Series comparison

-[Qemu-devel] [PULL 00/13] target-arm queue
+[PULL 0/8] target-arm queue
-Arm patch queue -- these are all bug fix patches but we might
+The following changes since commit aa9e7fa4689d1becb2faf67f65aafcbcf664f1ce:
 as well put them in to rc0...
-thanks
+  Merge tag 'edk2-stable202302-20230320-pull-request' of https://gitlab.com/kraxel/qemu into staging (2023-03-20 13:43:35 +0000)
 -- PMM
 The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:
   Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)
 are available in the Git repository at:
-  git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319
+  https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230321
-for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:
+for you to fetch changes up to 5787d17a42f7af4bd117e5d6bfa54b1fdf93c255:
-  hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)
+  target/arm: Don't advertise aarch64-pauth.xml to gdb (2023-03-21 13:19:08 +0000)
 ----------------------------------------------------------------
 target-arm queue:
- * fsl-imx6: Fix incorrect Ethernet interrupt defines
+ * contrib/elf2dmp: Support Windows Server 2022
- * dump: Update correct kdump phys_base field for AArch64
+ * hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
- * char: i.MX: Add support for "TX complete" interrupt
+ * target/arm: Add Neoverse-N1 IMPDEF registers
- * bcm2836/raspi: Fix various bugs resulting in panics trying
+ * hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
-   to boot a Debian Linux kernel on raspi3
+ * docs/system/arm/cpu-features.rst: Fix formatting
  * target/arm: Don't advertise aarch64-pauth.xml to gdb
 ----------------------------------------------------------------
-Andrey Smirnov (2):
+Chen Baozi (1):
-      char: i.MX: Simplify imx_update()
+      target/arm: Add Neoverse-N1 registers
       char: i.MX: Add support for "TX complete" interrupt
 Guenter Roeck (1):
-      fsl-imx6: Swap Ethernet interrupt defines
+      hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
-Peter Maydell (9):
+Peter Maydell (3):
-      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+      hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
-      hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
+      docs/system/arm/cpu-features.rst: Fix formatting
-      hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
+      target/arm: Don't advertise aarch64-pauth.xml to gdb
       hw/arm/bcm2386: Fix parent type of bcm2386
       hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
       hw/arm/bcm2836: Create proper bcm2837 device
       hw/arm/bcm2836: Use correct affinity values for BCM2837
       hw/arm/bcm2836: Hardcode correct CPU type
       hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
-Wei Huang (1):
+Viktor Prutyanov (3):
-      dump: Update correct kdump phys_base field for AArch64
+      contrib/elf2dmp: fix code style
       contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry
       contrib/elf2dmp: add PE name check and Windows Server 2022 support
- include/hw/arm/bcm2836.h     | 31 +++++++++++++---
+ docs/system/arm/cpu-features.rst |  68 ++++++++++-------------
- include/hw/arm/fsl-imx6.h    |  4 +-
+ contrib/elf2dmp/pe.h             | 115 ++++++++++++++++++++++-----------------
- include/hw/char/imx_serial.h |  3 ++
+ contrib/elf2dmp/addrspace.c      |   1 +
- dump.c                       | 14 +++++--
+ contrib/elf2dmp/main.c           | 108 ++++++++++++++++++++++++------------
- hw/arm/bcm2836.c             | 87 +++++++++++++++++++++++++++++++-------------
+ hw/char/cadence_uart.c           |   6 +-
- hw/arm/boot.c                | 12 ++++++
+ hw/usb/imx-usb-phy.c             |  19 ++++++-
- hw/arm/raspi.c               | 77 +++++++++++++++++++++++++++++++--------
+ target/arm/cpu64.c               |  69 +++++++++++++++++++++++
- hw/char/imx_serial.c         | 44 ++++++++++++++++------
+ target/arm/gdbstub.c             |   7 +++
- hw/net/imx_fec.c             | 28 +++++++++++++-
+files changed, 267 insertions(+), 126 deletions(-)
 files changed, 237 insertions(+), 63 deletions(-)

-[Qemu-devel] [PULL 10/13] hw/arm/bcm2836: Create proper bcm2837 device
+[PULL 1/8] target/arm: Add Neoverse-N1 registers
-The bcm2837 is pretty similar to the bcm2836, but it does have
+From: Chen Baozi <chenbaozi@phytium.com.cn>
 some differences. Notably, the MPIDR affinity aff1 values it
 sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
 uses, and if this is wrong Linux will not boot.
-Rather than trying to have one device with properties that
+Add implementation defined registers for neoverse-n1 which
-configure it differently for the two cases, create two
+would be accessed by TF-A. Since there is no DSU in Qemu,
-separate QOM devices for the two SoCs. We use the same approach
+CPUCFR_EL1.SCU bit is set to 1 to avoid DSU registers definition.
 as hw/arm/aspeed_soc.c and share code and have a data table
 that might differ per-SoC. For the moment the two types don't
 actually have different behaviour.
+Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
+Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
+Message-id: 20230313033936.585669-1-chenbaozi@phytium.com.cn
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
 ---
- include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
+ target/arm/cpu64.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++
- hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
+file changed, 69 insertions(+)
  hw/arm/raspi.c           |  3 ++-
 files changed, 53 insertions(+), 6 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
+diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
+--- a/target/arm/cpu64.c
-+++ b/include/hw/arm/bcm2836.h
++++ b/target/arm/cpu64.c
 @@ -XXX,XX +XXX,XX @@
+ #include "qemu/osdep.h"
- #define BCM283X_NCPUS 4
+ #include "qapi/error.h"
+ #include "cpu.h"
-+/* These type names are for specific SoCs; other than instantiating
++#include "cpregs.h"
-+ * them, code using these devices should always handle them via the
+ #include "qemu/module.h"
-+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
+ #include "sysemu/kvm.h"
-+ */
+ #include "sysemu/hvf.h"
-+#define TYPE_BCM2836 "bcm2836"
+@@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj)
-+#define TYPE_BCM2837 "bcm2837"
+     /* TODO:  Add A64FX specific HPC extension registers */
-+
+ }
- typedef struct BCM283XState {
-     /*< private >*/
++static const ARMCPRegInfo neoverse_n1_cp_reginfo[] = {
-     DeviceState parent_obj;
++    { .name = "ATCR_EL1", .state = ARM_CP_STATE_AA64,
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
++      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 7, .opc2 = 0,
-     BCM2835PeripheralState peripherals;
++      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
- } BCM283XState;
++    { .name = "ATCR_EL2", .state = ARM_CP_STATE_AA64,
++      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 0,
-+typedef struct BCM283XInfo BCM283XInfo;
++      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-+
++    { .name = "ATCR_EL3", .state = ARM_CP_STATE_AA64,
-+typedef struct BCM283XClass {
++      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 7, .opc2 = 0,
-+    DeviceClass parent_class;
++      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-+    const BCM283XInfo *info;
++    { .name = "ATCR_EL12", .state = ARM_CP_STATE_AA64,
-+} BCM283XClass;
++      .opc0 = 3, .opc1 = 5, .crn = 15, .crm = 7, .opc2 = 0,
-+
++      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-+#define BCM283X_CLASS(klass) \
++    { .name = "AVTCR_EL2", .state = ARM_CP_STATE_AA64,
-+    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
++      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 1,
-+#define BCM283X_GET_CLASS(obj) \
++      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-+    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
++    { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64,
-+
++      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 0,
- #endif /* BCM2836_H */
++      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
++    { .name = "CPUACTLR2_EL1", .state = ARM_CP_STATE_AA64,
-index XXXXXXX..XXXXXXX 100644
++      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 1,
---- a/hw/arm/bcm2836.c
++      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
-+++ b/hw/arm/bcm2836.c
++    { .name = "CPUACTLR3_EL1", .state = ARM_CP_STATE_AA64,
-@@ -XXX,XX +XXX,XX @@
++      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 2,
- /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
++      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
- #define BCM2836_CONTROL_BASE    0x40000000
++    /*
++     * Report CPUCFR_EL1.SCU as 1, as we do not implement the DSU
-+struct BCM283XInfo {
++     * (and in particular its system registers).
-+    const char *name;
++     */
 +    { .name = "CPUCFR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 0, .opc2 = 0,
 +      .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 4 },
 +    { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 4,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0x961563010 },
 +    { .name = "CPUPCR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 1,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPMR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 3,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPOR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 2,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPSELR_EL3", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 0,
 +      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "CPUPWRCTLR_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 7,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "ERXPFGCDN_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 2,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "ERXPFGCTL_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 1,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +    { .name = "ERXPFGF_EL1", .state = ARM_CP_STATE_AA64,
 +      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 0,
 +      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
 +};
 +
-+static const BCM283XInfo bcm283x_socs[] = {
++static void define_neoverse_n1_cp_reginfo(ARMCPU *cpu)
-+    {
++{
-+        .name = TYPE_BCM2836,
++    define_arm_cp_regs(cpu, neoverse_n1_cp_reginfo);
-+    },
++}
 +    {
 +        .name = TYPE_BCM2837,
 +    },
 +};
 +
- static void bcm2836_init(Object *obj)
+ static void aarch64_neoverse_n1_initfn(Object *obj)
  {
-     BCM283XState *s = BCM283X(obj);
+     ARMCPU *cpu = ARM_CPU(obj);
-@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
+@@ -XXX,XX +XXX,XX @@ static void aarch64_neoverse_n1_initfn(Object *obj)
-     DEFINE_PROP_END_OF_LIST()
- };
+     /* From D5.1 AArch64 PMU register summary */
+     cpu->isar.reset_pmcr_el0 = 0x410c3000;
--static void bcm2836_class_init(ObjectClass *oc, void *data)
++
-+static void bcm283x_class_init(ObjectClass *oc, void *data)
++    define_neoverse_n1_cp_reginfo(cpu);
  {
      DeviceClass *dc = DEVICE_CLASS(oc);
 +    BCM283XClass *bc = BCM283X_CLASS(oc);
 -    dc->props = bcm2836_props;
 +    bc->info = data;
      dc->realize = bcm2836_realize;
 +    dc->props = bcm2836_props;
  }
--static const TypeInfo bcm2836_type_info = {
+ static void aarch64_host_initfn(Object *obj)
 +static const TypeInfo bcm283x_type_info = {
      .name = TYPE_BCM283X,
      .parent = TYPE_DEVICE,
      .instance_size = sizeof(BCM283XState),
      .instance_init = bcm2836_init,
 -    .class_init = bcm2836_class_init,
 +    .class_size = sizeof(BCM283XClass),
 +    .abstract = true,
  };
  static void bcm2836_register_types(void)
  {
 -    type_register_static(&bcm2836_type_info);
 +    int i;
 +
 +    type_register_static(&bcm283x_type_info);
 +    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
 +        TypeInfo ti = {
 +            .name = bcm283x_socs[i].name,
 +            .parent = TYPE_BCM283X,
 +            .class_init = bcm283x_class_init,
 +            .class_data = (void *) &bcm283x_socs[i],
 +        };
 +        type_register(&ti);
 +    }
  }
  type_init(bcm2836_register_types)
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
      BusState *bus;
      DeviceState *carddev;
 -    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
 +    object_initialize(&s->soc, sizeof(s->soc),
 +                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
      object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                                &error_abort);
 --
-.16.2
+.34.1

-[Qemu-devel] [PULL 04/13] char: i.MX: Add support for "TX complete" interrupt
+[PULL 2/8] hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+The cadence UART attempts to avoid allowing the guest to set invalid
 baud rate register values in the uart_write() function.  However it
 does the "mask to the size of the register field" and "check for
 invalid values" in the wrong order, which means that a malicious
 guest can get a bogus value into the register by setting also some
 high bits in the value, and cause QEMU to crash by division-by-zero.
-Add support for "TX complete"/TXDC interrupt generate by real HW since
+Do the mask before the bounds check instead of afterwards.
 it is needed to support guests other than Linux.
-Based on the patch by Bill Paul as found here:
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493
-https://bugs.launchpad.net/qemu/+bug/1753314
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
 Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Tested-by: Qiang Liu <cyruscyliu@gmail.com>
 Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
 ---
  hw/char/cadence_uart.c | 6 ++++--
 file changed, 4 insertions(+), 2 deletions(-)
-Cc: qemu-devel@nongnu.org
+diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
 Cc: qemu-arm@nongnu.org
 Cc: Bill Paul <wpaul@windriver.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Bill Paul <wpaul@windriver.com>
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  include/hw/char/imx_serial.h |  3 +++
  hw/char/imx_serial.c         | 20 +++++++++++++++++---
 files changed, 20 insertions(+), 3 deletions(-)
 diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/char/imx_serial.h
+--- a/hw/char/cadence_uart.c
-+++ b/include/hw/char/imx_serial.h
++++ b/hw/char/cadence_uart.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
  #define UCR2_RXEN       (1<<1)    /* Receiver enable */
  #define UCR2_SRST       (1<<0)    /* Reset complete */
 +#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
 +
  #define UTS1_TXEMPTY    (1<<6)
  #define UTS1_RXEMPTY    (1<<5)
  #define UTS1_TXFULL     (1<<4)
@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
      uint32_t ubmr;
      uint32_t ubrc;
      uint32_t ucr3;
 +    uint32_t ucr4;
      qemu_irq irq;
      CharBackend chr;
 diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/char/imx_serial.c
 +++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@
  static const VMStateDescription vmstate_imx_serial = {
      .name = TYPE_IMX_SERIAL,
 -    .version_id = 1,
 -    .minimum_version_id = 1,
 +    .version_id = 2,
 +    .minimum_version_id = 2,
      .fields = (VMStateField[]) {
          VMSTATE_INT32(readbuff, IMXSerialState),
          VMSTATE_UINT32(usr1, IMXSerialState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
          VMSTATE_UINT32(ubmr, IMXSerialState),
          VMSTATE_UINT32(ubrc, IMXSerialState),
          VMSTATE_UINT32(ucr3, IMXSerialState),
 +        VMSTATE_UINT32(ucr4, IMXSerialState),
          VMSTATE_END_OF_LIST()
      },
  };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
       * unfortunately.
       */
      mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
 +    /*
 +     * TCEN and TXDC are both bit 3
 +     */
 +    mask |= s->ucr4 & UCR4_TCEN;
 +
      usr2 = s->usr2 & mask;
      qemu_set_irq(s->irq, usr1 || usr2);
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
          return s->ucr3;
      case 0x23: /* UCR4 */
 +        return s->ucr4;
 +
      case 0x29: /* BRM Incremental */
          return 0x0; /* TODO */
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
               * qemu_chr_fe_write and background I/O callbacks */
              qemu_chr_fe_write_all(&s->chr, &ch, 1);
              s->usr1 &= ~USR1_TRDY;
 +            s->usr2 &= ~USR2_TXDC;
              imx_update(s);
              s->usr1 |= USR1_TRDY;
 +            s->usr2 |= USR2_TXDC;
              imx_update(s);
          }
          break;
-@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
+     case R_BRGR: /* Baud rate generator */
-         s->ucr3 = value & 0xffff;
++        value &= 0xffff;
          if (value >= 0x01) {
 -            s->r[offset] = value & 0xFFFF;
 +            s->r[offset] = value;
          }
          break;
+     case R_BDIV:    /* Baud rate divider */
--    case 0x2d: /* UTS1 */
++        value &= 0xff;
-     case 0x23: /* UCR4 */
+         if (value >= 0x04) {
-+        s->ucr4 = value & 0xffff;
+-            s->r[offset] = value & 0xFF;
-+        imx_update(s);
++            s->r[offset] = value;
-+        break;
+         }
-+
+         break;
-+    case 0x2d: /* UTS1 */
+     default:
          qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
                        HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
          /* TODO */
 --
-.16.2
+.34.1

