter.maydell@linaro.org
---
 linux-user/syscall.c | 12 +++++-------
 1 file changed, 5 insertions(+), 7 deletions(-)

diff --git a/linux-user/syscall.c b/linux-user/syscall.c
index XXXXXXX..XXXXXXX 100644
--- a/linux-user/syscall.c
+++ b/linux-user/syscall.c
@@ -XXX,XX +XXX,XX @@ static abi_long do_syscall1(CPUArchState *cpu_env, int num, abi_long arg1,
 #if defined(TARGET_NR_clock_adjtime) && defined(CONFIG_CLOCK_ADJTIME)
     case TARGET_NR_clock_adjtime:
         {
-            struct timex htx, *phtx = &htx;
+            struct timex htx;
 
-            if (target_to_host_timex(phtx, arg2) != 0) {
+            if (target_to_host_timex(&htx, arg2) != 0) {
                 return -TARGET_EFAULT;
             }
-            ret = get_errno(clock_adjtime(arg1, phtx));
-            if (!is_error(ret) && phtx) {
-                if (host_to_target_timex(arg2, phtx) != 0) {
-                    return -TARGET_EFAULT;
-                }
+            ret = get_errno(clock_adjtime(arg1, &htx));
+            if (!is_error(ret) && host_to_target_timex(arg2, &htx)) {
+                return -TARGET_EFAULT;
             }
         }
         return ret;
-- 
2.34.1

Add comments to the in_* fields in the S1Translate struct
that explain what they're doing.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-2-peter.maydell@linaro.org
---
 target/arm/ptw.c | 40 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 40 insertions(+)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@
 #endif
 
 typedef struct S1Translate {
+    /*
+     * in_mmu_idx : specifies which TTBR, TCR, etc to use for the walk.
+     * Together with in_space, specifies the architectural translation regime.
+     */
     ARMMMUIdx in_mmu_idx;
+    /*
+     * in_ptw_idx: specifies which mmuidx to use for the actual
+     * page table descriptor load operations. This will be one of the
+     * ARMMMUIdx_Stage2* or one of the ARMMMUIdx_Phys_* indexes.
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     */
     ARMMMUIdx in_ptw_idx;
+    /*
+     * in_space: the security space for this walk. This plus
+     * the in_mmu_idx specify the architectural translation regime.
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     *
+     * Note that the security space for the in_ptw_idx may be different
+     * from that for the in_mmu_idx. We do not need to explicitly track
+     * the in_ptw_idx security space because:
+     *  - if the in_ptw_idx is an ARMMMUIdx_Phys_* then the mmuidx
+     *    itself specifies the security space
+     *  - if the in_ptw_idx is an ARMMMUIdx_Stage2* then the security
+     *    space used for ptw reads is the same as that of the security
+     *    space of the stage 1 translation for all cases except where
+     *    stage 1 is Secure; in that case the only possibilities for
+     *    the ptw read are Secure and NonSecure, and the in_ptw_idx
+     *    value being Stage2 vs Stage2_S distinguishes those.
+     */
     ARMSecuritySpace in_space;
+    /*
+     * in_secure: whether the translation regime is a Secure one.
+     * This is always equal to arm_space_is_secure(in_space).
+     * If a Secure ptw is "downgraded" to NonSecure by an NSTable bit,
+     * this field is updated accordingly.
+     */
     bool in_secure;
+    /*
+     * in_debug: is this a QEMU debug access (gdbstub, etc)? Debug
+     * accesses will not update the guest page table access flags
+     * and will not change the state of the softmmu TLBs.
+     */
     bool in_debug;
     /*
      * If this is stage 2 of a stage 1+2 page table walk, then this must
-- 
2.34.1

In commit fe4a5472ccd6 we rearranged the logic in S1_ptw_translate()
so that the debug-access "call get_phys_addr_*" codepath is used both
when S1 is doing ptw reads from stage 2 and when it is doing ptw
reads from physical memory.  However, we didn't update the
calculation of s2ptw->in_space and s2ptw->in_secure to account for
the "ptw reads from physical memory" case.  This meant that debug
accesses when in Secure state broke.

Create a new function S2_security_space() which returns the
correct security space to use for the ptw load, and use it to
determine the correct .in_secure and .in_space fields for the
stage 2 lookup for the ptw load.

