[Qemu-commits] [qemu/qemu] def183: target/arm: Forbid unprivileged mode for M Baselin...

[GitHub]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: def183446cebc0090f6d885383a6502302249f33
      
https://github.com/qemu/qemu/commit/def183446cebc0090f6d885383a6502302249f33
  Author: Julia Suvorova <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Forbid unprivileged mode for M Baseline

MSR handling is the only place where CONTROL.nPRIV is modified.

Signed-off-by: Julia Suvorova <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 7c9140afd594d7be73320ffaeb08210c59eaf168
      
https://github.com/qemu/qemu/commit/7c9140afd594d7be73320ffaeb08210c59eaf168
  Author: Julia Suvorova <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/armv7m_nvic.c

  Log Message:
  -----------
  nvic: Handle ARMv6-M SCS reserved registers

Handle SCS reserved registers listed in ARMv6-M ARM D3.6.1.
All reserved registers are RAZ/WI. ARM_FEATURE_M_MAIN is used for the
checks, because these registers are reserved in ARMv8-M Baseline too.

Signed-off-by: Julia Suvorova <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 22ab3460017cfcfb6b50f05838ad142e08becce5
      
https://github.com/qemu/qemu/commit/22ab3460017cfcfb6b50f05838ad142e08becce5
  Author: Julia Suvorova <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/armv7m_nvic.c
    M target/arm/cpu.c
    M target/arm/helper.c

  Log Message:
  -----------
  arm: Add ARMv6-M programmer's model support

Forbid stack alignment change. (CCR)
Reserve FAULTMASK, BASEPRI registers.
Report any fault as a HardFault. Disable MemManage, BusFault and
UsageFault, so they always escalated to HardFault. (SHCSR)

Signed-off-by: Julia Suvorova <address@hidden>
Reviewed-by: Stefan Hajnoczi <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: c4379b4874f4c522f6818f1720f295205d7cf34d
      
https://github.com/qemu/qemu/commit/c4379b4874f4c522f6818f1720f295205d7cf34d
  Author: Julia Suvorova <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/armv7m_nvic.c
    M include/hw/intc/armv7m_nvic.h

  Log Message:
  -----------
  nvic: Change NVIC to support ARMv6-M

The differences from ARMv7-M NVIC are:
  * ARMv6-M only supports up to 32 external interrupts
   (configurable feature already). The ICTR is reserved.
  * Active Bit Register is reserved.
  * ARMv6-M supports 4 priority levels against 256 in ARMv7-M.

Signed-off-by: Julia Suvorova <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: dbea78a4d696e35d28a35db95cb29ff075626150
      
https://github.com/qemu/qemu/commit/dbea78a4d696e35d28a35db95cb29ff075626150
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M accel/tcg/cputlb.c
    M accel/tcg/softmmu_template.h
    M include/qom/cpu.h
    M memory.c

  Log Message:
  -----------
  accel/tcg: Pass read access type through to io_readx()

The io_readx() function needs to know whether the load it is
doing is an MMU_DATA_LOAD or an MMU_INST_FETCH, so that it
can pass the right value to the cpu_transaction_failed()
function. Plumb this information through from the softmmu
code.

This is currently not often going to give the wrong answer,
because usually instruction fetches go via get_page_addr_code().
However once we switch over to handling execution from non-RAM by
creating single-insn TBs, the path for an insn fetch to generate
a bus error will be through cpu_ld*_code() and io_readx(),
so without this change we will generate a d-side fault when we
should generate an i-side fault.

We also have to pass the access type via a CPU struct global
down to unassigned_mem_read(), for the benefit of the targets
which still use the cpu_unassigned_access() hook (m68k, mips,
sparc, xtensa).

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Cédric Le Goater <address@hidden>
Message-id: address@hidden


  Commit: 7252f2dea9d0854872f9b6df4e8f94c56accd076
      
https://github.com/qemu/qemu/commit/7252f2dea9d0854872f9b6df4e8f94c56accd076
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M accel/tcg/cpu-exec.c

  Log Message:
  -----------
  accel/tcg: Handle get_page_addr_code() returning -1 in hashtable lookups

When we support execution from non-RAM MMIO regions, get_page_addr_code()
will return -1 to indicate that there is no RAM at the requested address.
Handle this in the cpu-exec TB hashtable lookup code, treating it as
"no match found".