-[Qemu-devel] [PULL 03/13] char: i.MX: Simplify imx_update()
+[PULL 3/8] contrib/elf2dmp: fix code style
-From: Andrey Smirnov <andrew.smirnov@gmail.com>
+From: Viktor Prutyanov <viktor@daynix.com>
-Code of imx_update() is slightly confusing since the "flags" variable
+Originally elf2dmp were added with some code style issues,
-doesn't really corespond to anything in real hardware and server as a
+especially in pe.h header, and some were introduced by
-kitchensink accumulating events normally reported via USR1 and USR2
+d0fc797faaa73fbc1d30f5f9e90407bf3dd93f0. Fix them now.
 registers.
-Change the code to explicitly evaluate state of interrupts reported
+Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
-via USR1 and USR2 against corresponding masking bits and use the to
+Reviewed-by: Annie Li <annie.li@oracle.com>
-detemine if IRQ line should be asserted or not.
+Message-id: 20230222211246.883679-2-viktor@daynix.com
 NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
 reasons:
 . Emulation code implements a single character FIFO, so this flag
        will always be set since characters are trasmitted as a part of
        the code emulating "push" into the FIFO
 . imx_update() is really just a function doing ORing and maksing
        of reported events, so checking for UTS1_TXEMPTY should happen,
        if it's ever really needed should probably happen outside of
        it.
 Cc: qemu-devel@nongnu.org
 Cc: qemu-arm@nongnu.org
 Cc: Bill Paul <wpaul@windriver.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
 Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- hw/char/imx_serial.c | 24 ++++++++++++++++--------
+ contrib/elf2dmp/pe.h        | 100 ++++++++++++++++++------------------
-file changed, 16 insertions(+), 8 deletions(-)
+ contrib/elf2dmp/addrspace.c |   1 +
  contrib/elf2dmp/main.c      |   9 ++--
 files changed, 57 insertions(+), 53 deletions(-)
-diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
+diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/char/imx_serial.c
+--- a/contrib/elf2dmp/pe.h
-+++ b/hw/char/imx_serial.c
++++ b/contrib/elf2dmp/pe.h
-@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
+@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DOS_HEADER {
+ } __attribute__ ((packed)) IMAGE_DOS_HEADER;
- static void imx_update(IMXSerialState *s)
  typedef struct IMAGE_FILE_HEADER {
 -  uint16_t  Machine;
 -  uint16_t  NumberOfSections;
 -  uint32_t  TimeDateStamp;
 -  uint32_t  PointerToSymbolTable;
 -  uint32_t  NumberOfSymbols;
 -  uint16_t  SizeOfOptionalHeader;
 -  uint16_t  Characteristics;
 +    uint16_t  Machine;
 +    uint16_t  NumberOfSections;
 +    uint32_t  TimeDateStamp;
 +    uint32_t  PointerToSymbolTable;
 +    uint32_t  NumberOfSymbols;
 +    uint16_t  SizeOfOptionalHeader;
 +    uint16_t  Characteristics;
  } __attribute__ ((packed)) IMAGE_FILE_HEADER;
  typedef struct IMAGE_DATA_DIRECTORY {
 -  uint32_t VirtualAddress;
 -  uint32_t Size;
 +    uint32_t VirtualAddress;
 +    uint32_t Size;
  } __attribute__ ((packed)) IMAGE_DATA_DIRECTORY;
  #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
  typedef struct IMAGE_OPTIONAL_HEADER64 {
 -  uint16_t  Magic; /* 0x20b */
 -  uint8_t   MajorLinkerVersion;
 -  uint8_t   MinorLinkerVersion;
 -  uint32_t  SizeOfCode;
 -  uint32_t  SizeOfInitializedData;
 -  uint32_t  SizeOfUninitializedData;
 -  uint32_t  AddressOfEntryPoint;
 -  uint32_t  BaseOfCode;
 -  uint64_t  ImageBase;
 -  uint32_t  SectionAlignment;
 -  uint32_t  FileAlignment;
 -  uint16_t  MajorOperatingSystemVersion;
 -  uint16_t  MinorOperatingSystemVersion;
 -  uint16_t  MajorImageVersion;
 -  uint16_t  MinorImageVersion;
 -  uint16_t  MajorSubsystemVersion;
 -  uint16_t  MinorSubsystemVersion;
 -  uint32_t  Win32VersionValue;
 -  uint32_t  SizeOfImage;
 -  uint32_t  SizeOfHeaders;
 -  uint32_t  CheckSum;
 -  uint16_t  Subsystem;
 -  uint16_t  DllCharacteristics;
 -  uint64_t  SizeOfStackReserve;
 -  uint64_t  SizeOfStackCommit;
 -  uint64_t  SizeOfHeapReserve;
 -  uint64_t  SizeOfHeapCommit;
 -  uint32_t  LoaderFlags;
 -  uint32_t  NumberOfRvaAndSizes;
 -  IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
 +    uint16_t  Magic; /* 0x20b */
 +    uint8_t   MajorLinkerVersion;
 +    uint8_t   MinorLinkerVersion;
 +    uint32_t  SizeOfCode;
 +    uint32_t  SizeOfInitializedData;
 +    uint32_t  SizeOfUninitializedData;
 +    uint32_t  AddressOfEntryPoint;
 +    uint32_t  BaseOfCode;
 +    uint64_t  ImageBase;
 +    uint32_t  SectionAlignment;
 +    uint32_t  FileAlignment;
 +    uint16_t  MajorOperatingSystemVersion;
 +    uint16_t  MinorOperatingSystemVersion;
 +    uint16_t  MajorImageVersion;
 +    uint16_t  MinorImageVersion;
 +    uint16_t  MajorSubsystemVersion;
 +    uint16_t  MinorSubsystemVersion;
 +    uint32_t  Win32VersionValue;
 +    uint32_t  SizeOfImage;
 +    uint32_t  SizeOfHeaders;
 +    uint32_t  CheckSum;
 +    uint16_t  Subsystem;
 +    uint16_t  DllCharacteristics;
 +    uint64_t  SizeOfStackReserve;
 +    uint64_t  SizeOfStackCommit;
 +    uint64_t  SizeOfHeapReserve;
 +    uint64_t  SizeOfHeapCommit;
 +    uint32_t  LoaderFlags;
 +    uint32_t  NumberOfRvaAndSizes;
 +    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
  } __attribute__ ((packed)) IMAGE_OPTIONAL_HEADER64;
  typedef struct IMAGE_NT_HEADERS64 {
 -  uint32_t Signature;
 -  IMAGE_FILE_HEADER FileHeader;
 -  IMAGE_OPTIONAL_HEADER64 OptionalHeader;
 +    uint32_t Signature;
 +    IMAGE_FILE_HEADER FileHeader;
 +    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
  } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
  typedef struct IMAGE_DEBUG_DIRECTORY {
 -  uint32_t Characteristics;
 -  uint32_t TimeDateStamp;
 -  uint16_t MajorVersion;
 -  uint16_t MinorVersion;
 -  uint32_t Type;
 -  uint32_t SizeOfData;
 -  uint32_t AddressOfRawData;
 -  uint32_t PointerToRawData;
 +    uint32_t Characteristics;
 +    uint32_t TimeDateStamp;
 +    uint16_t MajorVersion;
 +    uint16_t MinorVersion;
 +    uint32_t Type;
 +    uint32_t SizeOfData;
 +    uint32_t AddressOfRawData;
 +    uint32_t PointerToRawData;
  } __attribute__ ((packed)) IMAGE_DEBUG_DIRECTORY;
  #define IMAGE_DEBUG_TYPE_CODEVIEW   2
 diff --git a/contrib/elf2dmp/addrspace.c b/contrib/elf2dmp/addrspace.c
 index XXXXXXX..XXXXXXX 100644
 --- a/contrib/elf2dmp/addrspace.c
 +++ b/contrib/elf2dmp/addrspace.c
@@ -XXX,XX +XXX,XX @@
  static struct pa_block *pa_space_find_block(struct pa_space *ps, uint64_t pa)
  {
--    uint32_t flags;
+     size_t i;
-+    uint32_t usr1;
++
-+    uint32_t usr2;
+     for (i = 0; i < ps->block_nr; i++) {
-+    uint32_t mask;
+         if (ps->block[i].paddr <= pa &&
+                 pa <= ps->block[i].paddr + ps->block[i].size) {
--    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
+diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
--    if (s->ucr1 & UCR1_TXMPTYEN) {
+index XXXXXXX..XXXXXXX 100644
--        flags |= (s->uts1 & UTS1_TXEMPTY);
+--- a/contrib/elf2dmp/main.c
--    } else {
++++ b/contrib/elf2dmp/main.c
--        flags &= ~USR1_TRDY;
+@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
--    }
+     };
-+    /*
-+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
+     for (i = 0; i < ps->block_nr; i++) {
-+     * UCR1, so we can get away with something as simple as the
+-        h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / ELF2DMP_PAGE_SIZE;
-+     * following:
++        h.PhysicalMemoryBlock.NumberOfPages +=
-+     */
++                ps->block[i].size / ELF2DMP_PAGE_SIZE;
-+    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
+         h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
-+    /*
+             .BasePage = ps->block[i].paddr / ELF2DMP_PAGE_SIZE,
-+     * Bits that we want in USR2 are not as conveniently laid out,
+             .PageCount = ps->block[i].size / ELF2DMP_PAGE_SIZE,
-+     * unfortunately.
+         };
-+     */
+     }
-+    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
-+    usr2 = s->usr2 & mask;
+-    h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
++    h.RequiredDumpSpace +=
--    qemu_set_irq(s->irq, !!flags);
++            h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
-+    qemu_set_irq(s->irq, usr1 || usr2);
- }
+     *hdr = h;
- static void imx_serial_reset(IMXSerialState *s)
+@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
  static int fill_context(KDDEBUGGER_DATA64 *kdbg,
          struct va_space *vs, QEMU_Elf *qe)
  {
 -        int i;
 +    int i;
 +
      for (i = 0; i < qe->state_nr; i++) {
          uint64_t Prcb;
          uint64_t Context;
 --
-.16.2
+.34.1

-[Qemu-devel] [PULL 13/13] hw/arm/raspi: Provide spin-loop code for AArch64 CPUs
+[PULL 4/8] contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry
-The raspi3 has AArch64 CPUs, which means that our smpboot
+From: Viktor Prutyanov <viktor@daynix.com>
 code for keeping the secondary CPUs in a pen needs to have
 a version for A64 as well as A32. Without this, the
 secondary CPUs go into an infinite loop of taking undefined
 instruction exceptions.
+Move out PE directory search functionality to be reused not only
+for Debug Directory processing but for arbitrary PE directory.
+Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
+Reviewed-by: Annie Li <annie.li@oracle.com>
+Message-id: 20230222211246.883679-3-viktor@daynix.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
 ---
- hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
+ contrib/elf2dmp/main.c | 71 +++++++++++++++++++++++++-----------------
-file changed, 40 insertions(+), 1 deletion(-)
+file changed, 42 insertions(+), 29 deletions(-)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
+diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
+--- a/contrib/elf2dmp/main.c
-+++ b/hw/arm/raspi.c
++++ b/contrib/elf2dmp/main.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static int fill_context(KDDEBUGGER_DATA64 *kdbg,
- #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
+     return 0;
  #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
  #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
 +#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
  /* Table of Linux board IDs for different Pi versions */
  static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
                         info->smp_loader_start);
  }
-+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
++static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
 +        void *entry, size_t size, struct va_space *vs)
 +{
-+    /* Unlike the AArch32 version we don't need to call the board setup hook.
++    const char e_magic[2] = "MZ";
-+     * The mechanism for doing the spin-table is also entirely different.
++    const char Signature[4] = "PE\0\0";
-+     * We must have four 64-bit fields at absolute addresses
++    IMAGE_DOS_HEADER *dos_hdr = start_addr;
-+     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
++    IMAGE_NT_HEADERS64 nt_hdrs;
-+     * our CPUs, and which we must ensure are zero initialized before
++    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
-+     * the primary CPU goes into the kernel. We put these variables inside
++    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
-+     * a rom blob, so that the reset for ROM contents zeroes them for us.
++    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
 +     */
 +    static const uint32_t smpboot[] = {
 +        0xd2801b05, /*        mov     x5, 0xd8 */
 +        0xd53800a6, /*        mrs     x6, mpidr_el1 */
 +        0x924004c6, /*        and     x6, x6, #0x3 */
 +        0xd503205f, /* spin:  wfe */
 +        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
 +        0xb4ffffc4, /*        cbz     x4, spin */
 +        0xd2800000, /*        mov     x0, #0x0 */
 +        0xd2800001, /*        mov     x1, #0x0 */
 +        0xd2800002, /*        mov     x2, #0x0 */
 +        0xd2800003, /*        mov     x3, #0x0 */
 +        0xd61f0080, /*        br      x4 */
 +    };
 +
-+    static const uint64_t spintables[] = {
++    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
 +        0, 0, 0, 0
 +    };
 +
-+    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
++    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
-+                       info->smp_loader_start);
++        return 1;
-+    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
++    }
-+                       SPINTABLE_ADDR);
++
 +    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
 +                &nt_hdrs, sizeof(nt_hdrs), 0)) {
 +        return 1;
 +    }
 +
 +    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
 +            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
 +        return 1;
 +    }
 +
 +    if (va_space_rw(vs,
 +                base + data_dir[idx].VirtualAddress,
 +                entry, size, 0)) {
 +        return 1;
 +    }
 +
 +    printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
 +            (uint32_t)data_dir[idx].VirtualAddress);
 +
 +    return 0;
 +}
 +
- static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
+ static int write_dump(struct pa_space *ps,
          WinDumpHeader64 *hdr, const char *name)
  {
-     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
+@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
+ static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
-     /* Pi2 and Pi3 requires SMP setup */
+         char *hash, struct va_space *vs)
-     if (version >= 2) {
+ {
-         binfo.smp_loader_start = SMPBOOT_ADDR;
+-    const char e_magic[2] = "MZ";
--        binfo.write_secondary_boot = write_smpboot;
+-    const char Signature[4] = "PE\0\0";
-+        if (version == 2) {
+     const char sign_rsds[4] = "RSDS";
-+            binfo.write_secondary_boot = write_smpboot;
+-    IMAGE_DOS_HEADER *dos_hdr = start_addr;
-+        } else {
+-    IMAGE_NT_HEADERS64 nt_hdrs;
-+            binfo.write_secondary_boot = write_smpboot64;
+-    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
-+        }
+-    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
-         binfo.secondary_cpu_reset_hook = reset_secondary;
+-    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
      IMAGE_DEBUG_DIRECTORY debug_dir;
      OMFSignatureRSDS rsds;
      char *pdb_name;
      size_t pdb_name_sz;
      size_t i;
 -    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
 -
 -    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
 -        return 1;
 -    }
 -
 -    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
 -                &nt_hdrs, sizeof(nt_hdrs), 0)) {
 -        return 1;
 -    }
 -
 -    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
 -            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
 -        return 1;
 -    }
 -
 -    printf("Debug Directory RVA = 0x%08"PRIx32"\n",
 -            (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
 -
 -    if (va_space_rw(vs,
 -                base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
 -                &debug_dir, sizeof(debug_dir), 0)) {
 +    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
 +                &debug_dir, sizeof(debug_dir), vs)) {
 +        eprintf("Failed to get Debug Directory\n");
          return 1;
      }
 --
-.16.2
+.34.1

