The following changes since commit 8cc30eb1400fc01f2b139cdd3dc524f8b84dbe07:

Philippe Mathieu-Daudé (10):

MAINTAINERS: Cover system/arm/cpu-features.rst with ARM TCG CPUs

MAINTAINERS: Cover system/arm/aspeed.rst with ASPEED BMC machines

MAINTAINERS: Cover system/arm/nuvoton.rst with Nuvoton NPCM7xx

MAINTAINERS: Fix system/arm/orangepi.rst path

MAINTAINERS: Cover system/arm/sbsa.rst with SBSA-REF machine

MAINTAINERS: Cover system/arm/sx1.rst with OMAP machines

docs/system: Deprecate raspi2/raspi3 machine aliases

docs/system/arm: Document the various raspi boards

docs/system/arm: Document OpenPOWER Witherspoon BMC model Front LEDs

docs/system/arm: Document the Sharp Zaurus SL-6000

Rémi Denis-Courmont (1):

target/arm: fix stage 2 page-walks in 32-bit emulation

docs/meson.build | 1 +

docs/system/arm/aspeed.rst | 1 +

docs/system/arm/raspi.rst | 43 +++++++++++++++

docs/system/arm/xscale.rst | 20 ++++---

docs/{ => system}/cpu-hotplug.rst | 0

docs/system/deprecated.rst | 7 +++

docs/{ => system/i386}/microvm.rst | 5 +-

docs/system/i386/pc.rst | 7 +++

docs/system/index.rst | 4 ++

docs/{ => system}/pr-manager.rst | 44 +++------------

docs/system/target-arm.rst | 1 +

docs/system/target-i386.rst | 19 +++++--

docs/{ => system}/virtio-net-failover.rst | 0

docs/system/virtio-pmem.rst | 76 ++++++++++++++++++++++++++

docs/tools/conf.py | 2 +

docs/tools/index.rst | 1 +

docs/tools/qemu-pr-helper.rst | 90 +++++++++++++++++++++++++++++++

docs/virtio-pmem.rst | 76 --------------------------

hw/arm/pxa2xx.c | 2 +-

hw/arm/spitz.c | 2 +-

hw/arm/tosa.c | 2 +-

hw/intc/rx_icu.c | 18 +++----

linux-user/arm/cpu_loop.c | 28 ++++++++++

target/arm/arm-semi.c | 12 +++--

target/arm/helper.c | 4 +-

MAINTAINERS | 8 ++-

26 files changed, 326 insertions(+), 147 deletions(-)

create mode 100644 docs/system/arm/raspi.rst

rename docs/{ => system}/cpu-hotplug.rst (100%)

rename docs/{ => system/i386}/microvm.rst (98%)

create mode 100644 docs/system/i386/pc.rst

rename docs/{ => system}/pr-manager.rst (68%)

rename docs/{ => system}/virtio-net-failover.rst (100%)

create mode 100644 docs/system/virtio-pmem.rst

create mode 100644 docs/tools/qemu-pr-helper.rst

delete mode 100644 docs/virtio-pmem.rst

From: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

Using a target unsigned long would limit the Input Address to a LPAE

page-walk to 32 bits on AArch32 and 64 bits on AArch64. This is okay

for stage 1 or on AArch64, but it is insufficient for stage 2 on

AArch32. In that later case, the Input Address can have up to 40 bits.

Signed-off-by: Rémi Denis-Courmont <remi.denis.courmont@huawei.com>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20201118150414.18360-1-remi@remlab.net

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

target/arm/helper.c | 4 ++--

1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/target/arm/helper.c b/target/arm/helper.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/helper.c

+++ b/target/arm/helper.c

@@ -XXX,XX +XXX,XX @@

#ifndef CONFIG_USER_ONLY

-static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,

+static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,

MMUAccessType access_type, ARMMMUIdx mmu_idx,

bool s1_is_el0,

hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,

@@ -XXX,XX +XXX,XX @@ static ARMVAParameters aa32_va_parameters(CPUARMState *env, uint32_t va,

* @fi: set to fault info if the translation fails

* @cacheattrs: (if non-NULL) set to the cacheability/shareability attributes

*/

-static bool get_phys_addr_lpae(CPUARMState *env, target_ulong address,

+static bool get_phys_addr_lpae(CPUARMState *env, uint64_t address,

MMUAccessType access_type, ARMMMUIdx mmu_idx,

bool s1_is_el0,

hwaddr *phys_ptr, MemTxAttrs *txattrs, int *prot,

--

2.20.1

From: AlexChen <alex.chen@huawei.com>

We should use printf format specifier "%u" instead of "%i" for

argument of type "unsigned int".