Note that the call to get_page_addr_code() in tb_lookup_cmp() needs
no changes -- a return of -1 will already correctly result in the
function returning false.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Reviewed-by: Emilio G. Cota <address@hidden>
Tested-by: Cédric Le Goater <address@hidden>
Message-id: address@hidden


  Commit: c360a0fd71239948197f81737ba8b4eb132915f1
      
https://github.com/qemu/qemu/commit/c360a0fd71239948197f81737ba8b4eb132915f1
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M accel/tcg/translate-all.c

  Log Message:
  -----------
  accel/tcg: Handle get_page_addr_code() returning -1 in tb_check_watchpoint()

When we support execution from non-RAM MMIO regions, get_page_addr_code()
will return -1 to indicate that there is no RAM at the requested address.
Handle this in tb_check_watchpoint() -- if the exception happened for a
PC which doesn't correspond to RAM then there is no need to invalidate
any TBs, because the one-instruction TB will not have been cached.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Tested-by: Cédric Le Goater <address@hidden>
Message-id: address@hidden


  Commit: 9739e3767af19096898d63eb9f2f0ff5004797d2
      
https://github.com/qemu/qemu/commit/9739e3767af19096898d63eb9f2f0ff5004797d2
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M accel/tcg/translate-all.c

  Log Message:
  -----------
  accel/tcg: tb_gen_code(): Create single-insn TB for execution from non-RAM

If get_page_addr_code() returns -1, this indicates that there is no RAM
page we can read a full TB from. Instead we must create a TB which
contains a single instruction and which we do not cache, so it is
executed only once.

Since this means we can now have TBs which are not in any page list,
we also need to make tb_phys_invalidate() handle them (by not trying
to remove them from a nonexistent page list).

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Reviewed-by: Emilio G. Cota <address@hidden>
Tested-by: Cédric Le Goater <address@hidden>
Message-id: address@hidden


  Commit: 20cb6ae4724d05cbbda0d9ceec7e357d646b6886
      
https://github.com/qemu/qemu/commit/20cb6ae4724d05cbbda0d9ceec7e357d646b6886
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M accel/tcg/cputlb.c

  Log Message:
  -----------
  accel/tcg: Return -1 for execution from MMIO regions in get_page_addr_code()

Now that all the callers can handle get_page_addr_code() returning -1,
remove all the code which tries to handle execution from MMIO regions
or small-MMU-region RAM areas. This will mean that we can correctly
execute from these areas, rather than ending up either aborting QEMU
or delivering an incorrect guest exception.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Cédric Le Goater <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden


  Commit: d4b6275df320cee764d56b194b1898547f545857
      
https://github.com/qemu/qemu/commit/d4b6275df320cee764d56b194b1898547f545857
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Allow execution from small regions

Now that we have full support for small regions, including execution,
we can remove the workarounds where we marked all small regions as
non-executable for the M-profile MPU and SAU.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Cédric Le Goater <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden


  Commit: 55a7cb144d8565583d31c323672745f87fca9954
      
https://github.com/qemu/qemu/commit/55a7cb144d8565583d31c323672745f87fca9954
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M accel/tcg/cputlb.c
    M exec.c
    M include/exec/exec-all.h

  Log Message:
  -----------
  accel/tcg: Check whether TLB entry is RAM consistently with how we set it up

We set up TLB entries in tlb_set_page_with_attrs(), where we have
some logic for determining whether the TLB entry is considered
to be RAM-backed, and thus has a valid addend field. When we
look at the TLB entry in get_page_addr_code(), we use different
logic for determining whether to treat the page as RAM-backed
and use the addend field. This is confusing, and in fact buggy,
because the code in tlb_set_page_with_attrs() correctly decides
that rom_device memory regions not in romd mode are not RAM-backed,
but the code in get_page_addr_code() thinks they are RAM-backed.
This typically results in "Bad ram pointer" assertion if the
guest tries to execute from such a memory region.

Fix this by making get_page_addr_code() just look at the
TLB_MMIO bit in the code_address field of the TLB, which
tlb_set_page_with_attrs() sets if and only if the addend
field is not valid for code execution.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Tested-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden


  Commit: 67ce697ac84bd7f44348830df43f05195d5987e6
      
https://github.com/qemu/qemu/commit/67ce697ac84bd7f44348830df43f05195d5987e6
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c
    M hw/intc/arm_gic_common.c
    M hw/intc/arm_gic_kvm.c
    M hw/intc/gic_internal.h

  Log Message:
  -----------
  intc/arm_gic: Refactor operations on the distributor

In preparation for the virtualization extensions implementation,
refactor the name of the functions and macros that act on the GIC
distributor to make that fact explicit. It will be useful to
differentiate them from the ones that will act on the virtual
interfaces.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Sai Pavan Boddu <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 3bb0b03897abb634231366ce4e6651b56f16aa26
      
https://github.com/qemu/qemu/commit/3bb0b03897abb634231366ce4e6651b56f16aa26
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c

  Log Message:
  -----------
  intc/arm_gic: Implement GICD_ISACTIVERn and GICD_ICACTIVERn registers