-[Qemu-devel] [PULL 12/13] hw/arm/bcm2836: Hardcode correct CPU type
+[PULL 5/8] contrib/elf2dmp: add PE name check and Windows Server 2022 support
-Now we have separate types for BCM2386 and BCM2387, we might as well
+From: Viktor Prutyanov <viktor@daynix.com>
 just hard-code the CPU type they use rather than having it passed
 through as an object property. This then lets us put the initialization
 of the CPU object in init rather than realize.
-Note that this change means that it's no longer possible on
+Since its inception elf2dmp has checked MZ signatures within an
-the command line to use -cpu to ask for a different kind of
+address space above IDT[0] interrupt vector and took first PE image
-CPU than the SoC supports. This was never a supported thing to
+found as Windows Kernel.
-do anyway; we were just not sanity-checking the command line.
+But in Windows Server 2022 memory dump this address space range is
 full of invalid PE fragments and the tool must check that PE image
 is 'ntoskrnl.exe' actually.
 So, introduce additional validation by checking image name from
 Export Directory against 'ntoskrnl.exe'.
-This does require us to only build the bcm2837 object on
+Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
-TARGET_AARCH64 configs, since otherwise it won't instantiate
+Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com>
-due to the missing cortex-a53 device and "make check" will fail.
+Reviewed-by: Annie Li <annie.li@oracle.com>
 Message-id: 20230222211246.883679-4-viktor@daynix.com
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
  contrib/elf2dmp/pe.h   | 15 +++++++++++++++
  contrib/elf2dmp/main.c | 28 ++++++++++++++++++++++++++--
 files changed, 41 insertions(+), 2 deletions(-)
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
 Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
 ---
  hw/arm/bcm2836.c | 24 +++++++++++++++---------
  hw/arm/raspi.c   |  2 --
 files changed, 15 insertions(+), 11 deletions(-)
 diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/contrib/elf2dmp/pe.h
-+++ b/hw/arm/bcm2836.c
++++ b/contrib/elf2dmp/pe.h
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_NT_HEADERS64 {
      IMAGE_OPTIONAL_HEADER64 OptionalHeader;
  } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
 +typedef struct IMAGE_EXPORT_DIRECTORY {
 +    uint32_t    Characteristics;
 +    uint32_t    TimeDateStamp;
 +    uint16_t    MajorVersion;
 +    uint16_t    MinorVersion;
 +    uint32_t    Name;
 +    uint32_t    Base;
 +    uint32_t    NumberOfFunctions;
 +    uint32_t    NumberOfNames;
 +    uint32_t    AddressOfFunctions;
 +    uint32_t    AddressOfNames;
 +    uint32_t    AddressOfNameOrdinals;
 +} __attribute__ ((packed)) IMAGE_EXPORT_DIRECTORY;
 +
  typedef struct IMAGE_DEBUG_DIRECTORY {
      uint32_t Characteristics;
      uint32_t TimeDateStamp;
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DEBUG_DIRECTORY {
  #define IMAGE_DEBUG_TYPE_CODEVIEW   2
  #endif
 +#define IMAGE_FILE_EXPORT_DIRECTORY 0
  #define IMAGE_FILE_DEBUG_DIRECTORY  6
  typedef struct guid_t {
 diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
 index XXXXXXX..XXXXXXX 100644
 --- a/contrib/elf2dmp/main.c
 +++ b/contrib/elf2dmp/main.c
 @@ -XXX,XX +XXX,XX @@
- struct BCM283XInfo {
+ #define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
-     const char *name;
+ #define PDB_NAME    "ntkrnlmp.pdb"
-+    const char *cpu_type;
++#define PE_NAME     "ntoskrnl.exe"
-     int clusterid;
- };
+ #define INITIAL_MXCSR   0x1f80
- static const BCM283XInfo bcm283x_socs[] = {
+@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
-     {
+     return fclose(dmp_file);
-         .name = TYPE_BCM2836,
+ }
-+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
-         .clusterid = 0xf,
++static bool pe_check_export_name(uint64_t base, void *start_addr,
-     },
++        struct va_space *vs)
-+#ifdef TARGET_AARCH64
++{
-     {
++    IMAGE_EXPORT_DIRECTORY export_dir;
-         .name = TYPE_BCM2837,
++    const char *pe_name;
-+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
++
-         .clusterid = 0x0,
++    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_EXPORT_DIRECTORY,
-     },
++                &export_dir, sizeof(export_dir), vs)) {
-+#endif
++        return false;
- };
++    }
++
- static void bcm2836_init(Object *obj)
++    pe_name = va_space_resolve(vs, base + export_dir.Name);
 +    if (!pe_name) {
 +        return false;
 +    }
 +
 +    return !strcmp(pe_name, PE_NAME);
 +}
 +
  static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
          char *hash, struct va_space *vs)
  {
-     BCM283XState *s = BCM283X(obj);
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
-+    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
+     uint64_t KdDebuggerDataBlock;
-+    const BCM283XInfo *info = bc->info;
+     KDDEBUGGER_DATA64 *kdbg;
-+    int n;
+     uint64_t KdVersionBlock;
-+
++    bool kernel_found = false;
-+    for (n = 0; n < BCM283X_NCPUS; n++) {
-+        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
+     if (argc != 3) {
-+                          info->cpu_type);
+         eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
-+        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
-+                                  &error_abort);
+         }
-+    }
+         if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
-     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
+-            break;
-     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
++            if (pe_check_export_name(KernBase, nt_start_addr, &vs)) {
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
++                kernel_found = true;
++                break;
-     /* common peripherals from bcm2835 */
++            }
+         }
--    obj = OBJECT(dev);
+     }
--    for (n = 0; n < BCM283X_NCPUS; n++) {
--        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
+-    if (!nt_start_addr) {
--                          s->cpu_type);
++    if (!kernel_found) {
--        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
+         eprintf("Failed to find NT kernel image\n");
--                                  &error_abort);
+         err = 1;
--    }
+         goto out_ps;
 -
      obj = object_property_get_link(OBJECT(dev), "ram", &err);
      if (obj == NULL) {
          error_setg(errp, "%s: required ram link not found: %s",
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
  }
  static Property bcm2836_props[] = {
 -    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
      DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
                         BCM283X_NCPUS),
      DEFINE_PROP_END_OF_LIST()
 diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/arm/raspi.c
 +++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
      /* Setup the SOC */
      object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
                                     &error_abort);
 -    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
 -                            &error_abort);
      object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                              &error_abort);
      int board_rev = version == 3 ? 0xa02082 : 0xa21041;
 --
-.16.2
+.34.1

-[Qemu-devel] [PULL 01/13] fsl-imx6: Swap Ethernet interrupt defines
+[PULL 6/8] hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
 From: Guenter Roeck <linux@roeck-us.net>
-The sabrelite machine model used by qemu-system-arm is based on the
+The i.MX USB Phy driver does not check register ranges, resulting in out of
-Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
+bounds accesses if an attempt is made to access non-existing PHY registers.
-controller which is supported in QEMU using the imx_fec.c module
+Add range check and conditionally report bad accesses to fix the problem.
 (actually called imx.enet for this model.)
-The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
+While at it, also conditionally log attempted writes to non-existing or
-imx.enet device like this:
+read-only registers.
- #define FSL_IMX6_ENET_MAC_1588_IRQ 118
+Reported-by: Qiang Liu <cyruscyliu@gmail.com>
  #define FSL_IMX6_ENET_MAC_IRQ 119
 According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
 page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
 interrupts are as follows.
 ENET MAC 0 IRQ
 ENET MAC 0 1588 Timer interrupt
 where
 - 32 == 118
 - 32 == 119
 In other words, the vector definitions in the fsl-imx6.h file are reversed.
 Fixing the interrupts alone causes problems with older Linux kernels:
 The Ethernet interface will fail to probe with Linux v4.9 and earlier.
 Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
 error handling. This is a Linux kernel problem, not a qemu problem:
 the Linux kernel only worked by accident since it requested both interrupts.
 For backward compatibility, generate the Ethernet interrupt on both interrupt
 lines. This was shown to work from all Linux kernel releases starting with
 v3.16.
 Link: https://bugs.launchpad.net/qemu/+bug/1753309
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
-Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
+Tested-by: Qiang Liu <cyruscyliu@gmail.com>
 Message-id: 20230316234926.208874-1-linux@roeck-us.net
 Link: https://gitlab.com/qemu-project/qemu/-/issues/1408
 Fixes: 0701a5efa015 ("hw/usb: Add basic i.MX USB Phy support")
 Signed-off-by: Guenter Roeck <linux@roeck-us.net>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 ---
- include/hw/arm/fsl-imx6.h |  4 ++--
+ hw/usb/imx-usb-phy.c | 19 +++++++++++++++++--
- hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
+file changed, 17 insertions(+), 2 deletions(-)
 files changed, 29 insertions(+), 3 deletions(-)
-diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
+diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/fsl-imx6.h
+--- a/hw/usb/imx-usb-phy.c
-+++ b/include/hw/arm/fsl-imx6.h
++++ b/hw/usb/imx-usb-phy.c
-@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
+@@ -XXX,XX +XXX,XX @@
- #define FSL_IMX6_HDMI_MASTER_IRQ 115
+ #include "qemu/osdep.h"
- #define FSL_IMX6_HDMI_CEC_IRQ 116
+ #include "hw/usb/imx-usb-phy.h"
- #define FSL_IMX6_MLB150_LOW_IRQ 117
+ #include "migration/vmstate.h"
--#define FSL_IMX6_ENET_MAC_1588_IRQ 118
++#include "qemu/log.h"
--#define FSL_IMX6_ENET_MAC_IRQ 119
+ #include "qemu/module.h"
-+#define FSL_IMX6_ENET_MAC_IRQ 118
-+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
+ static const VMStateDescription vmstate_imx_usbphy = {
- #define FSL_IMX6_PCIE1_IRQ 120
+@@ -XXX,XX +XXX,XX @@ static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
- #define FSL_IMX6_PCIE2_IRQ 121
+         value = s->usbphy[index - 3];
- #define FSL_IMX6_PCIE3_IRQ 122
+         break;
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+     default:
-index XXXXXXX..XXXXXXX 100644
+-        value = s->usbphy[index];
---- a/hw/net/imx_fec.c
++        if (index < USBPHY_MAX) {
-+++ b/hw/net/imx_fec.c
++            value = s->usbphy[index];
-@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
++        } else {
++            qemu_log_mask(LOG_GUEST_ERROR,
- static void imx_eth_update(IMXFECState *s)
++                          "%s: Read from non-existing USB PHY register 0x%"
- {
++                          HWADDR_PRIx "\n",
--    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
++                          __func__, offset);
-+    /*
++            value = 0;
-+     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
++        }
-+     * interrupts swapped. This worked with older versions of Linux (4.14
+         break;
-+     * and older) since Linux associated both interrupt lines with Ethernet
+     }
-+     * MAC interrupts. Specifically,
+     return (uint64_t)value;
-+     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
+@@ -XXX,XX +XXX,XX @@ static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
-+     *   timer interrupts. Those versions of Linux fail with versions of QEMU
+         s->usbphy[index - 3] ^= value;
-+     *   with swapped interrupt assignments.
+         break;
-+     * - In linux 4.14, both interrupt lines were registered with the Ethernet
+     default:
-+     *   MAC interrupt handler. As a result, all versions of qemu happen to
+-        /* Other registers are read-only */
-+     *   work, though that is accidental.
++        /* Other registers are read-only or do not exist */
-+     * - In Linux 4.9 and older, the timer interrupt was registered directly
++        qemu_log_mask(LOG_GUEST_ERROR,
-+     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
++                      "%s: Write to %s USB PHY register 0x%"
-+     *   redirected to a GPIO interrupt to work around erratum ERR006687.
++                      HWADDR_PRIx "\n",
-+     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
++                      __func__,
-+     *   interrupt never fired since IOMUX is currently not supported in qemu.
++                      index >= USBPHY_MAX ? "non-existing" : "read-only",
-+     *   Linux instead received MAC interrupts on the timer interrupt.
++                      offset);
-+     *   As a result, qemu versions with the swapped interrupt assignment work,
+         break;
-+     *   albeit accidentally, but qemu versions with the correct interrupt
+     }
-+     *   assignment fail.
+ }
 +     *
 +     * To ensure that all versions of Linux work, generate ENET_INT_MAC
 +     * interrrupts on both interrupt lines. This should be changed if and when
 +     * qemu supports IOMUX.
 +     */
 +    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
 +        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
          qemu_set_irq(s->irq[1], 1);
      } else {
          qemu_set_irq(s->irq[1], 0);
 --
-.16.2
+.34.1

-[Qemu-devel] [PULL 02/13] dump: Update correct kdump phys_base field for AArch64
+Deleted patch
-From: Wei Huang <wei@redhat.com>
-For guest kernel that supports KASLR, the load address can change every
-time when guest VM runs. To find the physical base address correctly,
-current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
-However this string pattern is only available on x86_64. AArch64 uses a
-different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
-QEMU dump uses the correct string on AArch64.
-Signed-off-by: Wei Huang <wei@redhat.com>
-Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
-Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
----
- dump.c | 14 +++++++++++---
-file changed, 11 insertions(+), 3 deletions(-)
-diff --git a/dump.c b/dump.c
-index XXXXXXX..XXXXXXX 100644
---- a/dump.c
-+++ b/dump.c
-@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
-     lines = g_strsplit((char *)vmci, "\n", -1);
-     for (i = 0; lines[i]; i++) {
--        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
--            if (qemu_strtou64(lines[i] + 18, NULL, 16,
-+        const char *prefix = NULL;
-+
-+        if (s->dump_info.d_machine == EM_X86_64) {
-+            prefix = "NUMBER(phys_base)=";
-+        } else if (s->dump_info.d_machine == EM_AARCH64) {
-+            prefix = "NUMBER(PHYS_OFFSET)=";
-+        }
-+
-+        if (prefix && g_str_has_prefix(lines[i], prefix)) {
-+            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
-                               &phys_base) < 0) {
--                warn_report("Failed to read NUMBER(phys_base)=");
-+                warn_report("Failed to read %s", prefix);
-             } else {
-                 s->dump_info.phys_base = phys_base;
-             }
---
-.16.2

-[Qemu-devel] [PULL 05/13] hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
+Deleted patch
-For the rpi1 and 2 we want to boot the Linux kernel via some
-custom setup code that makes sure that the SMC instruction
-acts as a no-op, because it's used for cache maintenance.
-The rpi3 boots AArch64 kernels, which don't need SMC for
-cache maintenance and always expect to be booted non-secure.
-Don't fill in the aarch32-specific parts of the binfo struct.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
----
- hw/arm/raspi.c | 17 +++++++++++++----
-file changed, 13 insertions(+), 4 deletions(-)
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
-+++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
-     binfo.board_id = raspi_boardid[version];
-     binfo.ram_size = ram_size;
-     binfo.nb_cpus = smp_cpus;
--    binfo.board_setup_addr = BOARDSETUP_ADDR;
--    binfo.write_board_setup = write_board_setup;
--    binfo.secure_board_setup = true;
--    binfo.secure_boot = true;
-+
-+    if (version <= 2) {
-+        /* The rpi1 and 2 require some custom setup code to run in Secure
-+         * mode before booting a kernel (to set up the SMC vectors so
-+         * that we get a no-op SMC; this is used by Linux to call the
-+         * firmware for some cache maintenance operations.
-+         * The rpi3 doesn't need this.
-+         */
-+        binfo.board_setup_addr = BOARDSETUP_ADDR;
-+        binfo.write_board_setup = write_board_setup;
-+        binfo.secure_board_setup = true;
-+        binfo.secure_boot = true;
-+    }
-     /* Pi2 and Pi3 requires SMP setup */
-     if (version >= 2) {
---
-.16.2