Reported-by: Euler Robot <euler.robot@huawei.com>

Signed-off-by: Alex Chen <alex.chen@huawei.com>

Message-id: 5F9FD78B.8000300@huawei.com

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/arm/pxa2xx.c | 2 +-

hw/arm/spitz.c | 2 +-

hw/arm/tosa.c | 2 +-

3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/hw/arm/pxa2xx.c b/hw/arm/pxa2xx.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/pxa2xx.c

+++ b/hw/arm/pxa2xx.c

@@ -XXX,XX +XXX,XX @@ static void pxa2xx_ssp_write(void *opaque, hwaddr addr,

if (value & SSCR0_MOD)

printf("%s: Attempt to use network mode\n", __func__);

if (s->enable && SSCR0_DSS(value) < 4)

- printf("%s: Wrong data size: %i bits\n", __func__,

+ printf("%s: Wrong data size: %u bits\n", __func__,

SSCR0_DSS(value));

if (!(value & SSCR0_SSE)) {

s->sssr = 0;

diff --git a/hw/arm/spitz.c b/hw/arm/spitz.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/spitz.c

+++ b/hw/arm/spitz.c

@@ -XXX,XX +XXX,XX @@ struct SpitzLCDTG {

static void spitz_bl_update(SpitzLCDTG *s)

{

if (s->bl_power && s->bl_intensity)

- zaurus_printf("LCD Backlight now at %i/63\n", s->bl_intensity);

+ zaurus_printf("LCD Backlight now at %u/63\n", s->bl_intensity);

else

zaurus_printf("LCD Backlight now off\n");

}

diff --git a/hw/arm/tosa.c b/hw/arm/tosa.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/arm/tosa.c

+++ b/hw/arm/tosa.c

@@ -XXX,XX +XXX,XX @@ static void tosa_gpio_setup(PXA2xxState *cpu,

static uint32_t tosa_ssp_tansfer(SSISlave *dev, uint32_t value)

{

- fprintf(stderr, "TG: %d %02x\n", value >> 5, value & 0x1f);

+ fprintf(stderr, "TG: %u %02x\n", value >> 5, value & 0x1f);

return 0;

}

--

2.20.1

From: Chen Qun <kuhn.chenqun@huawei.com>

When 'j = icu->nr_sense – 1', the 'j < icu->nr_sense' condition is true,

then 'j = icu->nr_sense', the'icu->init_sense[j]' has out-of-bounds access.

The asan showed stack:

ERROR: AddressSanitizer: heap-buffer-overflow on address 0x604000004d7d at pc 0x55852cd26a76 bp 0x7ffe39f26200 sp 0x7ffe39f261f0

READ of size 1 at 0x604000004d7d thread T0

#0 0x55852cd26a75 in rxicu_realize ../hw/intc/rx_icu.c:311

#1 0x55852cf075f7 in device_set_realized ../hw/core/qdev.c:886

#2 0x55852cd4a32f in property_set_bool ../qom/object.c:2251

#3 0x55852cd4f9bb in object_property_set ../qom/object.c:1398

#4 0x55852cd54f3f in object_property_set_qobject ../qom/qom-qobject.c:28

#5 0x55852cd4fc3f in object_property_set_bool ../qom/object.c:1465

#6 0x55852cbf0b27 in register_icu ../hw/rx/rx62n.c:156

#7 0x55852cbf12a6 in rx62n_realize ../hw/rx/rx62n.c:261

#8 0x55852cf075f7 in device_set_realized ../hw/core/qdev.c:886

#9 0x55852cd4a32f in property_set_bool ../qom/object.c:2251

#10 0x55852cd4f9bb in object_property_set ../qom/object.c:1398

#11 0x55852cd54f3f in object_property_set_qobject ../qom/qom-qobject.c:28

#12 0x55852cd4fc3f in object_property_set_bool ../qom/object.c:1465

#13 0x55852cbf1a85 in rx_gdbsim_init ../hw/rx/rx-gdbsim.c:109

#14 0x55852cd22de0 in qemu_init ../softmmu/vl.c:4380

#15 0x55852ca57088 in main ../softmmu/main.c:49

#16 0x7feefafa5d42 in __libc_start_main (/lib64/libc.so.6+0x26d42)

Add the 'ice->src[i].sense' initialize to the default value, and then

process init_sense array to identify which irqs should be level-triggered.