Reported-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Jean-Philippe Brucker <jean-philippe@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-3-peter.maydell@linaro.org
Fixes: fe4a5472ccd6 ("target/arm: Use get_phys_addr_with_struct in S1_ptw_translate")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/ptw.c | 37 ++++++++++++++++++++++++++++++++-----
 1 file changed, 32 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool S2_attrs_are_device(uint64_t hcr, uint8_t attrs)
     }
 }
 
+static ARMSecuritySpace S2_security_space(ARMSecuritySpace s1_space,
+                                          ARMMMUIdx s2_mmu_idx)
+{
+    /*
+     * Return the security space to use for stage 2 when doing
+     * the S1 page table descriptor load.
+     */
+    if (regime_is_stage2(s2_mmu_idx)) {
+        /*
+         * The security space for ptw reads is almost always the same
+         * as that of the security space of the stage 1 translation.
+         * The only exception is when stage 1 is Secure; in that case
+         * the ptw read might be to the Secure or the NonSecure space
+         * (but never Realm or Root), and the s2_mmu_idx tells us which.
+         * Root translations are always single-stage.
+         */
+        if (s1_space == ARMSS_Secure) {
+            return arm_secure_to_space(s2_mmu_idx == ARMMMUIdx_Stage2_S);
+        } else {
+            assert(s2_mmu_idx != ARMMMUIdx_Stage2_S);
+            assert(s1_space != ARMSS_Root);
+            return s1_space;
+        }
+    } else {
+        /* ptw loads are from phys: the mmu idx itself says which space */
+        return arm_phys_to_space(s2_mmu_idx);
+    }
+}
+
 /* Translate a S1 pagetable walk through S2 if needed.  */
 static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
                              hwaddr addr, ARMMMUFaultInfo *fi)
 {
-    ARMSecuritySpace space = ptw->in_space;
     bool is_secure = ptw->in_secure;
     ARMMMUIdx mmu_idx = ptw->in_mmu_idx;
     ARMMMUIdx s2_mmu_idx = ptw->in_ptw_idx;
@@ -XXX,XX +XXX,XX @@ static bool S1_ptw_translate(CPUARMState *env, S1Translate *ptw,
          * From gdbstub, do not use softmmu so that we don't modify the
          * state of the cpu at all, including softmmu tlb contents.
          */
+        ARMSecuritySpace s2_space = S2_security_space(ptw->in_space, s2_mmu_idx);
         S1Translate s2ptw = {
             .in_mmu_idx = s2_mmu_idx,
             .in_ptw_idx = ptw_idx_for_stage_2(env, s2_mmu_idx),
-            .in_secure = s2_mmu_idx == ARMMMUIdx_Stage2_S,
-            .in_space = (s2_mmu_idx == ARMMMUIdx_Stage2_S ? ARMSS_Secure
-                         : space == ARMSS_Realm ? ARMSS_Realm
-                         : ARMSS_NonSecure),
+            .in_secure = arm_space_is_secure(s2_space),
+            .in_space = s2_space,
             .in_debug = true,
         };
         GetPhysAddrResult s2 = { };
-- 
2.34.1

In get_phys_addr_twostage() the code that applies the effects of
VSTCR.{SA,SW} and VTCR.{NSA,NSW} only updates result->f.attrs.secure.
Now we also have f.attrs.space for FEAT_RME, we need to keep the two
in sync.

These bits only have an effect for Secure space translations, not
for Root, so use the input in_space field to determine whether to
apply them rather than the input is_secure. This doesn't actually
make a difference because Root translations are never two-stage,
but it's a little clearer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Message-id: 20230710152130.3928330-4-peter.maydell@linaro.org
---
 target/arm/ptw.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/target/arm/ptw.c b/target/arm/ptw.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/ptw.c
+++ b/target/arm/ptw.c
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
     hwaddr ipa;
     int s1_prot, s1_lgpgsz;
     bool is_secure = ptw->in_secure;
+    ARMSecuritySpace in_space = ptw->in_space;
     bool ret, ipa_secure;
     ARMCacheAttrs cacheattrs1;
     ARMSecuritySpace ipa_space;
@@ -XXX,XX +XXX,XX @@ static bool get_phys_addr_twostage(CPUARMState *env, S1Translate *ptw,
      * Check if IPA translates to secure or non-secure PA space.
      * Note that VSTCR overrides VTCR and {N}SW overrides {N}SA.
      */
-    result->f.attrs.secure =
-        (is_secure
-         && !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
-         && (ipa_secure
-             || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW))));
+    if (in_space == ARMSS_Secure) {
+        result->f.attrs.secure =
+            !(env->cp15.vstcr_el2 & (VSTCR_SA | VSTCR_SW))
+            && (ipa_secure
+                || !(env->cp15.vtcr_el2 & (VTCR_NSA | VTCR_NSW)));
+        result->f.attrs.space = arm_secure_to_space(result->f.attrs.secure);
+    }
 
     return false;
 }
-- 
2.34.1

In commit f0a08b0913befbd we changed the type of the PC from
target_ulong to vaddr.  In doing so we inadvertently dropped the
zero-padding on the PC in trace lines (the second item inside the []
in these lines).  They used to look like this on AArch64, for
instance:

Trace 0: 0x7f2260000100 [00000000/0000000040000000/00000061/ff200000]

and now they look like this:
Trace 0: 0x7f4f50000100 [00000000/40000000/00000061/ff200000]

and if the PC happens to be somewhere low like 0x5000
then the field is shown as /5000/.