-[Qemu-devel] [PULL 11/13] hw/arm/bcm2836: Use correct affinity values for BCM2837
+[PULL 7/8] docs/system/arm/cpu-features.rst: Fix formatting
-The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
+The markup for the Arm CPU feature documentation is incorrect,
-CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
+and results in the HTML not rendering correctly -- the first
-is required for Linux to boot.
+line of each description is rendered in boldface as if it
 were part of the option name.
+Reformat to match the styling used in cpu-models-x86.rst.inc.
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1479
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
+Message-id: 20230316105808.1414003-1-peter.maydell@linaro.org
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
 Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
 ---
- hw/arm/bcm2836.c | 11 +++++++----
+ docs/system/arm/cpu-features.rst | 68 ++++++++++++++------------------
-file changed, 7 insertions(+), 4 deletions(-)
+file changed, 30 insertions(+), 38 deletions(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
+diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
+--- a/docs/system/arm/cpu-features.rst
-+++ b/hw/arm/bcm2836.c
++++ b/docs/system/arm/cpu-features.rst
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ are named with the prefix "kvm-".  KVM VCPU features may be probed,
+ enabled, and disabled in the same way as other CPU features.  Below is
- struct BCM283XInfo {
+ the list of KVM VCPU features and their descriptions.
-     const char *name;
-+    int clusterid;
+-  kvm-no-adjvtime          By default kvm-no-adjvtime is disabled.  This
- };
+-                           means that by default the virtual time
+-                           adjustment is enabled (vtime is not *not*
- static const BCM283XInfo bcm283x_socs[] = {
+-                           adjusted).
-     {
++``kvm-no-adjvtime``
-         .name = TYPE_BCM2836,
++  By default kvm-no-adjvtime is disabled.  This means that by default
-+        .clusterid = 0xf,
++  the virtual time adjustment is enabled (vtime is not *not* adjusted).
-     },
-     {
+-                           When virtual time adjustment is enabled each
-         .name = TYPE_BCM2837,
+-                           time the VM transitions back to running state
-+        .clusterid = 0x0,
+-                           the VCPU's virtual counter is updated to ensure
-     },
+-                           stopped time is not counted.  This avoids time
- };
+-                           jumps surprising guest OSes and applications,
+-                           as long as they use the virtual counter for
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
+-                           timekeeping.  However it has the side effect of
- static void bcm2836_realize(DeviceState *dev, Error **errp)
+-                           the virtual and physical counters diverging.
- {
+-                           All timekeeping based on the virtual counter
-     BCM283XState *s = BCM283X(dev);
+-                           will appear to lag behind any timekeeping that
-+    BCM283XClass *bc = BCM283X_GET_CLASS(dev);
+-                           does not subtract VM stopped time.  The guest
-+    const BCM283XInfo *info = bc->info;
+-                           may resynchronize its virtual counter with
-     Object *obj;
+-                           other time sources as needed.
-     Error *err = NULL;
++  When virtual time adjustment is enabled each time the VM transitions
-     int n;
++  back to running state the VCPU's virtual counter is updated to
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
++  ensure stopped time is not counted.  This avoids time jumps
-         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
++  surprising guest OSes and applications, as long as they use the
++  virtual counter for timekeeping.  However it has the side effect of
-     for (n = 0; n < BCM283X_NCPUS; n++) {
++  the virtual and physical counters diverging.  All timekeeping based
--        /* Mirror bcm2836, which has clusterid set to 0xf
++  on the virtual counter will appear to lag behind any timekeeping
--         * TODO: this should be converted to a property of ARM_CPU
++  that does not subtract VM stopped time.  The guest may resynchronize
--         */
++  its virtual counter with other time sources as needed.
--        s->cpus[n].mp_affinity = 0xF00 | n;
-+        /* TODO: this should be converted to a property of ARM_CPU */
+-                           Enable kvm-no-adjvtime to disable virtual time
-+        s->cpus[n].mp_affinity = (info->clusterid << 8) | n;
+-                           adjustment, also restoring the legacy (pre-5.0)
+-                           behavior.
-         /* set periphbase/CBAR value for CPU-local registers */
++  Enable kvm-no-adjvtime to disable virtual time adjustment, also
-         object_property_set_int(OBJECT(&s->cpus[n]),
++  restoring the legacy (pre-5.0) behavior.
 -  kvm-steal-time           Since v5.2, kvm-steal-time is enabled by
 -                           default when KVM is enabled, the feature is
 -                           supported, and the guest is 64-bit.
 +``kvm-steal-time``
 +  Since v5.2, kvm-steal-time is enabled by default when KVM is
 +  enabled, the feature is supported, and the guest is 64-bit.
 -                           When kvm-steal-time is enabled a 64-bit guest
 -                           can account for time its CPUs were not running
 -                           due to the host not scheduling the corresponding
 -                           VCPU threads.  The accounting statistics may
 -                           influence the guest scheduler behavior and/or be
 -                           exposed to the guest userspace.
 +  When kvm-steal-time is enabled a 64-bit guest can account for time
 +  its CPUs were not running due to the host not scheduling the
 +  corresponding VCPU threads.  The accounting statistics may influence
 +  the guest scheduler behavior and/or be exposed to the guest
 +  userspace.
  TCG VCPU Features
  =================
@@ -XXX,XX +XXX,XX @@ TCG VCPU Features
  TCG VCPU features are CPU features that are specific to TCG.
  Below is the list of TCG VCPU features and their descriptions.
 -  pauth-impdef             When ``FEAT_Pauth`` is enabled, either the
 -                           *impdef* (Implementation Defined) algorithm
 -                           is enabled or the *architected* QARMA algorithm
 -                           is enabled.  By default the impdef algorithm
 -                           is disabled, and QARMA is enabled.
 +``pauth-impdef``
 +  When ``FEAT_Pauth`` is enabled, either the *impdef* (Implementation
 +  Defined) algorithm is enabled or the *architected* QARMA algorithm
 +  is enabled.  By default the impdef algorithm is disabled, and QARMA
 +  is enabled.
 -                           The architected QARMA algorithm has good
 -                           cryptographic properties, but can be quite slow
 -                           to emulate.  The impdef algorithm used by QEMU
 -                           is non-cryptographic but significantly faster.
 +  The architected QARMA algorithm has good cryptographic properties,
 +  but can be quite slow to emulate.  The impdef algorithm used by QEMU
 +  is non-cryptographic but significantly faster.
  SVE CPU Properties
  ==================
 --
-.16.2
+.34.1

-[Qemu-devel] [PULL 06/13] hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
+[PULL 8/8] target/arm: Don't advertise aarch64-pauth.xml to gdb
-Add some assertions that if we're about to boot an AArch64 kernel,
+Unfortunately a bug in older versions of gdb means that they will
-the board code has not mistakenly set either secure_boot or
+crash if QEMU sends them the aarch64-pauth.xml.  This bug is fixed in
-secure_board_setup. It doesn't make sense to set secure_boot,
+gdb commit 1ba3a3222039eb25, and there are plans to backport that to
-because all AArch64 kernels must be booted in non-secure mode.
+affected gdb release branches, but since the bug affects gdb 9
 through 12 it is very widely deployed (for instance by distros).
-It might in theory make sense to set secure_board_setup, but
+It is not currently clear what the best way to deal with this is; it
-we don't currently support that, because only the AArch32
+has been proposed to define a new XML feature name that old gdb will
-bootloader[] code calls this hook; bootloader_aarch64[] does not.
+ignore but newer gdb can handle.  Since QEMU's 8.0 release is
-Since we don't have a current need for this functionality, just
+imminent and at least one of our CI runners is now falling over this,
-assert that we don't try to use it. If it's needed we'll add
+disable the pauth XML for the moment.  We can follow up with a more
-it later.
+considered fix either in time for 8.0 or else for the 8.1 release.
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
 ---
- hw/arm/boot.c | 7 +++++++
+ target/arm/gdbstub.c | 7 +++++++
 file changed, 7 insertions(+)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
+diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
+--- a/target/arm/gdbstub.c
-+++ b/hw/arm/boot.c
++++ b/target/arm/gdbstub.c
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
+@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
-                     } else {
+                                      aarch64_gdb_set_fpu_reg,
-                         env->pstate = PSTATE_MODE_EL1h;
+, "aarch64-fpu.xml", 0);
-                     }
+         }
-+                    /* AArch64 kernels never boot in secure mode */
++#if 0
-+                    assert(!info->secure_boot);
++        /*
-+                    /* This hook is only supported for AArch32 currently:
++         * GDB versions 9 through 12 have a bug which means they will
-+                     * bootloader_aarch64[] will not call the hook, and
++         * crash if they see this XML from QEMU; disable it for the 8.0
-+                     * the code above has already dropped us into EL2 or EL1.
++         * release, pending a better solution.
-+                     */
++         */
-+                    assert(!info->secure_board_setup);
+         if (isar_feature_aa64_pauth(&cpu->isar)) {
-                 }
+             gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg,
+                                      aarch64_gdb_set_pauth_reg,
-                 /* Set to non-secure if not a secure boot */
+, "aarch64-pauth.xml", 0);
          }
 +#endif
  #endif
      } else {
          if (arm_feature(env, ARM_FEATURE_NEON)) {
 --
-.16.2
+.34.1

-[Qemu-devel] [PULL 07/13] hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
+Deleted patch
-If we're directly booting a Linux kernel and the CPU supports both
-EL3 and EL2, we start the kernel in EL2, as it expects. We must also
-set the SCR_EL3.HCE bit in this situation, so that the HVC
-instruction is enabled rather than UNDEFing. Otherwise at least some
-kernels will panic when trying to initialize KVM in the guest.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
----
- hw/arm/boot.c | 5 +++++
-file changed, 5 insertions(+)
-diff --git a/hw/arm/boot.c b/hw/arm/boot.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/boot.c
-+++ b/hw/arm/boot.c
-@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
-                     assert(!info->secure_board_setup);
-                 }
-+                if (arm_feature(env, ARM_FEATURE_EL2)) {
-+                    /* If we have EL2 then Linux expects the HVC insn to work */
-+                    env->cp15.scr_el3 |= SCR_HCE;
-+                }
-+
-                 /* Set to non-secure if not a secure boot */
-                 if (!info->secure_boot &&
-                     (cs != first_cpu || !info->secure_board_setup)) {
---
-.16.2

-[Qemu-devel] [PULL 08/13] hw/arm/bcm2386: Fix parent type of bcm2386
+Deleted patch
-The TypeInfo and state struct for bcm2386 disagree about what the
-parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
-but the BCM2386State struct only defines the parent_obj field
-as DeviceState. This would have caused problems if anything
-actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
-Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
-need any of the additional functionality TYPE_SYS_BUS_DEVICE
-provides.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
----
- hw/arm/bcm2836.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
-+++ b/hw/arm/bcm2836.c
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
- static const TypeInfo bcm2836_type_info = {
-     .name = TYPE_BCM2836,
--    .parent = TYPE_SYS_BUS_DEVICE,
-+    .parent = TYPE_DEVICE,
-     .instance_size = sizeof(BCM2836State),
-     .instance_init = bcm2836_init,
-     .class_init = bcm2836_class_init,
---
-.16.2

-[Qemu-devel] [PULL 09/13] hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
+Deleted patch
-Our BCM2836 type is really a generic one that can be any of
-the bcm283x family. Rename it accordingly. We change only
-the names which are visible via the header file to the
-rest of the QEMU code, leaving private function names
-in bcm2836.c as they are.
-This is a preliminary to making bcm283x be an abstract
-parent class to specific types for the bcm2836 and bcm2837.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
----
- include/hw/arm/bcm2836.h | 12 ++++++------
- hw/arm/bcm2836.c         | 17 +++++++++--------
- hw/arm/raspi.c           | 16 ++++++++--------
-files changed, 23 insertions(+), 22 deletions(-)
-diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/arm/bcm2836.h
-+++ b/include/hw/arm/bcm2836.h
-@@ -XXX,XX +XXX,XX @@
- #include "hw/arm/bcm2835_peripherals.h"
- #include "hw/intc/bcm2836_control.h"
--#define TYPE_BCM2836 "bcm2836"
--#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
-+#define TYPE_BCM283X "bcm283x"
-+#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
--#define BCM2836_NCPUS 4
-+#define BCM283X_NCPUS 4
--typedef struct BCM2836State {
-+typedef struct BCM283XState {
-     /*< private >*/
-     DeviceState parent_obj;
-     /*< public >*/
-@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
-     char *cpu_type;
-     uint32_t enabled_cpus;
--    ARMCPU cpus[BCM2836_NCPUS];
-+    ARMCPU cpus[BCM283X_NCPUS];
-     BCM2836ControlState control;
-     BCM2835PeripheralState peripherals;
--} BCM2836State;
-+} BCM283XState;
- #endif /* BCM2836_H */
-diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/bcm2836.c
-+++ b/hw/arm/bcm2836.c
-@@ -XXX,XX +XXX,XX @@
- static void bcm2836_init(Object *obj)
- {
--    BCM2836State *s = BCM2836(obj);
-+    BCM283XState *s = BCM283X(obj);
-     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
-     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
- static void bcm2836_realize(DeviceState *dev, Error **errp)
- {
--    BCM2836State *s = BCM2836(dev);
-+    BCM283XState *s = BCM283X(dev);
-     Object *obj;
-     Error *err = NULL;
-     int n;
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
-     /* common peripherals from bcm2835 */
-     obj = OBJECT(dev);
--    for (n = 0; n < BCM2836_NCPUS; n++) {
-+    for (n = 0; n < BCM283X_NCPUS; n++) {
-         object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
-                           s->cpu_type);
-         object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
-     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
-         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
--    for (n = 0; n < BCM2836_NCPUS; n++) {
-+    for (n = 0; n < BCM283X_NCPUS; n++) {
-         /* Mirror bcm2836, which has clusterid set to 0xf
-          * TODO: this should be converted to a property of ARM_CPU
-          */
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
- }
- static Property bcm2836_props[] = {
--    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
--    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
-+    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
-+    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
-+                       BCM283X_NCPUS),
-     DEFINE_PROP_END_OF_LIST()
- };
-@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
- }
- static const TypeInfo bcm2836_type_info = {
--    .name = TYPE_BCM2836,
-+    .name = TYPE_BCM283X,
-     .parent = TYPE_DEVICE,
--    .instance_size = sizeof(BCM2836State),
-+    .instance_size = sizeof(BCM283XState),
-     .instance_init = bcm2836_init,
-     .class_init = bcm2836_class_init,
- };
-diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/arm/raspi.c
-+++ b/hw/arm/raspi.c
-@@ -XXX,XX +XXX,XX @@
- static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
- typedef struct RasPiState {
--    BCM2836State soc;
-+    BCM283XState soc;
-     MemoryRegion ram;
- } RasPiState;
-@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
-     BusState *bus;
-     DeviceState *carddev;
--    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
-+    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
-     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
-                               &error_abort);
-@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
-     mc->no_floppy = 1;
-     mc->no_cdrom = 1;
-     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
--    mc->max_cpus = BCM2836_NCPUS;
--    mc->min_cpus = BCM2836_NCPUS;
--    mc->default_cpus = BCM2836_NCPUS;
-+    mc->max_cpus = BCM283X_NCPUS;
-+    mc->min_cpus = BCM283X_NCPUS;
-+    mc->default_cpus = BCM283X_NCPUS;
-     mc->default_ram_size = 1024 * 1024 * 1024;
-     mc->ignore_memory_transaction_failures = true;
- };
-@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
-     mc->no_floppy = 1;
-     mc->no_cdrom = 1;
-     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
--    mc->max_cpus = BCM2836_NCPUS;
--    mc->min_cpus = BCM2836_NCPUS;
--    mc->default_cpus = BCM2836_NCPUS;
-+    mc->max_cpus = BCM283X_NCPUS;
-+    mc->min_cpus = BCM283X_NCPUS;
-+    mc->default_cpus = BCM283X_NCPUS;
-     mc->default_ram_size = 1024 * 1024 * 1024;
- }
- DEFINE_MACHINE("raspi3", raspi3_machine_init)
---
-.16.2

Arm patch queue -- these are all bug fix patches but we might
as well put them in to rc0...

thanks
-- PMM

The following changes since commit 2c8cfc0b52b5a4d123c26c0b5fdf941be24805be:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2018-03-19 11:44:26 +0000)

are available in the Git repository at:

git://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20180319

for you to fetch changes up to ff72cb6b46b95bb530787add5277c211af3d31c6:

hw/arm/raspi: Provide spin-loop code for AArch64 CPUs (2018-03-19 18:23:24 +0000)

----------------------------------------------------------------
target-arm queue:
 * fsl-imx6: Fix incorrect Ethernet interrupt defines
 * dump: Update correct kdump phys_base field for AArch64
 * char: i.MX: Add support for "TX complete" interrupt
 * bcm2836/raspi: Fix various bugs resulting in panics trying
   to boot a Debian Linux kernel on raspi3

----------------------------------------------------------------
Andrey Smirnov (2):
      char: i.MX: Simplify imx_update()
      char: i.MX: Add support for "TX complete" interrupt

Guenter Roeck (1):
      fsl-imx6: Swap Ethernet interrupt defines

Peter Maydell (9):
      hw/arm/raspi: Don't do board-setup or secure-boot for raspi3
      hw/arm/boot: assert that secure_boot and secure_board_setup are false for AArch64
      hw/arm/boot: If booting a kernel in EL2, set SCR_EL3.HCE
      hw/arm/bcm2386: Fix parent type of bcm2386
      hw/arm/bcm2836: Rename bcm2836 type/struct to bcm283x
      hw/arm/bcm2836: Create proper bcm2837 device
      hw/arm/bcm2836: Use correct affinity values for BCM2837
      hw/arm/bcm2836: Hardcode correct CPU type
      hw/arm/raspi: Provide spin-loop code for AArch64 CPUs

Wei Huang (1):
      dump: Update correct kdump phys_base field for AArch64

From: Guenter Roeck <linux@roeck-us.net>

The sabrelite machine model used by qemu-system-arm is based on the
Freescale/NXP i.MX6Q processor. This SoC has an on-board ethernet
controller which is supported in QEMU using the imx_fec.c module
(actually called imx.enet for this model.)