Suggested-by: Peter Maydell <peter.maydell@linaro.org>

Reported-by: Euler Robot <euler.robot@huawei.com>

Signed-off-by: Chen Qun <kuhn.chenqun@huawei.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Message-id: 20201111141733.2358800-1-kuhn.chenqun@huawei.com

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

hw/intc/rx_icu.c | 18 ++++++++----------

1 file changed, 8 insertions(+), 10 deletions(-)

diff --git a/hw/intc/rx_icu.c b/hw/intc/rx_icu.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/intc/rx_icu.c

+++ b/hw/intc/rx_icu.c

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps icu_ops = {

static void rxicu_realize(DeviceState *dev, Error **errp)

{

RXICUState *icu = RX_ICU(dev);

- int i, j;

+ int i;

if (icu->init_sense == NULL) {

qemu_log_mask(LOG_GUEST_ERROR,

"rx_icu: trigger-level property must be set.");

return;

}

- for (i = j = 0; i < NR_IRQS; i++) {

- if (icu->init_sense[j] == i) {

- icu->src[i].sense = TRG_LEVEL;

- if (j < icu->nr_sense) {

- j++;

- }

- } else {

- icu->src[i].sense = TRG_PEDGE;

- }

+

+ for (i = 0; i < NR_IRQS; i++) {

+ icu->src[i].sense = TRG_PEDGE;

+ }

+ for (i = 0; i < icu->nr_sense; i++) {

+ uint8_t irqno = icu->init_sense[i];

+ icu->src[irqno].sense = TRG_LEVEL;

}

icu->req_irq = -1;

}

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201120154545.2504625-2-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

MAINTAINERS | 1 +

1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS

index XXXXXXX..XXXXXXX 100644

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ F: disas/arm.c

F: disas/arm-a64.cc

F: disas/libvixl/

F: docs/system/target-arm.rst

+F: docs/system/arm/cpu-features.rst

ARM SMMU

M: Eric Auger <eric.auger@redhat.com>

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Message-id: 20201120154545.2504625-3-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

MAINTAINERS | 1 +

1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS

index XXXXXXX..XXXXXXX 100644

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ F: include/hw/*/*aspeed*

F: include/hw/misc/pca9552*.h

F: hw/net/ftgmac100.c

F: include/hw/net/ftgmac100.h

+F: docs/system/arm/aspeed.rst

NRF51

M: Joel Stanley <joel@jms.id.au>

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201120154545.2504625-4-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

MAINTAINERS | 1 +

1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS

index XXXXXXX..XXXXXXX 100644

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ F: include/hw/*/npcm7xx*

F: tests/qtest/npcm7xx*

F: pc-bios/npcm7xx_bootrom.bin

F: roms/vbootrom

+F: docs/system/arm/nuvoton.rst

nSeries

M: Andrzej Zaborowski <balrogg@gmail.com>

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Fixes: 0553ef42571 ("docs: add Orange Pi PC document")

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com>

Message-id: 20201120154545.2504625-5-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

MAINTAINERS | 2 +-

1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/MAINTAINERS b/MAINTAINERS

index XXXXXXX..XXXXXXX 100644

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ S: Maintained

F: hw/*/allwinner-h3*

F: include/hw/*/allwinner-h3*

F: hw/arm/orangepi.c

-F: docs/system/orangepi.rst

+F: docs/system/arm/orangepi.rst

ARM PrimeCell and CMSDK devices

M: Peter Maydell <peter.maydell@linaro.org>

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201120154545.2504625-6-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

MAINTAINERS | 1 +

1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS

index XXXXXXX..XXXXXXX 100644

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ R: Leif Lindholm <leif@nuviainc.com>

L: qemu-arm@nongnu.org

S: Maintained

F: hw/arm/sbsa-ref.c

+F: docs/system/arm/sbsa.rst

Sharp SL-5500 (Collie) PDA

M: Peter Maydell <peter.maydell@linaro.org>

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201120154545.2504625-7-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

MAINTAINERS | 1 +

1 file changed, 1 insertion(+)

diff --git a/MAINTAINERS b/MAINTAINERS

index XXXXXXX..XXXXXXX 100644

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ L: qemu-arm@nongnu.org

S: Maintained

F: hw/*/omap*

F: include/hw/arm/omap.h

+F: docs/system/arm/sx1.rst

IPack

M: Alberto Garcia <berto@igalia.com>

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Since commit aa35ec2213b ("hw/arm/raspi: Use more specific

machine names") the raspi2/raspi3 machines have been renamed

as raspi2b/raspi3b.

Note, rather than the raspi3b, the raspi3ap introduced in

commit 5be94252d34 ("hw/arm/raspi: Add the Raspberry Pi 3

model A+") is a closer match to what QEMU models, but only

provides 512 MB of RAM.