This is because TARGET_FMT_lx is a "%08x" or "%016x" specifier,
depending on TARGET_LONG_SIZE, whereas VADDR_PRIx is just PRIx64
with no width specifier.

Restore the zero-padding by adding an 016 width specifier to
this tracing and a couple of others that were similarly recently
changed to use VADDR_PRIx without a width specifier.

We can't unfortunately restore the "32-bit guests are padded to
8 hex digits and 64-bit guests to 16 hex digits" behaviour so
easily.

Fixes: f0a08b0913befbd ("accel/tcg/cpu-exec.c: Widen pc to vaddr")
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Reviewed-by: Anton Johansson <anjo@rev.ng>
Message-id: 20230711165434.4123674-1-peter.maydell@linaro.org
---
 accel/tcg/cpu-exec.c      | 4 ++--
 accel/tcg/translate-all.c | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/accel/tcg/cpu-exec.c b/accel/tcg/cpu-exec.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/cpu-exec.c
+++ b/accel/tcg/cpu-exec.c
@@ -XXX,XX +XXX,XX @@ static void log_cpu_exec(vaddr pc, CPUState *cpu,
     if (qemu_log_in_addr_range(pc)) {
         qemu_log_mask(CPU_LOG_EXEC,
                       "Trace %d: %p [%08" PRIx64
-                      "/%" VADDR_PRIx "/%08x/%08x] %s\n",
+                      "/%016" VADDR_PRIx "/%08x/%08x] %s\n",
                       cpu->cpu_index, tb->tc.ptr, tb->cs_base, pc,
                       tb->flags, tb->cflags, lookup_symbol(pc));
 
@@ -XXX,XX +XXX,XX @@ cpu_tb_exec(CPUState *cpu, TranslationBlock *itb, int *tb_exit)
         if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
             vaddr pc = log_pc(cpu, last_tb);
             if (qemu_log_in_addr_range(pc)) {
-                qemu_log("Stopped execution of TB chain before %p [%"
+                qemu_log("Stopped execution of TB chain before %p [%016"
                          VADDR_PRIx "] %s\n",
                          last_tb->tc.ptr, pc, lookup_symbol(pc));
             }
diff --git a/accel/tcg/translate-all.c b/accel/tcg/translate-all.c
index XXXXXXX..XXXXXXX 100644
--- a/accel/tcg/translate-all.c
+++ b/accel/tcg/translate-all.c
@@ -XXX,XX +XXX,XX @@ void cpu_io_recompile(CPUState *cpu, uintptr_t retaddr)
     if (qemu_loglevel_mask(CPU_LOG_EXEC)) {
         vaddr pc = log_pc(cpu, tb);
         if (qemu_log_in_addr_range(pc)) {
-            qemu_log("cpu_io_recompile: rewound execution of TB to %"
+            qemu_log("cpu_io_recompile: rewound execution of TB to %016"
                      VADDR_PRIx "\n", pc);
         }
     }
-- 
2.34.1

From: Tong Ho <tong.ho@amd.com>

Add a check in the bit-set operation to write the backstore
only if the affected bit is 0 before.

With this in place, there will be no need for callers to
do the checking in order to avoid unnecessary writes.

Signed-off-by: Tong Ho <tong.ho@amd.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Francisco Iglesias <frasse.iglesias@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/nvram/xlnx-efuse.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/hw/nvram/xlnx-efuse.c b/hw/nvram/xlnx-efuse.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/nvram/xlnx-efuse.c
+++ b/hw/nvram/xlnx-efuse.c
@@ -XXX,XX +XXX,XX @@ static bool efuse_ro_bits_find(XlnxEFuse *s, uint32_t k)
 
 bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
 {
+    uint32_t set, *row;
+
     if (efuse_ro_bits_find(s, bit)) {
         g_autofree char *path = object_get_canonical_path(OBJECT(s));
 
@@ -XXX,XX +XXX,XX @@ bool xlnx_efuse_set_bit(XlnxEFuse *s, unsigned int bit)
         return false;
     }
 