The include/hw/arm/fsm-imx6.h file defines the interrupt vectors for the
imx.enet device like this:

#define FSL_IMX6_ENET_MAC_1588_IRQ 118
 #define FSL_IMX6_ENET_MAC_IRQ 119

According to https://www.nxp.com/docs/en/reference-manual/IMX6DQRM.pdf,
page 225, in Table 3-1. ARM Cortex A9 domain interrupt summary,
interrupts are as follows.

150 ENET MAC 0 IRQ
151 ENET MAC 0 1588 Timer interrupt

where

150 - 32 == 118
151 - 32 == 119

In other words, the vector definitions in the fsl-imx6.h file are reversed.

Fixing the interrupts alone causes problems with older Linux kernels:
The Ethernet interface will fail to probe with Linux v4.9 and earlier.
Linux v4.1 and earlier will crash due to a bug in Ethernet driver probe
error handling. This is a Linux kernel problem, not a qemu problem:
the Linux kernel only worked by accident since it requested both interrupts.

For backward compatibility, generate the Ethernet interrupt on both interrupt
lines. This was shown to work from all Linux kernel releases starting with
v3.16.

Link: https://bugs.launchpad.net/qemu/+bug/1753309
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Message-id: 1520723090-22130-1-git-send-email-linux@roeck-us.net
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/arm/fsl-imx6.h |  4 ++--
 hw/net/imx_fec.c          | 28 +++++++++++++++++++++++++++-
 2 files changed, 29 insertions(+), 3 deletions(-)

diff --git a/include/hw/arm/fsl-imx6.h b/include/hw/arm/fsl-imx6.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/fsl-imx6.h
+++ b/include/hw/arm/fsl-imx6.h
@@ -XXX,XX +XXX,XX @@ typedef struct FslIMX6State {
 #define FSL_IMX6_HDMI_MASTER_IRQ 115
 #define FSL_IMX6_HDMI_CEC_IRQ 116
 #define FSL_IMX6_MLB150_LOW_IRQ 117
-#define FSL_IMX6_ENET_MAC_1588_IRQ 118
-#define FSL_IMX6_ENET_MAC_IRQ 119
+#define FSL_IMX6_ENET_MAC_IRQ 118
+#define FSL_IMX6_ENET_MAC_1588_IRQ 119
 #define FSL_IMX6_PCIE1_IRQ 120
 #define FSL_IMX6_PCIE2_IRQ 121
 #define FSL_IMX6_PCIE3_IRQ 122
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
 
 static void imx_eth_update(IMXFECState *s)
 {
-    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
+    /*
+     * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER
+     * interrupts swapped. This worked with older versions of Linux (4.14
+     * and older) since Linux associated both interrupt lines with Ethernet
+     * MAC interrupts. Specifically,
+     * - Linux 4.15 and later have separate interrupt handlers for the MAC and
+     *   timer interrupts. Those versions of Linux fail with versions of QEMU
+     *   with swapped interrupt assignments.
+     * - In linux 4.14, both interrupt lines were registered with the Ethernet
+     *   MAC interrupt handler. As a result, all versions of qemu happen to
+     *   work, though that is accidental.
+     * - In Linux 4.9 and older, the timer interrupt was registered directly
+     *   with the Ethernet MAC interrupt handler. The MAC interrupt was
+     *   redirected to a GPIO interrupt to work around erratum ERR006687.
+     *   This was implemented using the SOC's IOMUX block. In qemu, this GPIO
+     *   interrupt never fired since IOMUX is currently not supported in qemu.
+     *   Linux instead received MAC interrupts on the timer interrupt.
+     *   As a result, qemu versions with the swapped interrupt assignment work,
+     *   albeit accidentally, but qemu versions with the correct interrupt
+     *   assignment fail.
+     *
+     * To ensure that all versions of Linux work, generate ENET_INT_MAC
+     * interrrupts on both interrupt lines. This should be changed if and when
+     * qemu supports IOMUX.
+     */
+    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] &
+        (ENET_INT_MAC | ENET_INT_TS_TIMER)) {
         qemu_set_irq(s->irq[1], 1);
     } else {
         qemu_set_irq(s->irq[1], 0);
-- 
2.16.2

From: Wei Huang <wei@redhat.com>

For guest kernel that supports KASLR, the load address can change every
time when guest VM runs. To find the physical base address correctly,
current QEMU dump searches VMCOREINFO for the string "NUMBER(phys_base)=".
However this string pattern is only available on x86_64. AArch64 uses a
different field, called "NUMBER(PHYS_OFFSET)=". This patch makes sure
QEMU dump uses the correct string on AArch64.

Signed-off-by: Wei Huang <wei@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 1520615003-20869-1-git-send-email-wei@redhat.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 dump.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/dump.c b/dump.c
index XXXXXXX..XXXXXXX 100644
--- a/dump.c
+++ b/dump.c
@@ -XXX,XX +XXX,XX @@ static void vmcoreinfo_update_phys_base(DumpState *s)
 
     lines = g_strsplit((char *)vmci, "\n", -1);
     for (i = 0; lines[i]; i++) {
-        if (g_str_has_prefix(lines[i], "NUMBER(phys_base)=")) {
-            if (qemu_strtou64(lines[i] + 18, NULL, 16,
+        const char *prefix = NULL;
+
+        if (s->dump_info.d_machine == EM_X86_64) {
+            prefix = "NUMBER(phys_base)=";
+        } else if (s->dump_info.d_machine == EM_AARCH64) {
+            prefix = "NUMBER(PHYS_OFFSET)=";
+        }
+
+        if (prefix && g_str_has_prefix(lines[i], prefix)) {
+            if (qemu_strtou64(lines[i] + strlen(prefix), NULL, 16,
                               &phys_base) < 0) {
-                warn_report("Failed to read NUMBER(phys_base)=");
+                warn_report("Failed to read %s", prefix);
             } else {
                 s->dump_info.phys_base = phys_base;
             }
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Code of imx_update() is slightly confusing since the "flags" variable
doesn't really corespond to anything in real hardware and server as a
kitchensink accumulating events normally reported via USR1 and USR2
registers.

Change the code to explicitly evaluate state of interrupts reported
via USR1 and USR2 against corresponding masking bits and use the to
detemine if IRQ line should be asserted or not.

NOTE: Check for UTS1_TXEMPTY being set has been dropped for two
reasons:

1. Emulation code implements a single character FIFO, so this flag
       will always be set since characters are trasmitted as a part of
       the code emulating "push" into the FIFO

2. imx_update() is really just a function doing ORing and maksing
       of reported events, so checking for UTS1_TXEMPTY should happen,
       if it's ever really needed should probably happen outside of
       it.

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-1-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/char/imx_serial.c | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
 
 static void imx_update(IMXSerialState *s)
 {
-    uint32_t flags;
+    uint32_t usr1;
+    uint32_t usr2;
+    uint32_t mask;
 
-    flags = (s->usr1 & s->ucr1) & (USR1_TRDY|USR1_RRDY);
-    if (s->ucr1 & UCR1_TXMPTYEN) {
-        flags |= (s->uts1 & UTS1_TXEMPTY);
-    } else {
-        flags &= ~USR1_TRDY;
-    }
+    /*
+     * Lucky for us TRDY and RRDY has the same offset in both USR1 and
+     * UCR1, so we can get away with something as simple as the
+     * following:
+     */
+    usr1 = s->usr1 & s->ucr1 & (USR1_TRDY | USR1_RRDY);
+    /*
+     * Bits that we want in USR2 are not as conveniently laid out,
+     * unfortunately.
+     */
+    mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    usr2 = s->usr2 & mask;
 
-    qemu_set_irq(s->irq, !!flags);
+    qemu_set_irq(s->irq, usr1 || usr2);
 }
 
 static void imx_serial_reset(IMXSerialState *s)
-- 
2.16.2

From: Andrey Smirnov <andrew.smirnov@gmail.com>

Add support for "TX complete"/TXDC interrupt generate by real HW since
it is needed to support guests other than Linux.

Based on the patch by Bill Paul as found here:
https://bugs.launchpad.net/qemu/+bug/1753314

Cc: qemu-devel@nongnu.org
Cc: qemu-arm@nongnu.org
Cc: Bill Paul <wpaul@windriver.com>
Cc: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Bill Paul <wpaul@windriver.com>
Signed-off-by: Andrey Smirnov <andrew.smirnov@gmail.com>
Message-id: 20180315191141.6789-2-andrew.smirnov@gmail.com
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 include/hw/char/imx_serial.h |  3 +++
 hw/char/imx_serial.c         | 20 +++++++++++++++++---
 2 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/include/hw/char/imx_serial.h b/include/hw/char/imx_serial.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/char/imx_serial.h
+++ b/include/hw/char/imx_serial.h
@@ -XXX,XX +XXX,XX @@
 #define UCR2_RXEN       (1<<1)    /* Receiver enable */
 #define UCR2_SRST       (1<<0)    /* Reset complete */
 
+#define UCR4_TCEN       BIT(3)    /* TX complete interrupt enable */
+
 #define UTS1_TXEMPTY    (1<<6)
 #define UTS1_RXEMPTY    (1<<5)
 #define UTS1_TXFULL     (1<<4)
@@ -XXX,XX +XXX,XX @@ typedef struct IMXSerialState {
     uint32_t ubmr;
     uint32_t ubrc;
     uint32_t ucr3;
+    uint32_t ucr4;
 
     qemu_irq irq;
     CharBackend chr;
diff --git a/hw/char/imx_serial.c b/hw/char/imx_serial.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/imx_serial.c
+++ b/hw/char/imx_serial.c
@@ -XXX,XX +XXX,XX @@
 
 static const VMStateDescription vmstate_imx_serial = {
     .name = TYPE_IMX_SERIAL,
-    .version_id = 1,
-    .minimum_version_id = 1,
+    .version_id = 2,
+    .minimum_version_id = 2,
     .fields = (VMStateField[]) {
         VMSTATE_INT32(readbuff, IMXSerialState),
         VMSTATE_UINT32(usr1, IMXSerialState),
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_imx_serial = {
         VMSTATE_UINT32(ubmr, IMXSerialState),
         VMSTATE_UINT32(ubrc, IMXSerialState),
         VMSTATE_UINT32(ucr3, IMXSerialState),
+        VMSTATE_UINT32(ucr4, IMXSerialState),
         VMSTATE_END_OF_LIST()
     },
 };
@@ -XXX,XX +XXX,XX @@ static void imx_update(IMXSerialState *s)
      * unfortunately.
      */
     mask = (s->ucr1 & UCR1_TXMPTYEN) ? USR2_TXFE : 0;
+    /*
+     * TCEN and TXDC are both bit 3
+     */
+    mask |= s->ucr4 & UCR4_TCEN;
+
     usr2 = s->usr2 & mask;
 
     qemu_set_irq(s->irq, usr1 || usr2);
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_serial_read(void *opaque, hwaddr offset,
         return s->ucr3;
 
     case 0x23: /* UCR4 */
+        return s->ucr4;
+
     case 0x29: /* BRM Incremental */
         return 0x0; /* TODO */
 
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
              * qemu_chr_fe_write and background I/O callbacks */
             qemu_chr_fe_write_all(&s->chr, &ch, 1);
             s->usr1 &= ~USR1_TRDY;
+            s->usr2 &= ~USR2_TXDC;
             imx_update(s);
             s->usr1 |= USR1_TRDY;
+            s->usr2 |= USR2_TXDC;
             imx_update(s);
         }
         break;
@@ -XXX,XX +XXX,XX @@ static void imx_serial_write(void *opaque, hwaddr offset,
         s->ucr3 = value & 0xffff;
         break;
 
-    case 0x2d: /* UTS1 */
     case 0x23: /* UCR4 */
+        s->ucr4 = value & 0xffff;
+        imx_update(s);
+        break;
+
+    case 0x2d: /* UTS1 */
         qemu_log_mask(LOG_UNIMP, "[%s]%s: Unimplemented reg 0x%"
                       HWADDR_PRIx "\n", TYPE_IMX_SERIAL, __func__, offset);
         /* TODO */
-- 
2.16.2

For the rpi1 and 2 we want to boot the Linux kernel via some
custom setup code that makes sure that the SMC instruction
acts as a no-op, because it's used for cache maintenance.
The rpi3 boots AArch64 kernels, which don't need SMC for
cache maintenance and always expect to be booted non-secure.
Don't fill in the aarch32-specific parts of the binfo struct.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-2-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     binfo.board_id = raspi_boardid[version];
     binfo.ram_size = ram_size;
     binfo.nb_cpus = smp_cpus;
-    binfo.board_setup_addr = BOARDSETUP_ADDR;
-    binfo.write_board_setup = write_board_setup;
-    binfo.secure_board_setup = true;
-    binfo.secure_boot = true;
+
+    if (version <= 2) {
+        /* The rpi1 and 2 require some custom setup code to run in Secure
+         * mode before booting a kernel (to set up the SMC vectors so
+         * that we get a no-op SMC; this is used by Linux to call the
+         * firmware for some cache maintenance operations.
+         * The rpi3 doesn't need this.
+         */
+        binfo.board_setup_addr = BOARDSETUP_ADDR;
+        binfo.write_board_setup = write_board_setup;
+        binfo.secure_board_setup = true;
+        binfo.secure_boot = true;
+    }
 
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
-- 
2.16.2

Add some assertions that if we're about to boot an AArch64 kernel,
the board code has not mistakenly set either secure_boot or
secure_board_setup. It doesn't make sense to set secure_boot,
because all AArch64 kernels must be booted in non-secure mode.

It might in theory make sense to set secure_board_setup, but
we don't currently support that, because only the AArch32
bootloader[] code calls this hook; bootloader_aarch64[] does not.
Since we don't have a current need for this functionality, just
assert that we don't try to use it. If it's needed we'll add
it later.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-3-peter.maydell@linaro.org
---
 hw/arm/boot.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     } else {
                         env->pstate = PSTATE_MODE_EL1h;
                     }
+                    /* AArch64 kernels never boot in secure mode */
+                    assert(!info->secure_boot);
+                    /* This hook is only supported for AArch32 currently:
+                     * bootloader_aarch64[] will not call the hook, and
+                     * the code above has already dropped us into EL2 or EL1.
+                     */
+                    assert(!info->secure_board_setup);
                 }
 
                 /* Set to non-secure if not a secure boot */
-- 
2.16.2

If we're directly booting a Linux kernel and the CPU supports both
EL3 and EL2, we start the kernel in EL2, as it expects. We must also
set the SCR_EL3.HCE bit in this situation, so that the HVC
instruction is enabled rather than UNDEFing. Otherwise at least some
kernels will panic when trying to initialize KVM in the guest.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20180313153458.26822-4-peter.maydell@linaro.org
---
 hw/arm/boot.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/arm/boot.c b/hw/arm/boot.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/boot.c
+++ b/hw/arm/boot.c
@@ -XXX,XX +XXX,XX @@ static void do_cpu_reset(void *opaque)
                     assert(!info->secure_board_setup);
                 }
 
+                if (arm_feature(env, ARM_FEATURE_EL2)) {
+                    /* If we have EL2 then Linux expects the HVC insn to work */
+                    env->cp15.scr_el3 |= SCR_HCE;
+                }
+
                 /* Set to non-secure if not a secure boot */
                 if (!info->secure_boot &&
                     (cs != first_cpu || !info->secure_board_setup)) {
-- 
2.16.2

The TypeInfo and state struct for bcm2386 disagree about what the
parent class is -- the TypeInfo says it's TYPE_SYS_BUS_DEVICE,
but the BCM2386State struct only defines the parent_obj field
as DeviceState. This would have caused problems if anything
actually tried to treat the object as a TYPE_SYS_BUS_DEVICE.
Fix the TypeInfo to use TYPE_DEVICE as the parent, since we don't
need any of the additional functionality TYPE_SYS_BUS_DEVICE
provides.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-5-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 
 static const TypeInfo bcm2836_type_info = {
     .name = TYPE_BCM2836,
-    .parent = TYPE_SYS_BUS_DEVICE,
+    .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM2836State),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
-- 
2.16.2

Our BCM2836 type is really a generic one that can be any of
the bcm283x family. Rename it accordingly. We change only
the names which are visible via the header file to the
rest of the QEMU code, leaving private function names
in bcm2836.c as they are.