Implement GICD_ISACTIVERn and GICD_ICACTIVERn registers in the GICv2.
Those registers allow to set or clear the active state of an IRQ in the
distributor.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 50491c56a5e34948dc8d126c8f34e2457bd919fc
      
https://github.com/qemu/qemu/commit/50491c56a5e34948dc8d126c8f34e2457bd919fc
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c
    M hw/intc/gic_internal.h

  Log Message:
  -----------
  intc/arm_gic: Remove some dead code and put some functions static

Some functions are now only used in arm_gic.c, put them static. Some of
them where only used by the NVIC implementation and are not used
anymore, so remove them.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: b77473a0f7799f3484a1e483515c8bde7a872248
      
https://github.com/qemu/qemu/commit/b77473a0f7799f3484a1e483515c8bde7a872248
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M include/migration/vmstate.h

  Log Message:
  -----------
  vmstate.h: Provide VMSTATE_UINT16_SUB_ARRAY

Provide a VMSTATE_UINT16_SUB_ARRAY macro to save a uint16_t sub-array in
a VMState.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 5773c0494ae8045250288a801417270e0ef5de55
      
https://github.com/qemu/qemu/commit/5773c0494ae8045250288a801417270e0ef5de55
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c
    M hw/intc/arm_gic_common.c
    M hw/intc/arm_gic_kvm.c
    M hw/intc/gic_internal.h
    M include/hw/intc/arm_gic_common.h

  Log Message:
  -----------
  intc/arm_gic: Add the virtualization extensions to the GIC state

Add the necessary parts of the virtualization extensions state to the
GIC state. We choose to increase the size of the CPU interfaces state to
add space for the vCPU interfaces (the GIC_NCPU_VCPU macro). This way,
we'll be able to reuse most of the CPU interface code for the vCPUs.

The only exception is the APR value, which is stored in h_apr in the
virtual interface state for vCPUs. This is due to some complications
with the GIC VMState, for which we don't want to break backward
compatibility. APRs being stored in 2D arrays, increasing the second
dimension would lead to some ugly VMState description. To avoid
that, we keep it in h_apr for vCPUs.

The vCPUs are numbered from GIC_NCPU to (GIC_NCPU * 2) - 1. The
`gic_is_vcpu` function help to determine if a given CPU id correspond to
a physical CPU or a virtual one.

For the in-kernel KVM VGIC, since the exposed VGIC does not implement
the virtualization extensions, we report an error if the corresponding
property is set to true.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 7c2fffd282ec48ab852dd56b507abe76c64feea2
      
https://github.com/qemu/qemu/commit/7c2fffd282ec48ab852dd56b507abe76c64feea2
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/gic_internal.h

  Log Message:
  -----------
  intc/arm_gic: Add virtual interface register definitions

Add the register definitions for the virtual interface of the GICv2.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 4a37e0e47618533b3792a6a999d156703203b7a8
      
https://github.com/qemu/qemu/commit/4a37e0e47618533b3792a6a999d156703203b7a8
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c
    M hw/intc/gic_internal.h

  Log Message:
  -----------
  intc/arm_gic: Add virtualization extensions helper macros and functions

Add some helper macros and functions related to the virtualization
extensions to gic_internal.h.

The GICH_LR_* macros help extracting specific fields of a list register
value. The only tricky one is the priority field as only the MSB are
stored. The value must be shifted accordingly to obtain the correct
priority value.

gic_is_vcpu() and gic_get_vcpu_real_id() help with (v)CPU id manipulation
to abstract the fact that vCPU id are in the range
[ GIC_NCPU; (GIC_NCPU + num_cpu) [.

gic_lr_* and gic_virq_is_valid() help with the list registers.
gic_get_lr_entry() returns the LR entry for a given (vCPU, irq) pair. It
is meant to be used in contexts where we know for sure that the entry
exists, so we assert that entry is actually found, and the caller can
avoid the NULL check on the returned pointer.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 3dd0471b7584df8efc79c2e669460303d7394440
      
https://github.com/qemu/qemu/commit/3dd0471b7584df8efc79c2e669460303d7394440
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c

  Log Message:
  -----------
  intc/arm_gic: Refactor secure/ns access check in the CPU interface

An access to the CPU interface is non-secure if the current GIC instance
implements the security extensions, and the memory access is actually
non-secure. Until then, it was checked with tests such as
  if (s->security_extn && !attrs.secure) { ... }
in various places of the CPU interface code.

With the implementation of the virtualization extensions, those tests
must be updated to take into account whether we are in a vCPU interface
or not. This is because the exposed vCPU interface does not implement
security extensions.

This commits replaces all those tests with a call to the
gic_cpu_ns_access() function to check if the current access to the CPU
interface is non-secure. This function takes into account whether the
current CPU is a vCPU or not.