As more Raspberry Pi 2/3 models are emulated, in order

to avoid confusion, deprecate the raspi2/raspi3 machine

aliases.

ACKed-by: Peter Krempa <pkrempa@redhat.com>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201120173953.2539469-2-f4bug@amsat.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

docs/system/deprecated.rst | 7 +++++++

1 file changed, 7 insertions(+)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/deprecated.rst

+++ b/docs/system/deprecated.rst

@@ -XXX,XX +XXX,XX @@ This machine has been renamed ``fuloong2e``.

These machine types are very old and likely can not be used for live migration

from old QEMU versions anymore. A newer machine type should be used instead.

+Raspberry Pi ``raspi2`` and ``raspi3`` machines (since 5.2)

+'''''''''''''''''''''''''''''''''''''''''''''''''''''''''''

+

+The Raspberry Pi machines come in various models (A, A+, B, B+). To be able

+to distinguish which model QEMU is implementing, the ``raspi2`` and ``raspi3``

+machines have been renamed ``raspi2b`` and ``raspi3b``.

+

Device options

--------------

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Document the following Raspberry Pi models:

- raspi0 Raspberry Pi Zero (revision 1.2)

- raspi1ap Raspberry Pi A+ (revision 1.1)

- raspi2b Raspberry Pi 2B (revision 1.1)

- raspi3ap Raspberry Pi 3A+ (revision 1.0)

- raspi3b Raspberry Pi 3B (revision 1.2)

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201120173953.2539469-3-f4bug@amsat.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

docs/system/arm/raspi.rst | 43 ++++++++++++++++++++++++++++++++++++++

docs/system/target-arm.rst | 1 +

MAINTAINERS | 1 +

3 files changed, 45 insertions(+)

create mode 100644 docs/system/arm/raspi.rst

diff --git a/docs/system/arm/raspi.rst b/docs/system/arm/raspi.rst

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/docs/system/arm/raspi.rst

@@ -XXX,XX +XXX,XX @@

+Raspberry Pi boards (``raspi0``, ``raspi1ap``, ``raspi2b``, ``raspi3ap``, ``raspi3b``)

+======================================================================================

+

+

+QEMU provides models of the following Raspberry Pi boards:

+

+``raspi0`` and ``raspi1ap``

+ ARM1176JZF-S core, 512 MiB of RAM

+``raspi2b``

+ Cortex-A7 (4 cores), 1 GiB of RAM

+``raspi3ap``

+ Cortex-A53 (4 cores), 512 MiB of RAM

+``raspi3b``

+ Cortex-A53 (4 cores), 1 GiB of RAM

+

+

+Implemented devices

+-------------------

+

+ * ARM1176JZF-S, Cortex-A7 or Cortex-A53 CPU

+ * Interrupt controller

+ * DMA controller

+ * Clock and reset controller (CPRMAN)

+ * System Timer

+ * GPIO controller

+ * Serial ports (BCM2835 AUX - 16550 based - and PL011)

+ * Random Number Generator (RNG)

+ * Frame Buffer

+ * USB host (USBH)

+ * GPIO controller

+ * SD/MMC host controller

+ * SoC thermal sensor

+ * USB2 host controller (DWC2 and MPHI)

+ * MailBox controller (MBOX)

+ * VideoCore firmware (property)

+

+

+Missing devices

+---------------

+

+ * Peripheral SPI controller (SPI)

+ * Analog to Digital Converter (ADC)

+ * Pulse Width Modulation (PWM)

diff --git a/docs/system/target-arm.rst b/docs/system/target-arm.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/target-arm.rst

+++ b/docs/system/target-arm.rst

@@ -XXX,XX +XXX,XX @@ undocumented; you can get a complete list by running

arm/nuvoton

arm/orangepi

arm/palm

+ arm/raspi

arm/xscale

arm/collie

arm/sx1

diff --git a/MAINTAINERS b/MAINTAINERS

index XXXXXXX..XXXXXXX 100644

--- a/MAINTAINERS

+++ b/MAINTAINERS

@@ -XXX,XX +XXX,XX @@ F: hw/arm/raspi_platform.h

F: hw/*/bcm283*

F: include/hw/arm/raspi*

F: include/hw/*/bcm283*

+F: docs/system/arm/raspi.rst

Real View

M: Peter Maydell <peter.maydell@linaro.org>

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Document the 3 front LEDs modeled on the OpenPOWER Witherspoon BMC

(see commit 7cfbde5ea1c "hw/arm/aspeed: Add the 3 front LEDs drived

by the PCA9552 #1").