This is a preliminary to making bcm283x be an abstract
parent class to specific types for the bcm2836 and bcm2837.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-6-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 12 ++++++------
 hw/arm/bcm2836.c         | 17 +++++++++--------
 hw/arm/raspi.c           | 16 ++++++++--------
 3 files changed, 23 insertions(+), 22 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/arm/bcm2835_peripherals.h"
 #include "hw/intc/bcm2836_control.h"
 
-#define TYPE_BCM2836 "bcm2836"
-#define BCM2836(obj) OBJECT_CHECK(BCM2836State, (obj), TYPE_BCM2836)
+#define TYPE_BCM283X "bcm283x"
+#define BCM283X(obj) OBJECT_CHECK(BCM283XState, (obj), TYPE_BCM283X)
 
-#define BCM2836_NCPUS 4
+#define BCM283X_NCPUS 4
 
-typedef struct BCM2836State {
+typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
     /*< public >*/
@@ -XXX,XX +XXX,XX @@ typedef struct BCM2836State {
     char *cpu_type;
     uint32_t enabled_cpus;
 
-    ARMCPU cpus[BCM2836_NCPUS];
+    ARMCPU cpus[BCM283X_NCPUS];
     BCM2836ControlState control;
     BCM2835PeripheralState peripherals;
-} BCM2836State;
+} BCM283XState;
 
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 static void bcm2836_init(Object *obj)
 {
-    BCM2836State *s = BCM2836(obj);
+    BCM283XState *s = BCM283X(obj);
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_init(Object *obj)
 
 static void bcm2836_realize(DeviceState *dev, Error **errp)
 {
-    BCM2836State *s = BCM2836(dev);
+    BCM283XState *s = BCM283X(dev);
     Object *obj;
     Error *err = NULL;
     int n;
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     /* common peripherals from bcm2835 */
 
     obj = OBJECT(dev);
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
                           s->cpu_type);
         object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
     sysbus_connect_irq(SYS_BUS_DEVICE(&s->peripherals), 1,
         qdev_get_gpio_in_named(DEVICE(&s->control), "gpu-fiq", 0));
 
-    for (n = 0; n < BCM2836_NCPUS; n++) {
+    for (n = 0; n < BCM283X_NCPUS; n++) {
         /* Mirror bcm2836, which has clusterid set to 0xf
          * TODO: this should be converted to a property of ARM_CPU
          */
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM2836State, cpu_type),
-    DEFINE_PROP_UINT32("enabled-cpus", BCM2836State, enabled_cpus, BCM2836_NCPUS),
+    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
+    DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
+                       BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
 };
 
@@ -XXX,XX +XXX,XX @@ static void bcm2836_class_init(ObjectClass *oc, void *data)
 }
 
 static const TypeInfo bcm2836_type_info = {
-    .name = TYPE_BCM2836,
+    .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
-    .instance_size = sizeof(BCM2836State),
+    .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
     .class_init = bcm2836_class_init,
 };
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
 
 typedef struct RasPiState {
-    BCM2836State soc;
+    BCM283XState soc;
     MemoryRegion ram;
 } RasPiState;
 
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM2836);
+    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
@@ -XXX,XX +XXX,XX @@ static void raspi2_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a15");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
     mc->ignore_memory_transaction_failures = true;
 };
@@ -XXX,XX +XXX,XX @@ static void raspi3_machine_init(MachineClass *mc)
     mc->no_floppy = 1;
     mc->no_cdrom = 1;
     mc->default_cpu_type = ARM_CPU_TYPE_NAME("cortex-a53");
-    mc->max_cpus = BCM2836_NCPUS;
-    mc->min_cpus = BCM2836_NCPUS;
-    mc->default_cpus = BCM2836_NCPUS;
+    mc->max_cpus = BCM283X_NCPUS;
+    mc->min_cpus = BCM283X_NCPUS;
+    mc->default_cpus = BCM283X_NCPUS;
     mc->default_ram_size = 1024 * 1024 * 1024;
 }
 DEFINE_MACHINE("raspi3", raspi3_machine_init)
-- 
2.16.2

The bcm2837 is pretty similar to the bcm2836, but it does have
some differences. Notably, the MPIDR affinity aff1 values it
sets for the CPUs are 0x0, rather than the 0xf that the bcm2836
uses, and if this is wrong Linux will not boot.

Rather than trying to have one device with properties that
configure it differently for the two cases, create two
separate QOM devices for the two SoCs. We use the same approach
as hw/arm/aspeed_soc.c and share code and have a data table
that might differ per-SoC. For the moment the two types don't
actually have different behaviour.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-7-peter.maydell@linaro.org
---
 include/hw/arm/bcm2836.h | 19 +++++++++++++++++++
 hw/arm/bcm2836.c         | 37 ++++++++++++++++++++++++++++++++-----
 hw/arm/raspi.c           |  3 ++-
 3 files changed, 53 insertions(+), 6 deletions(-)

diff --git a/include/hw/arm/bcm2836.h b/include/hw/arm/bcm2836.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/bcm2836.h
+++ b/include/hw/arm/bcm2836.h
@@ -XXX,XX +XXX,XX @@
 
 #define BCM283X_NCPUS 4
 
+/* These type names are for specific SoCs; other than instantiating
+ * them, code using these devices should always handle them via the
+ * BCM283x base class, so they have no BCM2836(obj) etc macros.
+ */
+#define TYPE_BCM2836 "bcm2836"
+#define TYPE_BCM2837 "bcm2837"
+
 typedef struct BCM283XState {
     /*< private >*/
     DeviceState parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct BCM283XState {
     BCM2835PeripheralState peripherals;
 } BCM283XState;
 
+typedef struct BCM283XInfo BCM283XInfo;
+
+typedef struct BCM283XClass {
+    DeviceClass parent_class;
+    const BCM283XInfo *info;
+} BCM283XClass;
+
+#define BCM283X_CLASS(klass) \
+    OBJECT_CLASS_CHECK(BCM283XClass, (klass), TYPE_BCM283X)
+#define BCM283X_GET_CLASS(obj) \
+    OBJECT_GET_CLASS(BCM283XClass, (obj), TYPE_BCM283X)
+
 #endif /* BCM2836_H */
diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 /* "QA7" (Pi2) interrupt controller and mailboxes etc. */
 #define BCM2836_CONTROL_BASE    0x40000000
 
+struct BCM283XInfo {
+    const char *name;
+};
+
+static const BCM283XInfo bcm283x_socs[] = {
+    {
+        .name = TYPE_BCM2836,
+    },
+    {
+        .name = TYPE_BCM2837,
+    },
+};
+
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
@@ -XXX,XX +XXX,XX @@ static Property bcm2836_props[] = {
     DEFINE_PROP_END_OF_LIST()
 };
 
-static void bcm2836_class_init(ObjectClass *oc, void *data)
+static void bcm283x_class_init(ObjectClass *oc, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(oc);
+    BCM283XClass *bc = BCM283X_CLASS(oc);
 
-    dc->props = bcm2836_props;
+    bc->info = data;
     dc->realize = bcm2836_realize;
+    dc->props = bcm2836_props;
 }
 
-static const TypeInfo bcm2836_type_info = {
+static const TypeInfo bcm283x_type_info = {
     .name = TYPE_BCM283X,
     .parent = TYPE_DEVICE,
     .instance_size = sizeof(BCM283XState),
     .instance_init = bcm2836_init,
-    .class_init = bcm2836_class_init,
+    .class_size = sizeof(BCM283XClass),
+    .abstract = true,
 };
 
 static void bcm2836_register_types(void)
 {
-    type_register_static(&bcm2836_type_info);
+    int i;
+
+    type_register_static(&bcm283x_type_info);
+    for (i = 0; i < ARRAY_SIZE(bcm283x_socs); i++) {
+        TypeInfo ti = {
+            .name = bcm283x_socs[i].name,
+            .parent = TYPE_BCM283X,
+            .class_init = bcm283x_class_init,
+            .class_data = (void *) &bcm283x_socs[i],
+        };
+        type_register(&ti);
+    }
 }
 
 type_init(bcm2836_register_types)
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     BusState *bus;
     DeviceState *carddev;
 
-    object_initialize(&s->soc, sizeof(s->soc), TYPE_BCM283X);
+    object_initialize(&s->soc, sizeof(s->soc),
+                      version == 3 ? TYPE_BCM2837 : TYPE_BCM2836);
     object_property_add_child(OBJECT(machine), "soc", OBJECT(&s->soc),
                               &error_abort);
 
-- 
2.16.2

The BCM2837 sets the Aff1 field of the MPIDR affinity values for the
CPUs to 0, whereas the BCM2836 uses 0xf. Set this correctly, as it
is required for Linux to boot.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-8-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Now we have separate types for BCM2386 and BCM2387, we might as well
just hard-code the CPU type they use rather than having it passed
through as an object property. This then lets us put the initialization
of the CPU object in init rather than realize.

Note that this change means that it's no longer possible on
the command line to use -cpu to ask for a different kind of
CPU than the SoC supports. This was never a supported thing to
do anyway; we were just not sanity-checking the command line.

This does require us to only build the bcm2837 object on
TARGET_AARCH64 configs, since otherwise it won't instantiate
due to the missing cortex-a53 device and "make check" will fail.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Andrew Baumann <Andrew.Baumann@microsoft.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-9-peter.maydell@linaro.org
---
 hw/arm/bcm2836.c | 24 +++++++++++++++---------
 hw/arm/raspi.c   |  2 --
 2 files changed, 15 insertions(+), 11 deletions(-)

diff --git a/hw/arm/bcm2836.c b/hw/arm/bcm2836.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/bcm2836.c
+++ b/hw/arm/bcm2836.c
@@ -XXX,XX +XXX,XX @@
 
 struct BCM283XInfo {
     const char *name;
+    const char *cpu_type;
     int clusterid;
 };
 
 static const BCM283XInfo bcm283x_socs[] = {
     {
         .name = TYPE_BCM2836,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a15"),
         .clusterid = 0xf,
     },
+#ifdef TARGET_AARCH64
     {
         .name = TYPE_BCM2837,
+        .cpu_type = ARM_CPU_TYPE_NAME("cortex-a53"),
         .clusterid = 0x0,
     },
+#endif
 };
 
 static void bcm2836_init(Object *obj)
 {
     BCM283XState *s = BCM283X(obj);
+    BCM283XClass *bc = BCM283X_GET_CLASS(obj);
+    const BCM283XInfo *info = bc->info;
+    int n;
+
+    for (n = 0; n < BCM283X_NCPUS; n++) {
+        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
+                          info->cpu_type);
+        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
+                                  &error_abort);
+    }
 
     object_initialize(&s->control, sizeof(s->control), TYPE_BCM2836_CONTROL);
     object_property_add_child(obj, "control", OBJECT(&s->control), NULL);
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 
     /* common peripherals from bcm2835 */
 
-    obj = OBJECT(dev);
-    for (n = 0; n < BCM283X_NCPUS; n++) {
-        object_initialize(&s->cpus[n], sizeof(s->cpus[n]),
-                          s->cpu_type);
-        object_property_add_child(obj, "cpu[*]", OBJECT(&s->cpus[n]),
-                                  &error_abort);
-    }
-
     obj = object_property_get_link(OBJECT(dev), "ram", &err);
     if (obj == NULL) {
         error_setg(errp, "%s: required ram link not found: %s",
@@ -XXX,XX +XXX,XX @@ static void bcm2836_realize(DeviceState *dev, Error **errp)
 }
 
 static Property bcm2836_props[] = {
-    DEFINE_PROP_STRING("cpu-type", BCM283XState, cpu_type),
     DEFINE_PROP_UINT32("enabled-cpus", BCM283XState, enabled_cpus,
                        BCM283X_NCPUS),
     DEFINE_PROP_END_OF_LIST()
diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@ static void raspi_init(MachineState *machine, int version)
     /* Setup the SOC */
     object_property_add_const_link(OBJECT(&s->soc), "ram", OBJECT(&s->ram),
                                    &error_abort);
-    object_property_set_str(OBJECT(&s->soc), machine->cpu_type, "cpu-type",
-                            &error_abort);
     object_property_set_int(OBJECT(&s->soc), smp_cpus, "enabled-cpus",
                             &error_abort);
     int board_rev = version == 3 ? 0xa02082 : 0xa21041;
-- 
2.16.2

The raspi3 has AArch64 CPUs, which means that our smpboot
code for keeping the secondary CPUs in a pen needs to have
a version for A64 as well as A32. Without this, the
secondary CPUs go into an infinite loop of taking undefined
instruction exceptions.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 20180313153458.26822-10-peter.maydell@linaro.org
---
 hw/arm/raspi.c | 41 ++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 40 insertions(+), 1 deletion(-)

diff --git a/hw/arm/raspi.c b/hw/arm/raspi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/raspi.c
+++ b/hw/arm/raspi.c
@@ -XXX,XX +XXX,XX @@
 #define BOARDSETUP_ADDR (MVBAR_ADDR + 0x20) /* board setup code */
 #define FIRMWARE_ADDR_2 0x8000 /* Pi 2 loads kernel.img here by default */
 #define FIRMWARE_ADDR_3 0x80000 /* Pi 3 loads kernel.img here by default */
+#define SPINTABLE_ADDR  0xd8 /* Pi 3 bootloader spintable */
 
 /* Table of Linux board IDs for different Pi versions */
 static const int raspi_boardid[] = {[1] = 0xc42, [2] = 0xc43, [3] = 0xc44};
@@ -XXX,XX +XXX,XX @@ static void write_smpboot(ARMCPU *cpu, const struct arm_boot_info *info)
                        info->smp_loader_start);
 }
 
+static void write_smpboot64(ARMCPU *cpu, const struct arm_boot_info *info)
+{
+    /* Unlike the AArch32 version we don't need to call the board setup hook.
+     * The mechanism for doing the spin-table is also entirely different.
+     * We must have four 64-bit fields at absolute addresses
+     * 0xd8, 0xe0, 0xe8, 0xf0 in RAM, which are the flag variables for
+     * our CPUs, and which we must ensure are zero initialized before
+     * the primary CPU goes into the kernel. We put these variables inside
+     * a rom blob, so that the reset for ROM contents zeroes them for us.
+     */
+    static const uint32_t smpboot[] = {
+        0xd2801b05, /*        mov     x5, 0xd8 */
+        0xd53800a6, /*        mrs     x6, mpidr_el1 */
+        0x924004c6, /*        and     x6, x6, #0x3 */
+        0xd503205f, /* spin:  wfe */
+        0xf86678a4, /*        ldr     x4, [x5,x6,lsl #3] */
+        0xb4ffffc4, /*        cbz     x4, spin */
+        0xd2800000, /*        mov     x0, #0x0 */
+        0xd2800001, /*        mov     x1, #0x0 */
+        0xd2800002, /*        mov     x2, #0x0 */
+        0xd2800003, /*        mov     x3, #0x0 */
+        0xd61f0080, /*        br      x4 */
+    };
+
+    static const uint64_t spintables[] = {
+        0, 0, 0, 0
+    };
+
+    rom_add_blob_fixed("raspi_smpboot", smpboot, sizeof(smpboot),
+                       info->smp_loader_start);
+    rom_add_blob_fixed("raspi_spintables", spintables, sizeof(spintables),
+                       SPINTABLE_ADDR);
+}
+
 static void write_board_setup(ARMCPU *cpu, const struct arm_boot_info *info)
 {
     arm_write_secure_board_setup_dummy_smc(cpu, info, MVBAR_ADDR);
@@ -XXX,XX +XXX,XX @@ static void setup_boot(MachineState *machine, int version, size_t ram_size)
     /* Pi2 and Pi3 requires SMP setup */
     if (version >= 2) {
         binfo.smp_loader_start = SMPBOOT_ADDR;
-        binfo.write_secondary_boot = write_smpboot;
+        if (version == 2) {
+            binfo.write_secondary_boot = write_smpboot;
+        } else {
+            binfo.write_secondary_boot = write_smpboot64;
+        }
         binfo.secondary_cpu_reset_hook = reset_secondary;
     }
 