Note that this function is used only in the (v)CPU interface code path.
The distributor code path is left unchanged, as the distributor is not
exposed to vCPUs at all.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 86b350f0d07bae38dee6b7837fc30baea7b4c907
      
https://github.com/qemu/qemu/commit/86b350f0d07bae38dee6b7837fc30baea7b4c907
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c
    M hw/intc/gic_internal.h

  Log Message:
  -----------
  intc/arm_gic: Add virtualization enabled IRQ helper functions

Add some helper functions to gic_internal.h to get or change the state
of an IRQ. When the current CPU is not a vCPU, the call is forwarded to
the GIC distributor. Otherwise, it acts on the list register matching
the IRQ in the current CPU virtual interface.

gic_clear_active can have a side effect on the distributor, even in the
vCPU case, when the correponding LR has the HW field set.

Use those functions in the CPU interface code path to prepare for the
vCPU interface implementation.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: a1d7b8d896f98139dff177508895e55caf483f95
      
https://github.com/qemu/qemu/commit/a1d7b8d896f98139dff177508895e55caf483f95
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c

  Log Message:
  -----------
  intc/arm_gic: Implement virtualization extensions in 
gic_(activate_irq|drop_prio)

Implement virtualization extensions in gic_activate_irq() and
gic_drop_prio() and in gic_get_prio_from_apr_bits() called by
gic_drop_prio().

When the current CPU is a vCPU:
  - Use GIC_VIRT_MIN_BPR and GIC_VIRT_NR_APRS instead of their non-virt
  counterparts,
  - the vCPU APR is stored in the virtual interface, in h_apr.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 439badd66d6f1bf82211f86131c7ce75d951756a
      
https://github.com/qemu/qemu/commit/439badd66d6f1bf82211f86131c7ce75d951756a
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c

  Log Message:
  -----------
  intc/arm_gic: Implement virtualization extensions in gic_acknowledge_irq

Implement virtualization extensions in the gic_acknowledge_irq()
function. This function changes the state of the highest priority IRQ
from pending to active.

When the current CPU is a vCPU, modifying the state of an IRQ modifies
the corresponding LR entry. However if we clear the pending flag before
setting the active one, we lose track of the LR entry as it becomes
invalid. The next call to gic_get_lr_entry() will fail.

To overcome this issue, we call gic_activate_irq() before
gic_clear_pending(). This does not change the general behaviour of
gic_acknowledge_irq.

We also move the SGI case in gic_clear_pending_sgi() to enhance
code readability as the virtualization extensions support adds a if-else
level.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 02f2e22d7c81b7514f09dfbe91e81aad8e5381dc
      
https://github.com/qemu/qemu/commit/02f2e22d7c81b7514f09dfbe91e81aad8e5381dc
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c

  Log Message:
  -----------
  intc/arm_gic: Implement virtualization extensions in 
gic_(deactivate|complete_irq)

Implement virtualization extensions in the gic_deactivate_irq() and
gic_complete_irq() functions.

When the guest writes an invalid vIRQ to V_EOIR or V_DIR, since the
GICv2 specification is not entirely clear here, we adopt the behaviour
observed on real hardware:
  * When V_CTRL.EOIMode is false (EOI split is disabled):
    - In case of an invalid vIRQ write to V_EOIR:
      -> If some bits are set in H_APR, an invalid vIRQ write to V_EOIR
   triggers a priority drop, and increments V_HCR.EOICount.
      -> If V_APR is already cleared, nothing happen

    - An invalid vIRQ write to V_DIR is ignored.

  * When V_CTRL.EOIMode is true:
    - In case of an invalid vIRQ write to V_EOIR:
      -> If some bits are set in H_APR, an invalid vIRQ write to V_EOIR
   triggers a priority drop.
      -> If V_APR is already cleared, nothing happen

    - An invalid vIRQ write to V_DIR increments V_HCR.EOICount.

Signed-off-by: Luc Michel <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 7eb079ec510f72cc3d20f94bd78a02cca29c968c
      
https://github.com/qemu/qemu/commit/7eb079ec510f72cc3d20f94bd78a02cca29c968c
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c

  Log Message:
  -----------
  intc/arm_gic: Implement virtualization extensions in gic_cpu_(read|write)

Implement virtualization extensions in the gic_cpu_read() and
gic_cpu_write() functions. Those are the last bits missing to fully
support virtualization extensions in the CPU interface path.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 2c679ac734892e2a61ba3d1a7d5146f638882532
      
https://github.com/qemu/qemu/commit/2c679ac734892e2a61ba3d1a7d5146f638882532
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c

  Log Message:
  -----------
  intc/arm_gic: Wire the vCPU interface

Add the read/write functions to handle accesses to the vCPU interface.
Those accesses are forwarded to the real CPU interface, with the CPU id
being converted to the corresponding vCPU id (vCPU id = CPU id +
GIC_NCPU).