Reviewed-by: Cédric Le Goater <clg@kaod.org>

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201120173953.2539469-4-f4bug@amsat.org

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

docs/system/arm/aspeed.rst | 1 +

1 file changed, 1 insertion(+)

diff --git a/docs/system/arm/aspeed.rst b/docs/system/arm/aspeed.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/arm/aspeed.rst

+++ b/docs/system/arm/aspeed.rst

@@ -XXX,XX +XXX,XX @@ Supported devices

* GPIO Controller (Master only)

* UART

* Ethernet controllers

+ * Front LEDs (PCA9552 on I2C bus)

Missing devices

--

2.20.1

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

List the 'tosa' machine with the XScale-based PDAs models.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Message-id: 20201120173953.2539469-5-f4bug@amsat.org

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

---

docs/system/arm/xscale.rst | 20 +++++++++++++-------

1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/docs/system/arm/xscale.rst b/docs/system/arm/xscale.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/arm/xscale.rst

+++ b/docs/system/arm/xscale.rst

@@ -XXX,XX +XXX,XX @@

-Sharp XScale-based PDA models (``akita``, ``borzoi``, ``spitz``, ``terrier``)

-=============================================================================

+Sharp XScale-based PDA models (``akita``, ``borzoi``, ``spitz``, ``terrier``, ``tosa``)

+=======================================================================================

-The XScale-based clamshell PDA models (\"Spitz\", \"Akita\", \"Borzoi\"

-and \"Terrier\") emulation includes the following peripherals:

+The Sharp Zaurus are PDAs based on XScale, able to run Linux ('SL series').

-- Intel PXA270 System-on-chip (ARMv5TE core)

+The SL-6000 (\"Tosa\"), released in 2005, uses a PXA255 System-on-chip.

-- NAND Flash memory

+The SL-C3000 (\"Spitz\"), SL-C1000 (\"Akita\"), SL-C3100 (\"Borzoi\") and

+SL-C3200 (\"Terrier\") use a PXA270.

+

+The clamshell PDA models emulation includes the following peripherals:

+

+- Intel PXA255/PXA270 System-on-chip (ARMv5TE core)

+

+- NAND Flash memory - not in \"Tosa\"

- IBM/Hitachi DSCM microdrive in a PXA PCMCIA slot - not in \"Akita\"

-- On-chip OHCI USB controller

+- On-chip OHCI USB controller - not in \"Tosa\"

- On-chip LCD controller

--

2.20.1

The semihosting SYS_HEAPINFO call is supposed to return an array

of four guest addresses:

* base of heap memory

* limit of heap memory

* base of stack memory

* limit of stack memory

Some semihosting programs (including those compiled to use the

'newlib' embedded C library) use this call to work out where they

should initialize themselves to.

QEMU's implementation when in system emulation mode is very

simplistic: we say that the heap starts halfway into RAM and

continues to the end of RAM, and the stack starts at the top of RAM

and works down to the bottom. Unfortunately the code assumes that

the base address of RAM is at address 0, so on boards like 'virt'

where this is not true the addresses returned will all be wrong and

the guest application will usually crash.

Conveniently since all Arm boards call arm_load_kernel() we have the

base address of the main RAM block in the arm_boot_info struct which

is accessible via the CPU object. Use this to return sensible values

from SYS_HEAPINFO.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Message-id: 20201119092346.32356-1-peter.maydell@linaro.org

---

target/arm/arm-semi.c | 12 ++++++++----

1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/target/arm/arm-semi.c b/target/arm/arm-semi.c

index XXXXXXX..XXXXXXX 100644

--- a/target/arm/arm-semi.c

+++ b/target/arm/arm-semi.c

@@ -XXX,XX +XXX,XX @@

#else

#include "exec/gdbstub.h"

#include "qemu/cutils.h"

+#include "hw/arm/boot.h"

#endif

#define TARGET_SYS_OPEN 0x01

@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)

int i;

#ifdef CONFIG_USER_ONLY

TaskState *ts = cs->opaque;

+#else

+ const struct arm_boot_info *info = env->boot_info;

+ target_ulong rambase = info->loader_start;

#endif

GET_ARG(0);

@@ -XXX,XX +XXX,XX @@ target_ulong do_arm_semihosting(CPUARMState *env)

#else

limit = ram_size;

/* TODO: Make this use the limit of the loaded application. */

- retvals[0] = limit / 2;

- retvals[1] = limit;

- retvals[2] = limit; /* Stack base */

- retvals[3] = 0; /* Stack limit. */

+ retvals[0] = rambase + limit / 2;

+ retvals[1] = rambase + limit;