-- 
2.16.2

The following changes since commit aa9e7fa4689d1becb2faf67f65aafcbcf664f1ce:

Merge tag 'edk2-stable202302-20230320-pull-request' of https://gitlab.com/kraxel/qemu into staging (2023-03-20 13:43:35 +0000)

are available in the Git repository at:

https://git.linaro.org/people/pmaydell/qemu-arm.git tags/pull-target-arm-20230321

for you to fetch changes up to 5787d17a42f7af4bd117e5d6bfa54b1fdf93c255:

target/arm: Don't advertise aarch64-pauth.xml to gdb (2023-03-21 13:19:08 +0000)

----------------------------------------------------------------
target-arm queue:
 * contrib/elf2dmp: Support Windows Server 2022
 * hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
 * target/arm: Add Neoverse-N1 IMPDEF registers
 * hw/usb/imx: Fix out of bounds access in imx_usbphy_read()
 * docs/system/arm/cpu-features.rst: Fix formatting
 * target/arm: Don't advertise aarch64-pauth.xml to gdb

----------------------------------------------------------------
Chen Baozi (1):
      target/arm: Add Neoverse-N1 registers

Guenter Roeck (1):
      hw/usb/imx: Fix out of bounds access in imx_usbphy_read()

Peter Maydell (3):
      hw/char/cadence_uart: Fix guards on invalid BRGR/BDIV settings
      docs/system/arm/cpu-features.rst: Fix formatting
      target/arm: Don't advertise aarch64-pauth.xml to gdb

Viktor Prutyanov (3):
      contrib/elf2dmp: fix code style
      contrib/elf2dmp: move PE dir search to pe_get_data_dir_entry
      contrib/elf2dmp: add PE name check and Windows Server 2022 support

docs/system/arm/cpu-features.rst |  68 ++++++++++-------------
 contrib/elf2dmp/pe.h             | 115 ++++++++++++++++++++++-----------------
 contrib/elf2dmp/addrspace.c      |   1 +
 contrib/elf2dmp/main.c           | 108 ++++++++++++++++++++++++------------
 hw/char/cadence_uart.c           |   6 +-
 hw/usb/imx-usb-phy.c             |  19 ++++++-
 target/arm/cpu64.c               |  69 +++++++++++++++++++++++
 target/arm/gdbstub.c             |   7 +++
 8 files changed, 267 insertions(+), 126 deletions(-)

From: Chen Baozi <chenbaozi@phytium.com.cn>

Add implementation defined registers for neoverse-n1 which
would be accessed by TF-A. Since there is no DSU in Qemu,
CPUCFR_EL1.SCU bit is set to 1 to avoid DSU registers definition.

Signed-off-by: Chen Baozi <chenbaozi@phytium.com.cn>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Tested-by: Marcin Juszkiewicz <marcin.juszkiewicz@linaro.org>
Message-id: 20230313033936.585669-1-chenbaozi@phytium.com.cn
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/cpu64.c | 69 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 69 insertions(+)

diff --git a/target/arm/cpu64.c b/target/arm/cpu64.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/cpu64.c
+++ b/target/arm/cpu64.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "cpu.h"
+#include "cpregs.h"
 #include "qemu/module.h"
 #include "sysemu/kvm.h"
 #include "sysemu/hvf.h"
@@ -XXX,XX +XXX,XX @@ static void aarch64_a64fx_initfn(Object *obj)
     /* TODO:  Add A64FX specific HPC extension registers */
 }
 
+static const ARMCPRegInfo neoverse_n1_cp_reginfo[] = {
+    { .name = "ATCR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ATCR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ATCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ATCR_EL12", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 5, .crn = 15, .crm = 7, .opc2 = 0,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "AVTCR_EL2", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 4, .crn = 15, .crm = 7, .opc2 = 1,
+      .access = PL2_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUACTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUACTLR2_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 1,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUACTLR3_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 2,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    /*
+     * Report CPUCFR_EL1.SCU as 1, as we do not implement the DSU
+     * (and in particular its system registers).
+     */
+    { .name = "CPUCFR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 0, .opc2 = 0,
+      .access = PL1_R, .type = ARM_CP_CONST, .resetvalue = 4 },
+    { .name = "CPUECTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 1, .opc2 = 4,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0x961563010 },
+    { .name = "CPUPCR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 1,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPMR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 3,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPOR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 2,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPSELR_EL3", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 6, .crn = 15, .crm = 8, .opc2 = 0,
+      .access = PL3_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "CPUPWRCTLR_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 7,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ERXPFGCDN_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 2,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ERXPFGCTL_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 1,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+    { .name = "ERXPFGF_EL1", .state = ARM_CP_STATE_AA64,
+      .opc0 = 3, .opc1 = 0, .crn = 15, .crm = 2, .opc2 = 0,
+      .access = PL1_RW, .type = ARM_CP_CONST, .resetvalue = 0 },
+};
+
+static void define_neoverse_n1_cp_reginfo(ARMCPU *cpu)
+{
+    define_arm_cp_regs(cpu, neoverse_n1_cp_reginfo);
+}
+
 static void aarch64_neoverse_n1_initfn(Object *obj)
 {
     ARMCPU *cpu = ARM_CPU(obj);
@@ -XXX,XX +XXX,XX @@ static void aarch64_neoverse_n1_initfn(Object *obj)
 
     /* From D5.1 AArch64 PMU register summary */
     cpu->isar.reset_pmcr_el0 = 0x410c3000;
+
+    define_neoverse_n1_cp_reginfo(cpu);
 }
 
 static void aarch64_host_initfn(Object *obj)
-- 
2.34.1

The cadence UART attempts to avoid allowing the guest to set invalid
baud rate register values in the uart_write() function.  However it
does the "mask to the size of the register field" and "check for
invalid values" in the wrong order, which means that a malicious
guest can get a bogus value into the register by setting also some
high bits in the value, and cause QEMU to crash by division-by-zero.

Do the mask before the bounds check instead of afterwards.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1493
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Edgar E. Iglesias <edgar@zeroasic.com>
Reviewed-by: Wilfred Mallawa <wilfred.mallawa@wdc.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230314170804.1196232-1-peter.maydell@linaro.org
---
 hw/char/cadence_uart.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/hw/char/cadence_uart.c b/hw/char/cadence_uart.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/char/cadence_uart.c
+++ b/hw/char/cadence_uart.c
@@ -XXX,XX +XXX,XX @@ static MemTxResult uart_write(void *opaque, hwaddr offset,
         }
         break;
     case R_BRGR: /* Baud rate generator */
+        value &= 0xffff;
         if (value >= 0x01) {
-            s->r[offset] = value & 0xFFFF;
+            s->r[offset] = value;
         }
         break;
     case R_BDIV:    /* Baud rate divider */
+        value &= 0xff;
         if (value >= 0x04) {
-            s->r[offset] = value & 0xFF;
+            s->r[offset] = value;
         }
         break;
     default:
-- 
2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Originally elf2dmp were added with some code style issues,
especially in pe.h header, and some were introduced by
2d0fc797faaa73fbc1d30f5f9e90407bf3dd93f0. Fix them now.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Reviewed-by: Annie Li <annie.li@oracle.com>
Message-id: 20230222211246.883679-2-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/pe.h        | 100 ++++++++++++++++++------------------
 contrib/elf2dmp/addrspace.c |   1 +
 contrib/elf2dmp/main.c      |   9 ++--
 3 files changed, 57 insertions(+), 53 deletions(-)

diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/pe.h
+++ b/contrib/elf2dmp/pe.h
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DOS_HEADER {
 } __attribute__ ((packed)) IMAGE_DOS_HEADER;
 
 typedef struct IMAGE_FILE_HEADER {
-  uint16_t  Machine;
-  uint16_t  NumberOfSections;
-  uint32_t  TimeDateStamp;
-  uint32_t  PointerToSymbolTable;
-  uint32_t  NumberOfSymbols;
-  uint16_t  SizeOfOptionalHeader;
-  uint16_t  Characteristics;
+    uint16_t  Machine;
+    uint16_t  NumberOfSections;
+    uint32_t  TimeDateStamp;
+    uint32_t  PointerToSymbolTable;
+    uint32_t  NumberOfSymbols;
+    uint16_t  SizeOfOptionalHeader;
+    uint16_t  Characteristics;
 } __attribute__ ((packed)) IMAGE_FILE_HEADER;
 
 typedef struct IMAGE_DATA_DIRECTORY {
-  uint32_t VirtualAddress;
-  uint32_t Size;
+    uint32_t VirtualAddress;
+    uint32_t Size;
 } __attribute__ ((packed)) IMAGE_DATA_DIRECTORY;
 
 #define IMAGE_NUMBEROF_DIRECTORY_ENTRIES 16
 
 typedef struct IMAGE_OPTIONAL_HEADER64 {
-  uint16_t  Magic; /* 0x20b */
-  uint8_t   MajorLinkerVersion;
-  uint8_t   MinorLinkerVersion;
-  uint32_t  SizeOfCode;
-  uint32_t  SizeOfInitializedData;
-  uint32_t  SizeOfUninitializedData;
-  uint32_t  AddressOfEntryPoint;
-  uint32_t  BaseOfCode;
-  uint64_t  ImageBase;
-  uint32_t  SectionAlignment;
-  uint32_t  FileAlignment;
-  uint16_t  MajorOperatingSystemVersion;
-  uint16_t  MinorOperatingSystemVersion;
-  uint16_t  MajorImageVersion;
-  uint16_t  MinorImageVersion;
-  uint16_t  MajorSubsystemVersion;
-  uint16_t  MinorSubsystemVersion;
-  uint32_t  Win32VersionValue;
-  uint32_t  SizeOfImage;
-  uint32_t  SizeOfHeaders;
-  uint32_t  CheckSum;
-  uint16_t  Subsystem;
-  uint16_t  DllCharacteristics;
-  uint64_t  SizeOfStackReserve;
-  uint64_t  SizeOfStackCommit;
-  uint64_t  SizeOfHeapReserve;
-  uint64_t  SizeOfHeapCommit;
-  uint32_t  LoaderFlags;
-  uint32_t  NumberOfRvaAndSizes;
-  IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
+    uint16_t  Magic; /* 0x20b */
+    uint8_t   MajorLinkerVersion;
+    uint8_t   MinorLinkerVersion;
+    uint32_t  SizeOfCode;
+    uint32_t  SizeOfInitializedData;
+    uint32_t  SizeOfUninitializedData;
+    uint32_t  AddressOfEntryPoint;
+    uint32_t  BaseOfCode;
+    uint64_t  ImageBase;
+    uint32_t  SectionAlignment;
+    uint32_t  FileAlignment;
+    uint16_t  MajorOperatingSystemVersion;
+    uint16_t  MinorOperatingSystemVersion;
+    uint16_t  MajorImageVersion;
+    uint16_t  MinorImageVersion;
+    uint16_t  MajorSubsystemVersion;
+    uint16_t  MinorSubsystemVersion;
+    uint32_t  Win32VersionValue;
+    uint32_t  SizeOfImage;
+    uint32_t  SizeOfHeaders;
+    uint32_t  CheckSum;
+    uint16_t  Subsystem;
+    uint16_t  DllCharacteristics;
+    uint64_t  SizeOfStackReserve;
+    uint64_t  SizeOfStackCommit;
+    uint64_t  SizeOfHeapReserve;
+    uint64_t  SizeOfHeapCommit;
+    uint32_t  LoaderFlags;
+    uint32_t  NumberOfRvaAndSizes;
+    IMAGE_DATA_DIRECTORY DataDirectory[IMAGE_NUMBEROF_DIRECTORY_ENTRIES];
 } __attribute__ ((packed)) IMAGE_OPTIONAL_HEADER64;
 
 typedef struct IMAGE_NT_HEADERS64 {
-  uint32_t Signature;
-  IMAGE_FILE_HEADER FileHeader;
-  IMAGE_OPTIONAL_HEADER64 OptionalHeader;
+    uint32_t Signature;
+    IMAGE_FILE_HEADER FileHeader;
+    IMAGE_OPTIONAL_HEADER64 OptionalHeader;
 } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
 
 typedef struct IMAGE_DEBUG_DIRECTORY {
-  uint32_t Characteristics;
-  uint32_t TimeDateStamp;
-  uint16_t MajorVersion;
-  uint16_t MinorVersion;
-  uint32_t Type;
-  uint32_t SizeOfData;
-  uint32_t AddressOfRawData;
-  uint32_t PointerToRawData;
+    uint32_t Characteristics;
+    uint32_t TimeDateStamp;
+    uint16_t MajorVersion;
+    uint16_t MinorVersion;
+    uint32_t Type;
+    uint32_t SizeOfData;
+    uint32_t AddressOfRawData;
+    uint32_t PointerToRawData;
 } __attribute__ ((packed)) IMAGE_DEBUG_DIRECTORY;
 
 #define IMAGE_DEBUG_TYPE_CODEVIEW   2
diff --git a/contrib/elf2dmp/addrspace.c b/contrib/elf2dmp/addrspace.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/addrspace.c
+++ b/contrib/elf2dmp/addrspace.c
@@ -XXX,XX +XXX,XX @@
 static struct pa_block *pa_space_find_block(struct pa_space *ps, uint64_t pa)
 {
     size_t i;
+
     for (i = 0; i < ps->block_nr; i++) {
         if (ps->block[i].paddr <= pa &&
                 pa <= ps->block[i].paddr + ps->block[i].size) {
diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
     };
 
     for (i = 0; i < ps->block_nr; i++) {
-        h.PhysicalMemoryBlock.NumberOfPages += ps->block[i].size / ELF2DMP_PAGE_SIZE;
+        h.PhysicalMemoryBlock.NumberOfPages +=
+                ps->block[i].size / ELF2DMP_PAGE_SIZE;
         h.PhysicalMemoryBlock.Run[i] = (WinDumpPhyMemRun64) {
             .BasePage = ps->block[i].paddr / ELF2DMP_PAGE_SIZE,
             .PageCount = ps->block[i].size / ELF2DMP_PAGE_SIZE,
         };
     }
 
-    h.RequiredDumpSpace += h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
+    h.RequiredDumpSpace +=
+            h.PhysicalMemoryBlock.NumberOfPages << ELF2DMP_PAGE_BITS;
 
     *hdr = h;
 
@@ -XXX,XX +XXX,XX @@ static int fill_header(WinDumpHeader64 *hdr, struct pa_space *ps,
 static int fill_context(KDDEBUGGER_DATA64 *kdbg,
         struct va_space *vs, QEMU_Elf *qe)
 {
-        int i;
+    int i;
+
     for (i = 0; i < qe->state_nr; i++) {
         uint64_t Prcb;
         uint64_t Context;
-- 
2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Move out PE directory search functionality to be reused not only
for Debug Directory processing but for arbitrary PE directory.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Reviewed-by: Annie Li <annie.li@oracle.com>
Message-id: 20230222211246.883679-3-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/main.c | 71 +++++++++++++++++++++++++-----------------
 1 file changed, 42 insertions(+), 29 deletions(-)

diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@ static int fill_context(KDDEBUGGER_DATA64 *kdbg,
     return 0;
 }
 