Signed-off-by: Luc Michel <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 527d296f5d236cd68de496d0cf1260fe3fe98ab5
      
https://github.com/qemu/qemu/commit/527d296f5d236cd68de496d0cf1260fe3fe98ab5
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c

  Log Message:
  -----------
  intc/arm_gic: Implement the virtual interface registers

Implement the read and write functions for the virtual interface of the
virtualization extensions in the GICv2.

One mirror region per CPU is also created, which maps to that specific
CPU id. This is required by the GIC architecture specification.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: cbe1282b56808200c62b08b0094188afb5eff542
      
https://github.com/qemu/qemu/commit/cbe1282b56808200c62b08b0094188afb5eff542
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c

  Log Message:
  -----------
  intc/arm_gic: Implement gic_update_virt() function

Add the gic_update_virt() function to update the vCPU interface states
and raise vIRQ and vFIQ as needed. This commit renames gic_update() to
gic_update_internal() and generalizes it to handle both cases, with a
`virt' parameter to track whether we are updating the CPU or vCPU
interfaces.

The main difference between CPU and vCPU is the way we select the best
IRQ. This part has been split into the gic_get_best_(v)irq functions.
For the virt case, the LRs are iterated to find the best candidate.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 50e579262d8187ea69a844d9af8e1064200008b3
      
https://github.com/qemu/qemu/commit/50e579262d8187ea69a844d9af8e1064200008b3
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c

  Log Message:
  -----------
  intc/arm_gic: Implement maintenance interrupt generation

Implement the maintenance interrupt generation that is part of the GICv2
virtualization extensions.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 067a2b9c154c7024ecb1053e3cef1f22b085d9d8
      
https://github.com/qemu/qemu/commit/067a2b9c154c7024ecb1053e3cef1f22b085d9d8
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gic.c
    M hw/intc/trace-events

  Log Message:
  -----------
  intc/arm_gic: Improve traces

Add some traces to the ARM GIC to catch register accesses (distributor,
(v)cpu interface and virtual interface), and to take into account
virtualization extensions (print `vcpu` instead of `cpu` when needed).

Also add some virtualization extensions specific traces: LR updating
and maintenance IRQ generation.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 75b749af0c944a416dd5f334fc483f01110c3f5c
      
https://github.com/qemu/qemu/commit/75b749af0c944a416dd5f334fc483f01110c3f5c
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/arm/xlnx-zynqmp.c
    M include/hw/arm/xlnx-zynqmp.h

  Log Message:
  -----------
  xlnx-zynqmp: Improve GIC wiring and MMIO mapping

This commit improve the way the GIC is realized and connected in the
ZynqMP SoC. The security extensions are enabled only if requested in the
machine state. The same goes for the virtualization extensions.

All the GIC to APU CPU(s) IRQ lines are now connected, including FIQ,
vIRQ and vFIQ. The missing CPU to GIC timers IRQ connections are also
added (HYP and SEC timers).

The GIC maintenance IRQs are back-wired to the correct GIC PPIs.

Finally, the MMIO mappings are reworked to take into account the ZynqMP
specifics. The GIC (v)CPU interface is aliased 16 times:
  * for the first 0x1000 bytes from 0xf9010000 to 0xf901f000
  * for the second 0x1000 bytes from 0xf9020000 to 0xf902f000
Mappings of the virtual interface and virtual CPU interface are mapped
only when virtualization extensions are requested. The
XlnxZynqMPGICRegion struct has been enhanced to be able to catch all
this information.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Edgar E. Iglesias <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 55ef3233586ab7acc3bbd970d4324bee8cc95112
      
https://github.com/qemu/qemu/commit/55ef3233586ab7acc3bbd970d4324bee8cc95112
  Author: Luc Michel <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/arm/virt-acpi-build.c
    M hw/arm/virt.c
    M include/hw/arm/virt.h

  Log Message:
  -----------
  arm/virt: Add support for GICv2 virtualization extensions

Add support for GICv2 virtualization extensions by mapping the necessary
I/O regions and connecting the maintenance IRQ lines.

Declare those additions in the device tree and in the ACPI tables.

Signed-off-by: Luc Michel <address@hidden>
Reviewed-by: Peter Maydell <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: a3f0ecfd4e98d22e1c24e7baa924d99250a5799f
      
https://github.com/qemu/qemu/commit/a3f0ecfd4e98d22e1c24e7baa924d99250a5799f
  Author: Adam Lackorzynski <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/arm/boot.c

  Log Message:
  -----------
  arm: Fix return code of arm_load_elf

Use an int64_t as a return type to restore
the negative check for arm_load_as.