+ retvals[2] = rambase + limit; /* Stack base */

+ retvals[3] = rambase; /* Stack limit. */

#endif

for (i = 0; i < ARRAY_SIZE(retvals); i++) {

--

2.20.1

The Linux kernel doesn't use the official bkpt insn for breakpoints;

instead it uses three instructions in the guaranteed-to-UNDEF space,

and generates SIGTRAP for these rather than the SIGILL that most

UNDEF insns generate:

https://elixir.bootlin.com/linux/v5.9.8/source/arch/arm/kernel/ptrace.c#L197

Make QEMU treat these insns specially too. The main benefit of this

is that if you're running a debugger on a guest program that runs

into a GCC __builtin_trap() or LLVM "trap because execution should

never reach here" then you'll get the expected signal rather than a

SIGILL.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>

Message-id: 20201117155634.6924-1-peter.maydell@linaro.org

---

linux-user/arm/cpu_loop.c | 28 ++++++++++++++++++++++++++++

1 file changed, 28 insertions(+)

diff --git a/linux-user/arm/cpu_loop.c b/linux-user/arm/cpu_loop.c

index XXXXXXX..XXXXXXX 100644

--- a/linux-user/arm/cpu_loop.c

+++ b/linux-user/arm/cpu_loop.c

@@ -XXX,XX +XXX,XX @@ do_kernel_trap(CPUARMState *env)

return 0;

}

+static bool insn_is_linux_bkpt(uint32_t opcode, bool is_thumb)

+{

+ /*

+ * Return true if this insn is one of the three magic UDF insns

+ * which the kernel treats as breakpoint insns.

+ */

+ if (!is_thumb) {

+ return (opcode & 0x0fffffff) == 0x07f001f0;

+ } else {

+ /*

+ * Note that we get the two halves of the 32-bit T32 insn

+ * in the opposite order to the value the kernel uses in

+ * its undef_hook struct.

+ */

+ return ((opcode & 0xffff) == 0xde01) || (opcode == 0xa000f7f0);

+ }

+}

+

void cpu_loop(CPUARMState *env)

{

CPUState *cs = env_cpu(env);

@@ -XXX,XX +XXX,XX @@ void cpu_loop(CPUARMState *env)

/* FIXME - what to do if get_user() fails? */

get_user_code_u32(opcode, env->regs[15], env);

+ /*

+ * The Linux kernel treats some UDF patterns specially

+ * to use as breakpoints (instead of the architectural

+ * bkpt insn). These should trigger a SIGTRAP rather

+ * than SIGILL.

+ */

+ if (insn_is_linux_bkpt(opcode, env->thumb)) {

+ goto excp_debug;

+ }

+

rc = EmulateAll(opcode, &ts->fpa, env);

if (rc == 0) { /* illegal instruction */

info.si_signo = TARGET_SIGILL;

--

2.20.1

The virtio-net-failover documentation is currently orphan and

not included in any manual; move it into the system manual,

immediately following the general network emulation section.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

---

docs/system/index.rst | 1 +

docs/{ => system}/virtio-net-failover.rst | 0

2 files changed, 1 insertion(+)

rename docs/{ => system}/virtio-net-failover.rst (100%)

diff --git a/docs/system/index.rst b/docs/system/index.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/index.rst

+++ b/docs/system/index.rst

@@ -XXX,XX +XXX,XX @@ Contents:

monitor

images

net

+ virtio-net-failover

usb

ivshmem

linuxboot

diff --git a/docs/virtio-net-failover.rst b/docs/system/virtio-net-failover.rst

similarity index 100%

rename from docs/virtio-net-failover.rst

rename to docs/system/virtio-net-failover.rst

--

2.20.1

The cpu-hotplug.rst documentation is currently orphan and not

included in any manual; move it into the system manual.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

---

docs/{ => system}/cpu-hotplug.rst | 0

docs/system/index.rst | 1 +

2 files changed, 1 insertion(+)

rename docs/{ => system}/cpu-hotplug.rst (100%)

diff --git a/docs/cpu-hotplug.rst b/docs/system/cpu-hotplug.rst

similarity index 100%

rename from docs/cpu-hotplug.rst

rename to docs/system/cpu-hotplug.rst

diff --git a/docs/system/index.rst b/docs/system/index.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/index.rst

+++ b/docs/system/index.rst

@@ -XXX,XX +XXX,XX @@ Contents:

tls

gdb

managed-startup

+ cpu-hotplug

targets

security

deprecated

--

2.20.1

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

---

docs/system/index.rst | 1 +

docs/{ => system}/virtio-pmem.rst | 0

2 files changed, 1 insertion(+)

rename docs/{ => system}/virtio-pmem.rst (100%)

diff --git a/docs/system/index.rst b/docs/system/index.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/index.rst