+static int pe_get_data_dir_entry(uint64_t base, void *start_addr, int idx,
+        void *entry, size_t size, struct va_space *vs)
+{
+    const char e_magic[2] = "MZ";
+    const char Signature[4] = "PE\0\0";
+    IMAGE_DOS_HEADER *dos_hdr = start_addr;
+    IMAGE_NT_HEADERS64 nt_hdrs;
+    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
+    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
+    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
+
+    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
+
+    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
+        return 1;
+    }
+
+    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
+                &nt_hdrs, sizeof(nt_hdrs), 0)) {
+        return 1;
+    }
+
+    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
+            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
+        return 1;
+    }
+
+    if (va_space_rw(vs,
+                base + data_dir[idx].VirtualAddress,
+                entry, size, 0)) {
+        return 1;
+    }
+
+    printf("Data directory entry #%d: RVA = 0x%08"PRIx32"\n", idx,
+            (uint32_t)data_dir[idx].VirtualAddress);
+
+    return 0;
+}
+
 static int write_dump(struct pa_space *ps,
         WinDumpHeader64 *hdr, const char *name)
 {
@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
 static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
         char *hash, struct va_space *vs)
 {
-    const char e_magic[2] = "MZ";
-    const char Signature[4] = "PE\0\0";
     const char sign_rsds[4] = "RSDS";
-    IMAGE_DOS_HEADER *dos_hdr = start_addr;
-    IMAGE_NT_HEADERS64 nt_hdrs;
-    IMAGE_FILE_HEADER *file_hdr = &nt_hdrs.FileHeader;
-    IMAGE_OPTIONAL_HEADER64 *opt_hdr = &nt_hdrs.OptionalHeader;
-    IMAGE_DATA_DIRECTORY *data_dir = nt_hdrs.OptionalHeader.DataDirectory;
     IMAGE_DEBUG_DIRECTORY debug_dir;
     OMFSignatureRSDS rsds;
     char *pdb_name;
     size_t pdb_name_sz;
     size_t i;
 
-    QEMU_BUILD_BUG_ON(sizeof(*dos_hdr) >= ELF2DMP_PAGE_SIZE);
-
-    if (memcmp(&dos_hdr->e_magic, e_magic, sizeof(e_magic))) {
-        return 1;
-    }
-
-    if (va_space_rw(vs, base + dos_hdr->e_lfanew,
-                &nt_hdrs, sizeof(nt_hdrs), 0)) {
-        return 1;
-    }
-
-    if (memcmp(&nt_hdrs.Signature, Signature, sizeof(Signature)) ||
-            file_hdr->Machine != 0x8664 || opt_hdr->Magic != 0x020b) {
-        return 1;
-    }
-
-    printf("Debug Directory RVA = 0x%08"PRIx32"\n",
-            (uint32_t)data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress);
-
-    if (va_space_rw(vs,
-                base + data_dir[IMAGE_FILE_DEBUG_DIRECTORY].VirtualAddress,
-                &debug_dir, sizeof(debug_dir), 0)) {
+    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_DEBUG_DIRECTORY,
+                &debug_dir, sizeof(debug_dir), vs)) {
+        eprintf("Failed to get Debug Directory\n");
         return 1;
     }
 
-- 
2.34.1

From: Viktor Prutyanov <viktor@daynix.com>

Since its inception elf2dmp has checked MZ signatures within an
address space above IDT[0] interrupt vector and took first PE image
found as Windows Kernel.
But in Windows Server 2022 memory dump this address space range is
full of invalid PE fragments and the tool must check that PE image
is 'ntoskrnl.exe' actually.
So, introduce additional validation by checking image name from
Export Directory against 'ntoskrnl.exe'.

Signed-off-by: Viktor Prutyanov <viktor@daynix.com>
Tested-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Reviewed-by: Annie Li <annie.li@oracle.com>
Message-id: 20230222211246.883679-4-viktor@daynix.com
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 contrib/elf2dmp/pe.h   | 15 +++++++++++++++
 contrib/elf2dmp/main.c | 28 ++++++++++++++++++++++++++--
 2 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/contrib/elf2dmp/pe.h b/contrib/elf2dmp/pe.h
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/pe.h
+++ b/contrib/elf2dmp/pe.h
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_NT_HEADERS64 {
     IMAGE_OPTIONAL_HEADER64 OptionalHeader;
 } __attribute__ ((packed)) IMAGE_NT_HEADERS64;
 
+typedef struct IMAGE_EXPORT_DIRECTORY {
+    uint32_t    Characteristics;
+    uint32_t    TimeDateStamp;
+    uint16_t    MajorVersion;
+    uint16_t    MinorVersion;
+    uint32_t    Name;
+    uint32_t    Base;
+    uint32_t    NumberOfFunctions;
+    uint32_t    NumberOfNames;
+    uint32_t    AddressOfFunctions;
+    uint32_t    AddressOfNames;
+    uint32_t    AddressOfNameOrdinals;
+} __attribute__ ((packed)) IMAGE_EXPORT_DIRECTORY;
+
 typedef struct IMAGE_DEBUG_DIRECTORY {
     uint32_t Characteristics;
     uint32_t TimeDateStamp;
@@ -XXX,XX +XXX,XX @@ typedef struct IMAGE_DEBUG_DIRECTORY {
 #define IMAGE_DEBUG_TYPE_CODEVIEW   2
 #endif
 
+#define IMAGE_FILE_EXPORT_DIRECTORY 0
 #define IMAGE_FILE_DEBUG_DIRECTORY  6
 
 typedef struct guid_t {
diff --git a/contrib/elf2dmp/main.c b/contrib/elf2dmp/main.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/elf2dmp/main.c
+++ b/contrib/elf2dmp/main.c
@@ -XXX,XX +XXX,XX @@
 
 #define SYM_URL_BASE    "https://msdl.microsoft.com/download/symbols/"
 #define PDB_NAME    "ntkrnlmp.pdb"
+#define PE_NAME     "ntoskrnl.exe"
 
 #define INITIAL_MXCSR   0x1f80
 
@@ -XXX,XX +XXX,XX @@ static int write_dump(struct pa_space *ps,
     return fclose(dmp_file);
 }
 
+static bool pe_check_export_name(uint64_t base, void *start_addr,
+        struct va_space *vs)
+{
+    IMAGE_EXPORT_DIRECTORY export_dir;
+    const char *pe_name;
+
+    if (pe_get_data_dir_entry(base, start_addr, IMAGE_FILE_EXPORT_DIRECTORY,
+                &export_dir, sizeof(export_dir), vs)) {
+        return false;
+    }
+
+    pe_name = va_space_resolve(vs, base + export_dir.Name);
+    if (!pe_name) {
+        return false;
+    }
+
+    return !strcmp(pe_name, PE_NAME);
+}
+
 static int pe_get_pdb_symstore_hash(uint64_t base, void *start_addr,
         char *hash, struct va_space *vs)
 {
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
     uint64_t KdDebuggerDataBlock;
     KDDEBUGGER_DATA64 *kdbg;
     uint64_t KdVersionBlock;
+    bool kernel_found = false;
 
     if (argc != 3) {
         eprintf("usage:\n\t%s elf_file dmp_file\n", argv[0]);
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
         }
 
         if (*(uint16_t *)nt_start_addr == 0x5a4d) { /* MZ */
-            break;
+            if (pe_check_export_name(KernBase, nt_start_addr, &vs)) {
+                kernel_found = true;
+                break;
+            }
         }
     }
 
-    if (!nt_start_addr) {
+    if (!kernel_found) {
         eprintf("Failed to find NT kernel image\n");
         err = 1;
         goto out_ps;
-- 
2.34.1

From: Guenter Roeck <linux@roeck-us.net>

The i.MX USB Phy driver does not check register ranges, resulting in out of
bounds accesses if an attempt is made to access non-existing PHY registers.
Add range check and conditionally report bad accesses to fix the problem.

While at it, also conditionally log attempted writes to non-existing or
read-only registers.

Reported-by: Qiang Liu <cyruscyliu@gmail.com>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Tested-by: Qiang Liu <cyruscyliu@gmail.com>
Message-id: 20230316234926.208874-1-linux@roeck-us.net
Link: https://gitlab.com/qemu-project/qemu/-/issues/1408
Fixes: 0701a5efa015 ("hw/usb: Add basic i.MX USB Phy support")
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 hw/usb/imx-usb-phy.c | 19 +++++++++++++++++--
 1 file changed, 17 insertions(+), 2 deletions(-)

diff --git a/hw/usb/imx-usb-phy.c b/hw/usb/imx-usb-phy.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/imx-usb-phy.c
+++ b/hw/usb/imx-usb-phy.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include "hw/usb/imx-usb-phy.h"
 #include "migration/vmstate.h"
+#include "qemu/log.h"
 #include "qemu/module.h"
 
 static const VMStateDescription vmstate_imx_usbphy = {
@@ -XXX,XX +XXX,XX @@ static uint64_t imx_usbphy_read(void *opaque, hwaddr offset, unsigned size)
         value = s->usbphy[index - 3];
         break;
     default:
-        value = s->usbphy[index];
+        if (index < USBPHY_MAX) {
+            value = s->usbphy[index];
+        } else {
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "%s: Read from non-existing USB PHY register 0x%"
+                          HWADDR_PRIx "\n",
+                          __func__, offset);
+            value = 0;
+        }
         break;
     }
     return (uint64_t)value;
@@ -XXX,XX +XXX,XX @@ static void imx_usbphy_write(void *opaque, hwaddr offset, uint64_t value,
         s->usbphy[index - 3] ^= value;
         break;
     default:
-        /* Other registers are read-only */
+        /* Other registers are read-only or do not exist */
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: Write to %s USB PHY register 0x%"
+                      HWADDR_PRIx "\n",
+                      __func__,
+                      index >= USBPHY_MAX ? "non-existing" : "read-only",
+                      offset);
         break;
     }
 }
-- 
2.34.1

The markup for the Arm CPU feature documentation is incorrect,
and results in the HTML not rendering correctly -- the first
line of each description is rendered in boldface as if it
were part of the option name.

Reformat to match the styling used in cpu-models-x86.rst.inc.

Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1479
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Message-id: 20230316105808.1414003-1-peter.maydell@linaro.org
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
---
 docs/system/arm/cpu-features.rst | 68 ++++++++++++++------------------
 1 file changed, 30 insertions(+), 38 deletions(-)

diff --git a/docs/system/arm/cpu-features.rst b/docs/system/arm/cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/arm/cpu-features.rst
+++ b/docs/system/arm/cpu-features.rst
@@ -XXX,XX +XXX,XX @@ are named with the prefix "kvm-".  KVM VCPU features may be probed,
 enabled, and disabled in the same way as other CPU features.  Below is
 the list of KVM VCPU features and their descriptions.
 
-  kvm-no-adjvtime          By default kvm-no-adjvtime is disabled.  This
-                           means that by default the virtual time
-                           adjustment is enabled (vtime is not *not*
-                           adjusted).
+``kvm-no-adjvtime``
+  By default kvm-no-adjvtime is disabled.  This means that by default
+  the virtual time adjustment is enabled (vtime is not *not* adjusted).
 
-                           When virtual time adjustment is enabled each
-                           time the VM transitions back to running state
-                           the VCPU's virtual counter is updated to ensure
-                           stopped time is not counted.  This avoids time
-                           jumps surprising guest OSes and applications,
-                           as long as they use the virtual counter for
-                           timekeeping.  However it has the side effect of
-                           the virtual and physical counters diverging.
-                           All timekeeping based on the virtual counter
-                           will appear to lag behind any timekeeping that
-                           does not subtract VM stopped time.  The guest
-                           may resynchronize its virtual counter with
-                           other time sources as needed.
+  When virtual time adjustment is enabled each time the VM transitions
+  back to running state the VCPU's virtual counter is updated to
+  ensure stopped time is not counted.  This avoids time jumps
+  surprising guest OSes and applications, as long as they use the
+  virtual counter for timekeeping.  However it has the side effect of
+  the virtual and physical counters diverging.  All timekeeping based
+  on the virtual counter will appear to lag behind any timekeeping
+  that does not subtract VM stopped time.  The guest may resynchronize
+  its virtual counter with other time sources as needed.
 
-                           Enable kvm-no-adjvtime to disable virtual time
-                           adjustment, also restoring the legacy (pre-5.0)
-                           behavior.
+  Enable kvm-no-adjvtime to disable virtual time adjustment, also
+  restoring the legacy (pre-5.0) behavior.
 
-  kvm-steal-time           Since v5.2, kvm-steal-time is enabled by
-                           default when KVM is enabled, the feature is
-                           supported, and the guest is 64-bit.
+``kvm-steal-time``
+  Since v5.2, kvm-steal-time is enabled by default when KVM is
+  enabled, the feature is supported, and the guest is 64-bit.
 
-                           When kvm-steal-time is enabled a 64-bit guest
-                           can account for time its CPUs were not running
-                           due to the host not scheduling the corresponding
-                           VCPU threads.  The accounting statistics may
-                           influence the guest scheduler behavior and/or be
-                           exposed to the guest userspace.
+  When kvm-steal-time is enabled a 64-bit guest can account for time
+  its CPUs were not running due to the host not scheduling the
+  corresponding VCPU threads.  The accounting statistics may influence
+  the guest scheduler behavior and/or be exposed to the guest
+  userspace.
 
 TCG VCPU Features
 =================
@@ -XXX,XX +XXX,XX @@ TCG VCPU Features
 TCG VCPU features are CPU features that are specific to TCG.
 Below is the list of TCG VCPU features and their descriptions.
 
-  pauth-impdef             When ``FEAT_Pauth`` is enabled, either the
-                           *impdef* (Implementation Defined) algorithm
-                           is enabled or the *architected* QARMA algorithm
-                           is enabled.  By default the impdef algorithm
-                           is disabled, and QARMA is enabled.
+``pauth-impdef``
+  When ``FEAT_Pauth`` is enabled, either the *impdef* (Implementation
+  Defined) algorithm is enabled or the *architected* QARMA algorithm
+  is enabled.  By default the impdef algorithm is disabled, and QARMA
+  is enabled.
 
-                           The architected QARMA algorithm has good
-                           cryptographic properties, but can be quite slow
-                           to emulate.  The impdef algorithm used by QEMU
-                           is non-cryptographic but significantly faster.
+  The architected QARMA algorithm has good cryptographic properties,
+  but can be quite slow to emulate.  The impdef algorithm used by QEMU
+  is non-cryptographic but significantly faster.
 
 SVE CPU Properties
 ==================
-- 
2.34.1

Unfortunately a bug in older versions of gdb means that they will
crash if QEMU sends them the aarch64-pauth.xml.  This bug is fixed in
gdb commit 1ba3a3222039eb25, and there are plans to backport that to
affected gdb release branches, but since the bug affects gdb 9
through 12 it is very widely deployed (for instance by distros).

It is not currently clear what the best way to deal with this is; it
has been proposed to define a new XML feature name that old gdb will
ignore but newer gdb can handle.  Since QEMU's 8.0 release is
imminent and at least one of our CI runners is now falling over this,
disable the pauth XML for the moment.  We can follow up with a more
considered fix either in time for 8.0 or else for the 8.1 release.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
---
 target/arm/gdbstub.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/target/arm/gdbstub.c b/target/arm/gdbstub.c
index XXXXXXX..XXXXXXX 100644
--- a/target/arm/gdbstub.c
+++ b/target/arm/gdbstub.c
@@ -XXX,XX +XXX,XX @@ void arm_cpu_register_gdb_regs_for_features(ARMCPU *cpu)
                                      aarch64_gdb_set_fpu_reg,
                                      34, "aarch64-fpu.xml", 0);
         }
+#if 0
+        /*
+         * GDB versions 9 through 12 have a bug which means they will
+         * crash if they see this XML from QEMU; disable it for the 8.0
+         * release, pending a better solution.
+         */
         if (isar_feature_aa64_pauth(&cpu->isar)) {
             gdb_register_coprocessor(cs, aarch64_gdb_get_pauth_reg,
                                      aarch64_gdb_set_pauth_reg,
                                      4, "aarch64-pauth.xml", 0);
         }
+#endif
 #endif
     } else {
         if (arm_feature(env, ARM_FEATURE_NEON)) {
-- 
2.34.1