Signed-off-by: Adam Lackorzynski <address@hidden>
Message-id: address@hidden
Reviewed-by: Peter Maydell <address@hidden>
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 2ccf0fef632f3d54b2cc9ea08f1e6904ff1f8df4
      
https://github.com/qemu/qemu/commit/2ccf0fef632f3d54b2cc9ea08f1e6904ff1f8df4
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/cpu.h

  Log Message:
  -----------
  target/arm: Mask virtual interrupts if HCR_EL2.TGE is set

If the "trap general exceptions" bit HCR_EL2.TGE is set, we
must mask all virtual interrupts (as per DDI0487C.a D1.14.3).
Implement this in arm_excp_unmasked().

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: 30ac6339dca3fe0d05a611f12eedd5af20af585a
      
https://github.com/qemu/qemu/commit/30ac6339dca3fe0d05a611f12eedd5af20af585a
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Honour HCR_EL2.TGE and MDCR_EL2.TDE in debug register access 
checks

Some debug registers can be trapped via MDCR_EL2 bits TDRA, TDOSA,
and TDA, which we implement in the functions access_tdra(),
access_tdosa() and access_tda(). If MDCR_EL2.TDE or HCR_EL2.TGE
are 1, the TDRA, TDOSA and TDA bits should behave as if they were 1.
Implement this by having the access functions check MDCR_EL2.TDE
and HCR_EL2.TGE.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: 7556edfb4d7bf0583c852c8cfc49ef494c41dd8a
      
https://github.com/qemu/qemu/commit/7556edfb4d7bf0583c852c8cfc49ef494c41dd8a
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/op_helper.c

  Log Message:
  -----------
  target/arm: Honour HCR_EL2.TGE when raising synchronous exceptions

Whene we raise a synchronous exception, if HCR_EL2.TGE is set then
exceptions targeting NS EL1 must be redirected to EL2.  Implement
this in raise_exception() -- all synchronous exceptions go through
this function.

(Asynchronous exceptions go via arm_cpu_exec_interrupt(), which
already honours HCR_EL2.TGE when it determines the target EL
in arm_phys_excp_target_el().)

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: ac656b166b57332ee397e9781810c956f4f5fde5
      
https://github.com/qemu/qemu/commit/ac656b166b57332ee397e9781810c956f4f5fde5
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M hw/intc/arm_gicv3_cpuif.c
    M target/arm/cpu.h
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Provide accessor functions for HCR_EL2.{IMO, FMO, AMO}

The IMO, FMO and AMO bits in HCR_EL2 are defined to "behave as
1 for all purposes other than direct reads" if HCR_EL2.TGE
is set and HCR_EL2.E2H is 0, and to "behave as 0 for all
purposes other than direct reads" if HCR_EL2.TGE is set
and HRC_EL2.E2H is 1.

To avoid having to check E2H and TGE everywhere where we test IMO and
FMO, provide accessors arm_hcr_el2_imo(), arm_hcr_el2_fmo()and
arm_hcr_el2_amo().  We don't implement ARMv8.1-VHE yet, so the E2H
case will never be true, but we include the logic to save effort when
we eventually do get to that.

(Note that in several of these callsites the change doesn't
actually make a difference as either the callsite is handling
TGE specially anyway, or the CPU can't get into that situation
with TGE set; we change everywhere for consistency.)

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: 3d0e3080d8b7abcddc038d18e8401861c369c4c1
      
https://github.com/qemu/qemu/commit/3d0e3080d8b7abcddc038d18e8401861c369c4c1
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Treat SCTLR_EL1.M as if it were zero when HCR_EL2.TGE is set

One of the required effects of setting HCR_EL2.TGE is that when
SCR_EL3.NS is 1 then SCTLR_EL1.M must behave as if it is zero for
all purposes except direct reads. That is, it effectively disables
the MMU for the NS EL0/EL1 translation regime.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: a9074977ef59db36f8755c79d3de97ef8f036913
      
https://github.com/qemu/qemu/commit/a9074977ef59db36f8755c79d3de97ef8f036913
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Improve exception-taken logging

Improve the exception-taken logging by logging in
v7m_exception_taken() the exception we're going to take
and whether it is secure/nonsecure.

This requires us to move logging at many callsites from after the
call to before it, so that the logging appears in a sensible order.

(This will make tail-chaining produce more useful logs; for the
current callers of v7m_exception_taken() we know which exception
we're going to take, so custom log messages at the callsite sufficed;
for tail-chaining only v7m_exception_taken() knows the exception
number that we're going to tail-chain to.)