+++ b/docs/system/index.rst

@@ -XXX,XX +XXX,XX @@ Contents:

gdb

managed-startup

cpu-hotplug

+ virtio-pmem

targets

security

deprecated

diff --git a/docs/virtio-pmem.rst b/docs/system/virtio-pmem.rst

similarity index 100%

rename from docs/virtio-pmem.rst

rename to docs/system/virtio-pmem.rst

--

2.20.1

The virtio-pmem documentation has some minor style issues we hadn't

noticed since we weren't rendering it in our docs:

* Sphinx doesn't complain about overlong title-underlining the

way it complains about too-short underlining, but it looks odd;

make the underlines of section headers the right length

* Indent of paragraphs makes them render as blockquotes;

remove the indent so they just render as normal text

* Leading 'o' isn't rst markup, so it just renders as a literal

"o"; reformat as a subsection heading instead

* "QEMU" in the document title and section headings are a bit

odd and unnecessary since this is the QEMU manual; delete

or rephrase them

* There's no need to specify what QEMU version the device first

appeared in.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

Reviewed-by: Pankaj Gupta <pankaj.gupta@cloud.ionos.com>

---

docs/system/virtio-pmem.rst | 60 ++++++++++++++++++-------------------

1 file changed, 30 insertions(+), 30 deletions(-)

diff --git a/docs/system/virtio-pmem.rst b/docs/system/virtio-pmem.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/virtio-pmem.rst

+++ b/docs/system/virtio-pmem.rst

@@ -XXX,XX +XXX,XX @@

-========================

-QEMU virtio pmem

-========================

+===========

+virtio pmem

+===========

- This document explains the setup and usage of the virtio pmem device

- which is available since QEMU v4.1.0.

-

- The virtio pmem device is a paravirtualized persistent memory device

- on regular (i.e non-NVDIMM) storage.

+This document explains the setup and usage of the virtio pmem device.

+The virtio pmem device is a paravirtualized persistent memory device

+on regular (i.e non-NVDIMM) storage.

Usecase

---------

+-------

- Virtio pmem allows to bypass the guest page cache and directly use

- host page cache. This reduces guest memory footprint as the host can

- make efficient memory reclaim decisions under memory pressure.

+Virtio pmem allows to bypass the guest page cache and directly use

+host page cache. This reduces guest memory footprint as the host can

+make efficient memory reclaim decisions under memory pressure.

-o How does virtio-pmem compare to the nvdimm emulation supported by QEMU?

+How does virtio-pmem compare to the nvdimm emulation?

+-----------------------------------------------------

- NVDIMM emulation on regular (i.e. non-NVDIMM) host storage does not

- persist the guest writes as there are no defined semantics in the device

- specification. The virtio pmem device provides guest write persistence

- on non-NVDIMM host storage.

+NVDIMM emulation on regular (i.e. non-NVDIMM) host storage does not

+persist the guest writes as there are no defined semantics in the device

+specification. The virtio pmem device provides guest write persistence

+on non-NVDIMM host storage.

virtio pmem usage

-----------------

- A virtio pmem device backed by a memory-backend-file can be created on

- the QEMU command line as in the following example::

+A virtio pmem device backed by a memory-backend-file can be created on

+the QEMU command line as in the following example::

-object memory-backend-file,id=mem1,share,mem-path=./virtio_pmem.img,size=4G

-device virtio-pmem-pci,memdev=mem1,id=nv1

- where:

+where:

- "object memory-backend-file,id=mem1,share,mem-path=<image>, size=<image size>"

creates a backend file with the specified size.

@@ -XXX,XX +XXX,XX @@ virtio pmem usage

- "device virtio-pmem-pci,id=nvdimm1,memdev=mem1" creates a virtio pmem

pci device whose storage is provided by above memory backend device.

- Multiple virtio pmem devices can be created if multiple pairs of "-object"

- and "-device" are provided.

+Multiple virtio pmem devices can be created if multiple pairs of "-object"

+and "-device" are provided.

Hotplug

-------

@@ -XXX,XX +XXX,XX @@ the guest::

Guest Data Persistence

----------------------

- Guest data persistence on non-NVDIMM requires guest userspace applications

- to perform fsync/msync. This is different from a real nvdimm backend where

- no additional fsync/msync is required. This is to persist guest writes in

- host backing file which otherwise remains in host page cache and there is

- risk of losing the data in case of power failure.