-    s->fuse32[bit / 32] |= 1 << (bit % 32);
-    efuse_bdrv_sync(s, bit);
+    /* Avoid back-end write unless there is a real update */
+    row = &s->fuse32[bit / 32];
+    set = 1 << (bit % 32);
+    if (!(set & *row)) {
+        *row |= set;
+        efuse_bdrv_sync(s, bit);
+    }
     return true;
 }
 
-- 
2.34.1

v1->v2 changes: drop the "convert FEATURE_THUMB2EE" patch as
it broke compilation on arm hosts (conversion of KVM related
code had been forgotten)

thanks
-- PMM

The following changes since commit 13399aad4fa87b2878c49d02a5d3bafa6c966ba3:

Merge remote-tracking branch 'remotes/armbru/tags/pull-error-2018-10-22' into staging (2018-10-23 17:20:23 +0100)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20181024

for you to fetch changes up to 93f379b0c43617b1361f742f261479eaed4959cb:

target/arm: Only flush tlb if ASID changes (2018-10-24 07:51:37 +0100)

----------------------------------------------------------------
target-arm queue:
 * ssi-sd: Make devices picking up backends unavailable with -device
 * Add support for VCPU event states
 * Move towards making ID registers the source of truth for
   whether a guest CPU implements a feature, rather than having
   parallel ID registers and feature bit flags
 * Implement various HCR hypervisor trap/config bits
 * Get IL bit correct for v7 syndrome values
 * Report correct syndrome for FP/SIMD traps to Hyp mode
 * hw/arm/boot: Increase compliance with kernel arm64 boot protocol
 * Refactor A32 Neon to use generic vector infrastructure
 * Fix a bug in A32 VLD2 "(multiple 2-element structures)" insn
 * net: cadence_gem: Report features correctly in ID register
 * Avoid some unnecessary TLB flushes on TTBR register writes

----------------------------------------------------------------
Dongjiu Geng (1):
      target/arm: Add support for VCPU event states

Edgar E. Iglesias (2):
      net: cadence_gem: Announce availability of priority queues
      net: cadence_gem: Announce 64bit addressing support

Markus Armbruster (1):
      ssi-sd: Make devices picking up backends unavailable with -device

Peter Maydell (10):
      target/arm: Improve debug logging of AArch32 exception return
      target/arm: Make switch_mode() file-local
      target/arm: Implement HCR.FB
      target/arm: Implement HCR.DC
      target/arm: ISR_EL1 bits track virtual interrupts if IMO/FMO set
      target/arm: Implement HCR.VI and VF
      target/arm: Implement HCR.PTW
      target/arm: New utility function to extract EC from syndrome
      target/arm: Get IL bit correct for v7 syndrome values
      target/arm: Report correct syndrome for FP/SIMD traps to Hyp mode

Richard Henderson (29):
      target/arm: Move some system registers into a substructure
      target/arm: V8M should not imply V7VE
      target/arm: Convert v8 extensions from feature bits to isar tests
      target/arm: Convert division from feature bits to isar0 tests
      target/arm: Convert jazelle from feature bit to isar1 test
      target/arm: Convert sve from feature bit to aa64pfr0 test
      target/arm: Convert v8.2-fp16 from feature bit to aa64pfr0 test
      target/arm: Hoist address increment for vector memory ops
      target/arm: Don't call tcg_clear_temp_count
      target/arm: Use tcg_gen_gvec_dup_i64 for LD[1-4]R
      target/arm: Promote consecutive memory ops for aa64
      target/arm: Mark some arrays const
      target/arm: Use gvec for NEON VDUP
      target/arm: Use gvec for NEON VMOV, VMVN, VBIC & VORR (immediate)
      target/arm: Use gvec for NEON_3R_LOGIC insns
      target/arm: Use gvec for NEON_3R_VADD_VSUB insns
      target/arm: Use gvec for NEON_2RM_VMN, NEON_2RM_VNEG
      target/arm: Use gvec for NEON_3R_VMUL
      target/arm: Use gvec for VSHR, VSHL
      target/arm: Use gvec for VSRA
      target/arm: Use gvec for VSRI, VSLI
      target/arm: Use gvec for NEON_3R_VML
      target/arm: Use gvec for NEON_3R_VTST_VCEQ, NEON_3R_VCGT, NEON_3R_VCGE
      target/arm: Use gvec for NEON VLD all lanes
      target/arm: Reorg NEON VLD/VST all elements
      target/arm: Promote consecutive memory ops for aa32
      target/arm: Reorg NEON VLD/VST single element to one lane
      target/arm: Remove writefn from TTBR0_EL3
      target/arm: Only flush tlb if ASID changes

Stewart Hildebrand (1):
      hw/arm/boot: Increase compliance with kernel arm64 boot protocol