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden


  Commit: b8109608bc6f3337298d44ac4369bf0bc8c3a1e4
      
https://github.com/qemu/qemu/commit/b8109608bc6f3337298d44ac4369bf0bc8c3a1e4
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Initialize exc_secure correctly in do_v7m_exception_exit()

In do_v7m_exception_exit(), we use the exc_secure variable to track
whether the exception we're returning from is secure or non-secure.
Unfortunately the statement initializing this was accidentally
inside an "if (env->v7m.exception != ARMV7M_EXCP_NMI)" conditional,
which meant that we were using the wrong value for NMI handlers.
Move the initialization out to the right place.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Message-id: address@hidden


  Commit: 89b1fec193b81b6ad0bd2975f2fa179980cc722e
      
https://github.com/qemu/qemu/commit/89b1fec193b81b6ad0bd2975f2fa179980cc722e
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Restore M-profile CONTROL.SPSEL before any tailchaining

On exception return for M-profile, we must restore the CONTROL.SPSEL
bit from the EXCRET value before we do any kind of tailchaining,
including for the derived exceptions on integrity check failures.
Otherwise we will give the guest an incorrect EXCRET.SPSEL value on
exception entry for the tailchained exception.

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: 5f62d3b9e67bfc3deb970e3c7fb7df7e57d46fc3
      
https://github.com/qemu/qemu/commit/5f62d3b9e67bfc3deb970e3c7fb7df7e57d46fc3
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/helper.c

  Log Message:
  -----------
  target/arm: Implement tailchaining for M profile cores

Tailchaining is an optimization in handling of exception return
for M-profile cores: if we are about to pop the exception stack
for an exception return, but there is a pending exception which
is higher priority than the priority we are returning to, then
instead of unstacking and then immediately taking the exception
and stacking registers again, we can chain to the pending
exception without unstacking and stacking.

For v6M and v7M it is IMPDEF whether tailchaining happens for pending
exceptions; for v8M this is architecturally required.  Implement it
in QEMU for all M-profile cores, since in practice v6M and v7M
hardware implementations generally do have it.

(We were already doing tailchaining for derived exceptions which
happened during exception return, like the validity checks and
stack access failures; these have always been required to be
tailchained for all versions of the architecture.)

Signed-off-by: Peter Maydell <address@hidden>
Reviewed-by: Richard Henderson <address@hidden>
Message-id: address@hidden


  Commit: df4e001093988544d09887122ae824f18ba55c68
      
https://github.com/qemu/qemu/commit/df4e001093988544d09887122ae824f18ba55c68
  Author: Richard Henderson <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/sve_helper.c

  Log Message:
  -----------
  target/arm: Fix sign of sve_cmpeq_ppzw/sve_cmpne_ppzw

The normal vector element is sign-extended before
comparing with the wide vector element.

Reported-by: Laurent Desnogues <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>
Reviewed-by: Laurent Desnogues <address@hidden>
Reviewed-by: Alex Bennée <address@hidden>
Tested-by: Alex Bennée <address@hidden>
Tested-by: Laurent Desnogues <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 7a31e0c6c68baffab0867bdd92b8744568b1d3ba
      
https://github.com/qemu/qemu/commit/7a31e0c6c68baffab0867bdd92b8744568b1d3ba
  Author: Richard Henderson <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/translate-sve.c

  Log Message:
  -----------
  target/arm: Fix typo in do_sat_addsub_64

Used the wrong temporary in the computation of subtractive overflow.

Reported-by: Laurent Desnogues <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>
Reviewed-by: Laurent Desnogues <address@hidden>
Tested-by: Alex Bennée <address@hidden>
Tested-by: Laurent Desnogues <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: bbd0968c458d48e34a08b8694fa3309a9fe1c9e7
      
https://github.com/qemu/qemu/commit/bbd0968c458d48e34a08b8694fa3309a9fe1c9e7
  Author: Richard Henderson <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/sve_helper.c
    M target/arm/translate-sve.c

  Log Message:
  -----------
  target/arm: Reorganize SVE WHILE

The pseudocode for this operation is an increment + compare loop,
so comparing <= the maximum integer produces an all-true predicate.

Rather than bound in both the inline code and the helper, pass the
helper the number of predicate bits to set instead of the number
of predicate elements to set.

Reported-by: Laurent Desnogues <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>
Reviewed-by: Laurent Desnogues <address@hidden>
Tested-by: Alex Bennée <address@hidden>
Tested-by: Laurent Desnogues <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 054e7adf4e64e4acb3b033348ebf7cc871baa34f
      
https://github.com/qemu/qemu/commit/054e7adf4e64e4acb3b033348ebf7cc871baa34f
  Author: Richard Henderson <address@hidden>
  Date:   2018-08-14 (Tue, 14 Aug 2018)