+Guest data persistence on non-NVDIMM requires guest userspace applications

+to perform fsync/msync. This is different from a real nvdimm backend where

+no additional fsync/msync is required. This is to persist guest writes in

+host backing file which otherwise remains in host page cache and there is

+risk of losing the data in case of power failure.

- With virtio pmem device, MAP_SYNC mmap flag is not supported. This provides

- a hint to application to perform fsync for write persistence.

+With virtio pmem device, MAP_SYNC mmap flag is not supported. This provides

+a hint to application to perform fsync for write persistence.

Limitations

-------------

+-----------

+

- Real nvdimm device backend is not supported.

- virtio pmem hotunplug is not supported.

- ACPI NVDIMM features like regions/namespaces are not supported.

--

2.20.1

Currently target-i386.rst includes the documentation of the 'pc'

machine model inline. Split it out into its own file, in a

similar way to target-i386.rst; this gives us a place to put

documentation of other i386 machine models, such as 'microvm'.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

---

docs/system/i386/pc.rst | 7 +++++++

docs/system/target-i386.rst | 18 +++++++++++++-----

2 files changed, 20 insertions(+), 5 deletions(-)

create mode 100644 docs/system/i386/pc.rst

diff --git a/docs/system/i386/pc.rst b/docs/system/i386/pc.rst

new file mode 100644

index XXXXXXX..XXXXXXX

--- /dev/null

+++ b/docs/system/i386/pc.rst

@@ -XXX,XX +XXX,XX @@

+i440fx PC (``pc-i440fx``, ``pc``)

+=================================

+

+Peripherals

+~~~~~~~~~~~

+

+.. include:: ../target-i386-desc.rst.inc

diff --git a/docs/system/target-i386.rst b/docs/system/target-i386.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/target-i386.rst

+++ b/docs/system/target-i386.rst

@@ -XXX,XX +XXX,XX @@

.. _QEMU-PC-System-emulator:

-x86 (PC) System emulator

-------------------------

+x86 System emulator

+-------------------

.. _pcsys_005fdevices:

-Peripherals

-~~~~~~~~~~~

+Board-specific documentation

+~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-.. include:: target-i386-desc.rst.inc

+..

+ This table of contents should be kept sorted alphabetically

+ by the title text of each file, which isn't the same ordering

+ as an alphabetical sort by filename.

+

+.. toctree::

+ :maxdepth: 1

+

+ i386/pc

.. include:: cpu-models-x86.rst.inc

--

2.20.1

Now that target-i386.rst has a place to list documentation of

machines other than the 'pc' machine, we have a place we can

move the microvm documentation to.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

---

docs/{ => system/i386}/microvm.rst | 5 ++---

docs/system/target-i386.rst | 1 +

2 files changed, 3 insertions(+), 3 deletions(-)

rename docs/{ => system/i386}/microvm.rst (98%)

diff --git a/docs/microvm.rst b/docs/system/i386/microvm.rst

similarity index 98%

rename from docs/microvm.rst

rename to docs/system/i386/microvm.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/microvm.rst

+++ b/docs/system/i386/microvm.rst

@@ -XXX,XX +XXX,XX @@

-====================

-microvm Machine Type

-====================

+'microvm' virtual platform (``microvm``)

+========================================

``microvm`` is a machine type inspired by ``Firecracker`` and

constructed after its machine model.

diff --git a/docs/system/target-i386.rst b/docs/system/target-i386.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/target-i386.rst

+++ b/docs/system/target-i386.rst

@@ -XXX,XX +XXX,XX @@ Board-specific documentation

.. toctree::

:maxdepth: 1

+ i386/microvm

i386/pc

.. include:: cpu-models-x86.rst.inc

--

2.20.1

Move the pr-manager documentation into the system manual.

Some of it (the documentation of the pr-manager-helper tool)

should be in tools, but we will split it up after moving it.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

Reviewed-by: Alex Bennée <alex.bennee@linaro.org>

---

docs/system/index.rst | 1 +

docs/{ => system}/pr-manager.rst | 0

2 files changed, 1 insertion(+)

rename docs/{ => system}/pr-manager.rst (100%)

diff --git a/docs/system/index.rst b/docs/system/index.rst

index XXXXXXX..XXXXXXX 100644

--- a/docs/system/index.rst

+++ b/docs/system/index.rst

@@ -XXX,XX +XXX,XX @@ Contents:

managed-startup

cpu-hotplug

virtio-pmem

+ pr-manager

targets

security

deprecated

diff --git a/docs/pr-manager.rst b/docs/system/pr-manager.rst

similarity index 100%

rename from docs/pr-manager.rst

rename to docs/system/pr-manager.rst

--

2.20.1