  Changed paths:
    M target/arm/sve_helper.c

  Log Message:
  -----------
  target/arm: Fix typo in helper_sve_movz_d

Reported-by: Laurent Desnogues <address@hidden>
Signed-off-by: Richard Henderson <address@hidden>
Reviewed-by: Laurent Desnogues <address@hidden>
Reviewed-by: Alex Bennée <address@hidden>
Reviewed-by: Philippe Mathieu-Daudé <address@hidden>
Tested-by: Alex Bennée <address@hidden>
Tested-by: Laurent Desnogues <address@hidden>
Message-id: address@hidden
Signed-off-by: Peter Maydell <address@hidden>


  Commit: 48a539df4a25b009c5a1239039349d54185fc0df
      
https://github.com/qemu/qemu/commit/48a539df4a25b009c5a1239039349d54185fc0df
  Author: Peter Maydell <address@hidden>
  Date:   2018-08-15 (Wed, 15 Aug 2018)

  Changed paths:
    M accel/tcg/cpu-exec.c
    M accel/tcg/cputlb.c
    M accel/tcg/softmmu_template.h
    M accel/tcg/translate-all.c
    M exec.c
    M hw/arm/boot.c
    M hw/arm/virt-acpi-build.c
    M hw/arm/virt.c
    M hw/arm/xlnx-zynqmp.c
    M hw/intc/arm_gic.c
    M hw/intc/arm_gic_common.c
    M hw/intc/arm_gic_kvm.c
    M hw/intc/arm_gicv3_cpuif.c
    M hw/intc/armv7m_nvic.c
    M hw/intc/gic_internal.h
    M hw/intc/trace-events
    M include/exec/exec-all.h
    M include/hw/arm/virt.h
    M include/hw/arm/xlnx-zynqmp.h
    M include/hw/intc/arm_gic_common.h
    M include/hw/intc/armv7m_nvic.h
    M include/migration/vmstate.h
    M include/qom/cpu.h
    M memory.c
    M target/arm/cpu.c
    M target/arm/cpu.h
    M target/arm/helper.c
    M target/arm/op_helper.c
    M target/arm/sve_helper.c
    M target/arm/translate-sve.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20180814' 
into staging

target-arm queue:
 * Implement more of ARMv6-M support
 * Support direct execution from non-RAM regions;
   use this to implmeent execution from small (<1K) MPU regions
 * GICv2: implement the virtualization extensions
 * support a virtualization-capable GICv2 in the virt and
   xlnx-zynqmp boards
 * arm: Fix return code of arm_load_elf() so we can detect
   failure to load the file correctly
 * Implement HCR_EL2.TGE ("trap general exceptions") bit
 * Implement tailchaining for M profile cores
 * Fix bugs in SVE compare, saturating add/sub, WHILE, MOVZ

# gpg: Signature made Tue 14 Aug 2018 17:23:38 BST
# gpg:                using RSA key 3C2525ED14360CDE
# gpg: Good signature from "Peter Maydell <address@hidden>"
# gpg:                 aka "Peter Maydell <address@hidden>"
# gpg:                 aka "Peter Maydell <address@hidden>"
# Primary key fingerprint: E1A5 C593 CD41 9DE2 8E83  15CF 3C25 25ED 1436 0CDE

* remotes/pmaydell/tags/pull-target-arm-20180814: (45 commits)
  target/arm: Fix typo in helper_sve_movz_d
  target/arm: Reorganize SVE WHILE
  target/arm: Fix typo in do_sat_addsub_64
  target/arm: Fix sign of sve_cmpeq_ppzw/sve_cmpne_ppzw
  target/arm: Implement tailchaining for M profile cores
  target/arm: Restore M-profile CONTROL.SPSEL before any tailchaining
  target/arm: Initialize exc_secure correctly in do_v7m_exception_exit()
  target/arm: Improve exception-taken logging
  target/arm: Treat SCTLR_EL1.M as if it were zero when HCR_EL2.TGE is set
  target/arm: Provide accessor functions for HCR_EL2.{IMO, FMO, AMO}
  target/arm: Honour HCR_EL2.TGE when raising synchronous exceptions
  target/arm: Honour HCR_EL2.TGE and MDCR_EL2.TDE in debug register access 
checks
  target/arm: Mask virtual interrupts if HCR_EL2.TGE is set
  arm: Fix return code of arm_load_elf
  arm/virt: Add support for GICv2 virtualization extensions
  xlnx-zynqmp: Improve GIC wiring and MMIO mapping
  intc/arm_gic: Improve traces
  intc/arm_gic: Implement maintenance interrupt generation
  intc/arm_gic: Implement gic_update_virt() function
  intc/arm_gic: Implement the virtual interface registers
  ...

Signed-off-by: Peter Maydell <address@hidden>


Compare: https://github.com/qemu/qemu/compare/c7fb81a53cac...48a539df4a25
      **NOTE:** This service has been marked for deprecation: 
https://developer.github.com/changes/2018-04-25-github-services-deprecation/

      Functionality will be removed from GitHub.com on January 31st, 2019.